Gen.Variant.Razy.24271_f6539c91f0 – Adaware

Gen:Variant.Razy.24271 (B) (Emsisoft), Gen:Variant.Razy.24271 (AdAware), Trojan.Win32.Bumat.FD, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: f6539c91f03e9efe16a41aeea39915ac

SHA1: 71eef0ecddeeb382850cc712afbff44456f25c5d

SHA256: 2158dc8366fad5b25d40ba7e48c1740d52782e029a75fe7fb64b3b6b4f4e7c55

SSDeep: 98304:z7P0en3FnGnyh32jjwrV cSZS7VFTGQ m:/0enGnyhGaVAZSnUm

Size: 3424132 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2016-10-19 16:00:08

Analyzed on: Windows7 SP1 32-bit

Summary: Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:3648

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab1F.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_48C188F1D80811F5367F4E0451E85318 (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_6B5C8B321CA02275A82E95FA81D6DE62 (356 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 (665 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_6B5C8B321CA02275A82E95FA81D6DE62 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_48C188F1D80811F5367F4E0451E85318 (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7 (452 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mm_9E.tmp\log.txt (315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar20.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (248 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab1F.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar20.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mm_9E.tmp (0 bytes)

Registry activity

The process %original file name%.exe:3648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadDecisionTime" = "20 F6 13 59 C0 9C D2 01"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASAPI32]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadNetworkName" = "Network 2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecisionTime" = "20 F6 13 59 C0 9C D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 38 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\f6539c91f03e9efe16a41aeea39915ac_RASMANCS]
"EnableFileTracing" = "0"

"ConsoleTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab1F.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_48C188F1D80811F5367F4E0451E85318 (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_6B5C8B321CA02275A82E95FA81D6DE62 (356 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 (665 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_6B5C8B321CA02275A82E95FA81D6DE62 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_48C188F1D80811F5367F4E0451E85318 (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7 (452 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mm_9E.tmp\log.txt (315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar20.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (248 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: www.GameModding.net
Product Name: ModInstall
Product Version: 1.0.0.0
Legal Copyright: www.GameModding.net
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.1.0.0
File Description: ModInstall 3.0
Comments:
Language: German (Germany)

Company Name: www.GameModding.netProduct Name: ModInstallProduct Version: 1.0.0.0Legal Copyright: www.GameModding.netLegal Trademarks: Original Filename: Internal Name: File Version: 3.1.0.0File Description: ModInstall 3.0 Comments: Language: German (Germany)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	2793472	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	2797568	1265664	1263104	5.49643	0f963dff62ce59a79601d7439af4adf0
.rsrc	4063232	77824	74752	2.13349	cb8e70395f39a703d3e200112f50a8fb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 638
d9ef811825b1ee97884ecc253485628d
c2173bfc6ad3af622203e56821161165
ce23f63e36dc3a0ef10efb5a6b9009a2
7774e08463799c39d40dca5cf279849d
bfe8ab6fa63f5057dd0581d1af2477f0
9c684649329d5bc7372764247c23c134
40074a3208cda8b56a1cac51d4dd6027
e7ad00c35ea7654f9cfba522d3738da5
985d2cfebe4b9fd6fad0a727dcd58c77
cadccb568bdb625ee83c6cd9e02bbcf1
9edf7cd30af2ef6a6f1cd4c71773b120
a81cb66db15fb6b43b6f6e87e178bc2f
544174688b70de8e95b0ca8740ad2a36
48c4f926996192aa02e4cd4fa5140dba
e685f9c9fd359d82e7c4672ea86cf970
bbbd34a75555e86143604b39f3eb7368
f816c7e8bdb4564219e3041573b5894c
e58d21bc57365a8f3786923ed20d7965
486a54b983599df443247ec5ff8a0519
081373f14cb41ae9bd41fb71a6cc6228
ed8c966263e10600d8e4b947ae620794
a0a43f1feb604658d033d4d88a97524f
42eaca5b87995a69cf8646132a634a5e
a57090b406ae84dfe5074972f0783dce
d117447aa3c28893b6eda717b9b4dd40
91b5c50182c380490973ccb35dd711af

Network Activity

URLs

URL	IP
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==
hxxp://e6845.dscb1.akamaiedge.net/crls/gtglobal.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCE24N1wsMYCl
hxxp://clients.l.google.com/GIAG2.crl
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCE24N1wsMYCl	216.58.209.174
hxxp://pki.google.com/GIAG2.crl	216.58.209.174
hxxp://g.symcb.com/crls/gtglobal.crl	23.37.37.163
hxxp://crl.geotrust.com/crls/secureca.crl	23.37.37.163
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==	23.37.43.27
ssl.google-analytics.com	216.58.214.232
dns.msftncsi.com	131.107.255.255
teredo.ipv6.microsoft.com	157.56.120.207

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCE24N1wsMYCl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Sun, 12 Mar 2017 18:53:15 GMT

Expires: Thu, 16 Mar 2017 18:53:15 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Cache-Control: public, max-age=345600

Age: 150534

0..........0..... .....0......0...0......J......h.v....b..Z./..20170312130040Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..M.7\,1......20170312130040Z....20170319130040Z0...*.H.............kb@..2.......U<....>4.C1.Uj..%....X...Rn9..Gl.(.C...uM.y.P......_z.Kh..x!7.k..wi....f..0.......2&u..YVF....S.....T......(..'.....e..,.(X@.{.}..W.W..[`3....*....H.~.b..0$....L......Q...O?M%Y&.F6...I&..=K>W.O.....5.<....B~.....T..a..g.N.t..2.........$.....b.HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Sun, 12 Mar 2017 18:53:15 GMT..Expires: Thu, 16 Mar 2017 18:53:15 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 150534..0..........0..... .....0......0...0......J......h.v....b..Z./..20170312130040Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..M.7\,1......20170312130040Z....20170319130040Z0...*.H.............kb@..2.......U<....>4.C1.Uj..%....X...Rn9..Gl.(.C...uM.y.P......_z.Kh..x!7.k..wi....f..0.......2&u..YVF....S.....T......(..'.....e..,.(X@.{.}..W.W..[`3....*....H.~.b..0$....L......Q...O?M%Y&.F6...I&..=K>W.O.....5.<....B~.....T..a..g.N.t..2.........$.....b...

<<< skipped >>>

GET /GIAG2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: pki.google.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Date: Tue, 14 Mar 2017 12:40:52 GMT

Expires: Tue, 14 Mar 2017 13:40:52 GMT

Last-Modified: Tue, 14 Mar 2017 02:15:00 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 541

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 78

0...0......0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170314010003Z..170324010003Z0R0'..vK....Q...170113141858Z0.0...U.......0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U........0...*.H...............|i.\d..![.D.j...M^..lv&0..o..u....S....."....`w.]...OG.....m..d.C......p...T.....K.B.N......@..l...........!.(..o........T.^.9.....X../...y.Z.b.~Y.....:.....N8.z....h.....^q.........r&$|.......>./..e>.)#...o...V7>Do....;-h)c].;.. .d.......Q.....^..>..)..HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Date: Tue, 14 Mar 2017 12:40:52 GMT..Expires: Tue, 14 Mar 2017 13:40:52 GMT..Last-Modified: Tue, 14 Mar 2017 02:15..

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1

Cache-Control: max-age = 564348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1377

content-transfer-encoding: binary

Cache-Control: max-age=536062, public, no-transform, must-revalidate

Last-Modified: Mon, 13 Mar 2017 17:36:06 GMT

Expires: Mon, 20 Mar 2017 17:36:06 GMT

Date: Tue, 14 Mar 2017 12:42:03 GMT

Connection: keep-alive

0..]......V0..R.. .....0.....C0..?0......V.T'S...q..."...zr.*..20170313173606Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20170313173606Z....20170320173606Z0...*.H...............g.78..B...K.m.;T(.8.e,.)..Y./....7/T>@ii......r8......8...og.5..fO.....Zp.]..^...L.?.; ..i....F~.&N.....(...."...za..`....J=...sV,.&.(.9..~....?...3s....O..gZ....k.....t.Q...p{...`.d5h..r$D~..!".......%.........z]e`C....&......5U.'.~*.(.duo..|q!G..yn........0...0...0..s............ ...y..^..g0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...161208112535Z..171214112535Z02100...U...'GeoTrust Global CA TGV OCSP Responder 50.."0...*.H.............0...............S....!....,.t.?....d...M@.._.=.S..,."......Gdv._c..D1..N'E.:.....a2.......{/rD. .c.2..P...!.....Xn..}....{{.zI9.Y....../.....;.......fu..,...B._o..B..g....o........?Y\.?...y.H*..]yi.....3.......F.6.....Q.........{B..19..Kz...\z...P..._...-!.....'.Ym........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0"..U....0...0.1.0...U....TGV-OFF-570...*.H..............md.....yV{......y:5..@l#..5.......o..X....,r}......i..3..o.e...e5..@..H/Q..;.vd..?.j.m....../hv..A.......g.......a.....G..\.'*.b..>.....L.Y.To<.@>...&1..9.w.....N*Au.e.....b..K...PO47.J.....{.C\....G..0/.a.Eo.`z.<;IA... #.''.CG..K@7z..7.\_..'.]q.f._.WN....

<<< skipped >>>

GET /crls/gtglobal.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcb.com

HTTP/1.1 200 OK

Server: Apache

ETag: "cdfed412ffc55736da7d26dd6e325304:1480525813"

Last-Modified: Wed, 30 Nov 2016 17:10:13 GMT

Date: Tue, 14 Mar 2017 12:42:09 GMT

Content-Length: 665

Connection: keep-alive

Content-Type: application/pkix-crl

0...0..}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161130095847Z..170330095847Z0...0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....5...060809140549Z0....4Z..020521134804Z0....6k..070711055050Z0....:...161018104931Z0....:...161018104712Z0....:V..161130095847Z0...*.H.............F.k>l.e..V.c....O..#..dr..tQ..c.E..y( .O..Q.$=V..:.%..>.....h0X.J..........$......9...u......b !...B'...Zw...%..._.[.y.........b..E.O..:1..'..qS.l..G.$.7G..b...H.B..F....{#[..TR.(...M.I....`,...........l.e*>g......\.|@.,..]9..R.......X.]..$M.2..4..........HTTP/1.1 200 OK..Server: Apache..ETag: "cdfed412ffc55736da7d26dd6e325304:1480525813"..Last-Modified: Wed, 30 Nov 2016 17:10:13 GMT..Date: Tue, 14 Mar 2017 12:42:09 GMT..Content-Length: 665..Connection: keep-alive..Content-Type: application/pkix-crl..0...0..}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161130095847Z..170330095847Z0...0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....5...060809140549Z0....4Z..020521134804Z0....6k..070711055050Z0....:...161018104931Z0....:...161018104712Z0....:V..161130095847Z0...*.H.............F.k>l.e..V.c....O..#..dr..tQ..c.E..y( .O..Q.$=V..:.%..>.....h0X.J..........$......9...u......b !...B'...Zw...%..._.[.y.........b..E.O..:1..'..qS.l..G.$.7G..b...H.B..F....{#[..TR.(...M.I....`,......

<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "f725a6b778e33d624bf78aaf05d33944:1489494630"

Last-Modified: Tue, 14 Mar 2017 12:30:30 GMT

Date: Tue, 14 Mar 2017 12:41:56 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl

0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170314122300Z..170324122300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H.............h.s........0..Nz0..X.:..V......?FX.....tJ.3.....Eu.b>.z..#58....P......f..HV.8p...*TG..*.Bb....._ bW.&.......v..h0...-q..HI4.V.HTTP/1.1 200 OK..Server: Apache..ETag: "f725a6b778e33d624bf78aaf05d33944:1489494630"..Last-Modified: Tue, 14 Mar 2017 12:30:30 GMT..Date: Tue, 14 Mar 2017 12:41:56 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170314122300Z..170324122300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H.............h.s........0..Nz0..X.:..V......?FX.....tJ.3.....Eu.b>.z..#58....P......f..HV.8p...*TG..*.Bb....._ bW.&.......v..h0...-q..HI4.V...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_3648:

`.rsrc

TArray

Generics.Collections

doOwnsKeys

crTextColor

TWMKey

KeyData

grfLocksSupported

ISupportErrorInfoX

HelpKeyword

UnderstandsKeyword

ssShift

htKeyword

EInvalidOperation

TList.TDirection

AOperator

TStringsL%C

TThread.TSynchronizeRecord

TOperation

Operation

FOnExecute

OnExecute

TArray

TList.Sort$594$0$IntfX

TList.Sort$594$ActRec

$TComponent.FindComponent$1217$0$IntfX

$TComponent.FindComponent$1217$ActRec

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey`

LastErrorMsg

RootKey`

RootKeyName

TLocalTimeZone.TYearlyChanges

TLocalTimeZone.TYearlyChangesLFE

:TPair

LTArray>

QTEnumerator>(

QTEnumerator>

QTEnumerable>-

QTEnumerable>`KE

FTDictionary.TItem

KTDictionary.TItemArray

IEqualityComparerX

Generics.Defaults

#TCollectionNotifyEvent

?TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator$PE

TEnumerable-

TEnumerable@QE

OTDictionary.TKeyEnumerator;

OTDictionary.TKeyEnumeratorpRE

OTDictionary.TKeyCollection;

OTDictionary.TKeyCollectionlTE

/TArray

4TEnumerator(

4TEnumerator

4TEnumerable-

4TEnumerable@XE

QTDictionary.TValueEnumerator;

QTDictionary.TValueEnumerator

QTDictionary.TValueCollection;

QTDictionary.TValueCollection

PTDictionary.TPairEnumerator;

PTDictionary.TPairEnumerator

FOnKeyNotify

FKeyCollection

@TDictionary9

ContainsKey

@TDictionary

Keys

OnKeyNotify

FTObjectDictionaryM

FTObjectDictionary

e:{Generics.Collections}TList>.:1

OIComparer>X

\TCollectionNotifyEvent>

Item:TPair

QIEnumerable>

WTList>.TEnumerator5

WTList>.TEnumerator

KTList>&

KTList>

,:{Generics.Collections}TList.:1

IComparerX

IEnumerable

TList.TEnumerator5

TList.TEnumeratorl

TList&

TList

H:{Generics.Collections}TList.:1

2IComparerX

4IEnumerable

:TList.TEnumerator5

:TList.TEnumerator

.TList&

.TListH

QTComparison>X

OTComparer>2

OTComparer>

e:{Generics.Collections}TList>.:3

TComparisonX

TComparer2

TComparer

,:{Generics.Collections}TList.:3

4TComparisonX

2TComparer2

2TComparer

H:{Generics.Collections}TList.:3

XTDelegatedComparer>8

XTDelegatedComparer>

TDelegatedComparer8

TDelegatedComparer

;TDelegatedComparer8

;TDelegatedComparer`

RootKey

ServerKey`

FSupportsLicensing

SupportsLicensing

Uh_%F

Operator

EVariantBadIndexError

ENotSupportedException

ENotSupportedExceptionp

ENoMonitorSupportException

TArray

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

TArray

etNoMonitorSupportException

biClrImportant

tagMSG

Windows

HKEY

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

lrMonoChrome

IsShortCut

FHelpKeyword

FPasswordChar

PasswordChar

OnKeyDown

OnKeyPress\

OnKeyUp8

ssHorizontal

TCustomButton.TButtonStyle

poPortrait

APort

Port

FAutoHotkeys

RethinkHotkeys

AutoHotkeys

EInvalidGraphicOperation

EInvalidGraphicOperationP

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome4

ssHotTrack

TWindowState

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState

WindowStateT

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint`

BiDiKeyboard`

NonBiDiKeyboard

OnActionExecute(AJ

Uh%xM

FProportional

Proportional

sltURL

TCustomLinkLabel.TLinkAlignment

FURL

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeyword`

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

fKeyword

ImportPalette

ImportColorTable

ImportDIBColors

ImportColorMap

ExportPalette

rmWindows20

rmWindows256

rmWindowsGray

rmMonochrome

rmQuantizeWindows

TMonochromeLookup7

TMonochromeLookup

WebCaption

WebText

TKeyValues *

TKeyValues

TKeyValuesData

std::vector >

std::_Vector_val >

TKeyValuesData *

TKeyValuesBlock *

std::vector >

std::vector > *

std::_Vector_val >

TKeyValuesBlock

LeftPartButton

LeftPartButtonMouse

WriteKeyList

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

FPort

FPassword

URLDecode

URLEncode

Password`

Port`

SEC_GET_KEY_FN

KeyVer

pGetKeyFn

pvGetKeyArgument

EXPORT_SECURITY_CONTEXT_FN&

IMPORT_SECURITY_CONTEXT_FN_W(

ExportSecurityContext

ImportSecurityContextW

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEYL

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUX0

cert_info

ex_nscert

get_cert_methods

cert_crl

ppem_password_cb

key_arg_length

key_arg

master_key_length

master_key

sess_cert

Ptlsext_ticket_key_cb!

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

AMsg

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

Password

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile`

CertFile`

KeyFilep

LoadRootCert

LoadCert

KeyFile

fPeerCert

PeerCert8

fOnGetPassword

fOnGetPasswordEx

OnGetPassword

OnGetPasswordExP

MakeFTPSvrPort

MakeFTPSvrPasv

EIdOSSLLoadingRootCertError4

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

fPassThrough

PassThrough

IdHTTPHeaderInfo

ProxyPassword

ProxyPort`

FMetaHTTPEquiv

TIdMetaHTTPEquivE

ProcessMetaHTTPEquiv

TIdMetaHTTPEquiv

TIdHTTPConnectionType

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

TIdHTTPResponse7

TIdHTTPResponse

TIdHTTPRequest5

AHTTP

TIdHTTPRequestd

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

AURL

TIdCustomHTTP`

MetaHTTPEquiv8

HTTPOptionsh

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException

QuoteHTTP

FHttpOnly

HttpOnly`

FCommentURL

FPortList

FRecvPort

FUsePort

CommentURL

PortCount

UsePort

RecvPort

aPassword

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

SendCmdf

TIdTCPConnection

IdTCPConnection

LastCmdResult

FBoundPort

FBoundPortMax

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustomT

IdTCPClient

BoundPort

BoundPortMax

BoundPortMin

TIdTCPClient

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersion@

saUsernamePassword

FUDPSocksAssociation

OpenUDP

RecvFromUDP

SendToUDP9

CloseUDP

PortP

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax`

PeerPort

IPAsString

FDefaultPort

DefaultPortP

VMsgEnd

EIdPortRequired

EIdTCPConnectionError

EIdObjectTypeNotSupported

"EIdTransparentProxyUDPNotSupported

SendToUDPm

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows4Ia

TIdStackWindowsg

VPort

WSGetServByPort

APortNumber

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

CheckIPVersionSupport

TIdStackWindows

EIdIPVersionUnsupportedd

EIdIPVersionUnsupported

ReceiveMsg,

EIdCanNotBindPortInRange

EIdInvalidPortRange

EIdInvalidPortRangel

ftpTransfer

ftpReady

ftpAborted

OnProgressh

WMHTTP *

WMHTTP

TSQLTimeStamp

TSQLTimeStampOffset

TSQLTimeStampVariantType0

TSQLTimeStampVariantType`

SqlTimSt

TSQLTimeStampOffsetVariantType0

TSQLTimeStampOffsetVariantType`

TSQLTimeStampData6

ASQLTimeStamp

TSQLTimeStampDatal

TSQLTimeStampOffsetData6

ASQLTimeStampOffset

TSQLTimeStampOffsetData

%u8F3

C.Pj W

TApi.HttpGetText$17277$0$IntfX

TApi.HttpGetText$17277$ActRec

Uhf%d

log/send_report

ntdll.dll

\Capabilities\UrlAssociations

TC32Url

TC32Urls

Urls

LicenseUrl

ConfidentialUrl

$TDownstalHelper.LoadImg$17299$0$IntfX

$TDownstalHelper.LoadImg$17299$ActRec

7TDownstalHelper.DownloadAndInstallPartners$17304$0$IntfX

_http

7TDownstalHelper.DownloadAndInstallPartners$17304$ActRec

cWM_VKEYTOITEM

cWM_SETHOTKEY

cWM_GETHOTKEY

cEM_SETPASSWORDCHAR

cEM_GETPASSWORDCHAR

cWM_KEYDOWN

cWM_KEYUP

cWM_SYSKEYDOWN

cWM_SYSKEYUP

cWM_KEYLAST

cWM_CTLCOLORMSGBOX

cCB_MSGMAX

cWM_IME_KEYDOWN

cWM_IME_KEYUP

cWM_HOTKEY

cWM_DDE_EXECUTE

PMsgDecoded@

TMsgDecoded

TMsg

Cmsg

PTCKeyDown

TTCKEYDOWN

wVKey

TOnThreadExecute

TPenJoin

Join

G6_KeyPreview

TOnKey

TTabKey

TTabKeys

eoPassword

ScrollCmd

fOnKeyUp

fOnKeyDown

FOnREOverURL

FOnREURLClick

fPass2DefProc

fWndProcKeybd

fExMsgProc

fTBttCmd

fWindowState

fKeyPreviewCount

fREUrl

pszUrl

pszKeywords

pszMsgText

pszMsgTitle

fExecute

pszUrlJump1

pszUrlJump2

pszCurUrl

CmdLine

TWindowsVersion

TWindowsVersions

TGPPenLineJoin

LineJoinMiter

LineJoinBevel

LineJoinRound

LineJoinMiterClipped

PHTTPHeaderH

THTTPHeader4

HTTPVersion

PHTTPDownload

THTTPHdrRecvEvent

THTTPProgressEvent

THTTPErrorEvent

THTTPDownloadEventX

KOLHTTPDownload

THTTPStatusEvent

THTTPDownload

HttpGetText$17238$0$IntfX

HttpGetText$17238$ActRec

HttpGetText$17238$ActRecH

http:

PKeySendProcess

user32.dll

clCrt@

IdHTTP1

hXXp://corp.sputnik.ru/legal

hXXp://corp.sputnik.ru/browser/legal

hXXps://VVV.360totalsecurity.com/ru/privacy/

hXXps://VVV.360totalsecurity.com/ru/license/360-total-security/

SOFTWARE\GameModding.net

\toolbar.exe

SQLite

SOFTWARE\GameModding.net\

\VVV.GameModding.net mods\

FormKeyDown

GameModding.net

log\debug.log

\VVV.GameModding.net\

AUTOR_WEB

hXXp://VVV.gamemodding.net/

models\gta3.img

pc\models\cdimages\vehicles.img

VVV.GameModding.net\

VVV.GameModding.net\Uninstall

VVV.GameModding.net\Uninstall(

hXXp://log.gamemodding.net

lblWebCaption

lblWebText$

idHTTP

idHTTPFinish

1.2.3

GMMInstallMods.log

res_mods\0.8.4\text

res_mods\0.8.5\text

res_mods\0.8.6\text

res_mods\0.8.7\text

res_mods\0.8.8\text

res_mods\0.8.9\text

res_mods\0.9.0\text

res_mods\0.9.1\text

res_mods\0.9.2\text

res_mods\0.9.3\text

res_mods\0.9.4\text

res_mods\0.9.5\text

res_mods\0.8.10\text

data.config

readme.txt

VVV.GameModding.net.url

hXXp://VVV.GameModding.net/

GAME_EXE_NAME

Data.cfg

data.cfg

cleo\skin.img

config.ini

skin.png

skin.json

.xpfl

label.gm

%dir%

gmm.dff

vgs_palm%d

tree%d

gtatreeshi%d

radar%d

ce_ground%d

ce_lod_%d

ce_bankalley%d

melrose%d

sw_block%d

vgnretail%d

gta3.img

gmm.lbl

SEARCH_KEY1

SEARCH_KEY

cstrike\gameinfo.txt

\Fallout4\plugins.txt

Data.Path =

Data.DataSize =

mafiaiimaterialsmerger.exe

edit\materials\MafiaIIMaterialsMerger.exe

\SOFTWARE\GameModding.net

\SOFTWARE\GameModding.net\

config.data

config.cfg

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

kernel32.dll

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount)) || (!vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcNVdtCount)) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

_noParam.VType == VT_ERROR

variant.cpp

_empty.VType == varEmpty

VType == rhs.VType

C:\Builds\TP\include\windows\rtl\utilcls.h

Parms.VType == (VT_ARRAY|VT_VARIANT)

ParmTypes.VType == (VT_ARRAY|VT_I4)

?456789:;

!"#$%&'()* ,-./0123

{"generator":"MediaMagnet", "values":{ "targetname":"\u0424\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u043a\u043e\u0442\u0438\u043a\u043e\u0432", "place_domain":"domain.ru", "MediaMagnetLicUrl":"hXXps://coin32.com/MediaMagnet.html", "MediaMagnetConfUrl":"", }, "targeturl":"hXXp://fastloadmedia.ru/libs/test/kotiki.zip", "api_url":["hXXp://medialogger.ru/api/v3.1.0/"], "resource_url":"hXXp://downloadcloud.ru", "api_key":"^3e86f9e990fb82f58e181887c75e4d466107fa1a647681e6c17dd3260973dae2", "place_id":"1", "site_id":"1", "referrer":"hXXp://referer.url/", "timestamp" : 1433370034, "embedded_data" : { }, "download_plugins":{ "narod": "hXXp://fastloadmedia.ru/libs/modules/narod.bin", "torrent": "hXXp://fastloadmedia.ru/libs/modules/torrent.bin", "yadisk":"hXXp://fastloadmedia.ru/libs/modules/yadisk.bin" }, "adv_ti":{ "regSoftwareAmigo": "HKCU\\Software\\Amigo", "regAmigoInstaller": "HKCU\\Software\\Mail.Ru\\AmigoInstaller", "regSoftwareMailUninstall": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MailRuUpdater", "regSoftwareYandex": "HKCU\\Software\\Yandex", "regSoftwareYandexBrowser": "HKCU\\Software\\Yandex\\YandexBrowser", "regSoftwareRambler": "HKCU\\Software\\Rambler", "regSoftwareRamblerUpdate": "HKCU\\Software\\Rambler\\Update", "dirAmigoPathExists": "{localappdata}Amigo\\", "dirMailPathExists": "{localappdata}Mail.Ru\\", "dirMailSputnikPathExists": "{localappdata}Mail.Ru\\Sputnik\\", "dirYandexPathExists": "{localappdata}Yandex\\", "dirYandexBrowserPathExists": "{localappdata}Yandex\\YandexBrowser\\", "dirYandexUpdaterPathExists": "{localappdata}Yandex\\Updater\\", "dirRamblerPathExists": "{localappdata}Rambler\\", "dirRamblerUpdaterPathExists": "{localappdata}Rambler\\RamblerUpdater\\", "dirZaxarPathExists": "{programfiles(x86)}Zaxar\\", "fileAmigoFileExists": "{localappdata}Amigo\\Application\\amigo.exe", "fileMailRuUpdater": "{localappdata}Mail.Ru\\MailRuUpdater.exe", "fileSputnikMailRuIco": "{localappdata}Mail.Ru\\Sputnik\\MailRu.ico", "fileYandexClidsBarie": "{appdata}Yandex\\clids-barie.xml", "fileYandexBrowser": "{localappdata}Yandex\\YandexBrowser\\Application\\browser.exe", "fileZaxarFileExists": "{programfiles(x86)}Zaxar\\ZaxarGameBrowser.exe" }, "logging": true}

Gw2.Hwa

KERNEL32.DLL

USER32.DLL

WINDOWSCODECS.DLL

DWMAPI.DLL

UXTHEME.DLL

SHELL32.DLL

gta.exe

@$xp$10Kol@TOnKey

@$xp$11Kol@TTabKey

@$xp$12Kol@TPenJoin

@$xp$12Kol@TTabKeys

@$xp$14Kol@PTCKeyDown

@$xp$14Kol@TTCKEYDOWN

@$xp$15Kol@PMsgDecoded

@$xp$15Kol@TMsgDecoded

@$xp$16Kol@TWindowState

@$xp$19C32lib_main@TC32Url

@$xp$19Kol@TWindowsVersion

@$xp$20C32lib_main@TC32Urls

@$xp$20Kol@TOnThreadExecute

@$xp$20Kol@TWindowsVersions

@$xp$21Utils@PKeySendProcess

@$xp$24Kolgdipv2@TGPPenLineJoin

@$xp$25Kolhttpdownload@TSpecials

@$xp$27Kolhttpdownload@PHTTPHeader

@$xp$27Kolhttpdownload@THTTPHeader

@$xp$29Kolhttpdownload@PHTTPDownload

@$xp$29Kolhttpdownload@THTTPDownload

@$xp$30Kolhttpdownload@TEventHandlers

@$xp$31Kolhttpdownload@PDownloadWorker

@$xp$31Kolhttpdownload@TDownloadWorker

@$xp$31Kolhttpdownload@THTTPErrorEvent

@$xp$32Kolhttpdownload@PREQUEST_CONTEXT

@$xp$32Kolhttpdownload@THTTPStatusEvent

@$xp$32Kolhttpdownload@TREQUEST_CONTEXT

@$xp$33Kolhttpdownload@THTTPHdrRecvEvent

@$xp$34Kolhttpdownload@THTTPDownloadEvent

@$xp$34Kolhttpdownload@THTTPProgressEvent

@$xp$8Kol@TMsg

@@Wmhttp@Finalize

@@Wmhttp@Initialize

@Admutil@IsWindowsAdministrator$qqrv

@Apicontroller@TApi@GetKey$qqrv

@Apicontroller@TApi@HttpGetText$qqrx20System@UnicodeStringp12Kol@TStrList20System@UnicodeStringt3

@Apicontroller@TApi@send_report$qqr20System@UnicodeString

@Browserdetect@OpenURL$qqr20System@UnicodeString

@Comobj@GetDispatchPropValue$qqr36System@ÃžlphiInterface$t9IDispatchSystem@WideString

@Comobj@GetDispatchPropValue$qqr36System@ÃžlphiInterface$t9IDispatch%i

@Comobj@SetDispatchPropValue$qqr36System@ÃžlphiInterface$t9IDispatchSystem@WideStringrx17System@OleVariant

@Comobj@SetDispatchPropValue$qqr36System@ÃžlphiInterface$t9IDispatch%irx17System@OleVariant

@Comobj@TComObject@$bctr$qqrp17TComObjectFactoryx45System@ÃžlphiInterface$t17System@IInterface%

@Downstalhelper@TDownstalHelper@OnDownloadError$qqrp29Kolhttpdownload@THTTPDownloadus

@Downstalhelper@TDownstalHelper@OnDownloadTargetProgress$qqrp29Kolhttpdownload@THTTPDownloadiiii

@Downstalhelper@TDownstalHelper@OnHeaderReceived$qqrp29Kolhttpdownload@THTTPDownloadp12Kol@TStrList

@Downstalhelper@TDownstalHelper@OnHttpProgress$qqrp29Kolhttpdownload@THTTPDownloadiiii

@Downstalhelper@TDownstalHelper@OnStatusEvent$qqrp29Kolhttpdownload@THTTPDownloadpvuiuit2ui

@Kol@AutoMinimizeApplet$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@CharIn$qqrbrx29System@%Set$tc$iuc$0$iuc$255%

@Kol@DummyOnDrawItemProc$qqrpvp8Kol@TObjp5HDC__rx11Types@TRecti44System@%Set$t16Kol@TDrawActions$iuc$0$iuc$2DSystem@%Set$t15Kol@TDrawStates$iuc$0$iuc$14%

@Kol@DummyOnLVCustomDrawProc$qqrpvp12Kol@TControlp5HDC__uiiirx11Types@TRect44System@%Set$t15Kol@TDrawStates$iuc$0$iuc$14%rit9

@Kol@ExePath$qqrv

@Kol@ExecuteConsoleAppIORedirect$qqrx20System@UnicodeStringt1t1uit1r20System@UnicodeStringui

@Kol@ExecuteIORedirect$qqrx20System@UnicodeStringt1t1uipuit5t5t5

@Kol@ExecuteWait$qqrx20System@UnicodeStringt1t1uiuipui

@Kol@FormSetIndexedEvent$qqrp12Kol@TControl

@Kol@FormSetKeyPreviewTrue$qqrp12Kol@TControl

@Kol@FormSetWindowState$qqrp12Kol@TControl

@Kol@GetWindowsDir$qqrv

@Kol@IsWinVer$qqr47System@%Set$t19Kol@TWindowsVersion$iuc$0$iuc$9%

@Kol@MsgBox$qqrx20System@UnicodeStringui

@Kol@MsgOK$qqrx20System@UnicodeString

@Kol@NewBitBtn$qqrp12Kol@TControlx20System@UnicodeString45System@%Set$t17Kol@TBitBtnOption$iuc$0$iuc$4Kol@TGlyphLayoutp9HBITMAP__i

@Kol@NewCombobox$qqrp12Kol@TControl45System@%Set$t16Kol@TComboOption$iuc$0$iuc$10%

@Kol@NewDateTimePicker$qqrp12Kol@TControl53System@%Set$t25Kol@TDateTimePickerOption$iuc$0$iuc$5%

@Kol@NewEditbox$qqrp12Kol@TControl44System@%Set$t15Kol@TEditOption$iuc$0$iuc$11%

@Kol@NewGraphEditbox$qqrp12Kol@TControl44System@%Set$t15Kol@TEditOption$iuc$0$iuc$11%

@Kol@NewListView$qqrp12Kol@TControl18Kol@TListViewStyle48System@%Set$t19Kol@TListViewOption$iuc$0$iuc$25%p14Kol@TImageListt4t4

@Kol@NewListbox$qqrp12Kol@TControl44System@%Set$t15Kol@TListOption$iuc$0$iuc$12%

@Kol@NewOpenDirDialog$qqrx20System@UnicodeString46System@%Set$t18Kol@TOpenDirOption$iuc$0$iuc$8%

@Kol@NewOpenSaveDialog$qqrx20System@UnicodeStringt148System@%Set$t19Kol@TOpenSaveOption$iuc$0$iuc$14%

@Kol@NewProgressbarEx$qqrp12Kol@TControl50System@%Set$t22Kol@TProgressbarOption$iuc$0$iuc$1%

@Kol@NewRichEdit$qqrp12Kol@TControl44System@%Set$t15Kol@TEditOption$iuc$0$iuc$11%

@Kol@NewRichEdit1$qqrp12Kol@TControl44System@%Set$t15Kol@TEditOption$iuc$0$iuc$11%

@Kol@NewScrollBox$qqrp12Kol@TControl14Kol@TEdgeStyle44System@%Set$t16Kol@TScrollerBar$iuc$0$iuc$1%

@Kol@NewTabControl$qqrp12Kol@TControlpxpbxi50System@%Set$t21Kol@TTabControlOption$iuc$0$iuc$14%p14Kol@TImageListi

@Kol@NewTabEmpty$qqrp12Kol@TControl50System@%Set$t21Kol@TTabControlOption$iuc$0$iuc$14%p14Kol@TImageList

@Kol@NewToolbar$qqrp12Kol@TControl17Kol@TControlAlign46System@%Set$t18Kol@TToolbarOption$iuc$0$iuc$7%p9HBITMAP__pxpbxipxixi

@Kol@NewTreeView$qqrp12Kol@TControl48System@%Set$t19Kol@TTreeViewOption$iuc$0$iuc$13%p14Kol@TImageListt3

@Kol@RegKeyClose$qqrp6HKEY__

@Kol@RegKeyDelete$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyDeleteValue$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyExists$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyGetBinary$qqrp6HKEY__x20System@UnicodeStringpvi

@Kol@RegKeyGetDateTime$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyGetDw$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyGetStr$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyGetStrEx$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyGetSubKeys$qqrxp6HKEY__p13Kol@TWStrList

@Kol@RegKeyGetValueNames$qqrxp6HKEY__p13Kol@TWStrList

@Kol@RegKeyGetValueTyp$qqrxp6HKEY__x20System@UnicodeString

@Kol@RegKeyOpenCreate$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyOpenRead$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyOpenWrite$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeySetBinary$qqrp6HKEY__x20System@UnicodeStringpxvi

@Kol@RegKeySetDateTime$qqrp6HKEY__x20System@UnicodeString16System@TDateTime

@Kol@RegKeySetDw$qqrp6HKEY__x20System@UnicodeStringui

@Kol@RegKeySetStr$qqrp6HKEY__x20System@UnicodeStringt2

@Kol@RegKeySetStrEx$qqrp6HKEY__x20System@UnicodeStringt2o

@Kol@RegKeyValExists$qqrp6HKEY__x20System@UnicodeString

@Kol@RegKeyValueSize$qqrp6HKEY__x20System@UnicodeString

@Kol@ShowMsg$qqrx20System@UnicodeStringui

@Kol@StrIn$qqrx27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi

@Kol@StrIs$qqrx27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xiri

@Kol@SupportAnsiMnemonics$qqri

@Kol@SystemTime2Str$qqrrx11_SYSTEMTIMExuix47System@%Set$t19Kol@TTimeFormatFlag$iuc$0$iuc$3%pxb

@Kol@TColorDialog@Execute$qqrv

@Kol@TControl@AttachProc$qqrpqqrp12Kol@TControlr8Kol@TMsgri$o

@Kol@TControl@AttachProcEx$qqrpqqrp12Kol@TControlr8Kol@TMsgri$oo

@Kol@TControl@CallDefWndProc$qqrr8Kol@TMsg

@Kol@TControl@CreateChildWindows$qqrv

@Kol@TControl@DefaultBtnProc$qqrr8Kol@TMsgri

@Kol@TControl@DetachProc$qqrpqqrp12Kol@TControlr8Kol@TMsgri$o

@Kol@TControl@FormCreateParameters$qqrp65System@%StaticArray$pqqrp12Kol@TControl$p12Kol@TControli$i65536$%pc

@Kol@TControl@FormExecuteCommands$qqrp12Kol@TControlp31System@%StaticArray$si$i65536$%

@Kol@TControl@GetKeyPreview$qqrv

@Kol@TControl@GetWindowState$qqrv

@Kol@TControl@Get_OnKeyDown$qqrv

@Kol@TControl@Get_OnKeyUp$qqrv

@Kol@TControl@GraphButtonKeyboardProcess$qqrr8Kol@TMsgri

@Kol@TControl@GraphicButtonMouse$qqrr8Kol@TMsg

@Kol@TControl@GraphicCheckBoxMouse$qqrr8Kol@TMsg

@Kol@TControl@GraphicEditMouse$qqrr8Kol@TMsg

@Kol@TControl@IsProcAttached$qqrpqqrp12Kol@TControlr8Kol@TMsgri$o

@Kol@TControl@LVAdd$qqrx20System@UnicodeStringi51System@%Set$t23Kol@TListViewItemStates$iuc$0$iuc$3%iiui

@Kol@TControl@LVInsert$qqrix20System@UnicodeStringi51System@%Set$t23Kol@TListViewItemStates$iuc$0$iuc$3%iiui

@Kol@TControl@LVSetItem$qqriix20System@UnicodeStringi51System@%Set$t23Kol@TListViewItemStates$iuc$0$iuc$3%iiui

@Kol@TControl@LVSetItemState$qqrix51System@%Set$t23Kol@TListViewItemStates$iuc$0$iuc$3%

@Kol@TControl@Postmsg$qqsuiii

@Kol@TControl@REGetAutoURLDetect$qqrv

@Kol@TControl@REGetOnURL$qqrxi

@Kol@TControl@REGetTextSize$qqr46System@%Set$t18Kol@TRichTextSizes$iuc$0$iuc$3%

@Kol@TControl@RESetAutoURLDetect$qqrxo

@Kol@TControl@RESetOnURL$qqrxixynpqqrp8Kol@TObj$v

@Kol@TControl@SetKeyPreview$qqrxo

@Kol@TControl@SetLVOptions$qqrx48System@%Set$t19Kol@TListViewOption$iuc$0$iuc$25%

@Kol@TControl@SetOnDrawItem$qqrxynpqqrp8Kol@TObjp5HDC__rx11Types@TRecti44System@%Set$t16Kol@TDrawActions$iuc$0$iuc$2DSystem@%Set$t15Kol@TDrawStates$iuc$0$iuc$14%$o

@Kol@TControl@SetOnKeyDown$qqrxynpqqrp12Kol@TControlriui$v

@Kol@TControl@SetOnKeyUp$qqrxynpqqrp12Kol@TControlriui$v

@Kol@TControl@SetOnLVCustomDraw$qqrxynpqqrp12Kol@TControlp5HDC__uiiirx11Types@TRect44System@%Set$t15Kol@TDrawStates$iuc$0$iuc$14%rit8$ui

@Kol@TControl@SetOnRE_OverURL$qqrxynpqqrp8Kol@TObj$v

@Kol@TControl@SetOnRE_URLClick$qqrxynpqqrp8Kol@TObj$v

@Kol@TControl@SetWindowState$qqr16Kol@TWindowState

@Kol@TControl@Set_OnMessage$qqrxynpqqrr8Kol@TMsgri$o

@Kol@TControl@SupportMnemonics$qqrv

@Kol@TControl@WndProc$qqrr8Kol@TMsg

@Kol@TGraphicTool@GetPenJoin$qqrv

@Kol@TGraphicTool@SetFontStyle$qqrx43System@%Set$t15Kol@TFontStyles$iuc$0$iuc$3%

@Kol@TGraphicTool@SetPenJoin$qqrx12Kol@TPenJoin

@Kol@TIcon@LoadFromExecutable$qqrx20System@UnicodeStringi

@Kol@TIniFile@ClearKey$qqrx20System@UnicodeString

@Kol@TMenu@AddItem$qqrpbynpqqrp9Kol@TMenui$v43System@%Set$t15Kol@TMenuOption$iuc$0$iuc$9%

@Kol@TMenu@Insert$qqripbynpqqrp9Kol@TMenui$v43System@%Set$t15Kol@TMenuOption$iuc$0$iuc$9%

@Kol@TMenu@InsertItem$qqripbynpqqrp9Kol@TMenui$v43System@%Set$t15Kol@TMenuOption$iuc$0$iuc$9%

@Kol@TMenu@InsertItemEx$qqripbynpqqrp9Kol@TMenui$v43System@%Set$t15Kol@TMenuOption$iuc$0$iuc$9%o

@Kol@TMenu@SetOnDrawItem$qqrxynpqqrp8Kol@TObjp5HDC__rx11Types@TRecti44System@%Set$t16Kol@TDrawActions$iuc$0$iuc$2DSystem@%Set$t15Kol@TDrawStates$iuc$0$iuc$14%$o

@Kol@TOpenDirDialog@Execute$qqrv

@Kol@TOpenSaveDialog@Execute$qqrv

@Kol@TStrList@Join$qqrx27System@%AnsiStringT$us$i0$%

@Kol@TStrListEx@AddObject$qqrx27System@%AnsiStringT$us$i0$%ui

@Kol@TStrListEx@InsertObject$qqrix27System@%AnsiStringT$us$i0$%ui

@Kol@TThread@Execute$qqrv

@Kol@TerminateExecution$qqrrp12Kol@TControl

@Kol@ToolbarsIDcmd

@Kol@WindowsLogoff$qqro

@Kol@WindowsShutdown$qqrx20System@UnicodeStringoo

@Kol@WndProcAppAsm$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcCtrl$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcDoEraseBkgnd$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcDummy$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcKeybd$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcMenu$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcMouse$qqrp12Kol@TControlr8Kol@TMsgri

@Kol@WndProcUnicodeChars$qqrp12Kol@TControlr8Kol@TMsgri

@Kolgdipv2@GdiplusShutdown

@Kolgdipv2@NewGPFont$qqrix20System@UnicodeString43System@%Set$t15Kol@TFontStyles$iuc$0$iuc$3%

@Kolgdipv2@NewGPImageS$qqrx34System@ÃžlphiInterface$t7IStream%o

@Kolgdipv2@NewGPStringFormat$qqr62System@%Set$t33Kolgdipv2@TGPStringFormatBitFlags$iuc$0$iuc$14%

@Kolgdipv2@SaveGPImageS$qqrpx18Kolgdipv2@TGPImagex34System@ÃžlphiInterface$t7IStream%x29Kolgdipv2@TGdiPlusImageFormat

@Kolgdipv2@TGPImageAttributes@SetColorKey$qqrpxuixi31Kolgdipv2@TGPColorRemapCategory

@Kolgdipv2@TGPPen@GetLineJoin$qqrv

@Kolgdipv2@TGPPen@SetLineJoin$qqr24Kolgdipv2@TGPPenLineJoin

@Kolgdipv2@TGPStringFormat@SetFormatFlags$qqr62System@%Set$t33Kolgdipv2@TGPStringFormatBitFlags$iuc$0$iuc$14%

@Kolgdipv2@TKOLStreamAdapter@Clone$qqsr34System@ÃžlphiInterface$t7IStream%

@Kolgdipv2@TKOLStreamAdapter@CopyTo$qqs34System@ÃžlphiInterface$t7IStream%jrjt3

@Kolhttpdownload@DecodeURL$qqrx27System@%AnsiStringT$us$i0$%

@Kolhttpdownload@EncodeURI$qqrx20System@UnicodeString

@Kolhttpdownload@EncodeURL$qqrx20System@UnicodeString

@Kolhttpdownload@EvHandler

@Kolhttpdownload@FileSpecialChar

@Kolhttpdownload@Finalization$qqrv

@Kolhttpdownload@GetMimeTypeExtension$qqr20System@UnicodeString

@Kolhttpdownload@GetMimeTypeFromData$qqr20System@UnicodeStringp11Kol@TStream

@Kolhttpdownload@GetURLFileName$qqrp29Kolhttpdownload@THTTPDownload20System@UnicodeStringt2

@Kolhttpdownload@GetWinInetError$qqrui

@Kolhttpdownload@HttpGetText$qqrpx29Kolhttpdownload@THTTPDownloadx20System@UnicodeStringp12Kol@TStrList20System@UnicodeString27System@%AnsiStringT$us$i0$%

@Kolhttpdownload@HttpGetText$qqrx20System@UnicodeStringp12Kol@TStrList20System@UnicodeString27System@%AnsiStringT$us$i0$%

@Kolhttpdownload@Internet_Options

@Kolhttpdownload@NewDownloadWorker$qqrp29Kolhttpdownload@THTTPDownload

@Kolhttpdownload@NewHTTPDownload$qqrv

@Kolhttpdownload@ParseURL$qqrx20System@UnicodeStringr20System@UnicodeStringt2t2t2t2t2

@Kolhttpdownload@TDownloadWorker@

@Kolhttpdownload@TDownloadWorker@$bdtr$qqrv

@Kolhttpdownload@TDownloadWorker@On_DownloadExecute$qqrp11Kol@TThread

@Kolhttpdownload@TDownloadWorker@On_UpdateProgress$qqrv

@Kolhttpdownload@TDownloadWorker@On_WatchExecute$qqrp11Kol@TThread

@Kolhttpdownload@TDownloadWorker@StartDownload$qqrv

@Kolhttpdownload@TDownloadWorker@StopDownload$qqrv

@Kolhttpdownload@TEventHandlers@

@Kolhttpdownload@TEventHandlers@onDownload$qqrp29Kolhttpdownload@THTTPDownloadp11Kol@TStream

@Kolhttpdownload@TEventHandlers@onError$qqrp29Kolhttpdownload@THTTPDownloadus

@Kolhttpdownload@THTTPDownload@

@Kolhttpdownload@THTTPDownload@$bdtr$qqrv

@Kolhttpdownload@THTTPDownload@CancelDownload$qqrv

@Kolhttpdownload@THTTPDownload@CheckConnection$qqr20System@UnicodeString

@Kolhttpdownload@THTTPDownload@FormField$qqr20System@UnicodeStringt1

@Kolhttpdownload@THTTPDownload@FormFieldsClear$qqrv

@Kolhttpdownload@THTTPDownload@GetResource$qqr20System@UnicodeString

@Kolhttpdownload@THTTPDownload@ParseHeaders$qqrrp27Kolhttpdownload@THTTPHeader

@Kolhttpdownload@THTTPDownload@SetAuthInfo$qqr20System@UnicodeStringt1

@Kolhttpdownload@THTTPDownload@SetCustomHeaders$qqrp12Kol@TStrList

@Kolhttpdownload@THTTPDownload@SetDataStream$qqrp11Kol@TStream

@Kolhttpdownload@THTTPDownload@SetProxySettings$qqr20System@UnicodeStringi

@Kolhttpdownload@THTTPDownload@fOnErrorCall$qqrp29Kolhttpdownload@THTTPDownloadp11Kol@TThreadus

@Kolhttpdownload@URISpecialChar

@Kolhttpdownload@URLSpecialChar

@Kolhttpdownload@WaitUntilTrue$qqroi

@Kolhttpdownload@initialization$qqrv

@Spstdctrls@TSPCustomLabel@CMDialogChar$qqrr15Messages@TWMKey

@Spstdctrls@TSPCustomLabel@Notification$qqrp18Classes@TComponent18Classes@TOperation

@TSPImageScroll@GetProportionall$qp17Graphics@TPicturei

@TSPImageScroll@MouseDown$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@TSPImageScroll@MouseMove$qqrp14System@TObject46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@TSPImageScroll@MouseUp$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@TWMActionGTASettings@GetKeyCount$q20System@UnicodeStringt1

@TWMCustomHeaderData@rlblWebC$qqrv

@TWMCustomHeaderData@rlblWebT$qqrv

@TWMCustomHeaderData@wlblWebC$qqrp15Stdctrls@TLabel

@TWMCustomHeaderData@wlblWebT$qqrp15Stdctrls@TLabel

@TWMDialogReplaseModel@Execute$qqrv

@TWMDownloader@SetURL$qqr20System@UnicodeString

@TWMSkinManager@SetRect$q31System@%AnsiStringT$us$i65001$System@Variant

@Tspadvancedinifiles@TSPCustomIniFile@DeleteKey$qqrx20System@UnicodeStringt1

@Tspadvancedinifiles@TSPIniFile@DeleteKey$qqrx20System@UnicodeStringt1

@Tspadvancedinifiles@TSPMemIniFile@DeleteKey$qqrx20System@UnicodeStringt1

@Tspadvancedinifiles@TSPMemIniFile@WriteKeyList$qqrx20System@UnicodeStringp16Classes@TStrings

@Utils@ExecWin$qqr20System@UnicodeStringt1t1oi

@Utils@KeySendProcess

@Utils@MsgBox2$qqrx20System@UnicodeStringuii20System@UnicodeString

@Utils@TClassObj@senderkeynder$qqrv

@Utils@isShiftDown$qqrv

@WTSPCheckBox@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPCheckSlider@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPCheckSlider@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPCheckSlider@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPImageButton@myMouseDown$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPImageButton@myMouseUp$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPLabelButton@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPLabelButton@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPPageGraphicControl@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPPageGraphicControl@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPSlider@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPSlider@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPSlider@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPStechButton@MouseDown$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPStechButton@MouseUp$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$8%ii

@WTSPStechButton@rLeftPartButton$qqrv

@WTSPStechButton@rLeftPartButtonMouse$qqrv

@WTSPStechButton@wLeftPartButton$qqrp17Graphics@TPicture

@WTSPStechButton@wLeftPartButtonMouse$qqrp17Graphics@TPicture

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

LeftPartButton.Data

CenterPartButton.Data

"iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

LeftPartButtonMouse.Data

CenterPartButtonMouse.Data

Font.Quality

" id="W5M0MpCehiHzreSzNTczkc9d"?>

RightPartButton.Data

RightPartButtonMouse.Data

Picture.Data

" id="W5M0MpCehiHzreSzNTczkc9d"?> K

[y%xY

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

"Request.ContentRangeInstanceLength

Request.Accept

Request.BasicAuthentication

Request.UserAgent

&Mozilla/3.0 (compatible; Indy Library)

Request.Ranges.Units

Request.Ranges

HTTPOptions

DefaultPort

SSLOptions.Mode

SSLOptions.VerifyMode

SSLOptions.VerifyDepth

" id="W5M0MpCehiHzreSzNTczkc9d"?> Utw

.ffP F

kEY{V

(.qA/

%U`5H

`.sg:ON

`.Ã¿/

Font.Pitch

sputnik.ru

" id="W5M0MpCehiHzreSzNTczkc9d"?> [>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

fiTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

keq.eXd

%F`:V1

S3~%fP

U.LmwV1

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.ikJOt2

3Y.YR

.Ex-S[

worldofmods.com

BackgroundImage.Data

lblWebCaption

lblWebText

VVV.gamemodding.net

CaptionList.Strings

Diese Modifikation ist nicht von Moderatoren der Website GameModding.net durchgepruft. Sicherheit und Leistungsfahigkeit der Modifikationen kann nicht garantiert werden!

Margins.Left

Margins.Top

Margins.Right

Margins.Bottom

Font.Orientation

LangList.Strings

?5=This modification was downloaded from GameModding.net website

11=hXXp://vk.com/gamemoddingnet

&12=hXXps://twitter.com/GameModdingNet

'13=hXXp://VVV.facebook.com/gamemodding

114=hXXp://VVV.youtube.com/user/GameModdingPreview

GameModding.net

214=hXXp://VVV.youtube.com/user/GameModdingPreview

G5=Cette modification a ete telewchar_tge depuis le site GameModding.net

J5=Diese Modifikation wurde von der Website GameModding.net heruntergeladen

c:\builds\222\152932-test-create-2-gtav.exe

LanguageList.Strings

GameModding.net

GameModding.net.

VVV.GameModding.net

LangImage.Data

3=Web Site to Autor:

"8=Add GameModding.net to Favorites

19=Place a GameModding.net shortcut on the desktop

17=This modification is not checked by GameModding.net moderators. Usability and safety of the modification cannot be guaranteed!

"All Programs" in VVV.GameModding.net folder

C37=Visit us again! We will be glad to see you again on our website!

*8=GameModding.net zu Favoriten hinzufuegen

59=GameModding.net Verknuepfung auf dem desktop setzen

17= Diese Modifikation ist nicht von Moderatoren der Website GameModding.net durchgepruft. Sicherheit und Leistungsfahigkeit der Modifikationen kann nicht garantiert werden!

"Alle Programme"- im Ordner VVV.GameModding.net

n37=Kommen Sie und sehen uns wieder! Wir hoffen Sie kommen uns bald einmal auf unserer Website wieder besuchen.

/8=Ajouter worldofmods.com dans le marque-pages

49=Envoyer le raccourci sur le bureau worldofmods.com

rateur du site GameModding.net. La s

\5=hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-cleo-scripts/8940-skin-selector-v21.html

frmRPM.WTSPPageGraphicControl1

W1=With the IMGTool 1.3 program import files from the folder %dir% into the archive -

o4=You can download IMGTool 1.3 hXXp://VVV.gamemodding.net/gta-vice-city/gta-vc-programms/830-img-tool-13.html

6=Import into IMG

(7=Importing files into the game archive:

,12=Unable to complete import in IMG archive!

15=Importing file Into IMG:

17=To import to

B18=Files from the folder %dir% to be imported into the archive -

%dir%

: hXXp://VVV.gamemodding.net/gta-vice-city/gta-vc-programms/830-img-tool-13.html

%dir%

d1=Mit dem Programm IMGTool 1.3 importieren Sie Dateien aus dem Ordner %dir% Datei(en) in das Archiv

}4=Die Download-Link fuer IMGTool 1.3 ist hier: hXXp://VVV.gamemodding.net/gta-vice-city/gta-vc-programms/830-img-tool-13.html

6=Import in IMG

.7=Importieren von Dateien in das Spiel-Archiv:

B12=Der Import in das IMG Archiv kann nicht vervollstandigt werden!

15=Importieren Datei in IMG:

316=Beim Import der Datei ist ein Fehler aufgetreten

17=Import in

.18=Dateien aus dem Ordner %dir% in das Archiv

k1=With the IMGTool 2.0 or Crazy IMG Editor program import files from the folder %dir% into the archive -

t4=You can download IMGTool 2.0 here: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/829-imgtool-20.html

5=Crazy IMG Editor here: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/828-gta-san-andreas-crazy-img-editor.html

]17=hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-cleo-scripts/8940-skin-selector-v21.html

19=Importing file Into IMG:

21=To import to

B22=Files from the folder %dir% to be imported into the archive -

: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/829-imgtool-20.html

: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/828-gta-san-andreas-crazy-img-editor.html

z1=Mit dem Programm IMGTool 2.0 oder Crazy IMG Editor importieren Sie Dateien aus dem Ordner %dir% Datei(en) in das Archiv

~4=Die Download-Link fuer IMGTool 2.0 ist hier: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/829-imgtool-20.html

~5=Crazy IMG Editor hier: hXXp://VVV.gamemodding.net/gta-san-andreas/gta-sa-programms/828-gta-san-andreas-crazy-img-editor.html

19=Importieren Datei in IMG:

620=Beim Import der Datei ist ein Fehler aufgetreten:

21=Import in

.22=Dateien aus dem Ordner %dir% in das Archiv

^1=With the SparkIV or OpenIV program import files from the folder %dir% into the archive -

!3=to be imported into the archive

^4=You can download SparkIV hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/832-sparkiv.html

S5=Crazy OpenIV: hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/831-openiv.html

(12=Unable to complete import in archive!

16=Importing file Into IMG:

17=Importing file Into RPF:

19=To import to

B20=Files from the folder %dir% to be imported into the archive -

: hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/832-sparkiv.html

: hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/831-openiv.html

n1=Mit dem Programm SparkIV oder OpenIV importieren Sie Dateien aus dem Ordner %dir% Datei(en) in das Archiv

o4=Die Download-Link fuer SparkIV ist hier: hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/832-sparkiv.html

R5=OpenIV hier: hXXp://VVV.gamemodding.net/gta-iv/gta-iv-programms/831-openiv.html

12=Der Import in das Archiv kann nicht vervollst

16=Importieren Datei in IMG:

17=Importieren Datei in RPF:

618=Beim Import der Datei ist ein Fehler aufgetreten:

19=Import in

.20=Dateien aus dem Ordner %dir% in das Archiv

#1=Replacement options for transport

)1=Replacement-Optionen fuer den Transport

LabelFontDisable.Charset

LabelFontDisable.Color

LabelFontDisable.Height

LabelFontDisable.Name

LabelFontDisable.Style

PictureLabel.Data

FontLabels.Charset

FontLabels.Color

FontLabels.Height

FontLabels.Name

FontLabels.Style

Langs.Strings

SkinImage.Data

Paint.NET v3.22

%5UUUM

$A{.fR

CreatePipe

GetCPInfo

GetCPInfoExW

GetProcessHeap

GetWindowsDirectoryW

RegCloseKey

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyExW

RegFlushKey

RegLoadKeyW

RegOpenKeyExW

RegQueryInfoKeyW

RegReplaceKeyW

RegRestoreKeyW

RegSaveKeyW

RegUnLoadKeyW

SetViewportOrgEx

GdipSetPenLineJoin

GdipSetImageAttributesColorKeys

GdipGetPenLineJoin

SHFileOperationW

ShellExecuteA

ShellExecuteExW

ShellExecuteW

ActivateKeyboardLayout

EnumChildWindows

EnumThreadWindows

EnumWindows

ExitWindowsEx

GetAsyncKeyState

GetKeyNameTextW

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardLayoutNameW

GetKeyboardState

LoadKeyboardLayoutW

MapVirtualKeyW

MsgWaitForMultipleObjects

MsgWaitForMultipleObjectsEx

SetWindowsHookExW

UnhookWindowsHookEx

VkKeyScanExW

keybd_event

HttpAddRequestHeadersW

HttpOpenRequestW

HttpQueryInfoA

HttpQueryInfoW

HttpSendRequestW

InternetOpenUrlW

.text

`.data

.rdata

P.idata

@.didata

.edata

@.rsrc

@.reloc

Sl%CjI

?W[%C

UrlA

ADVAPI32.DLL

COMCTL32.DLL

COMDLG32.DLL

GDI32.DLL

GDIPLUS.DLL

MSIMG32.DLL

OLE32.DLL

OLEAUT32.DLL

SHFOLDER.DLL

SHLWAPI.DLL

URLMON.DLL

VERSION.DLL

WININET.DLL

WINMM.DLL

WINSPOOL.DRV

\\?\UNC\

uxtheme.dll

comctl32.dll

TaskDialogIndirect

%s[%d]

%s_%d

.Owner

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

%s%s%.2d:%.2d

%s%s%.2d

%d.%d

%s, ProgID: "%s"

ole32.dll

oleaut32.dll

%s-%s

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

olepro32.dll

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

%s%s%s%s%s%s%s%s%s%s

crSQLWait

%s (%s)

imm32.dll

Portable Network Graphics

data.ini

*#%"{}|\^[]`

HTTPS

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key

RSA_check_key

RSA_generate_key_ex

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

1993 - 2009

Content-Disposition: form-data; name="%s"

; filename="%s"

Content-Type: %s

; charset="%s"

Content-Transfer-Encoding: %s

WINDOWS

X-HTTP-Method-Override

Mozilla/3.0 (compatible; Indy Library)

%d-%d

application/x-www-form-urlencoded

https

HTTP/1.0 200 OK

HTTP/

.nml=animation/narrative

.aac=audio/mp4

.aif=audio/x-aiff

.aifc=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.gsm=audio/x-gsm

.kar=audio/midi

.m3u=audio/mpegurl

.mid=audio/midi

.midi=audio/midi

.mpega=audio/x-mpg

.mp2=audio/x-mpg

.mp3=audio/x-mpg

.mpga=audio/x-mpg

.m3u=audio/x-mpegurl

.pls=audio/x-scpls

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ram=audio/x-pn-realaudio

.rm=audio/x-pn-realaudio

.sd2=audio/x-sd2

.sid=audio/prs.sid

.snd=audio/basic

.wav=audio/x-wav

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.art=image/x-jg

.bmp=image/bmp

.cdr=image/x-coreldraw

.cdt=image/x-coreldrawtemplate

.cpt=image/x-corelphotopaint

.djv=image/vnd.djvu

.djvu=image/vnd.djvu

.gif=image/gif

.ief=image/ief

.ico=image/x-icon

.jng=image/x-jng

.jpg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.pat=image/x-coreldrawpattern

.pcx=image/pcx

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pict=image/x-pict

.png=image/x-png

.pnm=image/x-portable-anymap

.pntg=image/x-macpaint

.ppm=image/x-portable-pixmap

.psd=image/x-psd

.qtif=image/x-quicktime

.ras=image/x-cmu-raster

.rf=image/vnd.rn-realflash

.rgb=image/x-rgb

.rp=image/vnd.rn-realpix

.sgi=image/x-sgi

.svg=image/svg-xml

.svgz=image/svg-xml

.targa=image/x-targa

.tif=image/x-tiff

.wbmp=image/vnd.wap.wbmp

.xbm=image/xbm

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xml=text/xml

.uls=text/iuls

.txt=text/plain

.rtx=text/richtext

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htc=text/x-component

.vcf=text/x-vcard

.asf=video/x-ms-asf

.asx=video/x-ms-asf

.avi=video/x-msvideo

.dl=video/dl

.dv=video/dv

.flc=video/flc

.fli=video/fli

.gl=video/gl

.lsf=video/x-la-asf

.lsx=video/x-la-asf

.mng=video/x-mng

.mp2=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.moov=video/quicktime

.mov=video/quicktime

.mxu=video/vnd.mpegurl

.qt=video/quicktime

.qtc=video/x-qtc

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.abw=application/x-abiword

.ace=application/x-ace-compressed

.ai=application/postscript

.alz=application/x-alz-compressed

.ani=application/x-navi-animation

.arj=application/x-arj

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.boz=application/x-bzip2

.bz=application/x-bzip

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.cco=application/x-cocoa

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.com=application/x-msdos-program

.clp=application/x-msclip

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crl=application/pkix-crl

.csh=application/x-csh

.dar=application/x-dar

.dbf=application/x-dbase

.dcr=application/x-director

.deb=application/x-debian-package

.dir=application/x-director

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.doc=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dxr=application/x-director

.ebk=application/x-expandedbook

.eps=application/postscript

.evy=application/envoy

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fif=application/fractals

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.gzip=application/x-gzip

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gz=application/x-gzip

.hdf=application/x-hdf

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hta=application/hta

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.iii=application/x-iphone

.iso=application/x-iso9660-image

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.lha=application/x-lzh

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lz=application/x-lzip

.lzh=application/x-lzh

.lzma=application/x-lzma

.lzo=application/x-lzop

.lzx=application/x-lzx

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.man=application/x-troff-man

.mdb=application/x-msaccess

.me=application/x-troff-me

.ms=application/x-troff-ms

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rss=application/rss xml

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.sh=application/x-sh

.shar=application/x-shar

.shw=application/presentations

.sit=application/x-stuffit

.sitx=application/x-stuffitx

.skd=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smi=application/smil

.smil=application/smil

.spl=application/futuresplash

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf1=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tcl=application/x-tcl

.tex=application/x-tex

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.tbz=application/x-bzip-compressed-tar

.tbz2=application/x-bzip-compressed-tar

.tgz=application/x-compressed-tar

.tlz=application/x-lzma-compressed-tar

.tr=application/x-troff

.trm=application/x-msterminal

.troff=application/x-troff

.tsp=application/dsptype

.torrent=application/x-bittorrent

.ttz=application/t-time

.txz=application/x-xz-compressed-tar

.udeb=application/x-debian-package

.uin=application/x-icq

.urls=application/x-url-list

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.asm=text/x-asm

.pas=text/x-pascal

.cs=text/x-csharp

.cpp=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.java=text/x-java

.css=text/css

.js=text/javascript

.htm=text/html

.html=text/html

.ls=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.sgm=text/sgml

.sgml=text/sgml

HTTP-EQUIV

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?={}

.local

HttpOnly

HTTPONLY

$Port

COMMENTURL

PORT

()[]:;.,@\"

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

secur32.dll

security.dll

0.0.0.1

0.0.0.0

255.255.255.255

Wship6.dll

Fwpuclnt.dll

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Kernel32.dll

127.0.0.1

%s, %.2d %s %.4d %s %s

%s, %.2d-%s-%.2d %s %s

10.5.7

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

psapi.dll

base_url

windows

log.txt

api_url

api_key

resource_url

Load image HTTP error #

merge_keys

API key:

vendor_logo_url

appended_keys

append_keys

http_error

default_keys

_fail_exec

api.get_stat(

Result of api.get_stat:

targeturl

target_content.dat

Target content url:

hXXps://ssl.google-analytics.com/collect

hXXp://VVV.google-analytics.com/collect

ds=web

dl=hXXp://vpn-ping.ru/

Exception %s in module %s at %p.

Operation aborted

I/O error %d

Invalid pointer operation

Invalid floating point operation

Access violation at address %p. %s of address %p

External exception %x

Interface not supported

%s (%s, line %d)

Access violation at address %p in module '%s'. %s of address %p

D:\Dev\coin32\desktop-downstaller\desktop-libraries\kol_libs\err.pas

Win32 Error. Code: %d.

.manifest

2000/1/1

dd.MM.yyyy

DumpWindowed.txt

HHCTRL.OCX

GdiPlus.dll

GdiplusShutdown

.html

default.html

wininet.dll

Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)

http=

Content-Type: application/x-www-form-urlencoded

Balanced tree root node level is %d

Shell32.dll

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

D:\Dev\coin32\desktop-downstaller\downstaler\libs\Utils.pas

Certificats table file offset: $

Certificats table size:

Certificats table real size:

%s Pb

%s Tb

%s Gb

%s Mb

%s Kb

%d.%d.%d

mail.ru

@Mail.Ru

search_url

startup_urls

urls_to_restore_on_startup

opera

Opera Software\

icudt.dll

Opera\Opera\

operaprefs.ini

search.ini

Home URL

firefox

Mozilla\Firefox\

profiles.ini

prefs.js

browser.search.selectedEngine

browser.startup.homepage

Software\Microsoft\Windows\CurrentVersion\Uninstall\

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

WbemScripting.SWbemLocator

Select %s from %s

hXXp://VVV.gamemodding.net/?from=inst_link

hXXp://VVV.gamemodding.net/ru/toolbar.html

hXXp://VVV.gamemodding.net/en/toolbar.html

hXXp://VVV.gamemodding.net/feedback/

hXXp://VVV.gamemodding.net/forum/index.php

hXXp://VVV.gamemodding.net/?from=inst_logo

hXXp://VVV.facebook.com/gamemodding

hXXp://vk.com/gamemoddingnet

hXXp://VVV.youtube.com/user/GameModdingPreview

hXXps://twitter.com/GameModdingNet

hXXps://plus.google.com/communities/107466553082411818715

hXXp://ok.ru/group/52311790387354

8\\\?\

r\\?\

L==\\?\

\0 1 2 0 1 2

e\\?\

MafiaIIMaterialsMerger.exe

HTTP/1.1

KUTF8: A start byte not followed by enough continuation bytes in position %s

%s is not a valid BCD value$Could not parse SQL TimeStamp string

Invalid SQL date/time values

1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

End of stream: Class %s at ÃšUTF8: Type cannot be determined out of header byte at position %sDUTF8: An unexpected continuation byte in %s-byte UTF8 in position %s

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Reply Code is not valid: %s

Reply Code already exists: %s4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

Object type not supported.

Unsupported operation./Could not encode header data using charset "%s")UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

Handshake DonepUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

KUnsupported hash algorithm. This implementation supports only MD5 encoding.

The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

IOHandler value is not valid'Algorithm %s not permitted in FIPS mode

Unknown Protocol(Request method requires HTTP version 1.1

'Object type not supported for operation

Unsupported PixelFormat

Invalid stream operation

Invalid extension introducerÃºiled to allocate memory for GIF DIB

Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.

Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.

Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels.

.There is no default printer currently selected/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d."PageControl must first be assigned"%s requires Windows Vista or later %s requires themes to be enabled

Button%d

RadioButton%d

Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d

Value must be between %d and %d

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard: %s

Text exceeds memo capacity Operation not supported on selected printer

%s property out of range

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap

Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Scan line index out of range!Cannot change the size of an iconÃŠnnot change the size of a WIC Image

(Monitor support function not initialized

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Integer overflow Invalid floating point operation

Invalid class typecast0Access violation at address %p. %s of address %p

No help found for %s

Duplicates not allowed('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value

WThe given "%s" local time is invalid (situated within the missing period prior to DST).$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

Invalid Timeout value: %s

''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value

''%s'' is not a valid time

No help found for context %d

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

The specified path is too long The specified path was not found The path format is not supported The specified file was not found

List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

Invalid property type: %s

Invalid data type for '%s'

OLE error %.8x#Object factory for class %s missing%Type information missing for class %s'Incorrect type information for class %s(Dispatch interface missing from class %s.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

VVV.GameModding.net

3.1.0.0

1.0.0.0

%original file name%.exe_3648_rwx_00401000_003DE000: