Gen.Variant.MSILKrypt.11_3c39993620

by malwarelabrobot on August 28th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.MSILKrypt.11 (B) (Emsisoft), Gen:Variant.MSILKrypt.11 (AdAware), Packed.Win32.Themida.FD, SpyTool.Win32.Ardamax.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericEmailWorm.YR, PackedThemida.YR, GenericInjector.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm, Packed, SpyTool, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 3c3999362087ddd862ae3713471193b2
SHA1: 775caa4d2d9e6b2890d1d2f1fb625273cb009789
SHA256: ddf0fe439db6f444fcca2b7037af288efc5095286caa67b38f458c1973ce6947
SSDeep: 98304:awuFr1TuHYCuteDXv9jMiAA5xwXiU6Vu1mjOW1tC9x wi/7wCPmoemXhgYMujhY/:awuF52YCgeD/bAA6iDVu2O5YjFmGHjs
Size: 6254592 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2014-06-10 00:12:45
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

%original file name%.exe:196
1.exe:1328

The Trojan injects its code into the following process(es):

FEK.exe:1948
2.exe:1088

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:196 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\1.exe (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.exe (20507 bytes)

The process 1.exe:1328 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe (15801 bytes)
%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.00 (1 bytes)
%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.01 (81 bytes)
%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.02 (0 bytes)

Registry activity

The process %original file name%.exe:196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 0B 8B FE 70 94 C1 34 AF 0D 1B B2 44 1B 99 DC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"1.exe" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"2.exe" = "2"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 1.exe:1328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 21 12 64 FD B7 B5 E0 B1 C3 46 60 8F 24 77 B9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\RWNVQR]
"FEK.exe" = "FEK"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process FEK.exe:1948 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 67 95 12 6B C8 FC CF AD DE BB 69 F2 0E D4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FEK Start" = "%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe"

The process 2.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 E3 F2 08 E4 F2 DA B1 B4 7F 51 1D 6E 7F 08 B5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

Dropped PE files

MD5 File path
2d3d2d84ad552e325b9fc05088717816 c:\Documents and Settings\All Users\Application Data\RWNVQR\FEK.01
9434103fbb76b606043e6466a28980ce c:\Documents and Settings\All Users\Application Data\RWNVQR\FEK.exe
b9eaf4ad60f523c7c10af71f7ff1929b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\1.exe
7d5be2cb39276b48309c838a45522052 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\2.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: btf4 hack.exe
Internal Name: btf4 hack.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 6238516 6242304 5.45895 d18e74116b2b4e16849296e51c73f5b9
.rsrc 6250496 680 4096 0.47773 0e21e8b3c248688bf4668793a9a0bfc7
.reloc 6258688 12 4096 0.011373 5d13fa2f65f2809fc709fe1c324249e9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

2.exe_1088:

.rsrc
.idata
L.fr/0R
.mQ2[
E*7S%s"F1_!
`%]-aIsA}[neR
.RaNx
hTB.AF
d%dGzCK
~h.fn
.wcs=
aurL
Ee.sR?
zC%S@xE
2*.Ir^Y
ii.JY
tKX%S
5%fZKqAZ
;*.ij
!)9%d-
S.oDM
%c/!=
]%U)Rw
t.QgDh
Dm.yk
 %u]W
py1}.Jh
uPHv8.IPm
.uR~r
redJ)tJ&}W%X
Ti.LY
.AM45
urlc
;.fI\
kernel32.dll
user32.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\2.exe
%System%\ADVAPI32.dll
%userappdata%\RestartApp.exe
Themida - hXXp://VVV.oreans.com
3,$1,$3,$
{)z%sa
Exit Status = %d
^3,$1,$3,$\]
3<$1<$3<$
6G.zbw
.yT6)
B5.Jr2)
[%din)
%FP 3
Y.JW1
&%6UL
.QZa[
X"USER32.dll
ADVAPI32.dll
NTDLL.dll
34$14$34$\
34$14$34$
\\.\SICE
\\.\SIWVID
\\.\NTICE
3Cannot write oreans.vxd
\Oreans.vxd
ADVAPI32.DLL
oreans32.sys
oreansx64.sys
\\.\oreans32
\\.\Global\oreans32
\\.\Global\oreansx64
%s\system32\drivers\%s
%s\syswow64\drivers\%s
%s\system32\drivers\oreans32.sys
3Cannot Update oreans.sys driver. Please, make sure that you have
3Cannot open oreans.vxd driver. Make sure that oreans.vxd
\\.\Oreans.vxd
%s\Oreans.vxd
contact info@oreans.com for this error
winmm.dll
3,$1,$3,$\
3<$1<$3<$\
^3,$1,$3,$\
CheckIN = %d
CheckOUT = %d
ProcIN = %d
ProcOUT = %d
ExitIN = %d
ExitOUT = %d
TPin = %d
HWIn = %d
IntV = %x, %x, %x, %x
]3<$1<$3<$\
3An internal exception occured (Address: 0x%x)
Please, contact support@oreans.com. Thank you!
(r%C`
.umN@>
14$34$14$
pavshook.dll
LVPrcInj.dll
ShimEng.dll
mscorwks.dll
fusion.dll
mscoreei.dll
mscorjit.dll
mscoree.dll
clr.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
2.exe
MSVCR80.DLL
MSVCR80d.DLL
shell32.dll
%Documents and Settings%\%current user%\Application Data
acgenral.dll
>\\?\
>%use
>%com
*Process Monitor - test.pml
3The file %s is missing. Please, re-install this application
45613056
ntdll.dll
kernelbase.dll
advapi32.dll
apphelp.dll
xgusb.cpl
^-*Wy$%d
<9.EXEu
CF\.FU
.blm2
%C^UY9
x.EFo
H|v.Oo
$X%x#J'
%9%Fj
.Jo8'
<.Si<.h
/[.bu
.KiIl?U\e
i`oU.lp
1?gE.fCU
Z.XgrY
09.sDR
[/l"%c
zi%XZ
t.kP%
i" <%F
oW>%fT
@M%u&T
FCYP%f
5)V.cU?
c.WTYU|
Er.Ds
%Dhmn
.ahA.Q
h.csD
|PKEY
SU%X3
2%C]KX
}.lg|A|
fTpS
EURl*
h.RMW
.BAz"
QwEbo
.isf\
N%uSw
)W6d.sU
0.mww
Na%D%
1.GXoj
.fR _
.ai :(
WgB%U
H&%S( "
e@%F)
#%FT21
Og5%D
:.zzK
X-%5uE &
%s>%uM
?[(
Ek%DM
,%u%_
L*%dv
^2.ju
jy%ct
_ð%
*{o%DM
[%din
%F$@N
l.fK|/'~
t.rUE
]Em'.KS
~/%u6o
%F^?)
r!ñ
a.Yu(
.Ff`(N
&yTd%d
ú/1
6#097;(|
8^.aO
$%uNuK7
%C~y_
&<%uJ
Y-r}~
$1.Gd
R[i%sT-
$-W2N}
%uY{Ev=
\m%sd
%Dnd,
%NQ.Iu
1.IRW\x'U
]g:%x
Yñu
%dH a
0ôQ
Uq.IS
%f.])
_EX%U
Ep%F{
`%6UL
%dO_3
G%S_]
(%f)e
E5%U2
t-ev%s
TV.ru
(-n}[
}.gK])
T.RQ`
Z342%f
8F%X}
]ef%u
/G%uWv
]Sz%uF
.xV_V
[;%fw
@e/%u
Y\JM%f
w-.lf
:$%XR
&)%U4
Y%clw
/1fi
.IJ~g
pK\.af
t1%x)
N:\53
:/"p%u\
ab%Xz
.kS{!05\
\7%S,
0\.RVpC 2aD4)
%ulVO
5C;%9s
v.zf7
YúZ
.Ci]L
-:%U5{/
W%u20
Kl)^%x/
o%F.4!
þN 
E\N.ED
qA%UB
%x`N:
..neD
1.Zx(
W%1UeP
6.xzt 
H[;%Fs5
@6m^^%s
-?w%S[t<
1y6%S
%S{q9
.Jx8(
D>A.pX 
URLS
{%XX@
@%xQ@H`E
%uL ^1
]%S Y
I}y`%U
`V
5f@.xTm
e %UE
w-pQ}
.blm&
e`%x`
XL.Bo
A gd/.HE
}@/)`% (`
i) O`%f@
`%S`k
 ; _) %`/ 
ke@%s
.LBXm
M`.AP
kECi.dr
VL^%X
1yBu9).vD
.Vo m
q)ý,
.Xr2E$
l.JB@
.WTYU|
h%SFgp
%dm\T
*|0=& "~
.WeOh'
@ \{`.Mh
Ãv|S
SU%X2
DN7Xm%x
&%XX|g
HoN%sV
R.fQbi
W.fAK
.wd?^
.lg|A)\
JJ/.MC
G-v}Q
bD*.nC%
.qEc2
B` ?
c:\wJ
z.EChd
.l-Y.aoc
R.Zen
.yU?0
8!%F"O
h.RMW/
9-|/`\(#
ku.oQ
&/.Dp2G
%s|V9S
Zofb%U
@%fPC^
".qXr
E(H%D
KB)%8u^
N%uS0w
{>%S]
%X7h[
.TroB
6d0.spV
s%XlT
J.oZ@06
DDDJJJOOORRRQQQPPPRRRQQQQQQQQQQQQQQQQQQQQQQQQRSQLPQTRRQRPOQQSRV^_iu
%.Ouo47;
/:8WwrSqlDcfx
$~q:ng*B@.FD

2.exe_1088_rwx_00370000_0008E000:

.text
`.data
.rsrc
@.reloc
GDI32.dll
KERNEL32.dll
NTDLL.DLL
ImmProcessKey
USER32.dll
ActivateKeyboardLayout
ArrangeIconicWindows
CallMsgFilter
CallMsgFilterA
CallMsgFilterW
CascadeChildWindows
CascadeWindows
CliImmSetHotKey
CloseWindowStation
CreateDialogIndirectParamA
CreateDialogIndirectParamAorW
CreateDialogIndirectParamW
CreateWindowStationA
CreateWindowStationW
DisableProcessWindowsGhosting
DisplayExitWindowsWarnings
EnumChildWindows
EnumDesktopWindows
EnumThreadWindows
EnumWindowStationsA
EnumWindowStationsW
EnumWindows
ExitWindowsEx
GetAsyncKeyState
GetKeyNameTextA
GetKeyNameTextW
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyboardType
GetProcessWindowStation
LoadKeyboardLayoutA
LoadKeyboardLayoutEx
LoadKeyboardLayoutW
LockWindowStation
MapVirtualKeyA
MapVirtualKeyExA
MapVirtualKeyExW
MapVirtualKeyW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
OemKeyScan
OpenWindowStationA
OpenWindowStationW
RegisterHotKey
SetConsoleReserveKeys
SetKeyboardState
SetProcessWindowStation
SetWindowStationUser
SetWindowsHookA
SetWindowsHookExA
SetWindowsHookExW
SetWindowsHookW
TileChildWindows
TileWindows
UnhookWindowsHook
UnhookWindowsHookEx
UnloadKeyboardLayout
UnlockWindowStation
UnregisterHotKey
VkKeyScanA
VkKeyScanExA
VkKeyScanExW
VkKeyScanW
WINNLSGetIMEHotkey
keybd_event
=.cmd
=.pif
=.lnk
=.com
=.bat
F\ FTP
s.RPRP
tcPV
*9]0t#SSh
u.KKt*
~,SSSh
SSSSh
SSSh$6A~P
6SSSSh
t>SSh`
u"SSh`
ADVAPI32.dll
MSIMG32.dll
POWRPROF.dll
WINSTA.dll
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
ReportEventW
RegQueryInfoKeyW
ntdll.dll
GetViewportOrgEx
SetViewportOrgEx
GetViewportExtEx
GetCPInfo
GetSystemWindowsDirectoryW
NtQueryKey
NtEnumerateValueKey
NtYieldExecution
NtCreateKey
NtSetValueKey
NtDeleteValueKey
NtEnumerateKey
NtOpenKey
NtQueryValueKey
user32.pdb
windows.hlp
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
$$$006666
&$%Uooqkezs
['$$#%&(4
2<===@@=
0 00@0[0
0V0
9œ9S9|9
;";&;*;.;2;6;:;
8$8-858E8L8S8Z8a8h8o8v8}8
;(;7;>;};
2$3 363@3
;#<)<4<:<
7 8$8(8,8|8
IMM32.DLL
SETUPAPI.DLL
&%d %ws
Control Panel\Input Method\Hot Keys
Virtual Key
Key Modifiers
kbdus.dll
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\
$winnt$.inf
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Fonts
Keyboard Layout\Preload
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\LastFontSweep
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Type 1 Fonts
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Upgraded Type1
keyboardlayout.ini
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\LastType1Sweep
\Windows\WindowStations
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows
\Windows
Keyboard Layout
kbdkor.dll
kbdjpn.dll
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout
imm32.dll
Hot Keys
00000409
x:\...\
OLE32.DLL
%SystemRoot%\System32\user32.dll
Software\Microsoft\Windows\CurrentVersion\Reliability
hh.exe
indicdll.dll
\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\
IgnoreRemoteKeyboardLayout
\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Reliability
\snapshot.dll
Windows XP USER API Client DLL
5.1.2600.5512 (xpsp.080413-2105)
Windows
Operating System
5.1.2600.5512
Error Instrument: ProcessName: %1 WindowTitle: %2 MsgCaption: %3 MsgText: %4 CallerModuleName: %5 BaseAddr: %6 ImageSize: %7 ReturnAddr: %8
Zero width &joiner
Zero width &non-joiner
&More Windows...gInsufficient memory to create the bitmap. Close one or more applications to increase available memory.
Op&en Soft Keyboard
Close So&ft Keyboard
Windows
Other people are logged on to this remote computer. Shutting down Windows might cause them to lose data. Also, someone at the remote location will have to restart the computer manually.
Other people are logged on to this computer. Shutting down Windows might cause them to lose data.
Other people are logged on to this computer. Restarting Windows might cause them to lose data.
Hardware: Maintenance (Planned)"Hardware: Installation (Unplanned) Hardware: Installation (Planned)%Operating System: Upgrade (Unplanned)#Operating System: Upgrade (Planned)
-Operating System: Reconfiguration (Unplanned) Operating System: Reconfiguration (Planned)
8A restart or shutdown to service hardware on the system.AA restart or shutdown to begin or complete hardware installation.6A restart or shutdown to upgrade the operating system.CA restart or shutdown to change the operating system configuration.BA restart or shutdown to troubleshoot an unresponsive application.>A restart or shutdown to troubleshoot an unstable application.0A restart or shutdown to service an application. A shutdown or restart for an unknown reason1The computer displayed a blue screen crash event.
The system became unresponsive.GA restart or shutdown to perform planned maintenance on an application.

2.exe_1088_rwx_004DB000_00543000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\2.exe
%System%\ADVAPI32.dll
%userappdata%\RestartApp.exe
Themida - hXXp://VVV.oreans.com
3,$1,$3,$
{)z%sa
Exit Status = %d
^3,$1,$3,$\]
3<$1<$3<$
6G.zbw
.yT6)
B5.Jr2)
[%din)
%FP 3
Y.JW1
&%6UL
.QZa[
X"USER32.dll
ADVAPI32.dll
NTDLL.dll
34$14$34$\
34$14$34$
\\.\SICE
\\.\SIWVID
\\.\NTICE
3Cannot write oreans.vxd
\Oreans.vxd
ADVAPI32.DLL
oreans32.sys
oreansx64.sys
\\.\oreans32
\\.\Global\oreans32
\\.\Global\oreansx64
%s\system32\drivers\%s
%s\syswow64\drivers\%s
%s\system32\drivers\oreans32.sys
3Cannot Update oreans.sys driver. Please, make sure that you have
3Cannot open oreans.vxd driver. Make sure that oreans.vxd
\\.\Oreans.vxd
%s\Oreans.vxd
contact info@oreans.com for this error
winmm.dll
3,$1,$3,$\
3<$1<$3<$\
^3,$1,$3,$\
CheckIN = %d
CheckOUT = %d
ProcIN = %d
ProcOUT = %d
ExitIN = %d
ExitOUT = %d
TPin = %d
HWIn = %d
IntV = %x, %x, %x, %x
]3<$1<$3<$\
3An internal exception occured (Address: 0x%x)
Please, contact support@oreans.com. Thank you!
(r%C`
.umN@>
14$34$14$
pavshook.dll
LVPrcInj.dll
ShimEng.dll
mscorwks.dll
fusion.dll
mscoreei.dll
mscorjit.dll
mscoree.dll
clr.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
2.exe
MSVCR80.DLL
MSVCR80d.DLL
shell32.dll
%Documents and Settings%\%current user%\Application Data
acgenral.dll
>\\?\
>%use
>%com
*Process Monitor - test.pml
3The file %s is missing. Please, re-install this application
45613056
ntdll.dll
kernel32.dll
kernelbase.dll
advapi32.dll
apphelp.dll
xgusb.cpl
^-*Wy$%d
<9.EXEu
CF\.FU
.blm2
%C^UY9
x.EFo
H|v.Oo
$X%x#J'
%9%Fj
.Jo8'
<.Si<.h
/[.bu
.KiIl?U\e
i`oU.lp
1?gE.fCU
Z.XgrY
09.sDR
[/l"%c
zi%XZ
t.kP%
i" <%F
oW>%fT
@M%u&T
FCYP%f
5)V.cU?
c.WTYU|
Er.Ds
%Dhmn
.ahA.Q
h.csD
|PKEY
SU%X3
2%C]KX
}.lg|A|
fTpS
EURl*
h.RMW
.BAz"
QwEbo
.isf\
N%uSw
)W6d.sU
0.mww

2.exe_1088_rwx_01180000_000F2000:

.text
`.data
.rsrc
@.reloc
ntdll.dll
KERNEL32.dll
BaseCleanupAppcompatCacheSupport
BaseInitAppcompatCacheSupport
BaseProcessInitPostImport
CallNamedPipeA
CallNamedPipeW
CmdBatNotification
ConnectNamedPipe
CreateIoCompletionPort
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
DisconnectNamedPipe
GetCPFileNameFromRegistry
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleOutputCP
GetDefaultSortkeySize
GetLargestConsoleWindowSize
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessShutdownParameters
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetWindowsDirectoryA
GetWindowsDirectoryW
PeekNamedPipe
RegisterWowExec
SetCPGlobal
SetConsoleInputExeNameA
SetConsoleInputExeNameW
SetConsoleKeyShortcuts
SetConsoleMaximumWindowSize
SetConsoleOutputCP
SetNamedPipeHandleState
SetProcessShutdownParameters
SetThreadExecutionState
TransactNamedPipe
VDMConsoleOperation
VDMOperationStarted
WaitNamedPipeA
WaitNamedPipeW
WinExec
NTDLL.RtlAddVectoredExceptionHandler
NTDLL.RtlDecodePointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDeleteCriticalSection
NTDLL.RtlEncodePointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEnterCriticalSection
NTDLL.RtlGetLastWin32Error
NTDLL.RtlAllocateHeap
NTDLL.RtlFreeHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlSizeHeap
NTDLL.RtlInitializeSListHead
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlLeaveCriticalSection
NTDLL.RtlQueryDepthSList
NTDLL.RtlRemoveVectoredExceptionHandler
NTDLL.RtlRestoreLastWin32Error
NTDLL.RtlCaptureContext
NTDLL.RtlCaptureStackBackTrace
NTDLL.RtlFillMemory
NTDLL.RtlMoveMemory
NTDLL.RtlUnwind
NTDLL.RtlZeroMemory
NTDLL.RtlSetCriticalSectionSpinCount
NTDLL.RtlSetLastWin32Error
NTDLL.RtlTryEnterCriticalSection
NTDLL.VerSetConditionMask
DirOperationControl
UrlCanonicalizeW
SHDeleteKeyW
PathCreateFromUrlW
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
EnumDesktopWindows
CloseWindowStation
twain_32.dll
Jt.HH;
midiOutShortMsg
SXS: %s() LdrFindOutOfProcessResource failed; nt status = lx
advapi32.dll
ReportEventW
RegSaveKeyW
RegSaveKeyExW
RegSaveKeyA
RegRestoreKeyW
RegQueryInfoKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegCloseKey
ElfReportEventW
CryptExportKey
CryptDestroyKey
\Device\NamedPipe\Win32Pipes.x.x
CM_Open_DevNode_Key
CryptCATCatalogInfoFromContext
SetPortW
EnumPrinterKeyW
EnumPortsW
DeletePrinterKeyW
DeletePortW
ConfigurePortW
AddPortW
ShellExecuteW
ShellExecuteExW
ShellExecuteExA
ShellExecuteA
SHFileOperationW
SHFileOperationA
FindExecutableW
FindExecutableA
ImportPrivacySettings
MprConfigTransportGetInfo
MprConfigTransportGetHandle
MprConfigTransportDelete
MprConfigTransportCreate
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportGetInfo
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceTransportEnum
MprConfigInterfaceTransportAdd
MprAdminTransportCreate
MprAdminPortGetInfo
MprAdminPortEnum
MprAdminInterfaceTransportAdd
MimeOleParseMhtmlUrl
ImmGetVirtualKey
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
GdiplusShutdown
|CAGetCertTypePropertyEx
CAGetCertTypeProperty
CAGetCertTypeKeySpec
CAGetCertTypeFlagsEx
CAGetCertTypeFlags
CAGetCertTypeExtensionsEx
CAGetCertTypeExtensions
CAGetCertTypeExpiration
CAGetCACertificate
CAFreeCertTypeProperty
CAFreeCertTypeExtensions
CAFindCertTypeByName
CAEnumNextCertType
CAEnumCertTypesForCAEx
CAEnumCertTypesForCA
CACountCertTypes
CACloseCertType
CACertTypeAccessCheck
ApphelpCheckExe
WZCPassword2Key
EapcfgNodeFromKey
SetupDiOpenDevRegKey
SetupDiCreateDevRegKeyW
SXS: %s() BasepSxsCreateStreams() failed
winlogon.EXE
PWVSSh
SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status lx
SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status lx
SXS: %s - Failing thread create becuase NtQueryInformationThread() failed with status lx
u\SSh
kernel32: No mapping for ImageInformation.Machine == x
TermsrvLogInstallIniFile
TermsrvGetWindowsDirectoryW
TermsrvGetWindowsDirectoryA
SXS: %s failing because RtlQueryInformationActivationContext() returned status lx
SXS: %s - Failure getting active activation context; ntstatus lx
SXS: %s() LdrAccessOutOfProcessResource failed; nt status = lx
SXS: %s() LdrCreateOutOfProcessImage failed
SXS: %s() NtQueryInformationFile failed
SXS: %s() empty lpSource %ls
SXS: %s() Calling csrss server failed
SXS: %s() RtlMultiAppendUnicodeStringBuffer failed
SXS: %s() NtMapViewOfSection failed
SXS: %s() AssemblyDirectory is not null terminated
SXS: %s() BaseDllMapResourceIdW failed
SXS: %s() ACTCTX_FLAG_RESOURCE_NAME_VALID set but lpResourceName == 0
SXS: %s() Bad lpAssemblyDirectory %ls
SXS: %s() Bad lpSource PathType %ls, 0x%lx
SXS: %s() Bad lpAssemblyDirectory PathType %ls, 0x%lx
SXS: %s() bad wProcessorArchitecture 0x%x
SXS: Invalid parameter(s) passed to FindActCtxSection*()
->cbSize = %u
SXS: %s() CsrCaptureMessageMultiUnicodeStringsInPlace failed
QSSSSh
\twain_32.dll
ReportFault
SXS: %s() NtCreateSection() failed
SXS: %s() NtOpenFile(%wZ) failed
SXS: %s() Null %p or size 0x%lx too small
SXS: %s() Bad flags/size 0x%lx/0x%lx
.debug
.reloc
.rsrc1
|wzcsapi.dll
wzcdlg.dll
wtsapi32.dll
ws2_32.dll
wmvcore.dll
wmi.dll
wldap32.dll
wintrust.dll
winsta.dll
winspool.drv
winscard.dll
winmm.dll
wininet.dll
winhttp.dll
version.dll
uxtheme.dll
utildll.dll
usp10.dll
userenv.dll
user32.dll
urlmon.dll
tapi32.dll
syssetup.dll
sti.dll
shsvcs.dll
shlwapi.dll
shell32.dll
shdocvw.dll
sfc.dll
setupapi.dll
secur32.dll
scecli.dll
samlib.dll
rtutils.dll
rpcrt4.dll
regapi.dll
rasman.dll
rasdlg.dll
rasapi32.dll
query.dll
pstorec.dll
psapi.dll
printui.dll
powrprof.dll
pidgen.dll
pautoenr.dll
oleaut32.dll
oleacc.dll
ole32.dll
odbc32.dll
ocmanage.dll
ntmarta.dll
ntlsapi.dll
ntlanman.dll
ntdsapi.dll
ntdsa.dll
netshell.dll
netrap.dll
netplwiz.dll
netman.dll
netcfgx.dll
netapi32.dll
mswsock.dll
mssign32.dll
msrating.dll
msimg32.dll
msi.dll
mshtml.dll
msgina.dll
mscat32.dll
msacm32.dll
mprui.dll
mprapi.dll
mpr.dll
mobsync.dll
mlang.dll
lz32.dll
linkinfo.dll
keymgr.dll
kdcsvc.dll
iphlpapi.dll
inetcomm.dll
imm32.dll
imgutil.dll
imagehlp.dll
hnetcfg.dll
gdiplus.dll
gdi32.dll
esent.dll
efsadu.dll
duser.dll
dnsapi.dll
dhcpcsvc.dll
devmgr.dll
ddraw.dll
d3dxof.dll
cscdll.dll
cryptui.dll
crypt32.dll
credui.dll
comdlg32.dll
comctl32.dll
certcli.dll
cdfview.dll
cabinet.dll
browseui.dll
authz.dll
apphelp.dll
advpack.dll
activeds.dll
WinStationIsHelpAssistantSession
WinStationEnumerate_IndexedW
|UnlockUrlCacheEntryStream
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileA
SetUrlCacheEntryInfoW
SetUrlCacheEntryGroupW
SetUrlCacheConfigInfoA
RetrieveUrlCacheEntryStreamW
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryFileA
RegisterUrlCacheNotification
ReadUrlCacheEntryStream
LoadUrlCacheContent
IsHostInProxyBypassList
InternetShowSecurityInfoByURLW
InternetOpenUrlW
InternetOpenUrlA
InternetCreateUrlW
InternetCreateUrlA
InternetCrackUrlW
InternetCrackUrlA
InternetCombineUrlW
InternetCanonicalizeUrlW
InternetCanonicalizeUrlA
HttpSendRequestW
HttpSendRequestExW
HttpSendRequestExA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoA
HttpOpenRequestW
HttpOpenRequestA
HttpEndRequestW
HttpEndRequestA
HttpAddRequestHeadersW
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoA
GetUrlCacheConfigInfoW
GetUrlCacheConfigInfoA
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryA
FtpRenameFileA
FtpRemoveDirectoryA
FtpPutFileEx
FtpOpenFileW
FtpOpenFileA
FtpGetFileSize
FtpGetFileEx
FtpGetCurrentDirectoryW
FtpGetCurrentDirectoryA
FtpFindFirstFileW
FtpFindFirstFileA
FtpDeleteFileW
FtpDeleteFileA
FtpCreateDirectoryW
FtpCreateDirectoryA
FtpCommandA
FreeUrlCacheSpaceW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryA
FindNextUrlCacheContainerW
FindNextUrlCacheContainerA
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryA
FindFirstUrlCacheContainerW
FindFirstUrlCacheContainerA
FindCloseUrlCache
DeleteUrlCacheGroup
DeleteUrlCacheEntryW
DeleteUrlCacheEntryA
DeleteUrlCacheContainerA
CreateUrlCacheGroup
CreateUrlCacheEntryW
CreateUrlCacheEntryA
CreateUrlCacheContainerW
CreateUrlCacheContainerA
CommitUrlCacheEntryW
CommitUrlCacheEntryA
|WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
WinHttpCloseHandle
|UrlMkSetSessionOption
UrlMkGetSessionOption
URLOpenBlockingStreamW
URLDownloadToFileW
URLDownloadToCacheFileW
IsValidURL
GetMarkOfTheWeb
CreateURLMoniker
CoInternetParseUrl
CoInternetIsFeatureEnabledForUrl
CoInternetGetSecurityUrl
CoInternetCombineUrl
SceSetupUpdateSecurityKey
RasShareConnection
RasIsSharedConnection
DsMakePasswordCredentialsW
DsFreePasswordCredentials
|NetpUpgradePreNT5JoinInfo
NetUserChangePassword
NetUnjoinDomain
NetJoinDomain
NetGetJoinInformation
|SpcGetCertFromKey
GetCryptProvFromCert
FreeCryptProvFromCert
|ShowModelessHTMLDialog
MPRUI_DoPasswordDialog
PRShowSaveFromMsginaW
PRShowRestoreFromMsginaW
KRShowKeyMgr
GetUdpStatistics
GetTcpStatistics
|IcfGetOperationalMode
SetViewportOrgEx
SetViewportExtEx
JetMakeKey
CryptUIDlgViewCertificateW
CryptVerifyCertificateSignature
CryptSignAndEncodeCertificate
CryptMsgGetParam
CryptMsgGetAndVerifySigner
CryptMsgClose
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfo
CryptHashPublicKeyInfo
CryptExportPublicKeyInfo
CertVerifySubjectCertificateContext
CertVerifyCertificateChainPolicy
CertStrToNameW
CertSetCertificateContextProperty
CertRegisterPhysicalStore
CertRDNValueToStrW
CertOpenSystemStoreW
CertOpenStore
CertNameToStrW
CertGetPublicKeyLength
CertGetNameStringW
CertGetIssuerCertificateFromStore
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain
CertFreeCTLContext
CertFindSubjectInCTL
CertFindExtension
CertFindCertificateInStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertCreateCertificateContext
CertCreateCTLContext
CertControlStore
CertCompareCertificateName
CertCloseStore
CertAddCertificateContextToStore
CredUICmdLinePromptForCredentialsW
SSSSh
PSSSSSSh
t.PSW
mem16.dll
ImpersonateNamedPipeClient
VWSSh
t.hlt
hypertrm.exe"
hypertrm.exe
.exr (exception record)
.cxr (context record)
serialui.dll
mekr386.exe
PVWSSh
SXS: %s() BaseDllMapResourceIdA failed
-. "%ls" %ld
(LRU) (Exe Name) (FileSize)
Total Entries = 0x%x
xpsp2res.dll
xpsp3res.dll
?456789:;<=
!"#$%&'()* ,-./0123
|CertAutoEnrollment
VSSHP
NtQueryValueKey
NtOpenKey
NtFlushKey
NtSetValueKey
NtCreateKey
NtEnumerateKey
NtEnumerateValueKey
RtlFormatCurrentUserKeyPath
NtQueryKey
NtDeleteValueKey
RtlGetProcessHeaps
NtCreateNamedPipeFile
NtSetThreadExecutionState
LdrQueryImageFileExecutionOptions
NtDelayExecution
NtYieldExecution
kernel32.pdb
0!1'1;1|1
;,<0<8<<<
67
2,242<2}2@3
: :$:(:,:0:4:8:<:
8 8$8(8,8084888<8
< <$<(<,<0<4<8<<<@<]<
$0(040:0
<$=`=[?~?
1!202<2|2
4 4$4(4,4044484
sShortDate
win.ini
.Config
.Manifest
\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
\Windows
\NLS\NlsSectionSortkey
\system32\Apphelp.dll
\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
ADVAPI32.DLL
\\.\MountPointManager
\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters
hotkey.%u %s
wowexec.pif
cmd /c
hotkey.
setup.exe
\DosDevices\pipe\
\\.\pipe\
\REGISTRY\USER\.DEFAULT
WUSER32.DLL
~RF%4x.TMP
netmsg.dll
pipe\
c:\temp\
EmbdTrst.DLL
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
%ws%u\DosDevices\%ws
WINDOWS
\\?\GLOBALROOT
Application.Manifest
"/\[]:|<> =;,?
\REGISTRY\Machine\Software\Microsoft\Windows NT\currentVersion\Time Zones
\Registry\Machine\Software\Policies\Microsoft\Windows\System
AppCertDlls
tsappcmp.dll
\inifile.upd
t\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
DRMHeader.SubscriptionContentID
DRMHeader.ContentDistributor
DRMHeader.SECURITYVERSION
DRMHeader.CID
DRMHeader.LAINFO
DRMHeader.KID
LicenseStateData.Transfer.NONSDMI
LicenseStateData.Transfer.SDMI
LicenseStateData.Print.redbook
LicenseStateData.Play
ActionAllowed.Backup
ActionAllowed.Transfer.NONSDMI
ActionAllowed.Transfer.SDMI
ActionAllowed.Print.redbook
ActionAllowed.Play
BaseLAURL
Transfer.NONSDMI
Transfer.SDMI
Print.redbook
Software\Microsoft\Windows NT\CurrentVersion\Time Zones
TimeZoneKeyName
PendingFileRenameOperations%d
PendingFileRenameOperations
%s\system32\
\system32\faultrep.dll
mwowcmdline
cmdline
CONSOLE.DLL
conime.exe
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console
\INF\INTL.INF
DNSAPI.DLL
cfgmgr32.dll
The operation completed successfully.
Not enough storage is available to complete this operation.
The process cannot access the file because another process has locked a portion of the file.
The request is not supported.
Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator.
The specified server cannot perform the requested operation.
The specified network password is not correct.
The pipe has been ended.
The system does not support the command requested.
This function is not supported on this system.
The data area passed to a system call is too small.
Attempt to use a file handle to an open disk partition for an operation other than raw disk I/O.
A JOIN or SUBST command cannot be used for a drive that contains previously joined drives.
An attempt was made to use a JOIN or SUBST command on a drive that has already been joined.
An attempt was made to use a JOIN or SUBST command on a drive that has already been substituted.
The system tried to delete the JOIN of a drive that is not joined.
The system tried to join a drive to a directory on a joined drive.
The system tried to join a drive to a directory on a substituted drive.
The system tried to SUBST a drive to a directory on a joined drive.
The system cannot perform a JOIN or SUBST at this time.
The system cannot join or substitute a drive to or for a directory on the same drive.
An attempt was made to join or substitute a drive for which a directory on the drive is the target of a previous substitute.
System trace information was not specified in your CONFIG.SYS file, or tracing is disallowed.
DosMuxSemWait did not execute; too many semaphores are already set.
The file system does not support atomic changes to the lock type.
The operating system cannot run %1.
The flag passed is not correct.
The operating system cannot run this application program.
The operating system is not presently configured to run this application.
The pipe state is invalid.
All pipe instances are busy.
The pipe is being closed.
No process is on the other end of the pipe.
The wait operation timed out.
The mounted file system does not support extended attributes.
The volume is too fragmented to complete this operation.
There is a process on other end of the pipe.
Waiting for a process to open the other end of the pipe.
The I/O operation has been aborted because of either a thread exit or an application request.
Overlapped I/O operation is in progress.
Error performing inpage operation.
The requested operation cannot be performed in full-screen mode.
The configuration registry key is invalid.
The configuration registry key could not be opened.
The configuration registry key could not be read.
The configuration registry key could not be written.
An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry.
Illegal operation attempted on a registry key that has been marked for deletion.
Cannot create a symbolic link in a registry key that already has subkeys or values.
Cannot create a stable subkey under a volatile parent key.
The account name is invalid or does not exist, or the password is invalid for the account name specified.
The executable program that this service is configured to run in does not implement the service.
A serial I/O operation was completed by another write to the serial port.
A serial I/O operation completed because the timeout period expired.
The floppy disk controller reported an error that is not recognized by the floppy disk driver.
While accessing the hard disk, a recalibrate operation failed, even after retries.
While accessing the hard disk, a disk operation failed even after retries.
An attempt was made to create more links on a file than the file system supports.
The specified program requires a newer version of Windows.
The specified program is not a Windows or MS-DOS program.
The specified program was written for an earlier version of Windows.
No application is associated with the specified file for this operation.
The message can be used only with synchronous operations.
The device has indicated that cleaning is required before further operations are attempted.
There was no match for the specified key in the index.
The point passed to GetMouseMovePoints is not in the buffer.
The format of the specified password is invalid.
The operation was canceled by the user.
The requested operation cannot be performed on a file with a user-mapped section open.
The network transport endpoint already has an address associated with it.
An operation was attempted on a nonexistent network connection.
An invalid operation was attempted on an active network connection.
The network location cannot be reached. For information about network troubleshooting, see Windows Help.
No service is operating at the destination network endpoint on the remote system.
The operation could not be completed. A retry should be performed.
The network address could not be used for the operation requested.
The operation being requested was not performed because the user has not been authenticated.
The operation being requested was not performed because the user has not logged on to the network.
An attempt was made to perform an initialization operation when initialization has already been completed.
This operation is supported only when you are connected to the server.
This operation is not supported on a Microsoft Small Business Server
The remote system is not available. For information about network troubleshooting, see Windows Help.
Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator.
KDC certificate during smartcard logon.
The smartcard certificate used for authentication has been revoked.
An untrusted certificate authority was detected While processing the
smartcard certificate used for authentication. Please contact your system
The revocation status of the smartcard certificate used for
The smartcard certificate used for authentication was not trusted. Please
The smartcard certificate used for authentication has expired. Please
A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image.
No encryption key is available. A well-known encryption key was returned.
The password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string.
An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.
Unable to update the password. The value provided as the current password is incorrect.
Unable to update the password. The value provided for the new password contains values that are not allowed in passwords.
Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirement of the domain.
Logon failure: unknown user name or bad password.
Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced.
Logon failure: the specified account password has expired.
Unable to perform a security operation on an object that has no associated security.
The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation.
The domain was in the wrong state to perform the security operation.
This operation is only allowed for the Primary Domain Controller of the domain.
Unable to complete the requested operation because of either a catastrophic media failure or a data structure corruption on the disk.
The logon session is not in a state that is consistent with the requested operation.
Unable to impersonate using a named pipe until data has been read from that pipe.
The transaction state of a registry subtree is incompatible with the requested operation.
Cannot perform this operation on built-in accounts.
Cannot perform this operation on this built-in special group.
Cannot perform this operation on this built-in special user.
A cross-encrypted password is necessary to change a user password.
A cross-encrypted password is necessary to change this user password.
There is no user session key for the specified logon session.
Mutual Authentication failed. The server's password is out of date at the domain controller.
This operation can not be performed on the current domain.
Hot key is already registered.
Class still has open windows.
Hot key is not registered.
This list box does not support tab stops.
Child windows cannot have menus.
All handles to windows in a multiple-window position structure must have the same parent.
The paging file is too small for this operation to complete.
Invalid keyboard layout handle.
This operation requires an interactive window station.
This operation returned because the timeout period expired.
The event log file has changed between read operations.
The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance.
The configuration data for this product is corrupt. Contact your support personnel.
This installation package cannot be installed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service.
SQL query syntax invalid or unsupported.
This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.
This installation package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer package.
There was an error starting the Windows Installer service user interface. Contact your support personnel.
The language of this installation package is not supported by your system.
Function could not be executed.
Function failed during execution.
Data of this type is not supported.
The Windows Installer service failed to start. Contact your support personnel.
This installation package is not supported by this processor type. Contact your product vendor.
This patch package could not be opened. Verify that the patch package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer patch package.
This patch package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer patch package.
This patch package cannot be processed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service.
Invalid command line argument. Consult the Windows Installer SDK for detailed command line help.
The requested operation completed successfully. The system will be restarted so the changes can take effect.
The upgrade patch cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program. Verify that the program to be upgraded exists on your computer an
The RPC protocol sequence is not supported.
Not enough resources are available to complete this operation.
The RPC server is too busy to complete this operation.
The remote procedure call failed and did not execute.
The transfer syntax is not supported by the RPC server.
The universal unique identifier (UUID) type is not supported.
The name syntax is not supported.
The server endpoint cannot perform the operation.
No interfaces have been exported.
There is nothing to unexport.
The requested operation is not supported.
A floating-point operation at the RPC server caused a division by zero.
A null context handle was passed from the client to the host during a remote procedure call.
The binding handles passed to a remote procedure call do not match.
A null reference pointer was passed to the stub.
The supplied user buffer is not valid for the requested operation.
The specified port is unknown.
The requested authentication level is not supported.
The error specified is not a valid Windows RPC error code.
Invalid operation on the encoding/decoding handle.
The RPC pipe object is invalid or corrupted.
An invalid operation was attempted on an RPC pipe object.
Unsupported RPC pipe version.
The user's password must be changed before logging on the first time.
The object exporter specified was not found.
Invalid asynchronous RPC call handle for this operation.
The RPC pipe object has already been closed.
The RPC call completed before all pipes were processed.
No more data is available from the RPC pipe.
Not all object UUIDs could be exported to the specified entry.
Interface could not be exported to the specified entry.
The window style or class attribute is invalid for this operation.
The requested metafile operation is not supported.
The requested transformation operation is not supported.
The requested clipping operation is not supported.
The network connection was made successfully, but the user had to be prompted for a password other than the one originally specified.
The requested operation is not allowed when there are jobs queued to the printer.
The requested operation is successful. Changes will not be effective until the system is rebooted.
The requested operation is successful. Changes will not be effective until the service is restarted.
The importation from the file failed.
The GUID passed was not recognized as valid by a WMI data provider.
The instance name passed was not recognized as valid by a WMI data provider.
The data item ID passed was not recognized as valid by a WMI data provider.
The medium currently exists in an offline library and must be online to perform this operation.
The operation cannot be performed on an offline library.
The library, drive, or media pool must be empty to perform this operation.
A resource required for this operation is disabled.
The drive cannot be cleaned or does not support cleaning.
The resource required for this operation does not exist.
The operation identifier is not valid.
The operator or administrator has refused the request.
The transport cannot access the medium.
Unable to retrieve status about the transport.
Cannot use the transport because it is already in use.
Unable to open or close the inject/eject port.
The media type cannot be removed from this library since at least one drive in the library reports it can support this media type.
The remote storage service is not operational at this time.
A cluster node is not available for this operation.
The operation could not be completed because the cluster group is not online.
The operation could not be completed because the cluster resource is online.
The group or resource is not in the correct state to perform the requested operation.
A cluster network is not available for this operation.
All cluster nodes must be running to perform this operation.
A node is in the process of joining the cluster.
A cluster join operation is not in progress.
This operation cannot be performed on the cluster resource as it the quorum resource. You may not bring the quorum resource offline or modify its possible owners list.
The cluster node is not ready to perform the requested operation.
The cluster join operation was aborted.
The cluster join operation failed due to incompatible software versions between the joining node and its sponsor.
The system configuration changed during the cluster join or form operation. The join or form operation was aborted.
The specified node does not support a resource of this type. This may be due to version inconsistencies or due to the absence of the resource DLL on this node.
The specified resource name is not supported by this resource DLL. This may be due to a bad (or changed) name supplied to the resource DLL.
The join operation failed because the cluster database sequence number has changed or is incompatible with the locker node. This may happen during a join operation if the cluster database was changing during the join.
The resource monitor will not allow the fail operation to be performed while the resource is in its current state. This may happen if the resource is in a pending state.
An operation was attempted that is incompatible with the current membership state of the node.
The join operation failed because the cluster instance ID of the joining node does not match the cluster instance ID of the sponsor node.
This computer cannot be made a member of a cluster because it does not have the correct version of Windows installed.
There are no EFS keys defined for the user.
The specified file is not in the defined EFS export format.
The server is not trusted for remote encryption operation.
Recovery policy configured for this system contains invalid recovery certificate.
The encryption algorithm used on the source file needs a bigger key buffer than the one on the destination file.
The disk partition does not support file encryption.
A registry key for event logging could not be created for this session.
A close operation is pending on the session.
The MODEM.INF file was not found.
The modem name was not found in MODEM.INF.
Transport driver error
The requested operation cannot be completed because the terminal connection is currently busy processing a connect, disconnect, reset, or delete operation.
An attempt has been made to connect to a session whose video mode is not supported by the current client.
DOS graphics mode is not supported.
The requested operation can be performed only on the system console.
Disconnecting the console session is not supported.
Reconnecting a disconnected session to the console is not supported.
The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported.
The requested operation could not be performed because the directory service is not the master for that type of operation.
The requested operation did not satisfy one or more constraints associated with the class of the object.
The directory service can perform the requested operation only on a leaf object.
The directory service cannot perform the requested operation on the RDN attribute of an object.
The requested cross-domain move operation could not be performed.
An operations error occurred.
The requested authentication method is not supported by the server.
The server does not support the requested critical extension.
The operation affects multiple DSAs
The server is not operational.
The specified method is not supported.
The specified control is not supported by the server.
The add replica operation cannot be performed. The naming context must be writable in order to create the replica.
The attribute specified in the operation is not present on the object.
Illegal modify operation. Some aspect of the modification is not permitted.
The operation must be performed at a master DSA.
The operation could not be performed because the object's parent is either uninstantiated or deleted.
The operation cannot be performed because child objects exist. This operation can only be performed on a leaf object.
The operation is out of scope.
The operation cannot continue because the object is in the process of being removed.
The operation can only be performed on an internal master DSA object.
Insufficient access rights to perform the operation.
The operation cannot be performed on a back link.
The operation could not be performed because the directory service is shutting down.
The requested FSMO operation failed. The current FSMO holder could not be contacted.
Subtree notifications are only supported on NC heads.
The requested delete operation could not be performed.
The global catalog verification failed. The global catalog is not available or does not support the operation. Some part of the directory is currently not available.
The replication operation failed because of a schema mismatch between the servers involved.
The operation cannot replace the hidden record.
This directory server is shutting down, and cannot take ownership of new floating single-master operation roles.
The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles.
The directory service was unable to transfer ownership of one or more floating single-master operation roles to other servers.
The replication operation failed.
An invalid parameter was specified for this replication operation.
The directory service is too busy to complete the replication operation at this time.
The distinguished name specified for this replication operation is invalid.
The naming context specified for this replication operation is invalid.
The distinguished name specified for this replication operation already exists.
The replication operation encountered a database inconsistency.
The server specified for this replication operation could not be contacted.
The replication operation encountered an object with an invalid instance type.
The replication operation failed to allocate memory.
The replication operation encountered an error with the mail system.
The replication operation encountered a database error.
The requested operation is not supported by this version of the directory service.
The replication operation failed due to a collision of object names.
The replication operation failed because a required parent object is missing.
The replication operation was preempted.
The replication operation was terminated because the system is shutting down.
The server specified for this replication operation was contacted, but that server was unable to contact an additional server needed to complete the operation.
The version of the Active Directory schema of the source forest is not compatible with the version of Active Directory on this computer. You must upgrade the operating system on a domain controller in the source forest before this computer can be added as a domain controller to that forest.
The requested operation requires a directory service, and none was available.
The requested search operation is only supported for base searches.
The schema update operation tried to add a backward link attribute that has no corresponding forward link.
Source and destination for the cross-domain move operation are identical. Caller should use local move operation instead of cross-domain move operation.
Another operation which requires exclusive access to the PDC FSMO is already in progress.
A cross-domain move operation failed such that two versions of the moved object exist - one each in the source and destination domains. The destination object needs to be removed to restore the system to a consistent state.
The directory cannot validate the proposed naming context name because it does not hold a replica of the naming context above the proposed naming context. Please ensure that the domain naming master role is held by a server that is configured as a global catalog server, and that the server is up to date with its replication partners. (Applies only to Windows 2000 Domain Naming masters)
The operation can not be performed because the server does not have an infrastructure container in the domain of interest.
The replica/child install failed to read the objectVersion attribute in the SCHEMA section of the file schema.ini in the system32 directory.
Only DSAs configured to be Global Catalog servers should be allowed to hold the Domain Naming Master FSMO role. (Applies only to Windows 2000 servers)
The DSA operation is unable to proceed because of a DNS lookup failure.
The object requested was not found, but an object with that key was found.
The syntax of the linked attribute being added is incorrect. Forward links can only have syntax 2.5.5.1, 2.5.5.7, and 2.5.5.14, and backlinks can only have syntax 2.5.5.1
Security Account Manager needs to get the boot password.
Security Account Manager needs to get the boot key from floppy disk.
The operation requires that destination domain auditing be enabled.
The operation couldn't locate a DC for the source domain.
The replication operation could not be completed due to a schema incompatibility.
The replication operation could not be completed due to a previous schema incompatibility.
The replication update could not be applied because either the source or the destination has not yet received information regarding a recent cross-domain move operation.
The requested operation can be performed only on a global catalog server.
The operation requires that source domain auditing be enabled.
A Filter was passed that uses constructed attributes.
Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.
For security reasons, the operation must be run on the destination DC.
Critical Directory Service System objects cannot be deleted during tree delete operations. The tree delete may have been partially performed.
This version of Windows is too old to support the current directory forest behavior. You must upgrade the operating system on this server before it can become a domain controller in this forest.
This version of Windows is too old to support the current domain behavior. You must upgrade the operating system on this server before it can become a domain controller in this domain.
This version of Windows no longer supports the behavior version in use in this directory forest. You must advance the forest behavior version before this server can become a domain controller in the forest.
This version of Windows no longer supports the behavior version in use in this domain. You must advance the domain behavior version before this server can become a domain controller in the domain.
The version of Windows is incompatible with the behavior version of the domain or forest.
The sort order requested is not supported.
Unable to continue operation because multiple conflicting controls were used.
Rename or move operations on naming context heads or read-only objects are not allowed.
Move operations on objects in the schema naming context are not allowed.
The requested action is not supported on standard server.
The directory service cannot perform the requested operation because the servers
Operation not allowed on a disabled cross ref.
Schema update failed: Duplicate msDS-INtId. Retry the operation.
The remote create cross reference operation failed on the Domain Naming Master FSMO. The operation's error is in the extended data.
DNS request not supported by name server.
DNS operation refused.
DNS bad key.
Try DNS operation again later.
The operation requested is not permitted on a DNS root server.
Invalid operation for DNS zone.
The operation cannot be performed because this zone is shutdown.
TCP/IP network protocol not installed.
A blocking operation was interrupted by a call to WSACancelBlockingCall.
A non-blocking socket operation could not be completed immediately.
A blocking operation is currently executing.
An operation was attempted on a non-blocking socket that already had an operation in progress.
An operation was attempted on something that is not a socket.
A required address was omitted from an operation on a socket.
A protocol was specified in the socket function call that does not support the semantics of the socket type requested.
An unknown, invalid, or unsupported option or level was specified in a getsockopt or setsockopt call.
The support for the specified socket type does not exist in this address family.
The attempted operation is not supported for the type of object referenced.
Only one usage of each socket address (protocol/network address/port) is normally permitted.
A socket operation encountered a dead network.
A socket operation was attempted to an unreachable network.
The connection has been broken due to keep-alive activity detecting a failure while the operation was in progress.
An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.
A socket operation failed because the destination host was down.
A socket operation was attempted to an unreachable host.
A Windows Sockets implementation may have a limit on the number of applications that may use it simultaneously.
The Windows Sockets version requested is not supported.
The specified transport mode filter already exists.
The specified transport mode filter does not exist.
The requested lookup key was not found in any active activation context.
The transport filter is pending deletion.
IKE failed to find valid machine certificate
Certificate Revocation Check failed
Invalid certificate key usage
Invalid certificate type
No private key associated with machine certificate
Peer's certificate did not have a public key
Error processing Cert payload
Error processing Certificate Request payload
Peer failed to send valid machine certificate
Certification Revocation check of peer's certificate failed
Failed to load SECURITY.DLL.
Unsupported ID
Invalid certificate signature
The lifetime value received in the Responder Lifetime Notify is below the Windows 2000 configured minimum value. Please fix the policy on the peer machine.
Key length in certificate is too small for configured security requirements.
Lack of system resources has required isolated activation to be disabled for the current thread of execution.
Manifest Parse Error : System does not support the specified encoding.
Manifest Parse Error : Switch from current encoding to specified encoding not supported.
Assembly Protection Error : The public key for an assembly was too short to be allowed.
The storage operation should block until more data is available.
The storage operation should retry immediately.
The notified event sink will not influence the storage operation.
Drag-drop operation canceled
FORMATETC not supported
Invalid window handle passed
An asynchronous operation was specified. The operation has begun, but its outcome is not known yet.
The transaction was successfully aborted. However, this is a coordinated transaction, and some number of enlisted resources were aborted outright because they could not support abort-retaining semantics
An abort operation was already in progress.
No such interface supported
Operation aborted
The data necessary to complete this operation is not yet available.
Use of Ole1 services requiring DDE windows is disabled
The server process could not be started because the configured identity is incorrect. Check the username and password.
The operation attempted is not supported.
Unable to complete the call since there is no COM  security context inside IObjectControl.Activate.
The callee (server [not server application]) is not available and disappeared; all connections are invalid. The call may have executed.
The callee (server [not server application]) is not available and disappeared; all connections are invalid. The call did not execute.
Impersonate on unsecure calls is not supported.
Unable to obtain the Windows directory
The version of ACL format in the stream is not supported by this implementation of IAccessControl
Does not support a collection.
Wrong module kind for the operation.
Unable to perform requested operation.
Attempted an operation on an invalid object.
There is insufficient memory available to complete operation.
An error occurred during a seek operation.
A disk error occurred during a write operation.
A disk error occurred during a read operation.
There is insufficient disk space to complete operation.
Share.exe or equivalent is required for operation.
Illegal operation called on non-file based storage.
Illegal operation called on object with extant marshallings.
OLE32.DLL has been loaded at the wrong address.
Copy Protection Error - The given sector does not have a valid CSS key.
Copy Protection Error - DVD session key not established.
Need to run the object to perform this operation
There is no cache to operate on
Object is static; operation not allowed
compobj.dll is too old for the ole2.dll initialized
Not able to perform the operation because object is not given storage yet
Object doesn't support IViewObject interface
Class does not support aggregation (or class object is remote)
Could not read key from registry
Could not write key to registry
Could not find the key in the registry
A network error interrupted the operation.
There was an error in a Windows GDI call while converting the bitmap to a DIB
There was an error in a Windows GDI call while converting the DIB to a bitmap.
Operation exceeded deadline
Operation unavailable
Intermediate operation failed
User input required for operation to succeed
COM  is required for this operation, but is not installed
Task Scheduler security services are available only on Windows NT.
The task object version is either unsupported or invalid.
The task has been configured with an unsupported combination of account settings and run time options.
A retaining commit or abort is not supported
The requested isolation level is not valid or supported.
The transaction manager doesn't support an asynchronous operation for this method.
The requested semantics of retention of isolation across retaining commit and abort boundaries cannot be supported by this transaction implementation, or isoFlags was not equal to zero.
An import object for the transaction could not be found.
A time-out was specified, but time-outs are not supported.
The requested operation is already in progress for the transaction.
The Transaction Manager has disabled its support for TIP.
The transaction manager has disabled its support for remote/network transactions.
The partner transaction manager has disabled its support for remote/network transactions.
The transaction manager has disabled its support for XA transactions.
The requested operation requires that JIT be in the current context and it is not
The requested operation requires that the current context have a Transaction, and it does not
Server execution failed
Bad Key.
Key not valid for use in specified state.
Key does not exist.
Insufficient memory available for the operation.
Provider's public key is invalid.
Keyset does not exist
The keyset is not defined.
Keyset as registered is invalid.
The Keyset parameter is invalid.
The key parameters could not be set because the CSP uses fixed parameters.
The function requested is not supported
The per-message Quality of Protection is not supported by the security package
The certificate chain was issued by an authority that is not trusted.
An unknown error occurred while processing the certificate.
The received certificate has expired.
The other end of the security negotiation is requires strong crypto but it is not supported on the local machine.
The client cert name does not matches the user name or the KDC name is incorrect.
The encryption type requested is not supported by the KDC.
An unsupported preauthentication mechanism was presented to the kerberos package.
The requested operation requires delegation to be enabled on the machine.
The received certificate was mapped to multiple accounts.
SEC_E_NO_KERB_KEY
An error occurred while performing an operation on a cryptographic message.
The streamed cryptographic message requires more data to complete the decode operation.
An error occurred during encode or decode operation.
The specified certificate is self signed.
The previous certificate or CRL context was deleted.
The certificate does not have a property that references a private key.
Cannot find the certificate and private key for decryption.
Cannot find the certificate and private key to use for decryption.
The certificate is revoked.
No Dll or exported function was found to verify revocation.
The revocation function was unable to check revocation for the certificate.
The certificate is not in the revocation server's database.
The string contains an invalid X500 name attribute key, oid, value or delimiter.
The dwValueType for the CERT_NAME_VALUE is not one of the character strings. Most likely it is either a CERT_RDN_ENCODED_BLOB or CERT_TDN_OCTED_STRING.
The Put operation can not continue. The file needs to be resized. However, there is already a signature present. A complete signing operation must be done.
The cryptographic operation failed due to a local security option setting.
No DLL or exported function was found to verify subject usage.
The subject was not found in a Certificate Trust List (CTL).
None of the signers of the cryptographic message or certificate trust list is trusted.
The public key's algorithm parameters are missing.
OSS Certificate encode/decode error code base
OSS ASN.1 Error: Unsupported BER indefinite-length encoding.
ASN1 Certificate encode/decode error code base.
ASN1 function not supported for this PDU.
The request's current status does not allow this operation.
The certification authority's certificate contains invalid data.
Certificate service has been suspended for a database restore operation.
The certificate contains an encoded length that is potentially incompatible with older enrollment software.
The operation is denied. The user has multiple roles assigned and the certification authority is configured to enforce role separation.
The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.
Cannot archive private key. The certification authority is not configured for key archival.
Cannot archive private key. The certification authority could not verify one or more key recovery certificates.
The request is incorrectly formatted. The encrypted private key must be in an unauthenticated attribute in an outermost signature.
The request contains an invalid renewal certificate attribute.
An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions.
The permissions on this certification authority do not allow the current user to enroll for certificates.
The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
The requested certificate template is not supported by this CA.
The request contains no certificate template information.
The request is missing a required private key for archival by the server.
The request was made on behalf of a subject other than the caller. The certificate template must be configured to require at least one signature to authorize the request.
The request template version is newer than the supported template version.
The request includes a private key for archival by the server, but key archival is not enabled for the specified certificate template.
The public key does not meet the minimum size required by the specified certificate template.
The key is not exportable.
You cannot add the root CA certificate into your local store.
The key archival hash attribute was not found in the response.
An unexpetced key archival hash attribute was found in the response.
There is a key archival hash mismatch between the request and the response.
Signing certificate cannot include SMIME extension.
The certificate for the signer of the message is invalid or not found.
The signature of the certificate can not be verified.
The timestamp signature and/or certificate could not be verified or is malformed.
A certificate's basic constraint extension has not been observed.
The certificate does not meet or contain the Authenticode financial extensions.
The file did not pass the hints check.
Failed on a file operation (open, map, read, write).
The trust verification action specified is not supported by the specified trust provider.
The form specified for the subject is not one supported or known by the specified trust provider.
A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
The validity periods of the certification chain do not nest correctly.
A certificate that can only be used as an end-entity is being used as a CA or visa versa.
A path length constraint in the certification chain has been violated.
A certificate contains an unknown extension that is marked 'critical'.
A certificate being used for a purpose other than the ones specified by its CA.
A parent of a given certificate in fact did not issue that child certificate.
A certificate is missing or has an empty value for an important field, such as a subject or issuer name.
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
An internal certificate chaining error has occurred.
A certificate was explicitly revoked by its issuer.
The certification path terminates with the test root which is not trusted with the current policy settings.
The revocation process could not continue - the certificate(s) could not be checked.
The certificate's CN name does not match the passed value.
The certificate is not valid for the requested usage.
The certificate was explicitly marked as untrusted by the user.
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
The certificate has invalid policy.
The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.
The requested device registry key does not exist.
The operation cannot be performed on a device information element that has not been registered.
The operation does not require any files to be copied.
The operation cannot be performed because the device information set is locked.
The operation cannot be performed because the device information element is locked.
The operation cannot be performed because the file queue is locked.
The operation cannot be performed because the device interface is currently active.
The operation cannot be performed because the device interface has been removed from the system.
The driver selected for this device does not support Windows XP.
The driver selected for this device does not support Windows.
Operation not allowed in WOW64.
The operation involving unsigned file copying was rolled back, so that a system restore point could be set.
An INF was copied into the Windows INF directory in an improper manner.
The operation requires a Smart Card, but no Smart Card is currently in the device.
The operation has been aborted to allow the server application to exit.
The reader driver does not meet minimal requirements for support.
The smart card does not meet minimal requirements for support.
The requested order of object creation is not supported.
This smart card does not support the requested feature.
The requested certificate does not exist.
The requested certificate could not be obtained.
A communications error with the smart card has been detected. Retry the operation.
The requested key container does not exist on the smart card.
The identity or password set on the application is not valid
The DLL does not support the components listed in the TypeLib
The server catalog version is not supported
This operation can not be performed on the system application
This operation is not enabled on this platform
Application Proxy is not exportable
System application is not exportable
Can not subscribe to this component (the component may have been imported)
The partition cannot be exported, because one or more components in the partition have the same file name
Applications that contain one or more imported components cannot be installed into a non-base partition
The COM  Catalog Server threw an exception during execution
MSMQ is required for the requested operation and is not installed
Unable to marshal an interface that does not support IPersistStream
The ProgID provided to the copy operation is invalid. The ProgID is in use by another registered CLSID.
Only Application Files (*.MSI files) can be installed into partitions.
Applications containing one or more legacy components may not be exported to 1.0 format.
The SID filtering operation removed all SIDs.
Windows NT BASE API Client DLL
5.1.2600.5512 (xpsp.080413-2111)
Windows
Operating System
5.1.2600.5512
$$$$Guinea$Republic of Guinea)$$$$Guyana$Cooperative Republic of Guyana
$$$$Panama$Republic of Panama $$$$Portugal$Portuguese Republic:$$$$Papua New Guinea$Independent State of Papua New Guinea
$$$$Turkey$Republic of Turkey
$$$860 (OEM - Portuguese)
Portuguese (Brazil)$Brazil $$$1047 (IBM EBCDIC - Latin-1/Open System)
Turkish$Turkey
Portuguese (Portugal)$Portugal

FEK.exe_1948:

@.rsrc
.data
udPh
PSSSSSSh
PSSSSSSh!
YYhl%S
YYhX%S
t/hL%S
t2h@%S
vSSSh
FTPjK
FtPj;
C.PjRV
tGHt.Ht&
.EKSWU
FTPG
FTPj
FtPS
H%XLU
H%XMU
=KNILw.tT=RCNEw
_0 _8 _4;_,
SHA1 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
SHA256 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro@openssl.org>
6-9'6-9'
$6.:$6.:
*?#1*?#1
>8$4,8$4,
AES for x86, CRYPTOGAMS by <appro@openssl.org>
Camellia for x86 by <appro@openssl.org>
RC4 for x86, CRYPTOGAMS by <appro@openssl.org>
FRegDeleteKeyExW
MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}</STYLE></HEAD><META http-equiv=Content-Type content="text/html; charset=utf-8"><BODY>
mail@domain.com
Date: %d %s %d %d:%d:%d
EHLO %s
,qop=%s
,response=%s
,digest-uri="%s"
,cnonce="%s"
,nc=%s
,nonce="%s"
,realm="%s"
charset=utf-8,username="%s"
smtp/
AUTH PLAIN %s
^%s^%s
AUTH LOGIN
LOGIN
--%s--
RCPT TO:<%s>
MAIL FROM:<%s>
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
portuguese-brazilian
ADVAPI32.DLL
kernel32.dll
UxTheme.dll
OLEACC.dll
passed a null parameter
DSO support routines
x509 certificate routines
error:lX:%s:%s:%s
ssl_sess_cert
ssl_cert
evp_pkey
x509_pkey
%s(%d): OpenSSL internal error, assertion failed: %s
lhash part of OpenSSL 1.0.0d 8 Feb 2011
Stack part of OpenSSL 1.0.0d 8 Feb 2011
supportedAlgorithms
crossCertificatePair
certificateRevocationList
cACertificate
userCertificate
userPassword
supportedApplicationContext
Microsoft Local Key set
LocalKeySet
id-Gost28147-89-None-KeyMeshing
id-Gost28147-89-CryptoPro-KeyMeshing
password based MAC
id-PasswordBasedMAC
X509v3 Certificate Issuer
certificateIssuer
certicom-arc
Proxy Certificate Information
proxyCertInfo
Microsoft Smartcardlogin
msSmartcardLogin
joint-iso-itu-t
JOINT-ISO-ITU-T
set-rootKeyThumb
setAttr-Cert
setCext-cCertRequired
setCext-certType
setct-CertResTBE
setct-CertReqTBEX
setct-CertReqTBE
setct-AcqCardCodeMsgTBE
setct-CertInqReqTBS
setct-CertResData
setct-CertReqTBS
setct-CertReqData
setct-PCertResTBS
setct-PCertReqData
setct-AcqCardCodeMsg
certificate extensions
set-certExt
set-msgExt
id-ecPublicKey
id-cmc-confirmCertAcceptance
id-cmc-getCert
id-regInfo-certReq
id-regCtrl-protocolEncrKey
id-regCtrl-oldCertID
id-it-revPassphrase
id-it-keyPairParamRep
id-it-keyPairParamReq
id-it-unsupportedOIDs
id-it-caKeyUpdateInfo
id-it-encKeyPairTypes
id-it-signKeyPairTypes
id-it-caProtEncCert
id-mod-attribute-cert
id-mod-qualified-cert-93
id-mod-qualified-cert-88
id-smime-aa-ets-certCRLTimestamp
id-smime-aa-ets-certValues
id-smime-aa-ets-CertificateRefs
id-smime-aa-ets-otherSigCert
id-smime-aa-smimeEncryptCerts
id-smime-aa-signingCertificate
id-smime-aa-encrypKeyPref
id-smime-aa-msgSigDigest
id-smime-ct-publishCert
id-smime-mod-msg-v3
sdsiCertificate
x509Certificate
localKeyID
certBag
pkcs8ShroudedKeyBag
keyBag
pbeWithSHA1And2-KeyTripleDES-CBC
pbeWithSHA1And3-KeyTripleDES-CBC
TLS Web Client Authentication
TLS Web Server Authentication
X509v3 Extended Key Usage
extendedKeyUsage
X509v3 Authority Key Identifier
authorityKeyIdentifier
X509v3 Certificate Policies
certificatePolicies
X509v3 Private Key Usage Period
privateKeyUsagePeriod
X509v3 Key Usage
keyUsage
X509v3 Subject Key Identifier
subjectKeyIdentifier
Netscape Certificate Sequence
nsCertSequence
Netscape CA Policy Url
nsCaPolicyUrl
Netscape Renewal Url
nsRenewalUrl
Netscape CA Revocation Url
nsCaRevocationUrl
Netscape Revocation Url
nsRevocationUrl
Netscape Base Url
nsBaseUrl
Netscape Cert Type
nsCertType
Netscape Certificate Extension
nsCertExt
extendedCertificateAttributes
challengePassword
dhKeyAgreement
Big Number part of OpenSSL 1.0.0d 8 Feb 2011
ASN.1 part of OpenSSL 1.0.0d 8 Feb 2011
keylen <= sizeof key
EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
len>=0 && len<=(int)sizeof(ctx->key)
j <= (int)sizeof(ctx->key)
keylength
keyfunc
EVP part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\pkcs12\p12_key.c
SHA1 part of OpenSSL 1.0.0d 8 Feb 2011
SHA-256 part of OpenSSL 1.0.0d 8 Feb 2011
SHA-512 part of OpenSSL 1.0.0d 8 Feb 2011
RSA part of OpenSSL 1.0.0d 8 Feb 2011
RAND part of OpenSSL 1.0.0d 8 Feb 2011
You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html
value.bag
value.safes
value.shkeybag
value.keybag
value.sdsicert
value.x509cert
value.other
cert_info
hexkey
rsa_keygen_pubexp
rsa_keygen_bits
NETAPI32.DLL
KERNEL32.DLL
value.single
value.set
PKCS8_PRIV_KEY_INFO
pkey
pkeyalg
enc_key
key_enc_algor
cert
d.encrypted
d.digest
d.signed_and_enveloped
d.enveloped
d.sign
d.data
d.other
X509_PUBKEY
public_key
.\crypto\asn1\x_pubkey.c
%d.%d.%d.%d/%d.%d.%d.%d
%*s%s:
d.registeredID
d.iPAddress
d.uniformResourceIdentifier
d.ediPartyName
d.directoryName
d.dNSName
d.rfc822Name
d.otherName
name.relativename
name.fullname
certificateHold
Certificate Hold
cessationOfOperation
Cessation Of Operation
keyCompromise
Key Compromise
%*sOnly Attribute Certificates
%*sOnly CA Certificates
%*sOnly User Certificates
AUTHORITY_KEYID
keyid
X509_CERT_PAIR
X509_CERT_AUX
%d.%d.%d.%d
EC part of OpenSSL 1.0.0d 8 Feb 2011
ECDSA part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\ec\ec_key.c
DSA part of OpenSSL 1.0.0d 8 Feb 2011
Diffie-Hellman part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\dh\dh_key.c
\X
<unsupported>
IP Address:%d.%d.%d.%d
URI:%s
DNS:%s
email:%s
EdiPartyName:<unsupported>
X400Name:<unsupported>
othername:<unsupported>
d.usernotice
d.cpsuri
CERTIFICATEPOLICIES
%*sExplicit Text: %s
%*sNumber%s:
%*sOrganization: %s
%*sCPS: %s
ddddddZ
ddddddZ
pubkey
priv_key
pub_key
EC_PRIVATEKEY
publicKey
privateKey
value.implicitlyCA
value.parameters
value.named_curve
p.char_two
p.prime
p.ppBasis
p.tpBasis
p.onBasis
p.other
.\crypto\evp\evp_pkey.c
ECDH part of OpenSSL 1.0.0d 8 Feb 2011
%'%1$=%C%K%O%s%
.%.-.3.7.9.?.W.[.o.y.
C%C'C3C7C9COCWCiC
%s: (%d bit)
Public-Key
Private-Key
recommended-private-length: %d bits
public-key:
private-key:
PKCS#3 DH Public-Key
PKCS#3 DH Private-Key
Public-Key: (%d bit)
Private-Key: (%d bit)
X.509 part of OpenSSL 1.0.0d 8 Feb 2011
OPENSSL_ALLOW_PROXY_CERTS
x%s
%s - d:d:d%.*s %d%s
'() ,-./:=?
CONF part of OpenSSL 1.0.0d 8 Feb 2011
%*sPolicy Text: %s
%*scrlUrl:
EXTENDED_KEY_USAGE
%*sZone: %s, User:
.\crypto\x509v3\v3_akey.c
PKEY_USAGE_PERIOD
keyCertSign
Certificate Sign
keyAgreement
Key Agreement
keyEncipherment
Key Encipherment
.\crypto\x509v3\v3_skey.c
MD5 part of OpenSSL 1.0.0d 8 Feb 2011
PROXY_CERT_INFO_EXTENSION
D:/Projects/openssl-10.0d/ssl/certs
D:/Projects/openssl-10.0d/ssl/cert.pem
SSL_CERT_DIR
SSL_CERT_FILE
Basis Type: %s
Field Type: %s
ASN1 OID: %s
%s %s%lu (%s0x%lx)
%lu:%s:%s:%d:%s
CONF_def part of OpenSSL 1.0.0d 8 Feb 2011
[[%s]]
[%s] %s=%s
crlUrl
certStatus
certId
OCSP_CERTSTATUS
value.unknown
value.revoked
value.good
value.byKey
value.byName
reqCert
OCSP_CERTID
issuerKeyHash
certs
d.receiptList
d.allOrFirstTier
d.compressedData
d.authenticatedData
d.encryptedData
d.digestedData
d.envelopedData
d.signedData
d.ori
d.pwri
d.kekri
d.kari
d.ktri
CMS_PasswordRecipientInfo
keyDerivationAlgorithm
keyIdentifier
CMS_KeyAgreeRecipientInfo
recipientEncryptedKeys
CMS_OriginatorIdentifierOrKey
d.originatorKey
CMS_OriginatorPublicKey
CMS_RecipientEncryptedKey
CMS_KeyAgreeRecipientIdentifier
d.rKeyId
CMS_RecipientKeyIdentifier
CMS_OtherKeyAttribute
keyAttr
keyAttrId
CMS_KeyTransRecipientInfo
encryptedKey
keyEncryptionAlgorithm
certificates
d.crl
d.subjectKeyIdentifier
d.issuerAndSerialNumber
CMS_CertificateChoices
d.v2AttrCert
d.v1AttrCert
d.extendedCertificate
d.certificate
CMS_OtherCertificateFormat
otherCert
otherCertFormat
%s.dll
PEM part of OpenSSL 1.0.0d 8 Feb 2011
phrase is too short, needs to be at least %d chars
Enter PEM pass phrase:
TRUSTED CERTIFICATE
CERTIFICATE REQUEST
NEW CERTIFICATE REQUEST
CERTIFICATE
X509 CERTIFICATE
PRIVATE KEY
ENCRYPTED PRIVATE KEY
ANY PRIVATE KEY
.\crypto\evp\evp_key.c
nkey <= EVP_MAX_KEY_LENGTH
?456789:;<=
!"#$%&'()* ,-./0123
Verifying - %s
OpenSSL 1.0.0d 8 Feb 2011
%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s
EXPORT56
EXPORT40
EXPORT
.\ssl\ssl_cert.c
SSLv3 part of OpenSSL 1.0.0d 8 Feb 2011
TLSv1 part of OpenSSL 1.0.0d 8 Feb 2011
SSLv2 part of OpenSSL 1.0.0d 8 Feb 2011
s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)
wrong number of key bits
unsupported status type
unsupported ssl version
unsupported protocol
unsupported elliptic curve
unsupported digest type
unsupported compression algorithm
unsupported cipher
unknown pkey type
unknown key exchange type
unknown certificate type
unable to find public key parameters
unable to extract public key
unable to decode ecdh certs
unable to decode dh certs
tried to use unsupported cipher
tls peer did not respond with certificate list
tls client cert req with anon cipher
tlsv1 unsupported extension
tlsv1 certificate unobtainable
tlsv1 bad certificate status response
tlsv1 bad certificate hash value
tlsv1 alert export restriction
sslv3 alert unsupported certificate
sslv3 alert no certificate
sslv3 alert certificate unknown
sslv3 alert certificate revoked
sslv3 alert certificate expired
sslv3 alert bad certificate
signature for non signing certificate
reuse cert type not zero
reuse cert length not zero
public key not rsa
public key is not rsa
public key encrypt error
peer error unsupported certificate type
peer error no certificate
peer error certificate
peer did not return a certificate
null ssl method passed
no publickey
no private key assigned
no privatekey
Peer haven't sent GOST certificate, required for selected ciphersuite
no client cert received
no client cert method
no ciphers passed
no certificate specified
no certificate set
no certificate returned
no certificate assigned
no certificates returned
missing tmp rsa pkey
missing tmp rsa key
missing tmp ecdh key
missing tmp dh key
missing rsa signing cert
missing rsa encrypting cert
missing rsa certificate
missing export tmp rsa key
missing export tmp dh key
missing dsa signing cert
missing dh rsa cert
missing dh key
missing dh dsa cert
krb5 server rd_req (keytab perms?)
key arg too long
invalid ticket keys length
http request
https proxy request
error generating tmp rsa key
ecc cert should have sha1 signature
ecc cert should have rsa signature
ecc cert not for signing
ecc cert not for key agreement
cert length mismatch
certificate verify failed
bad ecc cert
bad dh pub key length
TLS1_SETUP_KEY_BLOCK
tls1_cert_verify_mac
SSL_VERIFY_CERT_CHAIN
SSL_use_RSAPrivateKey_file
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey
SSL_use_PrivateKey_file
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey
SSL_use_certificate_file
SSL_use_certificate_ASN1
SSL_use_certificate
SSL_SET_PKEY
SSL_SET_CERT
SSL_SESS_CERT_NEW
SSL_GET_SIGN_PKEY
SSL_GET_SERVER_SEND_CERT
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate
SSL_CTX_set_client_cert_engine
SSL_CTX_check_private_key
SSL_CHECK_SRVR_ECC_CERT_AND_ALG
SSL_check_private_key
SSL_CERT_NEW
SSL_CERT_INSTANTIATE
SSL_CERT_INST
SSL_CERT_DUP
SSL_add_file_cert_subjects_to_stack
SSL_add_dir_cert_subjects_to_stack
SSL3_SETUP_KEY_BLOCK
SSL3_SEND_SERVER_KEY_EXCHANGE
SSL3_SEND_SERVER_CERTIFICATE
SSL3_SEND_CLIENT_KEY_EXCHANGE
SSL3_SEND_CLIENT_CERTIFICATE
SSL3_SEND_CERTIFICATE_REQUEST
SSL3_OUTPUT_CERT_CHAIN
SSL3_GET_SERVER_CERTIFICATE
SSL3_GET_KEY_EXCHANGE
SSL3_GET_CLIENT_KEY_EXCHANGE
SSL3_GET_CLIENT_CERTIFICATE
SSL3_GET_CERT_VERIFY
SSL3_GET_CERT_STATUS
SSL3_GET_CERTIFICATE_REQUEST
SSL3_GENERATE_KEY_BLOCK
SSL3_CHECK_CERT_AND_ALGORITHM
SSL3_ADD_CERT_TO_BUF
SSL2_SET_CERTIFICATE
SSL2_GENERATE_KEY_MATERIAL
REQUEST_CERTIFICATE
GET_CLIENT_MASTER_KEY
DTLS1_SEND_SERVER_KEY_EXCHANGE
DTLS1_SEND_SERVER_CERTIFICATE
DTLS1_SEND_CLIENT_KEY_EXCHANGE
DTLS1_SEND_CLIENT_CERTIFICATE
DTLS1_SEND_CERTIFICATE_REQUEST
DTLS1_OUTPUT_CERT_CHAIN
DTLS1_ADD_CERT_TO_BUF
CLIENT_MASTER_KEY
CLIENT_CERTIFICATE
key expansion
client write key
server write key
c->iv_len <= (int)sizeof(s->session->key_arg)
s->s2->key_material_length <= sizeof s->s2->key_material
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
RST%d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
Obtained EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC index %d
Unsupported color conversion request
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
IDCT output block size %d not supported
Invalid component ID %d in SOS
Bogus message code %d
;Warning: highpass filter disabled. highpass frequency too small
hXXp://lame.sf.net
3.99.5
Opera
?INTERNAL ERROR IN VBR NEW CODE, please send bug report
@INTERNAL ERROR IN VBR NEW CODE (986), please send bug report
INTERNAL ERROR IN VBR NEW CODE (1313), please send bug report
maxbits=%d usedbits=%d
hip: invalid layer %d
hip: error audio data exceeds framesize by %d bytes
hip: bitstream problem, resyncing skipping %d bytes...
Sorry, layer %d not supported
hip: Can't rewind stream by %d bits!
hip: Bogus region length (%d)
ADVAPI32.dll
q%D,3
QVisual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
%S#[k
?#%X.y
.\crypto\engine\eng_pkey.c
RSA PRIVATE KEY
DSA PRIVATE KEY
EC PRIVATE KEY
Load certs from files in a directory
%s%clx.%s%d
unsupported type
unsupported recpientinfo type
unsupported recipient type
unsupported kek algorithm
unsupported content type
signer certificate not found
private key does not match certificate
no public key
no private key
no msgsigdigest
no key or cert
no key
not supported for this key type
not key transport
msgsigdigest wrong length
msgsigdigest verification failure
msgsigdigest error
invalid key length
invalid encrypted key length
error setting key
error getting public key
certificate verify error
certificate has no keyid
certificate already present
CMS_SIGNERINFO_VERIFY_CERT
CMS_RecipientInfo_set0_pkey
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_ktri_cert_cmp
cms_msgSigDigest_add1
CMS_GET0_CERTIFICATE_CHOICES
CMS_EncryptedData_set1_key
CMS_decrypt_set1_pkey
CMS_decrypt_set1_key
CMS_add1_recipient_cert
CMS_add0_recipient_key
CMS_add0_cert
unsupported requestorname type
no certificates in chain
error parsing url
PARSE_HTTP_LINE1
OCSP_parse_url
OCSP_cert_id_new
unimplemented public key method
invalid cmd number
invalid cmd name
failed loading public key
failed loading private key
cmd not executable
ENGINE_UNLOAD_KEY
ENGINE_load_ssl_client_cert
ENGINE_load_public_key
ENGINE_load_private_key
ENGINE_get_pkey_meth
ENGINE_get_pkey_asn1_meth
ENGINE_ctrl_cmd_string
ENGINE_ctrl_cmd
ENGINE_cmd_is_executable
unsupported version
unsupported md algorithm
invalid signer certificate purpose
ess signing certificate error
ess add signing cert error
TS_VERIFY_CERT
TS_TST_INFO_set_msg_imprint
TS_RESP_CTX_set_signer_cert
TS_RESP_CTX_set_certs
TS_REQ_set_msg_imprint
TS_MSG_IMPRINT_set_algo
TS_CHECK_SIGNING_CERTS
ESS_SIGNING_CERT_NEW_INIT
ESS_CERT_ID_NEW_INIT
ESS_ADD_SIGNING_CERT
functionality not supported
WIN32_JOINER
unsupported pkcs12 mode
key gen error
PKCS8_add_keyusage
PKCS12_PBE_keyivgen
PKCS12_newpass
PKCS12_MAKE_SHKEYBAG
PKCS12_MAKE_KEYBAG
PKCS12_key_gen_uni
PKCS12_key_gen_asc
PKCS12_add_localkeyid
unsupported option
unable to get issuer keyid
policy syntax not currently supported
operation not defined
no proxy cert policy language defined
no issuer certificate
extension setting not supported
V2I_EXTENDED_KEY_USAGE
V2I_AUTHORITY_KEYID
S2I_SKEY_ID
S2I_ASN1_SKEY_ID
R2I_CERTPOL
unsupported cipher type
unknown operation
unable to find certificate
signing not supported for this key type
operation not supported on this type
no recipient matches key
no recipient matches certificate
encryption not supported for this key type
decrypted key is wrong length
PKCS7_add_certificate
unsupported method
no port specified
no port defined
no accept port specified
broken pipe
BIO_get_port
ECDH_compute_key
data too large for key size
unsupported field
passed null parameter
not a supported NIST prime
missing private key
keys not set
invalid private key
PKEY_EC_SIGN
PKEY_EC_PARAMGEN
PKEY_EC_KEYGEN
PKEY_EC_DERIVE
PKEY_EC_CTRL_STR
PKEY_EC_CTRL
o2i_ECPublicKey
i2o_ECPublicKey
i2d_ECPrivateKey
EC_KEY_print_fp
EC_KEY_print
EC_KEY_new
EC_KEY_generate_key
EC_KEY_copy
EC_KEY_check_key
ECKEY_TYPE2PARAM
ECKEY_PUB_ENCODE
ECKEY_PUB_DECODE
ECKEY_PRIV_ENCODE
ECKEY_PRIV_DECODE
ECKEY_PARAM_DECODE
ECKEY_PARAM2TYPE
DO_EC_KEY_PRINT
d2i_ECPrivateKey
zlib not supported
wrong public key type
unsupported public key type
unsupported encryption algorithm
unsupported any defined by type
unknown public key type
unable to decode rsa private key
unable to decode rsa key
streaming not supported
private key header missing
digest and key type not supported
bad password read
X509_PKEY_new
i2d_RSA_PUBKEY
i2d_PublicKey
i2d_PrivateKey
i2d_EC_PUBKEY
i2d_DSA_PUBKEY
d2i_X509_PKEY
d2i_PublicKey
d2i_PrivateKey
d2i_AutoPrivateKey
unsupported algorithm
unknown key type
unable to get certs public key
public key encode error
public key decode error
no cert set for us to verify
method not supported
loading cert dir
key values mismatch
key type mismatch
cert already in hash table
cant check dh key
X509_verify_cert
X509_STORE_add_cert
X509_REQ_check_private_key
X509_PUBKEY_set
X509_PUBKEY_get
X509_load_cert_file
X509_load_cert_crl_file
X509_get_pubkey_parameters
X509_check_private_key
GET_CERT_BY_SUBJECT
ADD_CERT_DIR
PKEY_DSA_KEYGEN
PKEY_DSA_CTRL
unsupported key components
unsupported encryption
read key
public key no rsa
problems getting password
keyblob too short
keyblob header parse error
expecting public key blob
expecting private key blob
error converting private key
PEM_WRITE_PRIVATEKEY
PEM_READ_PRIVATEKEY
PEM_READ_BIO_PRIVATEKEY
PEM_PK8PKEY
PEM_F_PEM_WRITE_PKCS8PRIVATEKEY
DO_PK8PKEY_FP
DO_PK8PKEY
d2i_PKCS8PrivateKey_fp
d2i_PKCS8PrivateKey_bio
unsupported salt type
unsupported private key algorithm
unsupported prf
unsupported key size
unsupported key derivation function
unsupported keylength
unsuported number of rounds
private key encode error
private key decode error
operaton not initialized
operation not supported for this keytype
no operation set
no key set
keygen failure
invalid operation
expecting a ec key
expecting a ecdsa key
expecting a dsa key
expecting a dh key
expecting an rsa key
different key types
ctrl operation not implemented
command not supported
camellia key setup failed
bn pubkey error
bad key length
aes key setup failed
PKEY_SET_TYPE
PKCS5_v2_PBE_keyivgen
PKCS5_PBE_keyivgen
EVP_PKEY_verify_recover_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_init
EVP_PKEY_verify
EVP_PKEY_sign_init
EVP_PKEY_sign
EVP_PKEY_paramgen_init
EVP_PKEY_paramgen
EVP_PKEY_new
EVP_PKEY_keygen_init
EVP_PKEY_keygen
EVP_PKEY_get1_RSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_GET1_ECDSA
EVP_PKEY_get1_DSA
EVP_PKEY_get1_DH
EVP_PKEY_encrypt_old
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt
EVP_PKEY_derive_set_peer
EVP_PKEY_derive_init
EVP_PKEY_derive
EVP_PKEY_decrypt_old
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt
EVP_PKEY_CTX_dup
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_ctrl
EVP_PKEY_copy_parameters
EVP_PKEY2PKCS8_broken
EVP_PKCS82PKEY_BROKEN
EVP_PKCS82PKEY
EVP_CIPHER_CTX_set_key_length
ECKEY_PKEY2PKCS8
ECDSA_PKEY2PKCS8
DSA_PKEY2PKCS8
DSAPKEY2PKCS8
D2I_PKEY
CAMELLIA_INIT_KEY
AES_INIT_KEY
invalid public key
PKEY_DH_KEYGEN
PKEY_DH_DERIVE
GENERATE_KEY
COMPUTE_KEY
rsa operations not supported
key size too small
invalid keybits
illegal or unsupported padding mode
digest too big for rsa key
data too small for key size
RSA_generate_key
RSA_check_key
RSA_BUILTIN_KEYGEN
PKEY_RSA_VERIFYRECOVER
PKEY_RSA_SIGN
PKEY_RSA_CTRL_STR
PKEY_RSA_CTRL
.pp@0
aEÐ
 (#EÚ
ÚE<<0
RC2 part of OpenSSL 1.0.0d 8 Feb 2011
IDEA part of OpenSSL 1.0.0d 8 Feb 2011
libdes part of OpenSSL 1.0.0d 8 Feb 2011
DES part of OpenSSL 1.0.0d 8 Feb 2011
NETSCAPE_CERT_SEQUENCE
.\crypto\asn1\x_pkey.c
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventA
.?AVECSmtp@@
zcÁ
 {Xt
.LUp5
XS.dZ
{vi.oM(g
!Z.tN
nV.of~
0bu.PW
gZ.YZ
\cmd'
.GL#!
*%S_A
nÂzj
%fn%d
DQG"FXD%BTD"ESB!JY@$JSF$FPD$IXA%DQI$GSH
Ÿ!)
.LQ4<
-Vo7.Uo5(^g$=q
,%u]f{
.Le2-
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="x86" name="Test" type="win32"></assemblyIdentity><description>
</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>
.idata
.edata
P.reloc
P.rsrc
.reloc
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB<
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
`3-Uh}
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
Enigma_Plugin_OnSaveKey
Enigma_Plugin_OnLoadKey
ntdll.dll
LS_Enigma_Plugin_OnDeleteKey
TExecutedProcess
Library not found: %s
Function not found: %s.%s
RtlFormatCurrentUserKeyPath
ole32.dll
comctl32.dll
!"#$%&*;<=>@[]^_`{|}
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
TExported@
EInvalidGraphicOperation
uxtheme.dll
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
TComboBoxExEnumerator
ssHorizontal
OnKeyDown
OnKeyPressD
OnKeyUph
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
HelpKeyword
OnExecutetIv
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview0Hw
WindowStatehCw
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys<Aw
AutoHotkeys
Uh.nw
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
UhP%x
imm32.dll
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
PasswordChar
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
Uh.uy
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
dtPostMsg
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\%s
\\.\Scsi0:
\\.\SMARTVSD
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntRegistry.pas
M.ged
#$%&'()* ,-./01234
PSAPI.dll
VBoxService.exe
Ui%uG
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
%S-AEnS.kv}
THookWindowsAPI
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
EP_RegKeyInformation
EP_RegKeyInformationA
EP_RegKeyInformationW
EP_RegKeyStatus
DLL_Loader_Import_Unit
TInitImport
Could not load library: %s
S.mbVxT
Function %s not found in module %s
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
mscorwks.dll
mscoreei.dll
clr.dll
e .Kl3
%)Key
coRegistratioKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
.ZzhI
.jA'z
sxs.dll
THookWindowsAPI
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
%sH~C
%s\%.8x%.8x-%.8x%.8x
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
.NkA/
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
.section
DLL_Loader.dll
@``@``@``@``@``@``@``@
@``@``@``@``@``
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
_enigma_keygen_routines
TntWindows
UrlMon
virtualboximportunit
KeyRoutines
nJwaWindows
 DLL_Loader_Import_Unit
hv.ph,!
.nr2G
i?.hE
user32.dll
advapi32.dll
version.dll
gdi32.dll
shell32.dll
SHFolder.dll
shlwapi.dll
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
GetKeyboardType
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
RegOpenKeyExA
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
ShellExecuteW
ShellExecuteA
0/191_1{1
7#7'7 7/737
; ;$;(;,;0;4;8;
1$1*10161
8 8$8(8,8
>%> >7>?>{>
4'4 4;4[4
0)0.090@0
2%3x4
0*1.12161<1\1
5(535;5[5{5
4#4 4<4\4
7 7$7(7,7074787<7@7`7
; ;$;(;,;0;4;8;<;\;};
9 >$>(>,>0>4>
> >$>(>,>
67
45
psapi.dll
ws2_32.dll
wininet.dll
mpr.dll
winmm.dll
comdlg32.dll
Q.idat
.YH]lE
l]!.QQ
ÏMM
:z.dk>d
<t%saI
%SJBy$1
Keyw
u$%Cl
W%9s_
X~.AB
_=p%u6
DE.BY
8%S(U
01234567
rkey
%Ch.ZZ
),-./:??
;<=>@[]^
l%DkR
MsgZ
$.OstT
^40%ck
s~$%X
_q.BC
>X.PC$'E(x'
Hv%SttM[
v%F`u
E(ALc"%s
\V%u@J
%SWv=Ia!
%ul;T'
@keys
23456789
]U.av
%UG %
HxSF%x
u\P%sx
.BNx(
Q.KPe
Nx.pua
Ib.UP
("%ss
i%u!U
5a%d"
%&'()* ,
-./01234
.VB22Z
KW.HK
KeyWZL
%.tsI
hfTPh(
UrlI
?.Ss\R
3.uh/dF
p%clh
$G"%D.
\$.Hl
*|%s4
_48N%U
$y.Wi
-"ÙM
1234567
.zw _
P#&k-BP}
l%S%E
KO.Tb
N]%u0
.WXg-p
D%X~x#
jrg%U
.Pw>'
4%XbLQ5[
Zf.XWO
nI.HT
.AEl|
.XImA
R0>%X~e
t .ervP3m
6y%SJ
=X?%u0
K%X</
TNu%UV
I%uEB
(%C!L
FKP%X
[^.du
X.Sk&H
=_.DlS
..yJE
.nb4C
v.pD,(
.vfjN?B
"%D&>
w%x4l
S"h%X
-'.KQD
r2<s%t2`M%u3$v"
rz|g0!1H%U1
^8E%F
V0^%C
ZwVt%S
Wb.xVX
.Eh~!
Rpw%s
.ObtjLc7
?0?P?X?\?`?d?h?l?p?t%x
9 :(;,(0
t!v.xv[{
92 :L.lHe|
:c;g<k=o%s
~ ~$~(_,
%x|%L
tfIyd\.Vslwd
%3x$4
@UDPN]
.GvP/
(=N%U
?P%XW
n(ajP,d%x
b,pST.Rk
P.tgM
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com
Lisence holder: %s
8Y/.iaZ
|HJ.aE
\StringFileInfo\lx\%s
%Y-%m-%d_%H-%M-%S.mp3
smtps.uol.com.br
*@uol.com.br
smtp.hotpop.com
*@hotpop.com
smtp.googlemail.com
*@gmail.com;*@googlemail.com
smtp.mail.yahoo.com
*@yahoo.com
smtp.comcast.net
*@comcast.net
smtp.gawab.com
*@gawab.com
smtp.aim.com
*@aim.com
mail.messagingengine.com
*@fastmail.fm
smtp.mail.yahoo.com.br
*@yahoo.com.br
smtp.aol.com
*@aol.com
smtp.gmx.com
*@gmx.com;*@gmx.us
smtps.bol.com.br
*@bol.com.br
smtp.ig.com.br
*@ig.com.br
smtp.live.com
*@hotmail.com
Shell32.dll
RICHED20.DLL
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
@uxtheme.dll
@()<>,;:\"[]
Viewer.exe
Software\Microsoft\Windows\CurrentVersion\Run
test335.txt
TEST408.txt
TEST408.txt/test335.txt
4.0.5
All Files (*.*)
\Install.exe
*.exe
(*.exe)
\TEST361.txt
@USER32.DLL
4.0.5
®key=
R.ICO
\WinInit.Ini
netmsg.dll
%Y-%m-%d_%H-%M-%S.jpg
ChXXp://
R%Y-%m-%d_%H-%M-%S
CWebcam_
Keys_
.html
DNSAPI.DLL
WTL_CmdBar_InternalAutoPopupMsg
WTL_CmdBar_InternalGetBarMsg
mscoree.dll
V*(%F@4 F7*
72.JA1'
[,'&"?4-
%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe
%Cookies FOLDER%
Unspecified error (%d) from %s.
debug.log
enigma_ide.dll
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
\device\harddiskvolume1\test6\wait.htm
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
% )*0./(&'312-,
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread creation error: %s
Thread Error: %s (%d)7CreateClone not implemented for class %s with source %s
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Ancestor for '%s' not found
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation

2.exe_1088_rwx_01280000_00097000:

.text
`.data
.rsrc
@.reloc
KERNEL32.dll
NTDLL.DLL
RPCRT4.dll
ADVAPI32.dll
CryptDeriveKey
CryptDestroyKey
CryptDuplicateKey
CryptExportKey
CryptGenKey
CryptGetKeyParam
CryptGetUserKey
CryptHashSessionKey
CryptImportKey
CryptSetKeyParam
ElfReportEventA
ElfReportEventW
EncryptedFileKeyInfo
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
GetEventLogInformation
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetServiceKeyNameA
GetServiceKeyNameW
GetWindowsAccountDomainSid
ImpersonateNamedPipeClient
MSChapSrvChangePassword
MSChapSrvChangePassword2
QueryWindows31FilesMigration
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegFlushKey
RegGetKeySecurity
RegLoadKeyA
RegLoadKeyW
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegOverridePredefKey
RegQueryInfoKeyA
RegQueryInfoKeyW
RegReplaceKeyA
RegReplaceKeyW
RegRestoreKeyA
RegRestoreKeyW
RegSaveKeyA
RegSaveKeyExA
RegSaveKeyExW
RegSaveKeyW
RegSetKeySecurity
RegUnLoadKeyA
RegUnLoadKeyW
ReportEventA
ReportEventW
SaferiIsExecutableFileType
SetUserFileEncryptionKey
SynchronizeWindows31FilesAndWindowsNTRegistry
WmiExecuteMethodA
WmiExecuteMethodW
PSSSSSSh
PSSSSSSh#
PSSSSSSh
PSSSSSSh
(PSSSSSSh
0PSSSSSSh
8PSSSSSSh
wSSSSSSh
PSSSSSSh!
CPDuplicateKey
CPGetUserKey
CPHashSessionKey
CPImportKey
CPExportKey
CPGetKeyParam
CPSetKeyParam
CPDestroyKey
CPDeriveKey
CPGenKey
kernel32.dll
PSSSh
PSShZ
CloseWindowStation
GetProcessWindowStation
MsgWaitForMultipleObjects
8.YYu
TermsrvSetKeySecurity
TermsrvRestoreKey
TermsrvDeleteKey
TermsrvSetValueKey
tsappcmp.dll
Windows Setup
user32.dll
sndrec32.exe
soundrec.exe
packgr32.exe
packager.exe
mplay32.exe
mplayer.exe
mciole16.dll
mciole.dll
$Microsoft Root Certificate Authority
Windows 3.1 Migration
t%SVW)E
mpr.dll
Unable to locate init routine, error = %d
Unable to load client dll, error = %d
ldap_msgfree
1.2.840.113556.1.4.529
wldap32.dll
SamiChangePasswordUser2
SamiChangePasswordUser
SetProcessWindowStation
OpenWindowStationW
It.Iu
PSShL
t.Ht#Ht Ht
ShellExecuteExW
AccProvGetOperationResults
AccProvCancelOperation
WINREG: Frame %d = 0x%x
Frames %d
WINREG: Name: %S
WINREG: Unable to retrieve object name error 0x%x
WINREG: Tracked key data for object 0x%x
imagehlp.dll
SSSSSh
WINTRUST.dll
Secur32.dll
ntdll.dll
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
SetNamedPipeHandleState
GetProcessHeap
WaitNamedPipeW
NtQueryKey
NtEnumerateKey
RtlFormatCurrentUserKeyPath
NtNotifyChangeKey
NtDeleteValueKey
NtEnumerateValueKey
NtDeleteKey
NtQueryValueKey
NtSetValueKey
NtOpenKey
NtCreateKey
NtFlushKey
NtLoadKey
NtUnloadKey
NtReplaceKey
NtNotifyChangeMultipleKeys
NtQueryMultipleValueKey
NtRestoreKey
NtSaveKey
NtSaveMergedKeys
NtSaveKeyEx
advapi32.pdb
0p.yx
%x~O>
%D$#>
7,7<7\7}7
9#:*:@:{:
3 3%3.3=3
8$9(90949@9
1&2,263@3
:,:0:<:_:
3 3$303;3
3M4H4Z4`4e4
3"3'333<3
<"<)</<5<
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
\Registry\Machine\Software\Policies\Microsoft\Windows\Safer
\Software\Policies\Microsoft\Windows\Safer
\UrlZones
%HKEY_CURRENT_USER
\PIPE\
NTMARTA.DLL
%SystemRoot%\
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%System32\*.exe
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
%s\u
REG.DAT
Windows 3.1 Migration Status
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
t\\.\pipe\net\NtControlPipe
lX-X-X-XX-XXXXXX
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt
nuser32.dll
msi.dll
\PIPE\InitShutdown
.u
system.ini
reg.dat
%SystemRoot%\Debug\UserMode\appmgmt.log
%SystemRoot%\Debug\UserMode\appmgmt.bak
%HKEY_LOCAL_MACHINE
%s%s%d%s%s%s%s%s%s%s{lx-x-x-xx-xxxxxx}
certificate
%SystemRoot%\System32\Drivers\
\pipe\svcctl
Group%d
ncacn_ip_tcp
UrlZones
DisallowExecution
iphlpapi.dll
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
perfh004.dat
perfc004.dat
progman.ini
SoftWare\Microsoft\Windows NT\CurrentVersion\Program Manager\Settings
SoftWare\Microsoft\Windows NT\CurrentVersion\Program Manager\UNICODE Groups
Windows NT Network Provider
\\.\Pipe\TerminalServer\SystemExecSrvr\%d
W\winsta.dll
feclient.dll
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
samlib.dll
SupportUrl
Wshell32.dll
CEvents::Report called with more params then expected!
APPMGMT (%x.%x) d:d:d:d
appmgmts.dll
%s_%d
{x-x-x-xx-xxxxxx}
setupapi.dll
%ws\%u
\\.\%s
\Registry\Machine\Hardware\DeviceMap\Scsi\Scsi Port %d\Scsi Bus %d\Target ID %d\Logical Unit Id %d
\Device\Harddisk%d\Partition0
\\.\PhysicalDrive%d
W%s\%s
\Device\Video%d
DefaultSettings.YResolution
DefaultSettings.XResolution
DefaultSettings.VRefresh
DefaultSettings.BitsPerPel
HardwareInformation.BiosString
HardwareInformation.AdapterString
HardwareInformation.DacType
HardwareInformation.ChipType
HardwareInformation.MemorySize
SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3
PerfDbg.Etl
C:\perfdbg.etl
$winnt$.inf
Export
ncacn_nb_tcp
\PIPE\winreg
\SystemRoot\system32\perf0000.dat
\SystemRoot\system32\prf00000.dat
Advanced Windows 32 Base API
5.1.2600.5512 (xpsp.080413-2113)
advapi32.dll
Windows
Operating System
5.1.2600.5512
An exception occurred while performing Windows 3.1 migration. Some data
The entire contents of %1 was migrated into the Windows NT registry.
Windows NT registry.
the Windows NT registry.
The contents of the Windows 3.X Program Manager group file %1 was not
migrated into the Windows NT registry, as a group of that name, %2,
Contents of %1 migrated to the Windows NT registry.
Unable to migrate all or part of the %1 file into the Windows NT registry.
Unable to migrate all or part of the %1 section of %2 into the Windows
into the Windows NT registry.
Unable to load the contents of the Windows 3.1 Program Manager group file %1.
Error Code was %2. Group not migrated to the Windows NT registry.
Unable to convert the contents of the Windows 3.1 Program Manager group
file %1. into the Windows NT format. Error Code was %2. Group not
migrated to the Windows NT registry.
Unable to migrate all or part of %1 to the Windows NT registry.
the Windows NT registry. It is incompatible with Windows NT.
Allows programs to execute with only access to resources granted to open well-known groups, blocking access Administrator and Power User privileges, and personally granted rights.
Software cannot access certain resources, such as cryptographic keys and credentials, regardless of the access rights of the user.
Allows programs to execute as a user that does not have Administrator or Power User access rights, but can still access resouces accessible by normal users.

2.exe_1088_rwx_5D091000_00001000:

COMCTL32.dll

FEK.exe_1948_rwx_00401000_00281000:

udPh
PSSSSSSh
PSSSSSSh!
YYhl%S
YYhX%S
t/hL%S
t2h@%S
vSSSh
FTPjK
FtPj;
C.PjRV
tGHt.Ht&
.EKSWU
FTPG
FTPj
FtPS
H%XLU
H%XMU
=KNILw.tT=RCNEw
_0 _8 _4;_,
SHA1 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
SHA256 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro@openssl.org>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro@openssl.org>
6-9'6-9'
$6.:$6.:
*?#1*?#1
>8$4,8$4,
AES for x86, CRYPTOGAMS by <appro@openssl.org>
Camellia for x86 by <appro@openssl.org>
RC4 for x86, CRYPTOGAMS by <appro@openssl.org>
FRegDeleteKeyExW
MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}</STYLE></HEAD><META http-equiv=Content-Type content="text/html; charset=utf-8"><BODY>
mail@domain.com
Date: %d %s %d %d:%d:%d
EHLO %s
,qop=%s
,response=%s
,digest-uri="%s"
,cnonce="%s"
,nc=%s
,nonce="%s"
,realm="%s"
charset=utf-8,username="%s"
smtp/
AUTH PLAIN %s
^%s^%s
AUTH LOGIN
LOGIN
--%s--
RCPT TO:<%s>
MAIL FROM:<%s>
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
portuguese-brazilian
ADVAPI32.DLL
kernel32.dll
UxTheme.dll
OLEACC.dll
passed a null parameter
DSO support routines
x509 certificate routines
error:lX:%s:%s:%s
ssl_sess_cert
ssl_cert
evp_pkey
x509_pkey
%s(%d): OpenSSL internal error, assertion failed: %s
lhash part of OpenSSL 1.0.0d 8 Feb 2011
Stack part of OpenSSL 1.0.0d 8 Feb 2011
supportedAlgorithms
crossCertificatePair
certificateRevocationList
cACertificate
userCertificate
userPassword
supportedApplicationContext
Microsoft Local Key set
LocalKeySet
id-Gost28147-89-None-KeyMeshing
id-Gost28147-89-CryptoPro-KeyMeshing
password based MAC
id-PasswordBasedMAC
X509v3 Certificate Issuer
certificateIssuer
certicom-arc
Proxy Certificate Information
proxyCertInfo
Microsoft Smartcardlogin
msSmartcardLogin
joint-iso-itu-t
JOINT-ISO-ITU-T
set-rootKeyThumb
setAttr-Cert
setCext-cCertRequired
setCext-certType
setct-CertResTBE
setct-CertReqTBEX
setct-CertReqTBE
setct-AcqCardCodeMsgTBE
setct-CertInqReqTBS
setct-CertResData
setct-CertReqTBS
setct-CertReqData
setct-PCertResTBS
setct-PCertReqData
setct-AcqCardCodeMsg
certificate extensions
set-certExt
set-msgExt
id-ecPublicKey
id-cmc-confirmCertAcceptance
id-cmc-getCert
id-regInfo-certReq
id-regCtrl-protocolEncrKey
id-regCtrl-oldCertID
id-it-revPassphrase
id-it-keyPairParamRep
id-it-keyPairParamReq
id-it-unsupportedOIDs
id-it-caKeyUpdateInfo
id-it-encKeyPairTypes
id-it-signKeyPairTypes
id-it-caProtEncCert
id-mod-attribute-cert
id-mod-qualified-cert-93
id-mod-qualified-cert-88
id-smime-aa-ets-certCRLTimestamp
id-smime-aa-ets-certValues
id-smime-aa-ets-CertificateRefs
id-smime-aa-ets-otherSigCert
id-smime-aa-smimeEncryptCerts
id-smime-aa-signingCertificate
id-smime-aa-encrypKeyPref
id-smime-aa-msgSigDigest
id-smime-ct-publishCert
id-smime-mod-msg-v3
sdsiCertificate
x509Certificate
localKeyID
certBag
pkcs8ShroudedKeyBag
keyBag
pbeWithSHA1And2-KeyTripleDES-CBC
pbeWithSHA1And3-KeyTripleDES-CBC
TLS Web Client Authentication
TLS Web Server Authentication
X509v3 Extended Key Usage
extendedKeyUsage
X509v3 Authority Key Identifier
authorityKeyIdentifier
X509v3 Certificate Policies
certificatePolicies
X509v3 Private Key Usage Period
privateKeyUsagePeriod
X509v3 Key Usage
keyUsage
X509v3 Subject Key Identifier
subjectKeyIdentifier
Netscape Certificate Sequence
nsCertSequence
Netscape CA Policy Url
nsCaPolicyUrl
Netscape Renewal Url
nsRenewalUrl
Netscape CA Revocation Url
nsCaRevocationUrl
Netscape Revocation Url
nsRevocationUrl
Netscape Base Url
nsBaseUrl
Netscape Cert Type
nsCertType
Netscape Certificate Extension
nsCertExt
extendedCertificateAttributes
challengePassword
dhKeyAgreement
Big Number part of OpenSSL 1.0.0d 8 Feb 2011
ASN.1 part of OpenSSL 1.0.0d 8 Feb 2011
keylen <= sizeof key
EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
len>=0 && len<=(int)sizeof(ctx->key)
j <= (int)sizeof(ctx->key)
keylength
keyfunc
EVP part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\pkcs12\p12_key.c
SHA1 part of OpenSSL 1.0.0d 8 Feb 2011
SHA-256 part of OpenSSL 1.0.0d 8 Feb 2011
SHA-512 part of OpenSSL 1.0.0d 8 Feb 2011
RSA part of OpenSSL 1.0.0d 8 Feb 2011
RAND part of OpenSSL 1.0.0d 8 Feb 2011
You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html
value.bag
value.safes
value.shkeybag
value.keybag
value.sdsicert
value.x509cert
value.other
cert_info
hexkey
rsa_keygen_pubexp
rsa_keygen_bits
NETAPI32.DLL
KERNEL32.DLL
value.single
value.set
PKCS8_PRIV_KEY_INFO
pkey
pkeyalg
enc_key
key_enc_algor
cert
d.encrypted
d.digest
d.signed_and_enveloped
d.enveloped
d.sign
d.data
d.other
X509_PUBKEY
public_key
.\crypto\asn1\x_pubkey.c
%d.%d.%d.%d/%d.%d.%d.%d
%*s%s:
d.registeredID
d.iPAddress
d.uniformResourceIdentifier
d.ediPartyName
d.directoryName
d.dNSName
d.rfc822Name
d.otherName
name.relativename
name.fullname
certificateHold
Certificate Hold
cessationOfOperation
Cessation Of Operation
keyCompromise
Key Compromise
%*sOnly Attribute Certificates
%*sOnly CA Certificates
%*sOnly User Certificates
AUTHORITY_KEYID
keyid
X509_CERT_PAIR
X509_CERT_AUX
%d.%d.%d.%d
EC part of OpenSSL 1.0.0d 8 Feb 2011
ECDSA part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\ec\ec_key.c
DSA part of OpenSSL 1.0.0d 8 Feb 2011
Diffie-Hellman part of OpenSSL 1.0.0d 8 Feb 2011
.\crypto\dh\dh_key.c
\X
<unsupported>
IP Address:%d.%d.%d.%d
URI:%s
DNS:%s
email:%s
EdiPartyName:<unsupported>
X400Name:<unsupported>
othername:<unsupported>
d.usernotice
d.cpsuri
CERTIFICATEPOLICIES
%*sExplicit Text: %s
%*sNumber%s:
%*sOrganization: %s
%*sCPS: %s
ddddddZ
ddddddZ
pubkey
priv_key
pub_key
EC_PRIVATEKEY
publicKey
privateKey
value.implicitlyCA
value.parameters
value.named_curve
p.char_two
p.prime
p.ppBasis
p.tpBasis
p.onBasis
p.other
.\crypto\evp\evp_pkey.c
ECDH part of OpenSSL 1.0.0d 8 Feb 2011
%'%1$=%C%K%O%s%
.%.-.3.7.9.?.W.[.o.y.
C%C'C3C7C9COCWCiC
%s: (%d bit)
Public-Key
Private-Key
recommended-private-length: %d bits
public-key:
private-key:
PKCS#3 DH Public-Key
PKCS#3 DH Private-Key
Public-Key: (%d bit)
Private-Key: (%d bit)
X.509 part of OpenSSL 1.0.0d 8 Feb 2011
OPENSSL_ALLOW_PROXY_CERTS
x%s
%s - d:d:d%.*s %d%s
'() ,-./:=?
CONF part of OpenSSL 1.0.0d 8 Feb 2011
%*sPolicy Text: %s
%*scrlUrl:
EXTENDED_KEY_USAGE
%*sZone: %s, User:
.\crypto\x509v3\v3_akey.c
PKEY_USAGE_PERIOD
keyCertSign
Certificate Sign
keyAgreement
Key Agreement
keyEncipherment
Key Encipherment
.\crypto\x509v3\v3_skey.c
MD5 part of OpenSSL 1.0.0d 8 Feb 2011
PROXY_CERT_INFO_EXTENSION
D:/Projects/openssl-10.0d/ssl/certs
D:/Projects/openssl-10.0d/ssl/cert.pem
SSL_CERT_DIR
SSL_CERT_FILE
Basis Type: %s
Field Type: %s
ASN1 OID: %s
%s %s%lu (%s0x%lx)
%lu:%s:%s:%d:%s
CONF_def part of OpenSSL 1.0.0d 8 Feb 2011
[[%s]]
[%s] %s=%s
crlUrl
certStatus
certId
OCSP_CERTSTATUS
value.unknown
value.revoked
value.good
value.byKey
value.byName
reqCert
OCSP_CERTID
issuerKeyHash
certs
d.receiptList
d.allOrFirstTier
d.compressedData
d.authenticatedData
d.encryptedData
d.digestedData
d.envelopedData
d.signedData
d.ori
d.pwri
d.kekri
d.kari
d.ktri
CMS_PasswordRecipientInfo
keyDerivationAlgorithm
keyIdentifier
CMS_KeyAgreeRecipientInfo
recipientEncryptedKeys
CMS_OriginatorIdentifierOrKey
d.originatorKey
CMS_OriginatorPublicKey
CMS_RecipientEncryptedKey
CMS_KeyAgreeRecipientIdentifier
d.rKeyId
CMS_RecipientKeyIdentifier
CMS_OtherKeyAttribute
keyAttr
keyAttrId
CMS_KeyTransRecipientInfo
encryptedKey
keyEncryptionAlgorithm
certificates
d.crl
d.subjectKeyIdentifier
d.issuerAndSerialNumber
CMS_CertificateChoices
d.v2AttrCert
d.v1AttrCert
d.extendedCertificate
d.certificate
CMS_OtherCertificateFormat
otherCert
otherCertFormat
%s.dll
PEM part of OpenSSL 1.0.0d 8 Feb 2011
phrase is too short, needs to be at least %d chars
Enter PEM pass phrase:
TRUSTED CERTIFICATE
CERTIFICATE REQUEST
NEW CERTIFICATE REQUEST
CERTIFICATE
X509 CERTIFICATE
PRIVATE KEY
ENCRYPTED PRIVATE KEY
ANY PRIVATE KEY
.\crypto\evp\evp_key.c
nkey <= EVP_MAX_KEY_LENGTH
?456789:;<=
!"#$%&'()* ,-./0123
Verifying - %s
OpenSSL 1.0.0d 8 Feb 2011
%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s
EXPORT56
EXPORT40
EXPORT
.\ssl\ssl_cert.c
SSLv3 part of OpenSSL 1.0.0d 8 Feb 2011
TLSv1 part of OpenSSL 1.0.0d 8 Feb 2011
SSLv2 part of OpenSSL 1.0.0d 8 Feb 2011
s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)
wrong number of key bits
unsupported status type
unsupported ssl version
unsupported protocol
unsupported elliptic curve
unsupported digest type
unsupported compression algorithm
unsupported cipher
unknown pkey type
unknown key exchange type
unknown certificate type
unable to find public key parameters
unable to extract public key
unable to decode ecdh certs
unable to decode dh certs
tried to use unsupported cipher
tls peer did not respond with certificate list
tls client cert req with anon cipher
tlsv1 unsupported extension
tlsv1 certificate unobtainable
tlsv1 bad certificate status response
tlsv1 bad certificate hash value
tlsv1 alert export restriction
sslv3 alert unsupported certificate
sslv3 alert no certificate
sslv3 alert certificate unknown
sslv3 alert certificate revoked
sslv3 alert certificate expired
sslv3 alert bad certificate
signature for non signing certificate
reuse cert type not zero
reuse cert length not zero
public key not rsa
public key is not rsa
public key encrypt error
peer error unsupported certificate type
peer error no certificate
peer error certificate
peer did not return a certificate
null ssl method passed
no publickey
no private key assigned
no privatekey
Peer haven't sent GOST certificate, required for selected ciphersuite
no client cert received
no client cert method
no ciphers passed
no certificate specified
no certificate set
no certificate returned
no certificate assigned
no certificates returned
missing tmp rsa pkey
missing tmp rsa key
missing tmp ecdh key
missing tmp dh key
missing rsa signing cert
missing rsa encrypting cert
missing rsa certificate
missing export tmp rsa key
missing export tmp dh key
missing dsa signing cert
missing dh rsa cert
missing dh key
missing dh dsa cert
krb5 server rd_req (keytab perms?)
key arg too long
invalid ticket keys length
http request
https proxy request
error generating tmp rsa key
ecc cert should have sha1 signature
ecc cert should have rsa signature
ecc cert not for signing
ecc cert not for key agreement
cert length mismatch
certificate verify failed
bad ecc cert
bad dh pub key length
TLS1_SETUP_KEY_BLOCK
tls1_cert_verify_mac
SSL_VERIFY_CERT_CHAIN
SSL_use_RSAPrivateKey_file
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey
SSL_use_PrivateKey_file
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey
SSL_use_certificate_file
SSL_use_certificate_ASN1
SSL_use_certificate
SSL_SET_PKEY
SSL_SET_CERT
SSL_SESS_CERT_NEW
SSL_GET_SIGN_PKEY
SSL_GET_SERVER_SEND_CERT
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate
SSL_CTX_set_client_cert_engine
SSL_CTX_check_private_key
SSL_CHECK_SRVR_ECC_CERT_AND_ALG
SSL_check_private_key
SSL_CERT_NEW
SSL_CERT_INSTANTIATE
SSL_CERT_INST
SSL_CERT_DUP
SSL_add_file_cert_subjects_to_stack
SSL_add_dir_cert_subjects_to_stack
SSL3_SETUP_KEY_BLOCK
SSL3_SEND_SERVER_KEY_EXCHANGE
SSL3_SEND_SERVER_CERTIFICATE
SSL3_SEND_CLIENT_KEY_EXCHANGE
SSL3_SEND_CLIENT_CERTIFICATE
SSL3_SEND_CERTIFICATE_REQUEST
SSL3_OUTPUT_CERT_CHAIN
SSL3_GET_SERVER_CERTIFICATE
SSL3_GET_KEY_EXCHANGE
SSL3_GET_CLIENT_KEY_EXCHANGE
SSL3_GET_CLIENT_CERTIFICATE
SSL3_GET_CERT_VERIFY
SSL3_GET_CERT_STATUS
SSL3_GET_CERTIFICATE_REQUEST
SSL3_GENERATE_KEY_BLOCK
SSL3_CHECK_CERT_AND_ALGORITHM
SSL3_ADD_CERT_TO_BUF
SSL2_SET_CERTIFICATE
SSL2_GENERATE_KEY_MATERIAL
REQUEST_CERTIFICATE
GET_CLIENT_MASTER_KEY
DTLS1_SEND_SERVER_KEY_EXCHANGE
DTLS1_SEND_SERVER_CERTIFICATE
DTLS1_SEND_CLIENT_KEY_EXCHANGE
DTLS1_SEND_CLIENT_CERTIFICATE
DTLS1_SEND_CERTIFICATE_REQUEST
DTLS1_OUTPUT_CERT_CHAIN
DTLS1_ADD_CERT_TO_BUF
CLIENT_MASTER_KEY
CLIENT_CERTIFICATE
key expansion
client write key
server write key
c->iv_len <= (int)sizeof(s->session->key_arg)
s->s2->key_material_length <= sizeof s->s2->key_material
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
RST%d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
Obtained EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC index %d
Unsupported color conversion request
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
IDCT output block size %d not supported
Invalid component ID %d in SOS
Bogus message code %d
;Warning: highpass filter disabled. highpass frequency too small
hXXp://lame.sf.net
3.99.5
Opera
?INTERNAL ERROR IN VBR NEW CODE, please send bug report
@INTERNAL ERROR IN VBR NEW CODE (986), please send bug report
INTERNAL ERROR IN VBR NEW CODE (1313), please send bug report
maxbits=%d usedbits=%d
hip: invalid layer %d
hip: error audio data exceeds framesize by %d bytes
hip: bitstream problem, resyncing skipping %d bytes...
Sorry, layer %d not supported
hip: Can't rewind stream by %d bits!
hip: Bogus region length (%d)
ADVAPI32.dll
q%D,3
QVisual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
%S#[k
?#%X.y
.\crypto\engine\eng_pkey.c
RSA PRIVATE KEY
DSA PRIVATE KEY
EC PRIVATE KEY
Load certs from files in a directory
%s%clx.%s%d
unsupported type
unsupported recpientinfo type
unsupported recipient type
unsupported kek algorithm
unsupported content type
signer certificate not found
private key does not match certificate
no public key
no private key
no msgsigdigest
no key or cert
no key
not supported for this key type
not key transport
msgsigdigest wrong length
msgsigdigest verification failure
msgsigdigest error
invalid key length
invalid encrypted key length
error setting key
error getting public key
certificate verify error
certificate has no keyid
certificate already present
CMS_SIGNERINFO_VERIFY_CERT
CMS_RecipientInfo_set0_pkey
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_ktri_cert_cmp
cms_msgSigDigest_add1
CMS_GET0_CERTIFICATE_CHOICES
CMS_EncryptedData_set1_key
CMS_decrypt_set1_pkey
CMS_decrypt_set1_key
CMS_add1_recipient_cert
CMS_add0_recipient_key
CMS_add0_cert
unsupported requestorname type
no certificates in chain
error parsing url
PARSE_HTTP_LINE1
OCSP_parse_url
OCSP_cert_id_new
unimplemented public key method
invalid cmd number
invalid cmd name
failed loading public key
failed loading private key
cmd not executable
ENGINE_UNLOAD_KEY
ENGINE_load_ssl_client_cert
ENGINE_load_public_key
ENGINE_load_private_key
ENGINE_get_pkey_meth
ENGINE_get_pkey_asn1_meth
ENGINE_ctrl_cmd_string
ENGINE_ctrl_cmd
ENGINE_cmd_is_executable
unsupported version
unsupported md algorithm
invalid signer certificate purpose
ess signing certificate error
ess add signing cert error
TS_VERIFY_CERT
TS_TST_INFO_set_msg_imprint
TS_RESP_CTX_set_signer_cert
TS_RESP_CTX_set_certs
TS_REQ_set_msg_imprint
TS_MSG_IMPRINT_set_algo
TS_CHECK_SIGNING_CERTS
ESS_SIGNING_CERT_NEW_INIT
ESS_CERT_ID_NEW_INIT
ESS_ADD_SIGNING_CERT
functionality not supported
WIN32_JOINER
unsupported pkcs12 mode
key gen error
PKCS8_add_keyusage
PKCS12_PBE_keyivgen
PKCS12_newpass
PKCS12_MAKE_SHKEYBAG
PKCS12_MAKE_KEYBAG
PKCS12_key_gen_uni
PKCS12_key_gen_asc
PKCS12_add_localkeyid
unsupported option
unable to get issuer keyid
policy syntax not currently supported
operation not defined
no proxy cert policy language defined
no issuer certificate
extension setting not supported
V2I_EXTENDED_KEY_USAGE
V2I_AUTHORITY_KEYID
S2I_SKEY_ID
S2I_ASN1_SKEY_ID
R2I_CERTPOL
unsupported cipher type
unknown operation
unable to find certificate
signing not supported for this key type
operation not supported on this type
no recipient matches key
no recipient matches certificate
encryption not supported for this key type
decrypted key is wrong length
PKCS7_add_certificate
unsupported method
no port specified
no port defined
no accept port specified
broken pipe
BIO_get_port
ECDH_compute_key
data too large for key size
unsupported field
passed null parameter
not a supported NIST prime
missing private key
keys not set
invalid private key
PKEY_EC_SIGN
PKEY_EC_PARAMGEN
PKEY_EC_KEYGEN
PKEY_EC_DERIVE
PKEY_EC_CTRL_STR
PKEY_EC_CTRL
o2i_ECPublicKey
i2o_ECPublicKey
i2d_ECPrivateKey
EC_KEY_print_fp
EC_KEY_print
EC_KEY_new
EC_KEY_generate_key
EC_KEY_copy
EC_KEY_check_key
ECKEY_TYPE2PARAM
ECKEY_PUB_ENCODE
ECKEY_PUB_DECODE
ECKEY_PRIV_ENCODE
ECKEY_PRIV_DECODE
ECKEY_PARAM_DECODE
ECKEY_PARAM2TYPE
DO_EC_KEY_PRINT
d2i_ECPrivateKey
zlib not supported
wrong public key type
unsupported public key type
unsupported encryption algorithm
unsupported any defined by type
unknown public key type
unable to decode rsa private key
unable to decode rsa key
streaming not supported
private key header missing
digest and key type not supported
bad password read
X509_PKEY_new
i2d_RSA_PUBKEY
i2d_PublicKey
i2d_PrivateKey
i2d_EC_PUBKEY
i2d_DSA_PUBKEY
d2i_X509_PKEY
d2i_PublicKey
d2i_PrivateKey
d2i_AutoPrivateKey
unsupported algorithm
unknown key type
unable to get certs public key
public key encode error
public key decode error
no cert set for us to verify
method not supported
loading cert dir
key values mismatch
key type mismatch
cert already in hash table
cant check dh key
X509_verify_cert
X509_STORE_add_cert
X509_REQ_check_private_key
X509_PUBKEY_set
X509_PUBKEY_get
X509_load_cert_file
X509_load_cert_crl_file
X509_get_pubkey_parameters
X509_check_private_key
GET_CERT_BY_SUBJECT
ADD_CERT_DIR
PKEY_DSA_KEYGEN
PKEY_DSA_CTRL
unsupported key components
unsupported encryption
read key
public key no rsa
problems getting password
keyblob too short
keyblob header parse error
expecting public key blob
expecting private key blob
error converting private key
PEM_WRITE_PRIVATEKEY
PEM_READ_PRIVATEKEY
PEM_READ_BIO_PRIVATEKEY
PEM_PK8PKEY
PEM_F_PEM_WRITE_PKCS8PRIVATEKEY
DO_PK8PKEY_FP
DO_PK8PKEY
d2i_PKCS8PrivateKey_fp
d2i_PKCS8PrivateKey_bio
unsupported salt type
unsupported private key algorithm
unsupported prf
unsupported key size
unsupported key derivation function
unsupported keylength
unsuported number of rounds
private key encode error
private key decode error
operaton not initialized
operation not supported for this keytype
no operation set
no key set
keygen failure
invalid operation
expecting a ec key
expecting a ecdsa key
expecting a dsa key
expecting a dh key
expecting an rsa key
different key types
ctrl operation not implemented
command not supported
camellia key setup failed
bn pubkey error
bad key length
aes key setup failed
PKEY_SET_TYPE
PKCS5_v2_PBE_keyivgen
PKCS5_PBE_keyivgen
EVP_PKEY_verify_recover_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_init
EVP_PKEY_verify
EVP_PKEY_sign_init
EVP_PKEY_sign
EVP_PKEY_paramgen_init
EVP_PKEY_paramgen
EVP_PKEY_new
EVP_PKEY_keygen_init
EVP_PKEY_keygen
EVP_PKEY_get1_RSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_GET1_ECDSA
EVP_PKEY_get1_DSA
EVP_PKEY_get1_DH
EVP_PKEY_encrypt_old
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt
EVP_PKEY_derive_set_peer
EVP_PKEY_derive_init
EVP_PKEY_derive
EVP_PKEY_decrypt_old
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt
EVP_PKEY_CTX_dup
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_ctrl
EVP_PKEY_copy_parameters
EVP_PKEY2PKCS8_broken
EVP_PKCS82PKEY_BROKEN
EVP_PKCS82PKEY
EVP_CIPHER_CTX_set_key_length
ECKEY_PKEY2PKCS8
ECDSA_PKEY2PKCS8
DSA_PKEY2PKCS8
DSAPKEY2PKCS8
D2I_PKEY
CAMELLIA_INIT_KEY
AES_INIT_KEY
invalid public key
PKEY_DH_KEYGEN
PKEY_DH_DERIVE
GENERATE_KEY
COMPUTE_KEY
rsa operations not supported
key size too small
invalid keybits
illegal or unsupported padding mode
digest too big for rsa key
data too small for key size
RSA_generate_key
RSA_check_key
RSA_BUILTIN_KEYGEN
PKEY_RSA_VERIFYRECOVER
PKEY_RSA_SIGN
PKEY_RSA_CTRL_STR
PKEY_RSA_CTRL
.pp@0
aEÐ
 (#EÚ
ÚE<<0
RC2 part of OpenSSL 1.0.0d 8 Feb 2011
IDEA part of OpenSSL 1.0.0d 8 Feb 2011
libdes part of OpenSSL 1.0.0d 8 Feb 2011
DES part of OpenSSL 1.0.0d 8 Feb 2011
NETSCAPE_CERT_SEQUENCE
.\crypto\asn1\x_pkey.c
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventA
.?AVECSmtp@@
zcÁ
 {Xt
.LUp5
XS.dZ
{vi.oM(g
!Z.tN
nV.of~
0bu.PW
gZ.YZ
\StringFileInfo\lx\%s
%Y-%m-%d_%H-%M-%S.mp3
smtps.uol.com.br
*@uol.com.br
smtp.hotpop.com
*@hotpop.com
smtp.googlemail.com
*@gmail.com;*@googlemail.com
smtp.mail.yahoo.com
*@yahoo.com
smtp.comcast.net
*@comcast.net
smtp.gawab.com
*@gawab.com
smtp.aim.com
*@aim.com
mail.messagingengine.com
*@fastmail.fm
smtp.mail.yahoo.com.br
*@yahoo.com.br
smtp.aol.com
*@aol.com
smtp.gmx.com
*@gmx.com;*@gmx.us
smtps.bol.com.br
*@bol.com.br
smtp.ig.com.br
*@ig.com.br
smtp.live.com
*@hotmail.com
Shell32.dll
RICHED20.DLL
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
@uxtheme.dll
@()<>,;:\"[]
Viewer.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion
test335.txt
TEST408.txt
TEST408.txt/test335.txt
4.0.5
All Files (*.*)
\Install.exe
*.exe
(*.exe)
\TEST361.txt
@USER32.DLL
4.0.5
®key=
R.ICO
\WinInit.Ini
wininet.dll
netmsg.dll
%Y-%m-%d_%H-%M-%S.jpg
ChXXp://
R%Y-%m-%d_%H-%M-%S
CWebcam_
Keys_
.html
comctl32.dll
DNSAPI.DLL
WTL_CmdBar_InternalAutoPopupMsg
WTL_CmdBar_InternalGetBarMsg
mscoree.dll
V*(%F@4 F7*
72.JA1'
[,'&"?4-
%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe

FEK.exe_1948_rwx_006EB000_002B8000:

.idata
.edata
P.reloc
P.rsrc
.reloc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
W:\3rdparty\ScreamSec\SecUtils.pas
TCipher.CreateIntf: Algorithm mismatch
TBlockCipher.CreateIntf: Wrong VectorSize
Cipher mode not supported
The vector for %s is %d blocks. Cannot initialize with a %d block vector.
The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.
The minimum key and IV size for %s is %d bytes.
Not supported
TRijndael_PipedPCFB<
Rijndael: Invalid key size - %d
2.16.840.1.101.3.4.1.1
2.16.840.1.101.3.4.1.21
2.16.840.1.101.3.4.1.41
1.3.6.1.4.1.13085.1.22
1.3.6.1.4.1.13085.1.23
1.3.6.1.4.1.13085.1.24
2.16.840.1.101.3.4.1.4
2.16.840.1.101.3.4.1.24
2.16.840.1.101.3.4.1.44
1.3.6.1.4.1.13085.1.7
1.3.6.1.4.1.13085.1.8
1.3.6.1.4.1.13085.1.9
1.3.6.1.4.1.13085.1.4
1.3.6.1.4.1.13085.1.5
1.3.6.1.4.1.13085.1.6
1.3.6.1.4.1.13085.1.10
1.3.6.1.4.1.13085.1.11
1.3.6.1.4.1.13085.1.12
1.3.6.1.4.1.13085.1.1
1.3.6.1.4.1.13085.1.2
1.3.6.1.4.1.13085.1.3
1.3.6.1.4.1.13085.1.16
1.3.6.1.4.1.13085.1.17
1.3.6.1.4.1.13085.1.18
2.16.840.1.101.3.4.1.2
2.16.840.1.101.3.4.1.22
2.16.840.1.101.3.4.1.42
1.3.6.1.4.1.13085.1.19
1.3.6.1.4.1.13085.1.20
1.3.6.1.4.1.13085.1.21
2.16.840.1.101.3.4.1.3
2.16.840.1.101.3.4.1.23
2.16.840.1.101.3.4.1.43
2.16.840.1.101.3.4.1.5
2.16.840.1.101.3.4.1.25
2.16.840.1.101.3.4.1.45
/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
TGenerator.Create: Cipher mode must be cmCTR.
TMPPool.CheckThreadID: Called from the wrong thread.
TMPPool.Cache: Invalid pointer
TMPPool.Obtain: Out of memory
TMPPool.InternalCheck: Invalid pointer
Portugal
Turkey
TKeyVerifyParams
12345678-
`3-Uh}
Windows 95
WIN_VER_WINDOWS95
Windows 95 OSR2
WIN_VER_WINDOWS95OSR2
Windows 98
WIN_VER_WINDOWS98
Windows 98 SE
WIN_VER_WINDOWS98SE
Windows ME
WIN_VER_WINDOWSME
Windows 2000
WIN_VER_WINDOWS2000
Windows 2000 Professional
WIN_VER_WINDOWS2000PROF
Windows 2000 Data Server
WIN_VER_WINDOWS2000DATASERVER
Windows 2000 Advanced Server
WIN_VER_WINDOWS2000ADVSERVER
Windows 2000 Server
WIN_VER_WINDOWS2000SERVER
Windows XP
WIN_VER_WINDOWSXP
Windows XP Home
WIN_VER_WINDOWSXPHOME
Windows XP Professional
WIN_VER_WINDOWSXPPROF
Windows XP Professional x64
WIN_VER_WINDOWSXPPROFx64
Windows XP Professional Datacenter x64
WIN_VER_WINDOWSXPPROFDATACENTERx64
Windows XP Professional Enterprise x64
WIN_VER_WINDOWSXPPROFENERPRICEx64
Windows XP Professional Standart x64
WIN_VER_WINDOWSXPPROFSTANDARTx64
Windows 2003
Windows 2003 Server
WIN_VER_WINDOWS2003SERVER
Windows 2003 Server R2
WIN_VER_WINDOWS2003SERVERR2
Windows 2003 Storage Server
WIN_VER_WINDOWS2003STORAGESERVER
Windows 2003 Datacenter Itanium
WIN_VER_WINDOWS2003DATACENTERITANIUM
Windows 2003 Enterprise Itanium
WIN_VER_WINDOWS2003ENTERPRICEITANIUM
Windows 2003 Datacenter x64
WIN_VER_WINDOWS2003DATACENTERx64
Windows 2003 Enterprise x64
WIN_VER_WINDOWS2003ENERPRICEx64
Windows 2003 Standart x64
WIN_VER_WINDOWS2003STANDARTx64
Windows 2003 Compute
WIN_VER_WINDOWS2003COMPUTE
Windows 2003 Datacenter
WIN_VER_WINDOWS2003DATACENTER
Windows 2003 Enterprise
WIN_VER_WINDOWS2003ENTERPRICE
Windows 2003 Web
WIN_VER_WINDOWS2003WEB
Windows 2003 Standart
WIN_VER_WINDOWS2003STANDART
Windows Vista
WIN_VER_WINDOWSVISTA
Windows Vista Business
WIN_VER_WINDOWSVISTA_BUSINESS
Windows Vista Cluster Server
WIN_VER_WINDOWSVISTA_CLUSTER_SERVER
Windows Vista Datacenter Server
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER
Windows Vista Datacenter Server Core
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE
Windows Vista Datacenter Server Core V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V
Windows Vista Datacenter Server V
WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V
Windows Vista Enterprise
WIN_VER_WINDOWSVISTA_ENTERPRICE
Windows Vista Enterprise Server
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER
Windows Vista Enterprise Server Core
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE
Windows Vista Enterprise Server V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V
Windows Vista Enterprise Server Core V
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V
Windows Vista Enterprise Server IA64
WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64
Windows Vista Home Basic
WIN_VER_WINDOWSVISTA_HOME_BASIC
Windows Vista Home Premium
WIN_VER_WINDOWSVISTA_HOME_PREMIUM
Windows Vista Home Server
WIN_VER_WINDOWSVISTA_HOME_SERVER
Windows Vista Server For Small Business
WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS
Windows Vista Small Business Server
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER
Windows Vista Small Business Server Premium
WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM
Windows Vista Medium Business Server Management
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows Vista Medium Business Server Messaging
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING
Windows Vista Medium Business Server Security
WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY
Windows Vista Standard Server
WIN_VER_WINDOWSVISTA_STANDARD_SERVER
Windows Vista Standard Server V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V
Windows Vista Standard Server Core
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE
Windows Vista Standard Server Core V
WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V
Windows Vista Starter
WIN_VER_WINDOWSVISTA_STARTER
Windows Vista Storage Enterprise Server
WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER
Windows Vista Storage Express Server
WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER
Windows Vista Storage Standard Server
WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER
Windows Vista Storage Workgroup Server
WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER
Windows Vista Undefined
WIN_VER_WINDOWSVISTA_UNDEFINED
Windows Vista Ultimate
WIN_VER_WINDOWSVISTA_ULTIMATE
Windows Vista Web Server
WIN_VER_WINDOWSVISTA_WEB_SERVER
Windows Vista Web Server Core
WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE
Windows Vista Unlicensed
WIN_VER_WINDOWSVISTA_UNLICENSED
Windows 2008
WIN_VER_WINDOWS2008
Windows 2008 Business
WIN_VER_WINDOWS2008_BUSINESS
Windows 2008 Cluster Server
WIN_VER_WINDOWS2008_CLUSTER_SERVER
Windows 2008 Datacenter Server
WIN_VER_WINDOWS2008_DATACENTER_SERVER
Windows 2008 Datacenter Server Core
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE
Windows 2008 Datacenter Server Core V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V
Windows 2008 Datacenter Server V
WIN_VER_WINDOWS2008_DATACENTER_SERVER_V
Windows 2008 Enterprise
WIN_VER_WINDOWS2008_ENTERPRICE
Windows 2008 Enterprise Server
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER
Windows 2008 Enterprise Server Core
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE
Windows 2008 Enterprise Server V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V
Windows 2008 Enterprise Server Core V
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V
Windows 2008 Enterprise Server IA64
WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64
Windows 2008 Home Basic
WIN_VER_WINDOWS2008_HOME_BASIC
Windows 2008 Home Premium
WIN_VER_WINDOWS2008_HOME_PREMIUM
Windows 2008 Home Server
WIN_VER_WINDOWS2008_HOME_SERVER
Windows 2008 Server For Small Business
WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS
Windows 2008 Small Business Server
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER
Windows 2008 Small Business Server Premium
WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 Medium Business Server Management
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 Medium Business Server Messaging
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 Medium Business Server Security
WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 Standard Server
WIN_VER_WINDOWS2008_STANDARD_SERVER
Windows 2008 Standard Server V
WIN_VER_WINDOWS2008_STANDARD_SERVER_V
Windows 2008 Standard Server Core
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE
Windows 2008 Standard Server Core V
WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V
Windows 2008 Starter
WIN_VER_WINDOWS2008_STARTER
Windows 2008 Storage Enterprise Server
WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER
Windows 2008 Storage Express Server
WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER
Windows 2008 Storage Standard Server
WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER
Windows 2008 Storage Workgroup Server
WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER
Windows 2008 Undefined
WIN_VER_WINDOWS2008_UNDEFINED
Windows 2008 Ultimate
WIN_VER_WINDOWS2008_ULTIMATE
Windows 2008 Web Server
WIN_VER_WINDOWS2008_WEB_SERVER
Windows 2008 Web Server Core
WIN_VER_WINDOWS2008_WEB_SERVER_CORE
Windows 2008 Unlicensed
WIN_VER_WINDOWS2008_UNLICENSED
Windows 2008 R2
WIN_VER_WINDOWS2008R2
Windows 2008 R2 Business
WIN_VER_WINDOWS2008R2_BUSINESS
Windows 2008 R2 Cluster Server
WIN_VER_WINDOWS2008R2_CLUSTER_SERVER
Windows 2008 R2 Datacenter Server
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER
Windows 2008 R2 Datacenter Server Core
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE
Windows 2008 R2 Datacenter Server Core V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V
Windows 2008 R2 Datacenter Server V
WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V
Windows 2008 R2 Enterprise
WIN_VER_WINDOWS2008R2_ENTERPRICE
Windows 2008 R2 Enterprise Server
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER
Windows 2008 R2 Enterprise Server Core
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE
Windows 2008 R2 Enterprise Server V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V
Windows 2008 R2 Enterprise Server Core V
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V
Windows 2008 R2 Enterprise Server IA64
WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64
Windows 2008 R2 Home Basic
WIN_VER_WINDOWS2008R2_HOME_BASIC
Windows 2008 R2 Home Premium
WIN_VER_WINDOWS2008R2_HOME_PREMIUM
Windows 2008 R2 Home Server
WIN_VER_WINDOWS2008R2_HOME_SERVER
Windows 2008 R2 Server For Small Business
WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS
Windows 2008 R2 Small Business Server
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER
Windows 2008 R2 Small Business Server Premium
WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM
Windows 2008 R2 Medium Business Server Management
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 2008 R2 Medium Business Server Messaging
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 2008 R2 Medium Business Server Security
WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY
Windows 2008 R2 Standard Server
WIN_VER_WINDOWS2008R2_STANDARD_SERVER
Windows 2008 R2 Standard Server V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V
Windows 2008 R2 Standard Server Core
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE
Windows 2008 R2 Standard Server Core V
WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V
Windows 2008 R2 Starter
WIN_VER_WINDOWS2008R2_STARTER
Windows 2008 R2 Storage Enterprise Server
WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER
Windows 2008 R2 Storage Express Server
WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER
Windows 2008 R2 Storage Standard Server
WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER
Windows 2008 R2 Storage Workgroup Server
WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER
Windows 2008 R2 Undefined
WIN_VER_WINDOWS2008R2_UNDEFINED
Windows 2008 R2 Ultimate
WIN_VER_WINDOWS2008R2_ULTIMATE
Windows 2008 R2 Web Server
WIN_VER_WINDOWS2008R2_WEB_SERVER
Windows 2008 R2 Web Server Core
WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE
Windows 2008 R2 Unlicensed
WIN_VER_WINDOWS2008R2_UNLICENSED
Windows 7
WIN_VER_WINDOWSSEVEN
Windows 7 Business
WIN_VER_WINDOWSSEVEN_BUSINESS
Windows 7 Cluster Server
WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER
Windows 7 Datacenter Server
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER
Windows 7 Datacenter Server Core
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE
Windows 7 Datacenter Server Core V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V
Windows 7 Datacenter Server V
WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V
Windows 7 Enterprise
WIN_VER_WINDOWSSEVEN_ENTERPRICE
Windows 7 Enterprise Server
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER
Windows 7 Enterprise Server Core
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE
Windows 7 Enterprise Server V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V
Windows 7 Enterprise Server Core V
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V
Windows 7 Enterprise Server IA64
WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64
Windows 7 Home Basic
WIN_VER_WINDOWSSEVEN_HOME_BASIC
Windows 7 Home Premium
WIN_VER_WINDOWSSEVEN_HOME_PREMIUM
Windows 7 Home Server
WIN_VER_WINDOWSSEVEN_HOME_SERVER
Windows 7 Server For Small Business
WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS
Windows 7 Small Business Server
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER
Windows 7 Small Business Server Premium
WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM
Windows 7 Medium Business Server Management
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT
Windows 7 Medium Business Server Messaging
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING
Windows 7 Medium Business Server Security
WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY
Windows 7 Standard Server
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER
Windows 7 Standard Server V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V
Windows 7 Standard Server Core
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE
Windows 7 Standard Server Core V
WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V
Windows 7 Starter
WIN_VER_WINDOWSSEVEN_STARTER
Windows 7 Storage Enterprise Server
WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER
Windows 7 Storage Express Server
WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER
Windows 7 Storage Standard Server
WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER
Windows 7 Storage Workgroup Server
WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER
Windows 7 Undefined
WIN_VER_WINDOWSSEVEN_UNDEFINED
Windows 7 Ultimate
WIN_VER_WINDOWSSEVEN_ULTIMATE
Windows 7 Web Server
WIN_VER_WINDOWSSEVEN_WEB_SERVER
Windows 7 Web Server Core
WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE
Windows 7 Unlicensed
WIN_VER_WINDOWSSEVEN_UNLICENSED
Portuguese (Brazil)
Portuguese (Portugal)
Enigma_Plugin_OnSaveKey
Enigma_Plugin_OnLoadKey
ntdll.dll
LS_Enigma_Plugin_OnDeleteKey
TExecutedProcess
Library not found: %s
Function not found: %s.%s
RtlFormatCurrentUserKeyPath
ole32.dll
comctl32.dll
!"#$%&*;<=>@[]^_`{|}
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
TExported@
USER32.DLL
EInvalidGraphicOperation
uxtheme.dll
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
TComboBoxExEnumerator
ssHorizontal
OnKeyDown
OnKeyPressD
OnKeyUph
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
HelpKeyword
OnExecutetIv
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview0Hw
WindowStatehCw
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys<Aw
AutoHotkeys
Uh.nw
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
UhP%x
imm32.dll
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
PasswordChar
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
Uh.uy
.UnicodeClass
TntUnicodeVcl.DestroyWindow
Internal Error: Control does not support ITntGlyphButton.
dtPostMsg
Software\Microsoft\Windows\CurrentVersion
ProductKey
Software\Microsoft\Windows NT\CurrentVersion
\\.\PhysicalDrive0
\\.\%s
\\.\Scsi0:
\\.\SMARTVSD
%Program Files% (x86)\TntWare\Delphi Unicode Controls\Source\TntRegistry.pas
M.ged
#$%&'()* ,-./01234
PSAPI.dll
VBoxService.exe
Ui%uG
ÞFAULT FOLDER%
%SYSTEM FOLDER%
%WINDOWS FOLDER%
Mutex object: Unique: %d-%d. Number: %d
%S-AEnS.kv}
THookWindowsAPI
EP_RegCheckKey
EP_RegCheckKeyA
EP_RegCheckKeyW
EP_RegSaveKey
EP_RegSaveKeyA
EP_RegSaveKeyW
EP_RegLoadKey
EP_RegLoadKeyA
EP_RegLoadKeyW
EP_RegLoadAndCheckKey
EP_RegCheckAndSaveKey
EP_RegCheckAndSaveKeyA
EP_RegCheckAndSaveKeyW
EP_RegDeleteKey
EP_RegKeyExpirationDate
EP_RegKeyExpirationDateEx
EP_RegKeyCreationDate
EP_RegKeyCreationDateEx
EP_RegKeyExecutions
EP_RegKeyExecutionsTotal
EP_RegKeyExecutionsLeft
EP_RegKeyDays
EP_RegKeyDaysTotal
EP_RegKeyDaysLeft
EP_RegKeyRuntime
EP_RegKeyRuntimeTotal
EP_RegKeyRuntimeLeft
EP_RegKeyGlobalTime
EP_RegKeyGlobalTimeTotal
EP_RegKeyGlobalTimeLeft
EP_RegKeyRegisterAfterDate
EP_RegKeyRegisterAfterDateEx
EP_RegKeyRegisterBeforeDate
EP_RegKeyRegisterBeforeDateEx
EP_TrialExecutions
EP_TrialExecutionsTotal
EP_TrialExecutionsLeft
EP_TrialExecutionTime
EP_TrialExecutionTimeTotal
EP_TrialExecutionTimeLeft
EP_RegCheckKeyEx
EP_RegSaveKeyEx
EP_RegLoadKeyEx
EP_CheckUpStartupPasswordHashString
EP_ProtectedStringByKey
EP_RegKeyInformation
EP_RegKeyInformationA
EP_RegKeyInformationW
EP_RegKeyStatus
DLL_Loader_Import_Unit
TInitImport
Could not load library: %s
S.mbVxT
Function %s not found in module %s
File not found: %s
Can't find DLL entry point %s in %s
"%s" %s
%s %s
mscorwks.dll
mscoreei.dll
clr.dll
e .Kl3
%)Key
coRegistratioKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwCreateKey
ZwEnumerateKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwLoadKey
ZwLoadKey2
ZwNotifyChangeKey
ZwQueryMultipleValueKey
ZwReplaceKey
ZwRestoreKey
ZwSaveKey
ZwSetInformationKey
ZwUnloadKey
ZwOpenKeyEx
ZwQuerySection, Unsupported class %d
KeySetValue unsupported value type
ZwQueryValueKey, unsupported class %d
ZwQueryKey, unsupported class %d
ZwQueryObject with unsupported class
ZwReadFileInformation with unsupported class
ZwSetInformationFile with unsupported class
.ZzhI
.jA'z
sxs.dll
THookWindowsAPI
\\.\NTICE
\\.\SICE
\\.\SIWDEBUG
%sH~C
%s\%.8x%.8x-%.8x%.8x
)TEnigmaProtectorLoaderFormStartuppassword
DLL_Loader_RunPassword_Unit
.NkA/
decrypt_on_execute_begin
ECRONEXECB
decrypt_on_execute_end
ECRONEXECE
.section
DLL_Loader.dll
@``@``@``@``@``@``@``@
@``@``@``@``@``
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
_enigma_keygen_routines
TntWindows
UrlMon
virtualboximportunit
KeyRoutines
nJwaWindows
 DLL_Loader_Import_Unit
hv.ph,!
.nr2G
i?.hE
user32.dll
advapi32.dll
version.dll
gdi32.dll
shell32.dll
SHFolder.dll
shlwapi.dll
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCPInfo
GetKeyboardType
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
ShellExecuteW
ShellExecuteA
0/191_1{1
7#7'7 7/737
; ;$;(;,;0;4;8;
1$1*10161
8 8$8(8,8
>%> >7>?>{>
4'4 4;4[4
0)0.090@0
2%3x4
0*1.12161<1\1
5(535;5[5{5
4#4 4<4\4
7 7$7(7,7074787<7@7`7
; ;$;(;,;0;4;8;<;\;};
9 >$>(>,>0>4>
> >$>(>,>
67
45
psapi.dll
ws2_32.dll
wininet.dll
mpr.dll
winmm.dll
comdlg32.dll
%Cookies FOLDER%
Unspecified error (%d) from %s.
debug.log
enigma_ide.dll
ÚysToKeyExp%
%RegKey%
%KeyExpYear%
%KeyExpMonth%
%KeyExpDay%
%CU_EXTFILES%
%CU_EXECPR%
%CU_INSTSERV%
%CU_WINVER%
%CU_VIRTTOOLS%
%TrialExecsTotal%
%TrialExecsLeft%
%TrialExecMinsTotal%
%TrialExecMinsLeft%
hh.exe
write.exe
attrib.exe
chkdsk.exe
compact.exe
find.exe
help.exe
winver.exe
regsvr32.exe
replace.exe
dllhost.exe
ntvdm.exe
tcpsvcs.exe
Was not able to create virtual value at ImportCall_ZwSetValueKey
Was not able to create virtual key at ImportCall_ZwSetValueKey
ImportCall_ZwLoadKey
ImportCall_ZwLoadKey2
ImportCall_ZwNotifyChangeKey
ImportCall_ZwQueryMultipleValueKey
ImportCall_ZwReplaceKey
ImportCall_ZwRestoreKey
ImportCall_ZwSaveKey
ImportCall_ZwSetInformationKey
ImportCall_ZwUnloadKey
evb*.tmp
.manifest
Unsupported call of ZwSetVolumeInformationFile
\device\harddiskvolume1\test6\wait.htm
Application requires password to start
Enter password
Change password
New password:
Confirm new password:
% )*0./(&'312-,
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread creation error: %s
Thread Error: %s (%d)7CreateClone not implemented for class %s with source %s
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
'%s' is an invalid mask at (%d)$''%s'' is not a valid component name
Ancestor for '%s' not found
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation

FEK.exe_1948_rwx_009A5000_000FE000:

Q.idat
.YH]lE
l]!.QQ
ÏMM
:z.dk>d
<t%saI
%SJBy$1
Keyw
u$%Cl
W%9s_
X~.AB
_=p%u6
DE.BY
8%S(U
01234567
rkey
%Ch.ZZ
),-./:??
;<=>@[]^
l%DkR
MsgZ
$.OstT
^40%ck
s~$%X
_q.BC
>X.PC$'E(x'
Hv%SttM[
v%F`u
E(ALc"%s
\V%u@J
%SWv=Ia!
%ul;T'
@keys
23456789
]U.av
%UG %
HxSF%x
u\P%sx
.BNx(
Q.KPe
Nx.pua
Ib.UP
("%ss
i%u!U
5a%d"
M.ged
%&'()* ,
-./01234
.VB22Z
KW.HK
e .Kl3
KeyWZL
%.tsI
hfTPh(
UrlI
?.Ss\R
3.uh/dF
.ZzhI
.jA'z
.NkA/
p%clh
$G"%D.
\$.Hl
*|%s4
_48N%U
$y.Wi
-"ÙM
1234567
.zw _
P#&k-BP}
l%S%E
KO.Tb
N]%u0
.WXg-p
D%X~x#
jrg%U
.Pw>'
4%XbLQ5[
Zf.XWO
nI.HT
.AEl|
.XImA
R0>%X~e
t .ervP3m
6y%SJ
=X?%u0
K%X</
TNu%UV
I%uEB
(%C!L
FKP%X
[^.du
X.Sk&H
=_.DlS
..yJE
.nb4C
v.pD,(
.vfjN?B
"%D&>
w%x4l
S"h%X
-'.KQD
r2<s%t2`M%u3$v"
rz|g0!1H%U1
^8E%F
V0^%C
ZwVt%S
Wb.xVX
.Eh~!
Rpw%s
.ObtjLc7
?0?P?X?\?`?d?h?l?p?t%x
9 :(;,(0
t!v.xv[{
92 :L.lHe|
:c;g<k=o%s
~ ~$~(_,
%x|%L
tfIyd\.Vslwd
%3x$4
@UDPN]
.GvP/
(=N%U
?P%XW
n(ajP,d%x
b,pST.Rk
P.tgM
Site : hXXp://VVV.enigmaprotector.com/
E-mail : support@enigmaprotector.com
Lisence holder: %s

FEK.exe_1948_rwx_00F90000_00004000:

Invalid NULL variant operation
Invalid variant operation
Variant method calls not supported
Access violation at address %p. %s of address %p
Invalid pointer operation
Invalid floating point operation
I/O error %d
'%s' is not a valid integer value

FEK.exe_1948_rwx_01120000_00038000:

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
"%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe"
ntdll.dll
EnigmaDevelopers\license.dat
application.exe

FEK.exe_1948_rwx_01160000_00004000:

|ntdll.dll
|kernel32.dll
A~user32.dll
wgdi32.dll
wadvapi32.dll
wrpcrt4.dll
wsecur32.dll
woleaut32.dll
wmsvcrt.dll
Nwole32.dll
|shell32.dll
wshlwapi.dll
wversion.dll
vpsapi.dll
qws2_32.dll
qws2help.dll
=wcomctl32.dll
wwininet.dll
wcrypt32.dll
wmsasn1.dll
qmpr.dll
vwinmm.dll
;vcomdlg32.dll
9vimm32.dll
blpk.dll
tusp10.dll
xvshfolder.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:196
    1.exe:1328

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\1.exe (22433 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2.exe (20507 bytes)
    %Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe (15801 bytes)
    %Documents and Settings%\All Users\Application Data\RWNVQR\FEK.00 (1 bytes)
    %Documents and Settings%\All Users\Application Data\RWNVQR\FEK.01 (81 bytes)
    %Documents and Settings%\All Users\Application Data\RWNVQR\FEK.02 (0 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "FEK Start" = "%Documents and Settings%\All Users\Application Data\RWNVQR\FEK.exe"

  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.