MD5: de04b3403bdc724ddb0917fa70e07ec6
SHA1: f4194b117ead4639b729bf73efafd2fe9351342d
SHA256: 50b4a114158f85770fcb51f30e2e1455ce6db494eb278b9faba612536d9ff042
SSDeep: 98304:dlWTp/eJWr0Mfss/Oy mSVEFh21JgBMQXk3cU6vM:C2cgy mmUGcU
Size: 4878336 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, BorlandDelphi5, BorlandDelphi3, UPolyXv05_v6, Armadillov171
Company: Pokokosut
Created at: 2016-11-26 06:38:16
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:452
SearchProtocolHos.exe:308

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MinerLoder\miner.zip (1 bytes)
C:\pz.ini (206 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MinerLoder\SearchProtocolHos.exe (11865 bytes)
C:\zip.dll (930 bytes)

Registry activity

The process %original file name%.exe:452 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\de04b3403bdc724ddb0917fa70e07ec6_RASMANCS]
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Miner_Wakuang" = "c:\%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: VoipBuster
Product Name: VoipBuster
Product Version: 4.09 build 662
Legal Copyright: (c) VoipBuster, All rights reserved.
Legal Trademarks:
Original Filename: VoipBuster.exe
Internal Name: VoipBuster.exe
File Version: 4.9.662.0
File Description: Client to make VoIP calls.
Comments:
Language: German (Germany)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
xmr.installtion.com	112.216.30.54

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

F(`%D

~%UVW

u$SShe

kernel32.dll

zip.dll

wininet.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

hXXp://xmr.installtion.com:81/pz.txt

\pz.ini

kurl

kport

turl

Software\Microsoft\Windows\CurrentVersion\Run\Miner_Wakuang

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /t REG_SZ /d .exe;.bat;.vbs /f

\kernel32.dll

\zip.dll

.idata

.edata

P.reloc

P.rsrc

Portions Copyright (c) 1983,99 Borland

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

EInvalidOperation

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

PasswordChar

OnKeyDown

OnKeyPress

OnKeyUp(

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

AutoHotkeys

AutoHotkeys`

ParentBiDiModeH%C

:].tJ

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

OnKeyUp

%s: %s

%s:%s

user32.dll

Class <%s> not registered

Source Class <%s> not registered

tObject %s not in item list

TBadPassword

NewPassword

OnBadPassword49E

User Aborted Operation

Uhr%F

FTPF0

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

GetCPInfo

mpr.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

ole32.dll

comdlg32.dll

MyZip.dll

;#;'; ;/;3;7;

3M4

> >7>?>]>

?!?%?)?-?1?5?

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

/miner.zip

libwinpthread-1.dll

=%Uy|

cgÏ

|h.Ex2

ssleay32.dll

ya.Zf

FB%u 

A5\-q}

b!.%F

d%XSM;8

T"C%F

Fp%4S

.kA\7

Bu%S]

SearchProtocolHos.exe

J.evz

sc9j4E%CT

`0/.odP

NTCrT!

XR!i.PL

)uP.Pk

y/.Sf

.Jy8!

.Uv`P

X5.YMB

-Qm}=

wp.eV

.pg8Cv

q?.fk

.,.tqX

.eE>HP

fYc%U

Q1.hP

`.Hl5

.vO*5

Y.ccKDt

>C%cs

QL.crSo}

h%d~/

wO.nR1

3=%%u

.Ud`"

Q.lwp

c.XFJ>

wc%x?

CD.Ld

;'.ll

Qf'%S

zlib1.dll

t]5.wV

;%ut8LuM

libcurl.dll

tM3

XrAO.XT

o=.sf

6}f.Ar~J

X%Fy}

jI.mR

.ca=rG

%sbUZxs

:bxL.XK

þ)o

.vF|>H

y.pD90/W

.xz})

libeay32.dll

XVs.gp

UQ.fU

x K.SK

z.eAWdfI

H%5xn

x<;{.PY[

_A.cW

h.BsQ]y

r[%f_I

3GU[.PUkb

sD}%F

ah'.GGl8wW,S

$HXS.yP

by~I%d

.bmc!Q

 .FYJ

.VAv}

$;.BJ

'%c;'

z)w%uW

GTcp

4GJ.LeJ&

;C %s

zh7%s

.jSp3

Vx*.dK

.rhtr3!f

f8.tQ)

%uaC|

1-J7}

(.ep)

.sGVhu

1/b.fna

rx`%F

?.HA}

?(($$44"

~$~,~<~2

%U$U&5!

TvT.TnT^T

%U.U!uW

.JpC|C)1T

De|.JqZ

E.[.ew

.:.zat

:.tm$

.nmvb

.kuikt

.Eio(

{p.Gsl

libgcc_s_seh-1.dll

libstdc  -6.dll

|_.DQ_

.uCsg

*d.svb@

u7.hBG

.pm.i{

]K.AV

c7%xW

Z=t.dk

jn9d,jE%f

?Iy%F

K:\Lp

/.CCz}v

3.JGG

UG`.ep

H].JGR

sSHh8

D.AyW

.HX"$

.vH?`

.GARK

GCMD

TCP &J

:N.uu

-1pP3}

%U XJ

R.oG5

4.2.6.1.5.3.7

&%%UK

.BS"]

\SearchProtocolHos.exe -a cryptonight -o stratum tcp://

hXXps://

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXp://

https

p'.QN

"?%x*pV;4W

]]:.Eo

.TJF*

.dIG0

.ZEw!

On%d^

".nCJ_

Y..cT

a/~H.rm

S%DYI

r.sUP

B.Lk&)

:$D.IM5

/Q.sO|

3.tGx`p

.EU}rh

I.Qfg

.VnCGy

.lg!h

.RuU'n

h.Rf9~W

%f$i_

}.rrp

\.kk4~

<.UH=dGe7

Qs_G.TX

P.Btz}

A&.MHUj

a2.pTK

E#"%U

<n.zb:

/.lg->wTb-w

G.znjr

dc.ctL

K#%Sv0

C:.af

n}Ls%u%

d@~%S

wWEbe

c.TCu

>m.eQX

;^7%c

n)j.BPR

nN.ld

%XY\!

s.pGlg&w

qV%7s

X.Lc"A

 ".SlQ

`HL

.PcI}/6b@

Eh%s#F]8

aV%Dm

&F%0%c

T")I%u

9>.sl{I

_/#%C 

.eAKOw

J8.VL

p.TlH

w%SN'YC

.hS34

F(.xLc

K .yJ

H%ut4

L\7.gL/

wl!%xf

vA ^.me

=s&4%c

N.QgD

lY%XX|

qH.Te

b.gX.

x$1%Cg

o&.Oy6Zf

t.qC6

.zZ;C

*.ZNw

.CfdU8T

cÊQ]

l:.cgoG"

(.Zc 

N:q!Y.uO

%DQ0}

H;>-%s>J

@\;.dYgs

;&"%D

>%xJI

J.DAh

h.YCp'C

p%Ub=o$

.hHQ*

DFÜ

mÅv

)8Q%Ub.

(Mf.wI_

.AvAM

bmSg

'xL-%x

-.yx;

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

RegCreateKeyA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

X-X-X-X-X-X

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

.1.1.1/index.php/index/regserver

kurl=pool.minemonero.pro

kport=443

turl=hXXp://1.1.1.1/index.php/index/regserver

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

{{{`{{{0

" $&)&$"$

38EmssHosq0

555555555

)()) ,,,,(

)(()   ,,

"""$"$"$

))  ,,,,

)))   ,,

((()))) 

$($(((()

($($($((

$$($(($)

;1!D:.KD<QMJ

.EU\^`^``^```WWOE.

$**,,,($

n_EYA.aU<(

D0 H3!L6#P9%S:'U<(U<(ZB.

s^NZA.ZA.T> K7'D2#=- 7(

L6#P9%U<(

~l^T;'R:'O7ñ!J8*

]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^

]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^]]^

77777777777777

77777777

)('&&&%$

^;:]]!99

\<^;;:!]!9

====_<^^^;::

;/-,*)%#

U]]cI6[.ZY>MQU]

4$Ì

;41$#@'*3$

)))^***[

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>

Open a Zip File[Zip Files (*.ZIP)|*.zip|SFX Files (*.EXE)|*.exe|Jar Files (*.JAR)|*.jar|All Files (*.*)|*.*&User canceled Set Desination Directory

Index %d is out of range

User canceled Zip operation%Select a new name for the fixed file.

Zip Files (*.ZIP)

Invalid seek origin (%d)

Bits index out of range/Menu '%s' is already being used by another form

- Dock zone has no control%List does not allow duplicates ($0%x)

Invalid file name - %s

&Files: (*.*)

Ne&twork... Clipboard does not support Icons

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Custom port:

Custom VTP webgateway:

Custom VTP-TCP proxy:

Custom VTP-TCP port:

Error report

Edit my %s profile

Enable global hotkeys

Enable Hotkey

Change Hotkey

Hotkeys

Use port

Use port 80 and 443 as alternatives for incoming connections

Port

Password

Start %s when I start Windows

Associate %s with callto:links

%s - Options

msctls_hotkey32

Choose hotkey

Forgot your password ?

Password:

Retype password:

You have a total of %d contacts (%d online)

Change password

Old password:

New password:

Confirm new password

Problem report

%s received the following contacts from MSN-messenger, you can add these contacts now.

Contacts already using %s (click info icon to view profile).

Contacts not using %s.

%s can automatically send this person an e-mail with information and instructions for installing %s.

Next login attempt:

Enter new Speed-Dial number for %s

%d of %d characters used

Add %s to your contact list and request his/her authorization to see when he/she is online.

Note: the password you have already entered will be used for this account

%d/%d

Add a %s user

Enter the email addres, login name or full name of the person you wish to add to your contactlist.

Click the 'Record' button and speak in the microphone for %d seconds.

Support chat

ErrorMsg

Remember my password

{8856F961-340A-11D0-A96B-00C04FD705A2}

HThere are %d calls in progress, exiting the application will end them.

Downloading fileQThe old password you used is incorrect.

Profile for %s

%s is calling you.

Profile for %s (%s)

.Are you sure you want to exit the application?

< BackBYour account credit is: %s (Only FREE/BONUS trial calls available)

You have a total of %d contacts

No updates availablebWithin 1 minute your credit will expire! Buy credit now to keep enjoying our incredibly low rates!DLive update is not yet complete. Please restart the voip application]There are %d calls in progress, logging off will end them.

Hi! Have you heard about %s already?

If you are interested you can download %s at

%s/download.asp?lang=%s&username=%s

To contact me, call me at my %s username: %s

Please start Skype before using this option.tThis application requires at least 256 colors.

This call is FREE!2<b>%s</b> wants to add you to his/her contactlist.!Last message received at %s on %s

Set hotkey

The '0' digit=The username is too long, it should not exceed %d characters.?The username is too short, it should be at least %d characters.>The password is too short, it should be at least 4 characters.=The password is too long, it should not exceed 39 characters.7The typed passwords differ, please retype the passwordsWAn unsupported character '%c' was used in the username, please choose a different name.BA username must at least contain one letter instead of only digits[An unsupported character '%c' was used in the password, please choose a different password.

Hotkey

Clipboard Dial Hotkey

Disable Hotkey

Current version: %s

Required version: %s

Show all active calls?<a href="%s">Click here</a> to learn more about Phone-to-Phone.

Send an SMS message to %sOEach forwarded call to a standard phone number will be charged at normal rates.

Dial Hotkey

Hangup Hotkey

Answer Hotkey

Offhook Hotkey%The password you entered is incorrect*The password has been changed successfully9The password could not be changed, please try again later

Error: %s

Your account credit is: %s

%s is writing a message.

Please refine your searchstring.jUnable to start the core engine, the application cannot continue.

We honor your privacy so no confidential data will be sent during this process.DSorry, due to an unknown error your registration request was denied.9Sorry, your registration was denied.

Additional info: %s

%s - Options!Your e-mail will be kept private.FYour account credit is: %s (You cannot call non free destinations now)

aSorry, you do not have enough credit to complete this call. Go to your accountpage to buy credit!8Type a number with country code, example  1 123 456 7890!Sign me up for the %s newsletter!

You have missed a call from %s.

You have %d freedays left.3Click the green dial button below to call back now.

Username %s was successfully registered for %s.

Your username and password have been sent to you via email.

Please click the link in the email to verify your registration!,Sending messages to contacts... please wait. Call number from website with %s#Do you want to call %s with %s?

%s*You have received a new voicemail message.=Your normal freedays have expired, bonus freeday(s) received.<You have %d normal freedays left, bonus freeday(s) received.<This is your last normal freeday, bonus freeday(s) received.<You have %d normal freedays left, bonus freeday(s) received.

BFree call subscription: %d minute(s) left and valid for %d day(s).

IDS_CALLSTATE_CONNECTING4Connection failure, no internet connection availableLNOTE: To use %s without a computer, dial our local access number: <b>%s</b>.

Manage blocked users"Manage other programs access to %s

%s%You have exceeded the fair use policy(This contact is not in your contactlist.

Failed opening file, error:%s

A-side dialing...HToo many registration attempts, please restart the client and try again.

Play %s default sound

Reset to %s default soundHSorry, this username already exists, please choose a different username./Username %s was successfully registered for %s.QSorry, due to an unknown error, we could not log you on.

Please try again later.ASorry, we could not log you on at this time.

Additional info: %sFSorry, due to an unknown error we could not log you on at this moment..Sorry, user %s is not a valid username for %s.HInform your personal contacts about the endless possibilities of %s now!

Check out this new way to call for free: [website]

[displayname].>Your account credit is: %s (Only subscription calls available)

o Paulo, and then you enter the local number you want to call.HFree calls subscription to %s: %d minute(s) left and valid for %d day(s)!The username/password is invalid.IYou have logged in to %s on another computer. Click here to log in again.iSorry, this email address has already been registered for %s.

Please login with the appropriate account.!Sorry, we could not register you.]Sorry, due to a technical problem we could not process your request.

Please try again later.XSorry, %s is not yet globally available, please check the website for supported regions.eSorry, this version of the client is invalid.

Hour2Learn more how %s deals with proxies and firewalls

HTTPS

SOCKS5EYour %s subscription has %d minute(s) left and is valid for %d day(s)

Please choose a different name.TSorry, the password you have chosen is invalid.

Please choose a different password.[Sorry, the userinterface could not be initialized.

%s Default

Busy[You are already calling someone, please complete that callsetup before starting a new call.RSomeone is calling you, please answer or end that call before starting a new call.(Only one callsetup at a time is allowed.

<New Language>RPlease choose the language that we can use when the verification system calls you:QThe timelimit of this call has been reached. Buy credit and make unlimited calls!ESorry, this destination is not free. Please buy credit and call again The number you dialed is invalidrSorry, you do not have enough credit to complete this call. <a href="%s">Go to your accountpage to buy credit!</a>2Due to an unknown error this client ended the call8Incoming call not answered, the other party disconnected

Microphone VolumePThe username and password are mandatory and should be at least 4 characters longBThe username is mandatory and should be at least 4 characters longBThe password is mandatory and should be at least 4 characters long

%s - Logon>The email address could not be changed, please try again later/The email address has been changed successfullyDType a username or number with country code, example  1 123 456 7890

End call with %s

<font color="#FF0000"><b>Contact '%s' cannot be found. Please try the following:</b></font><br><br><br>

Make sure you spelled you contact's login name or full name correctly.<br><br>

If you are using your contact's full name, try a new search by login name.<br><br>

If you do not know your contact's login name you will need to ask him or her for it.<br><br>

%d users found Sorry, the search failed, please try again.

You have %d missed calls.

If you specify the name, state or city field, the input should at least contain 2 characters.CSend a personal authorization message to %s (minimum 10 characters)

Search the %s database... If you know anyone's <b>email address, login name or full name </b>enter it here or leave this box blank.

[displayname].8Connection failure, unable to get a valid server addressrEnter the <b>email address, login name </b>or<b> full name </b>of the person you wish to add to your contact list.

please uninstall TotalRecorder, restart %s and retry your call.TSorry, you do not have enough credit to complete this call.

Y&es to All"%s - Request Authorization from %sUSorry, you do not have enough credit to complete this call.

The %s seconds time limit of this call has been reached.

Please download and install the latest version of %s from our website (%s) to make sure you are using a valid copy.EThere is a problem with your account, please go to your account page.]The person you're connected with is not in your contact list, you can add this contact now...QThe version of this dll is not correct

This was a TESTCALL with a timelimit of %s seconds.

You missed this call.Sorry, a local network problem ended this call/Sorry, a remote network problem ended this call(Sorry, a network problem ended this call,Sorry, you are not allowed to make this call?The call failed due to sound device problems at the other party=The call failed due to sound device problems on this computer,The call failed due to sound device problems

Online with SIP,You have %d %s left for UNLIMITED FREE calls

Each forwarded call to a standard phone number will be charged %s credit at <a href="%s">normal rates</a>. Forwarded calls to other usernames are free.

<a href="%s">Click here</a> to learn more about call forwarding.,The person you want to call is not logged on*The person you want to call does not exist

Do you want to search the database for this user?R<b>%s received the following contacts from %s, you can add these contacts now.</b> Please allow me to see when you are online.MThe email address %s could not be found, because the owner is not using voip.]%s can automatically send this person %s with information and instructions for installing %s.

<b>%s</b> has sent you the following contact(s).

%s contacts import

Please Start\Login Msn messenger and then press OK.

Adding contacts... please wait.,Sending mail to msn contacts... please wait.@Sorry, there was an error on the server, please try again later.(You are not logged on, please (re)logon.8Unable to add contact due to an unknown reason [code:%d]

%s is not online and has no valid numbers in his/her profile that can be dialed.

The email address could not be found in our database because the owner is not using voip. Please inform the user about this wonderful service by sending a personal message.<Contacts already using %s (click info icon to view profile).

Contacts not using %s.GYou can inform the users not using %s about this wonderful service now.'The maximum free calls has been reached

Do you want to go to the website where you can buy credit? Say hello to your new contact(s);You have less than one minute left for UNLIMITED FREE calls

%d of %d characters used3User %s was successfully added to your contactlist.

Add %d contacts to your contact list and request their authorization to see when they are online.

You can type a personal message below.fThe other party is probably using an older version of the client

which does not support this feature.

User '%s' does not exist.

User '%s' is not logged on.0Skype contacts, you can send an personal message

To contact me, my %s-username is %s

Bye!U<b>%s receiving the following contacts from %s, you can add when import is ready.</b>RUser %s is currently receiving contacts from another user; please try again later.@Windows messenger (not msn messenger) is not installed properly.*Send %s to unknown list about this program

%s can automatically send this person %s with information and instructions for installing %s. Remember you must be online with Skype..The call was answered on another line. (local)0This forwarded call was answered on another line&The call was answered on another line.

Skypeimport is not available.'Skype is not installed on this machine.GSkype is installed on this machine, but not available for current user.

and the third step is click on 'Yes'.TOutlook is currently not running, please first start outlook before use this option.=Do you want to inform your skype contacts about this program?

(fair use policy exceeded)YError %d: Could not connect with Skype.

FinishedHSorry, the other party is not able to receive computer-to-computer callsKYou have %d freedays left. After this period, normal rates will be applied.BThis is your last freeday. Tomorrow, normal rates will be applied.9Your freedays have expired; normal rates will be applied.:Sorry, you are not able to make computer-to-computer calls0Sorry, computer-to-computer calls are impossible(A-side ringing... (pick up your phone !)

Phone-to-phone (%s to %s)

Would you like to continue using your computer to make this call? You have a total of %d contacts (%d online)

Chat with %s

VoIP-out Contacts.DA technical problem prevented this message from being delivered (%d)

The number is blocked3You do not have enough balance to send this message<Are you sure you want to delete the message history for %s ?

Message history for %s

Call %s on this number

Call via Phone-to-phone'Where do you want to receive your call?)Call %s on this number via Phone-to-phone Unable to modify this contact.

Error %d %s2Unable to modify the contact, the name is invalid.6Unable to modify the contact, the name already exists.

%s%d Contacts found

Verifying phone number %sUSorry, the search timed out. Please try to refine your search criteria and try again.SVerification could not be performed, please try again later. (result:%d - cause:%d)LThe sms could not be sent. Please try it again later. (result:%d - cause:%d)

It may take a few minutes before you receive the message. Please be patient and do not close this wizard.?The sms could not be sent. Please try it again later. (timeout)GThe code could not be verified. Please re-enter the code and try again.^The code could not be verified. Please re-enter the code and try again. (result:%d - cause:%d)KPhone number %s was successfully verified. It can now be used as Caller ID.9Phone number %s was not verified. Please try again.

%s0Unable to modify the group, the name is invalid.)Unable to modify this group.

Error %d %s

The computer will suspend in %d seconds.

No more subgroups can be added to this group.TShow / hide the contacts in this group.

Move / delete all subitems in order to delete this group.<Your account credit is: %s (Only FREE trial calls available)KThe new password is not strong enough.

Please choose a different password.

Display picture for %s

Sms Contacts&Use %s to seperate multiple recipients)Sender ID to be shown to the recipient(s)

Send the message4The SMS has been scheduled for delivery on %s at %s.

Current date: %s

Requesting...kThe clock settings of your computer seem to be wrong, please set the proper date and time of your computer.*You cannot schedule a message in the past.CSorry, you can not schedule an sms more than %d days in the future.&This scheduled sms has been cancelled.

The mobile number %s you entered is not yet verified.

Would you like to start the verification wizard now?bUnable to update the mobile number in your profile, please try again later. (result:%d - cause:%d)/Sending SMS to this region is not possible yet.

The sms will now be sent with your username as Caller ID!5Your username will be used as Caller ID for this sms.eYou have not entered your mobile phone number.

No message entered.*Please wait, generating verification code.\Verification code generated, please enter the code shown below on your phone when asked for.>Verification failed, did not receive response. Errorcode (%d).

QVerification failed, call to phone number (%s), was not answered. Errorcode (%d).AVerification failed, phone number (%s), was busy. Errorcode (%d).?Verification failed, unknown phone number (%s). Errorcode (%d).FVerification failed, failed to call phone number (%s). Errorcode (%d).8Verification failed, error calling (%s). Errorcode (%d).KVerification failed, no code received on phone number (%s). Errorcode (%d).NVerification failed, wrong code received on phone number (%s). Errorcode (%d).EVerification failed, error calling phone number (%s). Errorcode (%d).6Verification failed, too many retries. Errorcode (%d).5Verification failed, unhandled error. Errorcode (%d).-Verification failed, unhandled response (%d).6Verification failed (timeout). Please try again later.

Verification for %s failed.`The person you're sending a message is not in your contact list, you can add this contact now...(

(this is a free-trial sms sent via %s)

Your internet connection is currently very poor. Check our website to find out how you can enhance this.

Your internet connection is currently poor. Check our website to find out how you can enhance this.

You will have no problems having a good voip conversation.rYour internet connection is excellent!

Voip conversations should sound like the other person is in the same room.8<a href="%s/qualitycontrol/?quality=%d">More info...</a>

%s Users OnlinepThis is a 'verified' phone number.

This means that this number can be used as your CallerId for all your calls.0Please wait while your profile is being updated.)Sorry, your profile could not be updated.)The scheduled sms has been sent on %s %s.

Total calls: %u Last call: %s

Example: 49 123-456789&Please enter a value between %d and %d

Stop test call.Currently only mobile numbers can be verified.6The call was still in progress when client logged off.

Total sms: %u Last sms: %s

'Last name' or 'Company' is required.%First name:

Error: %s (%u)

There is a new version of %s available

<a href="%s">View the changelog.</a>

<font size=8> Right click to ignore this message.</font>;Sorry, your connection does not support peer-to-peer calls.

Type callback phone number... Type phone number or username...#Find a contact by name or number...1Click here for more info on VoIP-in phone numbers2You are currently not connected to the %s service.6You are directly connected to the %s service using %s.1You are connected to the Internet through a '%s'.GYou are connected to the Internet through a direct internet connection.HYou are connected to the Internet through a full or restricted cone NAT.EYou are connected to the Internet through a port restricted cone NAT.?You are connected to the Internet through a symmetric NAT (%s).0The other party ended the call with SIP error %d:You are connected to the %s service via proxy %s using %s.

Your public IP address is %s.

Please use outlook to add phone numbers to this contact.4For more info about rates <a href=%s>click here</a>.

The version of the Outlook interface is wrong, please reinstall %s

This feature is now disabled. You can re-enable it in the view menu.[If the problem persists, please visit our website, download the new version and install it.(%s authorized

Credits: %s

Freedays: %d

Associate %s with Call%s:linksJThe character you entered is invalid.

Valid characters are %c through %c.

Show %s;<a href="%s">Click here</a> to learn more about area codes.x<A HREF="%s">Click here for more information about your quality rating and how to improve your overall call quality.</A>

Playing...'Dashboard (VoiceEngine version %d.d)!Click <b>'Finish'</b> to continue

Audio delaybMake sure your speakers, microphone and or headset are plugged in, turned on and <u>not</u> muted.oIf you are having trouble, check your microphone to make sure it is plugged in, turned on and <u>not</u> muted.

%.2f seconds*You have tuned your audio settings for %s.3<font color="#9E9E9E" size=14><b>Welcome</b></font>M<font color="#9E9E9E" size=14><b>Step 1: Speaker, Ringdevice setup</b></font>D<font color="#9E9E9E" size=14><b>Step 2: Microphone setup</b></font>@<font color="#9E9E9E" size=14><b>Step 3: Verify setup</b></font>2<font color="#9E9E9E" size=14><b>Finish</b></font>

Register a new user for %s.PStart the Bandwidth test and see if your internet connection is ok for using %s.

]Start the Audio Wizard and configure the microphone, speakers and ringdevice you want to use.]Call "Echo123" Echo123 will help you make sure that your microphone and speakers are working.dPersonalize your account. Add a avater ass well as alternate phone numbers where you can be reached.*Preform a search for other users using %s.VAdd fixed and mobile phone numbers or peer-2-peer contacts you know for using with %s.6<b>Follow the steps below to get started using %s.</b>-The bandwidthtest failed. Please retry later.

for password retrieval...EClick the 'Record' button and speak in the microphone for %d seconds.

%d. Create an account#%d. Create an account (suggestions)

%d. Busy, Please wait...

%d. Test your bandwidth

%s would have charged %s

%d. Testing your bandwidth

%d. Tested your bandwidth(%d. Configure your audio devices (%d/%d)

%d. Make a testcall

Welcome to the 'Getting Started' wizard of <B>%s

.</B><BR><BR>When you follow the upcoming simple steps, you can configure and test your settings. After finishing these steps you will be able to use <B>%s

We hope the previous steps were successfull!<BR>You should now be able to make calls with %s.<BR><BR>Please take the time to explore the possibilities of %s.<BR><BR>For instance:<BR>

Send SMS to mobile phones at very low rates <A HREF=%s/smsrates>%s

Make free calls from computer to computer to other %s users.<BR><BR>

Chat with other %s users.<BR><BR>

Import contacts from other programs like Outlook

%d. Logon to your account

Getting started with %s

The username/password is wrong.

You have only one attempt left to login correctly.

If this attempt fails you will be locked out for %s minutes.iThe maximum number of login attempts has been exceeded.

You are locked out of the system for %s minutes.^You did not enter the correct text from the image. Please retry.

Sms sending is not supported&Phone to phone calls are not supportedHMultiple mobile numbers found, please select the number you want to use.

Your account credit is: %s6Your subscription is not paid and you have no credits.

You cannot make calls.-Your subscription is still valid for %d days.GYou have %s credits to call destinations not part of your subscription.;You have no credits to call destinations that are not free.

Your subscription is not paid.?You have %s credits, all calls will be charged at normal rates.

When you proceed to the next step, a text message (SMS)* with a code will be sent to phone number %s. You will have to enter this code in the next step of the wizard to finish the verification process..* Normal SMS rates will apply to this message.

When you proceed to the next step, we will call you on %s. You will be asked to enter a code on your phone that will be displayed on the screen in the next step.

Your freetrial period is over. You can receive additional freetime by verifying a mobile phone number. When you proceed to the next step, a text message (SMS)* with a code will be sent to the phone number you can enter below. You will have to enter this code received in the text message (SMS)* in the next step of the wizard to finish the verification process.gOur verification system will call %s and you will hear a four digit code. Please click next to proceed.LYou received additional freetime for successfully register your mobile phone,No response received for verifying fix phone*No answer received for verifying fix phone%Busy received for verifying fix phone.Unknown phone received for verifying fix phone'Failed received for verifying fix phone0Undefined error received for verifying fix phone)No input received for verifying fix phone

,Wrong input received for verifying fix phone.General error received for verifying fix phone New verify received for verifying fix phone;Caller want to check later received for verifying fix phone/Verify success received for verifying fix phone2Verify no success received for verifying fix phone*Blacklist received for verifying fix phone.To many retry received for verifying fix phone.Unknown error received for verifying fix phone

You already received a code. The code is only valid for a short period of time so it is important that you enter the code as soon as you receive it. Enter the phone number on which you received the code below. You can enter the code in the next screen.;Enter here the phone number on which you received the code.0Enter here the code you received on your mobile.-Enter this code on your phone when asked for.

Verification code generated, we will now call you on phone number %s. Please enter the code shown below on your phone when asked for.^Sorry, your voip provider is out of credits. Contact your voip provider to solve this problem.

INVALID NUMBER. Our system detected that you entered an invalid mobile phone number. Please check the length of the number in your profile and try again by starting this wizard again. If you are certain you did enter a valid mobile phone number then please give all the details via customer service.

INVALID NUMBER. Our system detected that you did not enter a mobile phone number. Please close this wizard and change the number into a mobile number in your profile and try again by starting this wizard again. If you are certain you did enter a mobile phone number then please give all the details via customer service.

BALANCE LOW. In order to verify your mobile phone number you will need to buy credit first. We are sorry for the inconvenience.aAN ERROR HAS OCCURRED. You can not verify this mobile number. We are sorry for the inconvenience.'Retry will be available in: %d seconds.gThe picture you selected is too big. Please select a displaypicture that is less than %d kByte in size.kFailed to change your displaypicture.

The file size could not be retrieved, please select another picture..Enter the phone numbers for your contact here.

It may take a few minutes for the text message (SMS) to arrive. If you haven't received the text message (SMS) please try the "Resend" option first. If you still haven't received your text message (SMS) after "Resend" please let us know through the "Feedback" link on our website. In rare cases text message (SMS) verification may not be possible from some mobiles, in that case you can only use your username as Caller ID. Our apologies for the inconvenience.

Please wait while your phone (%s) is called. When you are called and you pick up the phone, you will hear a four digit code. Please enter this four digit code.#Unlimited calls to %s for %d day(s)CPlease enter the code you have received and press next to continue.QYou've entered a wrong code. Press "Back" to re enter the code or cancel to stop.)Please wait for the code to be announced.:Please enter the code in the box below, not on your phone.

You have exceeded the maximum number of verification attempts. Please wait 24 hours and try again. We are sorry for the inconvenience. (error: 69)  Your %s subscription is valid for %d day(s)

Please try again later.$Sorry, unable to get the size of %s.

Getting size of %s...#Sorry, unable to check for updates.4Downloading list of files that need to be updated...(The installed %s software is up-to-date."Sorry, %s could not be downloaded.=%d files successfully updated

%s will restart in %d seconds.MUpdates are available, click the 'Update Now' button to start the LiveUpdate.

Downloading %s...1Unable to restart %s, please restart %s manually.

Unable to unzip %s.

Unable to delete %s.

Unable to rename %s.rSorry, you do not have the required privileges to update %s.

Restarting %s..._Sorry, unable to start %s with the required privileges, please ask your administrator for help.T%s was unable to detect the elevation type.

Please ask your administrator for help.U%s was unable to detect the elevation level.

Password.Remove my login information from this computer

Please enter your password.

Logged offN<a href="%s/?type=qualitycontrol&quality=%d&productnumber=%d">More info...</a>VYour account credit is: %s (FREE trial calls available, check your registration email)#This phone number cannot be called.

`You have reached the maximum number of reduced price SMS messages; normal rates will be applied.WYou have reached the maximum number of free SMS messages; normal rates will be applied.XYou have reached the maximum number of trial SMS messages; normal rates will be applied.WYou have reached the maximum number of demo SMS messages; normal rates will be applied.BPlease enter the code you have received and press next to proceed.

%d. Finished

NO USER INFO. In order to verify your mobile phone number you will need to buy credit first. We are sorry for the inconvenience.aAN ERROR HAS OCCURRED. You can not verify this mobile number. We are sorry for the inconvenience.

DESTINATION NOT SUPPORTED. We can not verify this mobile number because we cannot send a text message (SMS) to this mobile. We are sorry for the inconvenience.

Enter your password1Saves your username and password on this computer

Logon to %s

Cancel logon=<a href="%s/?type=qualitycontrol&quality=%d">More info...</a>

f you are interested you can download [label] at [website].

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

%s [Recovered]

4.9.662.0

VoipBuster.exe

SearchProtocolHos.exe_308:

.text

`.rdata

@.data

.vmp0

.vmp1

.reloc

@.rsrc

X?.Eoe

lKi.mA

(.VI~e

H.mBz]6<

.ILmx

o:\L|

N.vDc

.rP 4&P

D%U4y

%f?]5

11D1

434~4&585

3 3$3(3,30343

7|7r7

7|7R7a7

9 9$9(9,90949~9

<"=1=9=?=

4 4$4(4,4044484<4@4

< <$<(<,<0<4<8<

1 1$1(1,1014181<1

; ;$;(;,;

8(8,80848

0S091K1h1

0 0$0(0,0

W-.GE;

w.Su7

%c"c5

@?>=<;:9

87654321

0/.-, *)

('&%$#"!

}|Xd.rd

4f.lU

S0.LY

!CTa

h%S)Jy

=f.lz?

6*Á

F.SZT}

.zmH`

.Xm0_

d^%c.

I.DJw

?a.PuC"

,K.Bys

Z.Egh

.ITgt=

%Uv@u

eo.qe

,.UW434

%Dxwq

2:.xCO

Y3.LZ

-.LR$

\Sý

R.wf4

{v.xd

.XF8J

.yKgc

3Âm

BsQl|

-FLt}E

@.zSV

b8A%c

}.qTa

i:\O0N 2lw

jÄEm

t%Un{

qL%Ct

[%uo$

.pjXc%

<:86420.

WS2_32.dll

EnumChildWindows

CRt*u

.Wi|W

%cZy y

?>=<;:98

76543210

/.-, *)(

\.DDp(T

2bP%X

p.uDxi

USER32.dll

ADVAPI32.dll

F%u~M<

KERNEL32.dll

user32.dll

E:\CryptoNight\bitmonero-master\src\miner\Release\Crypto.pdb

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>

conhost.exe_3992:

.text

`.data

.rsrc

@.reloc

GDI32.dll

USER32.dll

msvcrt.dll

ntdll.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

KERNEL32.dll

IMM32.dll

ole32.dll

OLEAUT32.dll

PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

Invalid message 0x%x

InitExtendedEditKeys: Unsupported version number(%d)

Console init failed with status 0x%x

CreateWindowsWindow failed with status 0x%x, gle = 0x%x

InitWindowsStuff failed with status 0x%x (gle = 0x%x)

InitSideBySide failed create an activation context. Error: %d

GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

GetModuleFileNameW failed %d.

Invalid EventType: 0x%x

Dup handle failed for %d of %d (Status = 0x%x)

Couldn't grow input buffer, Status == 0x%x

InitializeScrollBuffer failed, Status = 0x%x

CreateWindow failed with gle = 0x%x

Opening Font file failed with error 0x%x

\ega.cpi

NtReplyWaitReceivePort failed with Status 0x%x

ConsoleOpenWaitEvent failed with Status 0x%x

NtCreatePort failed with Status 0x%x

GetCharWidth32 failed with error 0x%x

GetTextMetricsW failed with error 0x%x

GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

RtlStringCchCopy failed with Status 0x%x

Cannot allocate 0n%d bytes

|%SWj

O.fBf;

ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

Invalid Parameter: 0x%x, 0x%x, 0x%x

ConsoleKeyInfo buffer is full

Invalid screen buffer size (0x%x, 0x%x)

SetROMFontCodePage: failed to memory allocation %d bytes

FONT.NT

Failed to set font image. wc=x, sz=(%x,%x)

Failed to set font image. wc=x sz=(%x, %x).

Failed to set font image. wc=x sz=(%x,%x)

FullscreenControlSetColors failed - Status = 0x%x

FullscreenControlSetPalette failed - Status = 0x%x

WriteCharsFromInput failed 0x%x

WriteCharsFromInput failed %x

RtlStringCchCopyW failed with Status 0x%x

CreateFontCache failed with Status 0x%x

FTPh

\>.Sj

GetKeyboardLayout

MapVirtualKeyW

VkKeyScanW

GetKeyboardState

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyState

ActivateKeyboardLayout

GetKeyboardLayoutNameA

GetKeyboardLayoutNameW

_amsg_exit

_acmdln

ShipAssert

NtReplyWaitReceivePort

NtCreatePort

NtEnumerateValueKey

NtQueryValueKey

NtOpenKey

NtAcceptConnectPort

NtReplyPort

SetProcessShutdownParameters

GetCPInfo

conhost.pdb

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

version="5.1.0.0"

name="Microsoft.Windows.ConsoleHost"

<requestedExecutionLevel

name="Microsoft.Windows.ConsoleHost.SystemDefault"

publicKeyToken="6595b64144ccf1df"

name="Microsoft.Windows.SystemCompatible"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

< =$>:>@>

2%2X2

%SystemRoot%

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

WindowSize

ColorTableu

ExtendedEditkeyCustom

ExtendedEditKey

Software\Microsoft\Windows\CurrentVersion

\ !:=/.<>;|&

%d/%d

cmd.exe

desktop.ini

\console.dll

%d/%d

6.1.7601.17641 (win7sp1_gdr.110623-1503)

CONHOST.EXE

Windows

Operating System

6.1.7601.17641

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MinerLoder\miner.zip (1 bytes)
   C:\pz.ini (206 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MinerLoder\SearchProtocolHos.exe (11865 bytes)
   C:\zip.dll (930 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Miner_Wakuang" = "c:\%original file name%.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.