Trojan.GenericKD.3113209_5d3b18b98c – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

iexplorer.exe:656
iexplorer.exe:220
%original file name%.exe:576

The Trojan injects its code into the following process(es):

xDedicRDPPatch.exe:244
iexplore.exe:636
Explorer.EXE:932

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process iexplorer.exe:656 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\.Sys\explorer.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)

The process %original file name%.exe:576 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xDedicRDPPatch.exe (42619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iexplorer.exe (25421 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)

Registry activity

The process iexplorer.exe:656 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C AB 2F 44 F5 12 78 CB 36 01 FD 8F D9 AD 7A 2C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "%System%\.Sys\explorer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "%System%\.Sys\explorer.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{U57VP3KB-I2OB-82G5-D3J2-13SBCDAJ14TJ}]
"StubPath" = "%System%\.Sys\explorer.exe Restart"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%System%\.Sys\explorer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%System%\.Sys\explorer.exe"

The process iexplorer.exe:220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 93 2D 4F B2 CB D0 D4 80 B4 8A FF 03 4E 16 74"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process xDedicRDPPatch.exe:244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 6E 9E 74 3A E0 F8 A0 DA 46 98 4B F1 2F A3 17"

The process %original file name%.exe:576 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB FC 32 34 B7 0B BF CA B2 11 45 9C 59 4A 1C D7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"iexplorer.exe" = "BrowserE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"xDedicRDPPatch.exe" = "xDedicRDPPatch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
67bbb20d645a2d0465deb3c58cd5d0b6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\iexplorer.exe
fc5395ca900071976ca2c891b439fe7b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\xDedicRDPPatch.exe
67bbb20d645a2d0465deb3c58cd5d0b6	c:\WINDOWS\system32\.Sys\explorer.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
iexplorer.exe:656
iexplorer.exe:220
%original file name%.exe:576
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%System%\.Sys\explorer.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xDedicRDPPatch.exe (42619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iexplorer.exe (25421 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%System%\.Sys\explorer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%System%\.Sys\explorer.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23482	23552	4.48952	399636e1cf123faa9dc0c1c1ed9a4a52
.rdata	28672	4592	4608	3.65683	f359cd50555a06c1946c9624440c5811
.data	36864	155860	1024	3.57555	b6778f27be20a78cfc5e0496758eda32
.ndata	196608	32768	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	229376	5256	5632	1.56228	8b67ab87e2e99b7cc1c4eedb7ec49c26

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
m0ntecrist0.co.ve	85.204.74.145

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

xDedicRDPPatch.exe_244:

.text

`.itext

`.data

.idata

.didata

.edata

@.tls

.rdata

@.reloc

B.rsrc

.sdfr

.adata

TArray

System.Types

System.UITypes

TWindowState

poPortrait

ssHorizontal

biClrImportant

tagMSG

Winapi.Windows

HKEY

TWMKey

MsgFiller

KeyData

KeyDataFiller

!"#$%&'(!)* ,-./0'

System.SysUtils

ENoMonitorSupportException

ENoMonitorSupportExceptionx

TArray

TFormatSettings.TEraInfo

IEnumerable0!@

TArray

TMarshaller.PDisposeRecP

TMarshaller.TDisposeProc

TMarshaller.TDisposeRec

TMarshaller.IDisposer

TMarshaller.TDisposer'

TMarshaller.TDisposer

/TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

&TArray

System.Variants

Operator

System.Variants8&@

EVariantBadIndexError

Uhb%C

grfLocksSupported

Winapi.ActiveX

System.Generics.Defaults

IEqualityComparer

IComparer

TCustomComparer

TCustomComparer\

System.Generics.Collections

doOwnsKeys

System.Rtti

GetIndexedProperties

GetIndexedProperty

GetDeclaredIndexedProperties

TMethodImplementation.TFloatReg

):TMethodImplementation.TInterceptFrame.:1

%TMethodImplementation.TInterceptFrame(

*TMethodImplementation.TFirstStageIntercept

%TMethodImplementation.PInterceptFrame

*TMethodImplementation.PFirstStageIntercept

TMethodImplementation.TParamLoc

!TMethodImplementation.TInvokeInfoK

!TMethodImplementation.TInvokeInfop

TRttiIndexedPropertyS

TRttiIndexedProperty

FIndexedProps

TArray

-TFunc>

TArray

!TArray

(TArray

%TArray

TArray

3TArray

8TEnumerator(

8TEnumeratorh

8TEnumerable'

8TEnumerable

;TList.arrayofT

6IComparer

CTCollectionNotifyEvent

:TArrayManagerg

:TArrayManagerD

8IEnumerable0!@

=TList.TEmptyFunc

>TList.TEnumerator5

>TList.TEnumerator

2TList&

2TList|

"TArray

&TArray

-TPair

AKey

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>'

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

System.Generics.Collections0#D

!IEqualityComparer

&TCollectionNotifyEvent

/TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator$)D

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

TArray

$TEnumerator(

$TEnumerator|-D

$TEnumerable'

$TEnumerable

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator@0D

DTDictionary.TValueCollection;

DTDictionary.TValueCollection42D

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator\4D

FOnKeyNotify

FKeyCollection

3TDictionary9

ContainsKey

3TDictionaryL6D

Keysd3D

OnKeyNotify8%D

TArray

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>0

FTEnumerable>'

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

System.Generics.Collections$

IEqualityComparer

0TCollectionNotifyEvent

TArray

%TEnumerator(

%TEnumerator

%TEnumerable'

%TEnumerable(

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

Keys

OnKeyNotify

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>'

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

System.Generics.Collectionsx

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

#IComparer

%TComparison

#TComparer2

#TComparer

,TArray>

$TEnumerator(

$TEnumerator

$TEnumerable'

$TEnumerableH

'TList.arrayofT

"IComparer

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManagerH

$IEnumerable0!@

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumeratorT

TList&

TList

-TArray>

7TArray>

.TArray>

0TArray>

&TEnumerator(

&TEnumeratorL

&TEnumerable'

&TEnumerable

)TList.arrayofT

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerable0!@

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumerator

TList&

TListdEE

$TEnumerator(

$TEnumerator

$TEnumerable'

$TEnumerable|SE

'TList.arrayofT

"IComparer

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManagerxVE

$IEnumerable0!@

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumerator

TList&

TList8[E

5TArray>

#TEnumerator(

#TEnumeratordhE

#TEnumerable'

#TEnumerable

&TList.arrayofT

System.Generics.Collections\

!IComparer

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerable0!@

(TList.TEmptyFunc

)TList.TEnumerator5

)TList.TEnumerator

TList&

TListPqE

*TEnumerator(

*TEnumerator

*TEnumerable'

*TEnumerable

-TList.arrayofT

System.Generics.CollectionsX

(IComparer

5TCollectionNotifyEvent

,TArrayManagerg

,TArrayManager

*IEnumerable0!@

/TList.TEmptyFunc

0TList.TEnumerator5

0TList.TEnumerator4

$TList&

$TList

9TObjectDictionaryM

9TObjectDictionaryx

8TComparison

6TComparer2

6TComparerPJG

>TMoveArrayManagerg

>TMoveArrayManager0LG

D.TList`1.Pack$23$0$Intf

D@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

ITList>.arrayofT

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>0!@

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

TList.arrayofT

IComparer

TArrayManagerg

TArrayManager

IEnumerable0!@

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator

TList&

TList

'TList.arrayofT

System.Generics.CollectionsD

"IComparer

&TArrayManagerg

&TArrayManager

$IEnumerable0!@

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumerator

TList&

TList

List8%D

ITList>.arrayofT

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>0!@

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator8

@TList>&

@TList>0

(TList.arrayofT

System.Generics.CollectionspOH

#IComparer

'TArrayManagerg

'TArrayManager@

%IEnumerable0!@

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumeratorP

TList&

TList

TList.arrayofT

TArrayManagerg

TArrayManager4

TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TListp

ITList>.arrayofT

System.Generics.Collections,

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>l

FIEnumerable>0!@

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

,TDelegatedComparer8

,TDelegatedComparerD

$TComparison

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManagerh

0.TList`1.Pack$23$0$Intf

0@TList`1.Pack$23$ActRec

0@TList`1.Pack$23$ActRec|

{{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

&TComparison

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

2.TList`1.Pack$23$0$Intf

2@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

$TComparison

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

0.TList`1.Pack$23$0$Intf

0@TList`1.Pack$23$ActRec

{{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

#TComparison

!TComparer2

!TComparerx

)TMoveArrayManagerg

)TMoveArrayManager0

/.TList`1.Pack$23$0$Intf

/@TList`1.Pack$23$ActRec

y{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.Rtti\

*TComparison

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManagerx

6.TList`1.Pack$23$0$Intf

6@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.RttiX

?TDelegatedComparer8

?TDelegatedComparerd

FTComparison>

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

R.TList`1.Pack$23$0$Intf>

R@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

TComparison

TComparer2

TComparerx

!TMoveArrayManagerg

!TMoveArrayManager

'.TList`1.Pack$23$0$Intf

'@TList`1.Pack$23$ActRec

i{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

$TComparison

"TComparer2

"TComparerd

*TMoveArrayManagerg

*TMoveArrayManager

0.TList`1.Pack$23$0$Intf

0@TList`1.Pack$23$ActRec

0@TList`1.Pack$23$ActRec0

{{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.RttiD

FTComparison>

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

R.TList`1.Pack$23$0$Intf>

R@TList`1.Pack$23$ActRec>

R@TList`1.Pack$23$ActRec>4

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

%TComparison

#TComparer2

#TComparer0 H

TMoveArrayManagerg

TMoveArrayManager

1.TList`1.Pack$23$0$Intf

1@TList`1.Pack$23$ActRecP%H

1@TList`1.Pack$23$ActRec

}{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.RttipOH

TComparison

TComparer2

TComparerh'H

TMoveArrayManagerg

TMoveArrayManager

&.TList`1.Pack$23$0$Intf

&@TList`1.Pack$23$ActRec

g{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

FTComparison>

DTComparer>2

DTComparer>l.H

LTMoveArrayManager>g

LTMoveArrayManager>l0H

R.TList`1.Pack$23$0$Intf>

R@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

System.Rtti,

TDelegatedComparer8

TDelegatedComparer

-TDelegatedComparer8

-TDelegatedComparer

TDelegatedComparer8

TDelegatedComparerl9H

*TDelegatedComparer8

*TDelegatedComparer

1TDelegatedComparer8

1TDelegatedComparer

MTDelegatedComparer>8

MTDelegatedComparer>h>H

"TDelegatedComparer8

"TDelegatedComparerT@H

TDelegatedComparer8

TDelegatedComparer

MTDelegatedComparer>8

MTDelegatedComparer>

,TDelegatedComparer8

,TDelegatedComparerxEH

!TDelegatedComparer8

!TDelegatedComparer$GH

MTDelegatedComparer>8

MTDelegatedComparer>

System.TypInfo

mkOperatorOverload

PFieldExEntryDPH

TFieldExEntry

PVmtMethodExEntryHSH

TVmtMethodExEntry

$TArray

&TArray

TPropSetV

TPropSet

TPropSetV

TPropSet

TPropSetK

TPropSet

TPropSetK

TPropSet(

TPropSetK

TPropSet

TPropSetK

TPropSet

TPropSetK

TPropSetl

TPropSetV

TPropSetH

System.Classes

ssShift

htKeyword

EInvalidOperation

AOperator

TCollectionItemClassH

TThread.TSynchronizeRecord

TThread.TSystemTimes

GetCPUUsage

TOperation

TObservers.TCanObserveEvent

TObservers.TObserverAddedEvent

Operation

FOnExecute

OnExecute

TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

!TList.arrayofT

IComparer

)TCollectionNotifyEvent

TArrayManagerg

TArrayManager

IEnumerable0!@

#TList.TEmptyFunc

$TList.TEnumerator5

$TList.TEnumerator

TList&

TList@

TThreadList&

TThreadList@

&TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

.TList.arrayofT

System.Generics.CollectionsH

)IComparer

6TCollectionNotifyEvent

-TArrayManagerg

-TArrayManager

IEnumerable0!@

0TList.TEmptyFunc

1TList.TEnumerator5

1TList.TEnumerator

%TList&

%TList

TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable$

TList.arrayofT

IComparer

&TCollectionNotifyEvent

TArrayManagerg

TArrayManager

IEnumerable0!@

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator

TList&

TListx

!TArray

&TEnumerator(

&TEnumerator

&TEnumerable'

&TEnumerable

)TList.arrayofT

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerable0!@

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList

3TPair

JTArray>

OTEnumerator>(

OTEnumerator>

OTEnumerable>'

OTEnumerable>

?TDictionary.TItem

DTDictionary.TItemArray

!IEqualityComparer

&TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumeratorh

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollectiond

%TArray

*TEnumerator(

*TEnumerator

*TEnumerable'

*TEnumerable(

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator

JTDictionary.TValueCollection;

JTDictionary.TValueCollection

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumerator

9TDictionary9

9TDictionary

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable'

,TEnumerableD

/TList.arrayofT

*IComparer

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManagerl

,IEnumerable0!@

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList\

ELoginCredentialErrorT

ELoginCredentialError,

"TLoginCredentialService.TLoginFunc

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

3TLoginCredentialService.TLoginCredentialEventObject:

3TLoginCredentialService.TLoginCredentialEventObject

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxy

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialService

4TPair

KTArray>

PTEnumerator>(

PTEnumerator>

PTEnumerable>'

PTEnumerable> 1J

@TDictionary.TItem

ETDictionary.TItemArray

7TCollectionNotifyEvent

ITDictionary.TKeyEnumerator;

ITDictionary.TKeyEnumerator

ITDictionary.TKeyCollection;

ITDictionary.TKeyCollection

'TArray

,TEnumerator(

,TEnumeratorP9J

,TEnumerable'

,TEnumerable

KTDictionary.TValueEnumerator;

KTDictionary.TValueEnumerator4

KTDictionary.TValueCollection;

KTDictionary.TValueCollection4>J

JTDictionary.TPairEnumerator;

JTDictionary.TPairEnumeratorl@J

:TDictionary9

:TDictionarylBJ

Keysl?J

/TList.arrayofT

*IComparer

.TArrayManagerg

.TArrayManager

,IEnumerable0!@

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

TArray

%TEnumerator(

%TEnumerator

%TEnumerable'

%TEnumerableD^J

(TList.arrayofT

#IComparer

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManagerHaJ

%IEnumerable0!@

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumeratorXdJ

TList&

TList

%TObjectList

TArray

%TEnumerator(

%TEnumerator

%TEnumerable'

%TEnumerable

(TList.arrayofT

#IComparer

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManager

%IEnumerable0!@

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TList

%TThreadList&

%TThreadListx

TArray

0TEnumerator(

0TEnumerator

0TEnumerable'

0TEnumerable4

3TList.arrayofT

.IComparer

;TCollectionNotifyEvent

2TArrayManagerg

2TArrayManagert

0IEnumerable0!@

5TList.TEmptyFunc

6TList.TEnumerator5

6TList.TEnumerator

*TList&

*TList|

7TArray>

>(

>

>'

>p

LTList>.arrayofT

GIComparer>

GTCollectionNotifyEvent>

Item TList

>TArrayManager>g

>TArrayManager>

IIEnumerable>0!@

NTList>.TEmptyFunc

OTList>.TEnumerator5

OTList>.TEnumerator

CTList>&

CTList>

TList.Sort$122$0$Intf

TList.Sort$122$ActRec

TList.Sort$122$ActRec0

!TArray

&TEnumerator(

&TEnumerator

&TEnumerable'

&TEnumerable

)TList.arrayofT

System.Generics.CollectionsxWK

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerable0!@

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumerator

TList&

TListPbK

&TThreadList&

&TThreadList(oK

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable'

'TEnumerable

*TList.arrayofT

System.Generics.Collectionsl

%IComparer

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManager

'IEnumerable0!@

,TList.TEmptyFunc

-TList.TEnumerator5

-TList.TEnumerator

!TList&

!TList

TArray

#TEnumerator(

#TEnumeratorx!L

#TEnumerable'

#TEnumerable

&TList.arrayofT

!IComparer

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerable0!@

(TList.TEmptyFunc

)TList.TEnumerator5

)TList.TEnumerator

TList&

TList`*L

#TThreadList&

#TThreadList47L

TComponent.Create@$929$0$Intf

&TComparison

$TComparer2

$TComparer

-TDelegatedComparer8

-TDelegatedComparer

TComponent.Create@$929$ActRec

"TComponent.GetObservers$942$0$Intf

"TComponent.GetObservers$942$1$Intf

"TComponent.GetObservers$942$ActRec

Uh.yL

7TLoginCredentialService.GetLoginCredentials$1216$0$Intf

LPassword

7TLoginCredentialService.GetLoginCredentials$1216$ActRec

TComparison

TComparer2

TComparer4

$TMoveArrayManagerg

$TMoveArrayManager

*.TList`1.Pack$23$0$Intf

*@TList`1.Pack$23$ActRec

o{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

TComparison

)TComparer2

)TComparerH

1TMoveArrayManagerg

1TMoveArrayManager

7.TList`1.Pack$23$0$Intf

7@TList`1.Pack$23$ActRec

7@TList`1.Pack$23$ActRec4

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.ClassesH

TComparison

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManagerd

'.TList`1.Pack$23$0$Intf

'@TList`1.Pack$23$ActRec

'@TList`1.Pack$23$ActRecX N

i{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

,TMoveArrayManagerg

,TMoveArrayManager

2.TList`1.Pack$23$0$Intf

2@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

RTList>.arrayofT

MIComparer>

ZTCollectionNotifyEvent>

Item3TPair

QTArrayManager>g

QTArrayManager>

OIEnumerable>0!@

TTList>.TEmptyFunc

UTList>.TEnumerator5

UTList>.TEnumerator

ITList>&

ITList>

-TList.arrayofT

(IComparer

,TArrayManagerg

,TArrayManager

*IEnumerable0!@

/TList.TEmptyFunc

0TList.TEnumerator5

0TList.TEnumerator

$TList&

$TList

,TComparison

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManagerTQN

8.TList`1.Pack$23$0$Intf

8@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

STList>.arrayofT

NIComparer>

[TCollectionNotifyEvent>

Item4TPair

RTArrayManager>g

RTArrayManager>xXN

PIEnumerable>0!@

UTList>.TEmptyFunc

VTList>.TEnumerator5

VTList>.TEnumerator4\N

JTList>&

JTList>@^N

,TComparison

*TComparer2

*TComparerllN

2TMoveArrayManagerg

2TMoveArrayManager4nN

8.TList`1.Pack$23$0$Intf

8@TList`1.Pack$23$ActRec

8@TList`1.Pack$23$ActRec`qN

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

%TComparison

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager

1.TList`1.Pack$23$0$Intf

1@TList`1.Pack$23$ActRec

}{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

%TComparison

#TComparer2

#TComparer8{N

TMoveArrayManagerg

TMoveArrayManager

1.TList`1.Pack$23$0$Intf

1@TList`1.Pack$23$ActRecX

1@TList`1.Pack$23$ActRec

}{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

0TComparison

.TComparer2

.TComparer

6TMoveArrayManagerg

6TMoveArrayManagerX

<.tlist>

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.ClassesX

ITComparison>

GTComparer>2

GTComparer>X

OTMoveArrayManager>g

OTMoveArrayManager>X

U.TList`1.Pack$23$0$Intf>

U@TList`1.Pack$23$ActRec>P

U@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

&TComparison

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

2.TList`1.Pack$23$0$Intf

2@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.ClassesxWK

'TComparison

%TComparer2

%TComparer8

-TMoveArrayManagerg

-TMoveArrayManager

3.TList`1.Pack$23$0$Intf

3@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.Classesl

#TComparison

!TComparer2

!TComparer

)TMoveArrayManagerg

)TMoveArrayManagerH

/.TList`1.Pack$23$0$Intf

/@TList`1.Pack$23$ActRec

/@TList`1.Pack$23$ActRecT

y{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

%TDelegatedComparer8

%TDelegatedComparer

2TDelegatedComparer8

2TDelegatedComparer

"TDelegatedComparer8

"TDelegatedComparerT

OTComparison>

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

[.TList`1.Pack$23$0$Intf>

[@TList`1.Pack$23$ActRec>

[@TList`1.Pack$23$ActRec>t

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

TComparison

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager4

'.TList`1.Pack$23$0$Intf

'@TList`1.Pack$23$ActRec

'@TList`1.Pack$23$ActRec(

*TComparison

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManager

6.TList`1.Pack$23$0$Intf

6@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.ClassesD

3TDelegatedComparer8

3TDelegatedComparer

PTComparison>

NTComparer>2

NTComparer>@

VTMoveArrayManager>g

VTMoveArrayManager>P

\.TList`1.Pack$23$0$Intf>

\@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

3TDelegatedComparer8

3TDelegatedComparerL

,TDelegatedComparer8

,TDelegatedComparer

,TDelegatedComparer8

,TDelegatedComparer

7TDelegatedComparer8

7TDelegatedComparerX

PTDelegatedComparer>8

PTDelegatedComparer>

-TDelegatedComparer8

-TDelegatedComparer

.TDelegatedComparer8

.TDelegatedComparer

*TDelegatedComparer8

*TDelegatedComparer`

VTDelegatedComparer>8

VTDelegatedComparer>

"TDelegatedComparer8

"TDelegatedComparer

1TDelegatedComparer8

1TDelegatedComparer

WTDelegatedComparer>8

WTDelegatedComparer>H

System.Actions

FHelpKeyword

HelpKeywordd

'TArray

,TEnumerator(

,TEnumerable'

,TEnumerablex

/TList.arrayofT

System.Generics.Collections8

*IComparer

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerable0!@

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

-TContainedActionList.EnumByCategory$51$0$Intf

-TContainedActionList.EnumByCategory$51$ActRec

,TComparison

*TComparer2

*TComparerx>O

2TMoveArrayManagerg

2TMoveArrayManager@@O

8.TList`1.Pack$23$0$Intf

8@TList`1.Pack$23$ActRec

8@TList`1.Pack$23$ActReclCO

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

System.Actions8

3TDelegatedComparer8

3TDelegatedComparer@EO

Winapi.Wincodec

TTimeSpanParser.TParseError

System.TimeSpan

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsgP

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome

Uh.OP

Uh.oP

System.Contnrs

System.SyncObjs

System.SyncObjsX

TFunc

System.SyncObjsp

IsShortCut

Vcl.ActnList

1.2.8

System.ZLib

Ht.Ht3

System.Win.ComObj

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeywordD

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Vcl.Controlsh

Vcl.StdCtrls

Vcl.StdCtrls5

Vcl.StdCtrls-

FPasswordChar

Vcl.StdCtrlsC

PasswordChar

OnKeyDown

OnKeyPress

OnKeyUpd

Vcl.StdCtrlsA

TCustomButton.TButtonStyle

Vcl.StdCtrls;

Vcl.StdCtrls2

Vcl.StdCtrls

OnKeyUp

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindow

#TCustomEdit.ObserverAdded$78$0$Intf

#TCustomEdit.ObserverAdded$78$ActRec

Uh.mT

(TCustomCheckBox.ObserverAdded$290$0$Intf

(TCustomCheckBox.ObserverAdded$290$ActRec

(TCustomCheckBox.ObserverAdded$290$ActRec\

Winapi.ShlObj

Vcl.Printers

APort

Port

Vcl.Clipbrd

Vcl.StdActns

Vcl.ComCtrls

System.HelpIntfs

HelpKeyword

UnderstandsKeyword

(TArray

-TEnumerator(

-TEnumeratorx$U

-TEnumerable'

-TEnumerable

0TList.arrayofT

IComparer

8TCollectionNotifyEvent

/TArrayManagerg

/TArrayManager

-IEnumerable0!@

2TList.TEmptyFunc

3TList.TEnumerator5

3TList.TEnumerator(,U

'TList&

'TList

-TComparison

TComparer2

TComparer cU

3TMoveArrayManagerg

3TMoveArrayManager

9.TList`1.Pack$23$0$Intf

9@TList`1.Pack$23$ActRecphU

9@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

4TDelegatedComparer8

4TDelegatedComparer

Vcl.Dialogs

FURL

Vcl.Dialogs`

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials

.TDefaultLoginCredentials.LoginEvent$290$0$Intf

.TDefaultLoginCredentials.LoginEvent$290$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$292$0$Intf

3TDefaultLoginCredentials.LoginEventUsrPw$292$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$292$ActRecL

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.ExtCtrlsF

Vcl.ExtCtrlsD

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable'

'TEnumerable

*TList.arrayofT

%IComparer

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManager

'IEnumerable0!@

,TList.TEmptyFunc

-TList.TEnumerator5

-TList.TEnumerator

!TList&

!TList

RTPair>

eTArray>>

jTEnumerator>>(

jTEnumerator>>

jTEnumerable>>'

jTEnumerable>>

^TDictionary>.TItem

cTDictionary>.TItemArray

System.Generics.CollectionsDoW

IEqualityComparer

%TCollectionNotifyEvent

UTCollectionNotifyEvent>

Item!TList

TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerableHtW

gTDictionary>.TKeyEnumerator;

gTDictionary>.TKeyEnumerator

gTDictionary>.TKeyCollection;

gTDictionary>.TKeyCollection

4TArray>

9TEnumerator>(

9TEnumerator>

9TEnumerable>'

9TEnumerable> |W

iTDictionary>.TValueEnumerator;

iTDictionary>.TValueEnumerator

iTDictionary>.TValueCollection;

iTDictionary>.TValueCollection

hTDictionary>.TPairEnumerator;

hTDictionary>.TPairEnumerator|

XTDictionary>9

XTDictionary>

Keys`

2TPair

ETArray>

JTEnumerator>(

JTEnumerator>

JTEnumerable>'

JTEnumerable>@

>TDictionary.TItem

CTDictionary.TItemArray

%TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

GTDictionary.TKeyEnumerator;

GTDictionary.TKeyEnumerator0

GTDictionary.TKeyCollection;

GTDictionary.TKeyCollection(

%TArray

*TEnumerator(

*TEnumerator

*TEnumerable'

*TEnumerable

ITDictionary.TValueEnumerator;

ITDictionary.TValueEnumerator|

ITDictionary.TValueCollection;

ITDictionary.TValueCollectionx

HTDictionary.TPairEnumerator;

HTDictionary.TPairEnumerator

8TDictionary9

8TDictionary

OnKeyNotifyt

>TObjectDictionaryM

>TObjectDictionaryX

3TPair

FTArray>

KTEnumerator>(

KTEnumerator>

KTEnumerable>'

KTEnumerable>@

?TDictionary.TItem

DTDictionary.TItemArray

&IEqualityComparer

TCollectionNotifyEvent

0TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerable'

TEnumerable`

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumerator

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollection

TArray

%TEnumerator(

%TEnumeratorL

%TEnumerable'

%TEnumerable

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator

JTDictionary.TValueCollection;

JTDictionary.TValueCollection

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumeratorH

9TDictionary9

9TDictionaryD

KeysH

?TObjectDictionaryM

?TObjectDictionary

7TPair

JTArray>

OTEnumerator>(

OTEnumerator>\

OTEnumerable>'

OTEnumerable>

CTDictionary.TItem

HTDictionary.TItemArray

System.Generics.Collectionsp

4TCollectionNotifyEvent

LTDictionary.TKeyEnumerator;

LTDictionary.TKeyEnumerator

LTDictionary.TKeyCollection;

LTDictionary.TKeyCollection

$TArray

)TEnumerator(

)TEnumerator$

)TEnumerable'

)TEnumerablel

NTDictionary.TValueEnumerator;

NTDictionary.TValueEnumerator

NTDictionary.TValueCollection;

NTDictionary.TValueCollection

MTDictionary.TPairEnumerator;

MTDictionary.TPairEnumerator@

=TDictionary9

=TDictionaryD

Keys

CTObjectDictionaryM

CTObjectDictionary

9TPair

LTArray>

QTEnumerator>(

QTEnumerator>

QTEnumerable>'

QTEnumerable>

ETDictionary.TItem

JTDictionary.TItemArray

NTDictionary.TKeyEnumerator;

NTDictionary.TKeyEnumerator

NTDictionary.TKeyCollection;

NTDictionary.TKeyCollection

,TArray

1TEnumerator(

1TEnumerator

1TEnumerable'

1TEnumerable

PTDictionary.TValueEnumerator;

PTDictionary.TValueEnumeratorx

PTDictionary.TValueCollection;

PTDictionary.TValueCollection

OTDictionary.TPairEnumerator;

OTDictionary.TPairEnumerator

?TDictionary9

?TDictionary

6TArray

;TEnumerator(

;TEnumerator

;TEnumerable'

;TEnumerable`

>TList.arrayofT

System.Generics.Collections4*W

9IComparer

FTCollectionNotifyEvent

Item#TStyleManager.TStyleClassDescriptor

=TArrayManagerg

=TArrayManager

;IEnumerable0!@

@TList.TEmptyFunc

ATList.TEnumerator5

ATList.TEnumeratorP

5TList&

5TList0

*TArray

/TEnumerator(

/TEnumerator

/TEnumerable'

/TEnumerable

2TList.arrayofT

-IComparer

:TCollectionNotifyEvent

1TArrayManagerg

1TArrayManagerL&X

/IEnumerable0!@

4TList.TEmptyFunc

5TList.TEnumerator5

5TList.TEnumerator

)TList&

)TListL X

List %X

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable'

,TEnumerable

/TList.arrayofT

*IComparer

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerable0!@

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumerator,@X

&TList&

&TList

TArray

TEnumerator(

TEnumerator

TEnumerable'

TEnumerable

#TList.arrayofT

IComparer

TCollectionNotifyEvent

"TArrayManagerg

"TArrayManager

IEnumerable0!@

%TList.TEmptyFunc

&TList.TEnumerator5

&TList.TEnumerator

TList&

TList|

'TComparison

%TComparer2

%TComparer

-TMoveArrayManagerg

-TMoveArrayManager

3.TList`1.Pack$23$0$Intf

3@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

mTList>>.arrayofT

System.Generics.Collections(jW

hIComparer>>

uTCollectionNotifyEvent>>

ItemRTPair>

lTArrayManager>>g

lTArrayManager>>0

jIEnumerable>>0!@

oTList>>.TEmptyFunc

pTList>>.TEnumerator5

pTList>>.TEnumeratorP

dTList>>&

dTList>>

TList.arrayofT

IComparer

TArrayManagerg

TArrayManager

IEnumerable0!@

TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TListT

>.arrayofT

System.Generics.Collections$iW

7IComparer>

;TArrayManager>g

;TArrayManager>

9IEnumerable>0!@

>TList>.TEmptyFunc

?TList>.TEnumerator5

?TList>.TEnumerator\

3TList>&

3TList>8

MTList>.arrayofT

System.Generics.CollectionsT

HIComparer>

UTCollectionNotifyEvent>

Item2TPair

LTArrayManager>g

LTArrayManager>L

JIEnumerable>0!@

OTList>.TEmptyFunc

PTList>.TEnumerator5

PTList>.TEnumerator

DTList>&

DTList>

-TList.arrayofT

(IComparer

,TArrayManagerg

,TArrayManager

*IEnumerable0!@

/TList.TEmptyFunc

0TList.TEnumerator5

0TList.TEnumerator0)[

$TList&

$TList

NTList>.arrayofT

IIComparer>

VTCollectionNotifyEvent>

Item3TPair

MTArrayManager>g

MTArrayManager>

KIEnumerable>0!@

PTList>.TEmptyFunc

QTList>.TEnumerator5

QTList>.TEnumerator

ETList>&

ETList>

#TList.arrayofT

IComparer

"TArrayManagerg

"TArrayManager

IEnumerable0!@

%TList.TEmptyFunc

&TList.TEnumerator5

&TList.TEnumerator

TList&

TListDR[

(TList.arrayofT

#IComparer

'TArrayManagerg

'TArrayManager

%IEnumerable0!@

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TList

RTList>.arrayofT

MIComparer>

ZTCollectionNotifyEvent>

Item7TPair

QTArrayManager>g

QTArrayManager>

OIEnumerable>0!@

TTList>.TEmptyFunc

UTList>.TEnumerator5

UTList>.TEnumeratorLw[

ITList>&

ITList>Ty[

,TList.arrayofT

'IComparer

TArrayManagerg

TArrayManager|

)IEnumerable0!@

.TList.TEmptyFunc

/TList.TEnumerator5

/TList.TEnumerator

#TList&

#TListX

TTList>.arrayofT

OIComparer>

\TCollectionNotifyEvent>

Item9TPair

STArrayManager>g

STArrayManager>

QIEnumerable>0!@

VTList>.TEmptyFunc

WTList>.TEnumerator5

WTList>.TEnumerator`

KTList>&

KTList>l

4TList.arrayofT

/IComparer

3TArrayManagerg

3TArrayManager

1IEnumerable0!@

6TList.TEmptyFunc

7TList.TEnumerator5

7TList.TEnumerator

TList&

TList

;TComparison

9TComparer2

9TComparer

ATMoveArrayManagerg

ATMoveArrayManager

G.TList`1.Pack$23$0$Intf

G@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

Vcl.Themes4*W

/TComparison

-TComparer2

-TComparer

5TMoveArrayManagerg

5TMoveArrayManager

;.TList`1.Pack$23$0$Intf

;@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

,TComparison

*TComparer2

*TComparerp

2TMoveArrayManagerg

2TMoveArrayManager8

8.TList`1.Pack$23$0$Intf

8@TList`1.Pack$23$ActRec

8@TList`1.Pack$23$ActRecd

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

TComparison

TComparer2

TComparer

&TMoveArrayManagerg

&TMoveArrayManager

,.TList`1.Pack$23$0$Intf

,@TList`1.Pack$23$ActRec

s{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

.TDelegatedComparer8

.TDelegatedComparerH

jTComparison>>

hTComparer>>2

hTComparer>>

pTMoveArrayManager>>g

pTMoveArrayManager>>@

v.TList`1.Pack$23$0$Intf>>

v@TList`1.Pack$23$ActRec>>

{System.Generics.Collections}TList>>.:{System.Generics.Collections}TList

Vcl.Themes(jW

TComparison

TComparer2

TComparer

TMoveArrayManagerg

TMoveArrayManager@

&.TList`1.Pack$23$0$Intf

&@TList`1.Pack$23$ActRec

&@TList`1.Pack$23$ActRec0

g{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

9TComparison>

7TComparer>2

7TComparer>

?TMoveArrayManager>g

?TMoveArrayManager>p

E.TList`1.Pack$23$0$Intf>

E@TList`1.Pack$23$ActRec>(

E@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

Vcl.Themes$iW

JTComparison>

HTComparer>2

HTComparer>

PTMoveArrayManager>g

PTMoveArrayManager>

V.TList`1.Pack$23$0$Intf>

V@TList`1.Pack$23$ActRec>

V@TList`1.Pack$23$ActRec>0

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

Vcl.ThemesT

*TComparison

(TComparer2

(TComparer@

0TMoveArrayManagerg

0TMoveArrayManager

6.TList`1.Pack$23$0$Intf

6@TList`1.Pack$23$ActRec

6@TList`1.Pack$23$ActRec(

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

KTComparison>

ITComparer>2

ITComparer>

QTMoveArrayManager>g

QTMoveArrayManager>

W.TList`1.Pack$23$0$Intf>

W@TList`1.Pack$23$ActRec>

W@TList`1.Pack$23$ActRec>h

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

TComparison

TComparer2

TComparerp

&TMoveArrayManagerg

&TMoveArrayManager

,.TList`1.Pack$23$0$Intf

,@TList`1.Pack$23$ActRec

,@TList`1.Pack$23$ActRec(

s{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

%TComparison

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager@

1.TList`1.Pack$23$0$Intf

1@TList`1.Pack$23$ActRec

1@TList`1.Pack$23$ActRecT \

}{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

OTComparison>

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

[.TList`1.Pack$23$0$Intf>

[@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

)TComparison

'TComparer2

'TComparer

/TMoveArrayManagerg

/TMoveArrayManagert-\

5.TList`1.Pack$23$0$Intf

5@TList`1.Pack$23$ActRec

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

QTComparison>

OTComparer>2

OTComparer>D3\

WTMoveArrayManager>g

WTMoveArrayManager>T5\

].TList`1.Pack$23$0$Intf>

]@TList`1.Pack$23$ActRec>l9\

]@TList`1.Pack$23$ActRec>

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

1TComparison

/TComparer2

/TComparer

7TMoveArrayManagerg

7TMoveArrayManager

=.TList`1.Pack$23$0$Intf

=@TList`1.Pack$23$ActRec

=@TList`1.Pack$23$ActRec$A\

{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

BTDelegatedComparer8

BTDelegatedComparer

6TDelegatedComparer8

6TDelegatedComparer

3TDelegatedComparer8

3TDelegatedComparer

'TDelegatedComparer8

'TDelegatedComparerLH\

qTDelegatedComparer>>8

qTDelegatedComparer>>

!TDelegatedComparer8

!TDelegatedComparer

@TDelegatedComparer>8

@TDelegatedComparer>

QTDelegatedComparer>8

QTDelegatedComparer>

1TDelegatedComparer8

1TDelegatedComparerxQ\

RTDelegatedComparer>8

RTDelegatedComparer>,S\

'TDelegatedComparer8

'TDelegatedComparer U\

,TDelegatedComparer8

,TDelegatedComparer

VTDelegatedComparer>8

VTDelegatedComparer>hX\

0TDelegatedComparer8

0TDelegatedComparerdZ\

XTDelegatedComparer>8

XTDelegatedComparer>

8TDelegatedComparer8

8TDelegatedComparer

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeys,

AutoHotkeys|

System.Win.TaskbarCore

Vcl.Forms

ssHotTrack

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState`h]

Vcl.Formsc

KeyPreview(

WindowState

TApplication.TBiDiKeyboard

BiDiKeyboard

NonBiDiKeyboard

BiDiKeyboardHKL

NonBiDiKeyboardHKL

SetBiDiKeyboard

SetNonBiDiKeyboard

GetBidiKeyboard

GetNonBidiKeyboard

ApplyBiDiKeyboardLayout

ApplyNonBiDiKeyboardLayout

FBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

OnActionExecute

!TScrollingStyleHook.TScrollWindow6

!TScrollingStyleHook.TScrollWindow\

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHook

EnterWithKeyboard

TList.arrayofT

IComparer

TArrayManagerg

TArrayManagerDK_

IEnumerable0!@

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator,N_

TList&

TList

i{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

Vcl.Buttons

FLastErrorMsg

LastErrorMsg$

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccJoinControl

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

EJclMutexError

login

password

EdPassword

BtGenPasswd

BtGenPasswdClick

TSysPopupStyleHook.TSysPopupItemV

TSysPopupStyleHook.TSysPopupItem

Vcl.SysStyles

FKeyIndex

Vcl.Styles

6TPair

ITArray>

NTEnumerator>(

NTEnumerator>

NTEnumerable>'

NTEnumerable>t

BTDictionary.TItem

GTDictionary.TItemArray

,IEqualityComparer

-TCollectionNotifyEvent

KTDictionary.TKeyEnumerator;

KTDictionary.TKeyEnumerator|

KTDictionary.TKeyCollection;

KTDictionary.TKeyCollection|

TArray

"TEnumerator(

"TEnumerator

"TEnumerable'

"TEnumerable0

MTDictionary.TValueEnumerator;

MTDictionary.TValueEnumerator

MTDictionary.TValueCollection;

MTDictionary.TValueCollection

LTDictionary.TPairEnumerator;

LTDictionary.TPairEnumerator

9

OnKeyNotifyl

ktcPanel

ktcPanelDisabled

ssHot

FAuthorURL

TSeWindowSubclass

ktmiWindowStandard

QTList>.arrayofT

LIComparer>

YTCollectionNotifyEvent>

Item6TPair

PTArrayManager>g

PTArrayManager>HMd

NIEnumerable>0!@

STList>.TEmptyFunc

TTList>.TEnumerator5

TTList>.TEnumerator

HTList>&

HTList>

%TList.arrayofT

IComparer

$TArrayManagerg

$TArrayManager

"IEnumerable0!@

'TList.TEmptyFunc

(TList.TEnumerator5

(TList.TEnumerator

TList&

TList

NTComparison>

LTComparer>2

LTComparer>

TTMoveArrayManager>g

TTMoveArrayManager>

Z.TList`1.Pack$23$0$Intf>

Z@TList`1.Pack$23$ActRec>

Z@TList`1.Pack$23$ActRec> yd

{System.Generics.Collections}TList>.:{System.Generics.Collections}TList>.:1

"TComparison

TComparer2

TComparer8|d

(TMoveArrayManagerg

(TMoveArrayManager

..TList`1.Pack$23$0$Intf

.@TList`1.Pack$23$ActRec

w{System.Generics.Collections}TList.:{System.Generics.Collections}TList.:1

UTDelegatedComparer>8

UTDelegatedComparer>

)TDelegatedComparer8

)TDelegatedComparer

System.SysConst

System.RTLConsts

System.VarUtils

System.Internal.ExcUtils

System.Character

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.Math

System.AnsiStrings

System.StrUtils

Winapi.CommCtrl

Winapi.Messages

Winapi.Dwmapi

Winapi.UxTheme

System.Diagnostics

Winapi.MultiMon

Vcl.Consts

System.UIConsts

System.IniFiles

System.IOUtils

System.DateUtils

System.Masks

Winapi.MSXMLIntf

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

System.Win.ComConst

Winapi.PenInputPanel

Winapi.MsInkAut

Winapi.TpcShrd

Vcl.GraphUtil

System.Win.Crtl

Winapi.Imm

Winapi.CommDlg

Vcl.ComStrs

Winapi.WinSpool

Vcl.ListActns

Vcl.ToolWin

Winapi.RichEdit

Winapi.FlatSB

System.Win.Taskbar

Winapi.Dlgs

System.WideStrUtils

Vcl.ButtonGroup

Vcl.CategoryButtons

Vcl.Grids

Vcl.Mask

System.MaskUtils

Winapi.AccCtrl

Winapi.TlHelp32

Winapi.WinSock

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%{%|%}%~%

* *!*"*#*$*%*&*'*(*)*** *,*-*.*/*0*1*2*3*4*5*6*7*8*9*:*;**?*@*A*B*C*D*E*F*G*H*I*J*K*L*M*N*O*P*Q*R*S*T*U*V*W*X*Y*Z*[*\*]*^*_*`*a*b*c*d*e*f*g*h*i*j*k*l*m*n*o*p*q*r*s*t*u*v*w*x*y*z*{*|*}*~*

. .!.".#.$.%.&.'.(.).*. .,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.|.}.~.

C C!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C8C9C:C;CC?C@CACBCCCDCECFCGCHCICJCKCLCMCNCOCPCQCRCSCTCUCVCWCXCYCZC[C\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C

D D!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D

E E!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKELEMENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E

F F!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`FaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F

M M!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M

S S!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S

U U!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U

X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3X4X5X6X7X8X9X:X;XX?X@XAXBXCXDXEXFXGXHXIXJXKXLXMXNXOXPXQXRXSXTXUXVXWXXXYXZX[X\X]X^X_X`XaXbXcXdXeXfXgXhXiXjXkXlXmXnXoXpXqXrXsXtXuXvXwXxXyXzX{X|X}X~X

c c!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c

d d!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d

e e!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e6e7e8e9e:e;ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeNeOePeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefegeheiejekelemeneoepeqereseteuevewexeyeze{e|e}e~e

f f!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsftfufvfwfxfyfzf{f|f}f~f

m m!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m

s s!s"s#s$s%s&s's(s)s*s s,s-s.s/s0s1s2s3s4s5s6s7s8s9s:s;ss?s@sAsBsCsDsEsFsGsHsIsJsKsLsMsNsOsPsQsRsSsTsUsVsWsXsYsZs[s\s]s^s_s`sasbscsdsesfsgshsisjskslsmsnsospsqsrssstsusvswsxsyszs{s|s}s~s

u u!u"u#u$u%u&u'u(u)u*u u,u-u.u/u0u1u2u3u4u5u6u7u8u9u:u;uu?u@uAuBuCuDuEuFuGuHuIuJuKuLuMuNuOuPuQuRuSuTuUuVuWuXuYuZu[u\u]u^u_u`uaubucudueufuguhuiujukulumunuoupuqurusutuuuvuwuxuyuzu{u|u}u~u

x x!x"x#x$x%x&x'x(x)x*x x,x-x.x/x0x1x2x3x4x5x6x7x8x9x:x;xx?x@xAxBxCxDxExFxGxHxIxJxKxLxMxNxOxPxQxRxSxTxUxVxWxXxYxZx[x\x]x^x_x`xaxbxcxdxexfxgxhxixjxkxlxmxnxoxpxqxrxsxtxuxvxwxxxyxzx{x|x}x~x

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

user32.dll

kernel32.dll

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

GetViewportOrgEx

version.dll

GetCPInfoExW

GetCPInfo

CreatePipe

RegUnLoadKeyW

RegSaveKeyW

RegRestoreKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegOpenKeyExA

RegLoadKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

ole32.dll

comctl32.dll

msvcrt.dll

shell32.dll

ShellExecuteW

winspool.drv

wtsapi32.dll

msimg32.dll

RegDeleteKeyExW

windowscodecs.dll

uxtheme.dll

imm32.dll

DWMAPI.DLL

xDedicRDPPatch.exe

Embarcadero Delphi for Win32 compiler version 28.0 (21.0.17707.5020)

d.wB2

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

"Winapi.WinSock

ISystem.Internal.ExcUtils

dSystem.SysConst

,System.Character

kWinapi.PsAPI

-Winapi.ImageHlp

UVcl.Mask

yVcl.Consts

jVcl.Clipbrd

eVcl.Forms

RVcl.Dialogs

fSystem.Rtti

YSystem.AnsiStrings

System.StrUtils

%System.Classes

CVcl.ExtCtrls

'System.UIConsts

iSystem.IOUtils

&System.DateUtils

DWinapi.MsInkAut

|System.Actions

:Winapi.Imm

(Vcl.Menus

NSystem.Contnrs

Vcl.ComCtrls

hWinapi.UrlMon

4Winapi.RegStr

WVcl.ComStrs

bVcl.Printers

8Vcl.ToolWin

NSystem.Win.TaskbarCore

hSystem.Win.Taskbar

wVcl.ButtonGroup

Vcl.CategoryButtons

tVcl.Buttons

gVcl.Styles

.itext

.data

.reloc

.rsrc

SqlN

"%dYk

,Xt5Ã†MSa

>=;%x\g

zwb(&%d

cMdv

1.lL&

PyJIVN%C

2)AM%s(

ftpu>

b.dQ@

F^m0v.du0

.tsXR

L{l

5@_W.Qf

ry/.AWdk

)X-7N}C>

.vj"vbQy

Z"Ãœ

c;T%.SS

%FyuE@

2b.pO

%DIV)xKN

3P.Cs

h7.gq

@K%s^

V.WLW

%s>5U>e

.HhN4w

v$s%f|

%D#Zh

rMnr.ty

.fjxe

D%sYx

W%S2X&eB

Ã”o_Q

bZ.cvsa

4>.bSM

I(w%S

(T%f,|

v.pp7

V.DxvT

Nf.XsB

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

wininet.dll

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

EditLabel.Width

EditLabel.Height

EditLabel.Caption

Go to xDedic.biz !

$All RDP's in one place! - xDedic.biz

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

%s-%s

(%s @ %p)

(class '%s' @ %p)

operator

%s[%d]

%s_%d

.Owner

\\?\UNC\

crSQLWait

%s%0.8x

claBurlywood

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

TaskDialogIndirect

Invalid ZStream operation!

%s (%s)

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

%s%s%s%s%s%s%s%s%s%s

Windows

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

$URL$

JCL\source\windows

netapi32.dll

S-%u-

$URL:

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Login:

Password:

tch.exe

Not valid username or password!

User name and password copied to clipboard

All operations completed

New password copied to clipboard

Password created

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

The operation is allowed only on the primary domain controller of the domain

The password is shorter than required.

(The password could also be too long, be too recent in its change history,

not have enough unique characters, or not meet another password policy requirement)

/c ping -n 3 127.0.0.1 & shutdown -l -f

cmd.exe

/c ping -n 2 127.0.0.1 & del "

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

hXXps://xdedic.biz/

Windows Server 2012 R2

Invalid MMF name "%s"*The MMF named "%s" cannot be created empty

Win32 error: %s (%u)%s%s

Library not found: %s

Function not found: %s.%s

128-Byte PrefetchingeCPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters

Windows 8

Windows Server 2012

Windows 8.1

,Trace cache: 12 K-Ops, 8-way set associative,Trace cache: 16 K-Ops, 8-way set associative,Trace cache: 32 K-Ops, 8-way set associative,Trace cache: 64 K-Ops, 8-way set associative:Instruction TLB: 2M/4M pages, fully associative, 8 entriesD2nd-level cache: 1 MBytes, 4-way set associative, 64 bytes line sizeZ2nd-level cache: 128 KBytes, 8-way set associative, 64 bytes line size, 2 lines per sectorZ2nd-level cache: 256 KBytes, 8-way set associative, 64 bytes line size, 2 lines per sectorZ2nd-level cache: 512 KBytes, 8-way set associative, 64 bytes line size, 2 lines per sectorX2nd-level cache: 1 MBytes, 8-way set associative, 64 bytes line size, 2 lines per sectorC2nd-level cache: 2 MBytes, 8-way set associative, 64 byte line sizeE2nd-level cache: 512 KBytes, 2-way set associative, 64 byte line sizeE2nd-level cache: 512 KBytes, 8-way set associative, 64 byte line sizeA2nd-level cache: 256 KBytes, 8-way associative, 32 byte line sizeA2nd-level cache: 512 KBytes, 8-way associative, 32 byte line size?2nd-level cache: 1 MBytes, 8-way associative, 32 byte line size*Instruction TLB: 4 KByte pages, 32 EntriesAInstruction TLB: 4 KByte and 2 MByte or 4 MByte pages, 64 EntriesBInstruction TLB: 4 KByte and 2 MByte or 4 MByte pages, 128 EntriesBInstruction TLB: 4 KByte and 2 MByte or 4 MByte pages, 256 EntriesGInstruction TLB: 2-MByte or 4-MByte pages, fully associative, 7 entries;Data TLB0: 4 MByte pages, 4-way set associative, 16 entries7Data TLB0: 4 KByte pages, 4-way associative, 16 entries7Data TLB0: 4 KByte pages, fully associative, 16 entriesFData TLB0: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries/Data TLB: 4 KByte and 4 MByte pages, 64 Entries0Data TLB: 4 KByte and 4 MByte pages, 128 Entries0Data TLB: 4 KByte and 4 MByte pages, 256 EntriesH1st-level data cache: 16 KByte, 8-way set associative, 64 byte line sizeH1st-level data cache: 8 KBytes, 4-way set associative, 64 byte line sizeI1st-level data cache: 16 KBytes, 4-way set associative, 64 byte line sizeI1st-level data cache: 32 KBytes, 4-way set associative, 64 byte line sizeU2nd-level cache: 512 KBytes, 4-way set associative, sectored cache, 64-byte line sizeXNo 2nd-level cache or, if processor contains a valid 2nd-level cache, no 3rd-level cacheE2nd-level cache: 128 KBytes, 4-way set associative, 32 byte line sizeE2nd-level cache: 256 KBytes, 4-way set associative, 32 byte line sizeE2nd-level cache: 512 KBytes, 4-way set associative, 32 byte line sizeC2nd-level cache: 1 MBytes, 4-way set associative, 32 byte line sizeC2nd-level cache: 2 MBytes, 4-way set associative, 32 byte line sizeC3rd-level cache: 4 MBytes, 4-way set associative, 64 byte line sizeC3rd-level cache: 8 MBytes, 4-way set associative, 64 byte line sizeB3rd-level cache: 8 MByte, 8-way set associative, 64 byte line sizeD2nd-level cache: 4 MBytes, 16-way set associative, 64 byte line sizeB3rd-level cache: 6MByte, 12-way set associative, 64 byte line sizeB3rd-level cache: 8MByte, 16-way set associative, 64 byte line sizeC3rd-level cache: 12MByte, 12-way set associative, 64 byte line sizeC3rd-level cache: 16MByte, 16-way set associative, 64 byte line sizeB2nd-level cache: 6MByte, 24-way set associative, 64 byte line size@Instruction TLB: 4 MByte pages, 4-way set associative, 4 entriesI1st level data cache: 16 KBytes, 4-way set associative, 32 byte line sizeI1st level data cache: 16 KBytes, 4-way set associative, 64 byte line sizeI1st level data cache: 24 KBytes, 6-way set associative, 64 byte line sizeE2nd level cache: 256 KBytes, 8-way set associative, 64 byte line sizeY3rd level cache: 512 KBytes, 4-way set associative, 64 byte line size, 2 lines per sectorW3rd level cache: 1 MBytes, 8-way set associative, 64 byte line size, 2 lines per sectorW3rd level cache: 2 MBytes, 8-way set associative, 64 byte line size, 2 lines per sectorW3rd level cache: 4 MBytes, 8-way set associative, 64 byte line size, 2 lines per sectorI1st level data cache: 32 KBytes, 8-way set associative, 64 byte line sizeP1st level instruction cache: 32 KBytes, 8-way set associative, 64 byte line sizeU2nd-level cache: 128 KBytes, 4-way set associative, sectored cache, 64-byte line sizeU2nd-level cache: 192 KBytes, 6-way set associative, sectored cache, 64-byte line sizeU2nd-level cache: 128 KBytes, 2-way set associative, sectored cache, 64-byte line sizeU2nd-level cache: 256 KBytes, 4-way set associative, sectored cache, 64-byte line sizeU2nd-level cache: 384 KBytes, 6-way set associative, sectored cache, 64-byte line size#"%s\%s\%s" is of wrong kind or size

"%s" does not match RootKey

VCL Style File)Class '%s' is already registered for '%s'%Class '%s' is not registered for '%s'

%s parameter cannot be nil0A StyleHook class has not been registered for %s#Feature not supported by this style

Style '%s' is not registered"Cannot unregister the system style

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters(Failed to get ANSI replacement character#Unable to open key "%s\%s" for read0Unable to open key "%s\%s" and access value "%s"

&Password

LoginÃŠnnot remove shell notification icon"%s requires Windows Vista or later

Button%d

RadioButton%d

Unable to load style '%s'

Unable to load styles: %s

Style '%s' already registered#Style class '%s' already registered

Style '%s' not found

Style class '%s' not found

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard: %s

Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.7Length of value array must be >= length of prompt array

Value must be between %d and %d

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s property out of range

Invalid date string: %s

Invalid time string: %s

Invalid time Offset string: %s

Scan line index out of range!Cannot change the size of an iconÃŠnnot change the size of a WIC Image$Unknown picture file extension (.%s)

Unsupported clipboard format

Canvas does not allow drawing#Text format flag '%s' not supported

Windows 7

Windows Server 2008 R2

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interfaceGNo single cast observer with ID %d was added to the observer collectionFNo multi cast observer with ID %d was added to the observer collection

No help found for %s

Duplicates not allowed5Insufficient RTTI available to support this operation

Parameter count mismatch

Windows Vista

Windows Server 2008rHigh surrogate char without a following low surrogate char at index: %d. Check that the string is encoded properlyrLow surrogate char without a preceding high surrogate char at index: %d. Check that the string is encoded properly2Length of Strings and Objects arrays must be equal

Invalid Timeout value: %s

Timespan too longbThe duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue

No help found for context %d

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread

Parameter %s cannot be nil'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

Invalid characters in path The specified file was not found$No help viewer that supports filters8String index out of range (%d). Must be >= %d and = 0 and

%s on line %d

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

%s expected$%s not in a class registration group

Property %s does not exist

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s'

Line too long List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Ancestor for '%s' not found

Cannot assign a %s to a %s

''%s'' expectedECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Dec5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

!'%s' is not a valid integer value('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value

I/O error %d

04090000

2.3.0.0

RDPWInst.exe

RDP Host Support

1.6.0.0

hXXp://stascorp.com

2.0.1.5

1.0.0.0

xDedicRDPPatch.exe_244_rwx_007EC000_00002000:

kernel32.dll

user32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

oleaut32.dll

advapi32.dll

gdi32.dll

version.dll

ole32.dll

comctl32.dll

msvcrt.dll

shell32.dll

winspool.drv

RegUnLoadKeyW

ShellExecuteW

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

2.0.1.5

1.0.0.0

iexplore.exe_636:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_636_rwx_00150000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_00290000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_002D0000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_00310000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_00350000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_00390000_00001000:

KERNEL32.DLL

iexplore.exe_636_rwx_00C40000_00001000:

advapi32.dll

iexplore.exe_636_rwx_00D70000_00001000:

RegOpenKeyA

iexplore.exe_636_rwx_00D80000_00001000:

advapi32.dll

iexplore.exe_636_rwx_00DB0000_00001000:

AVICAP32.DLL

iexplore.exe_636_rwx_00EF0000_00001000:

AVICAP32.DLL

iexplore.exe_636_rwx_00F20000_00001000:

gdi32.dll

iexplore.exe_636_rwx_00F60000_00001000:

gdi32.dll

iexplore.exe_636_rwx_00F90000_00001000:

gdiplus.dll

iexplore.exe_636_rwx_00FD0000_00001000:

gdiplus.dll

iexplore.exe_636_rwx_01010000_00001000:

mpr.dll

iexplore.exe_636_rwx_01060000_00001000:

mpr.dll

iexplore.exe_636_rwx_01090000_00001000:

msacm32.dll

iexplore.exe_636_rwx_014E0000_00001000:

msacm32.dll

iexplore.exe_636_rwx_01510000_00001000:

ntdll.dll

iexplore.exe_636_rwx_01650000_00001000:

ntdll.dll

iexplore.exe_636_rwx_01680000_00001000:

ole32.dll

iexplore.exe_636_rwx_017C0000_00001000:

ole32.dll

iexplore.exe_636_rwx_017F0000_00001000:

oleaut32.dll

iexplore.exe_636_rwx_01830000_00001000:

oleaut32.dll

iexplore.exe_636_rwx_01970000_00001000:

powrprof.dll

iexplore.exe_636_rwx_01AB0000_00001000:

powrprof.dll

iexplore.exe_636_rwx_01AE0000_00001000:

shell32.dll

iexplore.exe_636_rwx_01C20000_00001000:

shell32.dll

iexplore.exe_636_rwx_01C50000_00001000:

user32.dll

iexplore.exe_636_rwx_01D90000_00001000:

user32.dll

iexplore.exe_636_rwx_01DC0000_00001000:

wininet.dll

iexplore.exe_636_rwx_01EF0000_00001000:

FtpOpenFileA

iexplore.exe_636_rwx_01F00000_00001000:

wininet.dll

iexplore.exe_636_rwx_01F30000_00001000:

winmm.dll

iexplore.exe_636_rwx_02070000_00001000:

winmm.dll

iexplore.exe_636_rwx_020A0000_00001000:

wsock32.dll

iexplore.exe_636_rwx_021E0000_00001000:

wsock32.dll

iexplore.exe_636_rwx_029C0000_0004B000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

oleaut32.dll

EVariantBadIndexError

u%CNu

%s[%d]

ESQLiteException

TSQLiteDatabasex

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Mozilla

Firefox

sqlite3.dll

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

ole32.dll

##@@## ##@@## ##@@##

\Google\Chrome\User Data\Default\Web Data

SELECT * FROM logins

password_value

origin_url

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMaxh

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

Password

Porth

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

EIdObjectTypeNotSupported

TIdTCPServer

IdTCPServer

CmdDelimiterh

TIdTCPServerConnection

DefaultPort

OnExecuteL

EIdTCPServerError

EIdNoExecuteSpecified

TIdTCPClient

IdTCPClient

BoundPorth

PortU

TOnHTTPDocument

TIdHTTPProxyServer

TIdHTTPProxyServer0

IdHTTPProxyServer

DefaultPortd

OnHTTPDocument

HTTP/1.0

Windows Firewall Update

1.2.3

KWindows

IdTCPStream

IdTCPServer

SQLiteTable3

SQLite3

DIdHTTPProxyServer

UnitChrome

UnitFireFox3_5

GetCPInfo

RegOpenKeyExA

RegFlushKey

RegCreateKeyExA

RegCloseKey

GetKeyboardType

MsgWaitForMultipleObjects

((&)))!&$

"#$$&-)01$$'&,--%.&,

4\@%c

.idata

.edata

P.reloc

P.rsrc

$>.icR9

KERNEL32.DLL

advapi32.dll

crypt32.dll

user32.dll

funcoes.dll

GetChromePass

Mozilla3_5Password

StartHttpProxy

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

%s is not a valid service.

Socket Error # %d

File "%s" not found1Only one TIdAntiFreeze can exist per application.

Object type not supported.

No execute handler found.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No command handler found.*Error on call Winsock2 library function %s

Failed to set data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

iexplore.exe_636_rwx_02C80000_0004B000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

oleaut32.dll

EVariantBadIndexError

u%CNu

%s[%d]

ESQLiteException

TSQLiteDatabasex

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Mozilla

Firefox

sqlite3.dll

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

ole32.dll

##@@## ##@@## ##@@##

\Google\Chrome\User Data\Default\Web Data

SELECT * FROM logins

password_value

origin_url

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMaxh

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

Password

Porth

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

EIdObjectTypeNotSupported

TIdTCPServer

IdTCPServer

CmdDelimiterh

TIdTCPServerConnection

DefaultPort

OnExecuteL

EIdTCPServerError

EIdNoExecuteSpecified

TIdTCPClient

IdTCPClient

BoundPorth

PortU

TOnHTTPDocument

TIdHTTPProxyServer

TIdHTTPProxyServer0

IdHTTPProxyServer

DefaultPortd

OnHTTPDocument

HTTP/1.0

Windows Firewall Update

1.2.3

KWindows

IdTCPStream

IdTCPServer

SQLiteTable3

SQLite3

DIdHTTPProxyServer

UnitChrome

UnitFireFox3_5

GetCPInfo

RegOpenKeyExA

RegFlushKey

RegCreateKeyExA

RegCloseKey

GetKeyboardType

MsgWaitForMultipleObjects

((&)))!&$

"#$$&-)01$$'&,--%.&,

4\@%c

.idata

.edata

P.reloc

P.rsrc

$>.icR9

KERNEL32.DLL

advapi32.dll

crypt32.dll

user32.dll

funcoes.dll

GetChromePass

Mozilla3_5Password

StartHttpProxy

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

%s is not a valid service.

Socket Error # %d

File "%s" not found1Only one TIdAntiFreeze can exist per application.

Object type not supported.

No execute handler found.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No command handler found.*Error on call Winsock2 library function %s

Failed to set data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

iexplore.exe_636_rwx_02DD0000_0004B000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

oleaut32.dll

EVariantBadIndexError

u%CNu

%s[%d]

ESQLiteException

TSQLiteDatabasex

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Mozilla

Firefox

sqlite3.dll

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

ole32.dll

##@@## ##@@## ##@@##

\Google\Chrome\User Data\Default\Web Data

SELECT * FROM logins

password_value

origin_url

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMaxh

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

Password

Porth

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

EIdObjectTypeNotSupported

TIdTCPServer

IdTCPServer

CmdDelimiterh

TIdTCPServerConnection

DefaultPort

OnExecuteL

EIdTCPServerError

EIdNoExecuteSpecified

TIdTCPClient

IdTCPClient

BoundPorth

PortU

TOnHTTPDocument

TIdHTTPProxyServer

TIdHTTPProxyServer0

IdHTTPProxyServer

DefaultPortd

OnHTTPDocument

HTTP/1.0

Windows Firewall Update

1.2.3

KWindows

IdTCPStream

IdTCPServer

SQLiteTable3

SQLite3

DIdHTTPProxyServer

UnitChrome

UnitFireFox3_5

GetCPInfo

RegOpenKeyExA

RegFlushKey

RegCreateKeyExA

RegCloseKey

GetKeyboardType

MsgWaitForMultipleObjects

((&)))!&$

"#$$&-)01$$'&,--%.&,

4\@%c

.idata

.edata

P.reloc

P.rsrc

$>.icR9

KERNEL32.DLL

advapi32.dll

crypt32.dll

user32.dll

funcoes.dll

GetChromePass

Mozilla3_5Password

StartHttpProxy

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

%s is not a valid service.

Socket Error # %d

File "%s" not found1Only one TIdAntiFreeze can exist per application.

Object type not supported.

No execute handler found.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No command handler found.*Error on call Winsock2 library function %s

Failed to set data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

iexplore.exe_636_rwx_24080000_00062000:

`.rsrc

/w)f%u/

kernel32.dll

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

XxX.xXx

UuU.uUu

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÃžSKTOP%

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearch

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

getpassword

_x_X_PASSWORDLIST_X_x_

NOIP.abc

MSN.abc

FIREFOX.abc

IELOGIN.abc

IEPASS.abc

IEAUTO.abc

IEWEB.abc

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

updateservidorweb

##@@## ##@@## ##@@##

Windows\CurrentVersion\Uninstall\eDonkey2000

UNWISE.EXE

ntdll.dll

icon=shell32.dll,4

shellexecute=

autorun.inf

XX--XX--XX.txt

logs.dat

SQLite3.dll

$1.2.3

KWindows

UnitExecutarComandos

uftp

UrlMon

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

Explorer.EXE_932_rwx_00FF0000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_01F60000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_02020000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_020D0000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_02890000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_028D0000_00001000:

KERNEL32.DLL

Explorer.EXE_932_rwx_02910000_00001000:

advapi32.dll

Explorer.EXE_932_rwx_02940000_00001000:

RegOpenKeyA

Explorer.EXE_932_rwx_02950000_00001000:

advapi32.dll

Explorer.EXE_932_rwx_02A90000_00001000:

AVICAP32.DLL

Explorer.EXE_932_rwx_02BD0000_00001000:

AVICAP32.DLL

Explorer.EXE_932_rwx_02C00000_00001000:

gdi32.dll

Explorer.EXE_932_rwx_02D40000_00001000:

gdi32.dll

Explorer.EXE_932_rwx_02D70000_00001000:

gdiplus.dll

Explorer.EXE_932_rwx_02EB0000_00001000:

gdiplus.dll

Explorer.EXE_932_rwx_02EF0000_00001000:

mpr.dll

Explorer.EXE_932_rwx_02F30000_00001000:

mpr.dll

Explorer.EXE_932_rwx_02F60000_00001000:

msacm32.dll

Explorer.EXE_932_rwx_02FA0000_00001000:

msacm32.dll

Explorer.EXE_932_rwx_03010000_00001000:

ntdll.dll

Explorer.EXE_932_rwx_03950000_00001000:

ntdll.dll

Explorer.EXE_932_rwx_03980000_00001000:

ole32.dll

Explorer.EXE_932_rwx_03AC0000_00001000:

ole32.dll

Explorer.EXE_932_rwx_03AF0000_00001000:

oleaut32.dll

Explorer.EXE_932_rwx_03C30000_00001000:

oleaut32.dll

Explorer.EXE_932_rwx_03C60000_00001000:

powrprof.dll

Explorer.EXE_932_rwx_03DA0000_00001000:

powrprof.dll

Explorer.EXE_932_rwx_03DD0000_00001000:

shell32.dll

Explorer.EXE_932_rwx_03F10000_00001000:

shell32.dll

Explorer.EXE_932_rwx_03F40000_00001000:

user32.dll

Explorer.EXE_932_rwx_04080000_00001000:

user32.dll

Explorer.EXE_932_rwx_040B0000_00001000:

wininet.dll

Explorer.EXE_932_rwx_041E0000_00001000:

FtpOpenFileA

Explorer.EXE_932_rwx_041F0000_00001000:

wininet.dll

Explorer.EXE_932_rwx_04220000_00001000:

winmm.dll

Explorer.EXE_932_rwx_04360000_00001000:

winmm.dll

Explorer.EXE_932_rwx_04390000_00001000:

wsock32.dll

Explorer.EXE_932_rwx_044D0000_00001000:

wsock32.dll

Explorer.EXE_932_rwx_24010000_00062000:

`.rsrc

/w)f%u/

kernel32.dll

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

XxX.xXx

UuU.uUu

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÃžSKTOP%

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearch

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

getpassword

_x_X_PASSWORDLIST_X_x_

NOIP.abc

MSN.abc

FIREFOX.abc

IELOGIN.abc

IEPASS.abc

IEAUTO.abc

IEWEB.abc

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

updateservidorweb

##@@## ##@@## ##@@##

Windows\CurrentVersion\Uninstall\eDonkey2000

UNWISE.EXE

ntdll.dll

icon=shell32.dll,4

shellexecute=

autorun.inf

XX--XX--XX.txt

logs.dat

SQLite3.dll

$1.2.3

KWindows

UnitExecutarComandos

uftp

UrlMon

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps