2026-11-09_69506f4404132f2673759ce887a36bb4_cobalt-strike_conti_darkgate_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_69506f4404132f2673759ce887a36bb4_cobalt-strike_conti_darkgate_elex_glassworm
Size 839KB
Sample261110-vrqc2shb39
SHA256 7cc3cf4c4962156620a0390c4de34df1aed49e07dc572fb84123524a4d6ca766
MD5 69506f4404132f2673759ce887a36bb4
SHA1 f21db6629031a5b6205df2e4d08b88bb0a6df55f
SHA512 798939c5b945e732aba21a7cb8ba22eb22fc9e880fca731bb285db2ce93a6483d349544d7adc6f5aec1b0a495a57fba29289f54d2dba9560dbcbba8afb178a15
SSDEEP 12288:xaOGqZTQbwuCU0v8smBMY/M3j4s1STgqnuA/nrA0DaYJc:JG2TQbJ0v8smBMY/M3UsETg+uAU02mc
TLSH
T101052A21A6C88136E0B21E7B8D7DE995A429BD305F24DC5F3AD80B4C0D3AF41BA76357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-09_69506f4404132f2673759ce887a36bb4_cobalt-strike_conti_darkgate_elex_glassworm

.exe 839KB

2026-11-09_69506f4404132f2673759ce887a36bb4_cobalt-strike_conti_darkgate_elex_glassworm

IMPHASH f8d302651433f824d15344494d55fab7
SHA256 7cc3cf4c4962156620a0390c4de34df1aed49e07dc572fb84123524a4d6ca766
MD5 69506f4404132f2673759ce887a36bb4
SHA1 f21db6629031a5b6205df2e4d08b88bb0a6df55f
SHA512 798939c5b945e732aba21a7cb8ba22eb22fc9e880fca731bb285db2ce93a6483d349544d7adc6f5aec1b0a495a57fba29289f54d2dba9560dbcbba8afb178a15
SSDEEP 12288:xaOGqZTQbwuCU0v8smBMY/M3j4s1STgqnuA/nrA0DaYJc:JG2TQbJ0v8smBMY/M3UsETg+uAU02mc
TLSH
T101052A21A6C88136E0B21E7B8D7DE995A429BD305F24DC5F3AD80B4C0D3AF41BA76357
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

84:e0:4e:60:8a:f2:16:0d:d7:39:e3:0b:8c:63:83:81:bd:71:6b:e5:bc:f3:fb:7c:ae:f7:5e:3a:75:e4:c9:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Nov 29, 2021

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

b3:e9:5c:f1:ce:b0:7a:33:51:cb:a4:58:b9:3b:ff:de:cb:8b:3c:ca

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Chains

Nov 29, 2021

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=IObit CO.\, LTD,O=IObit CO.\, LTD,POSTALCODE=610042,STREET=No. 605\, 6th Floor\, Unit 1\, Building 1+STREET=45 Renmin South Road,L=Chengdu Shi,ST=Sichuan Sheng,C=CN

Serial Number

8b:a1:f1:72:fd:50:ba:8d:4c:11:b7:4f:fa:c8:a2:82

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2021 - Mar 24, 2024

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

622620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

rtl120.bpl

@System@initialization$qqrv @System@Finalization$qqrv @System@LoadResString$qqrp20System@TResStringRec @System@UTF8ToUnicodeString$qqrrx28System@%SmallString$iuc$255% @System@UTF8Encode$qqrx20System@UnicodeString @System@FreeMemory$qpv @System@@CheckAutoResult$qqrl @System@TInterfacedObject@_Release$qqsv @System@TInterfacedObject@_AddRef$qqsv @System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv @System@TInterfacedObject@NewInstance$qqrv @System@TInterfacedObject@BeforeDestruction$qqrv @System@TInterfacedObject@AfterConstruction$qqrv @System@@IntfAddRef$qqrx45System@%DelphiInterface$t17System@IInterface% @System@@IntfCast$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%rx5_GUID @System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface% @System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface% @System@RegisterModule$qqrp17System@TLibModule @System@@DynArrayAsg$qqrv @System@@DynArrayClear$qqrrpvpv @System@@DynArraySetLength$qqrv @System@@DynArrayHigh$qqrv @System@@DynArrayLength$qqrv @System@@ValInt64$qqrx20System@UnicodeStringri @System@@_llmod$qqrv @System@@_lldiv$qqrv @System@@_llmulo$qqrv @System@@Dispose$qqrpvt1 @System@@New$qqripv @System@@CopyRecord$qqrv @System@@AddRefRecord$qqrv @System@@Finalize$qqrpvt1 @System@@FinalizeArray$qqrpvt1ui @System@@FinalizeRecord$qqrpvt1 @System@@InitializeRecord$qqrpvt1 @System@Pos$qqrx20System@UnicodeStringt1 @System@@UniqueStringU$qqrr20System@UnicodeString @System@@UStrInsert$qqrx20System@UnicodeStringr20System@UnicodeStringi @System@@UStrDelete$qqrr20System@UnicodeStringii @System@@UStrCopy$qqrx20System@UnicodeStringii @System@@UStrEqual$qqrv @System@@UStrCatN$qqrv @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2 @System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrSetLength$qqrr20System@UnicodeStringi @System@@UStrLen$qqrx20System@UnicodeString @System@@WStrFromUStr$qqrr17System@WideStringx20System@UnicodeString @System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString @System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus @System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$% @System@@UStrFromWArray$qqrr20System@UnicodeStringpbi @System@@UStrFromArray$qqrr20System@UnicodeStringpci @System@@UStrFromPWChar$qqrr20System@UnicodeStringpb @System@@UStrFromPChar$qqrr20System@UnicodeStringpc @System@@UStrFromWChar$qqrr20System@UnicodeStringb @System@@UStrFromChar$qqrr20System@UnicodeStringc @System@@UStrFromPWCharLen$qqrr20System@UnicodeStringpbi @System@@UStrToPWChar$qqrx20System@UnicodeString @System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrArrayClr$qqrpvi @System@@UStrClr$qqrpv @System@@UStrAddRef$qqrpv @System@@WStrAddRef$qqrr17System@WideString @System@StringOfChar$qqrbi @System@@WStrSetLength$qqrr17System@WideStringi @System@@WStrCopy$qqrx17System@WideStringii @System@@WStrEqual$qqrv @System@@WStrCatN$qqrv @System@@WStrCat3$qqrr17System@WideStringx17System@WideStringt2 @System@@WStrCat$qqrr17System@WideStringx17System@WideString @System@@WStrLen$qqrx17System@WideString @System@@WStrToPWChar$qqrx17System@WideString @System@@WStrFromWChar$qqrr17System@WideStringb @System@@WStrAsg$qqrr17System@WideStringx17System@WideString @System@@WStrArrayClr$qqrpvi @System@@WStrClr$qqrpv @System@@LStrSetLength$qqrv @System@Pos$qqrx31System@%AnsiStringT$us$i65535$%t1 @System@@LStrDelete$qqrv @System@@LStrCopy$qqrv @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$% @System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$% @System@@LStrAddRef$qqrpv @System@@LStrEqual$qqrv @System@@LStrCatN$qqrv @System@@LStrCat3$qqrv @System@@LStrCat$qqrv @System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$% @System@@LStrFromString$qqrr27System@%AnsiStringT$us$i0$%rx28System@%SmallString$iuc$255%us @System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus @System@@LStrFromPChar$qqrr27System@%AnsiStringT$us$i0$%pcus @System@@LStrFromChar$qqrr27System@%AnsiStringT$us$i0$%cus @System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us @System@@InternalLStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus @System@@EnsureUnicodeString$qqrr20System@UnicodeString @System@@InternalUStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$% @System@@LStrAsg$qqrpvpxv @System@@LStrArrayClr$qqrpvi @System@@LStrClr$qqrpv @System@@Assert$qqrx20System@UnicodeStringt1i @System@@RunError$qqruc @System@@Halt0$qqrv @System@@InitWideStrings$qqrv @System@@InitResStringImports$qqrv @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule @System@@TryFinallyExit$qqrv @System@@DoneExcept$qqrv @System@@RaiseAgain$qqrv @System@@RaiseExcept$qqrv @System@@HandleAutoException$qqrv @System@@HandleFinally$qqrv @System@@HandleOnException$qqrv @System@@HandleAnyException$qqrv @System@@BeforeDestruction$qqrp14System@TObjectzc @System@@AfterConstruction$qqrp14System@TObject @System@@ClassDestroy$qqrp14System@TObject @System@@ClassCreate$qqrp17System@TMetaClasso @System@TObject@Dispatch$qqrpv @System@TObject@BeforeDestruction$qqrv @System@TObject@AfterConstruction$qqrv @System@TObject@DefaultHandler$qqrpv @System@TObject@ToString$qqrv @System@TObject@SafeCallException$qqrp14System@TObjectpv @System@TObject@ClassInfo$qqrv @System@@FindDynaInst$qqrv @System@@CallDynaInst$qqrv @System@@AsClass$qqrp14System@TObjectp17System@TMetaClass @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass @System@TObject@GetInterface$qqrrx5_GUIDpv @System@TObject@GetHashCode$qqrv @System@TObject@Equals$qqrp14System@TObject @System@TObject@Free$qqrv @System@TObject@$bdtr$qqrv @System@TObject@$bctr$qqrv @System@TObject@FreeInstance$qqrv @System@TObject@NewInstance$qqrv @System@TObject@ClassName$qqrv @System@TObject@ClassType$qqrv @System@@IntOver$qqrv @System@@BoundErr$qqrv @System@@SetEq$qqrv @System@@SetElem$qqrv @System@@FillChar$qqrpvib @System@@AStrCmp$qqrv @System@@PStrCpy$qqrp28System@%SmallString$iuc$255%t1 @System@@AbstractError$qqrv @System@@TRUNC$qqrv @System@@ROUND$qqrv @System@Ln$qqrxg @System@Exp$qqrxg @System@Random$qqrxi @System@Randomize$qqrv @System@ParamStr$qqri @System@ParamCount$qqrv @System@Move$qqrpxvpvi @System@ExceptAddr$qqrv @System@ExceptObject$qqrv @System@@ReallocMem$qqrrpvi @System@@FreeMem$qqrpv @System@@GetMem$qqri @System@AllocMem$qqrui @System@SysRegisterExpectedMemoryLeak$qqrpv @System@MainThreadID @$xp$16System@TDateTime @$xp$24System@TInterfacedObject @System@TInterfacedObject@ @$xp$9IDispatch @$xp$17System@IInterface @$xp$14System@TObject @System@TObject@ @$xp$17System@OleVariant @$xp$14System@Variant @$xp$17System@AnsiString @$xp$17System@WideString @$xp$13System@string @$xp$8LongBool @$xp$15System@WordBool @$xp$15System@ByteBool @$xp$18System@ShortString @$xp$15System@Currency @$xp$11System@Comp @$xp$4Real @$xp$6Double @$xp$15System@Extended @$xp$6Single @$xp$5Int64 @$xp$8Cardinal @$xp$11System@Word @$xp$11System@Byte @$xp$7Integer @$xp$8SmallInt @$xp$15System@ShortInt @$xp$11System@Char @$xp$8AnsiChar @$xp$7Boolean @$xp$19TWideStringDynArray @$xp$15TStringDynArray @$xp$16TBooleanDynArray @$xp$15TDoubleDynArray @$xp$15TSingleDynArray @$xp$17TLongWordDynArray @$xp$14TInt64DynArray @$xp$17TShortIntDynArray @$xp$13TByteDynArray @$xp$17TSmallIntDynArray @$xp$13TWordDynArray @$xp$17TCardinalDynArray @$xp$16TIntegerDynArray @Sysconst@_SDivByZero @Activex@Failed$qqrl @Activex@Succeeded$qqrl @Helpintfs@initialization$qqrv @Helpintfs@Finalization$qqrv @Classes@initialization$qqrv @Classes@Finalization$qqrv @Classes@TStreamAdapter@$bctr$qqrp15Classes@TStream24Classes@TStreamOwnership @Classes@TComponent@QueryInterface$qqsrx5_GUIDpv @Classes@TComponent@UpdateRegistry$qqrox20System@UnicodeStringt2 @Classes@TComponent@SafeCallException$qqrp14System@TObjectpv @Classes@TComponent@SetName$qqrx20System@UnicodeString @Classes@TComponent@ValidateRename$qqrp18Classes@TComponentx20System@UnicodeStringt2 @Classes@TComponent@WriteState$qqrp15Classes@TWriter @Classes@TComponent@ReadState$qqrp15Classes@TReader @Classes@TComponent@Loaded$qqrv @Classes@TComponent@DefineProperties$qqrp14Classes@TFiler @Classes@TComponent@Notification$qqrp18Classes@TComponent18Classes@TOperation @Classes@TComponent@Destroying$qqrv @Classes@TComponent@FreeNotification$qqrp18Classes@TComponent @Classes@TComponent@BeforeDestruction$qqrv @Classes@TComponent@$bdtr$qqrv @Classes@TComponent@$bctr$qqrp18Classes@TComponent @Classes@TThread@WaitFor$qqrv @Classes@TThread@Terminate$qqrv @Classes@TThread@DoTerminate$qqrv @Classes@TThread@AfterConstruction$qqrv @Classes@TThread@$bdtr$qqrv @Classes@TThread@$bctr$qqro @Classes@HexToBin$qqrpbpci @Classes@TWriter@WriteString$qqrx20System@UnicodeString @Classes@TReader@ReadString$qqrv @Classes@TStringStream@$bctr$qqrx27System@%AnsiStringT$us$i0$% @Classes@TStringStream@$bctr$qqrx20System@UnicodeString @Classes@TMemoryStream@LoadFromFile$qqrx20System@UnicodeString @Classes@TMemoryStream@Clear$qqrv @Classes@TCustomMemoryStream@SaveToFile$qqrx20System@UnicodeString @Classes@TFileStream@$bdtr$qqrv @Classes@TFileStream@$bctr$qqrx20System@UnicodeStringus @Classes@THandleStream@SetSize$qqrxj @Classes@THandleStream@SetSize$qqri @Classes@THandleStream@Seek$qqrxj19Classes@TSeekOrigin @Classes@THandleStream@Write$qqrpxvi @Classes@THandleStream@Read$qqrpvi @Classes@TStream@CopyFrom$qqrp15Classes@TStreamj @Classes@TStream@WriteBuffer$qqrpxvi @Classes@TStream@ReadBuffer$qqrpvi @Classes@TStream@Seek$qqrxj19Classes@TSeekOrigin @Classes@TStream@Seek$qqrius @Classes@TStream@SetSize$qqrxj @Classes@TStream@SetSize64$qqrxj @Classes@TStream@SetSize$qqri @Classes@TStream@GetSize$qqrv @Classes@TStream@SetPosition$qqrxj @Classes@TStream@GetPosition$qqrv @Classes@TStringList@SetCaseSensitive$qqrxo @Classes@TStringList@$bctr$qqrv @Classes@TStringList@CompareStrings$qqrx20System@UnicodeStringt1 @Classes@TStringList@CustomSort$qqrpqqrp19Classes@TStringListii$i @Classes@TStringList@Sort$qqrv @Classes@TStringList@SetUpdateState$qqro @Classes@TStringList@SetCapacity$qqri @Classes@TStringList@PutObject$qqrip14System@TObject @Classes@TStringList@Put$qqrix20System@UnicodeString @Classes@TStringList@InsertItem$qqrix20System@UnicodeStringp14System@TObject @Classes@TStringList@InsertObject$qqrix20System@UnicodeStringp14System@TObject @Classes@TStringList@Insert$qqrix20System@UnicodeString @Classes@TStringList@IndexOf$qqrx20System@UnicodeString @Classes@TStringList@GetObject$qqri @Classes@TStringList@GetCount$qqrv @Classes@TStringList@GetCapacity$qqrv @Classes@TStringList@Get$qqri @Classes@TStringList@Find$qqrx20System@UnicodeStringri @Classes@TStringList@Exchange$qqrii @Classes@TStringList@Delete$qqri @Classes@TStringList@Clear$qqrv @Classes@TStringList@Changing$qqrv @Classes@TStringList@Changed$qqrv @Classes@TStringList@AddObject$qqrx20System@UnicodeStringp14System@TObject @Classes@TStringList@Add$qqrx20System@UnicodeString @Classes@TStringList@$bdtr$qqrv @Classes@TStrings@GetValueFromIndex$qqri @Classes@TStrings@GetNameValueSeparator$qqrv @Classes@TStrings@SetValue$qqrx20System@UnicodeStringt1 @Classes@TStrings@SetTextStr$qqrx20System@UnicodeString @Classes@TStrings@SetText$qqrpb @Classes@TStrings@SetCommaText$qqrx20System@UnicodeString @Classes@TStrings@SaveToStream$qqrp15Classes@TStreamp18Sysutils@TEncoding @Classes@TStrings@SaveToStream$qqrp15Classes@TStream @Classes@TStrings@SaveToFile$qqrx20System@UnicodeStringp18Sysutils@TEncoding @Classes@TStrings@SaveToFile$qqrx20System@UnicodeString @Classes@TStrings@Move$qqrii @Classes@TStrings@LoadFromStream$qqrp15Classes@TStreamp18Sysutils@TEncoding @Classes@TStrings@LoadFromStream$qqrp15Classes@TStream @Classes@TStrings@LoadFromFile$qqrx20System@UnicodeStringp18Sysutils@TEncoding @Classes@TStrings@LoadFromFile$qqrx20System@UnicodeString @Classes@TStrings@IndexOfObject$qqrp14System@TObject @Classes@TStrings@IndexOfName$qqrx20System@UnicodeString @Classes@TStrings@GetValue$qqrx20System@UnicodeString @Classes@TStrings@GetTextStr$qqrv @Classes@TStrings@GetText$qqrv @Classes@TStrings@GetName$qqri @Classes@TStrings@GetEnumerator$qqrv @Classes@TStrings@GetCommaText$qqrv @Classes@TStrings@EndUpdate$qqrv @Classes@TStrings@DefineProperties$qqrp14Classes@TFiler @Classes@TStrings@BeginUpdate$qqrv @Classes@TStrings@Assign$qqrp19Classes@TPersistent @Classes@TStrings@AddStrings$qqrp16Classes@TStrings @Classes@TStringsEnumerator@MoveNext$qqrv @Classes@TStringsEnumerator@GetCurrent$qqrv @Classes@TCollection@Notify$qqrp23Classes@TCollectionItem31Classes@TCollectionNotification @Classes@TCollection@Deleting$qqrp23Classes@TCollectionItem @Classes@TCollection@Added$qqrrp23Classes@TCollectionItem @Classes@TCollection@Update$qqrp23Classes@TCollectionItem @Classes@TCollection@SetItemName$qqrp23Classes@TCollectionItem @Classes@TCollection@EndUpdate$qqrv @Classes@TCollection@BeginUpdate$qqrv @Classes@TCollection@Assign$qqrp19Classes@TPersistent @Classes@TCollection@Add$qqrv @Classes@TCollection@$bdtr$qqrv @Classes@TCollection@$bctr$qqrp17System@TMetaClass @Classes@TCollectionItem@SetIndex$qqri @Classes@TCollectionItem@SetDisplayName$qqrx20System@UnicodeString @Classes@TCollectionItem@SetCollection$qqrp19Classes@TCollection @Classes@TCollectionItem@GetDisplayName$qqrv @Classes@TCollectionItem@$bdtr$qqrv @Classes@TCollectionItem@$bctr$qqrp19Classes@TCollection @Classes@TInterfacedPersistent@QueryInterface$qqsrx5_GUIDpv @Classes@TInterfacedPersistent@AfterConstruction$qqrv @Classes@TPersistent@DefineProperties$qqrp14Classes@TFiler @Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent @Classes@TPersistent@Assign$qqrp19Classes@TPersistent @Classes@TPersistent@$bdtr$qqrv @Classes@TInterfaceList@$bctr$qqrv @Classes@TThreadList@UnlockList$qqrv @Classes@TThreadList@LockList$qqrv @Classes@TThreadList@$bctr$qqrv @Classes@TList@IndexOf$qqrpv @Classes@TList@Get$qqri @Classes@TList@Delete$qqri @Classes@TList@Add$qqrpv @Classes@Bounds$qqriiii @Classes@Rect$qqriiii @Classes@ApplicationHandleException @$xp$18Classes@TComponent @Classes@TComponent@ @Classes@TThread@ @Classes@TStreamAdapter@ @Classes@TStringStream@ @Classes@TMemoryStream@ @Classes@TFileStream@ @$xp$15Classes@TStream @Classes@TStream@ @$xp$19Classes@TStringList @Classes@TStringList@ @$xp$16Classes@TStrings @Classes@TStrings@ @$xp$19Classes@TCollection @Classes@TCollection@ @$xp$23Classes@TCollectionItem @Classes@TCollectionItem@ @$xp$19Classes@TPersistent @Classes@TPersistent@ @Classes@TInterfaceList@ @$xp$22Classes@IInterfaceList @Classes@TThreadList@ @Classes@TList@ @$xp$20Classes@TNotifyEvent @Typinfo@initialization$qqrv @Typinfo@Finalization$qqrv @Typinfo@GetTypeData$qqrp17Typinfo@TTypeInfo @Typinfo@TPublishableVariantType@SetProperty$qqrrx8TVarDatax20System@UnicodeStringt1 @Typinfo@TPublishableVariantType@GetProperty$qqrr8TVarDatarx8TVarDatax20System@UnicodeString @Typinfo@TPublishableVariantType@ @Sysutils@initialization$qqrv @Sysutils@Finalization$qqrv @Sysutils@TEncoding@GetUTF8$qqrv @Sysutils@TEncoding@GetUnicode$qqrv @Sysutils@TEncoding@GetString$qqrx25System@%DynamicArray$tuc%ii @Sysutils@TEncoding@GetEncoding$qqri @Sysutils@TEncoding@GetBytes$qqrx20System@UnicodeStringiir25System@%DynamicArray$tuc%i @Sysutils@TEncoding@GetBytes$qqrx24System@%DynamicArray$tb%iir25System@%DynamicArray$tuc%i @Sysutils@TEncoding@GetByteCount$qqrx24System@%DynamicArray$tb%ii @Sysutils@TEncoding@GetASCII$qqrv @Sysutils@GetEnvironmentVariable$qqrx20System@UnicodeString @Sysutils@SafeLoadLibrary$qqrx20System@UnicodeStringui @Sysutils@Supports$qqrx45System@%DelphiInterface$t17System@IInterface%rx5_GUIDpv @Sysutils@FreeAndNil$qqrpv @Sysutils@RaiseLastOSError$qqrv @Sysutils@GetModuleName$qqrui @Sysutils@StringReplace$qqrx20System@UnicodeStringt1t149System@%Set$t21Sysutils@Sysutils__15$iuc$0$iuc$1% @Sysutils@GetLocaleFormatSettings$qqrir24Sysutils@TFormatSettings @Sysutils@AnsiStrScan$qqrpbb @Sysutils@AnsiPos$qqrx20System@UnicodeStringt1 @Sysutils@IncludeTrailingPathDelimiter$qqrx20System@UnicodeString @Sysutils@IncludeTrailingBackslash$qqrx20System@UnicodeString @Sysutils@Exception@ToString$qqrv @Sysutils@Exception@RaisingException$qqrp25Sysutils@TExceptionRecord @Sysutils@Exception@GetBaseException$qqrv @Sysutils@Exception@$bdtr$qqrv @Sysutils@Exception@$bctr$qqrx20System@UnicodeStringpx14System@TVarRecxi @Sysutils@Exception@$bctr$qqrx20System@UnicodeString @Sysutils@Abort$qqrv @Sysutils@ShowException$qqrp14System@TObjectpv @Sysutils@SysErrorMessage$qqrui @Sysutils@StrToDateTimeDef$qqrx20System@UnicodeStringx16System@TDateTimerx24Sysutils@TFormatSettings @Sysutils@StrToDateTime$qqrx20System@UnicodeStringrx24Sysutils@TFormatSettings @Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTimerx24Sysutils@TFormatSettings @Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTime @Sysutils@DateTimeToStr$qqrx16System@TDateTime @Sysutils@DateToStr$qqrx16System@TDateTimerx24Sysutils@TFormatSettings @Sysutils@DateTimeToString$qqrr20System@UnicodeStringx20System@UnicodeString16System@TDateTime @Sysutils@Now$qqrv @Sysutils@SystemTimeToDateTime$qqrrx11_SYSTEMTIME @Sysutils@EncodeTime$qqrusususus @Sysutils@StrToFloat$qqrx20System@UnicodeStringrx24Sysutils@TFormatSettings @Sysutils@StrToFloat$qqrx20System@UnicodeString @Sysutils@FloatToStrF$qqrg21Sysutils@TFloatFormatii @Sysutils@CurrToStr$qqr15System@Currency @Sysutils@FloatToStr$qqrgrx24Sysutils@TFormatSettings @Sysutils@FloatToStr$qqrg @Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxirx24Sysutils@TFormatSettings @Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxi @Sysutils@StrDispose$qqrpb @Sysutils@StrAlloc$qqrui @Sysutils@StrPas$qqrpxc @Sysutils@StrScan$qqrpxbb @Sysutils@StrPLCopy$qqrpcx27System@%AnsiStringT$us$i0$%ui @Sysutils@StrLCopy$qqrpbpxbui @Sysutils@StrLen$qqrpxb @Sysutils@ExpandFileName$qqrx20System@UnicodeString @Sysutils@ExtractFileExt$qqrx20System@UnicodeString @Sysutils@ExtractFileName$qqrx20System@UnicodeString @Sysutils@ExtractFileDrive$qqrx20System@UnicodeString @Sysutils@ExtractFileDir$qqrx20System@UnicodeString @Sysutils@ExtractFilePath$qqrx20System@UnicodeString @Sysutils@ChangeFileExt$qqrx20System@UnicodeStringt1 @Sysutils@LastDelimiter$qqrx20System@UnicodeStringt1 @Sysutils@RenameFile$qqrx20System@UnicodeStringt1 @Sysutils@DeleteFile$qqrx20System@UnicodeString @Sysutils@FindClose$qqrr19Sysutils@TSearchRec @Sysutils@FindNext$qqrr19Sysutils@TSearchRec @Sysutils@FindFirst$qqrx20System@UnicodeStringir19Sysutils@TSearchRec @Sysutils@FileIsReadOnly$qqrx20System@UnicodeString @Sysutils@FileSetAttr$qqrx20System@UnicodeStringi @Sysutils@FileGetAttr$qqrx20System@UnicodeString @Sysutils@ForceDirectories$qqr20System@UnicodeString @Sysutils@DirectoryExists$qqrx20System@UnicodeString @Sysutils@FileExists$qqrx20System@UnicodeString @Sysutils@BoolToStr$qqroo @Sysutils@StrToInt64Def$qqrx20System@UnicodeStringxj @Sysutils@StrToInt64$qqrx20System@UnicodeString @Sysutils@StrToIntDef$qqrx20System@UnicodeStringi @Sysutils@StrToInt$qqrx20System@UnicodeString @Sysutils@IntToHex$qqrii @Sysutils@IntToStr$qqrj @Sysutils@IntToStr$qqri @Sysutils@TrimRight$qqrx20System@UnicodeString @Sysutils@TrimLeft$qqrx20System@UnicodeString @Sysutils@Trim$qqrx20System@UnicodeString @Sysutils@AnsiCompareText$qqrx20System@UnicodeStringt1 @Sysutils@AnsiUpperCase$qqrx20System@UnicodeString @Sysutils@SameText$qqrx20System@UnicodeStringt1 @Sysutils@CompareText$qqrx20System@UnicodeStringt1 @Sysutils@CompareMem$qqrpvt1i @Sysutils@CompareStr$qqrx20System@UnicodeStringt1 @Sysutils@LowerCase$qqrx20System@UnicodeString @Sysutils@UpperCase$qqrx20System@UnicodeString @Sysutils@CharInSet$qqrbrx29System@%Set$tc$iuc$0$iuc$255% @Sysutils@IsLeadChar$qqrb @Sysutils@GUIDToString$qqrrx5_GUID @Sysutils@CreateGUID$qqsr5_GUID @$xp$19Sysutils@TCharArray @Sysutils@LeadBytes @$xp$24Sysutils@TFormatSettings @Sysutils@TwoDigitYearCenturyWindow @Sysutils@ShortDateFormat @Sysutils@DecimalSeparator @Sysutils@Win32BuildNumber @Sysutils@Win32MinorVersion @Sysutils@Win32MajorVersion @Sysutils@Win32Platform @Sysutils@EConvertError@ @Sysutils@EInOutError@ @Sysutils@Exception@ @$xp$19Sysutils@TSearchRec @$xp$15Sysutils@TBytes @Math@Power$qqrxfxf @Strutils@RightStr$qqrx17System@WideStringxi @Strutils@LeftStr$qqrx17System@WideStringxi @Variants@initialization$qqrv @Variants@Finalization$qqrv @Variants@@VarCmpEQ$qqrrx8TVarDatat1 @Variants@@VarAdd$qqrr8TVarDatarx8TVarData @Variants@Null$qqrv @Variants@TInvokeableVariantType@DoProcedure$qqrrx8TVarDatax20System@UnicodeStringx32System@%DynamicArray$t8TVarData% @Variants@TInvokeableVariantType@DoFunction$qqrr8TVarDatarx8TVarDatax20System@UnicodeStringx32System@%DynamicArray$t8TVarData% @Variants@TInvokeableVariantType@DispInvoke$qqrp8TVarDatarx8TVarDatap16System@TCallDescpv @Variants@TInvokeableVariantType@FixupIdent$qqrx20System@UnicodeString @Variants@TCustomVariantType@VarDataToStr$qqrrx8TVarData @Variants@TCustomVariantType@VarDataIsStr$qqrrx8TVarData @Variants@TCustomVariantType@QueryInterface$qqsrx5_GUIDpv @Variants@TCustomVariantType@VarDataFromOleStr$qqrr8TVarDatax17System@WideString @Variants@TCustomVariantType@VarDataFromStr$qqrr8TVarDatax20System@UnicodeString @Variants@TCustomVariantType@VarDataIsByRef$qqrrx8TVarData @Variants@TCustomVariantType@VarDataCastTo$qqrr8TVarDatarx8TVarDataxus @Variants@TCustomVariantType@VarDataCopyNoInd$qqrr8TVarDatarx8TVarData @Variants@TCustomVariantType@VarDataClear$qqrr8TVarData @Variants@TCustomVariantType@VarDataInit$qqrr8TVarData @Variants@TCustomVariantType@UnaryOp$qqrr8TVarDataxi @Variants@TCustomVariantType@RightPromotion$qqrrx8TVarDataxirus @Variants@TCustomVariantType@RaiseInvalidOp$qqrv @Variants@TCustomVariantType@OlePromotion$qqrrx8TVarDatarus @Variants@TCustomVariantType@LeftPromotion$qqrrx8TVarDataxirus @Variants@TCustomVariantType@IsClear$qqrrx8TVarData @Variants@TCustomVariantType@$bdtr$qqrv @Variants@TCustomVariantType@$bctr$qqrv @Variants@TCustomVariantType@CastToOle$qqrr8TVarDatarx8TVarData @Variants@TCustomVariantType@CompareOp$qqrrx8TVarDatat1xi @Variants@TCustomVariantType@CastTo$qqrr8TVarDatarx8TVarDataxus @Variants@VarToWideStr$qqrrx14System@Variant @Variants@VarToStr$qqrrx14System@Variant @Variants@VarIsNull$qqrrx14System@Variant @Variants@VarIsOrdinal$qqrrx14System@Variant @Variants@VarType$qqrrx14System@Variant @Variants@@VarAddRef$qqrr8TVarData @Variants@@OleVarFromVar$qqrr8TVarDatarx8TVarData @Variants@@OleVarFromUStr$qqrr8TVarDatax20System@UnicodeString @Variants@@VarFromDisp$qqrr8TVarDatax36System@%DelphiInterface$t9IDispatch% @Variants@@VarFromIntf$qqrr8TVarDatax45System@%DelphiInterface$t17System@IInterface% @Variants@@VarFromWChar$qqrr8TVarDataxb @Variants@@VarFromUStr$qqrr8TVarDatax20System@UnicodeString @Variants@@OleVarFromInt$qqrr8TVarDataxixzc @Variants@@VarToUStr$qqrr20System@UnicodeStringrx8TVarData @Variants@@VarToBool$qqrrx8TVarData @Variants@@VarToInteger$qqrrx8TVarData @Variants@@VarCopy$qqrr8TVarDatarx8TVarData @Variants@@DispInvoke$qp8TVarDatarx8TVarDatap16System@TCallDescpv @Variants@@VarClr$qqrr8TVarData @Varutils@initialization$qqrv @Varutils@Finalization$qqrv @Multimon@initialization$qqrv @Multimon@Finalization$qqrv @Registry@initialization$qqrv @Registry@Finalization$qqrv @Registry@TRegistry@KeyExists$qqrx20System@UnicodeString @Registry@TRegistry@ValueExists$qqrx20System@UnicodeString @Registry@TRegistry@ReadBinaryData$qqrx20System@UnicodeStringpvi @Registry@TRegistry@WriteBinaryData$qqrx20System@UnicodeStringpvi @Registry@TRegistry@ReadInteger$qqrx20System@UnicodeString @Registry@TRegistry@WriteInteger$qqrx20System@UnicodeStringi @Registry@TRegistry@GetDataAsString$qqrx20System@UnicodeStringo @Registry@TRegistry@ReadString$qqrx20System@UnicodeString @Registry@TRegistry@WriteExpandString$qqrx20System@UnicodeStringt1 @Registry@TRegistry@WriteString$qqrx20System@UnicodeStringt1 @Registry@TRegistry@GetDataSize$qqrx20System@UnicodeString @Registry@TRegistry@GetKeyNames$qqrp16Classes@TStrings @Registry@TRegistry@DeleteValue$qqrx20System@UnicodeString @Registry@TRegistry@DeleteKey$qqrx20System@UnicodeString @Registry@TRegistry@OpenKeyReadOnly$qqrx20System@UnicodeString @Registry@TRegistry@OpenKey$qqrx20System@UnicodeStringo @Registry@TRegistry@CreateKey$qqrx20System@UnicodeString @Registry@TRegistry@SetRootKey$qqrp6HKEY__ @Registry@TRegistry@CloseKey$qqrv @Registry@TRegistry@$bctr$qqrv @Registry@TRegistry@ @Inifiles@initialization$qqrv @Inifiles@Finalization$qqrv @Inifiles@TIniFile@DeleteKey$qqrx20System@UnicodeStringt1 @Inifiles@TIniFile@ReadSectionValues$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TIniFile@ReadSection$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TIniFile@$bdtr$qqrv @Inifiles@TMemIniFile@ReadString$qqrx20System@UnicodeStringt1t1 @Inifiles@TMemIniFile@ReadSectionValues$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TMemIniFile@ReadSections$qqrp16Classes@TStrings @Inifiles@TMemIniFile@ReadSection$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TMemIniFile@GetStrings$qqrp16Classes@TStrings @Inifiles@TMemIniFile@GetCaseSensitive$qqrv @Inifiles@TMemIniFile@EraseSection$qqrx20System@UnicodeString @Inifiles@TMemIniFile@Clear$qqrv @Inifiles@TMemIniFile@$bdtr$qqrv @Inifiles@TMemIniFile@$bctr$qqrx20System@UnicodeString @Inifiles@THashedStringList@IndexOfName$qqrx20System@UnicodeString @Inifiles@THashedStringList@IndexOf$qqrx20System@UnicodeString @Inifiles@THashedStringList@$bdtr$qqrv @Inifiles@THashedStringList@Changed$qqrv @Inifiles@TStringHash@Remove$qqrx20System@UnicodeString @Inifiles@TStringHash@Add$qqrx20System@UnicodeStringi @Inifiles@TCustomIniFile@ReadSections$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TCustomIniFile@WriteBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream @Inifiles@TCustomIniFile@ReadBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream @Inifiles@TCustomIniFile@ValueExists$qqrx20System@UnicodeStringt1 @Inifiles@TCustomIniFile@WriteBool$qqrx20System@UnicodeStringt1o @Inifiles@TCustomIniFile@WriteTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@WriteFloat$qqrx20System@UnicodeStringt1d @Inifiles@TCustomIniFile@WriteDateTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@WriteDate$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadFloat$qqrx20System@UnicodeStringt1d @Inifiles@TCustomIniFile@ReadDateTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadDate$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadBool$qqrx20System@UnicodeStringt1o @Inifiles@TCustomIniFile@WriteInteger$qqrx20System@UnicodeStringt1i @Inifiles@TCustomIniFile@ReadInteger$qqrx20System@UnicodeStringt1i @Inifiles@TCustomIniFile@SectionExists$qqrx20System@UnicodeString @Inifiles@TCustomIniFile@$bctr$qqrx20System@UnicodeString @Inifiles@TIniFile@ @Inifiles@TMemIniFile@ @$xp$26Inifiles@THashedStringList @Inifiles@THashedStringList@ @Inifiles@TCustomIniFile@ @Syncobjs@initialization$qqrv @Syncobjs@Finalization$qqrv @Syncobjs@TCriticalSection@Leave$qqrv @Syncobjs@TCriticalSection@Enter$qqrv @Syncobjs@TCriticalSection@Release$qqrv @Syncobjs@TCriticalSection@Acquire$qqrv @Syncobjs@TCriticalSection@$bdtr$qqrv @Syncobjs@TCriticalSection@$bctr$qqrv @Syncobjs@TCriticalSection@ @Uxtheme@initialization$qqrv @Uxtheme@Finalization$qqrv @Dwmapi@initialization$qqrv @Dwmapi@Finalization$qqrv @Zlib@inflateEnd$qqrr16Zlib@TZStreamRec @Zlib@inflate$qqrr16Zlib@TZStreamReci @Zlib@inflateInit_$qqrr16Zlib@TZStreamRecpbi @Zlib@deflateEnd$qqrr16Zlib@TZStreamRec @Zlib@deflate$qqrr16Zlib@TZStreamReci @Zlib@deflateInit_$qqrr16Zlib@TZStreamRecipbi @Flatsb@initialization$qqrv @Flatsb@Finalization$qqrv @Dateutils@EncodeDateTime$qqrxusxusxusxusxusxusxus @Dateutils@IncMinute$qqrx16System@TDateTimexj @Dateutils@DaysBetween$qqrx16System@TDateTimet1 @Dateutils@SecondOf$qqrx16System@TDateTime @Dateutils@MinuteOf$qqrx16System@TDateTime @Dateutils@HourOf$qqrx16System@TDateTime @Dateutils@DayOf$qqrx16System@TDateTime @Dateutils@MonthOf$qqrx16System@TDateTime @Dateutils@YearOf$qqrx16System@TDateTime @Dateutils@DaysInAMonth$qqrxusxus @Comobj@initialization$qqrv @Comobj@Finalization$qqrv @Comobj@CreateOleObject$qqrx20System@UnicodeString @Comobj@CreateComObject$qqrrx5_GUID @Comobj@GUIDToString$qqrrx5_GUID @Comobj@StringToGUID$qqrx20System@UnicodeString @Comobj@OleCheck$qqrl @Comobj@HandleSafeCallException$qqrp14System@TObjectpvrx5_GUIDx17System@WideStringt4 @Comobj@CoInitializeEx @Comobj@EOleException@ @$xp$17Msxml@IXMLDOMText @$xp$22Msxml@IXMLDOMAttribute @$xp$21Msxml@IXMLDOMDocument @$xp$25Msxml@IXMLDOMNamedNodeMap @$xp$21Msxml@IXMLDOMNodeList @$xp$17Msxml@IXMLDOMNode @$xp$27Msxml@IXMLDOMImplementation @Msxml@CLASS_DOMDocument @Ansistrings@initialization$qqrv @Ansistrings@Finalization$qqrv @Ansistrings@UpperCase$qqrx27System@%AnsiStringT$us$i0$%

kernel32

TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WritePrivateProfileStringW WriteFile WinExec UnmapViewOfFile TerminateProcess Sleep SetLastError SearchPathW RaiseException QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringW OpenProcess MulDiv MoveFileExW MoveFileW MapViewOfFile LocalFree LocalAlloc LoadLibraryW LeaveCriticalSection InitializeCriticalSection GetWindowsDirectoryW GetVersionExW GetTimeZoneInformation GetTickCount GetTempPathW GetTempFileNameW GetSystemInfo GetSystemDirectoryW GetShortPathNameW GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetLocalTime GetLastError GetFileSize GetCurrentThreadId GetCurrentProcess GetComputerNameW InterlockedIncrement InterlockedExchange InterlockedDecrement FreeLibrary EnterCriticalSection DeleteFileW DeleteCriticalSection CreateProcessW CreateFileMappingW CreateFileW CopyFileW CompareStringW CloseHandle Sleep

madexcept_.bpl

@Madexcept@initialization$qqrv @Madexcept@Finalization$qqrv @Madexcept@RegisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase @Madmapfile@initialization$qqrv @Madmapfile@Finalization$qqrv @Madstacktrace@initialization$qqrv @Madstacktrace@Finalization$qqrv @Madlinkdisasm@initialization$qqrv @Madlinkdisasm@Finalization$qqrv @Madlisthardware@initialization$qqrv @Madlisthardware@Finalization$qqrv @Madlistprocesses@initialization$qqrv @Madlistprocesses@Finalization$qqrv @Madlistmodules@initialization$qqrv @Madlistmodules@Finalization$qqrv

user32

PostMessageW LoadStringW FindWindowW

gdi32

StretchDIBits StretchBlt SetStretchBltMode SetBkColor SelectPalette SelectObject ResizePalette RealizePalette GetPaletteEntries GetObjectW GetNearestPaletteIndex GetDIBits DeleteObject DeleteDC CreatePalette CreateHalftonePalette CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBitmap BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

advapi32

GetUserNameW UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceLockStatusW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW

madbasic_.bpl

@Madstrings@initialization$qqrv @Madstrings@Finalization$qqrv @Madtools@initialization$qqrv @Madtools@Finalization$qqrv

maddisasm_.bpl

@Maddisasm@initialization$qqrv @Maddisasm@Finalization$qqrv

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeSecurity CoUninitialize CoInitialize

vcl120.bpl

@Forms@initialization$qqrv @Forms@Finalization$qqrv @Forms@TApplication@SetMainFormOnTaskBar$qqrxo @Forms@TApplication@GetExeName$qqrv @Forms@TApplication@Run$qqrv @Forms@TApplication@CreateForm$qqrp17System@TMetaClasspv @Forms@TApplication@Initialize$qqrv @Forms@TCustomForm@QueryInterface$qqsrx5_GUIDpv @Forms@TCustomForm@RequestAlign$qqrv @Forms@TCustomForm@UpdateActions$qqrv @Forms@TCustomForm@ShowModal$qqrv @Forms@TCustomForm@SetFocus$qqrv @Forms@TCustomForm@CloseQuery$qqrv @Forms@TCustomForm@Resizing$qqr18Forms@TWindowState @Forms@TCustomForm@PaintWindow$qqrp5HDC__ @Forms@TCustomForm@SetFocusedControl$qqrp20Controls@TWinControl @Forms@TCustomForm@DefaultHandler$qqrpv @Forms@TCustomForm@DestroyWindowHandle$qqrv @Forms@TCustomForm@DestroyHandle$qqrv @Forms@TCustomForm@CreateWindowHandle$qqrrx22Controls@TCreateParams @Forms@TCustomForm@CreateWnd$qqrv @Forms@TCustomForm@CreateParams$qqrr22Controls@TCreateParams @Forms@TCustomForm@AlignControls$qqrp17Controls@TControlr11Types@TRect @Forms@TCustomForm@WndProc$qqrr17Messages@TMessage @Forms@TCustomForm@ValidateRename$qqrp18Classes@TComponentx20System@UnicodeStringt2 @Forms@TCustomForm@SetParent$qqrp20Controls@TWinControl @Forms@TCustomForm@WantChildKey$qqrp17Controls@TControlr17Messages@TMessage @Forms@TCustomForm@SetParentBiDiMode$qqro @Forms@TCustomForm@GetFloating$qqrv @Forms@TCustomForm@GetClientRect$qqrv @Forms@TCustomForm@DefineProperties$qqrp14Classes@TFiler @Forms@TCustomForm@ReadState$qqrp15Classes@TReader @Forms@TCustomForm@Notification$qqrp18Classes@TComponent18Classes@TOperation @Forms@TCustomForm@Loaded$qqrv @Forms@TCustomForm@DoDestroy$qqrv @Forms@TCustomForm@DoCreate$qqrv @Forms@TCustomForm@$bdtr$qqrv @Forms@TCustomForm@BeforeDestruction$qqrv @Forms@TCustomForm@$bctr$qqrp18Classes@TComponenti @Forms@TCustomForm@AfterConstruction$qqrv @Forms@TCustomForm@$bctr$qqrp18Classes@TComponent @Forms@TScrollingWinControl@AdjustClientRect$qqrr11Types@TRect @Forms@TScrollingWinControl@AutoScrollInView$qqrp17Controls@TControl @Forms@TScrollingWinControl@AutoScrollEnabled$qqrv @Forms@Application @$xp$11Forms@TForm @Forms@TForm@ @Actnlist@initialization$qqrv @Actnlist@Finalization$qqrv @Graphics@initialization$qqrv @Graphics@Finalization$qqrv @Graphics@TBitmap@SetTransparentColor$qqr15Graphics@TColor @Graphics@TBitmap@SetPixelFormat$qqr21Graphics@TPixelFormat @Graphics@TBitmap@GetTransparentColor$qqrv @Graphics@TBitmap@SetAlphaFormat$qqr21Graphics@TAlphaFormat @Graphics@TBitmap@GetCanvas$qqrv @Graphics@TBitmap@$bctr$qqrv @Graphics@CopyPalette$qqrp10HPALETTE__ @Graphics@TPicture@UnregisterGraphicClass$qqrp17System@TMetaClass @Graphics@TPicture@RegisterFileFormat$qqrx20System@UnicodeStringt1p17System@TMetaClass @Graphics@TGraphic@WriteData$qqrp15Classes@TStream @Graphics@TGraphic@SetTransparent$qqro @Graphics@TGraphic@SetSize$qqrii @Graphics@TGraphic@SaveToFile$qqrx20System@UnicodeString @Graphics@TGraphic@ReadData$qqrp15Classes@TStream @Graphics@TGraphic@LoadFromFile$qqrx20System@UnicodeString @Graphics@TGraphic@Equals$qqrp14System@TObject @Graphics@TGraphic@Equals$qqrp17Graphics@TGraphic @Graphics@TGraphic@DrawTransparent$qqrp16Graphics@TCanvasrx11Types@TRectuc @Graphics@TGraphic@DefineProperties$qqrp14Classes@TFiler @Graphics@TGraphic@Changed$qqrp14System@TObject @Graphics@TGraphic@$bctr$qqrv @Graphics@TCanvas@SetHandle$qqrp5HDC__ @Graphics@TCanvas@GetHandle$qqrv @Graphics@TCanvas@FillRect$qqrrx11Types@TRect @Graphics@TCanvas@Draw$qqriip17Graphics@TGraphic @Graphics@TCanvas@$bctr$qqrv @Graphics@TBrush@SetColor$qqr15Graphics@TColor @Graphics@ColorToRGB$qqr15Graphics@TColor @Graphics@TBitmap@ @Graphics@TPicture@ @$xp$17Graphics@TGraphic @Graphics@TGraphic@ @Graphics@TCanvas@ @Themes@initialization$qqrv @Themes@Finalization$qqrv @Controls@initialization$qqrv @Controls@Finalization$qqrv @Controls@TWinControl@UpdateControlOriginalParentSize$qqrp17Controls@TControlr12Types@TPoint @Controls@TWinControl@DockReplaceDockClient$qqrp17Controls@TControlp20Controls@TWinControlt115Controls@TAlignt1 @Controls@TWinControl@SetParentBackground$qqro @Controls@TWinControl@CanAutoSize$qqrrit1 @Controls@TWinControl@AssignTo$qqrp19Classes@TPersistent @Controls@TWinControl@ConstrainedResize$qqrrit1t1t1 @Controls@TWinControl@CanResize$qqrrit1 @Controls@TWinControl@GetClientOrigin$qqrv @Controls@TWinControl@GetControlExtents$qqrv @Controls@TWinControl@Repaint$qqrv @Controls@TWinControl@Update$qqrv @Controls@TWinControl@Invalidate$qqrv @Controls@TWinControl@GetDeviceContext$qqrrp6HWND__ @Controls@TWinControl@ShowControl$qqrp17Controls@TControl @Controls@TWinControl@SetBounds$qqriiii @Controls@TWinControl@SetParentDoubleBuffered$qqro @Controls@TWinControl@CustomAlignPosition$qqrp17Controls@TControlrit2t2t2r11Types@TRectrx19Controls@TAlignInfo @Controls@TWinControl@CustomAlignInsertBefore$qqrp17Controls@TControlt1 @Controls@TWinControl@CreateHandle$qqrv @Controls@TWinControl@DestroyWnd$qqrv @Controls@TControl@InitiateAction$qqrv @Controls@TControl@GetFloatingDockSiteClass$qqrv @Controls@TControl@SetBiDiMode$qqr17Classes@TBiDiMode @Controls@TControl@SetEnabled$qqro @Controls@TControl@SetName$qqrx20System@UnicodeString @Controls@TControl@SetAutoSize$qqro @Controls@TControl@SetDragMode$qqr18Controls@TDragMode @Controls@TControl@GetAction$qqrv @Controls@TControl@GetEnabled$qqrv @Controls@TControl@GetDragImages$qqrv @Menus@initialization$qqrv @Menus@Finalization$qqrv @Dialogs@initialization$qqrv @Dialogs@Finalization$qqrv @Comctrls@initialization$qqrv @Comctrls@Finalization$qqrv @Graphutil@initialization$qqrv @Graphutil@Finalization$qqrv @Extctrls@initialization$qqrv @Extctrls@Finalization$qqrv @Printers@initialization$qqrv @Printers@Finalization$qqrv @Clipbrd@initialization$qqrv @Clipbrd@Finalization$qqrv @Oleserver@initialization$qqrv @Oleserver@Finalization$qqrv @Olectrls@initialization$qqrv @Olectrls@Finalization$qqrv @Axctrls@initialization$qqrv @Axctrls@Finalization$qqrv

hardwarelib

HTLIB_UninstallServices

Name

.text

Size

599KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_69506f4404132f2673759ce887a36bb4_cobalt-strike_conti_darkgate_elex_glassworm

rtl120.bpl

kernel32

madexcept_.bpl

user32

gdi32

version

advapi32

madbasic_.bpl

maddisasm_.bpl

shell32

ole32

vcl120.bpl

hardwarelib

generic