Packer.Enigma.1_a02f6ad12a – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Packer creates the following process(es):No processes have been created.The Packer injects its code into the following process(es):

%original file name%.exe:840

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:840 makes changes in the file system.

The Packer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\evb2.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\evb1.tmp (1 bytes)

Registry activity

The process %original file name%.exe:840 makes changes in the system registry.

The Packer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 FF 43 92 7A DD 38 C6 E2 93 F0 A2 F6 FE B2 B9"

Dropped PE files

MD5	File path
4da38dcda60385e10c9c2d12df67c278	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\evb1.tmp
4da38dcda60385e10c9c2d12df67c278	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\evb2.tmp

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Packer file.
Delete or disinfect the following files created/modified by the Packer:
%Documents and Settings%\%current user%\Local Settings\Temp\evb2.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\evb1.tmp (1 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: LuMianDan
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2015
Legal Trademarks:
Original Filename: RT???? v2.4.7.exe
Internal Name: RT???? v2.4.7.exe
File Version: 1.0.0.0
File Description: LuMianDan
Comments:
Language: English (United States)

Company Name: Product Name: LuMianDanProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2015Legal Trademarks: Original Filename: RT???? v2.4.7.exeInternal Name: RT???? v2.4.7.exeFile Version: 1.0.0.0File Description: LuMianDanComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
	8192	360448	113664	5.54372	11292716f48e56c44d7716cf6288d208
	368640	16384	0	0	d41d8cd98f00b204e9800998ecf8427e
	385024	8192	512	0.211627	469c9d2da49f4547d4a0c8049051f0a2
.rsrc	393216	16384	11264	4.40057	a7650dba0c73d08876737b296a123b3e
	409600	2613248	210944	5.54345	a7262ea941e444eb95c16f967f6f9439
.data	3022848	884736	881152	5.53588	c983283446fa68802c825e03a85cc8e7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Packer connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_840_rwx_00402000_00057000:

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj

QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

System.Drawing.Icon

System.Drawing.Size

v4.0.30319

v2.4.7.exe

LuMianDan.Util

LuMianDan.Properties

LoginParam

HttpWebResponseUtility

TKeyCountries

TKeyInformation

HttpUtil

System.Windows.Forms

System.Configuration

.ctor

mykey

get_Key

set_Key

password

get_Password

set_Password

checkCodeUrl

get_CheckCodeUrl

set_CheckCodeUrl

appkey

get_Appkey

set_Appkey

ifLoginSuccess

get_IfLoginSuccess

set_IfLoginSuccess

smsPostUrl

get_SmsPostUrl

set_SmsPostUrl

_w_tb_nick

get_W_tb_nick

set_W_tb_nick

loginTime

get_LoginTime

set_LoginTime

needLogin

get_NeedLogin

set_NeedLogin

appsecertForGw

get_AppsecertForGw

set_AppsecertForGw

Password

CheckCodeUrl

Appkey

IfLoginSuccess

SmsPostUrl

W_tb_nick

LoginTime

NeedLogin

AppsecertForGw

System.Collections.Generic

System.Data

ifApassUser

buildOrderUrl

result_next_url

HttpHelper

CsharpHttpHelper

HttpItem

http2

HttpResult

ifH5Login

ifApiLogin

ifLogin

wkUrl

ifCreateWkUrl

wkAlipayUrl

zcBuildHttp

zcCreateHttp

loginKey

UrlEncode

login_H5

toCacheLogin

appLogin

GetOnlineLogin

System.Drawing

getWebCookie

getSkuIDByUrl

alipay_http

isApassUser

KeyEventArgs

textBox4_KeyDown

createBuildOrderUrl

Newtonsoft.Json

Newtonsoft.Json.Linq

GetWebClientByTj

GetWebClientByTj_2

GetWebClientByGet

GetWebClientByPost

GetWebClient

login_api

autoLogin

createBuildOrderUrl_v3

System.Net.NetworkInformation

juJoinGroupH5

tbzcHttpHelperInit

getAlipayHttpPost

getAlipayUrl

System.ComponentModel

cAppLogin

buyerNick

get_BuyerNick

set_BuyerNick

BuyerNick

PICTURE_URL

get_Url

set_Url

System.Text

System.IO

login_getToken_url_re

login_getToken_url

login_getToken_url_2

product_detail_url

ping_url

getSignByECODE_apa_pass

getHttpPost

getHttpPost_tmall

getLoginInfo

getLoginInfo_tmall

getPassword

getStockUrl

getSignByOldKey

APPKEY

PASSWORD

CHECKCODEURL

getAppkey

getLoginApi

getStockParamUrl

getSecKillInfoUrl

System.Net

HttpWebRequest

HttpWebResponse

CreateGetHttpResponse

CreatePostHttpResponse

System.Security.Cryptography.X509Certificates

X509Certificate

System.Net.Security

KEY_STATUS_DOESNOTEXIST

KEY_STATUS_VALID

KEY_STATUS_INVALID

KEY_STATUS_STOLEN

KEY_STATUS_DATEEXPIRED

KEY_STATUS_WITHOUTHARDWARELOCK

KEY_STATUS_WITHOUTEXPIRATIONDATE

KEY_STATUS_WITHOUTREGISTERAFTERDATE

KEY_STATUS_WITHOUTREGISTERBEFOREDATE

KEY_STATUS_WITHOUTEXECUTIONSLIMIT

KEY_STATUS_WITHOUTDAYSLIMIT

KEY_STATUS_WITHOUTRUNTIMELIMIT

KEY_STATUS_WITHOUTGLOBALTIMELIMIT

KEY_STATUS_WITHOUTCOUNTRYLOCK

KEY_STATUS_COUNTRYINVALID

KEY_STATUS_REGISTERAFTERFAILED

KEY_STATUS_REGISTERBEFOREFAILED

KEY_STATUS_EXECUTIONSEXPIRED

KEY_STATUS_DAYSEXPIRED

KEY_STATUS_RUNTIMEEXPIRED

KEY_STATUS_GLOBALTIMEEXPIRED

KEY_STATUS_HARDWARECHANGESEXCEEDED_VOLUMESERIAL

KEY_STATUS_HARDWARECHANGESEXCEEDED_VOLUMENAME

KEY_STATUS_HARDWARECHANGESEXCEEDED_COMPUTERNAME

KEY_STATUS_HARDWARECHANGESEXCEEDED_CPU

KEY_STATUS_HARDWARECHANGESEXCEEDED_MOTHERBOARD

KEY_STATUS_HARDWARECHANGESEXCEEDED_WINDOWSKEY

KEY_STATUS_HARDWARECHANGESEXCEEDED_HDDSERIAL

KEY_STATUS_HARDWARECHANGESEXCEEDED_USERNAME

CN_PORTUGAL

CN_TURKEY

KEY_COUNTRIES

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegDeleteKey

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_ProtectedStringByKey

UseKeyExpiration

UseExecutionsLimit

System.Resources

System.Globalization

getHtmlByGetByUrl

getResultByGetByUrl

getHtmlByGetByUrlNoKeepLive

HttpPost

HttpGet

tracknick

get_Tracknick

set_Tracknick

Tracknick

System.Numerics

SetRSAPublicKey

openKey

postUrl

certificate

AKey

AKeyInfo

KeySize

System.Runtime.Versioning

System.Reflection

System.Runtime.InteropServices

log4net.Config

System.Diagnostics

System.Runtime.CompilerServices

v2.4.7

System.Security.Cryptography

System.IO.Compression

System.Text.RegularExpressions

set_URL

WebHeaderCollection

System.Collections.Specialized

WebBrowser

System.Web

HttpUtility

CsharpHttpHelper.Enum

get_RedirectUrl

ContainsKey

WebRequest

WebResponse

System.Threading

System.Collections

System.Web.Extensions

System.Web.Script.Serialization

WebException

Keys

get_KeyCode

WebClient

URLEncode

HttpRequestHeader

KeyedHashAlgorithm

set_PasswordChar

UrlDecode

ISupportInitialize

KeyEventHandler

add_KeyDown

.cctor

DllImportAttribute

Kernel32.dll

get_KeySize

System.CodeDom.Compiler

System.Net.Sockets

RemoteCertificateValidationCallback

set_ServerCertificateValidationCallback

HttpVersion

KeyValuePair`2

get_Keys

System.Net.Mail

System.Collections.ObjectModel

SmtpClient

SmtpException

enigma_ide.dll

System.Runtime.Serialization

System.Runtime.Serialization.Json

LuMianDan.Form1.resources

LuMianDan.Properties.Resources.resources

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

.NETFramework,Version=v4.0

.NET Framework 4

$c698086b-b37b-4acc-a189-628168f8d216

1.0.0.0

F:\goodleDownload\328_0827\322_0006\LuMianDan v2.4.7\LuMianDan\obj\x86\Debug\RT

v2.4.7.pdb

_CorExeMain

mscoree.dll

$this.Icon

hXXps://assets.alicdn.com/mw/app/mytaobao/h5/js/RSA.js?v=0

application/x-www-form-urlencoded

BigTools && BigTools.setMaxDigits(130);

var c = new RSAKeyPair(exponent, "", module), a = RSAKeyPair.encryptedString(c, pwd);

document.write(taobaoRSA("

{"platform":"h5","acookie":"","isPosition":false,"userId":null,"nick":null}

rest/h5ApiUpdate.do?callback=mtopjsonp1&type=jsonp&api=mtop.taobao.wireless.homepage.ac.loadPageContent&data={"platform":"h5","acookie":"","isPosition":false,"userId":null,"nick":null}&v=2.0&appKey=12574478&t=

application/x-www-form-urlencoded; Charset=UTF-8

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

/h5/mtop.taobao.detail.getdetail/6.0/?appKey=12574478&t=

&api=mtop.taobao.detail.getdetail&v=6.0&ttid=2013@taobao_h5_1.0.0&type=jsonp&dataType=jsonp&callback=mtopjsonp1&data=

Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4

hXXps://h5.m.taobao.com/awp/core/detail.htm?id=

hXXps://login.m.taobao.com/login.htm?spm=0.0.0.0&tpl_redirect_url=http://h5.m.taobao.com/awp/mtb/mtb.htm?#!/awp/mtb/mtb.htm

event_submit_do_login" value="

TPL_redirect_url" value="

pin.aliyun.com

hXXps://pin

&TPL_password=

&event_submit_do_login=

&TPL_redirect_url=

hXXps://login.m.taobao.com/login.htm?_input_charset=utf-8&sid=

login.m.etao.com

rest/h5ApiUpdate.do?callback=jsonp1&type=jsonp&api=com.taobao.client.getTms&data=&v=*&appKey=12574478&t=

_w_tb_nick=

hXXp://i.taobao.com/my_taobao_api/alipay_blance.json?_ksTS=

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

sorry.not.data

operationType=ali.user.gw.unifyLogin&id=0&requestData=

hXXp://agw.t.taobao.com/mgw.htm

application/x-www-form-urlencoded; charset=UTF-8

agw.t.taobao.com

h5Url

h5Url":"

12679450

data={"openKey":"

hXXp://api.qianglouyouli.com/lg.aspx?currentTime=

\MTUserInit.txt

hXXps://login.taobao.com/jump?target=https://buy.tmall.com/auction/buy.htm?from=itemDetail

Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0

ti=207200@tmall_android_4.2.2;_w_al_f=1;_w_tb_nick=

21533232

hXXp://api.qianglouyouli.com/version_mobile_md.aspx?currentTime=

\MTParamInit.txt

password=

\MTErr.txt

com.taobao.mtop.deliver.getdivisionchild

270200@taobao_android_5.4.7

rest/api3.do?sign=

&appKey=

MTOPSDK/1.4.0 (Android;2.3.4;samsung;GT-I9100)

http:

s.click.taobao.com

hXXps://api.m.taobao.com/rest/api3.do?

hXXps://api.m.taobao.com/

api=mtop.common.getTimestamp

hXXps://pin.aliyun.com/get_img?sessionid={0}&identity=sirius_checkcode&type=150_40&t={1}

600438@juhuasuan_android_2.9.1

mtop.trade.buildOrder

","supportAsync":"false","buyNow":"true"

","supportAsync":"false"}

mtop.trade.createOrder

nextUrl":"

class="am-msg-box">

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36

maliprod.alipay.com

mclient.alipay.com

HH:mm:ss.fff

am-msg-box">

hXXps://izhongchou.taobao.com/order/confirm_order.htm?itemId=

text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

_fm.co._0.i" id="itemId" value="

_fm.co._0.a" id="J_form_addressId" value="

_fm.co._0.o" value="

&_fm.co._0.i=

&_fm.co._0.a=

&_fm.co._0.o=

&_fm.co._0.ar=

&_fm.co._0.c=

&_fm.co._0.pr=

&_fm.co._0.pos=

&_fm.co._0.d=

&_fm.co._0.de=

&_fm.co._0.del=

&_fm.co._0.deli=

&_fm.co._0.di=

&_fm.co._0.p=

&_fm.co._0.s=

&_fm.co._0.isAnonymous=

&_fm.co._0.postFee=

&_fm.co._0.b=

&_fm.co._0.it=

&_fm.co._0.bu=

&_fm.co._0.sh=

hXXps://izhongchou.taobao.com/order/confirm_order.htm

207200@tmall_android_5.14.0

com.taobao.wireless.user.isApassUser

hXXp://mclient.alipay.com/w/trade_pay.do?alipay_trade_no=

transportType_

"transportType_

hXXp://buy.m.tmall.com/auction/confirm_order.htm?

Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

alipayURL=

0123456789

mtop.order.querybidlist

&ttid=700171@taobao_android_4.2.2&v=1.0&t=

&api=mtop.order.querybidlist&appKey=12278902&imsi=

hXXp://hws.m.taobao.com/cache/wdetail/5.0/?id=

|*.CSV

hXXp://mclient.alipay.com/w/trade_pay.do?alipay_trade_no=&pay_order_id=&s_id=

hXXps://mclient.alipay.com/h5/cashierPay.htm?awid=

com.taobao.client.sys.getAppToken

com.taobao.client.sys.login

hXXp://api.qianglouyouli.com/calc2.aspx?currentTime=

{"key":"

api=com.taobao.client.sys.getAppToken&v=*&data=

rest/api3.do

api.m.taobao.com

pubKey

","password":"

","appKey":"

api=com.taobao.client.sys.login&v=v2&data=

com.taobao.client.sys.autologin

rest/api3.do?

hXXp://api.qianglouyouli.com/login_tj.aspx?currentTime=

&password=

hXXp://api.qianglouyouli.com/updPsw_tj.aspx?currentTime=

&oldpassword=

&newpassword=

hXXp://api.qianglouyouli.com/register_tj.aspx?currentTime=

hXXp://api.qianglouyouli.com/recharge_tj_2.aspx?currentTime=

api.qianglouyouli.com

api.agdwt.com

hXXp://

/expire_tj_2.aspx?currentTime=

mtop.htao.buildOrder

","supportAsync":false,"buyNow":true}

gw/mtop.htao.buildOrder/2.0?rnd=

&supportAsync=true&data=

m-appkey

207200@tmall_android_5.14.0

","supportAsync":false}

mtop.htao.createOrder

gw/mtop.htao.createOrder/2.0?rnd=

(*.txt)|*.txt|(*.*)|*.*

212200@taobao_android_3.9.5

mtop.order.doPay

appKey=

alipayUrl

hXXps://buy.

.com/auction/buy_now.jhtml?&item_id=

F_nick" value="

&F_nick=

.com/auction/confirm_order.htm

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.111 Safari/537.36

CHECK_CODE_VALID_NOT_PASS

redirectUrl=

.com/order/confirm_order.htm?quantity={0}&buy_param={1}&buy_params={2}&item_id={3}&from=item_detail&item_id_num={4}

joinId":"

hXXp://mdskip.m.tmall.com/mobile/joinTg.do?itemId=

hXXp://detail.m.tmall.com/item.htm?id=

errorMsg":"

item.taobao.com

detail.tmall.com

hXXp://api.m.taobao.com/h5/mtop.ju.group.join/3.0/?v=3.0&api=mtop.ju.group.join&appKey=12574478&t=

juJoinGroupH5 >>

{"itemId":"520648018518","item_num_id":"520648018518","_input_charset":"utf-8","buyNow":"true","v":"0","skuId":"","channelKey":"qianggou","exParams":"{\"id\":\"520648018518\",\"spm\":\"\",\"umpChannel\":\"qianggou\",\"u_channel\":\"qianggou\"}"}

1448019226560

hXXps://api.m.taobao.com/h5/com.taobao.client.getTms/*/?appKey=12574478&t=

&api=com.taobao.client.getTms&v=*&type=originaljson&timeout=8000&isSec=1&dataType=json&ecode=1&ttid=#t#ip##_h5_2014&data=

\",\"spm\":\"0.0.0.0\",\"tg_key\":\"jhs\",\"v\":\"0\"}","ttid":"#t#ip##_h5_2014"}

","channelKey":"qianggou","exParams":"{\"id\":\"

appKey=12574478&t=

&api=mtop.trade.buildOrder.h5&v=3.0&type=originaljson&timeout=8000&isSec=1&dataType=json&ecode=1&ttid=

&AntiFlood=true&LoginRequest=true&H5Request=true&x-itemid=

hXXps://api.m.

.com/h5/mtop.trade.buildOrder.h5/3.0/?

Mozilla/5.0 (Windows; U; Android 4.1) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

hXXp://h5.m.taobao.com

hXXps://buy.m.

&ttid=#t#ip##_h5_2014&dataType=json&ecode=1&api=mtop.trade.buildOrder.h5&v=3.0&appKey=12574478&t=

rest/h5ApiUpdate.do?mtop.trade.buildOrder.h5/30/?type=originaljson

mtop.trade.buildOrder.h5

","supportAsync":true}

&ttid=207200@tmall_android_5.14.0&v=

&api=mtop.trade.buildOrder.h5&appKey=

&channelKey=qianggou&data=

&api=mtop.trade.createOrder.h5&v=3.0&type=originaljson&timeout=4000&isSec=1&dataType=json&ecode=1&ttid=

.com/h5/mtop.trade.createOrder.h5/3.0/?

rest/h5ApiUpdate.do?mtop.trade.createOrder.h5/3.0/?type=originaljson&ttid=#t#ad##_h5_2014&type=post&dataType=json&ecode=1&api=mtop.trade.createOrder.h5&v=3.0&appKey=12574478&t=

mtop.trade.createOrder.h5

&ttid=207200@tmall_android_5.14.0&v=

hXXp://trade.ju.taobao.com/trade/json/buy_item_action.htm?_input_charset=utf-8&callback=myjsonp

hXXp://detail.ju.taobao.com/home.htm?item_id=

hXXp://rt.agdwt.com/qq.aspx?i=

eurl":"

rest/h5ApiUpdate.do?callback=jsonp1&type=jsonp&api=mtop.order.queryOrderList&data=

&v=1.0&appKey=12574478&t=

hXXps://wap.alipay.com/home/taobaoTrustLogin.htm?type=applyPeerPay&alipay_trade_no=

&callbackURI=/personal/applyPeerPay.htm

207200@tmall_android_4.2.2

mtop.order.queryOrderDetail

255200@taobao_android_5.6.0

mtop.order.queryDetail

h5/mtop.order.queryDetail/3.0/?sign=

&appKey=12574478&t=

&AntiFlood=true&AntiCreep=true&LoginRequest=true&type=jsonp&dataType=jsnop&callback=mtopjsonp1

com.taobao.mtop.deliver.getAddressList

com.taobao.mtop.deliver.editAddressStatus

com.taobao.mtop.deliver.createAddress

hXXps://42.156.146.77/rest/api3.do?

hXXps://42.156.146.77/

mtop.pyramid.wirelessmtoprefundservice.refundrouter

hXXp://api.m.tmall.com/rest/h5ApiUpdate.do?sign=

mtop.pyramid.wirelessmtoprefundservice.queryalertrefundpage

mtop.trade.addBag

mtop.trade.queryBagList

","cat":"all","supportAsync":true,"pageNo":1,"cartType":"","next":true,"startTimestamp":0,"n":50,"mixed":false,"forceUpdate":false,"endTimestamp":0}

,smsniff,wireshark,fiddler,peid,httpwatch,analyzer,sniffer,pproxy,scoop,tcpdump.wsockexpert,reflector,reflexil,scanid.de4dot,pecompact,r4ndom,

2.4.7

v2.4.7

12278902

ttid=207200@tmall_android_4.2.2

","needSSOToken":"true","appKey":"

tracknick=

hXXp://ax.m.taobao.com/qst.htm?

12574478

hXXps://hws.m.taobao.com/cache/wdetail/5.0/?id=

m.ajax.taobao.com

hXXp://ax.m.taobao.com/stock2.htm?

hws.m.taobao.com/cache/wdetail/5.0/

appKey

https

&{0}={1}

zbbdsg@126.com

smtp.126.com

C:\Windows\temp

C:\Windows\temp\

.jpeg

Portugal

Turkey

LuMianDan.Properties.Resources

%original file name%.exe_840_rwx_00464000_00352000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

comctl32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ole32.dll

!"#$%&*;@[]^_`{|}

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

TNT Internal Error: TWideComponentHelper.Create should never be encountered.

w:\3rdparty\TntUnicode\Source\TntClasses.pas

Internal Error: Unexpected format type (%s)

W:\3rdparty\ScreamSec\SecUtils.pas

TCipher.CreateIntf: Algorithm mismatch

TBlockCipher.CreateIntf: Wrong VectorSize

Cipher mode not supported

The vector for %s is %d blocks. Cannot initialize with a %d block vector.

The block size for %s is %d bytes and the key is %d bytes. Cannot initialize with a %d block vector.

The minimum key and IV size for %s is %d bytes.

Not supported

TRijndael_PipedPCFB

Rijndael: Invalid key size - %d

2.16.840.1.101.3.4.1.1

2.16.840.1.101.3.4.1.21

2.16.840.1.101.3.4.1.41

1.3.6.1.4.1.13085.1.22

1.3.6.1.4.1.13085.1.23

1.3.6.1.4.1.13085.1.24

2.16.840.1.101.3.4.1.4

2.16.840.1.101.3.4.1.24

2.16.840.1.101.3.4.1.44

1.3.6.1.4.1.13085.1.7

1.3.6.1.4.1.13085.1.8

1.3.6.1.4.1.13085.1.9

1.3.6.1.4.1.13085.1.4

1.3.6.1.4.1.13085.1.5

1.3.6.1.4.1.13085.1.6

1.3.6.1.4.1.13085.1.10

1.3.6.1.4.1.13085.1.11

1.3.6.1.4.1.13085.1.12

1.3.6.1.4.1.13085.1.1

1.3.6.1.4.1.13085.1.2

1.3.6.1.4.1.13085.1.3

1.3.6.1.4.1.13085.1.16

1.3.6.1.4.1.13085.1.17

1.3.6.1.4.1.13085.1.18

2.16.840.1.101.3.4.1.2

2.16.840.1.101.3.4.1.22

2.16.840.1.101.3.4.1.42

1.3.6.1.4.1.13085.1.19

1.3.6.1.4.1.13085.1.20

1.3.6.1.4.1.13085.1.21

2.16.840.1.101.3.4.1.3

2.16.840.1.101.3.4.1.23

2.16.840.1.101.3.4.1.43

2.16.840.1.101.3.4.1.5

2.16.840.1.101.3.4.1.25

2.16.840.1.101.3.4.1.45

/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */

TGenerator.Create: Cipher mode must be cmCTR.

TMPPool.CheckThreadID: Called from the wrong thread.

TMPPool.Cache: Invalid pointer

TMPPool.Obtain: Out of memory

TMPPool.InternalCheck: Invalid pointer

Portugal

Turkey

TKeyVerifyParams

12345678-

EP_RegCheckKey

EP_RegCheckKeyA

EP_RegCheckKeyW

EP_RegSaveKey

EP_RegSaveKeyA

EP_RegSaveKeyW

EP_RegLoadKey

EP_RegLoadKeyA

EP_RegLoadKeyW

EP_RegLoadAndCheckKey

EP_RegCheckAndSaveKey

EP_RegCheckAndSaveKeyA

EP_RegCheckAndSaveKeyW

EP_RegDeleteKey

EP_RegKeyExpirationDate

EP_RegKeyExpirationDateEx

EP_RegKeyCreationDate

EP_RegKeyCreationDateEx

EP_RegKeyExecutions

EP_RegKeyExecutionsTotal

EP_RegKeyExecutionsLeft

EP_RegKeyDays

EP_RegKeyDaysTotal

EP_RegKeyDaysLeft

EP_RegKeyRuntime

EP_RegKeyRuntimeTotal

EP_RegKeyRuntimeLeft

EP_RegKeyGlobalTime

EP_RegKeyGlobalTimeTotal

EP_RegKeyGlobalTimeLeft

EP_RegKeyRegisterAfterDate

EP_RegKeyRegisterAfterDateEx

EP_RegKeyRegisterBeforeDate

EP_RegKeyRegisterBeforeDateEx

EP_TrialExecutions

EP_TrialExecutionsTotal

EP_TrialExecutionsLeft

EP_TrialExecutionTime

EP_TrialExecutionTimeTotal

EP_TrialExecutionTimeLeft

EP_RegCheckKeyEx

EP_RegSaveKeyEx

EP_RegLoadKeyEx

EP_CheckUpStartupPasswordHashString

EP_ProtectedStringByKey

EP_RegKeyInformation

EP_RegKeyInformationA

EP_RegKeyInformationW

EP_RegKeyStatus

Windows 95

WIN_VER_WINDOWS95

Windows 95 OSR2

WIN_VER_WINDOWS95OSR2

Windows 98

WIN_VER_WINDOWS98

Windows 98 SE

WIN_VER_WINDOWS98SE

Windows ME

WIN_VER_WINDOWSME

Windows 2000

WIN_VER_WINDOWS2000

Windows 2000 Professional

WIN_VER_WINDOWS2000PROF

Windows 2000 Data Server

WIN_VER_WINDOWS2000DATASERVER

Windows 2000 Advanced Server

WIN_VER_WINDOWS2000ADVSERVER

Windows 2000 Server

WIN_VER_WINDOWS2000SERVER

Windows XP

WIN_VER_WINDOWSXP

Windows XP Home

WIN_VER_WINDOWSXPHOME

Windows XP Professional

WIN_VER_WINDOWSXPPROF

Windows XP Professional x64

WIN_VER_WINDOWSXPPROFx64

Windows XP Professional Datacenter x64

WIN_VER_WINDOWSXPPROFDATACENTERx64

Windows XP Professional Enterprise x64

WIN_VER_WINDOWSXPPROFENERPRICEx64

Windows XP Professional Standart x64

WIN_VER_WINDOWSXPPROFSTANDARTx64

Windows 2003

Windows 2003 Server

WIN_VER_WINDOWS2003SERVER

Windows 2003 Server R2

WIN_VER_WINDOWS2003SERVERR2

Windows 2003 Storage Server

WIN_VER_WINDOWS2003STORAGESERVER

Windows 2003 Datacenter Itanium

WIN_VER_WINDOWS2003DATACENTERITANIUM

Windows 2003 Enterprise Itanium

WIN_VER_WINDOWS2003ENTERPRICEITANIUM

Windows 2003 Datacenter x64

WIN_VER_WINDOWS2003DATACENTERx64

Windows 2003 Enterprise x64

WIN_VER_WINDOWS2003ENERPRICEx64

Windows 2003 Standart x64

WIN_VER_WINDOWS2003STANDARTx64

Windows 2003 Compute

WIN_VER_WINDOWS2003COMPUTE

Windows 2003 Datacenter

WIN_VER_WINDOWS2003DATACENTER

Windows 2003 Enterprise

WIN_VER_WINDOWS2003ENTERPRICE

Windows 2003 Web

WIN_VER_WINDOWS2003WEB

Windows 2003 Standart

WIN_VER_WINDOWS2003STANDART

Windows Vista

WIN_VER_WINDOWSVISTA

Windows Vista Business

WIN_VER_WINDOWSVISTA_BUSINESS

Windows Vista Cluster Server

WIN_VER_WINDOWSVISTA_CLUSTER_SERVER

Windows Vista Datacenter Server

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER

Windows Vista Datacenter Server Core

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE

Windows Vista Datacenter Server Core V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_CORE_V

Windows Vista Datacenter Server V

WIN_VER_WINDOWSVISTA_DATACENTER_SERVER_V

Windows Vista Enterprise

WIN_VER_WINDOWSVISTA_ENTERPRICE

Windows Vista Enterprise Server

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER

Windows Vista Enterprise Server Core

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE

Windows Vista Enterprise Server V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_V

Windows Vista Enterprise Server Core V

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_CORE_V

Windows Vista Enterprise Server IA64

WIN_VER_WINDOWSVISTA_ENTERPRISE_SERVER_IA64

Windows Vista Home Basic

WIN_VER_WINDOWSVISTA_HOME_BASIC

Windows Vista Home Premium

WIN_VER_WINDOWSVISTA_HOME_PREMIUM

Windows Vista Home Server

WIN_VER_WINDOWSVISTA_HOME_SERVER

Windows Vista Server For Small Business

WIN_VER_WINDOWSVISTA_SERVER_FOR_SMALLBUSINESS

Windows Vista Small Business Server

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER

Windows Vista Small Business Server Premium

WIN_VER_WINDOWSVISTA_SMALLBUSINESS_SERVER_PREMIUM

Windows Vista Medium Business Server Management

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows Vista Medium Business Server Messaging

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_MESSAGING

Windows Vista Medium Business Server Security

WIN_VER_WINDOWSVISTA_MEDIUMBUSINESS_SERVER_SECURITY

Windows Vista Standard Server

WIN_VER_WINDOWSVISTA_STANDARD_SERVER

Windows Vista Standard Server V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_V

Windows Vista Standard Server Core

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE

Windows Vista Standard Server Core V

WIN_VER_WINDOWSVISTA_STANDARD_SERVER_CORE_V

Windows Vista Starter

WIN_VER_WINDOWSVISTA_STARTER

Windows Vista Storage Enterprise Server

WIN_VER_WINDOWSVISTA_STORAGE_ENTERPRISE_SERVER

Windows Vista Storage Express Server

WIN_VER_WINDOWSVISTA_STORAGE_EXPRESS_SERVER

Windows Vista Storage Standard Server

WIN_VER_WINDOWSVISTA_STORAGE_STANDARD_SERVER

Windows Vista Storage Workgroup Server

WIN_VER_WINDOWSVISTA_STORAGE_WORKGROUP_SERVER

Windows Vista Undefined

WIN_VER_WINDOWSVISTA_UNDEFINED

Windows Vista Ultimate

WIN_VER_WINDOWSVISTA_ULTIMATE

Windows Vista Web Server

WIN_VER_WINDOWSVISTA_WEB_SERVER

Windows Vista Web Server Core

WIN_VER_WINDOWSVISTA_WEB_SERVER_CORE

Windows Vista Unlicensed

WIN_VER_WINDOWSVISTA_UNLICENSED

Windows 2008

WIN_VER_WINDOWS2008

Windows 2008 Business

WIN_VER_WINDOWS2008_BUSINESS

Windows 2008 Cluster Server

WIN_VER_WINDOWS2008_CLUSTER_SERVER

Windows 2008 Datacenter Server

WIN_VER_WINDOWS2008_DATACENTER_SERVER

Windows 2008 Datacenter Server Core

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE

Windows 2008 Datacenter Server Core V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_CORE_V

Windows 2008 Datacenter Server V

WIN_VER_WINDOWS2008_DATACENTER_SERVER_V

Windows 2008 Enterprise

WIN_VER_WINDOWS2008_ENTERPRICE

Windows 2008 Enterprise Server

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER

Windows 2008 Enterprise Server Core

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE

Windows 2008 Enterprise Server V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_V

Windows 2008 Enterprise Server Core V

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_CORE_V

Windows 2008 Enterprise Server IA64

WIN_VER_WINDOWS2008_ENTERPRISE_SERVER_IA64

Windows 2008 Home Basic

WIN_VER_WINDOWS2008_HOME_BASIC

Windows 2008 Home Premium

WIN_VER_WINDOWS2008_HOME_PREMIUM

Windows 2008 Home Server

WIN_VER_WINDOWS2008_HOME_SERVER

Windows 2008 Server For Small Business

WIN_VER_WINDOWS2008_SERVER_FOR_SMALLBUSINESS

Windows 2008 Small Business Server

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER

Windows 2008 Small Business Server Premium

WIN_VER_WINDOWS2008_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 Medium Business Server Management

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 Medium Business Server Messaging

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 Medium Business Server Security

WIN_VER_WINDOWS2008_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 Standard Server

WIN_VER_WINDOWS2008_STANDARD_SERVER

Windows 2008 Standard Server V

WIN_VER_WINDOWS2008_STANDARD_SERVER_V

Windows 2008 Standard Server Core

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE

Windows 2008 Standard Server Core V

WIN_VER_WINDOWS2008_STANDARD_SERVER_CORE_V

Windows 2008 Starter

WIN_VER_WINDOWS2008_STARTER

Windows 2008 Storage Enterprise Server

WIN_VER_WINDOWS2008_STORAGE_ENTERPRISE_SERVER

Windows 2008 Storage Express Server

WIN_VER_WINDOWS2008_STORAGE_EXPRESS_SERVER

Windows 2008 Storage Standard Server

WIN_VER_WINDOWS2008_STORAGE_STANDARD_SERVER

Windows 2008 Storage Workgroup Server

WIN_VER_WINDOWS2008_STORAGE_WORKGROUP_SERVER

Windows 2008 Undefined

WIN_VER_WINDOWS2008_UNDEFINED

Windows 2008 Ultimate

WIN_VER_WINDOWS2008_ULTIMATE

Windows 2008 Web Server

WIN_VER_WINDOWS2008_WEB_SERVER

Windows 2008 Web Server Core

WIN_VER_WINDOWS2008_WEB_SERVER_CORE

Windows 2008 Unlicensed

WIN_VER_WINDOWS2008_UNLICENSED

Windows 2008 R2

WIN_VER_WINDOWS2008R2

Windows 2008 R2 Business

WIN_VER_WINDOWS2008R2_BUSINESS

Windows 2008 R2 Cluster Server

WIN_VER_WINDOWS2008R2_CLUSTER_SERVER

Windows 2008 R2 Datacenter Server

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER

Windows 2008 R2 Datacenter Server Core

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE

Windows 2008 R2 Datacenter Server Core V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_CORE_V

Windows 2008 R2 Datacenter Server V

WIN_VER_WINDOWS2008R2_DATACENTER_SERVER_V

Windows 2008 R2 Enterprise

WIN_VER_WINDOWS2008R2_ENTERPRICE

Windows 2008 R2 Enterprise Server

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER

Windows 2008 R2 Enterprise Server Core

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE

Windows 2008 R2 Enterprise Server V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_V

Windows 2008 R2 Enterprise Server Core V

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_CORE_V

Windows 2008 R2 Enterprise Server IA64

WIN_VER_WINDOWS2008R2_ENTERPRISE_SERVER_IA64

Windows 2008 R2 Home Basic

WIN_VER_WINDOWS2008R2_HOME_BASIC

Windows 2008 R2 Home Premium

WIN_VER_WINDOWS2008R2_HOME_PREMIUM

Windows 2008 R2 Home Server

WIN_VER_WINDOWS2008R2_HOME_SERVER

Windows 2008 R2 Server For Small Business

WIN_VER_WINDOWS2008R2_SERVER_FOR_SMALLBUSINESS

Windows 2008 R2 Small Business Server

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER

Windows 2008 R2 Small Business Server Premium

WIN_VER_WINDOWS2008R2_SMALLBUSINESS_SERVER_PREMIUM

Windows 2008 R2 Medium Business Server Management

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 2008 R2 Medium Business Server Messaging

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 2008 R2 Medium Business Server Security

WIN_VER_WINDOWS2008R2_MEDIUMBUSINESS_SERVER_SECURITY

Windows 2008 R2 Standard Server

WIN_VER_WINDOWS2008R2_STANDARD_SERVER

Windows 2008 R2 Standard Server V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_V

Windows 2008 R2 Standard Server Core

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE

Windows 2008 R2 Standard Server Core V

WIN_VER_WINDOWS2008R2_STANDARD_SERVER_CORE_V

Windows 2008 R2 Starter

WIN_VER_WINDOWS2008R2_STARTER

Windows 2008 R2 Storage Enterprise Server

WIN_VER_WINDOWS2008R2_STORAGE_ENTERPRISE_SERVER

Windows 2008 R2 Storage Express Server

WIN_VER_WINDOWS2008R2_STORAGE_EXPRESS_SERVER

Windows 2008 R2 Storage Standard Server

WIN_VER_WINDOWS2008R2_STORAGE_STANDARD_SERVER

Windows 2008 R2 Storage Workgroup Server

WIN_VER_WINDOWS2008R2_STORAGE_WORKGROUP_SERVER

Windows 2008 R2 Undefined

WIN_VER_WINDOWS2008R2_UNDEFINED

Windows 2008 R2 Ultimate

WIN_VER_WINDOWS2008R2_ULTIMATE

Windows 2008 R2 Web Server

WIN_VER_WINDOWS2008R2_WEB_SERVER

Windows 2008 R2 Web Server Core

WIN_VER_WINDOWS2008R2_WEB_SERVER_CORE

Windows 2008 R2 Unlicensed

WIN_VER_WINDOWS2008R2_UNLICENSED

Windows 7

WIN_VER_WINDOWSSEVEN

Windows 7 Business

WIN_VER_WINDOWSSEVEN_BUSINESS

Windows 7 Cluster Server

WIN_VER_WINDOWSSEVEN_CLUSTER_SERVER

Windows 7 Datacenter Server

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER

Windows 7 Datacenter Server Core

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE

Windows 7 Datacenter Server Core V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_CORE_V

Windows 7 Datacenter Server V

WIN_VER_WINDOWSSEVEN_DATACENTER_SERVER_V

Windows 7 Enterprise

WIN_VER_WINDOWSSEVEN_ENTERPRICE

Windows 7 Enterprise Server

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER

Windows 7 Enterprise Server Core

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE

Windows 7 Enterprise Server V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_V

Windows 7 Enterprise Server Core V

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_CORE_V

Windows 7 Enterprise Server IA64

WIN_VER_WINDOWSSEVEN_ENTERPRISE_SERVER_IA64

Windows 7 Home Basic

WIN_VER_WINDOWSSEVEN_HOME_BASIC

Windows 7 Home Premium

WIN_VER_WINDOWSSEVEN_HOME_PREMIUM

Windows 7 Home Server

WIN_VER_WINDOWSSEVEN_HOME_SERVER

Windows 7 Server For Small Business

WIN_VER_WINDOWSSEVEN_SERVER_FOR_SMALLBUSINESS

Windows 7 Small Business Server

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER

Windows 7 Small Business Server Premium

WIN_VER_WINDOWSSEVEN_SMALLBUSINESS_SERVER_PREMIUM

Windows 7 Medium Business Server Management

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MANAGEMENT

Windows 7 Medium Business Server Messaging

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_MESSAGING

Windows 7 Medium Business Server Security

WIN_VER_WINDOWSSEVEN_MEDIUMBUSINESS_SERVER_SECURITY

Windows 7 Standard Server

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER

Windows 7 Standard Server V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_V

Windows 7 Standard Server Core

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE

Windows 7 Standard Server Core V

WIN_VER_WINDOWSSEVEN_STANDARD_SERVER_CORE_V

Windows 7 Starter

WIN_VER_WINDOWSSEVEN_STARTER

Windows 7 Storage Enterprise Server

WIN_VER_WINDOWSSEVEN_STORAGE_ENTERPRISE_SERVER

Windows 7 Storage Express Server

WIN_VER_WINDOWSSEVEN_STORAGE_EXPRESS_SERVER

Windows 7 Storage Standard Server

WIN_VER_WINDOWSSEVEN_STORAGE_STANDARD_SERVER

Windows 7 Storage Workgroup Server

WIN_VER_WINDOWSSEVEN_STORAGE_WORKGROUP_SERVER

Windows 7 Undefined

WIN_VER_WINDOWSSEVEN_UNDEFINED

Windows 7 Ultimate

WIN_VER_WINDOWSSEVEN_ULTIMATE

Windows 7 Web Server

WIN_VER_WINDOWSSEVEN_WEB_SERVER

Windows 7 Web Server Core

WIN_VER_WINDOWSSEVEN_WEB_SERVER_CORE

Windows 7 Unlicensed

WIN_VER_WINDOWSSEVEN_UNLICENSED

Portuguese (Brazil)

Portuguese (Portugal)

Enigma_Plugin_OnSaveKey

Enigma_Plugin_OnLoadKey

ntdll.dll

LS_Enigma_Plugin_OnDeleteKey

TExecutedProcess

CCommonOperationSystem

ZwOpenKey

ZwEnumerateValueKey

ZwQueryKey

ZwQueryValueKey

ZwCreateKey

ZwEnumerateKey

ZwSetValueKey

ZwDeleteKey

ZwDeleteValueKey

ZwFlushKey

ZwLoadKey

ZwLoadKey2

ZwNotifyChangeKey

ZwQueryMultipleValueKey

ZwReplaceKey

ZwRestoreKey

ZwSaveKey

ZwSetInformationKey

ZwUnloadKey

ZwOpenKeyEx

TExported`

.Uym1

USER32.DLL

EInvalidGraphicOperation

uxtheme.dll

Proportional

MAPI32.DLL

TComboBoxExEnumerator

ssHorizontal

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

HelpKeyword

OnExecute

ssHotTrack

TWindowState

poProportional

TWMKey

ClientHeightTPF

KeyPreview

WindowState,

Uh.FN

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

AutoHotkeysH

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

hfTP

imm32.dll

w:\3rdparty\TntUnicode\Source\TntActnList.pas

PasswordChar

w:\3rdparty\TntUnicode\Source\TntStdCtrls.pas

w:\3rdparty\TntUnicode\Source\TntForms.pas

w:\3rdparty\TntUnicode\Source\TntMenus.pas

Internal Error: SyncHotKeyPosition Failed ("%s" "%s").

w:\3rdparty\TntUnicode\Source\TntControls.pas

Internal Error: SubClassUnicodeControl.Control is not Unicode.

.UnicodeClass

TntUnicodeVcl.DestroyWindow

Internal Error: Control does not support ITntGlyphButton.

dtPostMsg

Software\Microsoft\Windows\CurrentVersion

ProductKey

Software\Microsoft\Windows NT\CurrentVersion

\\.\PhysicalDrive0

\\.\%s

\\.\Scsi0:

\\.\SMARTVSD

w:\3rdparty\TntUnicode\Source\TntRegistry.pas

#$%&'()* ,-./01234

PSAPI.dll

s%F%,h

VBoxService.exe

ÃžFAULT FOLDER%

%SYSTEM FOLDER%

%WINDOWS FOLDER%

Mutex object: Unique: %d-%d. Number: %d

DLL_Loader_Import_Unit

TInitImport

Could not load library: %s

k_ntdll.dll

File not found: %s

Can't find DLL entry point %s in %s

"%s" %s

%s %s

mscorwks.dll

mscoreei.dll

clr.dll

.llfw

%s\%.8x%.8x-%.8x%.8x

X.xP`*U

)-%X`

coRegistratioKey

ZwQuerySection, Unsupported class %d

KeySetValue unsupported value type

ZwQueryValueKey, unsupported class %d

ZwQueryKey, unsupported class %d

ZwQueryObject with unsupported class

ZwReadFileInformation with unsupported class

ZwSetInformationFile with unsupported class

sxs.dll

THookWindowsAPI

nUc.HL@Y

\\.\NTICE

\\.\SICE

\\.\SIWDEBUG

I80|k.ZzD'

)TEnigmaProtectorLoaderFormStartuppassword

DLL_Loader_RunPassword_Unit

.brOmxw

1.2.3

Portable Network Graphics

decrypt_on_execute_begin

ECRONEXECB

decrypt_on_execute_end

ECRONEXECE

.section

;&;.;6;>;

?#?)?.?9?

1!1%1)1-11151~1

3 3$3(3,30383`3

;";&;*;.;2;

;$

7&7.787=7

[0/1;102

0"0&0*000

5%5[5`5|5

3%4U4`4m4

1-171W1}1

0#0'0 0/0

1 1$1(1,1014181

8$8 82878

; ;(;0;8;@;

@``@``@``@``@``@``@``@

@``@``@``@``@``

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

TntWindows

KWindows

UrlMon

_enigma_keygen_routines

virtualboximportunit

KeyRoutines

nJwaWindows

DLL_Loader_Import_Unit

user32.dll

SQLh

QwV%Sh

k.ffv>OhE

W?.VI

D6.Be

advapi32.dll

version.dll

gdi32.dll

shell32.dll

SHFolder.dll

shlwapi.dll

GetWindowsDirectoryW

GetWindowsDirectoryA

GetCPInfo

GetKeyboardType

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegFlushKey

RegCreateKeyExA

SetViewportOrgEx

ShellExecuteW

ShellExecuteA

RtlFormatCurrentUserKeyPath

mscoree.dll

_CorExeMain

%SEoD

"%D>Q

t.MN6

:z.dk>d

.AQIu

W'QJ%u

456789 /

Keyw

%s[3d]H

/EhÃº

YL%COH@

C".UHY

4%9s_

7.eEK

*%uf]

-Vu%d

|.VMe

01234567

Z".HxdP5

`Prkey

F%un]

g4e.jX_$

E.HTD

-vW}9

6

%UlJ0

rviyc%s

.LR$/

7%)ntl%uG:

"%sc,4)

%SWv9Ia%

%cR1%

i|$_%DY

keyPs&

23456789

BkEY

?,?3:4;8'9

%s2 (

.HYFKJ

%SD3

,u%X'

hA.Dh

f;2%u[

Q.KPe

-y.lO

C Ã–)

>X.PC$N(

.UP?1

("9%s

X%c&u

%s e(

n@ %s

'()* ,-.

R%R.HE

..tG9

X.xP`

F

.VKg

t..AA

MSgfH

%sPtoTB

p,.TMnP

"&.IlF

?%@Â

%D)Z`

!%D&('

%uwpFyd

.pJr3

8$4,6-;9'

e D$mHg

y_k%X

NLV%f

;.GnN

.GAeN

&'%XROA

.PjtoN

)KhC%D

>,&%d

=1>>%C

;!

vr.rj

.wFKIzd

.iBer

1234567

2W%uO

CV%DhY

lq0Cwr.hV

QwV%ShV

* !l

"%D*/

".Up}

?f.nf

: ;2

z8H;Z%U

.PXtoN

XNÃŠ

a%4U{

~;N%f

:R?X%x

Site : hXXp://VVV.enigmaprotector.com/

E-mail : support@enigmaprotector.com

Unspecified error (%d) from %s.

%Cookies FOLDER%

enigma_ide.dll

%s - Entry Point Not Found

The procedure entry point %s could not be located in the dynamic link library %s.

ÃšysToKeyExp%

%RegKey%

%KeyExpYear%

%KeyExpMonth%

%KeyExpDay%

%CU_EXTFILES%

%CU_EXECPR%

%CU_INSTSERV%

%CU_WINVER%

%CU_VIRTTOOLS%

%TrialExecsTotal%

%TrialExecsLeft%

%TrialExecMinsTotal%

%TrialExecMinsLeft%

hh.exe

write.exe

attrib.exe

chkdsk.exe

compact.exe

find.exe

help.exe

winver.exe

regsvr32.exe

replace.exe

dllhost.exe

ntvdm.exe

tcpsvcs.exe

Was not able to create virtual value at ImportCall_ZwSetValueKey

Was not able to create virtual key at ImportCall_ZwSetValueKey

ImportCall_ZwLoadKey

ImportCall_ZwLoadKey2

ImportCall_ZwNotifyChangeKey

ImportCall_ZwQueryMultipleValueKey

ImportCall_ZwReplaceKey

ImportCall_ZwRestoreKey

ImportCall_ZwSaveKey

ImportCall_ZwSetInformationKey

ImportCall_ZwUnloadKey

evb*.tmp

.manifest

Unsupported call of ZwSetVolumeInformationFile

@:"/\|?*

Application requires password to start

Enter password

Change password

New password:

Confirm new password:

The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.

RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL

No help keyword specified.&Cannot change the size of a JPEG image

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt Clipboard does not support Icons

Text exceeds memo capacity/Menu '%s' is already being used by another form

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid Format Specifier: %s7CreateClone not implemented for class %s with source %s

Cannot open file "%s". %s

'%s' is an invalid mask at (%d)$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

%original file name%.exe_840_rwx_00CE0000_00004000:

Invalid NULL variant operation

Invalid variant operation

Variant method calls not supported

Access violation at address %p. %s of address %p

Invalid pointer operation

Invalid floating point operation

I/O error %d

'%s' is not a valid integer value

DW20.EXE_1672:

.text

`.data

.cdata

.rsrc

watson.microsoft.com

.mdmp

%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S

/dw/stagetwo.asp

%s/%S/%S/%S/%S/%S/%S/%S/%S.htm

Failed to fill report params from generic params

Not offering reporting

%s Mode

Failed to get a reporting destination

Nothing to report from queue

No reports left to send. Removing queue triggers and bailing.

Failed to plug UI; LCID=%u

Ignoring %S due to unknown queue version

Reporting is disabled

SignOff queue reporting is disabled

Queued Reporting Mode called but still want to report to the queue

Bad queue type to report from

No reports for given queue mask - %u

Invalid queue mask - %u

Suspending: Force cancel to queued reporting

Suspending: Force cancel to network reporting

CreateWindowExA failed with %d.

Application Error Reporting %d

WatsonQueuedReportingInstanceVerification

riched20.dll

qMicrosoft\PCHealth\ErrorReporting\DW

msaccess.exe

hXXp://watson.microsoft.com/dw/dcp.asp

hXXp://watson.microsoft.com/dw/watsoninfo.asp

dwintl20.dll

Launching lightweight browser with URL

mshtml.dll

Not reporting

Reporting

DWBypassQueue

DWExplainerURL

DWNoSignOffQueueReporting

DWAlwaysReport

DWReporteeName

DWURLLaunch

DWNoExternalURL

DWStressReport

ole32.dll

imm32.dll

BTLog.dll

Microsoft\PCHealth\ErrorReporting\DW

HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

hXXp://

hXXps://

Software\Microsoft\PCHealth\ErrorReporting\DW\Debug

%s\%s

https

DwBTLog.log

Failed to get minidump for %S!

szAppName=%s

szAppVer=%d.%d.%d.%d

szAppStamp=x

szModName=%s

szModVer=%d.%d.%d.%d

szModStamp=x

fDebug=%s

offset=x

microsoft.com

.msn.com

.microsoft.com

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps