Gen.Trojan.Heur.rUWvfL8oxpGn_6f4a07367b

by malwarelabrobot on December 24th, 2016 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Trojan.Heur.rUW@vfL8oxpGn (B) (Emsisoft), Gen:Trojan.Heur.rUW@vfL8oxpGn (AdAware), Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericPhysicalDrive0.YR, BankerGeneric.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 6f4a07367bb66ae2ce0f69e8b89a0504
SHA1: 862ef9f2c58a1d64f5a37cc754e2e814a51f75f6
SHA256: 0b31483bcb97f9c9c96a6ed5326a7c13d278075d085ed6adb7b3817f6754e890
SSDeep: 49152:ItoxCFg0VGQeVx3rAZdHdbOO uscYewF1JmMkbE7I3xXDke5:IjFvVGQeVxbAZd9aBLcYewF1Og7ake5
Size: 2383360 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, BorlandDelphi30, ACProtect141
Company: Viewpoint Corporation
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit


Summary:

Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:2224

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\80EB2F5C (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\versao.txt (41 bytes)

Registry activity

The process %original file name%.exe:2224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E]
"Options" = "66 7F 51 15 2F 0F 75 FA E5 58 FA 03 D0 75 50 68"

[HKCU\Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD1]
"8BD0F9B1" = "FD 5B D9 80 A0 F2 BE 0E FC 96 24 AC D7 11"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xservicex" = "c:\%original file name%.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
4096 860160 334336 5.54475 8ce608f68e7aba7deea77e123c0cdc69
864256 12288 5120 5.40875 ace6dd9fce44a8c9a37f637bf0325dbd
876544 8192 0 0 d41d8cd98f00b204e9800998ecf8427e
884736 12288 0 0 d41d8cd98f00b204e9800998ecf8427e
897024 4096 0 0 d41d8cd98f00b204e9800998ecf8427e
901120 4096 0 0 d41d8cd98f00b204e9800998ecf8427e
905216 57344 0 0 d41d8cd98f00b204e9800998ecf8427e
962560 1540096 1362944 5.54506 16fe21ee74a19c13522ffd6066339072
.rsrc 2502656 28672 26624 2.76203 57c7a14b82355da66625df65ac60b654
2531328 3092480 0 0 d41d8cd98f00b204e9800998ecf8427e
.data 5623808 655360 653312 5.50359 55c17fc41fa366376afbc428e02d0d04

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.nefeshisrael.com/xyz/plugins/pastetext/.../cont.php 72.52.4.91
hxxp://meuip.datahouse.com.br/ 177.91.245.22


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1
Content-Type: text/html
Host: meuip.datahouse.com.br
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Thu, 16 Oct 2014 11:50:32 GMT
Accept-Ranges: bytes
ETag: "331fbd6337e9cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Fri, 23 Dec 2016 08:55:52 GMT
Content-Length: 149
<html>..    <head>..        <meta http-equiv="refresh" 
content="0; url=hXXp://meuip.net.br">..    </head>..    <b
ody>..        ..    </body>..</html>HTTP/1.1 200 OK..Co
ntent-Type: text/html..Last-Modified: Thu, 16 Oct 2014 11:50:32 GMT..A
ccept-Ranges: bytes..ETag: "331fbd6337e9cf1:0"..Server: Microsoft-IIS/
7.5..X-Powered-By: ASP.NET..X-Powered-By-Plesk: PleskWin..Date: Fri, 2
3 Dec 2016 08:55:52 GMT..Content-Length: 149..<html>..    <he
ad>..        <meta http-equiv="refresh" content="0; url=hXXp://m
euip.net.br">..    </head>..    <body>..        ..    &
lt;/body>..</html>..



GET /xyz/plugins/pastetext/.../cont.php HTTP/1.1
Content-Type: text/html
Host: VVV.nefeshisrael.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.0 200 OK
Date: Fri, 23 Dec 2016 08:55:51 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.6.28-1~dotdeb 7.1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Fri, 23 Dec 2016 08:55:51 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: tu=64f624503f8cfeb5608cf62cc662503a; expires=Tue, 31-Dec-2019 23:00:00 GMT; Max-Age=95349849; path=/; domain=nefeshisrael.com; httponly
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_x6GlJRGRcIp9PRGP3XcGFwKl1TJRSmxDMF6fkYoAzstAuM4gWMaWD6OHlJ2v02GMjHgIEHMLRUg01lQhJyStDA==
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from 551455
Connection: close
Set-Cookie: NSC_tfep-83 63 5 02-91=ffffffff516a73d445525d5f4f58455e445a4a423660;path=/;httponly
<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQA
DSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c o8fY
Ov/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_x6GlJRGRcIp9PRGP3XcGFwKl1TJRSmxDMF
6fkYoAzstAuM4gWMaWD6OHlJ2v02GMjHgIEHMLRUg01lQhJyStDA=="><head>
;<meta charset="utf-8" /><style type="text/css">/*!normali
ze.css v1.1.2 | MIT License | git.io/normalize */ article,aside,detail
s,figcaption,figure,footer,header,hgroup,main,nav,section,summary{disp
lay:block;}audio,canvas,video{display:inline-block;*display:inline;*zo
om:1;}audio:not([controls]){display:none;height:0;}[hidden]{display:no
ne;}html{font-size:100%;-ms-text-size-adjust:100%;-webkit-text-size-ad
just:100%;}html,button,input,select,textarea{font-family:sans-serif;}b
ody{margin:0;}a:focus{outline:thin dotted;}a:active,a:hover{outline:0;
}h1{font-size:2em;margin:0;}h2{font-size:1.33em;margin:0;}h3{font-size
:1.1em;margin:0;}h4{font-size:1em;margin:0;}h5{font-size:.83em;margin:
0;}h6{font-size:.67em;margin:0;}abbr[title]{border-bottom:1px dotted;}
b,strong{font-weight:bold;}blockquote{margin:.11em 40px;}dfn{font-styl
e:italic;}hr{-moz-box-sizing:content-box;box-sizing:content-box;height
:0;}mark{background:#FF0;color:#000;}p,pre{margin:.11em 0;}code,kbd,pr
e,samp{font-family:monospace,serif;_font-family:'courier new',monospac
e;font-size:1em;}pre{white-space:pre;white-space:pre-wrap;word-wrap:br
eak-word;}q{quotes:none;}q:before,q:after{content:'';content:none;}sma
ll{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:rel
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_2224:

P.rsrc
.data
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
comctl32.dll
USER32.DLL
uxtheme.dll
Proportional
MAPI32.DLL
PasswordChar
OnKeyDown
OnKeyPress|
OnKeyUp
ssHorizontal
OnKeyUp(3C
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
Uhn%F
%s, %d %s %d %s %s
ftpTransfer
ftpReady
ftpAborted
=?WINDOWS
ClientPortMin<
ClientPortMax
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
0.0.0.1
TIdTCPConnection
TIdTCPConnection(
IdTCPConnection
EIdTCPConnectionError
TIdTCPStream
End of stream: %s at %d
TIdTCPClient
IdTCPClient
BoundPort
PortU
OnExecuteMacro
Service %s
Topic %s
ole32.dll
Content-Disposition: form-data; name="%s"
; filename="%s"
Content-Type: %s
Unsupported operation.
password
Password
IdHTTPHeaderInfo
ProxyPassword<
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
libeay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
des_set_key
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFile
OnGetPassword0
EIdOSSLLoadingRootCertErrort
EIdOSSLLoadingCertError
EIdOSSLLoadingKeyError
CommentURL
TIdHTTPMethod
IdHTTP
TIdHTTPOption
TIdHTTPOptions
TIdHTTPProtocolVersion
IdHTTP<
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPRequest
TIdHTTPProtocol
TIdCustomHTTP
TIdHTTP
HTTPOptions8
EIdHTTPProtocolException
HTTPS
https
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/
TMonochromeLookup
Edit1KeyPress
Coordenada (A1) incorreta.Por favor, tente novamente.
Coordenada (B1) incorreta.Por favor, tente novamente.
Coordenada (C1) incorreta.Por favor, tente novamente.
Coordenada (D1) incorreta.Por favor, tente novamente.
Coordenada (E1) incorreta.Por favor, tente novamente.
Coordenada (F1) incorreta.Por favor, tente novamente.
Coordenada (G1) incorreta.Por favor, tente novamente.
Coordenada (H1) incorreta.Por favor, tente novamente.
Coordenada (A2) incorreta.Por favor, tente novamente.
Coordenada (B2) incorreta.Por favor, tente novamente.
Coordenada (C2) incorreta.Por favor, tente novamente.
Coordenada (D2) incorreta.Por favor, tente novamente.
Coordenada (E2) incorreta.Por favor, tente novamente.
Coordenada (F2) incorreta.Por favor, tente novamente.
Coordenada (G2) incorreta.Por favor, tente novamente.
Coordenada (H2) incorreta.Por favor, tente novamente.
Coordenada (A3) incorreta.Por favor, tente novamente.
Coordenada (B3) incorreta.Por favor, tente novamente.
Coordenada (C3) incorreta.Por favor, tente novamente.
Coordenada (D3) incorreta.Por favor, tente novamente.
Coordenada (E3) incorreta.Por favor, tente novamente.
Coordenada (F3) incorreta.Por favor, tente novamente.
Coordenada (G3) incorreta.Por favor, tente novamente.
Coordenada (H3) incorreta.Por favor, tente novamente.
Coordenada (A4) incorreta.Por favor, tente novamente.
Coordenada (B4) incorreta.Por favor, tente novamente.
Coordenada (C4) incorreta.Por favor, tente novamente.
Coordenada (D4) incorreta.Por favor, tente novamente.
Coordenada (E4) incorreta.Por favor, tente novamente.
Coordenada (F4) incorreta.Por favor, tente novamente.
Coordenada (G4) incorreta.Por favor, tente novamente.
Coordenada (H4) incorreta.Por favor, tente novamente.
Coordenada (A5) incorreta.Por favor, tente novamente.
Coordenada (B5) incorreta.Por favor, tente novamente.
Coordenada (C5) incorreta.Por favor, tente novamente.
Coordenada (D5) incorreta.Por favor, tente novamente.
Coordenada (E5) incorreta.Por favor, tente novamente.
Coordenada (F5) incorreta.Por favor, tente novamente.
Coordenada (G5) incorreta.Por favor, tente novamente.
Coordenada (H5) incorreta.Por favor, tente novamente.
Coordenada (A6) incorreta.Por favor, tente novamente.
Coordenada (B6) incorreta.Por favor, tente novamente.
Coordenada (C6) incorreta.Por favor, tente novamente.
Coordenada (D6) incorreta.Por favor, tente novamente.
Coordenada (E6) incorreta.Por favor, tente novamente.
Coordenada (F6) incorreta.Por favor, tente novamente.
Coordenada (G6) incorreta.Por favor, tente novamente.
Coordenada (H6) incorreta.Por favor, tente novamente.
Coordenada (A7) incorreta.Por favor, tente novamente.
Coordenada (B7) incorreta.Por favor, tente novamente.
Coordenada (C7) incorreta.Por favor, tente novamente.
Coordenada (D7) incorreta.Por favor, tente novamente.
Coordenada (E7) incorreta.Por favor, tente novamente.
Coordenada (F7) incorreta.Por favor, tente novamente.
Coordenada (G7) incorreta.Por favor, tente novamente.
Coordenada (H7) incorreta.Por favor, tente novamente.
Coordenada (A8) incorreta.Por favor, tente novamente.
Coordenada (B8) incorreta.Por favor, tente novamente.
Coordenada (C8) incorreta.Por favor, tente novamente.
Coordenada (D8) incorreta.Por favor, tente novamente.
Coordenada (E8) incorreta.Por favor, tente novamente.
Coordenada (F8) incorreta.Por favor, tente novamente.
Coordenada (G8) incorreta.Por favor, tente novamente.
Coordenada (H8) incorreta.Por favor, tente novamente.
CeGeDe.normal
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
_1_ _2_ _3_ _4_ _5_ _6_ _7_ _8_
gina da web
CeGeDe.emp
=-=-=-=-=-=-==-=-=-=-=-=-=-=
c:\arquivos de programas\internet explorer\iexplore.exe hXXp://VVV.cgd.pt/Empresas/Caixae-Banking/Pages/Aderir.aspx
%Program Files%\Internet Explorer\iexplore.exe hXXp://VVV.cgd.pt/Empresas/Caixae-Banking/Pages/Aderir.aspx
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/demoCEB.action
%Program Files%\Internet Explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/demoCEB.action
c:\arquivos de programas\internet explorer\iexplore.exe hXXp://VVV.cgd.pt/Seguranca/Pages/Segurancas.aspx
%Program Files%\Internet Explorer\iexplore.exe hXXp://VVV.cgd.pt/Seguranca/Pages/Segurancas.aspx
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/PrecarioEntrada.action;jsessionid=F889441FDB5DFC1E4693E9262F8D8FD5
%Program Files%\Internet Explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/PrecarioEntrada.action;jsessionid=F889441FDB5DFC1E4693E9262F8D8FD5
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/AdesaoOnline.action
%Program Files%\Internet Explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/AdesaoOnline.action
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://ws.cgd.pt/Espaco-Cliente/Contactos/Contactos.asp
%Program Files%\Internet Explorer\iexplore.exe hXXps://ws.cgd.pt/Espaco-Cliente/Contactos/Contactos.asp
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://seal.verisign.com/splash?form_file=fdf/splash.fdf&dn=CAIXAEBANKING.CGD.PT&lang=pt
%Program Files%\Internet Explorer\iexplore.exe hXXps://seal.verisign.com/splash?form_file=fdf/splash.fdf&dn=CAIXAEBANKING.CGD.PT&lang=pt
c:\arquivos de programas\internet explorer\iexplore.exe hXXp://get.adobe.com/br/reader/?promoid=BOZPZ
%Program Files%\Internet Explorer\iexplore.exe hXXp://get.adobe.com/br/reader/?promoid=BOZPZ
c:\arquivos de programas\internet explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/RegistarUtilizador.action;jsessionid=A4D3BCA317B9B6A35F5387B41C411F3D
%Program Files%\Internet Explorer\iexplore.exe hXXps://caixaebanking.cgd.pt/cebApp/RegistarUtilizador.action;jsessionid=A4D3BCA317B9B6A35F5387B41C411F3D
Uh%FK
P1KeyPress
PN1KeyPress
Edit2KeyPress
Edit3KeyPress
Edit4KeyPress
Edit5KeyPress
Palavra passe dever
ter 8 digitos.Por favor, tente novamente.
ter 4 digitos.Por favor, tente novamente.
Palavra passe inv
lida.Corrija, por favor.
1111111
2222222
3333333
4444444
5555555
6666666
7777777
8888888
9999999
0000000
PT.Corporation
Edit11KeyPress
Coordenada (A9) incorreta.Por favor, tente novamente.
Coordenada (B9) incorreta.Por favor, tente novamente.
Coordenada (C9) incorreta.Por favor, tente novamente.
Coordenada (D9) incorreta.Por favor, tente novamente.
Coordenada (E9) incorreta.Por favor, tente novamente.
Coordenada (F9) incorreta.Por favor, tente novamente.
Coordenada (G9) incorreta.Por favor, tente novamente.
Coordenada (H9) incorreta.Por favor, tente novamente.
o incorreto.Por favor, tente novamente.
Data de Validade incorreta.Por favor, tente novamente.
IdHTTP18
11111111
22222222
33333333
44444444
55555555
66666666
77777777
88888888
99999999
00000000
BBppII.Emp
hXXp://meuip.datahouse.com.br/
IdHTTP1
Software\Microsoft\Windows\CurrentVersion\Run
\versao.txt
15.txt
taskmgr.exe
?456789:;<=
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;<=>?
&'()* ,-./0123456789:;<=>?
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
UrlMon
IdHTTPServer
IdCustomHTTPServer
IdTCPStream
 IdTCPServer
0IdHTTPHeaderInfo
#IdSMTP
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Icon.Data
Picture.Data
9.GN;
&hv.vC
.pAMO
000.000.000.000
{.opE'
yo0Im.yk
OnKeyPress
ProxyParams.BasicAuthentication
ProxyParams.ProxyPort
Request.ContentLength
Request.ContentRangeEnd
Request.ContentRangeStart
Request.ContentType
Request.Accept
Request.BasicAuthentication
Request.UserAgent
&Mozilla/3.0 (compatible; Indy Library)
HTTPOptions
SMF%c
5c->b.vc
&cr%s
.Photoshop 3.0
URL overrides
New Windows Thumbnail
u.mln
j.pV0a
qK.hB?
.vUU8
S.iq-
.JbGe?I
.Vf.eNen
TN%UB%<V%V~"&f%Wv
m%C_Z
.pA#Y
.pA9.H6x
*Q-*
.hRV%r
x%D&M"
Mf!K&!s&%Ur%Y
1!32%s2)
)D~
*.Jr0
D.wYB6
dB.dC>dDNdE
fb.fc>fdNfe^ffnfg~fh
gr.gq~
>!.LBop
6L%s-
v]s%F
{C%Uc
'`.tS
F^o{5.vgBh
R.%S6
TN%UV
.yklK
#.wYJ
<@JeXE
[.fFNB
1t.Pd
R:\R&cb
%UdPr0ph
.Qb3lU
%d$B(
VertScrollBar.Visible
*(*.*18)'?"6667;>H
"ûe*& 
.RB2#
,^(#Û*
pzh0%sb
.hU)h
E10%S
$AQ%US5
.Vt,e
eR.eS>eTNeU^eVneW~eX
TgtCP,P6v
0(c%u
YCmD|
G<Cz%x07
L:
%E.eq
.DFNTA
.Ph{Lp
Items.Strings
"%uiV/
FS:%F
d[?-JS}
X`fh.eg6c
w.gGNe
$E.BM
%d$c"
%uV'@
.dGwg
*.hC.
_Z.YX
^".bx4^$Nb%^b
`g.Do
.Wh-N
ck,.QR
(7),01444
'9=82<.342
--.RTd
$.MUZracez}
\y 8qjq.rp
.PL4G
>!.NP
%8.eX
F4R.tG
þGwR
`SJA.Dr
Fvd%C
.eF}3Z^pI
T.RvJ
.hm#7
Cert&H"Q
uTz%u
N:A%F
.aRi"
.wh5uS
,.vMW
%0jeXr%\z%X
.uEgu
%c]db
Jdb.GzV
%fo!k
Created with ajaxload.info
.YLf4
&CITcP
dB.dC>
Þ2 s
p.wq.7
.dIk,!m%)
9.qnx
Z`-3}
.KYJT,
y.mM-,g
%S>Fq
%sN$c2&'
B.xWw
$z!%dt
J.oPzi
O<Ð
"%xA5t
"M.rIA
4%xIJ
@.gs>g>v
v`%Ul]
333$$$   
c=wd%f.H
Z|7N%u>
B(.bo 
2"&,\45>
*.**)
.idata
.edata
P.reloc
Uh.rg
.Owner
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
!"#$%&*;<=>@[]^_`{|}
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
ntdll.dll
%s%s%s%s%s%s%s%s%s%s
TComboBoxExEnumerator
OnKeyPress<zo
OnKeyUp`yo
OnExecutel
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\Scsi0:
\\.\SMARTVSD
\\.\%s
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntRegistry.pas
7nXR.Rx
#$%&'()* ,-./01234
VBoxService.exe
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
THookWindowsAPI
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
DLL_Loader_Import_Unit
TInitImport
Function %s not found in module %s
@~.HGk"
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
Could not load library: %s
k`ßkp1
coRegistratioKey
TExportedX
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
.ajav:
A].FT
%s\%.8x%.8x-%.8x%.8x
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
notepad\secret.datt
application.exe
CKv.AKv
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
SHFolder.dll
shell32.dll
ShellExecuteW
ShellExecuteA
DLL_Loader.dll
9%9-959=9
<!<%<)<-<1<5<9<=<
0"0&0*0.020
="=&=*=.=2=
8!8*858>8
3#4'4 4/43474;4
3 3$3(3,30383`3
= =$=(=,=0=4=8=
?"?&?*?.?2?
;(<,<4<8<
7%7X7p7
9):-:1:5:<:{:
6!6%6U6{6
< <$<(<,<0<4<8<
> >$>2>:>7?
3 3$3(3,3034383<3@3`3
1!1%1)1-111
7!8 858?8`8
5W5C5h5r5|5
TntWindows
_enigma_keygen_routines
KeyRoutines
 DLL_Loader_Import_Unit
.reloc
shfolder.dll
winmm.dll
.dO2g
%d)2-
Ct%xG
Ü2O
%FUGnd
.bFLl 
.mQ$-
.idat
P.rel8ocI$
DG.Kl,P]
W'QJ%u
sqL/<
Key_w
4!
DD I%d
W:\3rd^p
01234567
cRTY 5
urkey
bUDP
C:\Pn
"E.DK
,KP%C
J0Jg%f
b8Ò$4%
z}\%d
pIDuw%c
&/TtCp
r/.BQ \
%(T%c
f.LLI^
keyPs&<
1234567
UpxÀ
%s d(
.ctj.
]%2xt
uj\%s
C7;%X
%uFW%
("%s?
%h.cp0Sn
#$%&'()*
 ,-./012
56`7089:;
ÞFAULTv uO
k`%duF
;(
.pEpxUp"
-rv0}
FE8%F
8$4,6-;9'
\.Gr8
T".Dg
GW.jFDL'Z
t)v.xMzR|W~y~
<!=%>)?-$1
71r;t?vCxGzK|O~S~W~[~_~c~g]kv?s.wz
|VL6%1xbKM
6^.ym>
9/.Rv
%<N%8xNJ\
6!'%DU
>r!t.vixsz
K(%Fi
x1}ap
:X.to^y
r=O%SP"~[~_Nc
*a.Hht
%dW$<|
GS.Md%
: În
_48N%U
.id43
^%D#R
zh 5%d
\uC%str
v%x0z6|C~I~c~j~t~~~
<J=n%x
!%d.(
!%d.,L
81S
.HJ 0
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com
Lisence holder: %s 
.mNMi
couemnst nadS ettignsp\iartoa\eDstko\pnvoag i\fcnot.sgfi
couemnst nadS ettignsp\iartoa\eDstko\pnvoag i\fivnets.igf
couemnst nadS ettignsp\iartoa\eDstko\pnvoag i\frsepno.igf
couemnst nadS ettignsp\iartoa\eDstko\pnvoag i\fgsetoa.igf
couemnst nadS ettignsp\iartoa\eDstko\pnvoag i\fotur.ogfi
Dcouemnst nadS ettignsp\iart\aDsekotpv\edr.igf
Dcouemnst nadS ettignsp\iart\aDsekotpc\lra.igf
ignsb\ivgaomsD\ekstpo\OBTOA IGFE\N.Tgfi
ignsb\ivgaomsD\ekstpo\OBTOA IGFE\NLT.igf
ettignsb\ivgaomsD\ekstpo\OBTOA IGF2\.igf
ettignsb\ivgaomsD\ekstpo\OBTOA IGF7\.igf
couemnst nadS ettignsb\ivgaomsD\ekstpo\OBTOA IGFS\ETT.igf
couemnst nadS ettignsb\ivgaomsD\ekstpo\OBTOA IGFA\P.Agfi
nadS ettignsb\ivgaomsD\ekstpo\OBTOA IGF0\.igf
st nadS ettignsT\RMAP\ODsekotp1\221.igf
ttignsb\ivgaomsD\ekstpo\OBTOA IGF3\.igf
ttignsb\ivgaomsD\ekstpo\OBTOA IGF4\.igf
ignsb\ivgaomsD\ekstpo\OBTOA IGF5\.igf
ttignsb\ivgaomsD\ekstpo\OBTOA IGF6\.igf
S ettignsb\ivgaomsD\ekstpo\OBTOA IGF8\.igf
S ettignsb\ivgaomsD\ekstpo\OBTOA IGF9\.igf
couemnst nadS ettignsb\ivgaomsD\ekstpo\OBTOA IGFS\E.Tgfi
couemnst nadS ettignsb\ivgaomsD\ekstpo\OBTOA IGFA\PGA.igf
b\ivgaomsD\ekstpo\OBTOA IGFP\ASS.igf
Dcouemnst nadS ettignsp\iartoa\eDstko\pBTOTP\A.Ggfi
Dcouemnst nadS ettignsp\iartoa\eDstko\pBTOTP\O.Sgfi
couemnst nadS ettignsp\iartoa\eDstko\pBLO.igf
couemnst nadS ettignsp\iartoa\eDstko\puasre ssssss.igf
couemnst nadS ettignsp\iartoa\eDstko\pCIAX.Agfi
couemnst nadS ettignsp\iartoa\eDstko\psregrua.sgfi
Dcouemnst nadS ettignsp\iartoa\eDstko\pBTOTC\AXI.igf
Dcouemnst nadS ettignsp\iartoa\eDstko\pBTOTL\OAJ.igf
Unsupported PixelFormat
Invalid stream operation
Unsupported GIF version
Invalid extension introducerúiled to allocate memory for GIF DIB
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Unknown GIF block type'Object type not supported for operation
SSL status: "%s"
Uneven size in Encode.!Unrecognized UUE encoding scheme.oUnsupported object type. You can assign only one of the following types or thir descendants: TStrings, TStream.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters&Cannot change the size of a JPEG image
JPEG error #%d
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol family not supported.0Address family not supported by protocol family.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
Socket Error # %d
No help keyword specified.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found1Only one TIdAntiFreeze can exist per application.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Value must be between %d and %d
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed
7Invalid input value. Use escape key to abandon changes
Cannot drag a form"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation
!Control '%s' has no parent window
%s property out of range
Unsupported clipboard format
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
DECRYPT_ON_EXECUTE_BEGIN
DECRYPT_ON_EXECUTE_END
%Cookies FOLDER%
Unspecified error (%d) from %s.
debug.log
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
enigma_ide.dll
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
c:\%original file name%.exe
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread Error: %s (%d)7CreateClone not implemented for class %s with source %s
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Invalid data type for '%s' List capacity out of bounds (%d)
Failed to get data for '%s'
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Privileged instruction(Exception %s in module %s at %p.

%original file name%.exe_2224_rwx_004D3000_00009000:

?456789:;<=
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;<=>?
&'()* ,-./0123456789:;<=>?

%original file name%.exe_2224_rwx_0066A000_002F4000:

.idata
.edata
P.reloc
P.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Uh.rg
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
comctl32.dll
ole32.dll
!"#$%&*;<=>@[]^_`{|}
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
ntdll.dll
USER32.DLL
EInvalidGraphicOperation
uxtheme.dll
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
TComboBoxExEnumerator
ssHorizontal
OnKeyDown
OnKeyPress<zo
OnKeyUp`yo
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
HelpKeyword
OnExecutel
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
imm32.dll
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
PasswordChar
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\Scsi0:
\\.\SMARTVSD
\\.\%s
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntRegistry.pas
7nXR.Rx
#$%&'()* ,-./01234
VBoxService.exe
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
THookWindowsAPI
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
DLL_Loader_Import_Unit
TInitImport
Function %s not found in module %s
@~.HGk"
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
Could not load library: %s
k`ßkp1
coRegistratioKey
TExportedX
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
.ajav:
A].FT
%s\%.8x%.8x-%.8x%.8x
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
notepad\secret.datt
application.exe
CKv.AKv
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
SHFolder.dll
shell32.dll
ShellExecuteW
ShellExecuteA
DLL_Loader.dll
9%9-959=9
<!<%<)<-<1<5<9<=<
0"0&0*0.020
="=&=*=.=2=
8!8*858>8
3#4'4 4/43474;4
3 3$3(3,30383`3
= =$=(=,=0=4=8=
?"?&?*?.?2?
;(<,<4<8<
7%7X7p7
9):-:1:5:<:{:
6!6%6U6{6
< <$<(<,<0<4<8<
> >$>2>:>7?
3 3$3(3,3034383<3@3`3
1!1%1)1-111
7!8 858?8`8
5W5C5h5r5|5
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
TntWindows
UrlMon
_enigma_keygen_routines
KeyRoutines
 DLL_Loader_Import_Unit
.reloc
shfolder.dll
winmm.dll
.dO2g
DECRYPT_ON_EXECUTE_BEGIN
DECRYPT_ON_EXECUTE_END
%Cookies FOLDER%
Unspecified error (%d) from %s.
debug.log
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
enigma_ide.dll
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
c:\%original file name%.exe
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread creation error: %s
Thread Error: %s (%d)7CreateClone not implemented for class %s with source %s
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Ancestor for '%s' not found
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation

%original file name%.exe_2224_rwx_00969000_00093000:

.mQ$-
.idat
P.rel8ocI$
DG.Kl,P]
W'QJ%u
sqL/<
Key_w
4!
DD I%d
W:\3rd^p
01234567
cRTY 5
urkey
bUDP
C:\Pn
"E.DK
,KP%C
J0Jg%f
b8Ò$4%
z}\%d
pIDuw%c
&/TtCp
r/.BQ \
%(T%c
f.LLI^
keyPs&<
1234567
UpxÀ
%s d(
.ctj.
]%2xt
uj\%s
C7;%X
%uFW%
("%s?
%h.cp0Sn
#$%&'()*
 ,-./012
56`7089:;
ÞFAULTv uO
k`%duF
;(
.pEpxUp"
-rv0}
FE8%F
8$4,6-;9'
\.Gr8
T".Dg
GW.jFDL'Z
t)v.xMzR|W~y~
<!=%>)?-$1
71r;t?vCxGzK|O~S~W~[~_~c~g]kv?s.wz
|VL6%1xbKM
6^.ym>
9/.Rv
%<N%8xNJ\
6!'%DU
>r!t.vixsz
K(%Fi
x1}ap
:X.to^y
r=O%SP"~[~_Nc
*a.Hht
%dW$<|
GS.Md%
: În
_48N%U
.id43
^%D#R
zh 5%d
\uC%str
v%x0z6|C~I~c~j~t~~~
<J=n%x
!%d.(
!%d.,L
81S
.HJ 0
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com
Lisence holder: %s

%original file name%.exe_2224_rwx_01B30000_00028000:

Interface not supported
External exception %x
No argument for format '%s'
Invalid floating point operation
Invalid pointer operation
Clipboard does not support Icons
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
Value must be between %d and %d
No help keyword specified.

%original file name%.exe_2224_rwx_01B60000_00060000:

wntdll.dll
b66ae2ce0f69e8b89a0504.exe
vkernel32.dll
ae2ce0f69e8b89a0504.exe
3ukernelbase.dll
2ce0f69e8b89a0504.exe
vuser32.dll
vgdi32.dll
`ulpk.dll
vusp10.dll
vmsvcrt.dll
Jvadvapi32.dll
vsechost.dll
vrpcrt4.dll
voleaut32.dll
vole32.dll
ushell32.dll
vshlwapi.dll
{tversion.dll
rcomctl32.dll
sshfolder.dll
swinmm.dll
vimm32.dll
(wmsctf.dll
 uprofapi.dll
usspicli.dll
WS2_32.DLL
|%x,x9t
.mQ$-
comctl32.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\80EB2F5C (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\versao.txt (41 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "xservicex" = "c:\%original file name%.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now