MD5: fe8917ba562db38bde9c0c306e1d8282
SHA1: ec53cb43d8847a28d9316ba882b51605f22c2644
SHA256: 1057fbdb92e0689c69a518beec5271cbb3cbfe6502cb77ffd4f5c63a0b8f9df9
SSDeep: 24576:qmJAvwwS0lgd4wdi/kbsPuAFi 3YaYwMNPHL:qK0aewdAkoPuArIaY/j
Size: 971184 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Scandium Security Inc.
Created at: 2010-04-10 15:19:31
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

TPAutoConnSvc.exe:1776
SBSetupDrivers.exe:316
mofcomp.exe:2712
UnThreat.exe:4088
UnThreat.exe:2220
GFI.Tools.Run64.exe:3596
netsh.exe:3420
netsh.exe:1648
runonce.exe:3456
regsvr32.exe:3368
%original file name%.exe:820
pack.exe:388
adxregistrator.exe:2504

The Malware injects its code into the following process(es):

UnThreat.exe:2968
utsvc.exe:4012

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SBSetupDrivers.exe:316 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Windows\System32\drivers\SET6595.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DRVSetup\SetupDrv.log (837 bytes)

The process mofcomp.exe:2712 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp6B9D.tmp (744 bytes)

The process UnThreat.exe:4088 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\UnThreat\data\av.mof (321 bytes)

The process GFI.Tools.Run64.exe:3596 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\UnThreat AntiVirus\sbsetupdrivers.exe (180 bytes)

The process utsvc.exe:4012 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\ProgramData\UnThreat\data\WDBF\av.mof (1284 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\utwsc.exe (245 bytes)
C:\ProgramData\UnThreat\data\Staging\cblk.vtd (4604373 bytes)
C:\ProgramData\UnThreat\data\Staging\bhsl.vtd (197452 bytes)
C:\ProgramData\UnThreat\data\Staging\CatID.vdx (36 bytes)
C:\ProgramData\UnThreat\data\CSC39-EN-37600-F.sbr.sgn (26767379 bytes)
C:\ProgramData\UnThreat\recentScan.log (396 bytes)
C:\ProgramData\UnThreat\data\Staging\DefVer.txt (52 bytes)
%Program Files% (x86)\UnThreat AntiVirus\FSSC.dat (12 bytes)
C:\ProgramData\UnThreat\data\Staging\Cookies.vdx (9291 bytes)
C:\ProgramData\UnThreat\data\SBWL.dat (267 bytes)
C:\ProgramData\UnThreat\data\Staging\SBWL.dat (356 bytes)
C:\ProgramData\UnThreat\data\Staging\cname.wtd (19299 bytes)
C:\ProgramData\UnThreat\data\Staging\adsrules.dat (1120 bytes)
C:\ProgramData\UnThreat\data\Staging\AdviceTx.vdx (40 bytes)
C:\ProgramData\UnThreat\data\Staging\CSC39-EN-37600-F.sbr.sgn (2553832 bytes)
C:\ProgramData\UnThreat\data\Staging\comp0.std (129 bytes)
C:\ProgramData\UnThreat\data\Staging\dex_hash.dat (397051 bytes)
C:\ProgramData\UnThreat\data\WDBF\CSC39-EN-37600-F.sbr.sgn (2553832 bytes)
C:\ProgramData\UnThreat\data\Staging\apincl.dat (2856 bytes)
C:\ProgramData\UnThreat\data\Staging\acertdefs0.std (1908 bytes)
C:\ProgramData\UnThreat\data\Staging\CatDesc.vdx (720 bytes)
C:\ProgramData\UnThreat\data\Staging\api0.std (2096 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SbWebFilter.dll (466 bytes)
C:\ProgramData\UnThreat\data\Staging\defs0.std (148104 bytes)
C:\ProgramData\UnThreat\data\Staging\av.mof (1284 bytes)
C:\ProgramData\UnThreat\data\Staging\ctid.vtd (3444542 bytes)
C:\ProgramData\UnThreat\utsd2.dll (3775 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SBTIS.dll (110 bytes)
C:\ProgramData\UnThreat\data\Staging\apprules.dat (4 bytes)
C:\ProgramData\UnThreat\data\Staging\CoreVer.txt (9 bytes)
C:\ProgramData\UnThreat\data\WDBF\SBWL.dat (356 bytes)
%Program Files% (x86)\UnThreat AntiVirus\vipre.dll (335 bytes)

The process runonce.exe:3456 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl (712 bytes)

The process regsvr32.exe:3368 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\UnThreat AntiVirus\drv\utsh64.dll (483 bytes)

The process %original file name%.exe:820 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\Public\Desktop\UnThreat AntiVirus.lnk (589 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\sbapifs.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wnet\sbfw.sys (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\sbsetupdrivers.exe (673 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbapifs.inf (2 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\w2k\SbFwIm.sys (56 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\Interop.VBIDE.dll (59 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\FindProcDLL.dll (812 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wnet\SbFwIm.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wlh\sbhips.sys (61 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\AddinExpress.MSO.2005.dll (15019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UnThreat AntiVirus\Uninstall UnThreat AntiVirus.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst2AB8.tmp (52156 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\sbapifsl.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\ifcleanup.exe (18 bytes)
%Program Files% (x86)\UnThreat AntiVirus\unrar.dll (673 bytes)
%Program Files% (x86)\UnThreat AntiVirus\GFI.Tools.Run64.exe (865 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wnet\SBTIS.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Support\TeamViewerQS_en.exe (29430 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\adxloader64.dll (4545 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\sbaphd.sys (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\InvokeShellVerb.dll (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Helper.dll (10815 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\utwsc.exe (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbapifsl.cat (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UnThreat AntiVirus\Help.lnk (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wlh\SBTIS.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SbHips.dll (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SBRC.exe (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\modern-header.bmp (3312 bytes)
%Program Files% (x86)\UnThreat AntiVirus\sbap.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\license.txt (14 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64 (4 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim2k.inf (3 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\wlh\SBTIS.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SBTE.dll (7385 bytes)
%Program Files% (x86)\UnThreat AntiVirus\gfiarksh.dll (61 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim64.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim.inf (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\nso567B.tmp\pack.exe (1545760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\Helper.dll (48977 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UnThreat AntiVirus\Start UnThreat AntiVirus.lnk (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\sbapifs.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SbWebFilter.dll (3073 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\adxloader.dll (3073 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbwtis.inf (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SpursDownload.dll (2321 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\w2k\sbfw.sys (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\UnThreat AntiVirus.lnk (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wlh\sbfw.sys (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\wlh\sbfw.sys (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\rw32.dll (673 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbapx64.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\UTMailExtension.dll (21 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbapifs.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\rw64.dll (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers (4 bytes)
%Program Files% (x86)\UnThreat AntiVirus\utsvc.exe (19686 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\adxregistrator.exe (808 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\w2k\SBTIS.sys (1281 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\utsh64.dll (3073 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude (4 bytes)
C:\Windows\System32\sbbd.exe (47 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\wxp\SbFwIm.sys (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\UAC.dll (29 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\wlh\sbhips.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim86.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\Interop.Office.dll (673 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\Interop.Outlook.dll (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv (4 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\i386\wlh\SBWTIS.sys (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\UnThreat.exe (118451 bytes)
%Program Files% (x86)\UnThreat AntiVirus\help.chm (49 bytes)
%Program Files% (x86)\UnThreat AntiVirus\log.log (39451 bytes)
%Program Files% (x86)\UnThreat AntiVirus\update.exe (22336 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim2k_m.inf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\extensibility.dll (4 bytes)
C:\Users\"%CurrentUserName%"\Desktop\UnThreat AntiVirus.lnk (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\sbfwim_m.inf (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Uninstall.exe (1699 bytes)
%Program Files% (x86)\UnThreat AntiVirus\Drivers\amd64\wlh\SBWTIS.sys (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\Uninstall.exe (9608 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SbFwe.dll (5441 bytes)
%Program Files% (x86)\UnThreat AntiVirus\SBTIS.dll (601 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\uthw.dll (51 bytes)
%Program Files% (x86)\UnThreat AntiVirus\vipre.dll (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\nsDialogs.dll (21 bytes)

The process pack.exe:388 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\UnThreat AntiVirus\RawInclude\utsvc.exe (22733 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wnet\SBTIS.sys (1612 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\UTMailExtension.dll (1415 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SbFwe.dll (7008 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\sbapifsl.sys (1663 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\wlh\sbfw.sys (3742 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x32\SBSetupDrivers.exe (1640 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\wlh\SBWTIS.sys (684 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wlh\sbfw.sys (3289 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim_m.inf (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wnet\sbfw.sys (3068 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim2k_m.inf (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SBRC.exe (1529 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SBTE.dll (9353 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64\sbsetupdrivers.exe (1524 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SpursDownload.dll (3547 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbwtis.inf (1 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\Interop.Office.dll (2725 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64\utsh64.dll (5972 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64\ifcleanup.exe (1062 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\extensibility.dll (4 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbapifs.inf (2 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbapifsl.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wlh\SBTIS.sys (2434 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\sbaphd.sys (982 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\rw32.dll (3858 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\wlh\sbhips.sys (1019 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\sbap.dll (5103 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\gfiarksh.dll (1409 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\help.chm (49 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x32\utsh32.dll (3715 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x32\ifcleanup.exe (18 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbapifs.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\w2k\SBTIS.sys (2362 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim86.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SbWebFilter.dll (5858 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SbHips.dll (669 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wnet\SbFwIm.sys (1616 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\adxregistrator.exe (1209 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wlh\SBWTIS.sys (1195 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\UnThreat.exe (150962 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Support\TeamViewerQS_en.exe (52166 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim.inf (3 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\AddinExpress.MSO.2005.dll (18147 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbapx64.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\sbapifs.sys (1969 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\w2k\SbFwIm.sys (1830 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\uthw.dll (51 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim2k.inf (3 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\sbfwim64.cat (8 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\w2k\sbfw.sys (5262 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64\GFI.Tools.Run64.exe (1392 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\wlh\sbhips.sys (61 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\rw64.dll (1982 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\SBTIS.dll (1557 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\adxloader64.dll (7840 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\adxloader.dll (3945 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x64\sbbd.exe (1139 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\unrar.dll (1023 bytes)
%Program Files% (x86)\UnThreat AntiVirus\x32\sbbd.exe (44 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\Interop.VBIDE.dll (1996 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\vipre.dll (2996 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\wxp\SbFwIm.sys (927 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\utwsc.exe (4000 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\i386\wlh\SBTIS.sys (618 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\drv\Interop.Outlook.dll (1428 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\update.exe (26932 bytes)
%Program Files% (x86)\UnThreat AntiVirus\RawInclude\Drivers\amd64\sbapifs.sys (353 bytes)

The process adxregistrator.exe:2504 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adxregistrator.log (35512 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\UTMailExtension.dll (24 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\AddinExpress.MSO.2005.dll (49 bytes)
%Program Files% (x86)\UnThreat AntiVirus\drv\extensibility.dll (8 bytes)

Registry activity

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process SBSetupDrivers.exe:316 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\sbapifs\Instances\ActiveProtection]
"Altitude" = "268000"

[HKLM\SYSTEM\Setup\SetupapiLogStatus]
"setupapi.app.log" = "4096"

[HKLM\System\CurrentControlSet\services\eventlog\System\Anti-Spyware Filter]
"EventMessageFile" = "%SystemRoot%\System32\drivers\sbapifs.sys"

[HKLM\System\CurrentControlSet\services\sbapifs\Instances\ActiveProtection]
"Flags" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"GlobalAssocChangedCounter" = "53"

[HKLM\System\CurrentControlSet\services\sbapifs\Instances]
"DefaultInstance" = "ActiveProtection"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Content Screener" = "02 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\System\CurrentControlSet\services\eventlog\System\Anti-Spyware Filter]
"TypesSupported" = "7"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv" = "grpconv -o"

The process UnThreat.exe:4088 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "UnThreat.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process UnThreat.exe:2968 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "UnThreat.exe"

[HKLM\SOFTWARE\UnThreat\Settings]
"enablemailsign" = "1"

The process UnThreat.exe:2220 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\UnThreat AntiVirus]
"EnableLog" = "0"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "UnThreat.exe"

The process netsh.exe:3420 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32]
"tsgqec.dll,-103" = "Microsoft Corporation"
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"eapqec.dll,-102" = "1.0"
"eapqec.dll,-103" = "Microsoft Corporation"
"napipsec.dll,-3" = "Microsoft Corporation"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-4" = "1.0"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"dhcpqec.dll,-102" = "Microsoft Corporation"
"dhcpqec.dll,-103" = "1.0"
"tsgqec.dll,-102" = "1.0"

The process netsh.exe:1648 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process utsvc.exe:4012 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\UnThreat\Settings]
"AppVer" = "6.2.37"

[HKU\.DEFAULT\SOFTWARE\UnThreat AntiVirus]
"EnableLog" = "0"

[HKLM\SOFTWARE\UnThreat\Settings]
"internalver" = "37"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\UnThreat\Settings]
"defdate" = "//"
"enablemailsign" = "1"

[HKLM\System\CurrentControlSet\Control]
"ServicesPipeTimeout" = "60000"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing]
"State" = "141824"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnThreat" = "%Program Files% (x86)\UnThreat AntiVirus\UnThreat.exe -silent"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

The process runonce.exe:3456 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"

The process regsvr32.exe:3368 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCR\Folder\ShellEx\ContextMenuHandlers\UTMenu]
"(Default)" = "{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}"

[HKCR\txtfile\ShellEx\ContextMenuHandlers\UTShlExt]
"(Default)" = "{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}"

[HKCR\CLSID\{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}]
"(Default)" = "UTShlExt Class"

[HKCR\CLSID\{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\AllFilesystemObjects\shellex\ContextMenuHandlers\UTMenu]
"(Default)" = "{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}"

[HKCR\CLSID\{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}\InprocServer32]
"(Default)" = "%Program Files% (x86)\UnThreat AntiVirus\drv\utsh64.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{4057289B-9E9F-4ca0-A3DA-F98E1E1AF044}" = "UnThreat Files and Folders Scan"

The process %original file name%.exe:820 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"DisplayIcon" = "%Program Files% (x86)\UnThreat AntiVirus\UnThreat.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"Favorites" = "00 7C 01 00 00 14 00 1F 80 C8 27 34 1F 10 5C 10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@C:\Windows\system32]
"FXSRESM.dll,-120" = "Fax recipient"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"Traffic_type" = "n"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"@sendmail.dll,-21" = "Desktop (create shortcut)"

[HKCU\Software\UnThreat AntiVirus]
"iver" = "6.2.37.323"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "35"

[HKCU\Software\UnThreat AntiVirus]
"sysid" = "450"

[HKLM\SOFTWARE\Wow6432Node\UnThreat]
"PathApp" = "C:\Users\"%CurrentUserName%"\AppData\Roaming"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\UnThreat]
"Path" = "%Program Files% (x86)\UnThreat AntiVirus"

[HKLM\System\CurrentControlSet\services\sbhips]
"ImagePath" = "system32\drivers\sbhips.sys"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\UnThreat AntiVirus]
"LN" = "en"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"@sendmail.dll,-4" = "Mail recipient"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "50 50 15 55 CC 49 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"DisplayVersion" = "6.2.37.323"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2AC9.tmp\Helper.dll,"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"@zipfldr.dll,-10148" = "Compressed (zipped) folder"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesVersion" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCR\Applications\%original file name%.exe]
"IsHostApp" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"InstallLocation" = "%Program Files% (x86)\UnThreat AntiVirus"

[HKLM\System\CurrentControlSet\services\sbhips]
"ErrorControl" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"NoRepair" = "1"

[HKLM\System\CurrentControlSet\services\sbhips]
"Start" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "50 50 15 55 CC 49 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"NoModify" = "1"

[HKLM\System\CurrentControlSet\services\sbhips]
"DisplayName" = "sbhips"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"DisplayName" = "UnThreat Free AntiVirus 2014"

[HKCU\Software\UnThreat AntiVirus]
"pver" = "6.2.37.323"
"clid" = "{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}"
"AppID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"Publisher" = "Scandium Security Inc."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\UnThreat AntiVirus]
"home" = "%Program Files% (x86)\UnThreat AntiVirus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesChanges" = "7"

[HKLM\System\CurrentControlSet\services\sbhips]
"Type" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"FavoritesResolve" = "CC 02 00 00 4C 00 00 00 01 14 02 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnThreat AntiVirus]
"UninstallString" = "%Program Files% (x86)\UnThreat AntiVirus\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\UnThreat AntiVirus]
"iTime" = "2015-02-16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "50 50 15 55 CC 49 D0 01"
"WpadNetworkName" = "Network 3"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"!UnThreat AntiVirusOnce" = "c:\%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UnThreat" = "%Program Files% (x86)\UnThreat AntiVirus\UnThreat.exe"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"!UnThreat AntiVirusOnce"

The process adxregistrator.exe:2504 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"LoadBehavior" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"FriendlyName" = "UTMailExtension"

[HKCR\UTMailExtension.AddinModule\CLSID]
"(Default)" = "{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}]
"(Default)" = "UTMailExtension.AddinModule"

[HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"FriendlyName" = "UTMailExtension"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"CommandLineSafe" = "0"

[HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"LoadBehavior" = "3"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"(Default)" = "mscoree.dll"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"CodeBase" = "file:///C:/Program Files (x86)/UnThreat AntiVirus/drv/UTMailExtension.DLL"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"CodeBase" = "file:///C:/Program Files (x86)/UnThreat AntiVirus/drv/UTMailExtension.DLL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"Class" = "UTMailExtension.AddinModule"

[HKCU\Software\Microsoft\Office\Outlook\AddIns\UTMailExtension.AddinModule]
"ADXStartMode" = "FIRSTSTART"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"CodeBase" = "file:///C:/Program Files (x86)/UnThreat AntiVirus/drv/UTMailExtension.DLL"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\ProgId]
"(Default)" = "UTMailExtension.AddinModule"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"RuntimeVersion" = "v4.0.30319"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"Assembly" = "UTMailExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a21874991a18602"

[HKCR\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}]
"0" = ".NET Category"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"(Default)" = "mscoree.dll"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"Assembly" = "UTMailExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a21874991a18602"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}]
"(Default)" = "UTMailExtension.AddinModule"

[HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"Description" = "AddinModule"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"Class" = "UTMailExtension.AddinModule"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"Assembly" = "UTMailExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a21874991a18602"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"Assembly" = "UTMailExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=3a21874991a18602"

[HKCR\UTMailExtension.AddinModule]
"(Default)" = "UTMailExtension.AddinModule"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\ProgId]
"(Default)" = "UTMailExtension.AddinModule"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"RuntimeVersion" = "v4.0.30319"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"Description" = "AddinModule"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"CodeBase" = "file:///C:/Program Files (x86)/UnThreat AntiVirus/drv/UTMailExtension.DLL"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"Class" = "UTMailExtension.AddinModule"

[HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UTMailExtension.AddinModule]
"CommandLineSafe" = "0"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
"RuntimeVersion" = "v4.0.30319"

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"RuntimeVersion" = "v4.0.30319"

[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32]
"Class" = "UTMailExtension.AddinModule"

The Malware deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]
[HKCR\CLSID\{9720CA93-5814-4A70-AEEC-1ACC41FE9A5F}\InprocServer32\1.0.0.0]

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Scandium Security Inc.
Product Name: UnThreat Free AntiVirus 2014
Product Version: 6.2.37.323
Legal Copyright: Copyright 2014, Scandium Security Inc.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 6.2.37.323
File Description: UnThreat Free AntiVirus 2014 - Install
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
3bd246b2f9ec1c16ff37dd890783d65c

URLs

URL	IP
hxxp://a1254.g.akamai.net/cdn/packs/UTFree/1/pack.exe
hxxp://unthreat.com/install_statistics.php?sysid=450&appid=0&clid={C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}&ln=en&osver=6.1&osl=en-US&pver=6.2.37.323&iver=6.2.37.323&ptype=n&itype=n&ch=0&ct=0&ostype=win64
hxxp://unthreat.com/statistics/client/install.php?systemid=450&os=6.1&is64=1&ver=6.2.37.323&type=New&appid=0&userHome=No&userToolbar=No
hxxp://unthreat.com/register/check4d.php
hxxp://unthreat.com/spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0
hxxp://a1254.g.akamai.net/CSC39-EN-37600-F.sbr.sgn
hxxp://a1737.g.akamai.net/CSC39-EN-37600-F.sbr.sgn
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?00ec416eef2d9e94
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECmFQ0IsyBgAlJ/VNRDQEas=
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b00cc72c3b8bcef8
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.202.48
hxxp://avupdate.unthreat.com/CSC39-EN-37600-F.sbr.sgn	87.245.202.42
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://www.unthreat.com/register/check4d.php	109.201.148.135
hxxp://www.unthreat.com/spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0	109.201.148.135
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECmFQ0IsyBgAlJ/VNRDQEas=	23.43.139.27
hxxp://download.cdn.unthreat.com/cdn/packs/UTFree/1/pack.exe	87.245.202.42
hxxp://stat.unthreat.com/statistics/client/install.php?systemid=450&os=6.1&is64=1&ver=6.2.37.323&type=New&appid=0&userHome=No&userToolbar=No	109.201.148.135
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.202.48
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	87.245.202.48
hxxp://service.unthreat.com/install_statistics.php?sysid=450&appid=0&clid={C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}&ln=en&osver=6.1&osl=en-US&pver=6.2.37.323&iver=6.2.37.323&ptype=n&itype=n&ch=0&ct=0&ostype=win64	109.201.148.135
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.202.48
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?00ec416eef2d9e94	87.245.202.24
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b00cc72c3b8bcef8	87.245.202.24
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET MALWARE User-Agent (Mozilla/4.0 (compatible ICS))
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM FIN invalid ack
SURICATA STREAM FIN out of window

Traffic

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="0"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:18 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591952" seat
s="1" package="unthreatfree"/></userResponse>...

GET /statistics/client/install.php?systemid=450&os=6.1&is64=1&ver=6.2.37.323&type=New&appid=0&userHome=No&userToolbar=No HTTP/1.1

User-Agent: Brand HTTPConnection

Host: stat.unthreat.com

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:25 GMT

Content-Type: text/html

Content-Length: 0

X-Server: waim1

Vary: Accept-Encoding

Cache-Control: max-age=7200

Expires: Mon, 16 Feb 2015 11:38:25 GMT

X-Stat-Server: utall
HTTP/1.1 200 OK..Date: Mon, 16 Feb 2015 09:38:25 GMT..Content-Type: te
xt/html..Content-Length: 0..X-Server: waim1..Vary: Accept-Encoding..Ca
che-Control: max-age=7200..Expires: Mon, 16 Feb 2015 11:38:25 GMT..X-S
tat-Server: utall..

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:26 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591944" seat
s="1" package="unthreatfree"/></userResponse>...

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:53 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591977" seat
s="1" package="unthreatfree"/></userResponse>...

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT

Accept-Ranges: bytes

ETag: "75565c7ac03ad01:0"

Server: Microsoft-IIS/8.0

VTag: 279455044500000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Mon, 16 Feb 2015 09:43:08 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=385793, public, no-transform, must-revalidate

Last-Modified: Fri, 13 Feb 2015 20:53:01 GMT

Expires: Fri, 20 Feb 2015 20:53:01 GMT

Date: Mon, 16 Feb 2015 09:43:08 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
3205301Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150213205301Z....20150220205301Z0...*.H........
.....?..D<... .|?.........4H......hu..t...G...0.oT.D..A.I..M.1,..D.
j...y.9-..v.....4... .......Yx0...hAo71x.......F..)....<V..1......m
....=...{wX.!./j.2.....HS..<X....NcE.,..)._H.m...u8.D......X..E....
.K\6.).|%?lfH..\..] [email protected]>0....D.Ac.[..q..Ood....[.f.......#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?b00cc72c3b8bcef8 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT

Accept-Ranges: bytes

ETag: "803565fb436d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 57591

Date: Mon, 16 Feb 2015 09:42:45 GMT

Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._
q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p
..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Ic
z......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[
...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..
2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k
<<< skipped >>>

GET /cdn/packs/UTFree/1/pack.exe HTTP/1.1

Host: download.cdn.unthreat.com

Accept: */*

Accept-Encoding: identity

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 23 Jan 2014 18:17:22 GMT

Accept-Ranges: bytes

Content-Length: 11830272

X-Stat-Server: utall

Content-Type: application/octet-stream

Cache-Control: max-age=2592000

Expires: Wed, 18 Mar 2015 09:38:15 GMT

Date: Mon, 16 Feb 2015 09:38:15 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........%c..K0..K0
[email protected][email protected]..
.0..K0...0..K0..M0..K0Rich..K0................PE..L....S.L............
..............................@..................................w....
..................................|9..d....................j..0.......
......................................................................
...............text............................... ..`.rdata..\Q......
.R..................@[email protected][email protected]
[email protected]..............
@..@..................................................................
......................................................................
......................................................................
......................................................................
.................................................0.A...5lPB...cB..)J..
..L.A.. ......SVQ...M.......M.3..]...K...M..].j..]..].......E....A.P.E
.Pj.Y.E...yA..;.|......u...F...u...F..Y..Y^.M.[d.........t$..t$..E....
.u...tPB.j.Z........U..QVh;[email protected].....^U.
.QVW........Q...M.3. ..U.t.It.Iu..U....E....E...u...V.u...U...._^.....
`.A.........V...5hPB..M..(....u..e...U...j..6....u...F..Y^.M.d........
.....A........D...SVW.e...|.A...cB..5dPB.....H...M.........A..}.3..]..
.x.A..M.P......U..M..E...[:...]..u...E..Y.].j..M..]..]......j..M..
<<< skipped >>>

GET /CSC39-EN-37600-F.sbr.sgn HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: avupdate.unthreat.com

Pragma: no-cache

HTTP/1.0 200 OK

Server: nginx

Content-Type: application/octet-stream

Content-Length: 149918035

Last-Modified: Mon, 16 Feb 2015 08:28:20 GMT

Accept-Ranges: bytes

Date: Mon, 16 Feb 2015 09:38:30 GMT

Connection: keep-alive
@....uD..N.q.U.-E~7bvJC...'.ah^~\.`S:k..............x...).*[email protected]
r!.....s..........U1t..3............i&@\AA.3.. ...acertdefs0.std..n*e.
.A......6HvX..to..E..CtB.OV....11&...8....S.ke*...*4.J.^...h..\.......
r&v....9'a...h.J1.$....<9.t....I..<.9...w.....<.p&..o........
...x..*....v........0.c...........^n.W.Q....9Y.$......Mm^..f..!R.W....
ea.r...P...}.(hB....T.....Y>o]O.U...9...*u..."....x.X..A.7..L."D...
..$|.:W...... .........>.|.x..?.._.......n.."......B...O.%..g...'..
..........F.H..db;.4....x..&......I......K...&T..N..AH}.`;..~...-{..T.
......u.....s..1..?.0...........QX=.V.(.......l...t..1.h_..FF........8
NF.3.. ...adsrules.dat..r:E.....Q....~..^...z`....dvW.H.F..^z.UI3....B
@.....]....1.0....8A..... rp.....U..1.O.^_..e.....?.[.Z..........1 ...
.........5... po......G.;.!...qt*.t....J........v.\B....?..v.5....a..X
..........W.....C.~...-../............|.S/.......~Z..."...w..x.5...D..
...:aA2*GU~.5...&|..@X..#.I.........=_)..m^Zw.2....w. ...z8e.@....~2..
}L.xP%l>.[r.j........Dl..N...w....2d....!....../......I..#.$vl.]m..
..t..="..~j...jk...i.c. ..D.d.e..e...>...|...4.y.a......... .R.wt.P
z.ke....[ .e......C-..o#.s...T...........fv6.(C._.n.>..(......u....
...e..Q...G...Y...P<.&.'.......<.j{"..uw......V.....R.P.D#R/.$4O
.9...7.q..2.U,.......q.es..5.Z#fS?a..!uE.5..E....".....`0...O...;.....
.... ....-..H2.Lhm. .}.u.|L...........5>.\}....M/....v.e\9I....U.).
..B.....`-..7k...~y...^...]:.x....8R..x.#.H\/.J......Xmly.pAV....#~.#.
*..T..n.|o..X..r....-7......sJ....J........yl0..*.Q |7i.r.......-l
<<< skipped >>>

GET /CSC39-EN-37600-F.sbr.sgn HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: avupdate.unthreat.com

Pragma: no-cache

HTTP/1.0 200 OK

Server: nginx

Content-Type: application/octet-stream

Content-Length: 149918035

Last-Modified: Mon, 16 Feb 2015 08:28:20 GMT

Accept-Ranges: bytes

Date: Mon, 16 Feb 2015 09:39:37 GMT

Connection: keep-alive
@....uD..N.q.U.-E~7bvJC...'.ah^~\.`S:k..............x...).*[email protected]
r!.....s..........U1t..3............i&@\AA.3.. ...acertdefs0.std..n*e.
.A......6HvX..to..E..CtB.OV....11&...8....S.ke*...*4.J.^...h..\.......
r&v....9'a...h.J1.$....<9.t....I..<.9...w.....<.p&..o........
...x..*....v........0.c...........^n.W.Q....9Y.$......Mm^..f..!R.W....
ea.r...P...}.(hB....T.....Y>o]O.U...9...*u..."....x.X..A.7..L."D...
..$|.:W...... .........>.|.x..?.._.......n.."......B...O.%..g...'..
..........F.H..db;.4....x..&......I......K...&T..N..AH}.`;..~...-{..T.
......u.....s..1..?.0...........QX=.V.(.......l...t..1.h_..FF........8
NF.3.. ...adsrules.dat..r:E.....Q....~..^...z`....dvW.H.F..^z.UI3....B
@.....]....1.0....8A..... rp.....U..1.O.^_..e.....?.[.Z..........1 ...
.........5... po......G.;.!...qt*.t....J........v.\B....?..v.5....a..X
..........W.....C.~...-../............|.S/.......~Z..."...w..x.5...D..
...:aA2*GU~.5...&|..@X..#.I.........=_)..m^Zw.2....w. ...z8e.@....~2..
}L.xP%l>.[r.j........Dl..N...w....2d....!....../......I..#.$vl.]m..
..t..="..~j...jk...i.c. ..D.d.e..e...>...|...4.y.a......... .R.wt.P
z.ke....[ .e......C-..o#.s...T...........fv6.(C._.n.>..(......u....
...e..Q...G...Y...P<.&.'.......<.j{"..uw......V.....R.P.D#R/.$4O
...~}....Q.....>??z.k.....bbV...Zx...=..[=.........C*{.!...D......r
|..>W".T..\....g.. .t .tWT.__ ....c....)..u\x[.......Y!..=....:<
...3Z. J....R.({6>-K =o.).Dx3N..w..."....6A{..y..tdx...X.....5.....
!.....D.u..]{..Z.=.z\a,.....B.._.X.4...#Q..].z/.:m...9...........}
<<< skipped >>>

GET /spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0 HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:36 GMT

X-Server: utall

Content-Length: 74

Content-Type: text/html

Vary: Accept-Encoding

Cache-Control: max-age=7200

Expires: Mon, 16 Feb 2015 11:39:36 GMT

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
hXXp://avupdate.unthreat.com/CSC39-EN-37600-F.sbr.sgn?MD5=&SIZE=149918
035|..

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:56 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591974" seat
s="1" package="unthreatfree"/></userResponse>...

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:29 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591941" seat
s="1" package="unthreatfree"/></userResponse>...

GET /spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0 HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:18 GMT

X-Server: utall

Content-Length: 74

Content-Type: text/html

Vary: Accept-Encoding

Cache-Control: max-age=7200

Expires: Mon, 16 Feb 2015 11:39:18 GMT

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
hXXp://avupdate.unthreat.com/CSC39-EN-37600-F.sbr.sgn?MD5=&SIZE=149918
035|..

GET /CSC39-EN-37600-F.sbr.sgn HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: avupdate.unthreat.com

Pragma: no-cache

HTTP/1.0 200 OK

Server: nginx

Content-Type: application/octet-stream

Content-Length: 149918035

Last-Modified: Mon, 16 Feb 2015 08:28:20 GMT

Accept-Ranges: bytes

Date: Mon, 16 Feb 2015 09:39:19 GMT

Connection: keep-alive
@....uD..N.q.U.-E~7bvJC...'.ah^~\.`S:k..............x...).*[email protected]
r!.....s..........U1t..3............i&@\AA.3.. ...acertdefs0.std..n*e.
.A......6HvX..to..E..CtB.OV....11&...8....S.ke*...*4.J.^...h..\.......
r&v....9'a...h.J1.$....<9.t....I..<.9...w.....<.p&..o........
...x..*....v........0.c...........^n.W.Q....9Y.$......Mm^..f..!R.W....
ea.r...P...}.(hB....T.....Y>o]O.U...9...*u..."....x.X..A.7..L."D...
..$|.:W...... .........>.|.x..?.._.......n.."......B...O.%..g...'..
..........F.H..db;.4....x..&......I......K...&T..N..AH}.`;..~...-{..T.
......u.....s..1..?.0...........QX=.V.(.......l...t..1.h_..FF........8
NF.3.. ...adsrules.dat..r:E.....Q....~..^...z`....dvW.H.F..^z.UI3....B
@.....]....1.0....8A..... rp.....U..1.O.^_..e.....?.[.Z..........1 ...
.........5... po......G.;.!...qt*.t....J........v.\B....?..v.5....a..X
..........W.....C.~...-../............|.S/.......~Z..."...w..x.5...D..
...:aA2*GU~.5...&|..@X..#.I.........=_)..m^Zw.2....w. ...z8e.@....~2..
}L.xP%l>.[r.j........Dl..N...w....2d....!....../......I..#.$vl.]m..
..t..="..~j...jk...i.c. ..D.d.e..e...>...|...4.y.a......... .R.wt.P
z.ke....[ .e......C-..o#.s...T...........fv6.(C._.n.>..(......u....
...e..Q...G...Y...P<.&.'.......<.j{"..uw......V.....R.P.D#R/.$4O
.9...7.q..2.U,.......q.es..5.Z#fS?a..!uE.5..E....".....`0...O...;.....
.... ....-..H2.Lhm. .}.u.|L...........5>.\}....M/....v.e\9I....U.).
..B.....`-..7k...~y...^...]:.x....8R..x.#.H\/.J......Xmly.pAV....#~.#.
*..T..n.|o..X..r....-7......sJ....J........yl0..*.Q |7i.r.......-l
<<< skipped >>>

GET /spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0 HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:30 GMT

X-Server: utall

Content-Length: 74

Content-Type: text/html

Vary: Accept-Encoding

Cache-Control: max-age=7200

Expires: Mon, 16 Feb 2015 11:38:30 GMT

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
hXXp://avupdate.unthreat.com/CSC39-EN-37600-F.sbr.sgn?MD5=&SIZE=149918
035|..

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com

HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Mon, 16 Feb 2015 09:43:02 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl
0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Mon, 16 Feb 2015 09:43:02 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.
<<< skipped >>>

GET /spurs/spurs.php?product=430&appversion=4.0.0&vendor=UnThreat&language=EN&package=ThreatDef&RequestorPackageVersion=0 HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:01 GMT

X-Server: utall

Content-Length: 74

Content-Type: text/html

Vary: Accept-Encoding

Cache-Control: max-age=7200

Expires: Mon, 16 Feb 2015 11:39:01 GMT

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
hXXp://avupdate.unthreat.com/CSC39-EN-37600-F.sbr.sgn?MD5=&SIZE=149918
035|..

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:11 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591959" seat
s="1" package="unthreatfree"/></userResponse>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=561323, public, no-transform, must-revalidate

Last-Modified: Sun, 15 Feb 2015 21:38:27 GMT

Expires: Sun, 22 Feb 2015 21:38:27 GMT

Date: Mon, 16 Feb 2015 09:43:05 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
5213827Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150215213827Z....20150222213827Z0...*.H........
........?..s......RP.C......q..g[=..X...r......di....;s...U.......C..R
....'.zM.Xu...x..2.M.0..|g.M........*.O>....j]..(.N.......-.uC.....
.f......d..i......{[...)3\.H3=H ..."...... ....Hx.]..!.rs.".t..<...
...'.{.t..\m.s.B.....y.....Q...=.@a=...Txw.Ic...............#0...0...0
..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.....{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.
.........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG
.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l.
...(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...
U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veri
sign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS inco
rp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U..
......0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H
<<< skipped >>>

GET /CSC39-EN-37600-F.sbr.sgn HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: avupdate.unthreat.com

Pragma: no-cache

HTTP/1.0 200 OK

Server: nginx

Content-Type: application/octet-stream

Content-Length: 149918035

Last-Modified: Mon, 16 Feb 2015 08:28:20 GMT

Accept-Ranges: bytes

Date: Mon, 16 Feb 2015 09:39:01 GMT

Connection: keep-alive
@....uD..N.q.U.-E~7bvJC...'.ah^~\.`S:k..............x...).*[email protected]
r!.....s..........U1t..3............i&@\AA.3.. ...acertdefs0.std..n*e.
.A......6HvX..to..E..CtB.OV....11&...8....S.ke*...*4.J.^...h..\.......
r&v....9'a...h.J1.$....<9.t....I..<.9...w.....<.p&..o........
...x..*....v........0.c...........^n.W.Q....9Y.$......Mm^..f..!R.W....
ea.r...P...}.(hB....T.....Y>o]O.U...9...*u..."....x.X..A.7..L."D...
..$|.:W...... .........>.|.x..?.._.......n.."......B...O.%..g...'..
..........F.H..db;.4....x..&......I......K...&T..N..AH}.`;..~...-{..T.
......u.....s..1..?.0...........QX=.V.(.......l...t..1.h_..FF........8
NF.3.. ...adsrules.dat..r:E.....Q....~..^...z`....dvW.H.F..^z.UI3....B
@.....]....1.0....8A..... rp.....U..1.O.^_..e.....?.[.Z..........1 ...
.........5... po......G.;.!...qt*.t....J........v.\B....?..v.5....a..X
..........W.....C.~...-../............|.S/.......~Z..."...w..x.5...D..
...:aA2*GU~.5...&|..@X..#.I.........=_)..m^Zw.2....w. ...z8e.@....~2..
}L.xP%l>.[r.j........Dl..N...w....2d....!....../......I..#.$vl.]m..
..t..="..~j...jk...i.c. ..D.d.e..e...>...|...4.y.a......... .R.wt.P
z.ke....[ .e......C-..o#.s...T...........fv6.(C._.n.>..(......u....
...e..Q...G...Y...P<.&.'.......<.j{"..uw......V.....R.P.D#R/.$4O
.9...7.q..2.U,.......q.es..5.Z#fS?a..!uE.5..E....".....`0...O...;.....
.... ....-..H2.Lhm. .}.u.|L...........5>.\}....M/....v.e\9I....U.).
..B.....`-..7k...~y...^...]:.x....8R..x.#.H\/.J......Xmly.pAV....#~.#.
*..T..n.|o..X..r....-7......sJ....J........yl0..*.Q |7i.r.......-l
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.0

VTag: 438542942000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=775

Date: Mon, 16 Feb 2015 09:42:13 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.5

VTag: 791633315200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Mon, 16 Feb 2015 09:42:13 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 279252244600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Mon, 16 Feb 2015 09:42:14 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]..

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?00ec416eef2d9e94 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Mon, 16 Feb 2015 09:42:13 GMT

Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Mon, 16 Feb 2015 09:42:13 GMT..Conn
ection: keep-alive..

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:29 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2592000" seat
s="1" package="unthreatfree"/></userResponse>...

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="0"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:36 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591934" seat
s="1" package="unthreatfree"/></userResponse>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=382830, public, no-transform, must-revalidate

Last-Modified: Fri, 13 Feb 2015 20:02:51 GMT

Expires: Fri, 20 Feb 2015 20:02:51 GMT

Date: Mon, 16 Feb 2015 09:43:02 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150213200251Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201502
13200251Z....20150220200251Z0...*.H.............|;\....{F..0\..(C...="
.PP.[3.G...^8!...........4.D..Z..PW....`.)Rj.e0n.....H.Q{.%>..._.,B
...:...9.n..D6..)...%.2.]..$M.=..*....mlT.n.=Qk..e........w\.V...mY.:h
....}9..YI.Vm.......%.........J.m.^.....~....<..v...r....u....{!.s.
....y..G.F.p...B...%....izg=......0...0...0..{.........[..I|.....Zm..0
...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....Veri
Sign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/
rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000
000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA 
OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.
-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f
..;]s!.\"v...|....][email protected]. ..W....n..*
..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.
....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... 
.......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#
.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com
/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o
...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo.....
.E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|........
<<< skipped >>>

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="0"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:39:01 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591969" seat
s="1" package="unthreatfree"/></userResponse>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=443563, public, no-transform, must-revalidate

Last-Modified: Sat, 14 Feb 2015 12:53:05 GMT

Expires: Sat, 21 Feb 2015 12:53:05 GMT

Date: Mon, 16 Feb 2015 09:42:43 GMT

Connection: keep-alive
0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..2015021
4125305Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..R...%V.......K3.....20150214125305Z....20150221125305Z0...*.H.....
..........N..4#.p.........2X-..%......\4o..T...L...*.pQ7K.....t.#.$...
A..o....>.y.....v.N..K.R...........YO.s.:.4....~...U^..v.......!...
......l<......18].Ty.R..^..1B..`.....16..J..b....q...p.~3P.,...tr.&
gt;.\.'i,B....*... Su.A.g.VV.......}.><......7...?..RL.{[email protected]...
...0...0...0...........2...'U.BM...g.B0...*.H........0..1.0...U....US1
.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c
) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign 
Class 3 Public Primary Certification Authority - G50...141202000000Z..
151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U...
.Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Respo
nder Certificate 30.."0...*.H.............0...............2&..PL...,..
2....:..tH...`JG.%..*...s.c%[email protected]"
1.5?..s.....3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.
....@2$"..$l.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^.
.s'....f.6.pr4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`
.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...ht
tp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... ....
.0......0!..U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..
eUNp0...U.#..0.....e......0..C9...3130...*.H.............(.&..Dgr.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECmFQ0IsyBgAlJ/VNRDQEas= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=508238, public, no-transform, must-revalidate

Last-Modified: Sun, 15 Feb 2015 06:53:21 GMT

Expires: Sun, 22 Feb 2015 06:53:21 GMT

Date: Mon, 16 Feb 2015 09:42:43 GMT

Connection: keep-alive
0..........0..... .....0......0...0......u\..3Oo?U...H.....O!..2015021
5065321Z0s0q0I0... ...................F....0.yV......{&.K......&......
.).CB,......5........20150215065321Z....20150222065321Z0...*.H........
.....P.\.n........L/s.&.h.#[email protected]."[email protected]..|.
.c.Kn  lgE.*!U1.N.....~..n.G>[email protected].),...F?.`t<.6.bt..Z~._..,...
d`..7 .......&..<.e.....!..C7....?Ew.F.8........m".]a..Tv&n.7H.l.i!
...Y...;!.W.Z.:/..,.!...........G.<.9..2.i.].:...k......[.` ....0..
.0...0........../...nj0...}..i..0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 
Code Signing 2010 CA0...141204000000Z..150304235959Z0..1.0...U....US1.
0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1Ver
iSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............
0.........4.4...........o....?..f.........I.!.b.L...L..U.........rM.,.
....=..cR4d.~*..k..x......=.WT.<.A2n1.qZyM.M..Q_...8....9....d.... 
...'.........h..Z..I...(.b.jK..DO.ra..gb..j..A.(....mrzU.w.......Bv...
l.:s..L....y.....u..n.)W......Y!....Q...,.i|.....:.Mu..DD1.........0..
.0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www
.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS
 incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0.
..U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24600...*.
[email protected].=.. ...........hi.......&g
<<< skipped >>>

POST /register/check4d.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

Connection: Keep-Alive

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; ICS)

Host: VVV.unthreat.com

Pragma: no-cache

Content-Length: 251

<?xml version="1.0" encoding="utf-8"?>

<userRequest><update defVer="0" progVer="37"/><ident machine="{C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}" name="" email="" serial="" package="unthreatfree" isTrial="1" auto="1"/><stats lastscan="0"/></userRequest>

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:47 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache

Pragma: no-cache

X-Server: utall

Content-Length: 351

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

X-Stat-Server: utall

Keep-Alive: timeout=7, max=1000

Connection: Keep-Alive
<userResponse><update><programUpdate installNow="0" ver
="30"/><definitions ver="0" productID="430" stageID="0" vendor="
UnThreat" appversion="4.0.0" packageType="ThreatDef">hXXp://VVV.unt
hreat.com/spurs/spurs.php</definitions><others/></updat
e><ident result="OK" isTrial="1" serial="" expire="2591983" seat
s="1" package="unthreatfree"/></userResponse>...

GET /install_statistics.php?sysid=450&appid=0&clid={C3BE0BB7-0DFC-44DF-827E-D1E4724B34FB}&ln=en&osver=6.1&osl=en-US&pver=6.2.37.323&iver=6.2.37.323&ptype=n&itype=n&ch=0&ct=0&ostype=win64 HTTP/1.1

User-Agent: Brand HTTPConnection

Host: service.unthreat.com

HTTP/1.1 200 OK

Date: Mon, 16 Feb 2015 09:38:25 GMT

Content-Type: text/html

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Last-Modified: Mon, 16 Feb 2015 09:38:24GMT

Vary: Accept-Encoding

X-Stat-Server: utall

Transfer-Encoding: chunked
1..1..0..HTTP/1.1 200 OK..Date: Mon, 16 Feb 2015 09:38:25 GMT..Content
-Type: text/html..Expires: Sat, 26 Jul 1997 05:00:00 GMT..Cache-Contro
l: no-cache, must-revalidate..Pragma: no-cache..Last-Modified: Mon, 16
 Feb 2015 09:38:24GMT..Vary: Accept-Encoding..X-Stat-Server: utall..Tr
ansfer-Encoding: chunked..1..1..0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=542013, public, no-transform, must-revalidate

Last-Modified: Sun, 15 Feb 2015 16:13:12 GMT

Expires: Sun, 22 Feb 2015 16:13:12 GMT

Date: Mon, 16 Feb 2015 09:43:02 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015021
5161312Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150215161312Z....20150222161312Z0...*.H........
.........,./.......0..C..9"%.66........toD..:.:..;..\..e."b.I..O_...&l
t;X.h.<}j%1 .C.._.y{...~|.C.$6....Gd9)Z..a...V...qL.;.*[email protected].
...'.f......C...f.C.....G.8`.....:[email protected]
b)..:.].|_h.^E....{D.f..Y.6^.,l.;..4......R..(XZF7...0.......0...0...0
..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 30.."0...*.H.............0..........
'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-;
 ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS
.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]E...=.
_...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..
U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .
......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........
0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H...........
..$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..
D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,t>....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=545310, public, no-transform, must-revalidate

Last-Modified: Sun, 15 Feb 2015 17:08:25 GMT

Expires: Sun, 22 Feb 2015 17:08:25 GMT

Date: Mon, 16 Feb 2015 09:43:02 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
5170825Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150215170825Z....20150222170825Z0...*.H........
[email protected]{PiI...T.t..=9d).....4b.A.A
>.)?.C.....v`R.... :&Bk-y..........G.9...(.|c..l.Il.l.;i....l.....f
eX...p..H<a..c.{..&c.N......(p...C~.k.P..3...!@.>......rZ.j.%..0
.R.[..5p.....5....A.s....!s&.GJh.%{=.h&...N<.*..s.....'(2ox....#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710
<<< skipped >>>

The Malware connects to the servers at the folowing location(s):

.text

`.itext

`.data

.idata

.didata

.rdata

@.reloc

B.rsrc

System.Types

System.UITypes

TWindowState

poPortrait

MajorOperatingSystemVersion

MinorOperatingSystemVersion

biClrImportant

tagMSG

Winapi.Windows

HKEY

TWMKey

MsgFiller

KeyData

KeyDataFiller

etNoMonitorSupportException

System.Internal.ExcUtils

TArray<System.Byte>

System.SysUtils

ENotSupportedException

ENoMonitorSupportException

TArray<System.SysUtils.TLangRec>

TArray<System.Char>

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

System.SysUtils0

&TArray<System.SysUtils.TUnitHashEntry>

Winapi.ActiveX

grfLocksSupported

System.Variants

Operator

System.VariantsX"@

EVariantBadIndexErrorl

EVariantBadIndexErrorD

System.TypInfo

TPropSet<System.WideString>V

TPropSet<System.WideString>

TPropSet<System.string>V

TPropSet<System.string>

TPropSet<System.Single>K

TPropSet<System.Single>

TPropSet<System.Double>K

TPropSet<System.Double>d

TPropSet<System.Extended>K

TPropSet<System.Extended>

TPropSet<System.Comp>K

TPropSet<System.Comp>@

TPropSet<System.Currency>K

TPropSet<System.Currency>

TPropSet<System.IInterface>V

TPropSet<System.IInterface>p

System.Classes

ssShift

htKeyword

EInvalidOperation

EInvalidOperationx

TList.TDirection

AOperator

TThread.TSynchronizeRecord

TOperation

TObservers.TCanObserveEvent

TObservers.TObserverAddedEvent

Operation

FOnExecute

OnExecuteL

TArray<System.string>

TArray<System.TObject>

ELoginCredendialError

ELoginCredendialError`^D

"TLoginCredentialService.TLoginFunc

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxy$aD

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialServicelbD

TList.Sort$267$0$Intf

TList.Sort$267$ActRec

#TComponent.FindComponent$891$0$Intf

#TComponent.FindComponent$891$ActRec

"TComponent.GetObservers$902$0$Intf

"TComponent.GetObservers$902$1$Intf

"TComponent.GetObservers$902$ActRec

"TComponent.GetObservers$902$ActRecXhE

7TLoginCredentialService.GetLoginCredentials$1172$0$Intf

LPassword

7TLoginCredentialService.GetLoginCredentials$1172$ActRec

7TLoginCredentialService.GetLoginCredentials$1172$ActRecH

Winapi.Wincodec

TTimeSpanParser.TParseError

System.TimeSpan

System.SyncObjs

System.SyncObjsl

TFunc<System.Boolean>

System.SyncObjsp

System.Generics.Collections

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome,

Uh.NG

System.Contnrs

Vcl.ActnList

IsShortCut

FHelpKeyword

HelpKeyword

$:Crtc

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Vcl.StdCtrls

Vcl.StdCtrls,

FPasswordChar

Vcl.StdCtrlsB

PasswordChar43O

OnKeyDown

OnKeyPressx

OnKeyUpT

TCustomButton.TButtonStyle

Vcl.StdCtrls:

Vcl.StdCtrls*

OnKeyUpL

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindowX

%TCustomEdit.ObserverAdded$3288$0$Intf

%TCustomEdit.ObserverAdded$3288$ActRec

System.Win.ComObj

Winapi.ShlObj

Vcl.Printers

APort

Port

Vcl.StdActns

Vcl.ComCtrls

System.HelpIntfs

UnderstandsKeyword

Vcl.Dialogs

OnExecute@

FURL

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials4ZK

.TDefaultLoginCredentials.LoginEvent$833$0$Intf

.TDefaultLoginCredentials.LoginEvent$833$ActRec

.TDefaultLoginCredentials.LoginEvent$833$ActRecp\K

3TDefaultLoginCredentials.LoginEventUsrPw$835$0$Intf

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

TCustomStyleServicesClassh

 TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

"TArray<Vcl.Themes.TStyleHookClass>

'TEnumerator<Vcl.Themes.TStyleHookClass>(

'TEnumerator<Vcl.Themes.TStyleHookClass>

'TEnumerable<Vcl.Themes.TStyleHookClass>-

'TEnumerable<Vcl.Themes.TStyleHookClass>

B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:1

%IComparer<Vcl.Themes.TStyleHookClass>

System.Generics.Defaults

2TCollectionNotifyEvent<Vcl.Themes.TStyleHookClass>

'IEnumerable<Vcl.Themes.TStyleHookClass>

-TList<Vcl.Themes.TStyleHookClass>.TEnumerator5

-TList<Vcl.Themes.TStyleHookClass>.TEnumerator$bL

!TList<Vcl.Themes.TStyleHookClass>&

!TList<Vcl.Themes.TStyleHookClass>

RTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

AKey

eTArray<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>(

jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>0oL

jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>-

jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

^TDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItem

cTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItemArray

IEqualityComparer<System.TClass>

%TCollectionNotifyEvent<System.TClass>

UTCollectionNotifyEvent<System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

Item!TList<Vcl.Themes.TStyleHookClass>

TArray<System.TClass>

TEnumerator<System.TClass>(

TEnumerator<System.TClass>\vL

TEnumerable<System.TClass>-

TEnumerable<System.TClass>

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumerator;

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumerator

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection;

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection

4TArray<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>(

9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>-

9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>$

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator;

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollection;

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollection

hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumerator;

hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumeratorH

FOnKeyNotify

FKeyCollection

XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>9

ContainsKey

XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

Keys,

OnKeyNotify

9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>

LTArray<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>(

QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>-

QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>(

ETDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItem

JTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItemArray

IEqualityComparer<System.string>

%TCollectionNotifyEvent<System.string>

<TCollectionNotifyEvent<Vcl.Themes.TStyleManager.TSourceInfo>

TEnumerator<System.string>(

TEnumerator<System.string>

TEnumerable<System.string>-

TEnumerable<System.string>

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumerator;

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumerator@

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollection;

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollectionH

,TArray<Vcl.Themes.TStyleManager.TSourceInfo>

1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>(

1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>

1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>-

1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>$

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator;

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection;

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection

OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator;

OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator

?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>9

?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>

Keys

6TArray<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>(

;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>-

;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>p

V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:1

9IComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

FTCollectionNotifyEvent<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

Item#TStyleManager.TStyleClassDescriptor

;IEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator5

ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator8

5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>&

5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

*TArray<Vcl.Themes.TCustomStyleEngineClass>

/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>(

/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>

/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>-

/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>$

J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:1

-IComparer<Vcl.Themes.TCustomStyleEngineClass>

:TCollectionNotifyEvent<Vcl.Themes.TCustomStyleEngineClass>

/IEnumerable<Vcl.Themes.TCustomStyleEngineClass>

5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator5

5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator

)TList<Vcl.Themes.TCustomStyleEngineClass>&

)TList<Vcl.Themes.TCustomStyleEngineClass>`

'TArray<Vcl.Themes.TCustomStyleServices>

,TEnumerator<Vcl.Themes.TCustomStyleServices>(

,TEnumerator<Vcl.Themes.TCustomStyleServices>

,TEnumerable<Vcl.Themes.TCustomStyleServices>-

,TEnumerable<Vcl.Themes.TCustomStyleServices>

G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:1

Vcl.Themesh

*IComparer<Vcl.Themes.TCustomStyleServices>

7TCollectionNotifyEvent<Vcl.Themes.TCustomStyleServices>

,IEnumerable<Vcl.Themes.TCustomStyleServices>

2TList<Vcl.Themes.TCustomStyleServices>.TEnumerator5

2TList<Vcl.Themes.TCustomStyleServices>.TEnumeratorx

&TList<Vcl.Themes.TCustomStyleServices>&

&TList<Vcl.Themes.TCustomStyleServices><

TArray<System.Types.TPoint>

TEnumerator<System.Types.TPoint>(

TEnumerator<System.Types.TPoint>

TEnumerable<System.Types.TPoint>-

TEnumerable<System.Types.TPoint>

;:{System.Generics.Collections}TList<System.Types.TPoint>.:1

IComparer<System.Types.TPoint>

 TCollectionNotifyEvent<System.Types.TPoint>

IEnumerable<System.Types.TPoint>

&TList<System.Types.TPoint>.TEnumerator5

&TList<System.Types.TPoint>.TEnumerator

TList<System.Types.TPoint>&

TList<System.Types.TPoint>|/M

'TComparison<Vcl.Themes.TStyleHookClass>

%TComparer<Vcl.Themes.TStyleHookClass>2

%TComparer<Vcl.Themes.TStyleHookClass>

B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:3

:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:1

hIComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

uTCollectionNotifyEvent<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

ItemRTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

jIEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator5

pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator

dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>&

dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

5:{System.Generics.Collections}TList<System.TClass>.:1

IComparer<System.TClass>

IEnumerable<System.TClass>

TList<System.TClass>.TEnumerator5

TList<System.TClass>.TEnumerator

TList<System.TClass>&

TList<System.TClass>pbN

T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:1

7IComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

9IEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumerator5

?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumerator

3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>&

3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:1

Vcl.Themes

OIComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

\TCollectionNotifyEvent<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

Item9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>

QIEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumerator5

WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumerator

KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>&

KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

5:{System.Generics.Collections}TList<System.string>.:1

IComparer<System.string>

IEnumerable<System.string>

TList<System.string>.TEnumerator5

TList<System.string>.TEnumerator

TList<System.string>&

TList<System.string>

L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:1

/IComparer<Vcl.Themes.TStyleManager.TSourceInfo>

1IEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>

7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator5

7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator

 TList<Vcl.Themes.TStyleManager.TSourceInfo>&

 TList<Vcl.Themes.TStyleManager.TSourceInfo>

;TComparison<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>2

9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:3

/TComparison<Vcl.Themes.TCustomStyleEngineClass>

-TComparer<Vcl.Themes.TCustomStyleEngineClass>2

-TComparer<Vcl.Themes.TCustomStyleEngineClass>8

J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:3

,TComparison<Vcl.Themes.TCustomStyleServices>

*TComparer<Vcl.Themes.TCustomStyleServices>2

*TComparer<Vcl.Themes.TCustomStyleServices>D

G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:3

TComparison<System.Types.TPoint>

TComparer<System.Types.TPoint>2

TComparer<System.Types.TPoint>8

;:{System.Generics.Collections}TList<System.Types.TPoint>.:3

.TDelegatedComparer<Vcl.Themes.TStyleHookClass>8

.TDelegatedComparer<Vcl.Themes.TStyleHookClass>L

jTComparison<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>2

hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:3

TComparison<System.TClass>

TComparer<System.TClass>2

TComparer<System.TClass>

5:{System.Generics.Collections}TList<System.TClass>.:3

9TComparison<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>2

7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>|

T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:3

QTComparison<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>2

OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:3

TComparison<System.string>

TComparer<System.string>2

TComparer<System.string>

5:{System.Generics.Collections}TList<System.string>.:3

1TComparison<Vcl.Themes.TStyleManager.TSourceInfo>

/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>2

/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>

L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:3

BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>8

BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>0

6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>8

6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>

3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>8

3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>

'TDelegatedComparer<System.Types.TPoint>8

'TDelegatedComparer<System.Types.TPoint>t

qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>8

qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

!TDelegatedComparer<System.TClass>8

!TDelegatedComparer<System.TClass>D

@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>8

@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>8

XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

!TDelegatedComparer<System.string>8

!TDelegatedComparer<System.string>

8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>8

8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>D

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeysH

AutoHotkeys

Vcl.Forms

ssHotTrack

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview<.O

WindowState`

Vcl.Formsa

KeyPreviewx

WindowStatel O

Vcl.Formsp

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

BiDiKeyboard

NonBiDiKeyboard

OnActionExecutet

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHook(%P

EnterWithKeyboard

D$< FTP

Vcl.SvcMgr

FPassword

ReportStatus

OnExecute

Vcl.SvcMgrL

;!199{199

;0!8&2{199

"<;=!!%{199

Supports

AddItemsG

Windows 95

Windows 95 OSR-2

Windows 98

Windows 98 SE

Windows ME

Windows 9x New

Windows NT 3

Windows NT 4

Windows 2000

Windows XP

Windows 2003

Windows Vista

Windows 2008

Windows 7

Windows 2008 R2

Windows 8

Windows Server 8

Windows NT New

TMsgHandler

TMsgHandlerOO

TImageImportDirectory

PImageImportDirectory

TImageExportDirectory(

PImageExportDirectory

TMsgHandlers

madToolsMsgHandlerWindow

GetHotKey

GetShowCmd

SetHotKey

SetShowCmd

FHasShellFolder

comctl32.dll

FWatchMsg

FShMsg

ShMsgHandlerProc

WatchMsgHandlerProc

shell32.dll

windows-874

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

FAesKeyHex

LoadFromURL

AesKeyHexp

hcRT

Vcl.OleServer

LicenseKey

'TServerEventDispatch.Invoke$7171$0$Intf

'TServerEventDispatch.Invoke$7171$ActRec

'TServerEventDispatch.Invoke$7171$ActRec(

INetFwOpenPort

CoNetFwOpenPort1

CoNetFwOpenPortp

Vcl.AxCtrls

Vcl.OleCtrls

Uh&%U

AddTcpPortToFirewall

ProtocollPort

PortRemoteAddresses

AddUdpPortToFirewall

AMsg

EIdCanNotBindPortInRange

EIdCanNotBindPortInRangexUU

EIdInvalidPortRange

EIdInvalidPortRange8VU

CheckIPVersionSupport

WSGetServByPort

APortNumber

AddServByPortToList

VPort

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindows

EIdIPVersionUnsupported

ReceiveMsg,

EIdPortRequired

EIdTCPConnectionErrorL

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

FPort

VMsgEnd

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax

PeerPort

"EIdTransparentProxyUDPNotSupported

OpenUDP

CloseUDP

RecvFromUDP

SendToUDPm

PortXaU

IPAsStringU

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersionHiW

saUsernamePassword

FUDPSocksAssociation

SendToUDP9

Uh.wW

FBoundPort

FBoundPortMax

FBoundPortMin

FDefaultPort

BoundPort

DefaultPortXaU

BoundPortMax

BoundPortMinL

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

SendCmdf

TIdTCPConnection

IdTCPConnection

LastCmdResult

TIdTCPClientCustom'

TIdTCPClientCustom|

IdTCPClient

BoundPortMin

TIdTCPClient

>0';0974&0{199

;3:'84!<:;

&8&&{0-0

::9=09%fg

;<!<49</0

-60%!<:;

<&%4!6=0'

;&!' 6!<:;

;<6:"&{199

:;!4<;0'

&9{0-0

'<#<9020

";0'&=<%

'02<&!',

port

portThread

QuoteHTTP

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEYl8Z

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUX

cert_info

ex_nscert

get_cert_methods

cert_crl

ppem_password_cb

key_arg_length

key_arg

master_key_length

master_key

sess_cert

PSSL_CTX_info_callback.VZ

Ptlsext_ticket_key_cbyVZ

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile

CertFile

KeyFile

LoadRootCert

LoadCert

fPeerCert

PeerCertP

fOnGetPassword

fOnGetPasswordEx

OnGetPassword

OnGetPasswordEx

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertErrorH

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

SEC_GET_KEY_FN

KeyVer

pGetKeyFn

pvGetKeyArgument

EXPORT_SECURITY_CONTEXT_FN

IMPORT_SECURITY_CONTEXT_FN_Wt

ExportSecurityContext

ImportSecurityContextW

aPassword

aExec

password

rw_password

ro_password

FPasswordW

GetPassword

SetPassword

GetReadWritePassword

SetReadWritePassword

Software\Microsoft\Windows\CurrentVersion\Network\LanMan\

UdpInBytes

UdpInPackets

UdpOutBytes

UdpOutPackets

TcpInBytes

TcpInPackets

TcpOutBytes

TcpOutPackets

PortScanIntrusions

TClientMsg

TUTSendMsgs

UTMSG_NONE

UTMSG_SENDQUARANTINE

UTMSG_QUARDELETEID

UTMSG_QUARDELETEALL

UTMSG_QUARPURGE

UTMSG_PAUSE

UTMSG_CONTINUE

UTMSG_STOP

UTMSG_UPDATEDEFVER

UTMSG_SENDBLOCKEDPID

UTMSG_SENDALLOWEDPID

UTMSG_CLEARALLOWEDPID

UTMSG_CLEARBLOCKEDPID

UTMSG_REMOVEBLOCKEDPID

UTMSG_REMOVEALLOWEDPID

UTMSG_SHUTDOWN

UTMSG_WSCCHECK

UTMSG_UNQARANTINE

UTMSG_RELOADMON

TAlertMsg

TFW_MSG

TUTRoadWarriorMsg

SendMsg

TUTWebFilter.

TUTWebFilter

WebFilter

TellUpdateMSG

msgs

-2147483648

TNTLM_Msg2_Info

EHttpContentCodingException

OverbyteIcsHttpContCod

THttpContentCodingClass\F]

THttpContentCoding?

THttpContentCoding@E]

THttpCCodIdentity

THttpCCodIdentityPG]

THttpCCodStar@H]

THttpCCodStar

THttpContCodItemN

THttpContCodItem

THttpContCodHandlerR

THttpContCodHandler

sin_port

FMsgQueued

MsgRec

FMsgRelease

TIcsMsgMap

FMsgMap

FMsgLow

FMsgCnt

AllocateMsgHandler

MsgLow

MsgLeftH

TWhMaxMsgIDs

SetWndHandlerMaxMsgIDs

wsoTcpNoDelay

wsoNoHttp10Tunnel

FDnsLookupCheckMsg

FDnsLookupTempMsg

FMsg_WM_ASYNCSELECT

FMsg_WM_ASYNCGETHOSTBYNAME

FMsg_WM_ASYNCGETHOSTBYADDR

FMsg_WM_CLOSE_DELAYED

FMsg_WM_TRIGGER_EXCEPTION

FMsg_WM_TRIGGER_DATA_AVAILABLE

FLocalPortResolved

FPortStr

FPortAssigned

FPortResolved

FPortNum

FLocalPortStr

FLocalPortNum

GetPeerPort

GetXPort

SetTcpNoDelayOption

THttpTunnelAuthType

THttpTunnelServerAuthTypes

THttpTunnelState

THttpTunnelErrorEvent

THttpTunnelChunkState

THttpTunnelProto

THttpTunnelReconnectRequest

FHttpTunnelAuthChallenge

FHttpTunnelAuthDigestCached

FHttpTunnelAuthDigestValid

FHttpTunnelAuthDigestHash

FHttpTunnelAuthDigestInfo

FHttpTunnelAuthType

FHttpTunnelBuf

FHttpTunnelBufSize

FHttpTunnelChunked

FHttpTunnelChunkRcvd

FHttpTunnelChunkSize

FHttpTunnelChunkState

FHttpTunnelCloseNotified

FHttpTunnelContentLength

FHttpTunnelCurAuthType

FHttpTunnelKeepsAlive

FHttpTunnelLastResponse

FHttpTunnelLmCompatLevel

FHttpTunnelReconnectRequest

FHttpTunnelPassword

FHttpTunnelPort

FHttpTunnelPortAssigned

FHttpTunnelProto

FHttpTunnelRcvdCnt

FHttpTunnelRcvdIdx

FHttpTunnelServer

FHttpTunnelServerAssigned

FHttpTunnelServerAuthTypes

FHttpTunnelState

FHttpTunnelStatusCode

FHttpTunnelUsercode

FHttpTunnelWaitingBody

FMsg_WM_TUNNEL_RECONNECT

FOnHttpTunnelConnected

FOnHttpTunnelError

TCustomHttpTunnelWSocket6

TCustomHttpTunnelWSocket

FSocksPort

FSocksPortAssigned

FSocksPassword

LocalPort

SocksPort

SocksPassword$

HttpTunnelAuthType

HttpTunnelPassword

HttpTunnelPort

HttpTunnelServer

HttpTunnelUsercode

OnHttpTunnelError4

OnHttpTunnelConnected(

PortNump

PeerPort`

HttpTunnelCurrentAuthType

HttpTunnelBufferSize

HttpTunnelLastResponse

HttpTunnelLmCompatLevel

255.255.255.255

0.0.0.1

HTTP/1.

Proxy server must support HTTP/1.1

THttpTunnelWSocket - DataAvailable error

Received header line too long. Increase HttpTunnelBufferSize.

THttpTunnelWSocket - Fatal: Invalid state in TriggerDataAvailable

THttpTunnelWSocket - Fatal: Internal error in WMHttpTunnelReconnect

EHttpExceptionD

EHttpException

OverbyteIcsHttpProt

THttpRequest

httpABORT

httpGET

httpPOST

httpPUT

httpHEAD

httpDELETE

httpCLOSE

THttpState

httpReady

httpNotConnected

httpConnected

httpDnsLookup

httpDnsLookupDone

httpWaitingHeader

httpWaitingBody

httpBodyReceived

httpWaitingProxyConnect

httpClosing

httpAborting

THttpChunkState

httpChunkGetSize

httpChunkGetExt

httpChunkGetData

httpChunkSkipDataEnd

httpChunkDone

THttpNTLMState

ntlmMsg1

ntlmMsg2

ntlmMsg3

THttpDigestState

digestMsg1

THttpBasicState

basicMsg1

THttpAuthType

httpAuthNone

httpAuthBasic

httpAuthNtlm

httpAuthDigest

THttpBeforeAuthEvent

THttpRequestDone

THttpCliOption

httpoNoBasicAuth

httpoNoNTLMAuth

httpoBandwidthControl

httpoEnableContentCoding

httpoUseQuality

httpoNoDigestAuth

THttpCliOptions

FMsg_WM_HTTP_REQUEST_DONE

FMsg_WM_HTTP_SET_READY

FMsg_WM_HTTP_LOGIN

FTargetPort

FProxyPort

FCurrPassword

FProxyPassword

FCurrentPort

FNTLMMsg2Info

FProxyNTLMMsg2Info

FWMLoginQueued

THttpCli6

THttpCli

OverbyteIcsHttpProtE

ProxyPort

ProxyPassword

MON_WEB

MON_WEBADS

MON_WEBBADURL

MON_WEBFILTER

otComPort

otPipe

otWindowStation

otKey

otPort

otKeyedEvent

TSkipWindows

TSSkipWindows

IWindows\

IExportEntry

IXxportList\

TExeType

TExecuteFunctionProc`Z`

GetWindows

GetTaskbarWindows

FExeFile

FExeTypeReady

FExeType

GetExeFile

GetExeType

GetExportList

ComPort

Pipe

WindowStation

KeyedEvent

msgs_

TIWindows

TIExportEntry

GetExportModule

TIXxportListA

TIXxportList,

FImportList

FExportList

FImageImport

FImageExport

GetImportList

GetImageImportDirectory

GetImageExportDirectory

ImportList

ExportList

kernel32.dll

user32.dll

UnThreat.exe

t.HtNHtn

FProxyLogin

Fpassword

urls

IdHttpLog

TUTMsgs

TUTMsgsddc

:TUTMsgs.:1

ServiceExecute

utwsc.exe

Winapi.WinSvc

utwebfilter

IdHTTPHeaderInfo

System.SysConst

System.Character

System.RTLConsts

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.VarUtils

Winapi.Messages

System.DateUtils

System.Math

System.Diagnostics

System.AnsiStrings

System.StrUtils

System.IniFiles

System.IOUtils

System.Masks

Winapi.MultiMon

Winapi.CommCtrl

Winapi.Dwmapi

Winapi.UxTheme

Vcl.Consts

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

Vcl.GraphUtil

System.ZLib

System.Win.Crtl

System.UIConsts

Winapi.TpcShrd

Winapi.Imm

Winapi.CommDlg

Winapi.msxml

System.Win.ComConst

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Vcl.ComStrs

Winapi.WinSpool

Vcl.ListActns

Vcl.ToolWin

Winapi.RichEdit

Vcl.Clipbrd

Winapi.FlatSB

Winapi.Dlgs

System.WideStrUtils

Winapi.WinSock

OverbyteIcsNtlmMsgs

OverbyteIcsUrl

IdHTTP

IdTCPServer

IdCustomTCPServer

JwaWindows

System.Win.StdVCL

Vcl.OleConst

tewebtypes

tewebenums

tewebdefs

Vcl.ExtActns

Winapi.Mapi

Vcl.ExtDlgs

Vcl.Buttons

teweb

csshiftjis

windows-936

6666666666666666

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%<!"%$%&%(%*% %-%/%1%3%5%7%9%;$=%?%A%D%F%H%J%K%L%M%N%O%R%U%X%[%^%_%`%a%b%d%f%h%i%j%k%l%m%o%s% !,!

P%S%V%Y%\%

<4,$?7/'

(3-!0,1'8"5.*2$

?456789:;<=

!"#$%&'()* ,-./0123

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

GetConsoleOutputCP

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

msimg32.dll

gdi32.dll

SetViewportOrgEx

version.dll

GetCPInfoExW

GetCPInfo

CreatePipe

ReportEventW

RegUnLoadKeyW

RegSaveKeyW

RegRestoreKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegOpenKeyA

RegLoadKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

ole32.dll

ShellExecuteExW

ShellExecuteW

wininet.dll

InternetOpenUrlA

winspool.drv

sbhips.dll

SbFwe.dll

SbFweIds_LogPortScans

SbFwe_LogPacketsToUnopenedPorts

SbWebFilter.dll

SBTE.DLL

SBTE.dll

SBAP.DLL

wtsapi32.dll

RegDeleteKeyExW

windowscodecs.dll

uxtheme.dll

imm32.dll

DWMAPI.DLL

0.0<0\0|0

6w7F7]7

: :$:(:,:0:4:8:<:`:~:

5!5%5)5-51555

> >$>(>,>

4C4C4U4i4q4

6c6D6\6

2 222;2 3:3

0(0.040:0

7s7D7U7

6o6N6V6^6f6n6v6

2 2'2.252@2\2

5]5z5

3"3-3/5 606>6

5"6@6*7|7

5_5N5m5u5

5#5'5 5/53575;5

? ?$?(?,?0?4?<?

? ?$?(?0?8?~?

2 2$2(2,242<2

: :$:(:,:0:4:

?!?%?)?-?1?5?9?

1-15191V1y1}1

67f7

7$8-8}8

363F3N3|3

4,404`4|4

8%9X9

4C4F4d4r4

-0K0Z0}0

8Ÿ9{9

;7;@;};|<

0
0R0i0

6,7&848\8`8

2$373_3|3

919<9`9~9

6 6$6(6,606>6

0
0c0

7#828\8~8

8$8:8>8`8{8

; ;9;=;`;

1!11J1Q1[1c1

9%9)9-9P9X9}9

3,31363_3{3

5-6A6}6

0"1)1.1>1

88K8

>)>.>9>@>

= =$=(=,=0=4=

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

4E.Pl

i&&}%sX,

h9.El

0IdHTTPHeaderInfo

ISystem.Internal.ExcUtils

dSystem.SysConst

,System.Character

kWinapi.PsAPI

-Winapi.ImageHlp

%System.Classes

&System.DateUtils

YSystem.AnsiStrings

System.StrUtils

iSystem.IOUtils

RVcl.Dialogs

NSystem.Contnrs

CVcl.ExtCtrls

yVcl.Consts

eVcl.Forms

'System.UIConsts

:Winapi.Imm

(Vcl.Menus

Vcl.ComCtrls

hWinapi.UrlMon

4Winapi.RegStr

WVcl.ComStrs

bVcl.Printers

8Vcl.ToolWin

jVcl.Clipbrd

"Winapi.WinSock

'OverbyteIcsNtlmMsgs

0OverbyteIcsHttpProt

&OverbyteIcsUrl

 IdTCPServer

nJwaWindows

<System.Win.StdVCL

sVcl.AxCtrls

BVcl.OleServer

Winapi.WinSvc

}tewebtypes

%tewebdefs

*utwebfilter

(teweb

bVcl.ExtDlgs

tVcl.Buttons

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

%s-%s

%s[%d]

%s_%d

.Owner

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

crSQLWait

claBurlywood

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

TaskDialogIndirect

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

%s (%s)

%s, ClassID: %s

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

%s%s%s%s%s%s%s%s%s%s

Windows

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

illegal quote at pos %d

parent%d = "%s", this endtag = "%s": maybe "%s" should be closed

moving node "%s" from parent "%s" to grandparent "%s"

Cannot open URL %s

declaration with encoding "%s" and codepage %d

correctly closed node "%s" at pos %d

writing declaration with encoding "%s" and codepage %d

external encoding "%s" is not allowed (use ExternalCodepage)

external codepage "%d" not found

total node count: %d, chardata count: %d, references count: %d

D:\Work\UnThreat\Client\src\Delphi Controls\NativeXML\NativeXml407\nativexml\NativeXml.pas

BOM with encoding %s

%s%.2d:%.2d

loading binary version=%d, current version=%d

coder name: %s, compressed size: %d, plain size: %d

total node count: %d

unknown element type %d

unknown %s

unknown %s "%s"

olepro32.dll

%d - %s

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

127.0.0.1

10.5.8.0

0.0.0.0

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

*<>#%"{}|\^[]`

WINDOWS

()[]<>:;.,@\"

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key

RSA_check_key

RSA_generate_key_ex

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

secur32.dll

security.dll

svrApi.dll

svrapi.dll

netapi32.dll

Web Shield

Monitors all the processes and file operations on your computer, warning you against suspicious activities.

Monitors your browsing activity, blocks threats and prevent any malicious code from executing.

Warns and blocks access to phishing websites trying to steal sensitive data from you.

gb2312 csgb2312 gbk cp936 ms936 windows-936

shift_jis ms_kanji csshiftjis

us-ascii ascii us ansi_x3.4-1968 iso-ir-6 ansi_x3.4-1986 iso_646.irv:1991 iso646-us ibm367 cp367 csascii

IcsNtlmMsgs (c) 2004-2012 F. Piette V6.07

THttpContentCoding

%s;q=%s

%s, %s;q=%s

%s, %s

TIcsURL (c) 1997-2012 F. Piette V6.05

http:

D:\Work\UnThreat\Client\src\Delphi Controls\OverbyteICS\Delphi\Vc32\OverbyteIcsWndControl.pas

MsgLow not defined

Msg value out of bound

Msg already registered

Msg not registered

TIcsBufferHandler.Remove: Invalid Len

TIcsBufferHandler.Remove: nothing to remove

wsock32.dll

Unable to load wsock32.dll -

Winsock startup error wsock32.dll -

ws2_32.dll

Unable to load ws2_32.dll -

Cannot change Port if not closed

Cannot change LocalPort if not closed

Winsock Resolve Port: Invalid Port.

Winsock Resolve Port: Invalid Proto.

Winsock Resolve Port: Cannot convert port '

D:\Work\UnThreat\Client\src\Delphi Controls\OverbyteICS\Delphi\Vc32\OverbyteIcsWSocket.pas

setsockopt(IPPROTO_TCP, TCP_NODELAY)

Connect: No Port Specified

Connect (Invalid operation in OnChangeState)

listen: port not assigned

TCustomWSocket.Shutdown

Multi-Status (WebDAV)

Unsupported Media Type

Unprocessable Entity (WebDAV)

Locked (WebDAV)

Failed Dependency (WebDAV)

Blocked by Windows Parental Controls

HTTP Version Not Supported

Insufficient Storage (WebDAV)

HTTP status code

Not a HTTP status code

Not a HTTP tunnel error

HTTP Proxy -

Operation would block

Operation now in progress

Operation already in progress

Socket operation on non-socket

Protocol not supported

Socket type not supported

Operation not supported on socket

Protocol family not supported

Address family not supported by protocol family

WinSock DLL cannot support this application

Can't change socks port if not closed

Can't use Socks when HTTP proxy is used as well

Listening is not supported thru socks server

TCP is the only protocol supported thru socks server

command not supported

address type not supported

TCP is the only protocol supported by HTTP proxies

HTTP/1.1

Listening is not supported thru HTTP proxy servers

Can't change HTTP proxy authentication if not closed

Can't change HTTP proxy password if not closed

Can't change HTTP proxy port if not closed

Can't change HTTP proxy if not closed

Can't use HTTP proxy when Socks is used as well

Can't change HTTP proxy usercode if not closed

THttpCli (c) 1997-2012 F. Piette V7.25

%2.2d %s %4.4d %2.2d:%2.2d:%2.2d

application/x-www-form-urlencoded

Mozilla/4.0 (compatible; ICS)

State = httpReady

State = httpNotConnected

State = httpConnected

State = httpDnsLookup

State = httpDnsLookupDone

State = httpWaitingHeader

State = httpWaitingBody

State = httpBodyReceived

State = httpWaitingProxyConnect

State = httpClosing

State = httpAborting

PrepareNTLMAuth begin, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d

PrepareNTLMAuth end, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d

Login

https

HTTP/

httpChunkDone, end of document

HTTP/1.0

hXXp://

hXXps://

HTTP component

HTTP component has nothing to post or put

document.htm

HTTP no status code (connection closed prematurely)

Insupported HTTP version

drv\utwsc.exe

utsvc.exe

\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

UnThreat.exe" -silent

utsd2.dll

C:\ut.log

recentScan.log

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing

ServicesPipeTimeout

webshieldproov

ntdll.dll

winoa386.mod

MAPI32.DLL

.386;?HT*;ACM;ACE;ADE;ARJ;ASP;ADP;ANI;APP;ASD;ASF;ASP;ASX;AWX;AX;BAS;BAT;BIN;BZ2;BOO;CDF;CAB;CHM;CLA;CLASS;CMD;CNV;COM;CPL;CPX;CRT;CSH;DLL;DLO;DO*;DPL;DRV;DWG;ELF;EMF;EML;EXE*;FAS;FLT;FOT;FON;FPM;GEA;GZ;HA;HLP;HT*;HXS;INF;INI;INS;ISP;J2K;JAR;JFF;JFI;JFIF;JIF;JMH;JNG;JP2;JPE;JPEG;JPG;JS*;JSE;LNK;LSP;LHA;LNK;LZH;MD?;MDB;MBX;MOD;MS?;MIME;NWS;OBJ;OCX;OLB;OSD;OV?;OTM;PCD;PDF;PDR;PGM;PHP;PHT;PIF;PKG;PL*;PNG;POT*;PPAM;PPS*;PPT*;PRG;RAR;REG;RPL;RTF;SBF;SCR;SCRIPT;SCT;SH;SHA;SHB;SHS;SHTM*;SIS;SLD?;SPL;SWF;SYS;TLB;TMP;TSP;TTF;TAR;TGZ;THE;URL;VB?;VCS;VLM;VXD;VXO;WIZ;WLL;WMD;WMF;WMS;WMZ;WPC;WSC;WSF;WSH;WWK;XL*;XML;ZIP;7Z;

aplog.xml

msgid

messageOperation

sbj_file_cachekey

sbj_reg_key

obj_file_cachekey

obj_reg_key

ADE;ADP;ASF;BAS;BAT;CHM;CRT;DLL;DOC;DOT;EML;EX!;EX#;EX$;EX_;EXE;EXV;HLP;HTM;MSP;NT;VB;VBE;XPI;HTML;MSI;OCX;URL;VBS;HTA;INF;MSG;PCD;SYS;VXD;XLT;INI;MSC;PDF;SWF;WMV;CMD;INS;MDE;PIF;SHB;WSC;COM;ISP;MDB;PNG;SCT;WSF;CPL;JAR;LNK;PPS;SCR;WSH;JS;JSE;PPT;REG;XLS

fwlog.xml

zonerules.dat

adprules.dat

networkrules.dat

unthreat.exe

SBSetupDrivers.exe" /install /HIPS /fw

SBSetupDrivers.exe" /update /hips /fw

uplog.xml

wscapi.dll

msgs stopped

utwebmod stopped

Kernel32.dll

Open SSL Support DLL Delphi and C  Builder interface

hXXp://VVV.indyproject.org/

1993 - 2009

66006666

hXXp://VVV.unthreat.com/spurs/spurs.php

4.0.0

C:\ProgramData\UnThreat\data\

C:\ProgramData\UnThreat\vault\

Vietnamese (Windows)

Western European (Windows)"GetCoding must be overridden in %s

Cyrillic (Windows)

Greek (Windows)

Hebrew (Windows)

Thai (Windows)

Turkish (Windows)

Arabic (Windows)

Baltic (Windows)

Central European (Windows)

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

hThe smartcard certificate used for authentication has expired. Please contact your system administrator.

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.

The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.

An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.

The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.

The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate.AOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified.

-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.QAn unsupported preauthentication mechanism was presented to the Kerberos package.

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect.9The received certificate was mapped to multiple accounts.

SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage.

The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.

An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.

The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation).dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses.bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found.

The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.

EThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.

.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the context

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Reply Code is not valid: %s

Reply Code already exists: %s'Algorithm %s not permitted in FIPS modeKUnsupported hash algorithm. This implementation supports only MD5 encoding.

The handle specified is invalid'The function requested is not supported

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

Object type not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Address already in use. Cannot assign requested address.NUnable to retrieve a pointer to a running object registered with OLE for %s/%s4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Invalid argument./cannot manipulate nodes in this type of element=begin and end tag mismatch: "%s" and "%s" at line %d (pos %d)Hlevel mismatch between subnode "%s" and endnode "%s" at line %d (pos %d)

XML root element not defined.(non-default chardata at line %d (pos %d)

XML parent is not assigned3CopyFrom can only be used with TXmlNode descendants"'%s' is not a valid property value

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design mode

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DCOM not installed'stream terminated prematurely at pos %d

unsupported encoding (%s) default char used for codepage substitution

illegal tag ("%s") at pos %d unsupported tag ("%s") at pos Ðillegal end tag ("%s") at line %d (streampos %d)

quote char expected at pos %d'cannot add node to this type of element

cannot add attribute'cannot set name on this type of element(cannot set value on this type of element"%s requires Windows Vista or later

Button%d

RadioButton%d

Unable to load style '%s'

Unable to load styles: %s

Style '%s' already registered#Style class '%s' already registered

Style '%s' not found

Style class '%s' not found

Invalid style format%Class '%s' is not registered for '%s'

%s parameter cannot be nil#Feature not supported by this style

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.7Length of value array must be >= length of prompt array

&Password

Login

UTF-7Ênnot remove shell notification icon

/Menu '%s' is already being used by another form

Service failed on %s: %s

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Value must be between %d and %d

All Clipboard does not support Icons

Cannot open clipboard: %s Operation not supported on selected printer.There is no default printer currently selected

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s property out of range

Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

Canvas does not allow drawing#Text format flag '%s' not supported

Windows Server 2008

Windows Server 2008 R2

Windows Server 2003

Windows Server 2003 R2

Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interfaceGNo single cast observer with ID %s was added to the observer collectionFNo multi cast observer with ID %s was added to the observer collection

No help found for context %d

No help found for %s

Duplicates not allowed,Specified Login Credential Service not found"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)

Windows Vista The specified path was not found The path format is not supported

The drive cannot be found The specified file was not found$No help viewer that supports filters2Length of Strings and Objects arrays must be equal

Invalid Timeout value: %s

Timespan too longbThe duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue

Timespan element too long#''%s'' is not a valid integer value

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

System Error. Code: %d.

February=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s) Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

<unknown>('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value!'%s' is not a valid boolean value

I/O error %d

6.2.37.323

UnThreat.exe_2968:

.text

`.itext

`.data

.idata

.didata

.rdata

@.reloc

B.rsrc

System.Types

System.TypesL

System.UITypes

TMsgDlgType

TMsgDlgBtn

TMsgDlgButtons

TWindowState

poPortrait

MajorOperatingSystemVersion

MinorOperatingSystemVersion

biClrImportant

tagMSG

Winapi.Windows

HKEY

TWMKey

MsgFiller

KeyData

KeyDataFiller

Keys

KeysFiller

MouseMsg

HitTestMouseMsgFiller

etNoMonitorSupportException

System.Internal.ExcUtils

TArray<System.Byte>

System.SysUtils

ENotSupportedException

ENotSupportedException

ENoMonitorSupportException

ENoMonitorSupportException(%B

TArray<System.SysUtils.TLangRec>

TArray<System.Char>

;.uxC;

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

System.SysUtils0

&TArray<System.SysUtils.TUnitHashEntry>

Winapi.ActiveX

grfLocksSupported

tdPortNameOffset

ISupportErrorInfo

System.Variants

Operator

System.Variantsl#@

EVariantBadIndexError

System.VariantsT

System.Variants@_C

System.TypInfo

TPropSet<System.WideString>V

TPropSet<System.WideString>

TPropSet<System.string>V

TPropSet<System.string>

TPropSet<System.Single>K

TPropSet<System.Single>

TPropSet<System.Double>K

TPropSet<System.Double>lCD

TPropSet<System.Extended>K

TPropSet<System.Extended>

TPropSet<System.Comp>K

TPropSet<System.Comp>HFD

TPropSet<System.Currency>K

TPropSet<System.Currency>

TPropSet<System.IInterface>V

TPropSet<System.IInterface>PKD

&TPropSet<System.TypInfo.TDynamicArray>V

&TPropSet<System.TypInfo.TDynamicArray>

System.Classes

ssShift

htKeyword

EInvalidOperation

EInvalidOperation|fD

TList.TDirection

AOperator

TCollectionItemClassh

TThread.TSynchronizeRecord

TOperation

TObservers.TCanObserveEvent

TObservers.TObserverAddedEvent

Operation

FOnExecute

OnExecute

TArray<System.string>

TArray<System.TObject>

ELoginCredendialError

"TLoginCredentialService.TLoginFunc

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxyH!E

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialService

TList.Sort$267$0$Intf

TList.Sort$267$ActRec

#TComponent.FindComponent$891$0$Intf

#TComponent.FindComponent$891$ActRec

"TComponent.GetObservers$902$0$Intf

"TComponent.GetObservers$902$1$Intf

"TComponent.GetObservers$902$ActRec

7TLoginCredentialService.GetLoginCredentials$1172$0$Intf

LPassword

7TLoginCredentialService.GetLoginCredentials$1172$ActRec

Winapi.Wincodec

TTimeSpanParser.TParseError

System.TimeSpan

System.SyncObjs

System.SyncObjs<

TFunc<System.Boolean>

System.SyncObjsp

System.Generics.Collections

doOwnsKeys

System.DateUtils

TLocalTimeZone.TYearlyChanges

TLocalTimeZone.TYearlyChangesL

ATPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>

AKey

ZTArray<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

_TEnumerator<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>(

_TEnumerator<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>0

_TEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>-

_TEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

MTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TItem

RTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TItemArray

System.Generics.CollectionsX

IEqualityComparer<System.Word>

System.Generics.Defaults

#TCollectionNotifyEvent<System.Word>

FTCollectionNotifyEvent<System.DateUtils.TLocalTimeZone.TYearlyChanges>

TArray<System.Word>

TEnumerator<System.Word>(

TEnumerator<System.Word>

TEnumerable<System.Word>-

TEnumerable<System.Word>

VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyEnumerator;

VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyEnumeratorT

VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyCollection;

VTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TKeyCollectionl

6TArray<System.DateUtils.TLocalTimeZone.TYearlyChanges>

;TEnumerator<System.DateUtils.TLocalTimeZone.TYearlyChanges>(

;TEnumerator<System.DateUtils.TLocalTimeZone.TYearlyChanges>

;TEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>-

;TEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>x

XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueEnumerator;

XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueEnumerator

XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueCollection;

XTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TValueCollection

WTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TPairEnumerator;

WTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>.TPairEnumerator\

FOnKeyNotify

FKeyCollection

GTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>9

ContainsKey

GTDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>t

KeysP

OnKeyNotify|

MTObjectDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>M

MTObjectDictionary<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>H

z:{System.Generics.Collections}TList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.:1

]IComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

jTCollectionNotifyEvent<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

ItemATPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>

_IEnumerable<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

eTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.TEnumerator5

eTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.TEnumeratorLYG

YTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>&

YTList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>t[G

3:{System.Generics.Collections}TList<System.Word>.:1

IComparer<System.Word>

IEnumerable<System.Word>

TList<System.Word>.TEnumerator5

TList<System.Word>.TEnumerator

TList<System.Word>&

TList<System.Word>

V:{System.Generics.Collections}TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.:1

9IComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>

;IEnumerable<System.DateUtils.TLocalTimeZone.TYearlyChanges>

ATList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.TEnumerator5

ATList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.TEnumerator

5TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>&

5TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>

_TComparison<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

]TComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>2

]TComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

z:{System.Generics.Collections}TList<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>.:3

TComparison<System.Word>

TComparer<System.Word>2

TComparer<System.Word>

3:{System.Generics.Collections}TList<System.Word>.:3

;TComparison<System.DateUtils.TLocalTimeZone.TYearlyChanges>

9TComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>2

9TComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>|

V:{System.Generics.Collections}TList<System.DateUtils.TLocalTimeZone.TYearlyChanges>.:3

fTDelegatedComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>8

fTDelegatedComparer<System.DateUtils.TPair<System.Word,System.DateUtils.TLocalTimeZone.TYearlyChanges>>

TDelegatedComparer<System.Word>8

TDelegatedComparer<System.Word>

BTDelegatedComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>8

BTDelegatedComparer<System.DateUtils.TLocalTimeZone.TYearlyChanges>

System.Masks

TDirectory.TFilterPredicate

System.IOUtils

!TDirectory.DoGetFiles$2807$0$Intf

!TDirectory.DoGetFiles$2807$ActRec

System.IniFiles

DeleteKey

System.IniFilesT

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome,

System.Contnrs

Vcl.ActnList

IsShortCut

FHelpKeyword

HelpKeywordHZD

OnExecute8

$:Crtc

1.2.5

Ht.Ht3

Vcl.GraphUtil

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeyword(ZD

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Vcl.StdCtrls

Vcl.StdCtrls4

Vcl.StdCtrls,

FPasswordChar

Vcl.StdCtrlsB

PasswordChar

OnKeyDown

OnKeyPressx

OnKeyUpT

ssHorizontal

Vcl.StdCtrls@

Vcl.StdCtrlsC

OnKeyUp

TCustomButton.TButtonStyle

Vcl.StdCtrls:

Vcl.StdCtrls1

Vcl.StdCtrls0

Vcl.StdCtrlsF

Vcl.StdCtrls*

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindow

%TCustomEdit.ObserverAdded$3288$0$Intf

%TCustomEdit.ObserverAdded$3288$ActRec

)TCustomCheckBox.ObserverAdded$3495$0$Intf

)TCustomCheckBox.ObserverAdded$3495$ActRec

System.Win.ComObj

ServerKey

FSupportsLicensing

SupportsLicensing

Winapi.ShlObj

Vcl.Printers

APort

Port

Vcl.ToolWin

Vcl.ListActns

Vcl.Clipbrd

Vcl.StdActns

Vcl.ComCtrls

Vcl.ComCtrls'

Vcl.ComCtrls:

Vcl.ComCtrls0

cdsShowKeyboardCues

msShiftSelect

FSaveIndexes

Vcl.ComCtrlsZ

Vcl.ComCtrlsG

vsReport

Vcl.ComCtrls&

FCustomizeKeyName

Vcl.ComCtrlsU

CustomizeKeyName

Vcl.ComCtrls>

acoUpDownKeyDropsList

FUpDownLeftPressed

TComboBoxExEnumerator5

TComboBoxExEnumerator

System.HelpIntfs

HelpKeyword

UnderstandsKeyword

Vcl.Dialogs

FURL

Vcl.Dialogs0

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials

.TDefaultLoginCredentials.LoginEvent$833$0$Intf

.TDefaultLoginCredentials.LoginEvent$833$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$835$0$Intf

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec\

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.ExtCtrlsE

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

 TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

*TMouseTrackControlStyleHook.TMousePosition

"TArray<Vcl.Themes.TStyleHookClass>

'TEnumerator<Vcl.Themes.TStyleHookClass>(

'TEnumerator<Vcl.Themes.TStyleHookClass>0

'TEnumerable<Vcl.Themes.TStyleHookClass>-

'TEnumerable<Vcl.Themes.TStyleHookClass>t

B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:1

%IComparer<Vcl.Themes.TStyleHookClass>

2TCollectionNotifyEvent<Vcl.Themes.TStyleHookClass>

'IEnumerable<Vcl.Themes.TStyleHookClass>

-TList<Vcl.Themes.TStyleHookClass>.TEnumerator5

-TList<Vcl.Themes.TStyleHookClass>.TEnumerator

!TList<Vcl.Themes.TStyleHookClass>&

!TList<Vcl.Themes.TStyleHookClass>h

RTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

eTArray<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>(

jTEnumerator<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>-

jTEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

^TDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItem

cTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TItemArray

IEqualityComparer<System.TClass>

%TCollectionNotifyEvent<System.TClass>

UTCollectionNotifyEvent<System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

Item!TList<Vcl.Themes.TStyleHookClass>

TArray<System.TClass>

TEnumerator<System.TClass>(

TEnumerator<System.TClass>

TEnumerable<System.TClass>-

TEnumerable<System.TClass>

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumerator;

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyEnumeratorT"U

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection;

gTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TKeyCollection

4TArray<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>(

9TEnumerator<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>H'U

9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>-

9TEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator;

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueEnumerator0*U

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollection;

iTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TValueCollectionl,U

hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumerator;

hTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>.TPairEnumerator

XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>9

XTDictionary<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

OnKeyNotify`

9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>

LTArray<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>(

QTEnumerator<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>-

QTEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

ETDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItem

JTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TItemArray

IEqualityComparer<System.string>

%TCollectionNotifyEvent<System.string>

<TCollectionNotifyEvent<Vcl.Themes.TStyleManager.TSourceInfo>

TEnumerator<System.string>(

TEnumerator<System.string>`@U

TEnumerable<System.string>-

TEnumerable<System.string>

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumerator;

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyEnumerator

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollection;

NTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TKeyCollection

,TArray<Vcl.Themes.TStyleManager.TSourceInfo>

1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>(

1TEnumerator<Vcl.Themes.TStyleManager.TSourceInfo>XGU

1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>-

1TEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator;

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueEnumerator JU

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection;

PTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TValueCollection,LU

OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator;

OTDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>.TPairEnumerator`NU

?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>9

?TDictionary<System.string,Vcl.Themes.TStyleManager.TSourceInfo>hPU

Keys\MU

OnKeyNotify0?U

6TArray<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>(

;TEnumerator<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>-

;TEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:1

Vcl.Themes$

9IComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

FTCollectionNotifyEvent<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

Item#TStyleManager.TStyleClassDescriptor

;IEnumerable<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator5

ATList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.TEnumerator

5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>&

5TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

*TArray<Vcl.Themes.TCustomStyleEngineClass>

/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>(

/TEnumerator<Vcl.Themes.TCustomStyleEngineClass>\jU

/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>-

/TEnumerable<Vcl.Themes.TCustomStyleEngineClass>

J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:1

-IComparer<Vcl.Themes.TCustomStyleEngineClass>

:TCollectionNotifyEvent<Vcl.Themes.TCustomStyleEngineClass>

/IEnumerable<Vcl.Themes.TCustomStyleEngineClass>

5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator5

5TList<Vcl.Themes.TCustomStyleEngineClass>.TEnumerator$oU

)TList<Vcl.Themes.TCustomStyleEngineClass>&

)TList<Vcl.Themes.TCustomStyleEngineClass>

'TArray<Vcl.Themes.TCustomStyleServices>

,TEnumerator<Vcl.Themes.TCustomStyleServices>(

,TEnumerator<Vcl.Themes.TCustomStyleServices>\{U

,TEnumerable<Vcl.Themes.TCustomStyleServices>-

,TEnumerable<Vcl.Themes.TCustomStyleServices>

G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:1

*IComparer<Vcl.Themes.TCustomStyleServices>

7TCollectionNotifyEvent<Vcl.Themes.TCustomStyleServices>

,IEnumerable<Vcl.Themes.TCustomStyleServices>

2TList<Vcl.Themes.TCustomStyleServices>.TEnumerator5

2TList<Vcl.Themes.TCustomStyleServices>.TEnumerator

&TList<Vcl.Themes.TCustomStyleServices>&

&TList<Vcl.Themes.TCustomStyleServices>

'TComparison<Vcl.Themes.TStyleHookClass>

%TComparer<Vcl.Themes.TStyleHookClass>2

%TComparer<Vcl.Themes.TStyleHookClass>l

B:{System.Generics.Collections}TList<Vcl.Themes.TStyleHookClass>.:3

:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:1

hIComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

uTCollectionNotifyEvent<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

ItemRTPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>

jIEnumerable<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator5

pTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.TEnumerator

dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>&

dTList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

5:{System.Generics.Collections}TList<System.TClass>.:1

IComparer<System.TClass>

IEnumerable<System.TClass>

TList<System.TClass>.TEnumerator5

TList<System.TClass>.TEnumerator

TList<System.TClass>&

TList<System.TClass>\

T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:1

Vcl.ThemesD

7IComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

9IEnumerable<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumerator5

?TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.TEnumerator

3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>&

3TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:1

OIComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

\TCollectionNotifyEvent<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

Item9TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>

QIEnumerable<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumerator5

WTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.TEnumeratorl

KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>&

KTList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>x

5:{System.Generics.Collections}TList<System.string>.:1

IComparer<System.string>

IEnumerable<System.string>

TList<System.string>.TEnumerator5

TList<System.string>.TEnumerator

TList<System.string>&

TList<System.string>

L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:1

/IComparer<Vcl.Themes.TStyleManager.TSourceInfo>

1IEnumerable<Vcl.Themes.TStyleManager.TSourceInfo>

7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator5

7TList<Vcl.Themes.TStyleManager.TSourceInfo>.TEnumerator

 TList<Vcl.Themes.TStyleManager.TSourceInfo>&

 TList<Vcl.Themes.TStyleManager.TSourceInfo>

;TComparison<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>2

9TComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

V:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TStyleClassDescriptor>.:3

/TComparison<Vcl.Themes.TCustomStyleEngineClass>

-TComparer<Vcl.Themes.TCustomStyleEngineClass>2

-TComparer<Vcl.Themes.TCustomStyleEngineClass>$7W

J:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleEngineClass>.:3

,TComparison<Vcl.Themes.TCustomStyleServices>

*TComparer<Vcl.Themes.TCustomStyleServices>2

*TComparer<Vcl.Themes.TCustomStyleServices>0:W

G:{System.Generics.Collections}TList<Vcl.Themes.TCustomStyleServices>.:3

TComparison<System.Types.TPoint>

TComparer<System.Types.TPoint>2

TComparer<System.Types.TPoint>$=W

.TDelegatedComparer<Vcl.Themes.TStyleHookClass>8

.TDelegatedComparer<Vcl.Themes.TStyleHookClass>

jTComparison<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>2

hTComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>.:3

TComparison<System.TClass>

TComparer<System.TClass>2

TComparer<System.TClass>,EW

5:{System.Generics.Collections}TList<System.TClass>.:3

9TComparison<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>2

7TComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>

T:{System.Generics.Collections}TList<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>.:3

QTComparison<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>

OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>2

OTComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>LKW

l:{System.Generics.Collections}TList<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>.:3

TComparison<System.string>

TComparer<System.string>2

TComparer<System.string>

5:{System.Generics.Collections}TList<System.string>.:3

1TComparison<Vcl.Themes.TStyleManager.TSourceInfo>

/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>2

/TComparer<Vcl.Themes.TStyleManager.TSourceInfo>tQW

L:{System.Generics.Collections}TList<Vcl.Themes.TStyleManager.TSourceInfo>.:3

BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>8

BTDelegatedComparer<Vcl.Themes.TStyleManager.TStyleClassDescriptor>

6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>8

6TDelegatedComparer<Vcl.Themes.TCustomStyleEngineClass>

3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>8

3TDelegatedComparer<Vcl.Themes.TCustomStyleServices>HWW

'TDelegatedComparer<System.Types.TPoint>8

'TDelegatedComparer<System.Types.TPoint>

qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>8

qTDelegatedComparer<Vcl.Themes.TPair<System.TClass,System.Generics.Collections.TList<Vcl.Themes.TStyleHookClass>>>

!TDelegatedComparer<System.TClass>8

!TDelegatedComparer<System.TClass>

@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>8

@TDelegatedComparer<Vcl.Themes.TList<Vcl.Themes.TStyleHookClass>>`^W

XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>8

XTDelegatedComparer<Vcl.Themes.TPair<System.string,Vcl.Themes.TStyleManager.TSourceInfo>>4`W

!TDelegatedComparer<System.string>8

!TDelegatedComparer<System.string>8bW

8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>8

8TDelegatedComparer<Vcl.Themes.TStyleManager.TSourceInfo>

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeys

AutoHotkeys

Uht%X

Vcl.Forms

ssHotTrack

Vcl.Forms?

Vcl.Forms;

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState

Vcl.Formsa

KeyPreviewx

Vcl.FormsL

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

BiDiKeyboard

NonBiDiKeyboard

OnActionExecute

!TScrollingStyleHook.TScrollWindow6

!TScrollingStyleHook.TScrollWindow

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHookT

EnterWithKeyboard

D$< FTP

UdpInBytes

UdpInPackets

UdpOutBytes

UdpOutPackets

TcpInBytes

TcpInPackets

TcpOutBytes

TcpOutPackets

PortScanIntrusions

Vcl.Buttons

Vcl.Buttons

Vcl.Buttons3

Vcl.FileCtrl

TClientMsg

TUTSendMsgs

UTMSG_NONE

UTMSG_SENDQUARANTINE

UTMSG_QUARDELETEID

UTMSG_QUARDELETEALL

UTMSG_QUARPURGE

UTMSG_PAUSE

UTMSG_CONTINUE

UTMSG_STOP

UTMSG_UPDATEDEFVER

UTMSG_SENDBLOCKEDPID

UTMSG_SENDALLOWEDPID

UTMSG_CLEARALLOWEDPID

UTMSG_CLEARBLOCKEDPID

UTMSG_REMOVEBLOCKEDPID

UTMSG_REMOVEALLOWEDPID

UTMSG_SHUTDOWN

UTMSG_WSCCHECK

UTMSG_UNQARANTINE

UTMSG_RELOADMON

TAlertMsg

TFW_MSG

TUTRoadWarriorMsg

;!199{199

;0!8&2{199

"<;=!!%{199

Windows 95

Windows 95 OSR-2

Windows 98

Windows 98 SE

Windows ME

Windows 9x New

Windows NT 3

Windows NT 4

Windows 2000

Windows XP

Windows 2003

Windows Vista

Windows 2008

Windows 7

Windows 2008 R2

Windows 8

Windows Server 8

Windows NT New

TMsgHandler;

TMsgHandlerOO

TImageImportDirectory

PImageImportDirectoryT

TImageExportDirectory(

PImageExportDirectory

TMsgHandlers

madToolsMsgHandlerWindow

>0';0974&0{199

;3:'84!<:;

&8&&{0-0

::9=09%fg

;<!<49</0

-60%!<:;

<&%4!6=0'

;&!' 6!<:;

;<6:"&{199

:;!4<;0'

&9{0-0

'<#<9020

";0'&=<%

'02<&!',

port

portThread

Supports

AddItemsG

GetHotKey

GetShowCmd

SetHotKey

SetShowCmd

FHasShellFolder

comctl32.dll

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion\ProfileList

FWatchMsg

FShMsg

ShMsgHandlerProc

WatchMsgHandlerProc

shell32.dll

windows-874

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

FAesKeyHex

LoadFromURL

AesKeyHex\K]

Vcl.SvcMgr

FPassword

ReportStatus

OnExecute,

Vcl.OleServer

LicenseKey

'TServerEventDispatch.Invoke$7171$0$Intf

'TServerEventDispatch.Invoke$7171$ActRec

INetFwOpenPort

CoNetFwOpenPort1

CoNetFwOpenPort<?_

Vcl.AxCtrls

Vcl.OleCtrls

AddTcpPortToFirewall

ProtocollPort

PortRemoteAddresses

AddUdpPortToFirewall

AMsg

EIdCanNotBindPortInRange

EIdInvalidPortRange

CheckIPVersionSupport

WSGetServByPort

APortNumber

AddServByPortToList

VPort

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindowsd

EIdIPVersionUnsupported

ReceiveMsg,

EIdPortRequired

EIdPortRequiredp'a

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

FPort

VMsgEnd

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax

PeerPort

"EIdTransparentProxyUDPNotSupported

OpenUDP

CloseUDP

RecvFromUDP

SendToUDPm

IPAsStringU

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

FUDPSocksAssociation

SendToUDP9

FBoundPort

FBoundPortMax

FBoundPortMin

FDefaultPort

BoundPort

DefaultPort

BoundPortMax

BoundPortMin

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

SendCmdf

TIdTCPConnection

IdTCPConnection

LastCmdResult

TIdTCPClientCustom'

TIdTCPClientCustom

IdTCPClient

TIdTCPClient

QuoteHTTP

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

FMetaHTTPEquiv

TIdMetaHTTPEquivE

ProcessMetaHTTPEquiv

TIdMetaHTTPEquiv4

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

URLPld

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

URLDecode

URLEncode

FHttpOnly

HttpOnly

AURL

EIdUnsupportedOperation

EIdUnsupportedTransfer

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEY`>e

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUXxMe

cert_info

ex_nscert

get_cert_methods

cert_crl

ppem_password_cb

key_arg_length

key_arg

master_key_length

master_key

sess_cert

Ptlsext_ticket_key_cbm\e

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile

CertFile

KeyFile

LoadRootCert

LoadCert

fPeerCert

PeerCertD

fOnGetPassword

fOnGetPasswordEx

OnGetPassword

OnGetPasswordEx

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertError<

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

UhI%f

SEC_GET_KEY_FN

KeyVer

pGetKeyFn

pvGetKeyArgument

EXPORT_SECURITY_CONTEXT_FN

IMPORT_SECURITY_CONTEXT_FN_Wh

ExportSecurityContext

ImportSecurityContextW

aPassword

TIdHTTPConnectionType

IdHTTP

TIdHTTPOption

hoNoParseMetaHTTPEquiv

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

TIdHTTPResponse5

AHTTP

TIdHTTPResponseD

MetaHTTPEquiv

TIdHTTPRequest5

TIdHTTPRequestH

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP

MetaHTTPEquivT

HTTPOptions

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException

aExec

password

rw_password

ro_password

FPasswordW

GetPassword

SetPassword

GetReadWritePassword

SetReadWritePassword

Software\Microsoft\Windows\CurrentVersion\Network\LanMan\

SendMsg

TUTWebFilter.

TUTWebFilter(

WebFilter

TellUpdateMSG

msgs

-2147483648

TNTLM_Msg2_Info

EHttpContentCodingException

EHttpContentCodingExceptionh

OverbyteIcsHttpContCod

THttpContentCodingClass

THttpContentCoding?

THttpContentCoding

THttpCCodIdentity

THttpCCodIdentity

THttpCCodStar

THttpContCodItemN

THttpContCodItemp

THttpContCodHandlerR

THttpContCodHandler<

sin_port

FMsgQueued

MsgRec

FMsgRelease

TIcsMsgMap

FMsgMap

FMsgLow

FMsgCnt

AllocateMsgHandler

MsgLow

MsgLeft

TWhMaxMsgIDs

SetWndHandlerMaxMsgIDs

wsoTcpNoDelay

wsoNoHttp10Tunnel

TWSocketCounterClassH:i

FDnsLookupCheckMsg

FDnsLookupTempMsg

FMsg_WM_ASYNCSELECT

FMsg_WM_ASYNCGETHOSTBYNAME

FMsg_WM_ASYNCGETHOSTBYADDR

FMsg_WM_CLOSE_DELAYED

FMsg_WM_TRIGGER_EXCEPTION

FMsg_WM_TRIGGER_DATA_AVAILABLE

FLocalPortResolved

FPortStr

FPortAssigned

FPortResolved

FPortNum

FLocalPortStr

FLocalPortNum

GetPeerPort

GetXPort

SetTcpNoDelayOption

THttpTunnelAuthType

THttpTunnelServerAuthTypes

THttpTunnelState

THttpTunnelErrorEvent

THttpTunnelChunkState

THttpTunnelProto

THttpTunnelReconnectRequest

FHttpTunnelAuthChallenge

FHttpTunnelAuthDigestCached

FHttpTunnelAuthDigestValid

FHttpTunnelAuthDigestHash

FHttpTunnelAuthDigestInfo

FHttpTunnelAuthType

FHttpTunnelBuf

FHttpTunnelBufSize

FHttpTunnelChunked

FHttpTunnelChunkRcvd

FHttpTunnelChunkSize

FHttpTunnelChunkState

FHttpTunnelCloseNotified

FHttpTunnelContentLength

FHttpTunnelCurAuthType

FHttpTunnelKeepsAlive

FHttpTunnelLastResponse

FHttpTunnelLmCompatLevel

FHttpTunnelReconnectRequest

FHttpTunnelPassword

FHttpTunnelPort

FHttpTunnelPortAssigned

FHttpTunnelProto

FHttpTunnelRcvdCnt

FHttpTunnelRcvdIdx

FHttpTunnelServer

FHttpTunnelServerAssigned

FHttpTunnelServerAuthTypes

FHttpTunnelState

FHttpTunnelStatusCode

FHttpTunnelUsercode

FHttpTunnelWaitingBody

FMsg_WM_TUNNEL_RECONNECT

FOnHttpTunnelConnected

FOnHttpTunnelError

TCustomHttpTunnelWSocket6

TCustomHttpTunnelWSocket

FSocksPort

FSocksPortAssigned

FSocksPassword

LocalPort

SocksPort

SocksPassword

HttpTunnelAuthType

HttpTunnelPassword

HttpTunnelPort

HttpTunnelServer

HttpTunnelUsercodeDTi

OnHttpTunnelError

OnHttpTunnelConnected

PortNum

HttpTunnelCurrentAuthType

HttpTunnelBufferSize

HttpTunnelLastResponse

HttpTunnelLmCompatLevel

255.255.255.255

0.0.0.1

HTTP/1.

Proxy server must support HTTP/1.1

THttpTunnelWSocket - DataAvailable error

Received header line too long. Increase HttpTunnelBufferSize.

THttpTunnelWSocket - Fatal: Invalid state in TriggerDataAvailable

THttpTunnelWSocket - Fatal: Internal error in WMHttpTunnelReconnect

EHttpExceptionD

EHttpException

OverbyteIcsHttpProt

THttpRequest

httpABORT

httpGET

httpPOST

httpPUT

httpHEAD

httpDELETE

httpCLOSE

THttpState

httpReady

httpNotConnected

httpConnected

httpDnsLookup

httpDnsLookupDone

httpWaitingHeader

httpWaitingBody

httpBodyReceived

httpWaitingProxyConnect

httpClosing

httpAborting

THttpChunkState

httpChunkGetSize

httpChunkGetExt

httpChunkGetData

httpChunkSkipDataEnd

httpChunkDone

THttpNTLMState

ntlmMsg1

ntlmMsg2

ntlmMsg3

THttpDigestState

digestMsg1

THttpBasicState

basicMsg1

THttpAuthType

httpAuthNone

httpAuthBasic

httpAuthNtlm

httpAuthDigest

THttpBeforeAuthEvent

THttpRequestDone

THttpCliOption

httpoNoBasicAuth

httpoNoNTLMAuth

httpoBandwidthControl

httpoEnableContentCoding

httpoUseQuality

httpoNoDigestAuth

THttpCliOptions

FMsg_WM_HTTP_REQUEST_DONE

FMsg_WM_HTTP_SET_READY

FMsg_WM_HTTP_LOGIN

FTargetPort

FProxyPort

FCurrPassword

FProxyPassword

FCurrentPort

FNTLMMsg2Info

FProxyNTLMMsg2Info

FWMLoginQueued

THttpCli6

THttpCliH

OverbyteIcsHttpProtE

MON_WEB

MON_WEBADS

MON_WEBBADURL

MON_WEBFILTER

szPassword

DevPort1

DevPort2

fPassword

fDevicePort

fAboutToOpenPort

fPortOpened

fAuthChangePassword

fPasswordExpired

fPasswordFlag

fSubDevicePort

GetSubDevicePort

DevicePort

OnAboutToOpenPort

OnPortOpened

OnAuthChangePassword

OnPasswordExpiredW

SubDevicePort

PasswordFlag

fRequireEncryptedPassword

fRequireMSEncryptedPassword

fNetTCPIP

fCustomAuthKey

fUsePreSharedKey

fTcpWindowSize

SetSubDevicePort

bRequireEncryptedPassword

bRequireMSEncryptedPassword

bNetTCPIP

CustomAuthKey4

bUsePreSharedKey

TcpWindowSize

Passwordh

0.0.0.0

otComPort

otPipe

otWindowStation

otKey

otPort

otKeyedEvent

TSkipWindows

TSSkipWindows

IWindows

IExportEntry

IXxportList

TExeType

TExecuteFunctionProc

GetWindows

GetTaskbarWindows

FExeFile

FExeTypeReady

FExeType

GetExeFile

GetExeType

GetExportList

ComPort

Pipe

WindowStation

KeyedEvent

msgs_

TIWindows

TIExportEntry

GetExportModule

TIExportEntryP<n

TIXxportListA

TIXxportList

FImportList

FExportList

FImageImport

FImageExport

GetImportList

GetImageImportDirectory

GetImageExportDirectory

ImportList

ExportList

kernel32.dll

user32.dll

TSWMSG

MSG_SPECIAL

MSG_NOTIFY

MSG_SERVER

MSG_WEBPAGE

FUpURL

fpass

fport

msgType

notifyWebpage

TsWindowShowMode

Vcl.Imaging.jpeg

Vcl.Mask

Vcl.Mask?

EInvalidGridOperation

Vcl.Grids

goAlwaysShowEditor

Vcl.GridsM

%TCustomGrid.ObserverAdded$6145$0$Intf

%TCustomGrid.ObserverAdded$6145$1$Intf

%TCustomGrid.ObserverAdded$6145$ActRec8

%TCustomGrid.ObserverAdded$6145$ActRec

.TSparsePointerArray.ResetHighBound$6314$0$Intf

.TSparsePointerArray.ResetHighBound$6314$ActRec

'TStringSparseList.WriteData$6330$0$Intf

'TStringSparseList.WriteData$6330$1$Intf

'TStringSparseList.WriteData$6330$ActRec

'TStringSparseList.WriteData$6330$ActRecX

#TStringSparseList.Clear$6343$0$Intf

#TStringSparseList.Clear$6343$ActRec

#TStringSparseList.Clear$6343$ActRecx"r

$TStringGridStrings.Clear$6349$0$Intf

$TStringGridStrings.Clear$6349$ActRec

TStringGrid.Destroy$6361$0$Intf

TStringGrid.Destroy$6361$ActRec

#TStringGrid.ColumnMoved$6363$0$Intf

#TStringGrid.ColumnMoved$6363$ActRec

#TStringGrid.ColumnMoved$6363$ActRec`-r

csIndexed

FCrToRedTable

FCrToGreenTable

3333333

UpdateIconsIndexes

TacMDIWnd'

TacMDIWnd|su

Vcl.Imaging.pngimage

fKeyword

LeftP

t.Ht4

TsShadowMode

TsShadowG

TsShadow

TsWebLabel6

TsWebLabel

FMenuSupport

InitConstantIndexes

InitMaskIndexes

MenuSupport

UpdateIndexes

IndexWebBtn

TacMenuSupport&

TacMenuSupport

acInMouseMsg

IsControlSupported

CurLeft

f;x.tP

t.Ht!

TacGetImageIndexEvent

TsShellTreeView

TsShellTreeView@V

OnKeyUp\jO

Vcl.Shell.ShellCtrls

TGetImageIndexEvent

Vcl.Shell.ShellCtrls<

FKeys

KeyValue

getKey

FUseTaskMsgDlg

APasswordChar

InitTaskDialogIndirect

UseTaskMsgDlg`

TMyHKeyType

siHKEY_CURRENT_USER

siHKEY_CLASSES_ROOT

siHKEY_LOCAL_MACHINE

siHKEY_USERS

siHKEY_CURRENT_CONFIG

siHKEY_DYN_DATA

FSubKey

FRegRootKey

RegRootKey

SubKey

sShellTreeView1

sShellTreeView1Change

FLastErrorMsg

LastErrorMsg$

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccJoinControl

TRootKey

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

EJclMutexError

FURLColor

URLColor$

IWebBrowser

IWebBrowserApp

IWebBrowser2

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

TWebBrowserNewWindow3

bstrUrlContext

bstrUrl

"TWebBrowserSetPhishingFilterStatus

TWebBrowserWindowStateChanged

dwWindowStateFlags

TWebBrowserNewProcess

TWebBrowserThirdPartyUrlBlocked

!TWebBrowserRedirectXDomainBlocked

StartURL

RedirectURL

FLastUrl

FOnWindowSetResizable

FOnWindowSetLeft

FOnWindowSetTop

FOnWindowSetWidth

FOnWindowSetHeight

FOnWindowStateChanged

FOnThirdPartyUrlBlocked

TWebBrowser&

cmdID

cmdexecopt

TWebBrowser

OnWindowSetResizable

OnWindowSetLeft0

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeight

OnWindowStateChanged

OnThirdPartyUrlBlocked

LocationURL8

tsWindowsXP

tsWindowsVista

tsWindows7

FKey

HotkeyPrefix

HotkeyPrefixNone

HotkeyPrefixShow

HotkeyPrefixHide

UnsupportedGdiplusVersion

PropertyNotSupported

SetColorKey

ClearColorKey

SetHotkeyPrefix

hotkeyPrefix

GetHotkeyPrefix

edPassword

ssShortDateEU

ssShortDateUS

ssHTML

LeftPen

FHomeEndKey

HomeEndKey

Vcl.CheckLstH

Vcl.CheckLst

HasURL

dfURL

FAcceptURLs

grfKeyState

DropURL

AcceptURLsxs

scWindowsVista

scWindows7

etPassword

psShortLine

wsSports

FKeyTimer

cvtWebName

OnGridKeyDownx

OnGridKeyUp

OnGridKeyPress

gsWindowsXP

gsWindowsVista

gsWindows7

TFilterOperation

TOleDropURLEvent

TIsPasswordCellEvent

IsPassword

TGridExportState

esExportStart

esExportNewRow

esExportDone

esExportSelRow

esExportFail

esExportNextRow

TGridImportState

isImportStart

isImportNewRow

isImportDone

isImportSelRow

FExportImages

ExportImages

TIndexSortKey

FIndexSortKey

IndexSortKey

FWantKeyLeftRight

FWantKeyUpDown

FWantKeyHomeEnd

FWantKeyPriorNext

FWantKeyReturn

FWantKeyEscape

EditKeyDown

WantKeyLeftRight

WantKeyUpDown

WantKeyHomeEnd

WantKeyPriorNext

WantKeyReturn

WantKeyEscape

FOnReturnKey

OnReturnKey

FSelKeyDown

GotKey

FOperation

msURL

TClipOperation

FOleAcceptURLs

OleAcceptURLs

FLastKeyCell

FOnOleDropURL

FOnIsPasswordCell

FSortIndexes

FScrollProportional

FURLShow

FURLShowInText

FURLUnderlineOnHover

FURLFull

FURLEdit

wheelmsg

FTMSGradFrom

FTMSGradTo

FTMSGradMirrorFrom

FTMSGradMirrorTo

FTMSGradHoverFrom

FTMSGradHoverTo

FTMSGradHoverMirrorFrom

FTMSGradHoverMirrorTo

FTMSGradHoverBorder

FTMSGradDownFrom

FTMSGradDownTo

FTMSGradDownMirrorFrom

FTMSGradDownMirrorTo

FTMSGradDownBorder

ExportNotification

ImportNotification

ExportEmptyCells

SaveToXLSSheet

GetXLSSheets

LoadFromXLSSheet

LoadFromMDBSQL

QSortIndexed

QSortGroupIndexed

QuickSortIndexed

OnIsPasswordCell

OnOleDropURL$

ScrollProportional

URLColor

URLShow

URLShowInText

URLUnderlineOnHover

URLFull

URLEdit

SortIndexes

TMSGradientFrom

TMSGradientTo

TMSGradientMirrorFrom

TMSGradientMirrorTo

TMSGradientHoverFrom

TMSGradientHoverTo

TMSGradientHoverMirrorFrom

TMSGradientHoverMirrorTo

TMSGradientHoverBorder

TMSGradientDownFrom

TMSGradientDownTo

TMSGradientDownMirrorFrom

TMSGradientDownMirrorTo

TMSGradientDownBorder

ReportErrorA

ReportError$

Vcl.AppEvnts

AOperation

OnKeyPress

sWebLabel1

sWebLabel2

sWebLabel2Click

msgid

resultthreatsShow

resultresultsShow

VCLTee.TeeHtml

VCLTee.TeCanvas

VCLTee.TeCanvas$

VCLTee.TeCanvasX

Monochrome

SupportsFullRotation

SupportsXORMode

TTriangleIndexes

Indexes

SupportsID

Supports3DText

FMonochrome

VCLTee.TeCanvasP&A

VCLTee.TeCanvas`E

VCLTee.TeeFilters

VCLTee.TeeProcs

FPrintProportional

CalcProportionalMargins

PrintPortrait

PrintProportional

FKeyShift

KeyShift

VCLTee.TeEngine

VCLTee.TeEngine6

tssHideDataSource

ltsLeftPercent

VCLTee.Chart

FLeftPercent

FTopLeftPos

LeftPercent4

VCLTee.Chart)

VCLTee.Chart|"

OnKeyPress8

OnKeyDownx

VCLTee.Chart~

Monochromed

VCLTee.Chart

VCLTee.TeeSpline

VCLTee.Series

VCLTee.Series7

VCLTee.Series#

System.Win.ComServ

siLangLinked_frame_web

web1NavigateComplete2

Tframe_web

main_frame_web

UserPass=

FMX.FilterCatBlur

vec4 _TMP1;vec2 _TMP2;vec2 _TMP6;varying vec4 TEX0;uniform sampler2D texture0;uniform vec4 PSParam0;void main(){ vec4 _Color; vec2 _newCoord; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -8.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _TMP1*3.88725400E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -7.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.31734808E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -6.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.73619401E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -5.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.13192490E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -4.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.49249202E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -3.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.80626540E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -2.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.06265292E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   -1.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.25268966E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   0.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.36955872E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   1.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*3.88725400E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   2.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.36955872E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   3.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.25268966E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   4.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.06265292E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   5.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.80626540E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   6.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.49249202E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   7.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.13192490E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   8.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.73619401E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   9.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.31734808E-002; _newCoord = TEX0.xy; _newCoord.x = TEX0.x   1.00000000E 001/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*3.88725400E-002; gl_FragColor = _Color; return;}

vec4 _TMP1;vec2 _TMP2;vec2 _TMP6;varying vec4 TEX0;uniform sampler2D texture0;uniform vec4 PSParam0;void main(){ vec4 _Color; vec2 _newCoord; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -8.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _TMP1*3.88725400E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -7.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.31734808E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -6.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.73619401E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -5.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.13192490E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -4.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.49249202E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -3.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.80626540E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -2.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.06265292E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   -1.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.25268966E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   0.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.36955872E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   1.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*3.88725400E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   2.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.36955872E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   3.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.25268966E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   4.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*6.06265292E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   5.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.80626540E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   6.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.49249202E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   7.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*5.13192490E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   8.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.73619401E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   9.00000000E 000/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*4.31734808E-002; _newCoord = TEX0.xy; _newCoord.y = TEX0.y   1.00000000E 001/PSParam0.x; _TMP2 = min(vec2( 1.00000000E 000, 1.00000000E 000), _newCoord); _TMP6 = max(vec2( 0.00000000E 000, 0.00000000E 000), _TMP2); _TMP1 = texture2D(texture0, _TMP6); _Color = _Color   _TMP1*3.88725400E-002; gl_FragColor = _Color; return;}

vec4 _ret_0;vec4 _TMP3;vec4 _TMP2;vec4 _TMP1;vec4 _TMP0;vec2 _c0007;vec2 _c0009;vec2 _c0011;vec2 _c0013;varying vec4 TEX0;uniform sampler2D texture0;uniform vec4 PSParam0;void main() { vec2 _xOffset; vec2 _yOffset; vec4 _result; _xOffset = vec2(PSParam0.x/5.00000000E 002, 0.00000000E 000); _yOffset = vec2(0.00000000E 000, PSParam0.x/5.00000000E 002); _TMP0 = texture2D(texture0, TEX0.xy); _TMP1 = texture2D(texture0, TEX0.xy); _result = _TMP0   _TMP1; _TMP2 = texture2D(texture0, TEX0.xy); _result = _result   _TMP2; _TMP3 = texture2D(texture0, TEX0.xy); _result = _result   _TMP3; _c0007 = TEX0.xy   _xOffset; _TMP0 = texture2D(texture0, _c0007); _result = _result   _TMP0; _c0009 = TEX0.xy - _xOffset; _TMP1 = texture2D(texture0, _c0009); _result = _result   _TMP1; _c0011 = TEX0.xy   _yOffset; _TMP2 = texture2D(texture0, _c0011); _result = _result   _TMP2; _c0013 = TEX0.xy - _yOffset; _TMP3 = texture2D(texture0, _c0013); _result = _result   _TMP3; _c0007 = TEX0.xy   _xOffset*2.00000000E 000; _TMP0 = texture2D(texture0, _c0007); _result = _result   _TMP0; _c0009 = TEX0.xy - _xOffset*2.00000000E 000; _TMP1 = texture2D(texture0, _c0009); _result = _result   _TMP1; _c0011 = TEX0.xy   _yOffset*2.00000000E 000; _TMP2 = texture2D(texture0, _c0011); _result = _result   _TMP2; _c0013 = TEX0.xy - _yOffset*2.00000000E 000; _TMP3 = texture2D(texture0, _c0013); _result = _result   _TMP3; _c0007 = TEX0.xy   _xOffset*3.00000000E 000; _TMP0 = texture2D(texture0, _c0007); _result = _result   _TMP0; _c0009 = TEX0.xy - _xOffset*3.00000000E 000; _TMP1 = texture2D(texture0, _c0009); _result = _result   _TMP1; _c0011 = TEX0.xy   _yOffset*3.00000000E 000; _TMP2 = texture2D(texture0, _c0011); _result = _result   _TMP2; _c0013 = TEX0.xy - _yOffset*3.00000000E 000; _TMP3 = texture2D(texture0, _c0013); _result = _result   _TMP3; _ret_0 = _result/1.60000000E 001; gl_FragColor = _ret_0; return; }

PARAM c[3] = { program.local[0..1],

{ 0.001, 0.0174533, 0.0625 } };

MAD R0.z, -R3.x, R3.y, fragment.texcoord[0].y;

MAD R0.x, -R3, R3.z, fragment.texcoord[0];

MUL result.color, R0, c[2].z;

_uv = TEX0.xy;

PARAM c[6] = { program.local[0..1],

ADD R3.xy, fragment.texcoord[0], -c[0];

MAD R1.xy, R3, R1.x, c[0];

MAD R2.xy, R3, R2.x, c[0];

TEX R0, fragment.texcoord[0], texture[0], 2D;

MAD R0.xy, R3, R0.x, c[0];

MAD R1.xy, R3, R0.z, c[0];

MUL result.color, R0, c[2].y;

_uv = TEX0.xy - PSParam0.xy;

_c0006 = _uv   PSParam0.xy;

_c0006 = _uv*_scale1   PSParam0.xy;

FMX.FilterCatGeometry

PARAM c[5] = { program.local[0..3],

{ 1, 0 } };

MUL R0.x, fragment.texcoord[0].y, c[2].y;

MAD R0.y, fragment.texcoord[0].x, c[2].x, R0.x;

MUL R0.z, fragment.texcoord[0].y, c[3].y;

MAD R0.w, fragment.texcoord[0].x, c[3].x, R0.z;

CMP result.color, -R1.x, c[4].y, R0;

PARAM c[6] = { program.local[0..4],

MUL R0.x, fragment.texcoord[0].y, c[4].y;

MAD R0.x, fragment.texcoord[0], c[4], R0;

MUL R0.y, fragment.texcoord[0], c[3];

MAD R0.y, fragment.texcoord[0].x, c[3].x, R0;

MUL R1.x, fragment.texcoord[0].y, c[2].y;

MAD R1.x, fragment.texcoord[0], c[2], R1;

TEX R0, R0.zwzw, texture[0], 2D;

CMP result.color, -R1.x, c[5].y, R0;

MOV R0.xy, c[0];

ADD R0.zw, -R0.xyxy, c[1].xyxy;

ADD R0.xy, fragment.texcoord[0], c[0];

MUL R0.xy, R0, R0.zwzw;

CMP result.color, -R1.x, c[2].y, R0;

_newCoord = TEX0.xy   PSParam0.xy;

_newCoord = _newCoord*(PSParam1.xy - PSParam0.xy);

FMX.FilterCatTransition

PARAM c[3] = { program.local[0],

ADD R0.xy, fragment.texcoord[0], -c[1].y;

MUL R0.zw, R0.xyxy, R0.xyxy;

MUL R0.zw, R0.z, R0.xyxy;

MAD R0.xy, R0.zwzw, R1.x, c[1].y;

MAD R1.xy, R0.zwzw, R1.y, c[1].y;

MAD result.color, R2.x, R1, R0;

_toUV0007 = TEX0.xy - vec2( 5.00000000E-001, 5.00000000E-001);

MOV R0.x, fragment.texcoord[0];

ADD R0.x, fragment.texcoord[0].y, -R0;

MOV R1.x, fragment.texcoord[0];

FRC R0.zw, R1.xyxy;

TEX R0, R0.zwzw, texture[1], 2D;

CMP result.color, -R2.x, R0, R1;

_uv0009 = TEX0.xy;

PARAM c[7] = { program.local[0..3],

ADD R0.zw, fragment.texcoord[0].xyxy, -c[3].xyxy;

MUL R0.xy, R0.zwzw, R0.zwzw;

MUL R0.zw, R0.x, R0;

MAD R0.xy, R0, R0.z, c[3];

FRC R0.xy, R0;

TEX R0, fragment.texcoord[0], texture[1], 2D;

MAD result.color, R2.x, R0, R1;

_toUV0016 = TEX0.xy - PSParam3.xy;

_newUV0016 = _newUV0016*_TMP17   PSParam3.xy;

_c20016 = texture2D(texture1, TEX0.xy);

MUL R0.x, fragment.texcoord[0].y, c[1];

TEX R1, fragment.texcoord[0], texture[1], 2D;

_TMP6 = texture2D(texture1, TEX0.xy);

_TMP6 = texture2D(texture0, TEX0.xy);

ADD R2.xy, fragment.texcoord[0], -c[3];

MUL R2.xy, R2, R2;

TEX R1, fragment.texcoord[0], texture[0], 2D;

_v0013 = TEX0.xy - PSParam3.xy;

_c10011 = texture2D(texture0, TEX0.xy);

_c20011 = texture2D(texture1, TEX0.xy);

PARAM c[4] = { program.local[0..1],

{ 0.70710677 } };

ADD R0.zw, fragment.texcoord[0].xyxy, -c[1].xyxy;

ABS R1.xy, R0.zwzw;

MUL R0.xy, R0.zwzw, R0.y;

MAD R1.zw, R1.w, R0.xyxy, c[1].xyxy;

MAD R0.xy, R2.y, R0.zwzw, c[1];

ADD R0.xy, fragment.texcoord[0], -R0;

MUL R0.xy, R0, R0;

MUL R0.zw, R0, R1.x;

MAD R0.xy, R0.x, R0.zwzw, c[1];

TEX R1, R1.zwzw, texture[1], 2D;

_toUV0011 = TEX0.xy - PSParam1.xy;

_edgePoint10011 = PSParam1.xy   _distFromCenterToEdge10011*_normToUV0011;

_newUV10011 = PSParam1.xy   _percentFromCenterToRadius10011*(_edgePoint10011 - PSParam1.xy);

_edgePoint20011 = PSParam1.xy   _TMP3*_normToUV0011;

_radiusPoint10011 = PSParam1.xy   _radius0011*_normToUV0011;

_radiusToUV10011 = TEX0.xy - _radiusPoint10011;

_newUV20011 = PSParam1.xy   _percentFromRadiusToEdge10011*(_edgePoint20011 - PSParam1.xy);

{ 1, 2, 0 } };

MAD R0.y, fragment.texcoord[0], c[2], R0;

MUL R0.x, fragment.texcoord[0], c[2].y;

TEX R0.xy, R0, texture[2], 2D;

MUL R0.xy, R0, c[2].w;

ADD R0.xy, R0, -c[3].x;

MAD R0.xy, R0, R0.z, fragment.texcoord[0];

_offset0012 = _TMP2.xy*2.00000000E 000 - 1.00000000E 000;

_x0020 = TEX0.xy   _offset0012*_p0012;

_x0024 = TEX0.xy   _offset0012*_p0012;

ADD R0.xy, fragment.texcoord[0], c[1].x;

_x0011 = TEX0.xy   PSParam1.x;

_TMP8 = texture2D(texture0, TEX0.xy);

_TMP8 = texture2D(texture1, TEX0.xy);

MUL R0.x, fragment.texcoord[0], c[2];

MAD R0.y, -R0.x, R3, fragment.texcoord[0];

MOV_SAT R0.zw, R0.xyxy;

ADD R0.zw, R0, -R0.xyxy;

ABS R0.zw, R0;

CMP R0.zw, -R0, c[2].z, c[2].w;

CMP result.color, -R2.x, R1, R0;

_c20009 = texture2D(texture1, TEX0.xy);

PARAM c[2] = { program.local[0],

_c10005 = texture2D(texture0, TEX0.xy);

_c20005 = texture2D(texture1, TEX0.xy);

PARAM c[4] = { program.local[0],

{ -1, 2, 0 } };

ADD R0.xy, fragment.texcoord[0], -R2.w;

MAD R2.xy, R2.w, c[3].zxzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[2].xwzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[3].xzzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[1].ywzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[2].wxzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[1].wyzw, fragment.texcoord[0];

ADD R2.xy, fragment.texcoord[0], R2.w;

MAD R2.xy, R2.w, c[3], fragment.texcoord[0];

MAD R2.xy, R2.w, c[1].wzzw, fragment.texcoord[0];

MAD R2.xy, R2.w, c[1].yzzw, fragment.texcoord[0];

MAD result.color, R2.z, R0, R1;

_newUV10006 = TEX0.xy   vec2(-_offset0006, -_offset0006);

_brightness10006 = dot(_color10006.xyz, vec3( 1.00000000E 000, 1.10000002E 000, 8.99999976E-001));

_newUV10006 = TEX0.xy   vec2( 0.0, -1.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2( 1.00000000E 000, -1.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2( -1.00000000E 000, 0.0)*_offset0006;

_color10006 = texture2D(texture0, TEX0.xy);

_newUV10006 = TEX0.xy   vec2( 1.00000000E 000, 0.0)*_offset0006;

_newUV10006 = TEX0.xy   vec2( -1.00000000E 000, 1.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2( 0.0, 1.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2(_offset0006, _offset0006);

_newUV10006 = TEX0.xy   vec2( -1.00000000E 000, 2.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2( 0.0, 2.00000000E 000)*_offset0006;

_newUV10006 = TEX0.xy   vec2( 1.00000000E 000, 2.00000000E 000)*_offset0006;

_impl0006 = texture2D(texture1, TEX0.xy);

{ 0, 1, 2, 1000 } };

MAD R0.zw, fragment.texcoord[0].xyxy, R0.x, c[1].w;

FLR R0.xy, R0.zwzw;

MUL R1.xy, R0, R1.x;

_a0008 = TEX0.xy*_pixels0006;

PARAM c[8] = { program.local[0],

{ 2, 3, 4, 5 },

{ 6, 7, 8, 9 },

{ 10, 11, 12, 13 },

{ 14, 15, 16, 17 },

{ 18, 19, 20, 21 },

{ 22, 23 } };

ADD R2.xy, fragment.texcoord[0], -c[1].z;

MAD R1.xy, -R2, R2.z, fragment.texcoord[0];

MUL R3.xy, R2, R2.z;

MAD R0.xy, -R3, c[2].x, fragment.texcoord[0];

MAD R1.xy, -R3, c[2].y, fragment.texcoord[0];

MAD R0.xy, -R3, c[2].z, fragment.texcoord[0];

MAD R1.xy, -R3, c[2].w, fragment.texcoord[0];

MAD R0.xy, -R3, c[3].x, fragment.texcoord[0];

MAD R1.xy, -R3, c[3].y, fragment.texcoord[0];

MAD R0.xy, -R3, c[3].z, fragment.texcoord[0];

MAD R1.xy, -R3, c[3].w, fragment.texcoord[0];

MAD R0.xy, -R3, c[4].x, fragment.texcoord[0];

MAD R1.xy, -R3, c[4].y, fragment.texcoord[0];

MAD R0.xy, -R3, c[4].z, fragment.texcoord[0];

MAD R1.xy, -R3, c[4].w, fragment.texcoord[0];

MAD R0.xy, -R3, c[5].x, fragment.texcoord[0];

MAD R1.xy, -R3, c[5].y, fragment.texcoord[0];

MAD R0.xy, -R3, c[5].z, fragment.texcoord[0];

MAD R1.xy, -R3, c[5].w, fragment.texcoord[0];

MAD R0.xy, -R3, c[6].x, fragment.texcoord[0];

MAD R1.xy, -R3, c[6].y, fragment.texcoord[0];

MAD R0.xy, -R3, c[6].z, fragment.texcoord[0];

MAD R1.xy, -R3, c[6].w, fragment.texcoord[0];

MAD R1.xy, -R3, c[7].x, fragment.texcoord[0];

MAD R2.xy, -R3, c[7].y, fragment.texcoord[0];

MAD result.color, R3.z, R0, R2;

_TMP1 = texture2D(texture0, TEX0.xy);

_c0009 = TEX0.xy - _toUV0007*_s0007;

_c0009 = TEX0.xy - _toUV0007*_s0007*2.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*3.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*4.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*5.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*6.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*7.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*8.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*9.00000000E 000;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.00000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.10000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.20000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.30000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.40000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.50000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.60000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.70000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.80000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*1.90000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*2.00000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*2.10000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*2.20000000E 001;

_c0009 = TEX0.xy - _toUV0007*_s0007*2.30000000E 001;

_c20007 = texture2D(texture1, TEX0.xy);

PARAM c[7] = { program.local[0..1],

ADD R0.zw, fragment.texcoord[0].xyxy, -c[2].y;

MAD R0.xy, R0.zwzw, R1.y, c[2].y;

MAD R0.zw, R0, R1.x, c[2].y;

FRC R1.xy, R0;

FRC R0.xy, R0.zwzw;

_toUV0021 = TEX0.xy - vec2( 5.00000000E-001, 5.00000000E-001);

ADD R0.zw, fragment.texcoord[0].xyxy, -c[3].y;

MUL R1.xy, R0.y, R0.zwzw;

_fromCenter0019 = TEX0.xy - vec2( 5.00000000E-001, 5.00000000E-001);

_TMP18 = texture2D(texture1, TEX0.xy);

_TMP18 = texture2D(texture0, TEX0.xy);

{ 2, 1, 0, -0.01348047 },

MAD R0.x, fragment.texcoord[0].y, c[2].z, R0;

MUL R0.x, fragment.texcoord[0], c[2].z;

MAD R0.xy, R0, c[3].x, -c[3].y;

MUL R0.xy, R0, c[2].z;

MUL R0.zw, -R0.xyxy, -R0.xyxy;

MUL R0.zw, R1.x, -R0.xyxy;

ADD R1.zw, R0.xyxy, fragment.texcoord[0].xyxy;

MAD R0.xy, R0.zwzw, R0.x, R1.zwzw;

_offset0019 = _TMP2.xy*2.00000000E 000 - 1.00000000E 000;

_center0019 = TEX0.xy   _offset0019/1.00000000E 001;

_toUV0019 = TEX0.xy - _center0019;

{ 2, 5 } };

MAD R0.xy, R0.x, c[1], fragment.texcoord[0];

CMP R0.zw, -R0, c[2].y, c[2].z;

CMP R1.xy, -R1.z, R1, R0;

_uv0008 = TEX0.xy   PSParam1.xy*_progress0008;

PARAM c[5] = { program.local[0..1],

MAD R0.xy, R0, R0.z, c[2].y;

CMP R0.zw, -R0, c[2].w, c[2].z;

_toUV0014 = TEX0.xy - vec2( 5.00000000E-001, 5.00000000E-001);

_c20014 = texture2D(texture1, TEX0.xy);

MAD R0.x, fragment.texcoord[0].y, c[2], R0;

MUL R0.xy, R0, c[3].y;

ADD R0.xy, R0, -c[2].z;

MAD R0.xy, R0, R3.y, fragment.texcoord[0];

_offset0010 = _TMP2.xy*2.00000000E 000 - 1.00000000E 000;

_x0018 = TEX0.xy   _offset0010*_progress0010;

_c20010 = texture2D(texture1, TEX0.xy);

{ 0, 0.1 } };

MAD R0.x, fragment.texcoord[0].y, c[1], R0;

ADD R0.xy, fragment.texcoord[0], R0;

ADD R1.xy, R0.zwzw, -R0;

ABS R1.xy, R1;

CMP R1.xy, -R1, c[1].w, R0.z;

_newUV0007 = TEX0.xy   vec2(1.00000001E-001*_progress0007*_TMP0, 0.0);

MUL R2.xy, c[2], c[2];

MOV R2.xy, c[1];

ADD R2.xy, -R2, c[3];

MAD R2.xy, R2.w, R2, c[1];

ADD R2.zw, fragment.texcoord[0].xyxy, -R2.xyxy;

MUL R2.xy, R3.x, c[2];

MUL R2.xy, R2, R2.zwzw;

_currentLineOrigin0012 = PSParam1.xy   _progress0012*(PSParam3.xy - PSParam1.xy);

_TMP0 = dot(PSParam2.xy, PSParam2.xy);

_normLineNormal0012 = _TMP1*PSParam2.xy;

_c10012 = texture2D(texture0, TEX0.xy);

_c20012 = texture2D(texture1, TEX0.xy);

_b0026 = TEX0.xy - _currentLineOrigin0012;

FMX.FilterCatColor

TMonochromeFilter&

TMonochromeFilter

TColorKeyAlphaFilter&

TColorKeyAlphaFilter

ADD result.color.xyz, R0.w, -R0;

MOV result.color.w, R0;

uniform sampler2D texture0;varying vec4 TEX0;void main() {gl_FragColor = texture2D(texture0, TEX0.xy);gl_FragColor = vec4(gl_FragColor.a - gl_FragColor.rgb, gl_FragColor.a);}

DP3 result.color.xyz, R0, c[0];

_color = texture2D(texture0, TEX0.xy);

_gray = dot(_color.xyz, vec3( 2.12599993E-001, 7.15200007E-001, 7.22000003E-002));

{ 0 } };