Trojan.Win32.IEDummy_22d8d7a549 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:396

The Trojan injects its code into the following process(es):

MonsterEngine.exe:616

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:396 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1 bytes)
%System%\drivers\etc\hosts (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MonsterEngine.exe (46325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (49181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xhubehi (196 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xhubehi (0 bytes)

The process MonsterEngine.exe:616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\findByte.dll (8 bytes)

Registry activity

The process %original file name%.exe:396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 00 28 E6 CC 4B 61 72 7F 3E C1 18 88 02 F6 53"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"MonsterEngine.exe" = "MonsterEngine"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process MonsterEngine.exe:616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 90 AF 7D 95 92 B7 1A F8 23 C1 43 E8 84 99 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
c52c36dd19ecc4951741b4990a1fa3e3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\MonsterEngine.exe
a2cc56a286309a4bc7f9313a38164ed7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\findByte.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 151 bytes in size. The following strings are added to the hosts file listed below:

173.194.71.100	hack-games-vk.ru
173.194.71.100	baza.hack-games-vk.ru
173.194.71.100	forum-hack-games-vk.ru

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:396
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1 bytes)
%System%\drivers\etc\hosts (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MonsterEngine.exe (46325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (49181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xhubehi (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\findByte.dll (8 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	7163904	6692864	5.54516	e05be7358d03625c869de882d80b6c83
.rsrc	7168000	24576	24064	3.91224	bb868f62d078c7a7ce7b1a8fecdd1de6
.reloc	7192576	512	24	1.82008	24ebd808bce3899f1dab730cdd4d0504

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://youtube-ui.l.google.com/channel/UCobHV8Cy1NhUv9UaNkur-Nw?sub_confirmation=1&feature=iv&src_vid=ly48lw27f0Y&annotation_id=annotation_139174861
hxxp://www.youtube.com/channel/UCobHV8Cy1NhUv9UaNkur-Nw?sub_confirmation=1&feature=iv&src_vid=ly48lw27f0Y&annotation_id=annotation_139174861	173.194.113.193
ssl.gstatic.com	216.58.209.163
s.ytimg.com	173.194.116.128
accounts.google.com	216.58.209.173
yt3.ggpht.com	216.58.209.161
fonts.gstatic.com	216.58.209.163

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /channel/UCobHV8Cy1NhUv9UaNkur-Nw?sub_confirmation=1&feature=iv&src_vid=ly48lw27f0Y&annotation_id=annotation_139174861 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youtube.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Wed, 06 Jan 2016 21:57:00 GMT

Server: gwiseguy/2.0

X-XSS-Protection: 1; mode=block; report=hXXps://VVV.google.com/appserve/security-bugs/log/youtube

Content-Length: 0

Location: hXXps://VVV.youtube.com/channel/UCobHV8Cy1NhUv9UaNkur-Nw?sub_confirmation=1&feature=iv&src_vid=ly48lw27f0Y&annotation_id=annotation_139174861

P3P: CP="This is not a P3P policy! See hXXp://support.google.com/accounts/answer/151657?hl=en for more info."

Cache-Control: no-cache

Content-Type: text/html; charset=utf-8

Expires: Tue, 27 Apr 1971 19:44:06 EST

X-Content-Type-Options: nosniff

Set-Cookie: YSC=akg0E0pEn3o; path=/; domain=.youtube.com; httponly

Set-Cookie: VISITOR_INFO1_LIVE=YSg1vOXgF5E; path=/; domain=.youtube.com; expires=Tue, 06-Sep-2016 09:50:00 GMT; httponly

HTTP/1.1 301 Moved Permanently..Date: Wed, 06 Jan 2016 21:57:00 GMT..Server: gwiseguy/2.0..X-XSS-Protection: 1; mode=block; report=hXXps://www.google.com/appserve/security-bugs/log/youtube..Content-Length: 0..Location: hXXps://VVV.youtube.com/channel/UCobHV8Cy1NhUv9UaNkur-Nw?sub_confirmation=1&feature=iv&src_vid=ly48lw27f0Y&annotation_id=annotation_139174861..P3P: CP="This is not a P3P policy! See hXXp://support.google.com/accounts/answer/151657?hl=en for more info."..Cache-Control: no-cache..Content-Type: text/html; charset=utf-8..Expires: Tue, 27 Apr 1971 19:44:06 EST..X-Content-Type-Options: nosniff..Set-Cookie: YSC=akg0E0pEn3o; path=/; domain=.youtube.com; httponly..Set-Cookie: VISITOR_INFO1_LIVE=YSg1vOXgF5E; path=/; domain=.youtube.com; expires=Tue, 06-Sep-2016 09:50:00 GMT; httponly..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_948:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

MonsterEngine.exe_616:

.text

`.itext

`.data

.idata

.didata

.edata

@.tls

.rdata

@.mEngineO

.mEngine

.reloc

@.rsrc

TArray

System.Types

System.UITypes

TWindowState

poPortrait

ssHorizontal

biClrImportant

tagMSG

Winapi.Windows

HKEY

TWMKey

MsgFiller

KeyData

KeyDataFiller

Keys

KeysFiller

MouseMsg

HitTestMouseMsgFiller

!"#$%&'(!)* ,-./0'

System.SysUtils

ENoMonitorSupportException

TArray

TFormatSettings.TEraInfo

IEnumerableh!@

TArray

TMarshaller.PDisposeRec|$B

TMarshaller.TDisposeProch$B

TMarshaller.TDisposeRec

TMarshaller.IDisposer4!@

TMarshaller.TDisposer'

TMarshaller.TDisposer

/TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

&TArray

System.Variants

Operator

System.Variantsp&@

EVariantBadVarTypeErrorD%C

EVariantBadIndexError,&C

EVariantBadIndexError

System.VariantsD!C

Winapi.ActiveX

grfLocksSupported

TTimeSpanParser.TParseError

System.TimeSpan

System.SyncObjs

TFunc4!@

System.SyncObjsp

System.Generics.Defaults

IEqualityComparer4!@

IComparer4!@

TCustomComparer

System.Generics.Collections

doOwnsKeys

System.Rtti

GetIndexedProperties

GetIndexedProperty

GetDeclaredIndexedProperties

TMethodImplementation.TFloatReg

):TMethodImplementation.TInterceptFrame.:1

%TMethodImplementation.TInterceptFrame(

*TMethodImplementation.TFirstStageIntercept

%TMethodImplementation.PInterceptFrame 1D

*TMethodImplementation.PFirstStageIntercept

TMethodImplementation.TParamLoc

!TMethodImplementation.TInvokeInfoK

!TMethodImplementation.TInvokeInfo

TRttiIndexedPropertyS

TRttiIndexedProperty\>D

FIndexedProps

TArray

-TFunc>4!@

TArray

!TArray

(TArray

%TArray

TArray

3TArray

8TEnumerator(

8TEnumerator

8TEnumerable-

8TEnumerable

;TList.arrayofT

System.Generics.Collections83D

6IComparer4!@

CTCollectionNotifyEvent

:TArrayManagerg

:TArrayManager,gD

8IEnumerableh!@

=TList.TEmptyFunc4!@

>TList.TEnumerator5

>TList.TEnumerator

2TList&

2TListdlD

"TArray

&TArray

-TPair

AKey

ATArray>

FTEnumerator>(

FTEnumerator>${D

FTEnumerable>-

FTEnumerable>

9TDictionary.TItem

>TDictionary.TItemArray

!IEqualityComparer4!@

&TCollectionNotifyEvent

/TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator@

TEnumerable-

TEnumerablel

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

TArray

$TEnumerator(

$TEnumerator

$TEnumerable-

$TEnumerable@

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

FOnKeyNotify

FKeyCollection

3TDictionary9

ContainsKey

3TDictionary

OnKeyNotify

TArray

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>-

FTEnumerable>t

9TDictionary.TItem

>TDictionary.TItemArray

IEqualityComparer4!@

0TCollectionNotifyEvent

TArray

%TEnumerator(

%TEnumeratorx

%TEnumerable-

%TEnumerable

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator,

3TDictionary9

3TDictionary

Keys4

OnKeyNotify@

-TPair

ATArray>

FTEnumerator>(

FTEnumerator>

FTEnumerable>-

FTEnumerable>T

9TDictionary.TItem

>TDictionary.TItemArray

BTDictionary.TKeyEnumerator;

BTDictionary.TKeyEnumerator

BTDictionary.TKeyCollection;

BTDictionary.TKeyCollection

DTDictionary.TValueEnumerator;

DTDictionary.TValueEnumerator

DTDictionary.TValueCollection;

DTDictionary.TValueCollection

CTDictionary.TPairEnumerator;

CTDictionary.TPairEnumerator

3TDictionary9

3TDictionary

OnKeyNotify

#IComparer4!@

%TComparison4!@

#TComparer2

#TComparer

,TArray>

$TEnumerator(

$TEnumerator|6E

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer4!@

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManager

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator

TList&

TListL?E

-TArray>

7TArray>

.TArray>

0TArray>

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerableD

)TList.arrayofT

System.Generics.Collectionsd D

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator0

TList&

TList

$TEnumerator(

$TEnumerator

$TEnumerable-

$TEnumerable

'TList.arrayofT

"IComparer4!@

/TCollectionNotifyEvent

&TArrayManagerg

&TArrayManager

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator

TList&

TList

5TArray>

#TEnumerator(

#TEnumerator

#TEnumerable-

#TEnumerable

&TList.arrayofT

!IComparer4!@

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerableh!@

(TList.TEmptyFunc4!@

)TList.TEnumerator5

)TList.TEnumerator

TList&

TListx

*TEnumerator(

*TEnumerator

*TEnumerable-

*TEnumerable

-TList.arrayofT

(IComparer4!@

5TCollectionNotifyEvent

,TArrayManagerg

,TArrayManager|

*IEnumerableh!@

/TList.TEmptyFunc4!@

0TList.TEnumerator5

0TList.TEnumerator

$TList&

$TList\

9TObjectDictionaryM

9TObjectDictionary@7F

Uh.WF

Uh.nF

8TComparison4!@

6TComparer2

6TComparer

>TMoveArrayManagerg

>TMoveArrayManager

E.TList`1.Pack$697$0$Intf4!@

E@TList`1.Pack$697$ActRecl

E@TList`1.Pack$697$ActRec

System.Rtti83D

ITList>.arrayofT

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>l

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

TList.arrayofT

IComparer4!@

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumerator

TList&

TListx

'TList.arrayofT

"IComparer4!@

&TArrayManagerg

&TArrayManager

$IEnumerableh!@

)TList.TEmptyFunc4!@

*TList.TEnumerator5

*TList.TEnumerator

TList&

TList

ITList>.arrayofT

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

(TList.arrayofT

#IComparer4!@

'TArrayManagerg

'TArrayManager(

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator8

TList&

TList

TList.arrayofT

TArrayManagerg

TArrayManager

TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TListX

ITList>.arrayofT

System.Generics.Collectionsx

DIComparer>4!@

QTCollectionNotifyEvent>

Item-TPair

HTArrayManager>g

HTArrayManager>T

FIEnumerable>h!@

KTList>.TEmptyFunc4!@

LTList>.TEnumerator5

LTList>.TEnumerator

@TList>&

@TList>

$TComparison4!@

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager

1.TList`1.Pack$697$0$Intf4!@

1@TList`1.Pack$697$ActRec

&TComparison4!@

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManagert

3.TList`1.Pack$697$0$Intf4!@

3@TList`1.Pack$697$ActRec

System.Rttid D

$TComparison4!@

"TComparer2

"TComparer

*TMoveArrayManagerg

*TMoveArrayManager@ H

1.TList`1.Pack$697$0$Intf4!@

1@TList`1.Pack$697$ActRec

1@TList`1.Pack$697$ActRecT#H

#TComparison4!@

!TComparer2

!TComparerP%H

)TMoveArrayManagerg

)TMoveArrayManager

0.TList`1.Pack$697$0$Intf4!@

0@TList`1.Pack$697$ActRec

*TComparison4!@

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManager

7.TList`1.Pack$697$0$Intf4!@

7@TList`1.Pack$697$ActRec

FTComparison>4!@

DTComparer>2

DTComparer>$3H

LTMoveArrayManager>g

LTMoveArrayManager>$5H

S.TList`1.Pack$697$0$Intf>4!@

S@TList`1.Pack$697$ActRec>

TComparison4!@

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManagerx

(.TList`1.Pack$697$0$Intf4!@

(@TList`1.Pack$697$ActRec

(@TList`1.Pack$697$ActRecp?H

$TComparison4!@

"TComparer2

"TComparerXAH

*TMoveArrayManagerg

*TMoveArrayManager

1.TList`1.Pack$697$0$Intf4!@

1@TList`1.Pack$697$ActRecxFH

1@TList`1.Pack$697$ActRec$FH

FTComparison>4!@

DTComparer>2

DTComparer>@HH

LTMoveArrayManager>g

LTMoveArrayManager>@JH

S.TList`1.Pack$697$0$Intf>4!@

S@TList`1.Pack$697$ActRec>

%TComparison4!@

#TComparer2

#TComparer

TMoveArrayManagerg

TMoveArrayManager

2.TList`1.Pack$697$0$Intf4!@

2@TList`1.Pack$697$ActRec

TComparison4!@

TComparer2

TComparer

TMoveArrayManagerg

TMoveArrayManager\XH

'.TList`1.Pack$697$0$Intf4!@

'@TList`1.Pack$697$ActRec

'@TList`1.Pack$697$ActRecL[H

FTComparison>4!@

DTComparer>2

DTComparer>T]H

LTMoveArrayManager>g

LTMoveArrayManager>T_H

S.TList`1.Pack$697$0$Intf>4!@

S@TList`1.Pack$697$ActRec>

System.Rttix

,TDelegatedComparer8

,TDelegatedComparer

?TDelegatedComparer8

?TDelegatedComparer

TDelegatedComparer8

TDelegatedComparer

-TDelegatedComparer8

-TDelegatedComparer4rH

TDelegatedComparer8

TDelegatedComparer

*TDelegatedComparer8

*TDelegatedComparer

1TDelegatedComparer8

1TDelegatedComparer(wH

MTDelegatedComparer>8

MTDelegatedComparer>

"TDelegatedComparer8

"TDelegatedComparer

TDelegatedComparer8

TDelegatedComparer\|H

MTDelegatedComparer>8

MTDelegatedComparer>

,TDelegatedComparer8

,TDelegatedComparer

!TDelegatedComparer8

!TDelegatedComparer

MTDelegatedComparer>8

MTDelegatedComparer>,

System.TypInfo

mkOperatorOverload

PFieldExEntry

TFieldExEntry

PVmtMethodExEntry

TVmtMethodExEntry

TPropSetV

TPropSet

TPropSetV

TPropSet

TPropSetK

TPropSet

TPropSetK

TPropSett

TPropSetK

TPropSet

TPropSetK

TPropSetP

TPropSetK

TPropSet

TPropSetV

TPropSet

System.Classes

ssShift

htKeyword

EInvalidOperationL

EInvalidOperation(

AOperator

TThread.TSynchronizeRecord

TThread.TSystemTimes

GetCPUUsage

TOperation

TObservers.TCanObserveEvent4!@

TObservers.TObserverAddedEvent4!@

Operation

FOnExecute

OnExecute

TArray

TEnumerator(

TEnumeratord

TEnumerable-

TEnumerable

!TList.arrayofT

System.Generics.Collections4!@

IComparer4!@

)TCollectionNotifyEvent

TArrayManagerg

TArrayManagerH

IEnumerableh!@

#TList.TEmptyFunc4!@

$TList.TEnumerator5

$TList.TEnumerator8

TList&

TList

TThreadList&

TThreadList

&TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerablel

.TList.arrayofT

)IComparer4!@

6TCollectionNotifyEvent

-TArrayManagerg

-TArrayManagerd

IEnumerableh!@

0TList.TEmptyFunc4!@

1TList.TEnumerator5

1TList.TEnumerator

%TList&

%TListL

TArray

TEnumerator(

TEnumeratorl

TEnumerable-

TEnumerable

TList.arrayofT

System.Generics.Collections4

IComparer4!@

&TCollectionNotifyEvent

TArrayManagerg

TArrayManager8

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumerator

TList&

TList

!TArray

&TEnumerator(

&TEnumerator

&TEnumerable-

&TEnumerable

)TList.arrayofT

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator

TList&

TList

3TPair

JTArray>

OTEnumerator>(

OTEnumerator>

OTEnumerable>-

OTEnumerable>,%J

?TDictionary.TItem

DTDictionary.TItemArray

!IEqualityComparer4!@

&TCollectionNotifyEvent

5TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

HTDictionary.TKeyEnumerator;

HTDictionary.TKeyEnumerator(,J

HTDictionary.TKeyCollection;

HTDictionary.TKeyCollection$.J

%TArray

*TEnumerator(

*TEnumerator

*TEnumerable-

*TEnumerable

JTDictionary.TValueEnumerator;

JTDictionary.TValueEnumerator

JTDictionary.TValueCollection;

JTDictionary.TValueCollection

ITDictionary.TPairEnumerator;

ITDictionary.TPairEnumeratorh7J

9TDictionary9

9TDictionaryd9J

Keysh6J

'TArray

,TEnumerator(

,TEnumeratorpAJ

,TEnumerable-

,TEnumerable

/TList.arrayofT

System.Generics.Collectionsh

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

ELoginCredendialError

ELoginCredendialErrorxXJ

"TLoginCredentialService.TLoginFunc4!@

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

3TLoginCredentialService.TLoginCredentialEventObject:

3TLoginCredentialService.TLoginCredentialEventObject

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxy

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialService

4TPair

KTArray>

PTEnumerator>(

PTEnumerator>

PTEnumerable>-

PTEnumerable>

@TDictionary.TItem

ETDictionary.TItemArray

7TCollectionNotifyEvent

ITDictionary.TKeyEnumerator;

ITDictionary.TKeyEnumerator8qJ

ITDictionary.TKeyCollection;

ITDictionary.TKeyCollection4sJ

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerable

KTDictionary.TValueEnumerator;

KTDictionary.TValueEnumerator\xJ

KTDictionary.TValueCollection;

KTDictionary.TValueCollection\zJ

JTDictionary.TPairEnumerator;

JTDictionary.TPairEnumerator

:TDictionary9

:TDictionary

/TList.arrayofT

*IComparer4!@

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator4

&TList&

&TList

TArray

%TEnumerator(

%TEnumerator

%TEnumerable-

%TEnumerable`

(TList.arrayofT

#IComparer4!@

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManager4

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumeratorD

TList&

TList

%TObjectList

TArray

%TEnumerator(

%TEnumeratorl

%TEnumerable-

%TEnumerable

(TList.arrayofT

#IComparer4!@

0TCollectionNotifyEvent

'TArrayManagerg

'TArrayManager

%IEnumerableh!@

*TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TListD

%TThreadList&

%TThreadList

TArray

0TEnumerator(

0TEnumerator

0TEnumerable-

0TEnumerablet

3TList.arrayofT

.IComparer4!@

;TCollectionNotifyEvent

2TArrayManagerg

2TArrayManager

0IEnumerableh!@

5TList.TEmptyFunc4!@

6TList.TEnumerator5

6TList.TEnumerator

*TList&

*TList

7TArray>

>(

>

>-

>

LTList>.arrayofT

System.Generics.Collections(!J

GIComparer>4!@

GTCollectionNotifyEvent>

Item TList

>TArrayManager>g

>TArrayManager>

IIEnumerable>h!@

NTList>.TEmptyFunc4!@

OTList>.TEnumerator5

OTList>.TEnumerator|

CTList>&

CTList>x

TList.Sort$1847$0$Intf4!@

TList.Sort$1847$ActRecD

TList.Sort$1847$ActRec

!TArray

&TEnumerator(

&TEnumeratort

&TEnumerable-

&TEnumerable

)TList.arrayofT

$IComparer4!@

1TCollectionNotifyEvent

(TArrayManagerg

(TArrayManager

&IEnumerableh!@

TList.TEmptyFunc4!@

,TList.TEnumerator5

,TList.TEnumerator

TList&

TListX

&TThreadList&

&TThreadList0

huRL

"TArray

'TEnumerator(

'TEnumeratord\L

'TEnumerable-

'TEnumerable

*TList.arrayofT

%IComparer4!@

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManager

'IEnumerableh!@

,TList.TEmptyFunc4!@

-TList.TEnumerator5

-TList.TEnumerator

!TList&

!TListXeL

TArray

#TEnumerator(

#TEnumerator

#TEnumerable-

#TEnumerable,

&TList.arrayofT

System.Generics.CollectionsX

!IComparer4!@

.TCollectionNotifyEvent

%TArrayManagerg

%TArrayManager

#IEnumerableh!@

(TList.TEmptyFunc4!@

)TList.TEnumerator5

)TList.TEnumerator

TList&

TList

#TThreadList&

#TThreadList

TComponent.Create@$2656$0$Intf4!@

&TComparison4!@

$TComparer2

$TComparer

-TDelegatedComparer8

-TDelegatedComparerH

TComponent.Create@$2656$ActRec

TComponent.Create@$2656$ActRecP

#TComponent.GetObservers$2669$0$Intf4!@

#TComponent.GetObservers$2669$1$Intf4!@

#TComponent.GetObservers$2669$ActRec

#TComponent.GetObservers$2669$ActRec(

7TLoginCredentialService.GetLoginCredentials$2942$0$Intf4!@

LPassword

7TLoginCredentialService.GetLoginCredentials$2942$ActRec

Uh.hM

TComparison4!@

TComparer2

TComparerhYN

$TMoveArrayManagerg

$TMoveArrayManager

.TList`1.Pack$697$0$Intf4!@

@TList`1.Pack$697$ActRec

System.Classes4!@

TComparison4!@

)TComparer2

)TComparer

1TMoveArrayManagerg

1TMoveArrayManager

8.TList`1.Pack$697$0$Intf4!@

8@TList`1.Pack$697$ActRec

TComparison4!@

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager

(.TList`1.Pack$697$0$Intf4!@

(@TList`1.Pack$697$ActRec

System.Classes4

,TMoveArrayManagerg

,TMoveArrayManager

3.TList`1.Pack$697$0$Intf4!@

3@TList`1.Pack$697$ActRec

RTList>.arrayofT

System.Generics.Collections,"J

MIComparer>4!@

ZTCollectionNotifyEvent>

Item3TPair

QTArrayManager>g

QTArrayManager>LsN

OIEnumerable>h!@

TTList>.TEmptyFunc4!@

UTList>.TEnumerator5

UTList>.TEnumerator

ITList>&

ITList>

-TList.arrayofT

(IComparer4!@

,TArrayManagerg

,TArrayManager8

*IEnumerableh!@

/TList.TEmptyFunc4!@

0TList.TEnumerator5

0TList.TEnumeratorX

$TList&

$TList

,TComparison4!@

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$697$0$Intf4!@

9@TList`1.Pack$697$ActRecH

9@TList`1.Pack$697$ActRec

System.Classesh

STList>.arrayofT

NIComparer>4!@

[TCollectionNotifyEvent>

Item4TPair

RTArrayManager>g

RTArrayManager>`

PIEnumerable>h!@

UTList>.TEmptyFunc4!@

VTList>.TEnumerator5

VTList>.TEnumerator

JTList>&

JTList>(

,TComparison4!@

*TComparer2

*TComparerT

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$697$0$Intf4!@

9@TList`1.Pack$697$ActRec

9@TList`1.Pack$697$ActRecH

%TComparison4!@

#TComparer2

#TComparerX

TMoveArrayManagerg

TMoveArrayManager

2.TList`1.Pack$697$0$Intf4!@

2@TList`1.Pack$697$ActRec

2@TList`1.Pack$697$ActRec$

%TComparison4!@

#TComparer2

#TComparer(

TMoveArrayManagerg

TMoveArrayManager

2.TList`1.Pack$697$0$Intf4!@

2@TList`1.Pack$697$ActRec

0TComparison4!@

.TComparer2

.TComparer

6TMoveArrayManagerg

6TMoveArrayManager

=.TList`1.Pack$697$0$Intf4!@

=@TList`1.Pack$697$ActRecl

=@TList`1.Pack$697$ActRec

ITComparison>4!@

GTComparer>2

GTComparer>H

OTMoveArrayManager>g

OTMoveArrayManager>H

V.TList`1.Pack$697$0$Intf>4!@

V@TList`1.Pack$697$ActRec>

System.Classes(!J

&TComparison4!@

$TComparer2

$TComparer

,TMoveArrayManagerg

,TMoveArrayManager

3.TList`1.Pack$697$0$Intf4!@

3@TList`1.Pack$697$ActRec

'TComparison4!@

%TComparer2

%TComparer

-TMoveArrayManagerg

-TMoveArrayManager

4.TList`1.Pack$697$0$Intf4!@

4@TList`1.Pack$697$ActRec

#TComparison4!@

!TComparer2

!TComparer

)TMoveArrayManagerg

)TMoveArrayManager

0.TList`1.Pack$697$0$Intf4!@

0@TList`1.Pack$697$ActRec

System.ClassesX

%TDelegatedComparer8

%TDelegatedComparer

2TDelegatedComparer8

2TDelegatedComparerp

"TDelegatedComparer8

"TDelegatedComparer$

OTComparison>4!@

MTComparer>2

MTComparer>

UTMoveArrayManager>g

UTMoveArrayManager>

\.TList`1.Pack$697$0$Intf>4!@

\@TList`1.Pack$697$ActRec>

\@TList`1.Pack$697$ActRec>H

System.Classes,"J

TComparison4!@

TComparer2

TComparer

!TMoveArrayManagerg

!TMoveArrayManager

(.TList`1.Pack$697$0$Intf4!@

(@TList`1.Pack$697$ActRec

(@TList`1.Pack$697$ActRec4

*TComparison4!@

(TComparer2

(TComparer

0TMoveArrayManagerg

0TMoveArrayManager

7.TList`1.Pack$697$0$Intf4!@

7@TList`1.Pack$697$ActRec

3TDelegatedComparer8

3TDelegatedComparer(

PTComparison>4!@

NTComparer>2

NTComparer>

VTMoveArrayManager>g

VTMoveArrayManager>

].TList`1.Pack$697$0$Intf>4!@

]@TList`1.Pack$697$ActRec>

]@TList`1.Pack$697$ActRec>p

3TDelegatedComparer8

3TDelegatedComparer

,TDelegatedComparer8

,TDelegatedComparer

,TDelegatedComparer8

,TDelegatedComparerh

7TDelegatedComparer8

7TDelegatedComparer

PTDelegatedComparer>8

PTDelegatedComparer>

-TDelegatedComparer8

-TDelegatedComparer

.TDelegatedComparer8

.TDelegatedComparerp

*TDelegatedComparer8

*TDelegatedComparer

VTDelegatedComparer>8

VTDelegatedComparer>

"TDelegatedComparer8

"TDelegatedComparer

1TDelegatedComparer8

1TDelegatedComparerP#O

WTDelegatedComparer>8

WTDelegatedComparer>

System.Actions

FHelpKeyword

HelpKeyword

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerable

/TList.arrayofT

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator$CO

&TList&

&TList

/TContainedActionList.EnumByCategory$3260$0$Intf4!@

/TContainedActionList.EnumByCategory$3260$ActRec

,TComparison4!@

*TComparer2

*TComparer

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$697$0$Intf4!@

9@TList`1.Pack$697$ActRecl

9@TList`1.Pack$697$ActRec

3TDelegatedComparer8

3TDelegatedComparer`

Winapi.Wincodec

DeleteKey

System.IniFiles

TStringHash.THashItem

System.IniFilesl

-TArray

2TEnumerator(

2TEnumerator

2TEnumerable-

2TEnumerable|

5TList.arrayofT

System.Generics.Collections0

0IComparer4!@

=TCollectionNotifyEvent

4TArrayManagerg

4TArrayManager

2IEnumerableh!@

7TList.TEmptyFunc4!@

8TList.TEnumerator5

8TList.TEnumerator

,TList&

,TList

2TComparison4!@

0TComparer2

0TComparerp

8TMoveArrayManagerg

8TMoveArrayManagerH

?.TList`1.Pack$697$0$Intf4!@

?@TList`1.Pack$697$ActRec

System.IniFiles0

9TDelegatedComparer8

9TDelegatedComparer

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg0#A

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome\

System.Contnrs

IsShortCut

Vcl.ActnList

1.2.7

System.ZLib

Ht.Ht3

Vcl.GraphUtil

System.Win.ComObj

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

Vcl.ControlsP{R

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeyword|

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Vcl.ControlsH#A

Vcl.StdCtrls

Vcl.StdCtrls5

Vcl.StdCtrls-

FPasswordChar

Vcl.StdCtrlsC

PasswordChar$

OnKeyDown

OnKeyPressX

OnKeyUp4

Vcl.StdCtrlsA

Vcl.StdCtrlsD

OnKeyUp|

TCustomButton.TButtonStyle

Vcl.StdCtrls;

Vcl.StdCtrls2

Vcl.StdCtrlsG

Vcl.StdCtrls

OnKeyUp

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindow

Uhb%U

Uh%9U

%TCustomEdit.ObserverAdded$3338$0$Intf4!@

%TCustomEdit.ObserverAdded$3338$ActRec

%TCustomEdit.ObserverAdded$3338$ActRec\=U

)TCustomCheckBox.ObserverAdded$3550$0$Intf4!@

)TCustomCheckBox.ObserverAdded$3550$ActRec

Winapi.ShlObj

Vcl.Printers

APort

Port

Vcl.ToolWin

Vcl.Clipbrd

Vcl.StdActns

Vcl.ComCtrls

Vcl.ComCtrls'

Vcl.ComCtrls;

Vcl.ComCtrls1

cdsShowKeyboardCues

msShiftSelect

FSaveIndexes

Vcl.ComCtrls[

Vcl.ComCtrls/

vsReport

Vcl.ComCtrls&

FCustomizeKeyName

Vcl.ComCtrlsV

CustomizeKeyName

FUpDownLeftPressed

System.HelpIntfs

UnderstandsKeyword

(TArray

-TEnumerator(

-TEnumerator

-TEnumerable-

-TEnumerable\

0TList.arrayofT

IComparer4!@

8TCollectionNotifyEvent

/TArrayManagerg

/TArrayManager\

-IEnumerableh!@

2TList.TEmptyFunc4!@

3TList.TEnumerator5

3TList.TEnumerator

'TList&

'TListP

-TComparison4!@

TComparer2

TComparer

3TMoveArrayManagerg

3TMoveArrayManager

:.TList`1.Pack$697$0$Intf4!@

:@TList`1.Pack$697$ActRec

4TDelegatedComparer8

4TDelegatedComparer`

Vcl.Dialogs

Vcl.Dialogsl~Q

FURL

Vcl.Dialogs(5V

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials|

.TDefaultLoginCredentials.LoginEvent$833$0$Intf4!@

.TDefaultLoginCredentials.LoginEvent$833$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$835$0$Intf4!@

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRecX

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.ExtCtrlsF

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

*TMouseTrackControlStyleHook.TMousePosition

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable-

'TEnumerable

*TList.arrayofT

System.Generics.CollectionsH

%IComparer4!@

2TCollectionNotifyEvent

)TArrayManagerg

)TArrayManager

'IEnumerableh!@

,TList.TEmptyFunc4!@

-TList.TEnumerator5

-TList.TEnumerator

!TList&

!TList

RTPair>

eTArray>>

jTEnumerator>>(

jTEnumerator>>

jTEnumerable>>-

jTEnumerable>>

^TDictionary>.TItem

cTDictionary>.TItemArray

System.Generics.Collections(

IEqualityComparer4!@

%TCollectionNotifyEvent

UTCollectionNotifyEvent>

Item!TList

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable,

gTDictionary>.TKeyEnumerator;

gTDictionary>.TKeyEnumeratorl

gTDictionary>.TKeyCollection;

gTDictionary>.TKeyCollection

4TArray>

9TEnumerator>(

9TEnumerator>`

9TEnumerable>-

9TEnumerable>

iTDictionary>.TValueEnumerator;

iTDictionary>.TValueEnumeratorH

iTDictionary>.TValueCollection;

iTDictionary>.TValueCollection

hTDictionary>.TPairEnumerator;

hTDictionary>.TPairEnumerator

XTDictionary>9

XTDictionary>(

OnKeyNotifyx

9TPair

LTArray>

QTEnumerator>(

QTEnumerator>4

QTEnumerable>-

QTEnumerable>

ETDictionary.TItem

JTDictionary.TItemArray

System.Generics.Collections$

%TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable-

TEnumerableH

NTDictionary.TKeyEnumerator;

NTDictionary.TKeyEnumerator

NTDictionary.TKeyCollection;

NTDictionary.TKeyCollection

,TArray

1TEnumerator(

1TEnumerator

1TEnumerable-

1TEnumerablel

PTDictionary.TValueEnumerator;

PTDictionary.TValueEnumerator

PTDictionary.TValueCollection;

PTDictionary.TValueCollection

OTDictionary.TPairEnumerator;

OTDictionary.TPairEnumerator

?TDictionary9

?TDictionary$

6TArray

;TEnumerator(

;TEnumeratorL

;TEnumerable-

;TEnumerable

>TList.arrayofT

System.Generics.Collections\

9IComparer4!@

FTCollectionNotifyEvent

Item#TStyleManager.TStyleClassDescriptor

=TArrayManagerg

=TArrayManager

;IEnumerableh!@

@TList.TEmptyFunc4!@

ATList.TEnumerator5

ATList.TEnumerator|

5TList&

5TList\

*TArray

/TEnumerator(

/TEnumerator

/TEnumerable-

/TEnumerable8,[

2TList.arrayofT

System.Generics.Collections8

-IComparer4!@

:TCollectionNotifyEvent

1TArrayManagerg

1TArrayManagerL/[

/IEnumerableh!@

4TList.TEmptyFunc4!@

5TList.TEnumerator5

5TList.TEnumerator

)TList&

)TListL4[

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerable

/TList.arrayofT

*IComparer4!@

7TCollectionNotifyEvent

.TArrayManagerg

.TArrayManager

,IEnumerableh!@

1TList.TEmptyFunc4!@

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TList

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerableT

#TList.arrayofT

IComparer4!@

TCollectionNotifyEvent

"TArrayManagerg

"TArrayManager

IEnumerableh!@

%TList.TEmptyFunc4!@

&TList.TEnumerator5

&TList.TEnumerator

TList&

TList

'TComparison4!@

%TComparer2

%TComparer

-TMoveArrayManagerg

-TMoveArrayManagerh

4.TList`1.Pack$697$0$Intf4!@

4@TList`1.Pack$697$ActRec

Vcl.ThemesH

mTList>>.arrayofT

System.Generics.Collections

hIComparer>>4!@

uTCollectionNotifyEvent>>

ItemRTPair>

lTArrayManager>>g

lTArrayManager>>X

jIEnumerable>>h!@

oTList>>.TEmptyFunc4!@

pTList>>.TEnumerator5

pTList>>.TEnumeratorx

dTList>>&

dTList>>

TList.arrayofT

IComparer4!@

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

TList.TEnumerator5

TList.TEnumerator

TList&

TList|

>.arrayofT

7IComparer>4!@

;TArrayManager>g

;TArrayManager>$

9IEnumerable>h!@

>TList>.TEmptyFunc4!@

?TList>.TEnumerator5

?TList>.TEnumerator

3TList>&

3TList>`

TTList>.arrayofT

OIComparer>4!@

\TCollectionNotifyEvent>

Item9TPair

STArrayManager>g

STArrayManager>

QIEnumerable>h!@

VTList>.TEmptyFunc4!@

WTList>.TEnumerator5

WTList>.TEnumeratorP)]

KTList>&

KTList>\ ]

4TList.arrayofT

/IComparer4!@

3TArrayManagerg

3TArrayManager

1IEnumerableh!@

6TList.TEmptyFunc4!@

7TList.TEnumerator5

7TList.TEnumerator

TList&

TList

;TComparison4!@

9TComparer2

9TComparer

ATMoveArrayManagerg

ATMoveArrayManager

H.TList`1.Pack$697$0$Intf4!@

H@TList`1.Pack$697$ActRec

Vcl.Themes\

/TComparison4!@

-TComparer2

-TComparer

5TMoveArrayManagerg

5TMoveArrayManager

<.tlist>4!@

Y]

Vcl.Themes8

,TComparison4!@

*TComparer2

*TComparer8[]

2TMoveArrayManagerg

2TMoveArrayManager

9.TList`1.Pack$697$0$Intf4!@

9@TList`1.Pack$697$ActRec

9@TList`1.Pack$697$ActRec,`]

TComparison4!@

TComparer2

TComparer4b]

&TMoveArrayManagerg

&TMoveArrayManager

-.TList`1.Pack$697$0$Intf4!@

-@TList`1.Pack$697$ActRec

.TDelegatedComparer8

.TDelegatedComparer h]

jTComparison>>4!@

hTComparer>>2

hTComparer>>

pTMoveArrayManager>>g

pTMoveArrayManager>>

w.TList`1.Pack$697$0$Intf>>4!@

w@TList`1.Pack$697$ActRec>>

Vcl.Themes

TComparison4!@

TComparer2

TComparerts]

TMoveArrayManagerg

TMoveArrayManager

'.TList`1.Pack$697$0$Intf4!@

'@TList`1.Pack$697$ActRec

Vcl.Themes$

9TComparison>4!@

7TComparer>2

7TComparer>

?TMoveArrayManager>g

?TMoveArrayManager>

F.TList`1.Pack$697$0$Intf>4!@

F@TList`1.Pack$697$ActRec>

F@TList`1.Pack$697$ActRec>8

QTComparison>4!@

OTComparer>2

OTComparer>

WTMoveArrayManager>g

WTMoveArrayManager>

^.TList`1.Pack$697$0$Intf>4!@

^@TList`1.Pack$697$ActRec>

^@TList`1.Pack$697$ActRec>4

1TComparison4!@

/TComparer2

/TComparer

7TMoveArrayManagerg

7TMoveArrayManagerh

>.TList`1.Pack$697$0$Intf4!@

>@TList`1.Pack$697$ActRec

BTDelegatedComparer8

BTDelegatedComparer

6TDelegatedComparer8

6TDelegatedComparer

3TDelegatedComparer8

3TDelegatedComparer

'TDelegatedComparer8

'TDelegatedComparer

qTDelegatedComparer>>8

qTDelegatedComparer>>

!TDelegatedComparer8

!TDelegatedComparer

@TDelegatedComparer>8

@TDelegatedComparer>

XTDelegatedComparer>8

XTDelegatedComparer>t

8TDelegatedComparer8

8TDelegatedComparerx

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeysh

AutoHotkeys

Vcl.Forms

ssHotTrack

Vcl.Forms;

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview,

WindowState

Vcl.Formsc

KeyPreview

TApplication.TBiDiKeyboard

BiDiKeyboard

NonBiDiKeyboard

BiDiKeyboardHKL

NonBiDiKeyboardHKL

SetBiDiKeyboard

SetNonBiDiKeyboard

GetBidiKeyboard

GetNonBidiKeyboard

ApplyBiDiKeyboardLayout

ApplyNonBiDiKeyboardLayout

FBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

OnActionExecute

!TScrollingStyleHook.TScrollWindow6

!TScrollingStyleHook.TScrollWindow

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

Vcl.Forms,

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHookh

EnterWithKeyboard

Vcl.AxCtrls

Vcl.Buttons

Vcl.Buttons!

Vcl.Buttons4

TList.arrayofT

IComparer4!@

TArrayManagerg

TArrayManager

IEnumerableh!@

TList.TEmptyFunc4!@

!TList.TEnumerator5

!TList.TEnumerator

TList&

TList

Vcl.Mask

EInvalidGridOperation

EInvalidGridOperation`ka

Vcl.Grids

goAlwaysShowEditor

%TCustomGrid.ObserverAdded$6194$0$Intf4!@

%TCustomGrid.ObserverAdded$6194$1$Intf4!@

%TCustomGrid.ObserverAdded$6194$ActRec

TacMenuSupport&

TacMenuSupport

csIndexed

FCrToRedTable

FCrToGreenTable

3333333

UpdateIconsIndexes

TacMDIWnd'

TacMDIWndHwe

HandleAlphaCmd

UhÅ¸

IndexWebBtn

UpdateIndexes

HandleOwnerMsg

TAddItemExEvent

acInMouseMsg

IsControlSupported

CurLeft

Vcl.Imaging.pngimage

fKeyword

TacScrollBarsSupport6

TacScrollBarsSupportL$m

TacButtonsSupport6

TacButtonsSupport

TacLabelsSupport6

TacLabelsSupport

FMenuSupport

FButtonsSupport

FLabelsSupport

InitConstantIndexes

InitMaskIndexes

MenuSupport

C.hPom

Vcl.OleCtrls

LicenseKey

Vcl.OleServer

'TServerEventDispatch.Invoke$7223$0$Intf4!@

'TServerEventDispatch.Invoke$7223$ActRec

TVarAddressh

Vcl.Imaging.jpeg

Vcl.Styles

6TPair

ITArray>

NTEnumerator>(

NTEnumerator>H

NTEnumerable>-

NTEnumerable>

BTDictionary.TItem

GTDictionary.TItemArray

System.Generics.Collections,

,IEqualityComparer4!@

-TCollectionNotifyEvent

KTDictionary.TKeyEnumerator;

KTDictionary.TKeyEnumerator

KTDictionary.TKeyCollection;

KTDictionary.TKeyCollection

TArray

"TEnumerator(

"TEnumerator

"TEnumerable-

"TEnumerable\

MTDictionary.TValueEnumerator;

MTDictionary.TValueEnumerator

MTDictionary.TValueCollection;

MTDictionary.TValueCollection

LTDictionary.TPairEnumerator;

LTDictionary.TPairEnumerator

9

ktcPanel

ktcPanelDisabled

ssHot

FAuthorURL

TSeWindowSubclass

ktmiWindowStandard

QTList>.arrayofT

LIComparer>4!@

YTCollectionNotifyEvent>

Item6TPair

PTArrayManager>g

PTArrayManager>TVt

NIEnumerable>h!@

STList>.TEmptyFunc4!@

TTList>.TEnumerator5

TTList>.TEnumerator

HTList>&

HTList>

%TList.arrayofT

IComparer4!@

$TArrayManagerg

$TArrayManager(jt

"IEnumerableh!@

'TList.TEmptyFunc4!@

(TList.TEnumerator5

(TList.TEnumerator(mt

TList&

TList

NTComparison>4!@

LTComparer>2

LTComparer>

TTMoveArrayManager>g

TTMoveArrayManager>

[.TList`1.Pack$697$0$Intf>4!@

[@TList`1.Pack$697$ActRec>

[@TList`1.Pack$697$ActRec>,

"TComparison4!@

TComparer2

TComparerx

(TMoveArrayManagerg

(TMoveArrayManager0

/.TList`1.Pack$697$0$Intf4!@

/@TList`1.Pack$697$ActRec

/@TList`1.Pack$697$ActRec8

UTDelegatedComparer>8

UTDelegatedComparer>p

)TDelegatedComparer8

)TDelegatedComparerl

System.SysConst

System.RTLConsts

System.Character

System.Internal.ExcUtils

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.VarUtils

System.Math

System.Diagnostics

Winapi.Messages

System.AnsiStrings

System.StrUtils

Winapi.CommCtrl

Winapi.Dwmapi

Winapi.UxTheme

Winapi.MultiMon

Vcl.Consts

System.UIConsts

System.IOUtils

System.DateUtils

System.Masks

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

System.Win.ComConst

Winapi.PenInputPanel

Winapi.MsInkAut

Winapi.TpcShrd

System.Win.Crtl

Winapi.Imm

Winapi.CommDlg

Winapi.MSXMLIntf

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Vcl.ComStrs

Winapi.WinSpool

Vcl.ListActns

Winapi.RichEdit

Winapi.FlatSB

Winapi.Dlgs

System.WideStrUtils

Vcl.Imaging.JConsts

Winapi.TlHelp32

Vcl.OleConst

System.Win.StdVCL

System.MaskUtils

Vcl.Imaging.pnglang

Vcl.FileCtrl

Vcl.ExtDlgs

Vcl.ButtonGroup

Vcl.CategoryButtons

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

1.2.3

a%SAz2

kernel32.dll

wtsapi32.dll

user32.dll

msimg32.dll

advapi32.dll

RegDeleteKeyExW

windowscodecs.dll

uxtheme.dll

imm32.dll

DWMAPI.DLL

shell32.dll

a%2xO

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

activation.php?code=

deactivation.php?hash=

.?AVIUrlBuilderSource@@

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\MonsterEngine.exe

^%sY1

&-JCR}

..gv4'

D9.vo

a.UG]

.nN7z

cX.Yj

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps