Trojan.GenericKD.3684510_0c779688ca – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2984

The Trojan injects its code into the following process(es):

KS v19.exe:2992

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2984 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\KS v19.exe (77434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Windows\System32\drivers\etc\hosts (193 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7889.tmp (980 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xarkqjo (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7945.tmp (34885 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7945.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7889.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xarkqjo (0 bytes)
C:\Windows\System32\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:2984 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\IExplore\WWW_OpenURL]
"processname" = "iexplore.exe"
"WindowClassName" = "DDEMLMom"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "https://www.youtube.com/channel/UClUQuOZlC5lbq4-Z_FNlGGg?sub_confirmation=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5	File path
ad4cefa99f1c318bb41064329f37699e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\KS v19.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 111 bytes in size. The following strings are added to the hosts file listed below:

173.194.72.94	mediadisk.net
173.194.72.94	obla4ko.com
173.194.72.94	pihack.ru

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2984
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\KS v19.exe (77434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Windows\System32\drivers\etc\hosts (193 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7889.tmp (980 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xarkqjo (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7945.tmp (34885 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (Canada)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (Canada)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	5435392	4857344	5.54515	8274779dfd78a692ecffaafff079b5a4
.rsrc	5439488	110592	107008	3.48444	da8b17f6fc27dba4a3caeb8cabbb9252
.reloc	5550080	512	24	1.74051	26a79acc896fc01321b3f5ffb26f245b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a1625116.hostink.ru/Cheat/KS/MainScript.php?s=1&v=19T&u=[10F5-F7ED]	93.189.43.44
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==
hxxp://e6845.dscb1.akamaiedge.net/crls/gtglobal.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHNzUKtRZktz
hxxp://www3.l.google.com/GIAG2.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK
hxxp://plus.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://plus.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	173.194.32.164
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK	173.194.32.164
hxxp://pki.google.com/GIAG2.crl	173.194.44.71
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	173.194.32.164
hxxp://g.symcb.com/crls/gtglobal.crl	23.43.133.163
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHNzUKtRZktz	173.194.32.164
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
r6---sn-3c27ln7y.googlevideo.com	173.194.48.245
r2---sn-2puapox-ig3l.googlevideo.com	194.242.96.109
www.youtube.com	173.194.113.198
s.ytimg.com	216.58.214.238
www.googleadservices.com	173.194.113.218
www.google.com.ua	173.194.113.207
s2.googleusercontent.com	216.58.214.193
apis.google.com	173.194.122.194
s.youtube.com	216.58.209.174
googleads.g.doubleclick.net	173.194.113.217
yt3.ggpht.com	216.58.209.65
fonts.gstatic.com	173.194.113.207

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /crls/gtglobal.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcb.com

HTTP/1.1 200 OK

Server: Apache

ETag: "d3908add2f074be70e6d1b7f7814c032:1479862229"

Last-Modified: Wed, 23 Nov 2016 00:50:29 GMT

Date: Thu, 24 Nov 2016 22:06:58 GMT

Content-Length: 642

Connection: keep-alive

Content-Type: application/pkix-crl

0..~0..f0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161018104931Z..170101003431Z0..0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....4Z..020521134804Z0....6k..070711055050Z0....5...060809140549Z0....:...161018104931Z0....:...161018104712Z0...*.H...............BG.*.\O.a.......f..~.>..aB....UP0........o$.V.E...jC.W .X.....Q._.5.2....4...\.3..'i&7..A...S.7..s.e..5...k.....v.n..5.]..:I.......7`.{...I..B......s3p.2..q...\.C 3@#.`....CONE.v.........)9.>....o\X4.@*.@XA.f...8f.....l7....o..e...S.n.|..W.F....,......m.HTTP/1.1 200 OK..Server: Apache..ETag: "d3908add2f074be70e6d1b7f7814c032:1479862229"..Last-Modified: Wed, 23 Nov 2016 00:50:29 GMT..Date: Thu, 24 Nov 2016 22:06:58 GMT..Content-Length: 642..Connection: keep-alive..Content-Type: application/pkix-crl..0..~0..f0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161018104931Z..170101003431Z0..0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....4Z..020521134804Z0....6k..070711055050Z0....5...060809140549Z0....:...161018104931Z0....:...161018104712Z0...*.H...............BG.*.\O.a.......f..~.>..aB....UP0........o$.V.E...jC.W .X.....Q._.5.2....4...\.3..'i&7..A...S.7..s.e..5...k.....v.n..5.]..:I.......7`.{...I..B......s3p.2..q...\.C 3@#.`....CONE.v.........)9.>....o\X4.@*.@XA.f...8f.....l7....o..e...S.n.|..W.F...

<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "09f8024379c5446b8b18c11ffd85fc62:1480024835"

Last-Modified: Thu, 24 Nov 2016 22:00:35 GMT

Date: Thu, 24 Nov 2016 22:06:49 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl

0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161124214300Z..161204214300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............V.t2w.p.,..6.en.&......jp. .$..1.............uV)h..A...R.....J`.........W..-....R...._.!......2>....c~..X..fRy.........2..2.j.>.HTTP/1.1 200 OK..Server: Apache..ETag: "09f8024379c5446b8b18c11ffd85fc62:1480024835"..Last-Modified: Thu, 24 Nov 2016 22:00:35 GMT..Date: Thu, 24 Nov 2016 22:06:49 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161124214300Z..161204214300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............V.t2w.p.,..6.en.&......jp. .$..1.............uV)h..A...R.....J`.........W..-....R...._.!......2>....c~..X..fRy.........2..2.j.>...

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 19:28:53 GMT..Expires: Sat, 26 Nov 2016 19:28:53 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 182290..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A....

GET /GIAG2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: pki.google.com

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: application/pkix-crl

Date: Thu, 24 Nov 2016 21:37:11 GMT

Expires: Thu, 24 Nov 2016 22:37:11 GMT

Last-Modified: Wed, 23 Nov 2016 02:15:00 GMT

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Age: 1790

Cache-Control: public, max-age=3600

Accept-Ranges: none

Transfer-Encoding: chunked

334a..0.3F0.2....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..161123010003Z..161203010003Z0.1}0'..u.e.kl....160915211903Z0.0...U.......0'....._|.....160915211951Z0.0...U.......0'../....=.:..160915211941Z0.0...U.......0'..NH...M....160915211829Z0.0...U.......0'..;Jy..)l...160915211944Z0.0...U.......0'.....Y[.I...160915211321Z0.0...U.......0'..]tR..k.6..160915211814Z0.0...U.......0'...G.. G....160915212012Z0.0...U.......0'..@~}m:.....160915211902Z0.0...U.......0'..i..Hj#....160915211900Z0.0...U.......0'..1_..?.M...160915211841Z0.0...U.......0'...I..5.....160915212030Z0.0...U.......0'.......8.-..160915211750Z0.0...U.......0'..tR."g.....160915211936Z0.0...U.......0'.....x......160915211950Z0.0...U.......0'..[......U..160915211655Z0.0...U.......0'....Y.sO.#..160915211505Z0.0...U.......0'..i.?.D3.S..160915211611Z0.0...U.......0'..n..N......160915212018Z0.0...U.......0'..M,...w....160915211533Z0.0...U.......0'........h...160915211358Z0.0...U.......0'........{...160915211518Z0.0...U.......0'...q....}...160915211439Z0.0...U.......0'....|.......160915211959Z0.0...U.......0'.......(.t..160915211404Z0.0...U.......0'..!C........160915211535Z0.0...U.......0'..@..:.G.G..160915211352Z0.0...U.......0'..X...6.E...160915211953Z0.0...U.......0'..Es}.Vr....160915211801Z0.0...U.......0'......k..y..160915211632Z0.0...U.......0'..}2."...J..160915211541Z0.0...U.......0'...C4...<...160915211738Z0.0...U.......0'....;.<J....160915211606Z0.0...U.......0'..8.........160915211947Z0.0...U..

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHNzUKtRZktz HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Mon, 21 Nov 2016 18:37:22 GMT

Expires: Fri, 25 Nov 2016 18:37:22 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 271778

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161121130506Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..ssP.QfKs....20161121130506Z....20161128130506Z0...*.H.............M..G.m.. u}4p.0.X....lN[@...'......Fh.>.....x..h<< .....D...[.......3.S.LL...$PQ.!rP......0....b.../zZ....e.T..P..s...H...)D..t.o..0...Wi.....A!..% ...)k.......c.[...u..I.v..L..B.[s.;..)q.". G]H...\..z.m...bU..l......_g9........:Lt........2c,R.....w..4/..1HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Mon, 21 Nov 2016 18:37:22 GMT..Expires: Fri, 25 Nov 2016 18:37:22 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 271778..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161121130506Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..ssP.QfKs....20161121130506Z....20161128130506Z0...*.H.............M..G.m.. u}4p.0.X....lN[@...'......Fh.>.....x..h<< .....D...[.......3.S.LL...$PQ.!rP......0....b.../zZ....e.T..P..s...H...)D..t.o..0...Wi.....A!..% ...)k.......c.[...u..I.v..L..B.[s.;..)q.". G]H...\..z.m...bU..l......_g9........:Lt........2c,R.....w..4/..1....

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 03:31:31 GMT

Expires: Sat, 26 Nov 2016 03:31:31 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 239732

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161121190654Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161121190654Z....20161128190654Z0...*.H.............8k....H@....$.c1................(..(..q....4^.. .].VJ..3..3k.8i7F..Be..8....tL3.or....B.3b..16.......j..-,T.;..U.....J.4M.\..,.k.p=..H.....A..cB@.(s......I.........r.._.&(H.U..1o........5.^n..7.c.....y=&..YW/.y..#....*..]..n......*.'.3.....]....~..\......l....

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 03:31:31 GMT

Expires: Sat, 26 Nov 2016 03:31:31 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 239732

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161121190654Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161121190654Z....20161128190654Z0...*.H.............8k....H@....$.c1................(..(..q....4^.. .].VJ..3..3k.8i7F..Be..8....tL3.or....B.3b..16.......j..-,T.;..U.....J.4M.\..,.k.p=..H.....A..cB@.(s......I.........r.._.&(H.U..1o........5.^n..7.c.....y=&..YW/.y..#....*..]..n......*.'.3.....]....~..\......lHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 03:31:31 GMT..Expires: Sat, 26 Nov 2016 03:31:31 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 239732..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161121190654Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161121190654Z....20161128190654Z0...*.H.............8k....H@....$.c1................(..(..q....4^.. .].VJ..3..3k.8i7F..Be..8....tL3.or....B.3b..16.......j..-,T.;..U.....J.4M.\..,.k.p=..H.....A..cB@.(s......I.........r.._.&(H.U..1o........5.^n..7.c.....y=&..YW/.y..#....*..]..n......*.'.3.....]....~..\......l..

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 19:28:53 GMT..Expires: Sat, 26 Nov 2016 19:28:53 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 182290..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A....

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1

Cache-Control: max-age = 564348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.1

Content-Type: application/ocsp-response

Content-Length: 1362

content-transfer-encoding: binary

Cache-Control: max-age=548740, public, no-transform, must-revalidate

Last-Modified: Thu, 24 Nov 2016 06:31:16 GMT

Expires: Thu, 1 Dec 2016 06:31:16 GMT

Date: Thu, 24 Nov 2016 22:06:55 GMT

Connection: keep-alive

0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..20161124063116Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20161124063116Z....20161201063116Z0...*.H.............r..M,...R1....a.*m..b....z.tj$ a..3.J.../..(#..>....a..qnP....[.nSRU..Am..8_'K...r....."..%U...n...$..8F..n{..e.....N.-....e.]P..i`M{..OZ ..F.DZ...e..b....od..R..J.s[..............}.5.....`nw.^...j...K..m.<cE.......w..c.l-.o%.(.v@J`.....>q.....!.R.l)...t.,....0...0..|0..d........:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...151203170230Z..161214170230Z02100...U...'GeoTrust Global CA TGV OCSP Responder 40.."0...*.H.............0.........[.c.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D...*...Rx........mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^.P.!.3..t.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.............v4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H...............aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxua...C.X.S....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=..l...gf..L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>d.U......w.(\....v..9.z7.....J..;..'...u.Y...BB.@.2u.e..eW..J.U....

<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1

Cache-Control: max-age = 564348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.1

Content-Type: application/ocsp-response

Content-Length: 1362

content-transfer-encoding: binary

Cache-Control: max-age=548740, public, no-transform, must-revalidate

Last-Modified: Thu, 24 Nov 2016 06:31:16 GMT

Expires: Thu, 1 Dec 2016 06:31:16 GMT

Date: Thu, 24 Nov 2016 22:06:55 GMT

Connection: keep-alive

0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..20161124063116Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20161124063116Z....20161201063116Z0...*.H.............r..M,...R1....a.*m..b....z.tj$ a..3.J.../..(#..>....a..qnP....[.nSRU..Am..8_'K...r....."..%U...n...$..8F..n{..e.....N.-....e.]P..i`M{..OZ ..F.DZ...e..b....od..R..J.s[..............}.5.....`nw.^...j...K..m.<cE.......w..c.l-.o%.(.v@J`.....>q.....!.R.l)...t.,....0...0..|0..d........:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...151203170230Z..161214170230Z02100...U...'GeoTrust Global CA TGV OCSP Responder 40.."0...*.H.............0.........[.c.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D...*...Rx........mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^.P.!.3..t.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.............v4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H...............aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxua...C.X.S....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=..l...gf..L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>d.U......w.(\....v..9.z7.....J..;..'...u.Y...BB.@.2u.e..eW..J.U....

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHNzUKtRZktz HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 23 Nov 2016 18:55:57 GMT

Expires: Sun, 27 Nov 2016 18:55:57 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 97863

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161123130507Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..ssP.QfKs....20161123130507Z....20161130130507Z0...*.H..................{u/....)i..i..((..oX..)..1....>e..s....{'t......&...$.J.....M..y.....z..C'HQ....G7...l...JR..i.....'N.qB<.v.~4iYP....f|.;2...Y5..4x.[.v(..d-....... Xi.O.{..Z.O$3,.Z.. '.x....-M.....%.........\).8%.J{.........|..<63@...B....e.....~.......T^..TO..l(.v..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Wed, 23 Nov 2016 18:55:57 GMT..Expires: Sun, 27 Nov 2016 18:55:57 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 97863..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161123130507Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..ssP.QfKs....20161123130507Z....20161130130507Z0...*.H..................{u/....)i..i..((..oX..)..1....>e..s....{'t......&...$.J.....M..y.....z..C'HQ....G7...l...JR..i.....'N.qB<.v.~4iYP....f|.;2...Y5..4x.[.v(..d-....... Xi.O.{..Z.O$3,.Z.. '.x....-M.....%.........\).8%.J{.........|..<63@...B....e.....~.......T^..TO..l(.v......

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A......

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 19:28:53 GMT..Expires: Sat, 26 Nov 2016 19:28:53 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 182290..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A....

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Thu, 24 Nov 2016 22:07:31 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Thu, 24 Nov 2016 22:07:36 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha

<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "09f8024379c5446b8b18c11ffd85fc62:1480024835"

Last-Modified: Thu, 24 Nov 2016 22:00:35 GMT

Date: Thu, 24 Nov 2016 22:06:49 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl

0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161124214300Z..161204214300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............V.t2w.p.,..6.en.&......jp. .$..1.............uV)h..A...R.....J`.........W..-....R...._.!......2>....c~..X..fRy.........2..2.j.>.HTTP/1.1 200 OK..Server: Apache..ETag: "09f8024379c5446b8b18c11ffd85fc62:1480024835"..Last-Modified: Thu, 24 Nov 2016 22:00:35 GMT..Date: Thu, 24 Nov 2016 22:06:49 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161124214300Z..161204214300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............V.t2w.p.,..6.en.&......jp. .$..1.............uV)h..A...R.....J`.........W..-....R...._.!......2>....c~..X..fRy.........2..2.j.>...

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 19:28:53 GMT..Expires: Sat, 26 Nov 2016 19:28:53 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 182290..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A....

GET /GIAG2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: pki.google.com

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: application/pkix-crl

Date: Thu, 24 Nov 2016 21:37:11 GMT

Expires: Thu, 24 Nov 2016 22:37:11 GMT

Last-Modified: Wed, 23 Nov 2016 02:15:00 GMT

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Age: 1790

Cache-Control: public, max-age=3600

Accept-Ranges: none

Transfer-Encoding: chunked

334a..0.3F0.2....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..161123010003Z..161203010003Z0.1}0'..u.e.kl....160915211903Z0.0...U.......0'....._|.....160915211951Z0.0...U.......0'../....=.:..160915211941Z0.0...U.......0'..NH...M....160915211829Z0.0...U.......0'..;Jy..)l...160915211944Z0.0...U.......0'.....Y[.I...160915211321Z0.0...U.......0'..]tR..k.6..160915211814Z0.0...U.......0'...G.. G....160915212012Z0.0...U.......0'..@~}m:.....160915211902Z0.0...U.......0'..i..Hj#....160915211900Z0.0...U.......0'..1_..?.M...160915211841Z0.0...U.......0'...I..5.....160915212030Z0.0...U.......0'.......8.-..160915211750Z0.0...U.......0'..tR."g.....160915211936Z0.0...U.......0'.....x......160915211950Z0.0...U.......0'..[......U..160915211655Z0.0...U.......0'....Y.sO.#..160915211505Z0.0...U.......0'..i.?.D3.S..160915211611Z0.0...U.......0'..n..N......160915212018Z0.0...U.......0'..M,...w....160915211533Z0.0...U.......0'........h...160915211358Z0.0...U.......0'........{...160915211518Z0.0...U.......0'...q....}...160915211439Z0.0...U.......0'....|.......160915211959Z0.0...U.......0'.......(.t..160915211404Z0.0...U.......0'..!C........160915211535Z0.0...U.......0'..@..:.G.G..160915211352Z0.0...U.......0'..X...6.E...160915211953Z0.0...U.......0'..Es}.Vr....160915211801Z0.0...U.......0'......k..y..160915211632Z0.0...U.......0'..}2."...J..160915211541Z0.0...U.......0'...C4...<...160915211738Z0.0...U.......0'....;.<J....160915211606Z0.0...U.......0'..8.........160915211947Z0.0...U..

<<< skipped >>>

GET /Cheat/KS/MainScript.php?s=1&v=19T&u=[10F5-F7ED] HTTP/1.1

Host: a1625116.hostink.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Date: Thu, 24 Nov 2016 22:06:43 GMT

Server: Apache

X-Powered-By: PHP/5.6.23

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

49..OK.NO.NO.87aea278b261a1fb36e73cfcf56d8ade78ddc573828e03281f9d5c67b724f1cb..0..HTTP/1.1 200 OK..Date: Thu, 24 Nov 2016 22:06:43 GMT..Server: Apache..X-Powered-By: PHP/5.6.23..Transfer-Encoding: chunked..Content-Type: text/html; charset=UTF-8..49..OK.NO.NO.87aea278b261a1fb36e73cfcf56d8ade78ddc573828e03281f9d5c67b724f1cb..0..

GET /crls/gtglobal.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcb.com

HTTP/1.1 200 OK

Server: Apache

ETag: "d3908add2f074be70e6d1b7f7814c032:1479862229"

Last-Modified: Wed, 23 Nov 2016 00:50:29 GMT

Date: Thu, 24 Nov 2016 22:06:58 GMT

Content-Length: 642

Connection: keep-alive

Content-Type: application/pkix-crl

0..~0..f0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161018104931Z..170101003431Z0..0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....4Z..020521134804Z0....6k..070711055050Z0....5...060809140549Z0....:...161018104931Z0....:...161018104712Z0...*.H...............BG.*.\O.a.......f..~.>..aB....UP0........o$.V.E...jC.W .X.....Q._.5.2....4...\.3..'i&7..A...S.7..s.e..5...k.....v.n..5.]..:I.......7`.{...I..B......s3p.2..q...\.C 3@#.`....CONE.v.........)9.>....o\X4.@*.@XA.f...8f.....l7....o..e...S.n.|..W.F....,......m.HTTP/1.1 200 OK..Server: Apache..ETag: "d3908add2f074be70e6d1b7f7814c032:1479862229"..Last-Modified: Wed, 23 Nov 2016 00:50:29 GMT..Date: Thu, 24 Nov 2016 22:06:58 GMT..Content-Length: 642..Connection: keep-alive..Content-Type: application/pkix-crl..0..~0..f0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..161018104931Z..170101003431Z0..0....:...161018104555Z0....:~..161018104327Z0....4...031011141952Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....4Z..020521134804Z0....6k..070711055050Z0....5...060809140549Z0....:...161018104931Z0....:...161018104712Z0...*.H...............BG.*.\O.a.......f..~.>..aB....UP0........o$.V.E...jC.W .X.....Q._.5.2....4...\.3..'i&7..A...S.7..s.e..5...k.....v.n..5.]..:I.......7`.{...I..B......s3p.2..q...\.C 3@#.`....CONE.v.........)9.>....o\X4.@*.@XA.f...8f.....l7....o..e...S.n.|..W.F...

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGcrqhZHJmYK HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 22 Nov 2016 19:28:53 GMT

Expires: Sat, 26 Nov 2016 19:28:53 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 182290

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A..HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 22 Nov 2016 19:28:53 GMT..Expires: Sat, 26 Nov 2016 19:28:53 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 182290..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161122130653Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..g ..G&f.....20161122130653Z....20161129130653Z0...*.H..............|..Pvt.p..{.vix...\Z.....b..!....a......XM%...4.4..)~8....YI.....F.xOR....g5,5........?O..A.3..U..F.\L..U....... g-<......f.......V......$..'....g.?...k(....B...1#.M.v]4....G@.....|......B....6. kR..$.*f...f:..U.f.),.a...S.....p.z.)8G..G....x.......'%.A....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.10.1

Content-Type: application/ocsp-response

Content-Length: 1452

content-transfer-encoding: binary

Cache-Control: max-age=598888, public, no-transform, must-revalidate

Last-Modified: Thu, 24 Nov 2016 20:26:32 GMT

Expires: Thu, 1 Dec 2016 20:26:32 GMT

Date: Thu, 24 Nov 2016 22:07:42 GMT

Connection: keep-alive

0..........0..... .....0......0...0.........Yt...........z.(...20161124202632Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20161124202632Z....20161201202632Z0...*.H...............9..|ht.....R.].._./........].\...5..^..;.......4q[|.......?.$.EOM..u.x:/.......O/..;=.........*.;..#.`J...R.....tx...........`.........<3.<.\..w.....4Y.d.^..\f.}.b..P<*.v.}`.j_M.....b.B...(.o.X..I....p..l...()#....O_N 6...F.....f..<.6..A..Q....p-..7.........0...0...0..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 40.."0...*.H.............0..........K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?......g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.......gM...H..m..P..t (..)..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_2504:

.text

`.data

.rsrc

@.reloc

Bv.TBv

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

ÃºW1

.ApX/

H.ZAf

Ã°[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

iexplore.exe_2996:

.text

`.data

.rsrc

@.reloc

Bv.TBv

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

ÃºW1

.ApX/

H.ZAf

Ã°[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

KS v19.exe_2992:

.text

`.itext

`.data

.idata

.didata

.edata

@.tls

.rdata

@.reloc

B.rsrc

TArray

System.Types

System.UITypes

TWindowState

poPortrait

ssHorizontal

biClrImportant

tagMSG

Winapi.Windows

HKEY

TWMKey

MsgFiller

KeyData

KeyDataFiller

Keys

KeysFiller

MouseMsg

HitTestMouseMsgFiller

!"#$%&'(!)* ,-./0'

System.SysUtils

ENoMonitorSupportException

TArray

TFormatSettings.TEraInfo

IEnumerableh!@

TArray

TMarshaller.PDisposeRec

TMarshaller.TDisposeProc

TMarshaller.TDisposeRec

TMarshaller.IDisposer4!@

TMarshaller.TDisposer'

TMarshaller.TDisposer(

/TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

&TArray

System.Variants

Operator

System.Variantsp&@

EVariantBadIndexError

UhF%C

Uh.BC

Winapi.ActiveX

grfLocksSupported

TTimeSpanParser.TParseError

System.TimeSpan

System.SyncObjs

TFunc4!@

System.SyncObjsp

System.Generics.Defaults

IEqualityComparer4!@

IComparer4!@

TCustomComparer

System.Generics.Collections

doOwnsKeys

System.Rtti

GetIndexedProperties

GetIndexedProperty

GetDeclaredIndexedProperties

TMethodImplementation.TFloatReg

):TMethodImplementation.TInterceptFrame.:1

%TMethodImplementation.TInterceptFrame(

*TMethodImplementation.TFirstStageIntercept

%TMethodImplementation.PInterceptFrame@"D

*TMethodImplementation.PFirstStageIntercept

TMethodImplementation.TParamLoc

!TMethodImplementation.TInvokeInfoK

!TMethodImplementation.TInvokeInfo

TRttiIndexedPropertyS

TRttiIndexedProperty|/D

FIndexedProps

TArray

-TFunc>4!@

TArray

!TArray

(TArray

%TArray

TArray

3TArray

8TEnumerator(

8TEnumerator

8TEnumerable-

8TEnumerable

;TList.arrayofT

System.Generics.CollectionsX$D

6IComparer4!@

CTCollectionNotifyEvent

:TArrayManagerg

:TArrayManagerLXD

8IEnumerableh!@

=TList.TEmptyFunc4!@

>TList.TEnumerator5

>TList.TEnumerator

2TList&

2TList

"TArray

&TArray

-TPair

AKey

ATArray>

FTEnumerator>(

FTEnumerator>DlD

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

!IEqualityComparer4!@

&TCollectionNotifyEvent

/TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator`rD

TEnumerable-

TEnumerable

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

TArray

$TEnumerator(

$TEnumerator(yD

$TEnumerable-

$TEnumerablehzD

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

FOnKeyNotify

FKeyCollection

3TDictionary9

ContainsKey

3TDictionary

OnKeyNotify

TArray

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

System.Generics.CollectionsT

IEqualityComparer4!@

0TCollectionNotifyEvent

TArray

%TEnumerator(

%TEnumerator

%TEnumerable-

%TEnumerableX

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

OnKeyNotifyx

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

System.Generics.CollectionsH

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

#IComparer4!@

%TComparison4!@

#TComparer2

#TComparerd

,TArray>

$TEnumerator(

$TEnumeratorD(E

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer4!@

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManagerT,E

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator`/E

TList&

TList

-TArray>

7TArray>

.TArray>

0TArray>

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerable

)TList.arrayofT

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList

$TEnumerator(

$TEnumerator

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer4!@

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManager

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator

TList&

TListT

5TArray>

#TEnumerator(

#TEnumerator

#TEnumerable-

#TEnumerable

&TList.arrayofT

!IComparer4!@

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerableh!@

(TList.TEmptyFunc4!@

)TList.TEnumerator5

)TList.TEnumerator

TList&

TList@

*TEnumerator(

*TEnumerator4

*TEnumerable-

*TEnumerable

-TList.arrayofT

(IComparer4!@

5TCollectionNotifyEvent

,TArrayManagerg

,TArrayManagert

*IEnumerableh!@

/TList.TEmptyFunc4!@

0TList.TEnumerator5

0TList.TEnumerator

$TList&

$TListT

9TObjectDictionaryM

9TObjectDictionaryT)F

Uh.eF

8TComparison4!@

6TComparer2

6TComparert{G

>TMoveArrayManagerg

>TMoveArrayManagerT}G

E.TList`1.Pack$823$0$Intf4!@

E@TList`1.Pack$823$ActRec

System.RttiX$D

ITList>.arrayofT

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

TList.arrayofT

IComparer4!@

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumeratorx

TList&

TList

'TList.arrayofT

"IComparer4!@

&TArrayManagerg

&TArrayManager

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator

TList&

TListX

ITList>.arrayofT

System.Generics.Collections8

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>0

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

(TList.arrayofT

#IComparer4!@

'TArrayManagerg

'TArrayManager

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TList

TList.arrayofT

TArrayManagerg

TArrayManager

TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumeratorX

TList&

TList

ITList>.arrayofT

System.Generics.Collections,

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>|

$TComparison4!@

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManagerD

1.TList`1.Pack$823$0$Intf4!@

1@TList`1.Pack$823$ActRec

1@TList`1.Pack$823$ActRecX

&TComparison4!@

$TComparer2

$TComparerT

,TMoveArrayManagerg

,TMoveArrayManager

3.TList`1.Pack$823$0$Intf4!@

3@TList`1.Pack$823$ActRec

3@TList`1.Pack$823$ActRec(

$TComparison4!@

"TComparer2

"TComparer(

*TMoveArrayManagerg

*TMoveArrayManager

1.TList`1.Pack$823$0$Intf4!@

1@TList`1.Pack$823$ActRecH

1@TList`1.Pack$823$ActRec

#TComparison4!@

!TComparer2

!TComparer

)TMoveArrayManagerg

)TMoveArrayManager

0.TList`1.Pack$823$0$Intf4!@

0@TList`1.Pack$823$ActRec

*TComparison4!@

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManager|&H

7.TList`1.Pack$823$0$Intf4!@

7@TList`1.Pack$823$ActRec

FTComparison>4!@

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

S.TList`1.Pack$823$0$Intf>4!@

S@TList`1.Pack$823$ActRec>

S@TList`1.Pack$823$ActRec>81H

TComparison4!@

TComparer2

TComparerp3H

!TMoveArrayManagerg

!TMoveArrayManager

(.TList`1.Pack$823$0$Intf4!@

(@TList`1.Pack$823$ActRec

$TComparison4!@

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

1.TList`1.Pack$823$0$Intf4!@

1@TList`1.Pack$823$ActRec

FTComparison>4!@

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

S.TList`1.Pack$823$0$Intf>4!@

S@TList`1.Pack$823$ActRec>

S@TList`1.Pack$823$ActRec>TFH

System.Rtti8

%TComparison4!@

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManagerLJH

2.TList`1.Pack$823$0$Intf4!@

2@TList`1.Pack$823$ActRec

2@TList`1.Pack$823$ActRec`MH

TComparison4!@

TComparer2

TComparerTOH

TMoveArrayManagerg

TMoveArrayManager

'.TList`1.Pack$823$0$Intf4!@

'@TList`1.Pack$823$ActRec

FTComparison>4!@

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

S.TList`1.Pack$823$0$Intf>4!@

S@TList`1.Pack$823$ActRec>

S@TList`1.Pack$823$ActRec>h[H

System.Rtti,

,TDelegatedComparer8

,TDelegatedComparer

?TDelegatedComparer8

?TDelegatedComparerdgH

TDelegatedComparer8

TDelegatedComparer0iH

-TDelegatedComparer8

-TDelegatedComparer

TDelegatedComparer8

TDelegatedComparer

*TDelegatedComparer8

*TDelegatedComparer$nH

1TDelegatedComparer8

1TDelegatedComparer

MTDelegatedComparer>8

MTDelegatedComparer>|qH

"TDelegatedComparer8

"TDelegatedComparerhsH

TDelegatedComparer8

TDelegatedComparer

MTDelegatedComparer>8

MTDelegatedComparer>

,TDelegatedComparer8

,TDelegatedComparer

!TDelegatedComparer8

!TDelegatedComparer8zH

MTDelegatedComparer>8

MTDelegatedComparer>

System.TypInfo

mkOperatorOverload

PFieldExEntryX

TFieldExEntry

PVmtMethodExEntry\

TVmtMethodExEntry

$TArray

&TArray

TPropSetV

TPropSet

TPropSetV

TPropSetT

TPropSetK

TPropSet

TPropSetK

TPropSet@

TPropSetK

TPropSet

TPropSetK

TPropSet

TPropSetK

TPropSet

TPropSetV

TPropSet`

System.Classes

ssShift

htKeyword

EInvalidOperation

EInvalidOperation`

AOperator

System.ClassesL

TThread.TSynchronizeRecord

TThread.TSystemTimes

GetCPUUsage

TOperation

TObservers.TCanObserveEvent4!@

TObservers.TObserverAddedEvent4!@

Operation

FOnExecute

OnExecute

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable$

!TList.arrayofT

System.Generics.Collections4!@

IComparer4!@

)TCollectionNotifyEvent

TArrayManagerg

TArrayManager

IEnumerableh!@

#TList.TEmptyFunc4!@

$TList.TEnumerator5

$TList.TEnumerator

TList&

TListl

TThreadList&

TThreadListl

&TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

.TList.arrayofT

)IComparer4!@

6TCollectionNotifyEvent

-TArrayManagerg

-TArrayManager

IEnumerableh!@

0TList.TEmptyFunc4!@

1TList.TEnumerator5

1TList.TEnumerator

%TList&

%TList

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable$

TList.arrayofT

System.Generics.Collections4

IComparer4!@

&TCollectionNotifyEvent

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumerator

TList&

TListL

!TArray

&TEnumerator(

&TEnumeratorT

&TEnumerable-

&TEnumerable

)TList.arrayofT

System.Generics.Collections

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManagerp

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList8

3TPair

JTArray>

OTEnumerator>(

OTEnumerator>$

OTEnumerable>-

OTEnumerable>

?TDictionary.TItem

DTDictionary.TItemArray

!IEqualityComparer4!@

&TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumeratorD

TEnumerable-

TEnumerablep

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumerator

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollection

%TArray

*TEnumerator(

*TEnumerator( J

*TEnumerable-

*TEnumerablet!J

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator

JTDictionary.TValueCollection;

JTDictionary.TValueCollection

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumerator

9TDictionary9

9TDictionary

OnKeyNotify(

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerable`2J

/TList.arrayofT

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManagerX5J

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TListH:J

ELoginCredentialError@HJ

ELoginCredentialError

"TLoginCredentialService.TLoginFunc4!@

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

3TLoginCredentialService.TLoginCredentialEventObject:

3TLoginCredentialService.TLoginCredentialEventObject

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxy(LJ

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialServicepMJ

4TPair

KTArray>

PTEnumerator>(

PTEnumerator>

PTEnumerable>-

PTEnumerable>4]J

@TDictionary.TItem

ETDictionary.TItemArray

7TCollectionNotifyEvent

ITDictionary.TKeyEnumerator;

ITDictionary.TKeyEnumerator

ITDictionary.TKeyCollection;

ITDictionary.TKeyCollection

'TArray

,TEnumerator(

,TEnumerator4eJ

,TEnumerable-

,TEnumerable

KTDictionary.TValueEnumerator;

KTDictionary.TValueEnumerator

KTDictionary.TValueCollection;

KTDictionary.TValueCollection

JTDictionary.TPairEnumerator;

JTDictionary.TPairEnumerator lJ

:TDictionary9

:TDictionary nJ

Keys kJ

/TList.arrayofT

*IComparer4!@

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

TArray

%TEnumerator(

%TEnumerator

%TEnumerable-

%TEnumerable

(TList.arrayofT

#IComparer4!@

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManager

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TList

%TObjectList

%TObjectListh

TArray

%TEnumerator(

%TEnumerator4

%TEnumerable-

%TEnumerablet

(TList.arrayofT

System.Generics.Collectionsh

#IComparer4!@

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManagerH

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumeratorX

TList&

TList

%TThreadList&

%TThreadList

TArray

0TEnumerator(

0TEnumerator

0TEnumerable-

0TEnumerable

3TList.arrayofT

System.Generics.CollectionsDGJ

.IComparer4!@

;TCollectionNotifyEvent

2TArrayManagerg

2TArrayManagerL

0IEnumerableh!@

5TList.TEmptyFunc4!@

6TList.TEnumerator5

6TList.TEnumerator

*TList&

*TListT

7TArray>

>(

>

>-

>H

LTList>.arrayofT

GIComparer>4!@

GTCollectionNotifyEvent>

Item TList

>TArrayManager>g

>TArrayManager>

IIEnumerable>h!@

NTList>.TEmptyFunc4!@

OTList>.TEnumerator5

OTList>.TEnumeratorD

CTList>&

CTList>@

TList.Sort$1974$0$Intf4!@

TList.Sort$1974$ActRec

Uh.RK

!TArray

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerable

)TList.arrayofT

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList

&TThreadList&

&TThreadList

System.Classes

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable-

'TEnumerable

*TList.arrayofT

%IComparer4!@

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManager

'IEnumerableh!@

,TList.TEmptyFunc4!@

-TList.TEnumerator5

-TList.TEnumerator

!TList&

!TList

TArray

#TEnumerator(

#TEnumeratordRL

#TEnumerable-

#TEnumerable

&TList.arrayofT

!IComparer4!@

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManagerhVL

#IEnumerableh!@

(TList.TEmptyFunc4!@

)TList.TEnumerator5

)TList.TEnumeratorpYL

TList&

TList [L

#TThreadList&

#TThreadList

TComponent.Create@$2783$0$Intf4!@

&TComparison4!@

$TComparer2

$TComparer

-TDelegatedComparer8

-TDelegatedComparer

TComponent.Create@$2783$ActRec

#TComponent.GetObservers$2796$0$Intf4!@

#TComponent.GetObservers$2796$1$Intf4!@

#TComponent.GetObservers$2796$ActRec

7TLoginCredentialService.GetLoginCredentials$3070$0$Intf4!@

LPassword

7TLoginCredentialService.GetLoginCredentials$3070$ActRec

TComparison4!@

TComparer2

TComparer`1N

$TMoveArrayManagerg

$TMoveArrayManager

.TList`1.Pack$823$0$Intf4!@

@TList`1.Pack$823$ActRec

System.Classes4!@

TComparison4!@

)TComparer2

)TComparer

1TMoveArrayManagerg

1TMoveArrayManager

8.TList`1.Pack$823$0$Intf4!@

8@TList`1.Pack$823$ActRec

TComparison4!@

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager

(.TList`1.Pack$823$0$Intf4!@

(@TList`1.Pack$823$ActRec

System.Classes4

,TMoveArrayManagerg

,TMoveArrayManager

3.TList`1.Pack$823$0$Intf4!@

3@TList`1.Pack$823$ActRec

RTList>.arrayofT

MIComparer>4!@

ZTCollectionNotifyEvent>

Item3TPair

QTArrayManager>g

QTArrayManager>DKN

OIEnumerable>h!@

TTList>.TEmptyFunc4!@

UTList>.TEnumerator5

UTList>.TEnumerator

ITList>&

ITList>

-TList.arrayofT

(IComparer4!@

,TArrayManagerg

,TArrayManager0_N

*IEnumerableh!@

/TList.TEmptyFunc4!@

0TList.TEnumerator5

0TList.TEnumeratorPbN

$TList&

$TList

,TComparison4!@

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$823$0$Intf4!@

9@TList`1.Pack$823$ActRec@wN

9@TList`1.Pack$823$ActRec

STList>.arrayofT

System.Generics.Collections0ZJ

NIComparer>4!@

[TCollectionNotifyEvent>

Item4TPair

RTArrayManager>g

RTArrayManager>XzN

PIEnumerable>h!@

UTList>.TEmptyFunc4!@

VTList>.TEnumerator5

VTList>.TEnumerator

JTList>&

JTList>

,TComparison4!@

*TComparer2

*TComparerL

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$823$0$Intf4!@

9@TList`1.Pack$823$ActRec

9@TList`1.Pack$823$ActRec@

System.ClassesH

%TComparison4!@

#TComparer2

#TComparerP

TMoveArrayManagerg

TMoveArrayManager

2.TList`1.Pack$823$0$Intf4!@

2@TList`1.Pack$823$ActRec

%TComparison4!@

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager

2.TList`1.Pack$823$0$Intf4!@

2@TList`1.Pack$823$ActRec

System.Classesh

0TComparison4!@

.TComparer2

.TComparer

6TMoveArrayManagerg

6TMoveArrayManager

=.TList`1.Pack$823$0$Intf4!@

=@TList`1.Pack$823$ActRecd

=@TList`1.Pack$823$ActRec

System.ClassesDGJ

ITComparison>4!@

GTComparer>2

GTComparer>@

OTMoveArrayManager>g

OTMoveArrayManager>@

V.TList`1.Pack$823$0$Intf>4!@

V@TList`1.Pack$823$ActRec>

&TComparison4!@

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

3.TList`1.Pack$823$0$Intf4!@

3@TList`1.Pack$823$ActRec

'TComparison4!@

%TComparer2

%TComparer

-TMoveArrayManagerg

-TMoveArrayManager

4.TList`1.Pack$823$0$Intf4!@

4@TList`1.Pack$823$ActRec

#TComparison4!@

!TComparer2

!TComparer

)TMoveArrayManagerg

)TMoveArrayManager

0.TList`1.Pack$823$0$Intf4!@

0@TList`1.Pack$823$ActRec

%TDelegatedComparer8

%TDelegatedComparer

2TDelegatedComparer8

2TDelegatedComparerh

"TDelegatedComparer8

"TDelegatedComparer

OTComparison>4!@

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

\.TList`1.Pack$823$0$Intf>4!@

\@TList`1.Pack$823$ActRec>

\@TList`1.Pack$823$ActRec>@

TComparison4!@

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager4

(.TList`1.Pack$823$0$Intf4!@

(@TList`1.Pack$823$ActRec

(@TList`1.Pack$823$ActRec,

*TComparison4!@

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManager

7.TList`1.Pack$823$0$Intf4!@

7@TList`1.Pack$823$ActRec

3TDelegatedComparer8

3TDelegatedComparer

PTComparison>4!@

NTComparer>2

NTComparer>

VTMoveArrayManager>g

VTMoveArrayManager>

].TList`1.Pack$823$0$Intf>4!@

]@TList`1.Pack$823$ActRec>

]@TList`1.Pack$823$ActRec>h

System.Classes0ZJ

3TDelegatedComparer8

3TDelegatedComparer

,TDelegatedComparer8

,TDelegatedComparer

,TDelegatedComparer8

,TDelegatedComparer`

7TDelegatedComparer8

7TDelegatedComparer

PTDelegatedComparer>8

PTDelegatedComparer>

-TDelegatedComparer8

-TDelegatedComparer

.TDelegatedComparer8

.TDelegatedComparerh

*TDelegatedComparer8

*TDelegatedComparer

VTDelegatedComparer>8

VTDelegatedComparer>

"TDelegatedComparer8

"TDelegatedComparer

1TDelegatedComparer8

1TDelegatedComparerH

WTDelegatedComparer>8

WTDelegatedComparer>

System.Actions

FHelpKeyword

HelpKeyword|

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerable,

/TList.arrayofT

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager$

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumeratorP

&TList&

&TList

/TContainedActionList.EnumByCategory$3394$0$Intf4!@

/TContainedActionList.EnumByCategory$3394$ActRec

,TComparison4!@

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManagerT[O

9.TList`1.Pack$823$0$Intf4!@

9@TList`1.Pack$823$ActRec

3TDelegatedComparer8

3TDelegatedComparer

Winapi.Wincodec

DeleteKey

System.IniFiles

TStringHash.THashItem

System.IniFiles@

-TArray

2TEnumerator(

2TEnumerator

2TEnumerable-

2TEnumerableP

5TList.arrayofT

0IComparer4!@

=TCollectionNotifyEvent

4TArrayManagerg

4TArrayManagerp

2IEnumerableh!@

7TList.TEmptyFunc4!@

8TList.TEnumerator5

8TList.TEnumerator

,TList&

,TList

2TComparison4!@

0TComparer2

0TComparer\

8TMoveArrayManagerg

8TMoveArrayManager4

?.TList`1.Pack$823$0$Intf4!@

?@TList`1.Pack$823$ActRec

?@TList`1.Pack$823$ActRecl

9TDelegatedComparer8

9TDelegatedComparer

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg0

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome

System.Contnrs

IsShortCut

Vcl.ActnList

1.2.7

Ht.Ht3

Vcl.GraphUtil

System.Win.ComObj

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeyword\

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Uh.dS

Vcl.ControlsH

Vcl.StdCtrls

Vcl.StdCtrls5

Vcl.StdCtrls-

FPasswordChar

Vcl.StdCtrlsC

PasswordChar

OnKeyDownTGR

OnKeyPress

OnKeyUp

Vcl.StdCtrlsD

OnKeyUp(CT

TCustomButton.TButtonStyle

Vcl.StdCtrls;

Vcl.StdCtrls1

Vcl.StdCtrls

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindow

%TCustomEdit.ObserverAdded$3346$0$Intf4!@

%TCustomEdit.ObserverAdded$3346$ActRec|

%TCustomEdit.ObserverAdded$3346$ActRec4

)TCustomCheckBox.ObserverAdded$3558$0$Intf4!@

)TCustomCheckBox.ObserverAdded$3558$ActRec

)TCustomCheckBox.ObserverAdded$3558$ActRec` U

Winapi.ShlObj

Winapi.ShlObj$

Vcl.Printers

APort

Port

Vcl.ToolWin

Vcl.Clipbrd

Vcl.StdActns

Vcl.ComCtrls

Vcl.ComCtrls'

Vcl.ComCtrls;

Vcl.ComCtrls1

cdsShowKeyboardCues

Vcl.ComCtrls/

FArrowKeys

vsReport

Vcl.ComCtrls&

FCustomizeKeyName

Vcl.ComCtrlsV

CustomizeKeyName

FUpDownLeftPressed

FLeftPressed

System.HelpIntfs

HelpKeyword

UnderstandsKeyword

(TArray

-TEnumerator(

-TEnumerator

-TEnumerable-

-TEnumerable

0TList.arrayofT

System.Generics.Collections

IComparer4!@

8TCollectionNotifyEvent

/TArrayManagerg

/TArrayManager

-IEnumerableh!@

2TList.TEmptyFunc4!@

3TList.TEnumerator5

3TList.TEnumerator

'TList&

'TList

-TComparison4!@

TComparer2

TComparer

3TMoveArrayManagerg

3TMoveArrayManager

:.TList`1.Pack$823$0$Intf4!@

:@TList`1.Pack$823$ActRec

System.HelpIntfs

4TDelegatedComparer8

4TDelegatedComparerX

Vcl.Dialogs

FURL

Vcl.Dialogst

Uhb%X

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials

.TDefaultLoginCredentials.LoginEvent$835$0$Intf4!@

.TDefaultLoginCredentials.LoginEvent$835$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$837$0$Intf4!@

3TDefaultLoginCredentials.LoginEventUsrPw$837$ActRectaX

3TDefaultLoginCredentials.LoginEventUsrPw$837$ActRec

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.ExtCtrlsF

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

*TMouseTrackControlStyleHook.TMousePosition

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable-

'TEnumerable`

*TList.arrayofT

System.Generics.Collections0NY

%IComparer4!@

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManagerD

'IEnumerableh!@

,TList.TEmptyFunc4!@

-TList.TEnumerator5

-TList.TEnumerator\

!TList&

!TList

RTPair>

eTArray>>

jTEnumerator>>(

jTEnumerator>>0

jTEnumerable>>-

jTEnumerable>>

^TDictionary>.TItem

cTDictionary>.TItemArray

IEqualityComparer4!@

%TCollectionNotifyEvent

UTCollectionNotifyEvent>

Item!TList

TArray

TEnumerator(

TEnumerator\

TEnumerable-

TEnumerable

gTDictionary>.TKeyEnumerator;

gTDictionary>.TKeyEnumerator

gTDictionary>.TKeyCollection;

gTDictionary>.TKeyCollection

4TArray>

9TEnumerator>(

9TEnumerator>

9TEnumerable>-

9TEnumerable>0

iTDictionary>.TValueEnumerator;

iTDictionary>.TValueEnumerator

iTDictionary>.TValueCollection;

iTDictionary>.TValueCollection

hTDictionary>.TPairEnumerator;

hTDictionary>.TPairEnumerator\

XTDictionary>9

XTDictionary>

Keys@

2TPair

ETArray>

JTEnumerator>(

JTEnumerator>

JTEnumerable>-

JTEnumerable>

>TDictionary.TItem

CTDictionary.TItemArray

%TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumeratorD

TEnumerable-

TEnumerablep

GTDictionary.TKeyEnumerator;

GTDictionary.TKeyEnumerator

GTDictionary.TKeyCollection;

GTDictionary.TKeyCollection

%TArray

*TEnumerator(

*TEnumerator

*TEnumerable-

*TEnumerablel

ITDictionary.TValueEnumerator;

ITDictionary.TValueEnumerator

ITDictionary.TValueCollection;

ITDictionary.TValueCollection

HTDictionary.TPairEnumerator;

HTDictionary.TPairEnumerator

8TDictionary9

8TDictionary

OnKeyNotify$

>TObjectDictionaryM

>TObjectDictionary

3TPair

FTArray>

KTEnumerator>(

KTEnumerator>

KTEnumerable>-

KTEnumerable>

?TDictionary.TItem

DTDictionary.TItemArray

&IEqualityComparer4!@

TCollectionNotifyEvent

0TCollectionNotifyEvent

TArray

TEnumerator(

TEnumeratorL

TEnumerable-

TEnumerable

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumerator

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollection

TArray

%TEnumerator(

%TEnumerator@

%TEnumerable-

%TEnumerable

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator

JTDictionary.TValueCollection;

JTDictionary.TValueCollection

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumerator

9TDictionary9

9TDictionary

?TObjectDictionaryM

?TObjectDictionary

7TPair

JTArray>

OTEnumerator>(

OTEnumerator>

OTEnumerable>-

OTEnumerable>

CTDictionary.TItem

HTDictionary.TItemArray

4TCollectionNotifyEvent

LTDictionary.TKeyEnumerator;

LTDictionary.TKeyEnumerator8

LTDictionary.TKeyCollection;

LTDictionary.TKeyCollection

$TArray

)TEnumerator(

)TEnumerator

)TEnumerable-

)TEnumerable

NTDictionary.TValueEnumerator;

NTDictionary.TValueEnumeratord

NTDictionary.TValueCollection;

NTDictionary.TValueCollectionl

MTDictionary.TPairEnumerator;

MTDictionary.TPairEnumerator

=TDictionary9

=TDictionary

CTObjectDictionaryM

CTObjectDictionaryt Z

9TPair

LTArray>

QTEnumerator>(

QTEnumerator>

QTEnumerable>-

QTEnumerable>

ETDictionary.TItem

JTDictionary.TItemArray

NTDictionary.TKeyEnumerator;

NTDictionary.TKeyEnumerator$)Z

NTDictionary.TKeyCollection;

NTDictionary.TKeyCollection, Z

,TArray

1TEnumerator(

1TEnumerator

1TEnumerable-

1TEnumerable

PTDictionary.TValueEnumerator;

PTDictionary.TValueEnumerator

PTDictionary.TValueCollection;

PTDictionary.TValueCollection

OTDictionary.TPairEnumerator;

OTDictionary.TPairEnumerator

?TDictionary9

?TDictionary

6TArray

;TEnumerator(

;TEnumerator

;TEnumerable-

;TEnumerableh@Z

>TList.arrayofT

System.Generics.Collections`aY

9IComparer4!@

FTCollectionNotifyEvent

Item#TStyleManager.TStyleClassDescriptor

=TArrayManagerg

=TArrayManager

;IEnumerableh!@

@TList.TEmptyFunc4!@

ATList.TEnumerator5

ATList.TEnumerator,GZ

5TList&

5TList

*TArray

/TEnumerator(

/TEnumerator

/TEnumerable-

/TEnumerable

2TList.arrayofT

System.Generics.Collections

-IComparer4!@

:TCollectionNotifyEvent

1TArrayManagerg

1TArrayManager

/IEnumerableh!@

4TList.TEmptyFunc4!@

5TList.TEnumerator5

5TList.TEnumerator4^Z

)TList&

)TList

'TArray

,TEnumerator(

,TEnumerator4mZ

,TEnumerable-

,TEnumerable

/TList.arrayofT

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TListpvZ

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

#TList.arrayofT

IComparer4!@

TCollectionNotifyEvent

"TArrayManagerg

"TArrayManager

IEnumerableh!@

%TList.TEmptyFunc4!@

&TList.TEnumerator5

&TList.TEnumerator

TList&

TList\

'TComparison4!@

%TComparer2

%TComparer8

-TMoveArrayManagerg

-TMoveArrayManager

4.TList`1.Pack$823$0$Intf4!@

4@TList`1.Pack$823$ActRec

Vcl.Themes0NY

mTList>>.arrayofT

hIComparer>>4!@

uTCollectionNotifyEvent>>

ItemRTPair>

lTArrayManager>>g

lTArrayManager>>

jIEnumerable>>h!@

oTList>>.TEmptyFunc4!@

pTList>>.TEnumerator5

pTList>>.TEnumerator

dTList>>&

dTList>>H

TList.arrayofT

System.Generics.Collections$

IComparer4!@

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumeratorl

TList&

TList

>.arrayofT

7IComparer>4!@

;TArrayManager>g

;TArrayManager>

9IEnumerable>h!@

>TList>.TEmptyFunc4!@

?TList>.TEnumerator5

?TList>.TEnumerator

3TList>&

3TList>

MTList>.arrayofT

HIComparer>4!@

UTCollectionNotifyEvent>

Item2TPair

LTArrayManager>g

LTArrayManager>

JIEnumerable>h!@

OTList>.TEmptyFunc4!@

PTList>.TEnumerator5

PTList>.TEnumerator

DTList>&

DTList>

-TList.arrayofT

(IComparer4!@

,TArrayManagerg

,TArrayManager

*IEnumerableh!@

/TList.TEmptyFunc4!@

0TList.TEnumerator5

0TList.TEnumerator

$TList&

$TList

NTList>.arrayofT

IIComparer>4!@

VTCollectionNotifyEvent>

Item3TPair

MTArrayManager>g

MTArrayManager>

KIEnumerable>h!@

PTList>.TEmptyFunc4!@

QTList>.TEnumerator5

QTList>.TEnumeratorH^]

ETList>&

ETList>H`]

#TList.arrayofT

System.Generics.CollectionsP

IComparer4!@

"TArrayManagerg

"TArrayManagerTn]

IEnumerableh!@

%TList.TEmptyFunc4!@

&TList.TEnumerator5

&TList.TEnumeratorPq]

TList&

TList

(TList.arrayofT

#IComparer4!@

'TArrayManagerg

'TArrayManager

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TListL

RTList>.arrayofT

MIComparer>4!@

ZTCollectionNotifyEvent>

Item7TPair

QTArrayManager>g

QTArrayManager>L

OIEnumerable>h!@

TTList>.TEmptyFunc4!@

UTList>.TEnumerator5

UTList>.TEnumerator

ITList>&

ITList>

,TList.arrayofT

'IComparer4!@

TArrayManagerg

TArrayManager4

)IEnumerableh!@

.TList.TEmptyFunc4!@

/TList.TEnumerator5

/TList.TEnumeratorT

#TList&

#TList

TTList>.arrayofT

System.Generics.Collectionsx"Z

OIComparer>4!@

\TCollectionNotifyEvent>

Item9TPair

STArrayManager>g

STArrayManager>X

QIEnumerable>h!@

VTList>.TEmptyFunc4!@

WTList>.TEnumerator5

WTList>.TEnumerator

KTList>&

KTList>$

4TList.arrayofT

System.Generics.Collections

/IComparer4!@

3TArrayManagerg

3TArrayManagerd

1IEnumerableh!@

6TList.TEmptyFunc4!@

7TList.TEnumerator5

7TList.TEnumerator

TList&

TListp

;TComparison4!@

9TComparer2

9TComparerp

ATMoveArrayManagerg

ATMoveArrayManagerX

H.TList`1.Pack$823$0$Intf4!@

H@TList`1.Pack$823$ActRec

Vcl.Themes`aY

/TComparison4!@

-TComparer2

-TComparer

5TMoveArrayManagerg

5TMoveArrayManager

<.tlist>4!@

Vcl.Themes

,TComparison4!@

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$823$0$Intf4!@

9@TList`1.Pack$823$ActRecP

9@TList`1.Pack$823$ActRec

TComparison4!@

TComparer2

TComparer

&TMoveArrayManagerg

&TMoveArrayManager

-.TList`1.Pack$823$0$Intf4!@

-@TList`1.Pack$823$ActRec

.TDelegatedComparer8

.TDelegatedComparer

jTComparison>>4!@

hTComparer>>2

hTComparer>>

pTMoveArrayManager>>g

pTMoveArrayManager>>

w.TList`1.Pack$823$0$Intf>>4!@

w@TList`1.Pack$823$ActRec>>

TComparison4!@

TComparer2

TComparer

TMoveArrayManagerg

TMoveArrayManager

'.TList`1.Pack$823$0$Intf4!@

'@TList`1.Pack$823$ActRec

Vcl.Themes$

9TComparison>4!@

7TComparer>2

7TComparer>

?TMoveArrayManager>g

?TMoveArrayManager>

F.TList`1.Pack$823$0$Intf>4!@

F@TList`1.Pack$823$ActRec>

JTComparison>4!@

HTComparer>2

HTComparer>L

PTMoveArrayManager>g

PTMoveArrayManager>T

W.TList`1.Pack$823$0$Intf>4!@

W@TList`1.Pack$823$ActRec>

Vcl.Themes4

*TComparison4!@

(TComparer2

(TComparer ^

0TMoveArrayManagerg

0TMoveArrayManager

7.TList`1.Pack$823$0$Intf4!@

7@TList`1.Pack$823$ActRec

KTComparison>4!@

ITComparer>2

ITComparer>8'^

QTMoveArrayManager>g

QTMoveArrayManager>@)^

X.TList`1.Pack$823$0$Intf>4!@

X@TList`1.Pack$823$ActRec>

TComparison4!@

TComparer2

TComparer

&TMoveArrayManagerg

&TMoveArrayManager

-.TList`1.Pack$823$0$Intf4!@

-@TList`1.Pack$823$ActRec

Vcl.ThemesP

%TComparison4!@

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManagerp7^

2.TList`1.Pack$823$0$Intf4!@

2@TList`1.Pack$823$ActRec

OTComparison>4!@

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

\.TList`1.Pack$823$0$Intf>4!@

\@TList`1.Pack$823$ActRec>

\@TList`1.Pack$823$ActRec>TB^

)TComparison4!@

'TComparer2

'TComparer

/TMoveArrayManagerg

/TMoveArrayManagerhF^

6.TList`1.Pack$823$0$Intf4!@

6@TList`1.Pack$823$ActRec

QTComparison>4!@

OTComparer>2

OTComparer>

WTMoveArrayManager>g

WTMoveArrayManager>

^.TList`1.Pack$823$0$Intf>4!@

^@TList`1.Pack$823$ActRec>

^@TList`1.Pack$823$ActRec>dQ^

Vcl.Themesx"Z

1TComparison4!@

/TComparer2

/TComparer

7TMoveArrayManagerg

7TMoveArrayManager

>.TList`1.Pack$823$0$Intf4!@

>@TList`1.Pack$823$ActRec

Vcl.Themes

BTDelegatedComparer8

BTDelegatedComparer(Z^

6TDelegatedComparer8

6TDelegatedComparer

3TDelegatedComparer8

3TDelegatedComparer

'TDelegatedComparer8

'TDelegatedComparerl_^

qTDelegatedComparer>>8

qTDelegatedComparer>>

!TDelegatedComparer8

!TDelegatedComparer

@TDelegatedComparer>8

@TDelegatedComparer>

QTDelegatedComparer>8

QTDelegatedComparer>

1TDelegatedComparer8

1TDelegatedComparer

RTDelegatedComparer>8

RTDelegatedComparer>Lj^

'TDelegatedComparer8

'TDelegatedComparer@l^

,TDelegatedComparer8

,TDelegatedComparer

VTDelegatedComparer>8

VTDelegatedComparer>

0TDelegatedComparer8

0TDelegatedComparer

XTDelegatedComparer>8

XTDelegatedComparer>8s^

8TDelegatedComparer8

8TDelegatedComparer

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeysL

AutoHotkeys

System.Win.TaskbarCore

Vcl.Forms

ssHotTrack

Vcl.Forms;

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState

Vcl.Formsc

KeyPreviewt,R

TApplication.TBiDiKeyboard

BiDiKeyboard

NonBiDiKeyboard

BiDiKeyboardHKL

NonBiDiKeyboardHKL

SetBiDiKeyboard

SetNonBiDiKeyboard

GetBidiKeyboard

GetNonBidiKeyboard

ApplyBiDiKeyboardLayout

ApplyNonBiDiKeyboardLayout

Vcl.FormsP

FBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

OnActionExecute

!TScrollingStyleHook.TScrollWindow6

!TScrollingStyleHook.TScrollWindow

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

Vcl.Forms0

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHookl

EnterWithKeyboard

Vcl.Imaging.jpeg

TsWindowShowMode

Vcl.Buttons

Vcl.Buttons!

Vcl.Buttons4

TList.arrayofT

IComparer4!@

TArrayManagerg

TArrayManagert

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumerator\

TList&

TList

Vcl.Mask

EInvalidGridOperation

Vcl.Grids

goAlwaysShowEditor

%TCustomGrid.ObserverAdded$6305$0$Intf4!@

%TCustomGrid.ObserverAdded$6305$1$Intf4!@

%TCustomGrid.ObserverAdded$6305$ActRec`

%TCustomGrid.ObserverAdded$6305$ActRec

TacMenuSupport&

TacMenuSupport

ControlsShifted

Uh.we

UpdateIconsIndexes

TacMDIWnd'

TacMDIWnd

HandleAlphaCmd

Vcl.Imaging.pngimage

fKeyword

csIndexed

FCrToRedTable

FCrToGreenTable

3333333

TsShowTimerL

TsShowTimer

ssWebBtn

ssProgressH

ssHint

TsShadowMode

TsShadowG

TsShadow

UpdateIndexes

HandleOwnerMsg

TAddItemExEvent

LeftPressed

acInMouseMsg

IsControlSupported

CurLeft

ShTtp

|$(;

pcWebText

pcWebTextHot

pcEditText_Bypassed

pcEditBG_Bypassed

TacScrollBarsSupport6

TacScrollBarsSupporth

TacButtonsSupport6

TacButtonsSupport

TacLabelsSupport6

TacLabelsSupport

FKeyList

FMenuSupport

FButtonsSupport

FLabelsSupport

InitMaskIndexes

InitConstantIndexes

MenuSupport

KeyList

Vcl.AxCtrls

Vcl.OleCtrls

LicenseKey

Uh~%s

Vcl.OleServer

'TServerEventDispatch.Invoke$7334$0$Intf4!@

'TServerEventDispatch.Invoke$7334$ActRec

FOPT_READPAGE_EXECUTEREAD

FOPT_READPAGE_EXECUTEREADWRITE

OPT_READPAGE_EXECUTEREAD

OPT_READPAGE_EXECUTEREADWRITE

FProccessHandle

ProccessHandle

AMsg

EIdCanNotBindPortInRange

EIdCanNotBindPortInRangeXxs

EIdInvalidPortRange

Uh.zt

CheckIPVersionSupport

VPort

WSGetServByPort

APortNumber

AddServByPortToList

TIdSocketListWindows4

TIdSocketListWindows

IdStackWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindowsd

EIdIPVersionUnsupported

FSourcePort

FDestPort

SourcePort

DestPort

EIdPortRequired

EIdTCPConnectionErrorpRu

EIdTCPConnectionErrorDRu

EIdObjectTypeNotSupported4Su

EIdObjectTypeNotSupported

IPAsStringU

QuoteHTTP

IdHTTPHeaderInfo

FPassword

FPort

ProxyPassword

ProxyPort

TIdMetaHTTPEquivE

ProcessMetaHTTPEquiv

TIdMetaHTTPEquiv

ftpTransfer

ftpReady

ftpAborted

VMsgEnd

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax

PeerPort

"EIdTransparentProxyUDPNotSupported

OpenUDP

CloseUDP

RecvFromUDP

VPeerPort

SendToUDP

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

TIdTCPConnectionD(x

IdTCPConnection

LastCmdResult

FBoundPort

FBoundPortMax

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustom

IdTCPClient

BoundPort

BoundPortMax

BoundPortMin

TIdTCPClient

TIdTCPClientTDx

%EIdSocksUDPNotSupportedBySOCKSVersionTOx

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

FUDPSocksAssociation

Uh.xx

FDefaultPort

DefaultPort

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

URLDecode

URLEncode

FHttpOnly

HttpOnly

AURL

EIdUnsupportedOperation

EIdUnsupportedOperationhRy

EIdUnsupportedTransfer

EIdUnsupportedTransfer0Sy

EIdUnsupportedEncoding

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYIDd

X509_PUBKEY

public_key

PX509_PUBKEYL

X509_CERT_AUX

PX509_CERT_AUX

cert_info

ex_nscert

get_cert_methods

cert_crl

lookup_certs

ppem_password_cb

algorithm_mkey

key_arg_length

key_arg

master_key_length

master_key

sess_cert

login

Ptlsext_ticket_key_cba

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

new_mac_pkey_type

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile

CertFile

KeyFile

LoadRootCert

LoadCert

fPeerCert

PeerCert|bz

fOnGetPassword

fOnGetPasswordEx

OnGetPassword

OnGetPasswordEx|>z

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertErrortgz

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

SEC_GET_KEY_FN

KeyVer

pGetKeyFn

pvGetKeyArgument

CHANGE_PASSWORD_FN_W4

pszOldPassword

pszNewPassword

EXPORT_SECURITY_CONTEXT_FN

IMPORT_SECURITY_CONTEXT_FN_WX

ExportSecurityContext

ImportSecurityContextW

ChangeAccountPasswordW

aPassword

TIdHTTPWhatsNext

wnGoToURL

IdHTTP

TIdHTTPConnectionType

TIdHTTPOption

hoNoParseMetaHTTPEquiv

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

FMetaHTTPEquiv

TIdHTTPResponse5

AHTTP

TIdHTTPResponseLI{

MetaHTTPEquiv

TIdHTTPRequest5

TIdHTTPRequest|L{

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTPhQ{

HTTPOptions

TIdHTTP

TIdHTTPTb{

EIdHTTPProtocolExceptionn

EIdHTTPProtocolExceptionhg{

OnKeyUpTDR

ArrowKeys

IdHTTP1

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

System.Win.ComConst

System.VarUtils

System.SysConst

System.Internal.ExcUtils

System.Character

System.RTLConsts

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.AnsiStrings

System.StrUtils

System.Math

System.Diagnostics

Winapi.Messages

Winapi.PenInputPanel

Winapi.MsInkAut

Winapi.TpcShrd

Vcl.Consts

System.ZLib

System.Win.Crtl

System.UIConsts

System.IOUtils

System.DateUtils

System.Masks

Winapi.Dwmapi

Winapi.UxTheme

Winapi.CommCtrl

Winapi.MultiMon

Winapi.Dlgs

Winapi.MSXMLIntf

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Winapi.CommDlg

Vcl.ComStrs

Winapi.WinSpool

Vcl.ListActns

Winapi.RichEdit

Winapi.FlatSB

System.Win.Taskbar

Winapi.Imm

System.WideStrUtils

Vcl.Imaging.JConsts

Vcl.Imaging.pnglang

Vcl.ExtDlgs

Vcl.FileCtrl

System.MaskUtils

Winapi.WinSock

Winapi.IpHlpApi

Winapi.IpRtrMib

Winapi.IpTypes

IdTCPServer

IdCustomTCPServer

Winapi.TlHelp32

Vcl.OleConst

System.Win.StdVCL

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

1.2.3

If you have a key for this skin, please insert it in the KeyList.

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

KGS!@#$%x

rSL@.Ide

SL1.IfkTBYNW

E.FHY

cTB]NPbpD.TUWT

}Bv.TBv

?456789:;

!"#$%&'()* ,-./0123

DBv}.BvsuAv{ Bv

DBv}.Bv

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

user32.dll

kernel32.dll

keybd_event

UnhookWindowsHookEx

SetWindowsHookExW

SetKeyboardState

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

SetViewportExtEx

GetViewportOrgEx

version.dll

GetCPInfoExW

GetCPInfo

RegUnLoadKeyW

RegSaveKeyW

RegRestoreKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

ole32.dll

comctl32.dll

msvcrt.dll

shell32.dll

SHFileOperationW

ShellExecuteExW

ShellExecuteW

winspool.drv

Kernel32.dll

wtsapi32.dll

msimg32.dll

RegDeleteKeyExW

windowscodecs.dll

uxtheme.dll

imm32.dll

DWMAPI.DLL

Project1.exe

? ?$?(?,?0?4?8?`?~?

60646\6`6

?)?0?:?>?[?

?!?%?)?-?1?5?

2%2u2

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps