HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.16017651 (B) (Emsisoft), Trojan.Generic.16017651 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 54df6fca578702630f554b7894d39967
SHA1: aa9656a6e4f7b038bf84e1f726126e6d3af23d75
SHA256: 467bc17532f51d4924ce0b3ffe804ca28c0606c7716bf52a4854637a8f712932
SSDeep: 98304:Y7crkUMKfhowjiRCzyqrCS5ySoFy6zOihGNENp:Y71UhZowjiR4yNS8SoFNHgop
Size: 3631123 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-03-01 13:53:03
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
regsvr32.exe:432
The Trojan injects its code into the following process(es):
%original file name%.exe:1788
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\ZCB_API.dll (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
Registry activity
The process regsvr32.exe:432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 3C 90 16 E3 4C 8C 3E 1B 1D 26 8A 79 CE A5 36"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\TypeLib]
"(Default)" = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\ProgID]
"(Default)" = "REGCOM.Register.Api.1"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\0\win32]
"(Default)" = "c:\ZCB_API.dll"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}]
"(Default)" = "ZCBApiPlug Class"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib]
"(Default)" = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\FLAGS]
"(Default)" = "0"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib]
"Version" = "1.0"
[HKCR\REGCOM.Register.Api\CurVer]
"(Default)" = "REGCOM.Register.Api.1"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0]
"(Default)" = "ZCB_APILib"
[HKCR\REGCOM.Register.Api.1\CLSID]
"(Default)" = "{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\VersionIndependentProgID]
"(Default)" = "REGCOM.Register.Api"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32]
"(Default)" = "c:\ZCB_API.dll"
[HKCR\REGCOM.Register.Api.1]
"(Default)" = "ZCBApiPlug Class"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}]
"(Default)" = "IZCBApiPlug"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\Version]
"(Default)" = "1.0"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\REGCOM.Register.Api]
"(Default)" = "ZCBApiPlug Class"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\HELPDIR]
"(Default)" = "c:"
The process %original file name%.exe:1788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C D4 41 0D E9 35 17 B0 5B 09 EC C3 F3 C9 B9 BA"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
2305a0666ee61c846ba2dade346e2980 | c:\ZCB_API.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
regsvr32.exe:432
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\ZCB_API.dll (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes) - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
vv 0 | 4096 | 2433024 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
vv 1 | 2437120 | 3465216 | 3464192 | 5.54514 | 71d663f81cece96ce469642c829bf57e |
.rsrc | 5902336 | 167936 | 165376 | 2.9642 | 8fd6a6699ebc2a64560caa1570620ded |
.vv | 6070272 | 512 | 512 | 4.75808 | 80360b4bf778bb1e919509f3c9456f5a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1788:
`.rsrc
`.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
Ntdll.dll
Ntdll.dll
Kernel32.dll
Kernel32.dll
Psapi.dll
Psapi.dll
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
advapi32.dll
advapi32.dll
wininet.dll
wininet.dll
shlwapi.dll
shlwapi.dll
Shlwapi.dll
Shlwapi.dll
shell32.dll
shell32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
RegOpenKeyA
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyA
RegCloseKey
RegCloseKey
RegEnumKeyA
RegEnumKeyA
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
ShellExecuteA
ShellExecuteA
110notepad.exe
110notepad.exe
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}
HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}
HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}
HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}
HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}
HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}
HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}
\ZCB_API.dll
\ZCB_API.dll
.text
.text
`.rdata
`.rdata
@.data
@.data
.UPX0
.UPX0
.UPX1
.UPX1
.reloc
.reloc
@.rsrc
@.rsrc
f;T$.uBf
f;T$.uBf
8%u/P
8%u/P
tFHt:Ht.Ht"Hu`
tFHt:Ht.Ht"Hu`
QSShP
QSShP
s%j.Zf
s%j.Zf
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
CNotSupportedException
CNotSupportedException
CCmdTarget
CCmdTarget
CHttpFile
CHttpFile
TaskDialogIndirect
TaskDialogIndirect
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
inflate 1.2.8 Copyright 1995-2013 Mark Adler
inflate 1.2.8 Copyright 1995-2013 Mark Adler
[%s] %s
[%s] %s
rc4.CryptData fail!
rc4.CryptData fail!
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptMemory(): malloc error %d
DecryptEncryptMemory(): malloc error %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): pDllImageBase = %X
LoadAndRunEncryptFile(): pDllImageBase = %X
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): pDllImageBase = %X
MemoryLoadEncryptMemory(): pDllImageBase = %X
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
CWebBrowser2
CWebBrowser2
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
\*.log
\*.log
CWebQQ
CWebQQ
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
ZCB_API.dll
ZCB_API.dll
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.PAVCUserException@@
.PAVCUserException@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCInternetException@@
.PAVCInternetException@@
.?AVCHttpFile@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.PAVCFileException@@
.PAVCFileException@@
zcÃ
zcÃ
.PAVCException@@
.PAVCException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCWebBrowser2@@
.?AVCWebBrowser2@@
.?AVCMD5@@
.?AVCMD5@@
1.2.8
1.2.8
WS2_32.dll
WS2_32.dll
User32.dll
User32.dll
.?AVCWebQQ@@
.?AVCWebQQ@@
3FV%D
3FV%D
4ccrT
4ccrT
-mN}5
-mN}5
I%U0=
I%U0=
Su.BJ=
Su.BJ=
'*$/O.QI
'*$/O.QI
,A:%D
,A:%D
s*.fme
s*.fme
)W%X6
)W%X6
_=2Ã’A
_=2Ã’A
.XP:KK
.XP:KK
C.RvK
C.RvK
xmD&.va
xmD&.va
\$l.SvFx
\$l.SvFx
&.sIM
&.sIM
.CWHS
.CWHS
.vanr
.vanr
&V}%duV
&V}%duV
.sWy3
.sWy3
,5.KC
,5.KC
.Ixd'
.Ixd'
UDpW
UDpW
ptkD%U
ptkD%U
?.Pf%
?.Pf%
p?^.JI
p?^.JI
6?u%S*
6?u%S*
:)û
:)û
Y1.JF
Y1.JF
-x}:
-x}:
.qe>O
.qe>O
2B.rV
2B.rV
FZ=.fpf
FZ=.fpf
oH%f)
oH%f)
>.fvd
>.fvd
7.MF,3l
7.MF,3l
.wi>C
.wi>C
e.WeI
e.WeI
.dr}
.dr}
Iik=.Ddwm:
Iik=.Ddwm:
g?k%D
g?k%D
xW%cp
xW%cp
NS.iA
NS.iA
(?.IR
(?.IR
H.QzZ
H.QzZ
.ec\U
.ec\U
B(%U(
B(%U(
,u.IG
,u.IG
[<.qhp>
[<.qhp>
S9.Wxd
S9.Wxd
s%u-r{
s%u-r{
-N;V&%u
-N;V&%u
.unYK
.unYK
:3BGq@%c
:3BGq@%c
l$$h%FP
l$$h%FP
2|B.mN7
2|B.mN7
yrK%c
yrK%c
.fmgH
.fmgH
f6^%6.d
f6^%6.d
FK.CN=
FK.CN=
P.PR(
P.PR(
.bl(@
.bl(@
-gJ}_
-gJ}_
%XfNl
%XfNl
Dn%x`
Dn%x`
.mReu
.mReu
u.MgZ
u.MgZ
7=j.Ks
7=j.Ks
.xcs|i
.xcs|i
Z.Aiv
Z.Aiv
L$@hh8'%f
L$@hh8'%f
4TD%Su
4TD%Su
v.Dz`
v.Dz`
jf.nzb
jf.nzb
!b%u{S
!b%u{S
D$
D$
%Dm|2
%Dm|2
5B.riw{u\b
5B.riw{u\b
.ek\"j
.ek\"j
TP).Cm
TP).Cm
D)h%X4G[
D)h%X4G[
.WzeK
.WzeK
L7.oH
L7.oH
.jrIOe
.jrIOe
&%fU.}
&%fU.}
J?.IR
J?.IR
}5%.sg e
}5%.sg e
.mpu,
.mpu,
3]vExe
3]vExe
m=E.Lv
m=E.Lv
QK%cR
QK%cR
W%Xm$
W%Xm$
Z).NQU:F&
Z).NQU:F&
)1%Fv
)1%Fv
$.Ehk
$.Ehk
#?.uy
#?.uy
%DgD3
%DgD3
%0x{J&
%0x{J&
sF%D:
sF%D:
.vs?Q
.vs?Q
t.ek`
t.ek`
@-rA}4
@-rA}4
^I%u1
^I%u1
/2U4I%coN
/2U4I%coN
%f/2e:R%
%f/2e:R%
Q/2%C}
Q/2%C}
/25;g.hF
/25;g.hF
%d/2u2j
%d/2u2j
I)/2%8s
I)/2%8s
/2Å’
/2Å’
w!%1X
w!%1X
fJ.vh
fJ.vh
}/.Cv
}/.Cv
.PZZ&
.PZZ&
1f'%S
1f'%S
I!.vf?
I!.vf?
S;C
S;C
#.dy7M
#.dy7M
.TTU
.TTU
/'.vt
/'.vt
oledlg.dll
oledlg.dll
ADVAPI32.dll
ADVAPI32.dll
yk.GG
yk.GG
ShellExecuteW
ShellExecuteW
KERNEL32.dll
KERNEL32.dll
SHLWAPI.dll
SHLWAPI.dll
fGg.rV
fGg.rV
InternetOpenUrlW
InternetOpenUrlW
Cmq%C{c{
Cmq%C{c{
ZGDI32.dll
ZGDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
,I.Im
,I.Im
e.Xiv
e.Xiv
x&-4}p
x&-4}p
ole32.dll
ole32.dll
WININET.dll
WININET.dll
SHELL32.dll
SHELL32.dll
OLEACC.dll
OLEACC.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
HV).qQ
HV).qQ
OLEAUT32.dll
OLEAUT32.dll
1p.qnd
1p.qnd
.mdD&
.mdD&
$COMDLG32.dll
$COMDLG32.dll
(l5.ZzL
(l5.ZzL
1hS.xk
1hS.xk
SetViewportExtEx
SetViewportExtEx
YUSER32.dll
YUSER32.dll
-M9}6
-M9}6
;,
;,
8Ÿ:S:x:
8Ÿ:S:x:
=#='= =9>
=#='= =9>
?#?'? ?8?
?#?'? ?8?
; ;$;(;,;0;
; ;$;(;,;0;
4 4$4(4,4044484
4 4$4(4,4044484
7 7$7(7,7074787
7 7$7(7,7074787
3 3$3(3,30343
3 3$3(3,30343
4 4(40484
4 4(40484
7(707
7(707
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'
REGCOM.Register.Api = s 'ZCBApiPlug Class'
REGCOM.Register.Api = s 'ZCBApiPlug Class'
CurVer = s 'REGCOM.Register.Api.1'
CurVer = s 'REGCOM.Register.Api.1'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'
ProgID = s 'REGCOM.Register.Api.1'
ProgID = s 'REGCOM.Register.Api.1'
VersionIndependentProgID = s 'REGCOM.Register.Api'
VersionIndependentProgID = s 'REGCOM.Register.Api'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'
stdole2.tlbWWW
stdole2.tlbWWW
API_LoginWWW
API_LoginWWW
,7API_FindPasswordd
,7API_FindPasswordd
API_LoginOutd
API_LoginOutd
API_QQLoginWd
API_QQLoginWd
rAPI_GetLoginInfod
rAPI_GetLoginInfod
gAPI_GetLoginStateInfoWWW
gAPI_GetLoginStateInfoWWW
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
1.3.1WW
1.3.1WW
\ZCB_API.dll" /s
\ZCB_API.dll" /s
REGCOM.Register.api.1
REGCOM.Register.api.1
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
gdi32.dll
gdi32.dll
\*.dll
\*.dll
\Config.ini
\Config.ini
API_Login
API_Login
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/160301A.exe.exe
hXXp://bbs.kartrider.net/160301A.exe.exe
cmd.exe /c del "
cmd.exe /c del "
66666666
66666666
FreeStyle.exe
FreeStyle.exe
\ApolloCT.dll
\ApolloCT.dll
API_LoginOut
API_LoginOut
API_FindPassword
API_FindPassword
#in_password
#in_password
API_QQLogin
API_QQLogin
.rsrc
.rsrc
@.reloc
@.reloc
kernel32.DLL
kernel32.DLL
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
GetProcessHeap
GetProcessHeap
WINMM.dll
WINMM.dll
timeGetTimehXXp://VVV.2345.com/?ktt659189
timeGetTimehXXp://VVV.2345.com/?ktt659189
BUG! hXXp://VVV.super-ec.cn/
BUG! hXXp://VVV.super-ec.cn/
ws2_32.dll
ws2_32.dll
321050146
321050146
1.03-1.08
1.03-1.08
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WinExec
WinExec
GetKeyState
GetKeyState
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
COMCTL32.dll
COMCTL32.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
dll.dll
dll.dll
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
2%3s3
2%3s3
1 1$1(1,101
1 1$1(1,101
5"5,5@5|5
5"5,5@5|5
8%9u9
8%9u9
5Q5D5[5a5m5
5Q5D5[5a5m5
7084888
7084888
01
01
8$9(9,90949
8$9(9,90949
-090C0W0e0r0w0}0
-090C0W0e0r0w0}0
2%2F2V2
2%2F2V2
7-7C7U7i7}7
7-7C7U7i7}7
: :$:(:,:0:4:8:<:>
: :$:(:,:0:4:8:<:>
2 2$2(24282
2 2$2(24282
hXXp://qq131420.cccpan.com/
hXXp://qq131420.cccpan.com/
Freestyle.exe
Freestyle.exe
514416727
514416727
F%*.*f
F%*.*f
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
c:\%original file name%.exe
c:\%original file name%.exe
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
.data
.data
.rdata
.rdata
KERNEL32.DLL
KERNEL32.DLL
RASAPI32.dll
RASAPI32.dll
comctl32.dll
comctl32.dll
accKeyboardShortcut
accKeyboardShortcut
wuser32.dll
wuser32.dll
hhctrl.ocx
hhctrl.ocx
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
mfcm100u.dll
mfcm100u.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
%s%s.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
lX-X-x-XX-XXXXXX
WININET.DLL
WININET.DLL
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
SHELL32.DLL
SHELL32.DLL
lXXxXXXXXXXX
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
UxTheme.dll
UxTheme.dll
dwmapi.dll
dwmapi.dll
D2D1.dll
D2D1.dll
DWrite.dll
DWrite.dll
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
%s (%s:%d)
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}
000000000000
000000000000
[%d/d/d d:d:d] %s
[%d/d/d d:d:d] %s
%sd-d-d.log
%sd-d-d.log
ZCB_MUTEX_%X
ZCB_MUTEX_%X
0123456789
0123456789
|%s%s%s
|%s%s%s
%s|%d|%s|%s
%s|%d|%s|%s
%s|%s
%s|%s
d-d-d d:d:d
d-d-d d:d:d
%s|%s|%s|%s|%s
%s|%s|%s|%s|%s
%s|%s|%s|%s
%s|%s|%s|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%s|%s|%s
%s|%s|%s
%d|%d
%d|%d
%d|%s|%s
%d|%s|%s
%s\Update.exe
%s\Update.exe
%s "%s" %d %s
%s "%s" %d %s
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
OLEAUT32.DLL
OLEAUT32.DLL
{8856F961-340A-11D0-A96B-00C04FD705A2}
{8856F961-340A-11D0-A96B-00C04FD705A2}
c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
c.84zcb.com/open/v1_7/soft/ann
c.84zcb.com/open/v1_7/soft/ann
XXXXXX
XXXXXX
Host: %s
Host: %s
%d:%s
%d:%s
%d,%d
%d,%d
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
hXXp://user.84zcb.com/p/qq
hXXp://user.84zcb.com/p/qq
user.84zcb.com/s/Client
user.84zcb.com/s/Client
%d.%d.%d.%d
%d.%d.%d.%d
0.0.0.0
0.0.0.0
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d&mm=%s
data=%s&sign=%s&crypto=%d&mm=%s
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
1.0.1.1032
1.0.1.1032
(*.*)
(*.*)
%original file name%.exe_1788_rwx_00401000_005A0000:
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
Ntdll.dll
Ntdll.dll
Kernel32.dll
Kernel32.dll
Psapi.dll
Psapi.dll
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
advapi32.dll
advapi32.dll
wininet.dll
wininet.dll
shlwapi.dll
shlwapi.dll
Shlwapi.dll
Shlwapi.dll
shell32.dll
shell32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
RegOpenKeyA
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyA
RegCloseKey
RegCloseKey
RegEnumKeyA
RegEnumKeyA
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
ShellExecuteA
ShellExecuteA
110notepad.exe
110notepad.exe
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}
HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}
HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}
HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}
HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}
HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}
HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}
\ZCB_API.dll
\ZCB_API.dll
.text
.text
`.rdata
`.rdata
@.data
@.data
.UPX0
.UPX0
.UPX1
.UPX1
.reloc
.reloc
@.rsrc
@.rsrc
f;T$.uBf
f;T$.uBf
8%u/P
8%u/P
tFHt:Ht.Ht"Hu`
tFHt:Ht.Ht"Hu`
QSShP
QSShP
s%j.Zf
s%j.Zf
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
CNotSupportedException
CNotSupportedException
CCmdTarget
CCmdTarget
CHttpFile
CHttpFile
TaskDialogIndirect
TaskDialogIndirect
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
inflate 1.2.8 Copyright 1995-2013 Mark Adler
inflate 1.2.8 Copyright 1995-2013 Mark Adler
[%s] %s
[%s] %s
rc4.CryptData fail!
rc4.CryptData fail!
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptMemory(): malloc error %d
DecryptEncryptMemory(): malloc error %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): pDllImageBase = %X
LoadAndRunEncryptFile(): pDllImageBase = %X
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): pDllImageBase = %X
MemoryLoadEncryptMemory(): pDllImageBase = %X
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
CWebBrowser2
CWebBrowser2
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
\*.log
\*.log
CWebQQ
CWebQQ
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
ZCB_API.dll
ZCB_API.dll
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.PAVCUserException@@
.PAVCUserException@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCInternetException@@
.PAVCInternetException@@
.?AVCHttpFile@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.PAVCFileException@@
.PAVCFileException@@
zcÃ
zcÃ
.PAVCException@@
.PAVCException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCWebBrowser2@@
.?AVCWebBrowser2@@
.?AVCMD5@@
.?AVCMD5@@
1.2.8
1.2.8
WS2_32.dll
WS2_32.dll
User32.dll
User32.dll
.?AVCWebQQ@@
.?AVCWebQQ@@
3FV%D
3FV%D
4ccrT
4ccrT
-mN}5
-mN}5
I%U0=
I%U0=
Su.BJ=
Su.BJ=
'*$/O.QI
'*$/O.QI
,A:%D
,A:%D
s*.fme
s*.fme
)W%X6
)W%X6
_=2Ã’A
_=2Ã’A
.XP:KK
.XP:KK
C.RvK
C.RvK
xmD&.va
xmD&.va
\$l.SvFx
\$l.SvFx
&.sIM
&.sIM
.CWHS
.CWHS
.vanr
.vanr
&V}%duV
&V}%duV
.sWy3
.sWy3
,5.KC
,5.KC
.Ixd'
.Ixd'
UDpW
UDpW
ptkD%U
ptkD%U
?.Pf%
?.Pf%
p?^.JI
p?^.JI
6?u%S*
6?u%S*
:)û
:)û
Y1.JF
Y1.JF
-x}:
-x}:
.qe>O
.qe>O
2B.rV
2B.rV
FZ=.fpf
FZ=.fpf
oH%f)
oH%f)
>.fvd
>.fvd
7.MF,3l
7.MF,3l
.wi>C
.wi>C
e.WeI
e.WeI
.dr}
.dr}
Iik=.Ddwm:
Iik=.Ddwm:
g?k%D
g?k%D
xW%cp
xW%cp
NS.iA
NS.iA
(?.IR
(?.IR
H.QzZ
H.QzZ
.ec\U
.ec\U
B(%U(
B(%U(
,u.IG
,u.IG
[<.qhp>
[<.qhp>
S9.Wxd
S9.Wxd
s%u-r{
s%u-r{
-N;V&%u
-N;V&%u
.unYK
.unYK
:3BGq@%c
:3BGq@%c
l$$h%FP
l$$h%FP
2|B.mN7
2|B.mN7
yrK%c
yrK%c
.fmgH
.fmgH
f6^%6.d
f6^%6.d
FK.CN=
FK.CN=
P.PR(
P.PR(
.bl(@
.bl(@
-gJ}_
-gJ}_
%XfNl
%XfNl
Dn%x`
Dn%x`
.mReu
.mReu
u.MgZ
u.MgZ
7=j.Ks
7=j.Ks
.xcs|i
.xcs|i
Z.Aiv
Z.Aiv
L$@hh8'%f
L$@hh8'%f
4TD%Su
4TD%Su
v.Dz`
v.Dz`
jf.nzb
jf.nzb
!b%u{S
!b%u{S
D$
D$
%Dm|2
%Dm|2
5B.riw{u\b
5B.riw{u\b
.ek\"j
.ek\"j
TP).Cm
TP).Cm
D)h%X4G[
D)h%X4G[
.WzeK
.WzeK
L7.oH
L7.oH
.jrIOe
.jrIOe
&%fU.}
&%fU.}
J?.IR
J?.IR
}5%.sg e
}5%.sg e
.mpu,
.mpu,
3]vExe
3]vExe
m=E.Lv
m=E.Lv
QK%cR
QK%cR
W%Xm$
W%Xm$
Z).NQU:F&
Z).NQU:F&
)1%Fv
)1%Fv
$.Ehk
$.Ehk
#?.uy
#?.uy
%DgD3
%DgD3
%0x{J&
%0x{J&
sF%D:
sF%D:
.vs?Q
.vs?Q
t.ek`
t.ek`
@-rA}4
@-rA}4
^I%u1
^I%u1
/2U4I%coN
/2U4I%coN
%f/2e:R%
%f/2e:R%
Q/2%C}
Q/2%C}
/25;g.hF
/25;g.hF
%d/2u2j
%d/2u2j
I)/2%8s
I)/2%8s
/2Å’
/2Å’
w!%1X
w!%1X
fJ.vh
fJ.vh
}/.Cv
}/.Cv
.PZZ&
.PZZ&
1f'%S
1f'%S
I!.vf?
I!.vf?
S;C
S;C
#.dy7M
#.dy7M
.TTU
.TTU
/'.vt
/'.vt
oledlg.dll
oledlg.dll
ADVAPI32.dll
ADVAPI32.dll
yk.GG
yk.GG
ShellExecuteW
ShellExecuteW
KERNEL32.dll
KERNEL32.dll
SHLWAPI.dll
SHLWAPI.dll
fGg.rV
fGg.rV
InternetOpenUrlW
InternetOpenUrlW
Cmq%C{c{
Cmq%C{c{
ZGDI32.dll
ZGDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
,I.Im
,I.Im
e.Xiv
e.Xiv
x&-4}p
x&-4}p
ole32.dll
ole32.dll
WININET.dll
WININET.dll
SHELL32.dll
SHELL32.dll
OLEACC.dll
OLEACC.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
HV).qQ
HV).qQ
OLEAUT32.dll
OLEAUT32.dll
1p.qnd
1p.qnd
.mdD&
.mdD&
$COMDLG32.dll
$COMDLG32.dll
(l5.ZzL
(l5.ZzL
1hS.xk
1hS.xk
SetViewportExtEx
SetViewportExtEx
YUSER32.dll
YUSER32.dll
-M9}6
-M9}6
;,
;,
8Ÿ:S:x:
8Ÿ:S:x:
=#='= =9>
=#='= =9>
?#?'? ?8?
?#?'? ?8?
; ;$;(;,;0;
; ;$;(;,;0;
4 4$4(4,4044484
4 4$4(4,4044484
7 7$7(7,7074787
7 7$7(7,7074787
3 3$3(3,30343
3 3$3(3,30343
4 4(40484
4 4(40484
7(707
7(707
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'
REGCOM.Register.Api = s 'ZCBApiPlug Class'
REGCOM.Register.Api = s 'ZCBApiPlug Class'
CurVer = s 'REGCOM.Register.Api.1'
CurVer = s 'REGCOM.Register.Api.1'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'
ProgID = s 'REGCOM.Register.Api.1'
ProgID = s 'REGCOM.Register.Api.1'
VersionIndependentProgID = s 'REGCOM.Register.Api'
VersionIndependentProgID = s 'REGCOM.Register.Api'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'
stdole2.tlbWWW
stdole2.tlbWWW
API_LoginWWW
API_LoginWWW
,7API_FindPasswordd
,7API_FindPasswordd
API_LoginOutd
API_LoginOutd
API_QQLoginWd
API_QQLoginWd
rAPI_GetLoginInfod
rAPI_GetLoginInfod
gAPI_GetLoginStateInfoWWW
gAPI_GetLoginStateInfoWWW
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
1.3.1WW
1.3.1WW
\ZCB_API.dll" /s
\ZCB_API.dll" /s
REGCOM.Register.api.1
REGCOM.Register.api.1
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
gdi32.dll
gdi32.dll
\*.dll
\*.dll
\Config.ini
\Config.ini
API_Login
API_Login
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/160301A.exe.exe
hXXp://bbs.kartrider.net/160301A.exe.exe
cmd.exe /c del "
cmd.exe /c del "
66666666
66666666
FreeStyle.exe
FreeStyle.exe
\ApolloCT.dll
\ApolloCT.dll
API_LoginOut
API_LoginOut
API_FindPassword
API_FindPassword
#in_password
#in_password
API_QQLogin
API_QQLogin
.rsrc
.rsrc
@.reloc
@.reloc
kernel32.DLL
kernel32.DLL
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
GetProcessHeap
GetProcessHeap
WINMM.dll
WINMM.dll
timeGetTimehXXp://VVV.2345.com/?ktt659189
timeGetTimehXXp://VVV.2345.com/?ktt659189
BUG! hXXp://VVV.super-ec.cn/
BUG! hXXp://VVV.super-ec.cn/
ws2_32.dll
ws2_32.dll
321050146
321050146
1.03-1.08
1.03-1.08
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WinExec
WinExec
GetKeyState
GetKeyState
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
COMCTL32.dll
COMCTL32.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
dll.dll
dll.dll
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
2%3s3
2%3s3
1 1$1(1,101
1 1$1(1,101
5"5,5@5|5
5"5,5@5|5
8%9u9
8%9u9
5Q5D5[5a5m5
5Q5D5[5a5m5
7084888
7084888
01
01
8$9(9,90949
8$9(9,90949
-090C0W0e0r0w0}0
-090C0W0e0r0w0}0
2%2F2V2
2%2F2V2
7-7C7U7i7}7
7-7C7U7i7}7
: :$:(:,:0:4:8:<:>
: :$:(:,:0:4:8:<:>
2 2$2(24282
2 2$2(24282
hXXp://qq131420.cccpan.com/
hXXp://qq131420.cccpan.com/
Freestyle.exe
Freestyle.exe
514416727
514416727
F%*.*f
F%*.*f
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
c:\%original file name%.exe
c:\%original file name%.exe
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
.data
.data
.rdata
.rdata
comctl32.dll
comctl32.dll
accKeyboardShortcut
accKeyboardShortcut
wuser32.dll
wuser32.dll
hhctrl.ocx
hhctrl.ocx
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
mfcm100u.dll
mfcm100u.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
KERNEL32.DLL
%s%s.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
lX-X-x-XX-XXXXXX
WININET.DLL
WININET.DLL
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
SHELL32.DLL
SHELL32.DLL
lXXxXXXXXXXX
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
UxTheme.dll
UxTheme.dll
dwmapi.dll
dwmapi.dll
D2D1.dll
D2D1.dll
DWrite.dll
DWrite.dll
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
%s (%s:%d)
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}
000000000000
000000000000
[%d/d/d d:d:d] %s
[%d/d/d d:d:d] %s
%sd-d-d.log
%sd-d-d.log
ZCB_MUTEX_%X
ZCB_MUTEX_%X
0123456789
0123456789
|%s%s%s
|%s%s%s
%s|%d|%s|%s
%s|%d|%s|%s
%s|%s
%s|%s
d-d-d d:d:d
d-d-d d:d:d
%s|%s|%s|%s|%s
%s|%s|%s|%s|%s
%s|%s|%s|%s
%s|%s|%s|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%s|%s|%s
%s|%s|%s
%d|%d
%d|%d
%d|%s|%s
%d|%s|%s
%s\Update.exe
%s\Update.exe
%s "%s" %d %s
%s "%s" %d %s
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
OLEAUT32.DLL
OLEAUT32.DLL
{8856F961-340A-11D0-A96B-00C04FD705A2}
{8856F961-340A-11D0-A96B-00C04FD705A2}
c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
c.84zcb.com/open/v1_7/soft/ann
c.84zcb.com/open/v1_7/soft/ann
XXXXXX
XXXXXX
Host: %s
Host: %s
%d:%s
%d:%s
%d,%d
%d,%d
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
hXXp://user.84zcb.com/p/qq
hXXp://user.84zcb.com/p/qq
user.84zcb.com/s/Client
user.84zcb.com/s/Client
%d.%d.%d.%d
%d.%d.%d.%d
0.0.0.0
0.0.0.0
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d&mm=%s
data=%s&sign=%s&crypto=%d&mm=%s
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
1.0.1.1032
1.0.1.1032
(*.*)
(*.*)