Trojan.Win32.Swrort.3.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: fd9ce9438f978194b379e0b454ac0c14
SHA1: c71750b1c744decd3b578ce99ea3a16f3a44d2e4
SHA256: f8d4d78afba39c76512690c4339224863d3e594c617de831e833a5794234d63a
SSDeep: 3072:ps7AwB5/jwO0oa9knbwxLBHRC0s sout6F:psh9jE9ObwZxSoS6F
Size: 101224 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-12-06 15:32:00
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
RUpdate.exe:1792
RUpdate.exe:1512
Zona.exe:1240
Zona.exe:788
%original file name%.exe:1392
%original file name%.exe:772
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process RUpdate.exe:1792 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (10 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (2796 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (86 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\del_cookie_assist[1].xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setsearch[1].xml (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[1].txt (167 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (0 bytes)
The process RUpdate.exe:1512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (570 bytes)
The process Zona.exe:1240 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Zona\launch.log (7639 bytes)
The process Zona.exe:788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Zona\launch.log (19063 bytes)
The process %original file name%.exe:1392 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Zona\init.xml (255 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\zona.ru\zona.sol (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appdata.7z (1326784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon1.tmp (47 bytes)
%Documents and Settings%\%current user%\Start Menu\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Desktop\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Zona.7z (435264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rambler_r33.7z (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon2.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (14173 bytes)
The process %original file name%.exe:772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Zona\utils.jar (29 bytes)
%Program Files%\Zona\License_uk.rtf (21 bytes)
%Program Files%\Zona\License_en.rtf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (7131 bytes)
%Program Files%\Zona\License_ru.rtf (23 bytes)
Registry activity
The process RUpdate.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"URL" = "http://nova.rambler.ru/search?query={searchTerms}&utm_source=r33&utm_medium=distribution&utm_content=e09&utm_campaign=c01"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"SuggestionsURL_JSON" = "http://nova.rambler.ru/suggest?v=3&query={searchTerms}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"ShowSearchSuggestions" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"OSDFileURL" = "http://www.rambler.ru/i/osd.xml"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.rambler.ru/?utm_source=r33&utm_medium=distribution&utm_content=e08&utm_campaign=c01"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{00000000-4EB2-4FC3-BD68-7067448F7A06}"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"FaviconURL" = "http://i.rl0.ru/favicon.ico"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"SortIndex" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 09 28 37 6D 9F 8D DC 78 3C 45 71 84 95 5A 29"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.rambler.ru/?utm_source=r33&utm_medium=distribution&utm_content=e08&utm_campaign=c01"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"DisplayName" = "Rambler"
"Codepage" = "65001"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Rambler Update RunOnce" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe /fromrunonce /standalone r33 /sethome /setsearch"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page"
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Rambler Update Assistant"
The process RUpdate.exe:1512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 DE 72 7D BC 2E 14 61 61 50 E3 35 FE 40 63 DF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process Zona.exe:1240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 88 60 B1 12 63 ED 14 0A 7A 28 E8 CE E9 C4 85"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process Zona.exe:788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 03 D7 65 24 E3 3E 14 6B 02 0D A0 16 6D 57 8D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process %original file name%.exe:1392 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\.zona]
"(Default)" = "Zona"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"DisplayName" = "Zona"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Zona]
"InstallDate" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithProgids]
"Zona" = ""
[HKCU\Software\Zona]
"PID" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"DisplayIcon" = "%Program Files%\Zona\Zona.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona)]
"DisplayName" = "Zona"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Zona]
"Guid" = "C0560306-7F41-4CA6-878C-8CA6FF61642B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"NoRepair" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\Zona\DefaultIcon]
"(Default)" = "%Program Files%\Zona\torrent.ico"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"UninstallString" = "%Program Files%\Zona\uninstall.exe"
"Publisher" = "Zona Team"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\.zona]
"(Default)" = "Zona"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"NoModify" = "1"
"EstimatedSize" = "30720"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Classes\.torrent]
"(Default)" = "Zona"
[HKCU\Software\Zona]
"DownloadsDir" = "%Documents and Settings%\%current user%\My Documents\Zona Download"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"%original file name%.exe" = "fd9ce9438f978194b379e0b454ac0c14"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Classes\Zona\shell\open\command]
"(Default)" = "%Program Files%\Zona\Zona.exe %1"
[HKCU\Software\Zona]
"InstallLang" = "1033"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Classes\Zona]
"URL Protocol" = ""
[HKCR\Applications\Zona.exe\shell\open\command]
"(Default)" = "%Program Files%\Zona\Zona.exe %1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 4E 69 6A FE C6 03 20 70 AC 62 D4 92 14 71 BB"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Zona]
"Zona.exe" = "Zona"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Zona]
"Path" = "%Program Files%\Zona"
[HKCR\.torrent]
"(Default)" = "Zona"
[HKCU\Software\Zona]
"exec" = "%Program Files%\Zona\Zona.exe"
[HKCU\Software\Classes\Zona\shell]
"(Default)" = "open"
[HKCU\Software\Zona]
"pinstall" = "rambler"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Zona" = "%Program Files%\Zona\Zona.exe /MINIMIZED"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Zona]
"Zona.exe" = "%Program Files%\Zona\Zona.exe:*:Enabled:Zona"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 47 CE 75 51 39 0F A6 45 FE 45 0C C6 39 CB 58"
Dropped PE files
| MD5 | File path |
|---|---|
| b3874f9d34aa1a38b926c997461d9a00 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zupdater\ZonaUpdater.exe |
| b8cfe375c50c91aa2b05829f9a601844 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\AccessibleMarshal.dll |
| 1c9b45e87528b8bb8cfa884ea0099a85 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\D3DCompiler_43.dll |
| 0e8394cf74ccd8d74cda1d511cc92c81 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\IA2Marshal.dll |
| 96abf77120ed8becac9625b6862669e6 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\breakpadinjector.dll |
| c42b7c989a7685d419fe54142fdb5b88 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\freebl3.dll |
| dcc9057de8993c37cdd69e97c1fa904a | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\gkmedias.dll |
| 41aa5c719065a2559c0dd5e863e442d2 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\libEGL.dll |
| b2e2090eaaa41b4e7e56746c751e2496 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\libGLESv2.dll |
| 7bdf4aa3957d3a2ad97ee9b0380fc65f | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\mozalloc.dll |
| 4a2d70bad4eb8651ec65e197b7b4da44 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\mozglue.dll |
| a70c8b2d04e147f63a4595983c2216f6 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\mozjs.dll |
| 03e9314004f504a14a61c3d364b62f66 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\msvcp100.dll |
| 67ec459e42d3081dd8fd34356f7cafc1 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\msvcr100.dll |
| e739ea41d9492d4f326653fba7cdce34 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\nss3.dll |
| 19eee0bb2bae9012b85215c8e11e8ada | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\nssckbi.dll |
| 2a4791c380b0de276b996aa0ae0b7537 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\nssdbm3.dll |
| 093060e0b35a73d4b63b54fd1445cd89 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\plugin-container.exe |
| 8a35bb9d003a596a46632ab0fd075da9 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\softokn3.dll |
| a8f9c256214517da5d4691fa256c8be8 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Zona\plugins\zxulrunner31\xul.dll |
| 36420c8fd3da665b877922285fa7a9aa | c:\Program Files\Zona\Zona.exe |
| b3874f9d34aa1a38b926c997461d9a00 | c:\Program Files\Zona\ZonaUpdater.exe |
| 42587a83c07279327233c4640df6a2d8 | c:\Program Files\Zona\uninstall.exe |
| 6f5f6e46aa832672742a9de2444e5bb7 | c:\Program Files\Zona\zreg.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
RUpdate.exe:1792
RUpdate.exe:1512
Zona.exe:1240
Zona.exe:788
%original file name%.exe:1392
%original file name%.exe:772 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (10 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (2796 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (86 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\del_cookie_assist[1].xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setsearch[1].xml (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[1].txt (167 bytes)
%Documents and Settings%\%current user%\Application Data\Zona\launch.log (7639 bytes)
%Documents and Settings%\%current user%\Application Data\Zona\init.xml (255 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\zona.ru\zona.sol (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appdata.7z (1326784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon1.tmp (47 bytes)
%Documents and Settings%\%current user%\Start Menu\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Desktop\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Zona.7z (435264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rambler_r33.7z (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon2.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (14173 bytes)
%Program Files%\Zona\utils.jar (29 bytes)
%Program Files%\Zona\License_uk.rtf (21 bytes)
%Program Files%\Zona\License_en.rtf (5 bytes)
%Program Files%\Zona\License_ru.rtf (23 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Rambler Update RunOnce" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe /fromrunonce /standalone r33 /sethome /setsearch"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Zona" = "%Program Files%\Zona\Zona.exe /MINIMIZED" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 139264 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 143360 | 81920 | 81408 | 5.53666 | eb67b66ca707a8590cbc69d9c4074406 |
| .rsrc | 225280 | 12288 | 10240 | 2.34644 | 6a37d408a921a5da917dda3fa4f3c9bd |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 8
86fd03030ee25e4059214002cc1103cd
a44dcc564fa758f6961abb0c91d4d1b6
7aa37f40187649f0af3cbe90474ccef5
592af76bd80d76e8ccf63e36f132bc49
32a11d7abd9916129401e7cf62ad6f94
b9fc7cee4d906c89a92c8b1093ddb1d1
9d63565736cc22069b79213fccf230d7
187319dbbf64c9d7adb89d22de8d1c5e
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://zona.ru/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 | 5.35.172.6 |
| hxxp://dl.zona.ru/appdata.7z | 46.254.16.107 |
| hxxp://dl.zona.ru/Zona.7z | 46.254.16.107 |
| hxxp://stat.miniload.org/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 | 46.254.17.199 |
| hxxp://zona.ru/img/no-cover.jpg | 5.35.172.6 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /appdata.7z HTTP/1.1
User-Agent: ZONA_httpget
Host: dl.zona.ru
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 22 Mar 2016 11:09:24 GMT
Content-Type: application/x-7z-compressed
Content-Length: 20696765
Last-Modified: Thu, 24 Dec 2015 05:58:18 GMT
Connection: keep-alive
Content-MD5: caa8ecbd2704a23b18d8430bbc9e6b11
ETag: "567b897a-13bcebd"
Accept-Ranges: bytes
].............(..`(...;.Z)..ML.x....;.[...$&..7..^.....4.L.Y\|..=.........q7...P1E..d.. $.qEW.;..t...&...3{..?.....#.K.@<.^......sj.Pk.c.e..Oc..........w.!...V7.......u~.{.o..H.S.e(.&.:{.A.W...bf.\..4.K0$.Y.... z.v.J...g.V\LT.*Z9.C.AV.}K...={:"..n.....s&...K]9....v.....Y.........n/...t.Im..].Q...4~..V..'%}).....].#|?.ed..6..1..o.E....H....s@>......O....0L...(.:...Xst....@D.7...5....!PQ....}.\ ..b.]N.v.K..?.....y...}.X.HS.../yuXdt......U.!.I6SgLZ.3~..i.H.:........7&.f&.G...;.......1..B{zI.l..."H)'..8...kn..%...s*G.._..g..........h,uj_De..n(.R:..,._....<..pd.{.Y.\.U....d@..86Q..@....FY.oB...W..Ahro.f...v. .|.h.N./......q.P..U<.X:m.........M..../...C[.`.....D1.._-.G...4..~.Yh;?.."..g..;.....Va..i.&n.;....zx.C......E.%..p.q5.9C.GT.....iMg.7.'}6..S..S....Bp.c.EQ._.}.H..... {..._f..}A..O....J,&.. x1@.-.W.]s...U9R<...>...)O....%....E.}'b...h!..-.B.....e.m......f./..T.i..*...s2bY.%....`.Ed...u.w.uN..D....8Yt.g..|.J..Q.]\.#..Y9......:......P|vB3.j.....~..t#^y.....9.....c....jQ....>@F.....?,...@.A....W...f|...u..3ovqT.}.[....M...9.r.....J.Y~.;.....:.............X..@7u..m@.....u.[..*k}...*c...!.T...'0\..L....K.v=..........J..:w..........r.&...a....xNPP*v..I..mSN....f..k..'...d....0u...^.U.w$.z.*..1..I..x.z.M=.<.....=.B7H..anD..n|..Em..Q..~X%.d....z.......L.g.wo\H...4f.AI.Q..3.p..]S...x/....TE.C.y....n..d]x..,..4k._..i s.......^v.\o..[.....y(K/.[qk...5W.[...M..1.u..F=...v...r.~...&.....8..2./T....8......Jy.....>.foy|H..)F.G.,A....o&.pE..t..~'...h.M.Id.=...X.... ....\.N....8..Qs....,......m"!.....
<<< skipped >>>
GET /installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 HTTP/1.1
User-Agent: ZONA_httpget
Host: stat.miniload.org
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 22 Mar 2016 11:09:23 GMT
Content-Type: text/html;charset=UTF8
Content-Length: 47
Connection: keep-alive
<response time="1458644963847" idState="free"/>HTTP/1.1 200 OK..Server: nginx..Date: Tue, 22 Mar 2016 11:09:23 GMT..Content-Type: text/html;charset=UTF8..Content-Length: 47..Connection: keep-alive..<response time="1458644963847" idState="free"/>..
GET /installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 HTTP/1.1
User-Agent: ZONA_httpget
Host: zona.ru
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 22 Mar 2016 11:09:20 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: hXXp://stat.miniload.org/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14
<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..HTTP/1.1 301 Moved Permanently..Server: nginx..Date: Tue, 22 Mar 2016 11:09:20 GMT..Content-Type: text/html..Content-Length: 178..Connection: keep-alive..Location: hXXp://stat.miniload.org/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14..<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>....
GET /Zona.7z HTTP/1.1
User-Agent: ZONA_httpget
Host: dl.zona.ru
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 22 Mar 2016 11:09:27 GMT
Content-Type: application/x-7z-compressed
Content-Length: 6841699
Last-Modified: Thu, 24 Dec 2015 06:09:23 GMT
Connection: keep-alive
Content-MD5: 1000528de212b75d1e98e1b79f725681
ETag: "567b8c13-686563"
Accept-Ranges: bytes
].............(..`(...;.ac..ML.].....W.....nED..*.$. .\#...F...Z....?....)......;;M..Q.b$..g.cj2.....T.........j.&..J}hZ.`Z...........P0...:.W..4.......p..-....sK.I...........E..5..M[..i!.4.............0..t.Y.J.,......%....6....*..*F2s=..y......<....X.s....:$...e..r.%...'tfN.y.ai....eo.*..H. N{K.>A.k;.QpJ....>'..Q.&....3..ej.\!Ou....Q%_.......No..7....)J..^.........oy.....<>.C4....7..\.gC.....l...../...2.%..3r7}B=..#...*Qa....Jy...4.e^..7.^.Ry...f.0f.|j.e....x...)..5>...A|`..L....^.../'..........c......jB../.w..._w..?........|2..D~....F....o..8....J'F...u..e3...r.....]...........U3...}..IT........y..5Y..iG.f%.............d.....H..J9....?.9;.Ldm......$o..B.c...GH.b.....N*-.u....'.&_.....C..V....:#..A..G.............I...O.w...z.....1...C..cV...}W....2..d..,.np.....?.....gZJ3.o..]>...N.m..>..4.C........... .......s..D.......:s..\h.Y.7l;FSsi....Y.....&.L{.Z...|.J..g.Q..m....Tm&.5.._...i [&~.yw..M...E.oD....$........~..I..:j:].....h.y7.dI.."..7u.&.....E...f..PA../.6.b..O<.<y$......U.@gs..Jm<..j........k...].....GO......g.7.....t....6.....5.n4.I"3x.....w.G........n*...j......u`.?@...L.#qK..d...5....x.W3I...Dn2Wx...N..i......y#........ ...t...E....>..........nD......^$X....<.'a............W...6.D.s...Qf`.%...0@%;... 6......._tu.O#...w.V.....8&/.....w.7..c....H.&.h.(.~..X."=....`.`.gy..<t......!...*.7Cs5........&...n."lj.'.Z...........R..Xn.......n..F;y.X.{..@^{S!..F]-HF....h.....18...j..L..U$........s.c..z.,.T=T.W.....W...a:.....dK.....Hs..qj.HZ<.uT........N............R...
<<< skipped >>>
GET /img/no-cover.jpg HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: zona.ru
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 22 Mar 2016 11:09:23 GMT
Content-Type: text/html
Content-Length: 5630
Connection: keep-alive
ETag: "56ea60d7-15fe"
<!DOCTYPE html>.<html lang=ru>. <head>. <meta charset=UTF-8>. <title>Zona - .............. .................. .............. ............ ........ .. ........................ ..........</title>.. . <meta property=og:type content=website>. <meta property=og:title content=".................... ............">. <meta property=og:image content=http://zona.ru/img/logo-large.png>. <meta property=og:description name=description content="........ - .............. .................. .............. ............ Zona .. ........................ .......... .................. .............. ............ ...... .... ................ ............ .. .............. ............">. . ... . <meta name=format-detection content="telephone=no">..<!-- . <meta name="apple-mobile-web-app-capable" content="yes">. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">. -->.. . <link rel=stylesheet href=/css/main.f965a79d.css>. <link rel=stylesheet href=/css/avast.css>. .. . . . <!--[if lt IE 9]><link rel="stylesheet" href="/css/ie8.css"><![endif]-->. <!--[if lt IE 9]><script src="//html5shim.googlecode.com/svn/trunk/html5.js"></script><![endif]-->. . <link rel="shortcut icon" href=/favicon.ico>. <link rel=apple-touch-icon href=/img/apple-touch-i
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
Zona.exe_788:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
PSSSSSSh
PSSSSSSh
&hx%D
&hx%D
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
portuguese-brazilian
portuguese-brazilian
GetProcessWindowStation
GetProcessWindowStation
operator
operator
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
123456789
123456789
u/megamakc/core/JavaVer.class
u/megamakc/core/JavaVer.class
ru/megamakc/core/JavaArch.class
ru/megamakc/core/JavaArch.class
D:\workspace_mars\Installer\Installer\Release\ZonaRunner.pdb
D:\workspace_mars\Installer\Installer\Release\ZonaRunner.pdb
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
InternetCrackUrlW
InternetCrackUrlW
HttpSendRequestW
HttpSendRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
WININET.dll
WININET.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumWindows
EnumWindows
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
SHFileOperationW
SHFileOperationW
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
VERSION.dll
VERSION.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
.?AVUrlLinkLabel@@
.?AVUrlLinkLabel@@
.?AVExecuteProcessCommand@@
.?AVExecuteProcessCommand@@
.?AVKeyState@@
.?AVKeyState@@
.?AVWindowsRegistry@@
.?AVWindowsRegistry@@
8|u%SS3
8|u%SS3
04|#04|.04|?04|
04|#04|.04|?04|
.tgPV
.tgPV
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRVj
C.PjRVj
9|u.VV3
9|u.VV3
!7|&"7|~"7|
!7|&"7|~"7|
msvcr71.pdb
msvcr71.pdb
kernel32.dll
kernel32.dll
6y4|__MSVCRT_HEAP_SELECT
6y4|__MSVCRT_HEAP_SELECT
MSVCR71.dll
MSVCR71.dll
_CRT_RTC_INIT
_CRT_RTC_INIT
__crtCompareStringA
__crtCompareStringA
__crtCompareStringW
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringA
__crtLCMapStringW
__crtLCMapStringW
__p__acmdln
__p__acmdln
__p__wcmdln
__p__wcmdln
_acmdln
_acmdln
_amsg_exit
_amsg_exit
_execl
_execl
_execle
_execle
_execlp
_execlp
_execlpe
_execlpe
_execv
_execv
_execve
_execve
_execvp
_execvp
_execvpe
_execvpe
_pipe
_pipe
_wcmdln
_wcmdln
_wexecl
_wexecl
_wexecle
_wexecle
_wexeclp
_wexeclp
_wexeclpe
_wexeclpe
_wexecv
_wexecv
_wexecve
_wexecve
_wexecvp
_wexecvp
_wexecvpe
_wexecvpe
setnewh.cpp
setnewh.cpp
mscoree.dll
mscoree.dll
- This application cannot run using the active version of the Microsoft .NET Runtime
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
Please contact the application's support team for more information.
4|GetProcessWindowStation
4|GetProcessWindowStation
user32.dll
user32.dll
internal state. The program cannot safely continue execution and must
internal state. The program cannot safely continue execution and must
continue execution and must now be terminated.
continue execution and must now be terminated.
n5|.com
n5|.com
cmd.exe
cmd.exe
command.com
command.com
%S#[k
%S#[k
?#%X.y
?#%X.y
GetConsoleOutputCP
GetConsoleOutputCP
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
Assertion failed: %s, file %s, line %d
Assertion failed: %s, file %s, line %d
"%7|"%7|
"%7|"%7|
;$;*;/;7;
;$;*;/;7;
7$858=8{8
7$858=8{8
8!8%8*898
8!8%8*898
5]5Q5\5i5
5]5Q5\5i5
11m1
11m1
;'; ;7;;;
;'; ;7;;;
9 9$94989
9 9$94989
`.data
`.data
MSVCR100.dll
MSVCR100.dll
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateExecute@@YAHP6GHXZ@Z
_CRT_RTC_INITW
_CRT_RTC_INITW
__report_gsfailure
__report_gsfailure
_calloc_crt
_calloc_crt
_crt_debugger_hook
_crt_debugger_hook
_malloc_crt
_malloc_crt
_realloc_crt
_realloc_crt
_recalloc_crt
_recalloc_crt
_set_malloc_crt_max_wait
_set_malloc_crt_max_wait
wcrtomb
wcrtomb
wcrtomb_s
wcrtomb_s
xMaxPolicyElementKey
xMaxPolicyElementKey
pExecutionResource
pExecutionResource
s.SVW
s.SVW
*Yp3.CP
*Yp3.CP
GetProcessHeap
GetProcessHeap
msvcr100.i386.pdb
msvcr100.i386.pdb
.?AUIExecutionContext@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVoperation_timed_out@Concurrency@@
.?AVoperation_timed_out@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.PAVscheduler_resource_allocation_error@Concurrency@@
.PAVscheduler_resource_allocation_error@Concurrency@@
.PAVexception@std@@
.PAVexception@std@@
0$0(0,0004080
0$0(0,0004080
1(1/14181
1(1/14181
1&2,2024282
1&2,2024282
4C4U4V5Z6
4C4U4V5Z6
2!272?2{2
2!272?2{2
3&3,3:3@3
3&3,3:3@3
=$=(?2?=?
=$=(?2?=?
7 8%9-9J9Z9};
7 8%9-9J9Z9};
2#2)23292?2
2#2)23292?2
7 7$7)7/7
7 7$7)7/7
1!2=2}2
1!2=2}2
8 949\9|9
8 949\9|9
= =$=(=,=
= =$=(=,=
3hXXp://crl.microsoft.com/pki/crl/products/CSPCA.crl0H
3hXXp://crl.microsoft.com/pki/crl/products/CSPCA.crl0H
,hXXp://VVV.microsoft.com/pki/certs/CSPCA.crt0
,hXXp://VVV.microsoft.com/pki/certs/CSPCA.crt0
3hXXp://crl.microsoft.com/pki/crl/products/tspca.crl0H
3hXXp://crl.microsoft.com/pki/crl/products/tspca.crl0H
,hXXp://VVV.microsoft.com/pki/certs/tspca.crt0
,hXXp://VVV.microsoft.com/pki/certs/tspca.crt0
hXXp://microsoft.com0
hXXp://microsoft.com0
LAUNCH_ON_WINDOWS_STARTUP=
LAUNCH_ON_WINDOWS_STARTUP=
.torrent
.torrent
Mail.Ru
Mail.Ru
@Mail.Ru
@Mail.Ru
Guard@Mail.Ru
Guard@Mail.Ru
FireFox
FireFox
MAILRU_INSTALL_CHROME_EXTENSIONS=
MAILRU_INSTALL_CHROME_EXTENSIONS=
Chrome
Chrome
1.0.1.6
1.0.1.6
support@zona.ru,
support@zona.ru,
SECOND_INSTANCE_TEXT1=Found running Zona, waiting %d second(s).
SECOND_INSTANCE_TEXT1=Found running Zona, waiting %d second(s).
NOT_ENOUGH_SPACE_TO_INSTALL=Not enough disk space, you need to %s MB of free space
NOT_ENOUGH_SPACE_TO_INSTALL=Not enough disk space, you need to %s MB of free space
ZONA_COMPONENT_NOT_FOUND=Important components of the program are not found. Please reinstall Zona.
ZONA_COMPONENT_NOT_FOUND=Important components of the program are not found. Please reinstall Zona.
DOWNLOADING=Downloading %s
DOWNLOADING=Downloading %s
UNPACKING=Unpacking %s
UNPACKING=Unpacking %s
INSTALLING=Installing %s
INSTALLING=Installing %s
INSTALL_SOFT_FOR_HELP=Establishing the proposed software you help %s remain free
INSTALL_SOFT_FOR_HELP=Establishing the proposed software you help %s remain free
LAUNCH_ON_WINDOWS_STARTUP=Start Zona when Windows starts
LAUNCH_ON_WINDOWS_STARTUP=Start Zona when Windows starts
OPEN_TORRENT_VIA_ZONA=Open .torrent files in Zona
OPEN_TORRENT_VIA_ZONA=Open .torrent files in Zona
PARTNER_TITLE=Together with %s You can install additional software
PARTNER_TITLE=Together with %s You can install additional software
MAILRU_HOME_PAGE=Set Mail.Ru homepage
MAILRU_HOME_PAGE=Set Mail.Ru homepage
MAILRU_SEARCH=Set Search@Mail.Ru search by default
MAILRU_SEARCH=Set Search@Mail.Ru search by default
MAILRU_INSTALL_GUARD=Install Guard@Mail.Ru
MAILRU_INSTALL_GUARD=Install Guard@Mail.Ru
@Mail.Ru for FireFox
@Mail.Ru for FireFox
MAILRU_INSTALL_CHROME_EXTENSIONS=Install Chrome extensions
MAILRU_INSTALL_CHROME_EXTENSIONS=Install Chrome extensions
VERSION_LESS_THAN_1016=This link works in Zona version 1.0.1.6 and above. Please wait for updates and follow the link again.
VERSION_LESS_THAN_1016=This link works in Zona version 1.0.1.6 and above. Please wait for updates and follow the link again.
UNINSTALLER_CLOSING_ZONA=Shutdown running zona...PAD
UNINSTALLER_CLOSING_ZONA=Shutdown running zona...PAD
X.Igy
X.Igy
j-K.PX
j-K.PX
k.aIi
k.aIi
2$2,232=2`2
2$2,232=2`2
4 4$4(4,4044484
4 4$4(4,4044484
8!9'969}9
8!9'969}9
3"383@3|3
3"383@3|3
6&6.646:6
6&6.646:6
2 2$2(2,2024282
2 2$2(2,2024282
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
KERNEL32.DLL
KERNEL32.DLL
WUSER32.DLL
WUSER32.DLL
%s\%s
%s\%s
Error: %d
Error: %d
dll d %s
dll d %s
ZonaUpdater.exe
ZonaUpdater.exe
Updater ver [%d.%d.%d.%d]
Updater ver [%d.%d.%d.%d]
%s\Zona\updates\inst_*
%s\Zona\updates\inst_*
%s\License_ru.rtf
%s\License_ru.rtf
%s\License_uk.rtf
%s\License_uk.rtf
%s\License_en.rtf
%s\License_en.rtf
shell32.dll
shell32.dll
%s\zona.ru
%s\zona.ru
%s\zona.ru\zona.sol
%s\zona.ru\zona.sol
\Macromedia\Flash Player\#SharedObjects\%s
\Macromedia\Flash Player\#SharedObjects\%s
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\%s
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\%s
%s\Zona\launch.log
%s\Zona\launch.log
\jre_packed.exe
\jre_packed.exe
/moveXUL /appDataPath "%s" /appPath "%s" /jvmPath "%s"
/moveXUL /appDataPath "%s" /appPath "%s" /jvmPath "%s"
ttp://dl.zonainst.com/jre_packed.exe
ttp://dl.zonainst.com/jre_packed.exe
ttp://dl.zonainst.com/jre_latest.exe
ttp://dl.zonainst.com/jre_latest.exe
msvcr71.dll
msvcr71.dll
msvcr100.dll
msvcr100.dll
%s %s -classpath Zona.jar;swt.jar -Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator ru.zona.Main %s
%s %s -classpath Zona.jar;swt.jar -Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator ru.zona.Main %s
%sjavaw.exe
%sjavaw.exe
Exception in Janel.main()
Exception in Janel.main()
%s\utils.jar
%s\utils.jar
Exception in Janel.getProperties()
Exception in Janel.getProperties()
Exception in Janel.launchJavaMainMethod()
Exception in Janel.launchJavaMainMethod()
ttp://zona.ru
ttp://zona.ru
ttp://zona.ru/?ref=%s
ttp://zona.ru/?ref=%s
\Zona.jar
\Zona.jar
\zreg.dll
\zreg.dll
\swt.jar
\swt.jar
@ExecuteProcessCommand
@ExecuteProcessCommand
xecute process, WAIT cmd:
xecute process, WAIT cmd:
xit code is %d
xit code is %d
13:45:09
13:45:09
oftware\%s
oftware\%s
[%d_%d_%d %d:%d:%d:%d] %s : [%s] : %s
[%d_%d_%d %d:%d:%d:%d] %s : [%s] : %s
%s%s%s
%s%s%s
httpget start asynch loading
httpget start asynch loading
wininet.dll
wininet.dll
id:%s url:%s ErrorCode:%d
id:%s url:%s ErrorCode:%d
%s ErrorText:%s
%s ErrorText:%s
httpget
httpget
InternetCrackUrl
InternetCrackUrl
%sx
%sx
HttpOpenRequest
HttpOpenRequest
Range: bytes=%d-
Range: bytes=%d-
HttpSendRequest
HttpSendRequest
HttpQueryInfo
HttpQueryInfo
%s_%s
%s_%s
Error copy file, err: %d
Error copy file, err: %d
Error delete file, err: %d
Error delete file, err: %d
avaVer.class found
avaVer.class found
%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaVer
%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaVer
avaVer.class NOT FOUND
avaVer.class NOT FOUND
%s\bin\javaw.exe" -classpath "%s" org.gudy.azureus2.core3.util.Constants
%s\bin\javaw.exe" -classpath "%s" org.gudy.azureus2.core3.util.Constants
s\Zona.jar
s\Zona.jar
s\plugins\zxulrunner\plugin.properties
s\plugins\zxulrunner\plugin.properties
s\plugins\zxulrunner10\plugin.properties
s\plugins\zxulrunner10\plugin.properties
s\plugins\zxulrunner*|%s\plugins
s\plugins\zxulrunner*|%s\plugins
s.
s.
Exception in JVMInfo.getComparableVersionUsingRegularVersion()
Exception in JVMInfo.getComparableVersionUsingRegularVersion()
Exception in JVMInfo.adjustComparableVersionForJavaBundle()
Exception in JVMInfo.adjustComparableVersionForJavaBundle()
Exception in JVMInfo.adjustComparableVersionForBinJvmDir()
Exception in JVMInfo.adjustComparableVersionForBinJvmDir()
Exception in JVMInfo.clone()
Exception in JVMInfo.clone()
Exception in JVMInfo.getJrePath()
Exception in JVMInfo.getJrePath()
Exception in JVMInfo.existsJvmDLL()
Exception in JVMInfo.existsJvmDLL()
Error while testing if JVM.DLL exists.
Error while testing if JVM.DLL exists.
\jvm.dll
\jvm.dll
Exception in JVMInfo.getJvmDLLPath()
Exception in JVMInfo.getJvmDLLPath()
Error while getting the jvm.dll path.
Error while getting the jvm.dll path.
javaw.exe
javaw.exe
\bin\splashscreen.dll
\bin\splashscreen.dll
Loading splashscreen.dll from
Loading splashscreen.dll from
Failed to load splashscreen.dll
Failed to load splashscreen.dll
command line arg[%u]=%s
command line arg[%u]=%s
Exception in JVMLauncher.launch()
Exception in JVMLauncher.launch()
-Djava.class.path=
-Djava.class.path=
-Djava.library.path=
-Djava.library.path=
Exception in JVMLauncher.setupJavaVMInitArgs()
Exception in JVMLauncher.setupJavaVMInitArgs()
Exception in Properties.loadProperties()
Exception in Properties.loadProperties()
-Xmx%dm
-Xmx%dm
-XX:ErrorFile="%s\Zona\errors\hs_err_pid%%p.log"
-XX:ErrorFile="%s\Zona\errors\hs_err_pid%%p.log"
-Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator
-Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator
-Djava.class.path=Zona.jar;swt.jar
-Djava.class.path=Zona.jar;swt.jar
ru.zona.Main
ru.zona.Main
m_fullPathAndNameOfExe=
m_fullPathAndNameOfExe=
Exception in Properties.isVersionLessThanEqualMax()
Exception in Properties.isVersionLessThanEqualMax()
Exception in Properties.isVersionGreaterThanEqualMin()
Exception in Properties.isVersionGreaterThanEqualMin()
-Dprocess.id=%u
-Dprocess.id=%u
-Djava.class.path
-Djava.class.path
-Djava.library.path
-Djava.library.path
Error adding directories to java.library.path.
Error adding directories to java.library.path.
,m_javaSystemProperties[%u]=%s
,m_javaSystemProperties[%u]=%s
,m_commandLineArguments[%u]=%s
,m_commandLineArguments[%u]=%s
Exception in LocalUtilites.trim()
Exception in LocalUtilites.trim()
Exception in LocalUtilites.fileExists()
Exception in LocalUtilites.fileExists()
AException in PropertiesFile.loadPropertiesFromFile()
AException in PropertiesFile.loadPropertiesFromFile()
Ajanel.main.class
Ajanel.main.class
janel.bin.jvm.dir
janel.bin.jvm.dir
janel.java.bundle
janel.java.bundle
janel.min.java.version
janel.min.java.version
janel.max.java.version
janel.max.java.version
janel.jvm.path
janel.jvm.path
janel.java.home.path
janel.java.home.path
janel.trap.console.ctrl
janel.trap.console.ctrl
janel.classpath.jars.dir
janel.classpath.jars.dir
janel.classpath.jars.dir.recursive
janel.classpath.jars.dir.recursive
janel.debug.file
janel.debug.file
janel.library.path.dir
janel.library.path.dir
janel.library.path.dir.recursive
janel.library.path.dir.recursive
janel.working.dir
janel.working.dir
janel.main.argument
janel.main.argument
janel.sysprop.process.id
janel.sysprop.process.id
janel.splash
janel.splash
janel.memory.check.limits
janel.memory.check.limits
janel.memory.max.available.percent
janel.memory.max.available.percent
janel.memory.max.total.percent
janel.memory.max.total.percent
janel.memory.max.upper.limit
janel.memory.max.upper.limit
janel.memory.max.lower.limit
janel.memory.max.lower.limit
janel.memory.init.available.percent
janel.memory.init.available.percent
janel.memory.init.total.percent
janel.memory.init.total.percent
janel.memory.init.upper.limit
janel.memory.init.upper.limit
janel.memory.init.lower.limit
janel.memory.init.lower.limit
janel.error.default.text
janel.error.default.text
janel.error.show.detail
janel.error.show.detail
FOUND_EXE_FOLDER
FOUND_EXE_FOLDER
sJavaArch.class found
sJavaArch.class found
"%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaArch
"%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaArch
JavaArch.class NOT FOUND
JavaArch.class NOT FOUND
Exception in JVMChooser.getBestJVM()
Exception in JVMChooser.getBestJVM()
%s\jre
%s\jre
%s\bin\client\jvm.dll
%s\bin\client\jvm.dll
Exception in JVMChooser.getAllJVMs()
Exception in JVMChooser.getAllJVMs()
Exception in JVMChooser.breakoutBinJvmDirs()
Exception in JVMChooser.breakoutBinJvmDirs()
JVMChooser.determineVersions version is bad:
JVMChooser.determineVersions version is bad:
Exception in JVMChooser.determineVersions()
Exception in JVMChooser.determineVersions()
Exception in JVMChooser.removeUnacceptableJVMs()
Exception in JVMChooser.removeUnacceptableJVMs()
Exception in JVMChooser.getJvmFromCustomJvmPath():
Exception in JVMChooser.getJvmFromCustomJvmPath():
Exception in JVMChooser.getJvmFromCustomJvmPath()
Exception in JVMChooser.getJvmFromCustomJvmPath()
Exception in JVMChooser.getJvmFromCustomJavaHomePath():
Exception in JVMChooser.getJvmFromCustomJavaHomePath():
Exception in JVMChooser.getJvmFromCustomJavaHomePath()
Exception in JVMChooser.getJvmFromCustomJavaHomePath()
Exception in JVMChooser.getJvm()
Exception in JVMChooser.getJvm()
fullKeyPath=
fullKeyPath=
Exception in WindowsRegistry.addAllSdkJvms()
Exception in WindowsRegistry.addAllSdkJvms()
Exception in WindowsRegistry.addAllJreJvms()
Exception in WindowsRegistry.addAllJreJvms()
Registry key
Registry key
Briched20.dll
Briched20.dll
%Program Files%\Zona\Zona.exe
%Program Files%\Zona\Zona.exe
7.10.3052.4
7.10.3052.4
MSVCR71.DLL
MSVCR71.DLL
Visual Studio .NET
Visual Studio .NET
wUSER32.DLL
wUSER32.DLL
advapi32.dll
advapi32.dll
[%d:%d:%d:%d(%d)] %S: !!!!!!!Assert Failed(%S: %d)
[%d:%d:%d:%d(%d)] %S: !!!!!!!Assert Failed(%S: %d)
[%d] %S: !!!!!!!Assert Failed(%S: %d)
[%d] %S: !!!!!!!Assert Failed(%S: %d)
[%d:%d:%d:%d(%d)]
[%d:%d:%d:%d(%d)]
ADVAPI32.DLL
ADVAPI32.DLL
10.00.30319.415
10.00.30319.415
msvcr100_clr0400.dll
msvcr100_clr0400.dll
msvcr100.dl
msvcr100.dl
1.0.6.5
1.0.6.5