handler8.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 33/53 Related 2060
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 1198.00 KB (1226752 bytes)
Compile time: 2016-07-01 21:38:57
MD5: 312812b53d45bf543cc12a0c7576a022
SHA1: 083d3daf48e94ed4a4e14c3fced04d9cdfe430cd
SHA256: 44996598c59fe3b9ff3b5cbe4a6777cc02785a60c52f203c7d3e063f77eb259d
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2016-07-05 15:33:06
Last submission: 2016-07-05 15:33:06
Filename detected: - handler8.exe (1)
URL file hosting
hXXp://lindethlive.com/logs/handler8.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-07-05 07:42:12 [33/53] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x12acf4 1224192 5cbc96e2ccfb7bd4e377cc1acc3c639c 6368fe8cd2eea8cd16decda12382d3e4d69b5eef
.rsrc 0x12e000 0x600 1536 01616c4f47b824ad64a85da311e2ddd0 c5a8b1f4ac6cb45f98937c660b708585661abf83
.reloc 0x130000 0xc 512 6e2ede685e3fdc6d04dd969f4390e73b 85790eba72e4f78df0c642fc891a217cc93f18d4
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x12e0a0 716 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x12e36c 427 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 1.0.0.0
InternalName: Orcus.exe
FileVersion: 1.0.0.0
CompanyName:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription:
Translation: 0x0000 0x04b0
OriginalFilename: Orcus.exe
XOR
8 131566
1 131566
2 131566
4 131566
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Binary
http://speedtest.netcologne.de/test_100mb.bin
http://speedtest.reliableservers.com/100MBtest.bin
FIle type: Compressed
costura.microsoft.win32.taskscheduler.dll.zip
costura.orcus.plugins.dll.zip
costura.cscore.dll.zip
costura.aforge.video.directshow.dll.zip
costura.orcus.shared.utilities.dll.zip
costura.orcus.shared.dll.zip
costura.starksoft.aspen.dll.zip
costura.aforge.video.dll.zip
FIle type: Data
Microsoft\Speech\Files\err_{0}.dat
Microsoft\Speech\Files\klg_{0}.dat
FIle type: XML
.purple\accounts.xml
FileZilla\recentservers.xml
System.Xml
FIle type: Database
key3.db
FIle type: Library
nss3.dll
System.Core.dll
System.Windows.Forms.dll
System.Xml.Linq.dll
msvcp100.dll
msvcr100.dll
mozglue.dll
msvcr120.dll
System.dll
System.Xml.dll
msvcp120.dll
SHLWAPI.dll
USER32.dll
MSVCRT.dll
mscoree.dll
ADVAPI32.dll
KERNEL32.dll
IPHLPAPI.DLL
GDI32.dll
a.DLL
SHELL32.dll
IP Found
127.0.0.1
URL(s)
http://mirror.internode.on.net/pub/test/100meg.test
https://api.ipify.org/
http://speedtest.reliableservers.com/100MBtest.bin
http://speedtest.netcologne.de/test_100mb.bin
http://www.speedtestx.de/testfiles/data_100mb.test
String too long
3ZPiKmMjz0zleat98Ix3hteZq3jeg9Wyjyr7LPgMkx01uIcSIjhzOpx4MRrjnHD5yCLIoRqQ/IROuS4KEM13Y5cAlPEBLXpgjcqMsEUtoetsjLFGMsMEKTlF2JfgLwnK9wD0MJBl65gD0FjZ1O4FYvNmMJ7HQMjPIBAeblH3VhCl04Su6yn1XEvR1wyZnRE/bi8cNOrGqUr7kxAdCTADTssXlEHqN3Ire44midwEURY=
y9t8/nREFuupF37BI7/S3rGAs1faYE+mq8YiDQLE+G/a7vHvcyLRt3OeDX757kOx4hZUXjcKN912qzi7f7gBTWb7gMwlaD9midY8PyO1tw/l1/TVdJbUWDDVS4KEtdfxe1w0NZpvLH2VpUcINwE7q7PVA4bSrrSLJcrWqauENNjxAJogkeetU6KxFZdj/G8bb778HDSq08A3sXSEsjG4bg==
<?xml version="1.0" encoding="utf-8"?><assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
Error loading and creating {0} of plugin {1}
OBJECTIDENTIFIER
Revision
InternalName
Software\Microsoft\Windows\CurrentVersion\Policies\System
Shell_TrayWnd
keep-alive
WorkerW
SELECT Caption FROM Win32_OperatingSystem
Host
Unknown
{0:X2}
Yandex\YandexBrowser\User Data\Default\Cookies
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381
5gg/vmthZ7+kQDltRCnHtBTrxUFb1mwWlFQde3FpZcM=
Bytes Sent/sec
Windows 8
Windows 7
Shutdown plugin"
LegalCopyright
CoreFtp/sites.idx
nss3.dll
Kill
GHz (
r Windows-basierte Programme. Wenn dieser Dienst beendet wird, funktionieren Eingabeger
cookies
System.Core.dll
A+s
-)E
PK11SDR_Decrypt
Version
<supportedRuntime version="v4.0.30319" sku=".NETFramework,Version=v4.0,Profile=Client" />
MIPS
System.Windows.Forms.dll
port
^[0-9](\.[0-9]{1,3})?
Math Processor
explorer.exe
1.0.0.0
version
rundll32.exe
Orcus.CodeExecution
/test
/wait
AdminPasswordStatus
0.1.0.22738
3ZPiKmMjz0zleat98Ix3hteZq3jeg9Wyjyr7LPgMkx01uIcSIjhzOpx4MRrjnHD5yCLIoRqQ/IROuS4KEM13Y5cAlPEBLXpgjcqMsEUtoetsjLFGMsMEKTlF2JfgLwnK9wD0MJBl65gD0FjZ1O4FYvNmMJ7HQMjPIBAeblH3VhCl04Su6yn1XEvR1wyZnRE/bi8cNOrGqUr7kxAdCTADTssXlEHqN3Ire44midwEURY=
Status:
path
/l /t 0
v3.5
Firefox does not have any profiles, has it ever been launched?
ExtClock
action
OrcusUtilities
bad ret
Architecture
expires_utc
secure
Yandex\YandexBrowser\User Data\Default\Login Data
Pidgin
Google Chrome
SEQUENCE {
Internet Explorer
SVGA
Security
SELECT * FROM AntivirusProduct
Windows CE
<supportedRuntime version="v2.0.50727" />
MDA
https
[Idle]
Keyboard Hook Dispose
SOFTWARE\Mozilla\Mozilla Firefox
FM]
UninstallString
Opera
N/A
cookies.sqlite
y9t8/nREFuupF37BI7/S3rGAs1faYE+mq8YiDQLE+G/a7vHvcyLRt3OeDX757kOx4hZUXjcKN912qzi7f7gBTWb7gMwlaD9midY8PyO1tw/l1/TVdJbUWDDVS4KEtdfxe1w0NZpvLH2VpUcINwE7q7PVA4bSrrSLJcrWqauENNjxAJogkeetU6KxFZdj/G8bb778HDSq08A3sXSEsjG4bg==
orcus.shared.utilities
JDownloader 2.0
*.nfo
logins.json
{0} x {1}
No Firefox profiles could be found
costura.microsoft.win32.taskscheduler.dll.zip
ListOfLanguages
wallpaper.bmp
WRAM
StreamCodec can not be null.
Microsoft\Speech\Files\plg_{0}
System.Xml.Linq.dll
-Hv
keyName
costura.orcus.plugins.dll.zip
MemoryDevices
0.1.0
ConnectedLabel
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>
_Total
HostName
costura.cscore.dll.zip
Pipelined Burst SRAM
parameter
host_key
oipiy
FileVersion
Windows 3.1
--install
ProductVersion
DigitalProductId
Model
HGC
OriginalFilename
No Firefox logins.json was found
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Win32 Windows
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
origin_url
NSSBase64_DecodeBuffer
Mozilla Thunderbird
Orcus.Properties.Resources
Firefox does not have any cookie file
password_value
NSS_Init
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
@=<VY]BUQM{sp&hH%xbLJcUd/2sWgR+YA&-_Z>/$skSXZR!:(yZ5!>t>ZxaPTrS[Z/'R,ssg'.&4yZN?S)My+:QV2(c&x/TU]Yq2?g?*w7*r@pmh
[{0} Me]: {1}
CurrentBuild
Load plugin: "
EGA
MaxCacheSize
style
drivers\etc\hosts
Unknow database format
FromHandle
MHz)
runas
SELECT * FROM Win32_PhysicalMemoryArray
moz_cookies
TCPVIEW
Whistler Server
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381/OrcusUtilities
nnen die Dienste, die von diesem Dienst explizit abh
Central Processor
The platform or operating system must be Windows 2000 or later.
name
SELECT * FROM Win32_PhysicalMemory
Parallels Video Adapter
MainForm
^(?<guid>([0-9A-Fa-f]{32}))_(?<version>(\d+(?:\.\d+)+))$
Mozilla Firefox install folder cannot be found.
A/}
A/{
Not connected
hoster
The binary key cannot have an odd number of digits: {0}
HARDWARE\DESCRIPTION\System\CentralProcessor\0
orcus.shared
{0}||{1}
bad ret on check
SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
msvcp100.dll
Workgroup
\e3c6cefd462d48f0b30a5ebcd238b5b1
1.85 (Hash, version 2, native byte-order)
http://speedtest.netcologne.de/test_100mb.bin
/SMV7RYPoqRdeZRq4FdU5g==
PortNumber
root\CIMV2
Windows 10
Copyright
3DRAM
Linear Frame Buffer
PC-98
collection
Install string was null or empty
msvcr100.dll
isSecure
WinInput.exe
http://speedtest.reliableservers.com/100MBtest.bin
CurrentMajorVersionNumber
Microsoft\Speech\Files\psh_{0}
PrimaryOwnerName
/wait /upgrade "{0}"
VendorIdentifier
Start
Occurred while executing command "{0}" (Command ID: {1})
DisplayVersion
WinSCP
ProcessorType
VideoProcessor
3$;'<(=+>,?/@0N6P8]:j@oBpCuGvJxKyM{T
CurrentClockSpeed
WIRESHARK
\.(?<extension>([a-zA-Z]{3,4}))$
te f
case FromAdministrationPackage.GetScreen
VS_VERSION_INFO
VMware SVGA
<Pass encoding="base64">
Enabled
CDRAM
D:\Dokumente\HfLogo.png
Couldn't determine file name
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
ping 127.0.0.1 > nul
Orcus Client
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>.*?<Pass encoding="base64">(?<password>(.*?))</Pass>
root\SecurityCenter2
Select * FROM WIN32_Processor
.purple\accounts.xml
DisplayIcon
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Connected to {0}:{1}
Other
<supportedRuntime version="v4.0" />
KiB
CoreFTP
Main
encryptedPassword
No admin rights and service isn't running
Could not read cookie table
Software\Microsoft\Windows\CurrentVersion\Run
{0}{1}{0}{2}
Automatic Key Log
Verwaltet Eingabeger
eab
Name
Button
img\
VirtualBox Graphics Adapter
Caption
Processor
userName
exe
displayName
CurrentMinorVersionNumber
ARM
InstallLocation
PK11_GetInternalKeySlot
Microsoft 2016
DeviceID
Comments
MaxClockSpeed
{0}.{1}
registryHive
MainRichTextBox
00:00:00:00:00:00
PublicKeyFile
{0}x{1}
Mozilla\Firefox\Profiles
mozglue.dll
.nfo
encryptedUsername
Translation
00061561
Assembly Version
$1:$2:$3:$4:$5:$6
</configuration>
Level
label1
label2
label3
OCTETSTRING
Safe mode without network support
bat
% Processor Time
[{0} {1}]: {2}
ydxN6Yj0lVaMYN89YlT3KrIkUJHl2bs/Kb+kLwlywoYGfRJY1JVGKyFaqFIX9kHc
SHELLDLL_DefView
Disabled
.ico
SELECT * FROM Win32_VideoController
ZnqfVtgJLX255UVs9SM3pw==
Send
#32768
</startup>
echo j | del {1}
Longhorn
msvcr120.dll
{0}_{1}
Segoe UI
Not a valid SQLite 3 Database File
WallpaperStyle
aforge.video
{{Left={0},Top={1},Right={2},Bottom={3}}}
(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})
Orcus.Service.Properties.Resources
Opera Software\Opera Stable\Login Data
<configuration>
A-w
JDownloader v2.0\cfg\org.jdownloader.settings.AccountSettings.accounts.ejs
ngig sind, nicht mehr gestartet werden.
UnhandledException
costura.aforge.video.directshow.dll.zip
logins
costura.orcus.shared.utilities.dll.zip
Safe mode with network support
notepad.exe
VGA
SGRAM
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\
Uninstall
csrss
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites\{0}
SystemType
LegalTrademarks
MHz
ClientActionCommand.UpdateFromUrl: 10/10 tries unsuccessfully
Bytes Received/sec
login
Firefox Application Data folder does not exist!
"{0}"
UserName
Google\Chrome\User Data\Default\Cookies
RUNASADMIN
username_value
table
Windows Input
guid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
A)`
-Jz
/forceInstall
A)_
--uninstall
costura.orcus.shared.dll.zip
VideoModeDescription
@ECHO OFF
SOFTWARE\Microsoft\Windows NT\CurrentVersion
echo j | del "{0}"
DisableTaskMgr
Orcus.Service.exe
MDIClient
ProgramFiles(x86)
FolderView
content-disposition
[Build
aforge.video.directshow
en-US
SELECT * FROM Win32_ComputerSystem
CurrentVersion
Whistler
ABCDEF
NETMON
Video Processor
<?xml version="1.0" encoding="utf-8"?>
value
EstimatedSize
Burst Synchronous DRAM
costura.starksoft.aspen.dll.zip
Windows-Eingabe
VM Additions S3 Trio32/64
filename=
CiceroUIWndFrame
starksoft.aspen
\Mozilla\Firefox\Profiles
shutdown.exe
. Wenn dieser Dienst deaktiviert wird, k
signons.sqlite
VRAM
http://mirror.internode.on.net/pub/test/100meg.test
orcus.plugins
FileZilla\recentservers.xml
Software\Microsoft\Windows NT\CurrentVersion
N@ncyl
hostname
x64
VUlZmz8xPkKb9m/FqrQOtw==
hdfzpysvpzimorhk
status
SDRAM
Firefox is not installed, or the install path could not be located
http
x86
Win32_CacheMemory
NumberOfCores
DSP Processor
"(?<hoster>(.+?))" : \[\ \{.+?"password" : "(?<password>(.*?))".*?"user" : "(?<userName>(.*?))".*?"statusString" : "(?<status>(.*?))"
000004b0
The graphics mode is not supported (BADMOVE)
KillButton
FileDescription
encrypted_value
Description
NumberOfLogicalProcessors
WinInp.exe
Requested Key Log
eaVZ3qyF3tFRjpKzecEyqzdmMYo4gTX06IYxVWAOy24Ncv8TWMc2OAgE549AOcRb
BCDFGHJKMPQRTVWXY2346789
Threshold
Manages input devices for Windows-based programs. If this service is stopped, input devices will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Port
Auto-vacuum capable database is not supported
L3CacheSize
L2CacheSize
cmd.exe
ThreadException
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
SysListView32
SELECT * FROM FirewallProduct
VideoMemoryType
Activating keylogger
EDO RAM
ReleaseDate
password
MCGA
SOFTWARE\Microsoft\NET Framework Setup\NDP
moz_logins
Control Panel\Desktop
https://api.ipify.org/
Network Interface
Thunderbird\Profiles
Occurred while executing static command "{0}" (Command ID: {1})
Blackcomb, Vienna
Orcus.exe
Alpha
Release
UNIQUE
InfluenceStartup() at plugin: "
UBR
Itanium-based systems
No installs of firefox recorded in its key.
MessageTextBox
server
Yandex
CanStart() at plugin: "
Product Key
httponly
DisplayName
00000000
VarFileInfo
key3.db
System
LoaderExceptions:
Application
.jpg
CrackedByWardow
PowerPC
.zip
SELECT * FROM Win32_Processor
root\SecurityCenter
TileWallpaper
XBox
<Server>
Edit
SQLite format 3
case FromAdministrationPackage.GetActiveWindow
WindowsInput
The process does not exist
System.dll
Microsoft\Speech\Files\err_{0}.dat
[^\u0020-\u007F]
System.Xml.dll
expiry
ReleaseId
host
ConsoleWindowClass
te nicht ordnungsgem
http://www.speedtestx.de/testfiles/data_100mb.test
Not Implemented
Microsoft
S3 Trio32/64
VolumeSerialNumber
System restart required
extension
/r /t 0
ProductName
<startup>
MaxRefreshRate
[PRIVATE KEY LOCATION: "{0}"]
Win32_Processor
cscore
A$H
A-v
TotalPhysicalMemory
file:
DISPLAY
Microsoft\Speech\Files\klg_{0}.dat
VideoArchitecture
PK11_Authenticate
Normal
CGA
.config
msvcp120.dll
CompilerVersion
User
00000002
Manufacturer
Orcus_Service
Install Directory
Longhorn Server
~MHz
DRAM
true
WindowsInput.exe
Load
\Mozilla Firefox\
CompanyName
rXY
UninstallButton
n must be 0 or greater
microsoft.win32.taskscheduler
Copyright Orcus Technologies
Vista
SysShadow
Microsoft.Win32.SafeHandles.SafeRegistryHandle
SRAM
SerialNumber
SendButton
/s /t 0
INTEGER
8514A
XGA
global-salt
ProcessorId
SELECT * FROM Win32_BIOS
ProxyEnable
StringFileInfo
Password
Google\Chrome\User Data\Default\Login Data
password-check
Mystic, Orient
Windows
IFactoryClientCommand
FileZilla
+*-,0/21547686A@CBSRTRURVRWRXRYRgfqprptszy~}
URL.DLL,FileProtocolHandler "{0}"
2008
$this.Icon
Mozilla Firefox
costura.aforge.video.dll.zip
Input.exe
Speed
CurrentLanguage
ProxyServer
win32_logicaldisk.deviceid="
-{0}
Opera Software\Opera Stable\Cookies
Berkelet DB
mE:r
o&[I
j?E
q%:D
lw{w
^~z
f11b
*;_{
256A
2%ba
J|\Xr
{42]vD
WHITENESS
e[9=/
.rx)
RegistryCommunication
J-oV
Wc}uo
c$8B
<NewCommandType>k__BackingField
6j)g')`U
bKl#
mn'8
L .o
Uw,s
', Q
set_Type
v_Q)e
get_Speed
4!>Bx
(7[_
Fi-*
3;z)u)q/ !gd
S;Bt
I3s[

"]l?=
AFN)
lcv_
C@ p
h9w y2
KEYEVENTF_KEYDOWN
|VdI
ToggleDesktopIcons
s.?h
get_DataMode
RemoteCertificateValidationCallback
~HB)
})8" T
subKey
n#]
+2M/
MWYj2
p >%
FOrcus.Commands.Passwords.Applications.WinSCP.WinSCP+<GetPasswords>d__0
@SS813
g7BU
mcT#E6+
sff6
set_Scheme
o0o*
set_Capacity
DxK8[
ArrayList
5`}h
HSHELL_WINDOWDESTROYED
U_ce
SwapExtents
q \?
get_Left
1A('
XZj:
get_Factory
i`60
Xuce
qfgN1
set_EntryLocation
)B]'
G L3 =
V?5sR
OnShown
a^HWbX
-`zk
8vD
(3}?P
parentHandle
UxCrL
set_MaxClockSpeed
Bvb=
y(LW
regKey
iPeu
CryptoStream
SIZING
\\9E
[,|*A
t9m$
>T}M
Zb?<O
$9 +
SendResult
lM&
GetWindowAtPosition
NoD[
_desktop
V^k}
get_MainWindowHandle
mF)=
LastVisited
I.7[&
<fqw(
K$ZZGs
LSOQ
GsEs
g(-+Y
p*rOC
iVLE3
RestoreAllScreens
get_NewWindows
Z9%*k
/T)r
MZaK}
+2 o
,# o
_meColor
'VLi
a|cddL
U6Sn
(;}
*/]0
set_PriorityClass
x~Fq
$VzT:;
add_SendResult
u,OIc
m_7
|5V w
Vwd0
U]ptL
set_AntiVirusPrograms
*: '
l3kd
Ru[*_
^i_{1
:Wyq
sU=P
0 $m
uninstallableProgram
@ 4J
.ZL}7
SuppressFinalize
V2I`h
Sa;p
TaskPrincipal
RemotePort
`?[b
BI%Yp
$L&a
u()BO
$ZHxHt
Nullable`1
Tiled
GetFirefoxInstallPath
:`2-cXR>l
hStdInput
Ri,g
! 9@!9@!9
HOrcus.Commands.Passwords.Applications.CoreFTP.CoreFtp+<GetPasswords>d__1
get_SendProcesses
KDg'*
WK N
UNDO
# j+T
OxPS
$)ks
RegistryValueString
.Ul
SC_ARRANGE
!~;"
}J &U
s9!`
jv\n
y&9Y0
` ))
%\qQ
4!0 4
R'jPMx3
\@]U
DRs"myP
DRAWITEM
e@Ly
4;D>sg
A;C{
3hHz{
<'d3
Nfo&
ZbS#Fg3
ReleaseComObject
P2GO
&+D
01KM
M:=MM
?OH"z4S
#$]D
7\dAHZ*
#E,Y}
HD`mNq
2cE,|
formSubmitURL
set_RemoteAddress
(i
8@|Oi
Mvo7
get_Language
fLH0\
]|9Je=
T ot
chatSettings
ConnectionState
fLbK}
p2]N
ToolTipIcon
x?lF
Enumerable
=PaE
q|]J
ONr*
~;4r@
ManagementObjectCollection
ResolveEventHandler
&+
MatchCollection
cK7}
z!H Ab~
set_RedirectStandardError
>.wCn
,6D"
BootMode
ut(f
row_id
T9cQ$
T(AV
ti7]
ThreadExceptionEventArgs
System.Security.Cryptography
B5%T
8(X*
t^uv
" ki
<GetHardwareInformation>b__5
."/1
pXN.
MaxLogSize
nt Q
yZ3Nv
Speak
A 4
6Q^o
e{zfL
\2l^
OpenSubKey
WriteAppConfig
% }X
WH_SHELL
;c!XU
>
get_UpdatedWindows
_keyProcessing_StringUp
xEv[
U(C,p
A( r
\ r
((sY
NCMBUTTONUP
,i*EZ
QFFV
C.B;
FNQbNr
Mt FG
3kl<S
^f<~
fz(r
v"Em
xM2^7
^#2e
sQY&s}
+"M)
;~4C/
"E7j
SecretId1
/~|/=
'j<^
set_Text
\= k
SecretId2
newCreationTime
i7F_)
X g
<SetMemoryInformation>b__1_1
p CZ
?% 1#
<SetMemoryInformation>b__1_0
get_ElapsedMilliseconds
d5[%
u.od
get_FileTransferTempDirectory
K-OoU"
jal.j
<s
@/$c
P\r\
MT;'Y
`bN]j
Copy
M5so
oJS1
W{Ql
#Z4(
=Lk7C
%o&D
CJ8$
>pVh
+t\ z
SHGFI_SMALLICON
Im/0
add_FileTransferAccepted
windowinfo
pE W
7fU,
s`W
get_Loadables
R|`%
System.Speech.Synthesis
arySrc
9^&Hd
/&hvo
=i ~E?~(
9xJh]<
h}:I
szTypeName
<>8__1
C=Ha
)%V:
| UL6
\lmvp
!Vt$
DeviceState
Guid
Y$FT
~v%o
Cf$r
RTfeA
ErrorReporter
pp7]c
{wtk
[lRQFw
'-AC|
Yo:
!FUcQ
IQH2
size
vz?wO
U e2K{
vf*+
-i/aP
LT=-F
DzK=
<>c__DisplayClass3_0
QK?/|
set_AddressFamily
p`8H9t
5 k^
gDZjl)bVM
IUrlHistoryStg
DI?}~>
>@zl
BnYP\`]
ConnectionId
/b,9
F6;V4k|
%L_E
1iq0
p6 5i
l}:[
_ Gko
K.Dl\`
GHg{
Char
&[Ni
DM_PELSWIDTH
\ 3:
!0 R
eo&q4
_g
}]$)
=#1^
HTNOWHERE
dwNewLong
RemoteDesktopCommand
.d<d
(i
aXc7
z|"1
s&
&P7f6
HK'/T
GetValue
B5@^
<ValueObject>k__BackingField
4= h
StopDDoSCommand
%n
P6)/+/)
OnConnect
^[rS@
assemblyNames
HashAlgorithm
5y;[a
aX`q
Xeu7W
n{?h
1C\i
q{Yo
][:Lja
a)MO
keyf
i7,
1*2Q2x2
5,Ey.'M m9
MOUSEHWHEEL
1)5
Yiu#
MRob
_AC6
DELETEITEM
set_ClosedProcesses
FZ; (
Xkt%
GetBiosInformation
=*z98
HSHELL_APPCOMMAND
QBZU
IzgO=t0b+
^w!D |
4~n)F
^{LTJT
3kl8
%zm'
get_LCID
(1
5A [
fG!`
YlZo`
co:Hw
BN^Iq
L|mL
7RPWu
8A6OZ
MMDeviceEnumerator
+|+}
EVj\W
'~2tad
zqJlV
pR},f
yBMS
\ r]
I=+6
RWp)O
VCode
deviceId
~3E
=k"c
w&u6
m$x?ps
Nmj/y
6G9
P2Y\
9bc<
_/ Zk
WN2\
xC#5
GetShellWindow
cO6OP
.text
&R(
iE>,E
JO'Z
sCBC
?%OW
V/5t
ye|a
~ LW
UYfR
ServiceInstaller
Disconnected
]-_#
| y\
XmlReader
GetObject
Mwv)Zv
?0N2h+
*s-?G\
T{'h
f4\
=u.@
FB1[Jf$
c6<X
Uv3JR
>Ot6
wqUSx
object
%@xW
9T=
~<di
InstallHelper
>C<P
v )[
ZC c
0'(2Hqm
dw1*O}
g@o[
Ro^g
VJ+;>
Orcus.Commands.TextChat.TextChatForm.resources
kBY!3d
z#W>
$v:]-
hX=~
[SnH;
.6r9
. ,N
add_ResponseBytes
Client
xf+2
<IsWorking>k__BackingField
.,YIe
EndConnect
Z>Fm"
=]\c
cV?K
fuWinIni
filetime
x}!)q
xiqm%
oy{uF
&p[G
set_ForceInstallerAdministratorRights
y2vjE
m4X^
d"XH
kh N
Resources
3]<ln
CipherMode
,R r'
<GetBiosInformation>b__3
7u-q_
B7&}
y V%tP
G @{
1iRY
rt :
"kQp>u
of[$
wJ{V
AeBg
NORMAL_PRIORITY_CLASS
g>K
+>z;7
|;'#
s9?c
W#e}
?}}
&Znx
( P' -<
\{1:Iz>
=)X {
)i3H
Id
&k/FD
#G'FnF
XmlElement
VistaOrHigher
?kj,
NSSBase64_DecodeBuffer
38iI
,mGe
bg:9
qH_u
PluginFactory
H+{N
get_SynSockets
UrlHistoryClass
u'l'
C=_|k
4.0.0.0
`!sJjX
AddRegistryKeyValue
IFormatProvider
q1.+
Ompm
,+f|
4^ Y
Y]m6
Uw.e
!O=*
parentHwnd
%n-b
{u4 f
#qw2
gEZV
o@[}
CryptoApi
l=_I
-9vc
wjzT
R*r,
\GeT
UseHashToken
pLG`
]h|Y
M~U.
)(W,
e#H#
SW_NORMAL
c*E
r@&
m{-0_|
XBUTTONDOWN
ew-]
ijX}
/ENH-k
<ProcessCommand>b__7_1
set_ClientConfig
^f|DP
>:=1
V]7~
set_IsBackground
% }
TernaryRasterOperations
k("+(
N%F@V
56+;W7
#Ece
-W2<}
remove_NewFrame
d#6q
|lxN
R#I=
c9C*B
vKTR;
w!'!
lpfn
$2w/vG
e3oX
iX$ k
U5vJ#
QU$7
set_IsDataAvailable
{Xz2
rlgi
,OJ ^
+)p5z
GetWindowInfo
bVTI
0>+X
|5{@X
HF98H
RENDERALLFORMATS
F"D<
{Pz
K 9j
@#ndz
DnA;
pI!q
T9P52
ANTIDEBUGGER
dwDesiredAccess
uiFx:
f=W>
$3C374A41-BAE4-11CF-BF7D-00AA006946EE
AudioCommand
J{Gj6$2
K@H_
r zRf
vYc7[
IsOnVirtualBox
8SS{e5
Pv%G
GetWindowRect
p[Kk
hStdError
WH3%
T3HkU ,Q
!9dI
o O(
ProcessThread
biWkC
7u K
GetProcAddress
HWND_BROADCAST
MP\n
:lwiSr
[26v~3
\_W/
DM: .
ServiceAccount
Eep>
$!<i?
s pU+Jw$
U aj
fIcon
fX^~
pOfi
qpz
rgiu
V!+Cj
sslPolicyErrors
set_AdministrationRightsRequired
>e-j.`
!F}#
| Vi
A}?f
Z3gZ
$fUQ:
H!PE
pZ}
ReadAllBytes
^Rl#k
h"v[
ySxU
141w
}YI1
HttpFlood
SbO!
@.v1
]:L'
Jvo@
Z-I6
ApmU
C Xw
PathContent
JM$B
E.a 4
6{\AZ
2 GK
" GC
lZYN
&(6;
on]O;
_deadKeyOver
X=,&
5X~[
yBm3
+] r
Z#PY^
Z9 \
get_IsWarning
remove_DataReceived
get_Assembly
X(6-
bBw '
hvncDesktop
,T:iwk~
System.Xml
}*`Cq>
n ip|
r=!RZD?4E
I_=/
get_Volume
p7on0L
hN"~rb
EnumWindowsProc
m$weF
uParam
UYCT
" z9
~:BD
\T;r
^"?f
NXz
R65
dFos+|b
$[yW,=
{&zFQs
o6x
x) },
Q]iN\*U&
lpszDriver
B*!>ee
PDK%
1c`1
-v|.
*T>LI
\Q*A
GenKey_SaveInContainer
xx:w
_isClosing
z@%>
.Un/
_windowPrintTypes
ADMINISTRATIONRIGHTSREQUIRED
ullTotalVirtual
"IU4
SecretEntry
get_AddressFamily
$- eJ
get_OSName
'eWwWt
qf ~3}
_Jyt
Rjw(
>Z*?W\
\:,Z
MOVE
9 Y
STATURL_QUERYFLAG_TOPLEVEL
%XvMt
3`Kt
FunActionsCommunication
kYBt
hbmColor
^:?@
#K"6O~
System.ServiceModel.Description
s{
HideWindow
/i':
RegistryKeyExtensions
jYl#
MO!)
= g=< N"
dmICMMethod
op_Explicit
f-z?-zG-zz
Drx/">(
qX''
]hck
YdH2
#q@;=,
+]5yv
FpO U
y]{,r
ru-
d[)f
\!9{V
0H}P
+V-?]
`>D^G
_k=H
}q{ -`
[LUom
URL_ESCAPE_PERCENT
(e=t
(J*J)
aF6'd0o
[Is/
'GinvI7
G=_Q
}@ ,
rRRx
NKr87
8)U.
% 9m
SYSKEYUP
WindowPrintTypes
CURSORINFO
FileTimeToDateTime
+ieg
2N+X
p d%
+oIt
6,eS
/~G#
aj4pbG
yE*9q
]+ev
Ro1)
Uk/8
O}J,
"lg(
c>LV
tableName
System
[U|_f
G,F $F
Application
L{WH
OJK}
|{S)
rXl 96
NetworkInformation
]?,'
p)i`
PasswordsCommand
Du\P|
ba;<V
$$O)
;l. 5y
aak{Z
NznX53
V;.S
get_VistaOrHigher
cypherText
rt9%X
dvGV
85mR
,x-u
#Ozg
_y^!U*
ProcessorInfo
y[ k
4RCjI
cT?Z
{->X
8\B't
XPD,
set_InstallService
<ExceptionFile>k__BackingField
BeginConnect
7k3_
SH\J"
ToByteArray
set_Version
!0?
DoNotActivate
RD2\L
exception1
b G3
nextId
MethodBase
First
.R{<z
Font
;7S3Qj
t} mk
/CWDN
wad4
({ 0
get_VersionString
Stretched
bG J
.i S
set_CarriageReturnAndLineFeedReplacement
8uV=
[0_4x
i7+V
WTSSESSION_CHANGE
?)jP0
+.ni
k s9 {}
Capture
4Y-
y#;#
_receivedBytes
9 !p ;
TryConnectDelegate
"G~+_
*.-K
?bl
? -
SecretId7
yU}p
`C &'
set_AutostartMethod
n oW
}fZY
b,_6
*Vs
<ExecuteCommand>b__0
7l{
NCPAINT
}iJZ
Vd~Rz
width
XnG(
mQo;
Yt=,
J}6#
ISIL
get_EthernetAdapterData
/p^XS
,^v-
hp-X
LT/O
&! {
HTBOTTOM
add_FileTransferCompleted
get_AvailablePlugins
zK>sdy
S-giy
CsvRecord
wB<B
STATURL
RSDSy4
~O{
D.l9
Orcus.Shared.Connection
aA
get_Position
/bCF
m.V"es|
sfr \
Mu +
CreateDC
f;]f
ChannelFactory`1
2}c/q
hxxP
?B!t%
;ZjUY^r/
'C'!}$t ig
St%
H,=l
PATINVERT
!R !
6 Lh?
"3'^
Cl^B
(tJX
rz&
~O&6
EYS"a+
,scbjt
X_Z#!
d $[I
CloseDesktop
dt9u
{] J
IsCtrlPressed
"4sm
u"=Iq
gN=88
<Name>k__BackingField
(=;3
b=zv
EANF
c`}k
get_PluginName
*,\l@
`1OS
hbmMask
IKm`
ky |
Registry64
'%L0
;"vh
; EGU
VV(<
X.E$
6|X
SAg"
EventWaitHandle
:ZMDw>L
get_UserDomainName
z" @_
D:\Dokumente\Visual Studio 2015\Projects\Orcus\MainSource\Features\Orcus.Service\obj\Release\Orcus.Service.pdb
27zen
k!5Y
)zQ
T+zg-
currentTime
v6Q+
<@Kh
XYLB
0]h1D
DeleteRegistryKeyValue
n-~++
6+r
MIB_TCP_STATE_CLOSE_WAIT
aT?hO
qRLR
IME_KEYDOWN
<: 2(a
' o*
w00)
set_BackColor
_CorExeMain
c{}#
hy$6
r%K
[6r\
2fEt
e<+e-
L=]T 4
CompareTo
.3^C
ContainsKey
>^fF
'\/g
{:+;J
Bc=Tyz
2|tC0
>w6 }v
a&hV
?;<f
icmpSockets
]'I$
u@{Z
0=?A
tcOH
TuPW
BmSNc
ZMyb
7W+z
6SZ6SZ6SZ6[
sYk~
_cancelActions
+LMp
|]EA
OnKeyActionFurtherProcessing2
set_RootDirectory
CalculateMd5HashFromFile
v3w
; 6eXP
3bXw
pnbE
4W}Z
kI|%
ComputerInformation
sF%?
u^Vo
@.reloc
Func`2
Func`3
dwTotalSecrets
FVr7
WebcamCommand
g+Uw
1]$K
,y\;K
BP5,;FT
A+']g
)>U
xU<qPbe
Bb&3
i]s}U
% o)
$@B %
#=k?x6
wo#0
RemoveFromAutostart
gV?x
dwLength
}RD.b
get_IsTaken
D$}r!
ug1G/'
FirefoxLogins
JnD9a
<GetHardwareInformation>b__6_1
<GetHardwareInformation>b__6_0
eR,S
<GetHardwareInformation>b__6_2
:&nn
\m v+
TVX~*
#[s&
mg
O sn
kw&]
oX.a
:Mk0>_q
UatV
]22t v
@VW@
7 I}
%_BE"3^
CsvFile
isCsvData
T(
V7[y
d2N
'r t
sC6k
bN j
localPort3
\}W0
2n#=`
get_ChannelIndex
Y)?B(
CaptureScreen
GetProfilePath
<Objects>k__BackingField
=W S
STATURLFLAGS
6x<-
HttpRequest
Cv )
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
`HF n
Win32Exception
Sz`Am
uuek%
r95EO
get_ClientPlugins
S?J]
Sp^D9/Q
ux8m
gkK!
\?}h
^^b*
FONTCHANGE
<jQ{
TT S
y\e'>G
K HB
BinaryReader
3NYx
B2)q
title
jRs
set_EthernetAdapterData
b3Ma
Xx6A
cekS
hThread
-s`
Qa0(
{>4O
I+s2U
ntHP
{ vO$
]wkc
puV&
?dHZ
~q/b
(#4MN
cds(
oH]>#$
Uj`M
E1v.M
9}j_d%^
LoadStream
DeleteUrl
L##8
RotateResult
*2qZ
Pe4DH
ofG
A:|'
4 Bz
<GetWindows>b__40_0
wT(G
TCP_TABLE_BASIC_CONNECTIONS
; {\
t$(U)4
R.G!
!fId
} JF
GetRowCount
@?sg
i&!Qf
l:l/7-
SQLiteHandler
Restart
set_DataMode
7tEOC
set_Name
f\#>
0 1>1\1h1z1
Default
{/4L\
QUERYUISTATE
mL}s=
kEXv
;7b[
@yX
set_Path
ArchitectureToString
!{"|v
I^@
/B 8
{bVk
N:X#0
c HW
,!9W
LlLYM
8U2'
FrameChanged
TB,7
set_Install
set_ApiVersion
GetHbitmap
Nm3i@
POWER
GetEntryAssembly
F\ G0
qzQo
6I=iS
h9 ]N
M/_zo'
Ttk2L
GetSystemInfo
7U2u
%&ER
set_PrivateBytes
;)c
2"A=
%&EJ
A+Xq
8N8K-
#_g!V
<qcZ
G3bfd[
CompileAssemblyFromSource
h0f]
4B*\
$D8;0
Bj A
]Klse
2o=A
SystemIcon
)V^y
gIUP
nz)V
R/JA?
!2GQf
A=>,
Z%vza:
ZOrcus.Commands.Passwords.Applications.InternetExplorer.InternetExplorer+<GetPasswords>d__1
set_IsTaken
uD:H
l{IV
eUDW^f
c{^l
QL)i
2Su9
_vfv5sG
p9J8R
uBUU
get_Count
W #o
:[?8
s'fM
!VM,
_client_Disconnected
"wly
z f3
parameter
#VMe--]
Vggy
0_fK
<SetProcessorInformation>b__2_0
fe6*D;
hklE
?("OX
hICu
Z@Lt
1u% 5
O<#~v}z
ToArray
h&=y
Xt{3
sH4_
Q3vi
<>9__7_1
c#qr
WS_GROUP
)Z:L
*}6-
|.Wa
f}oT
wkOr
b>*;
GetFormattedKeyValues
dbrP
d*Fe
OperationalStatus
NDM&EK
HTSYSMENU
[d|
{MKY
R2`)
,<#"D
\#M5Ko
GcqR
GetAudioDevices
&bcc
set_FriendlyName
#VCG
i*P[2P
ToInt32
k Ow
8wi."z
WFZ?
_=I<
a'DX
3F(#4
(BwJTE
HTTOPRIGHT
SpecialKeyType
KeyProcessing
t\`X&
HSHELL_ACCESSIBILITYSTATE
Ct`
({q
8QU65
>DK
kx4@
)9e6
p\;P|
<KeyLoggerService>k__BackingField
B{yN
3 `
4Vo{l
PASTE
>,;sa
o mW
MIB_TCP_STATE_LISTEN
RRCZ
6;T5I
C15f
cv_+
&
set_CompanyName
RegistryValueUnknown
get_Pipe
[Gk::"\
set_AutoResetEvent
PK11SDR_DecryptPtr
TK5UCM
|]TA?F
Tojj B
) f|L
mZ O
GLLG
ReverseProxyCommunication
q+QA#
ShowWindow
l%dK
ProxyHelper
get_File
An}t
PEA|
t8r=
M MB7
?h4T
y{S5y
tln$6
vC#>
Mf8X
;q J
:$^$=N8
20RV
YEjq%
eb98W
BitBlt
Ouo~|)
set_Host
1;^
.VX]
x !q 4
~0t l
4(p^J>R
lpSystemInfo
CGlQ
5&8Xi^J
!kx1f
v s]
ShowDialog
rk-
v(`e
b+,jx
~6Be^
=.K!
oR_b
lfvI63;
CryptAcquireContext
-@;lr ^+u
:)Be
rgH
6QklB
get_ASCII
_connectionInfo
#'e{
|a1|)
NumberStyles
Pnw9
GetPasswords
+NOe#
6PY,
2.8Xn7/
NetNamedPipeBinding
5,~
fzyT
Orcus.Commands.TextChat
parallelDownloads
Vm4
i5Wx
SettingsBase
"@hH
~&;Sc
R`50 l
\FwP
te~Bi
Orcus.Native
ZYN9
CancelOutputRead
aH?X
8rzi
l&n?w(
//1\d
set_FileName
B-|lK]S
pOX%
4_P`
@GuT
mIb(
r&A J(X
,5|~
x_lg
ply|
get_CarriageReturnAndLineFeedReplacement
LinkedListNode`1
yzV+
h^*+I'
F\f#
'W^)
HK]
lgE
EI$-
get_SoundOutId
h!?iS2
vz+?
ToBase64String
Install
ZCY)
|I|?
yzV7
TrimEnd
dtcf
<GetOperatingSystemInformation>b__5
CS$<>9__CachedAnonymousMethodDelegate1
:p7(
caD|
jxe]
[$PG
e2]u
WindowStyles
:[w/
e2]l
J=~
P?l}
V8|6>
get_EnumUrls
z(t:ddb}z&
lpThreadAttributes
Pmq5
@;sD
_sd/m
<ProcessCommand>b__4
PTC!V
Instance
-aK`i
}4#
<Host>k__BackingField
'UC
u\r!
iv]?
uSF#
aJ?
<entry>5__1
q6X%
h! !7 Y i
DownloadAndExecuteCommand
hProv
<GetOperatingSystemInformation>b__7
set_ProcessorInfo
qof);
zoG,
Invoke
StartProcess
3'5k~
KeyLogFile
"K
(l?}
=L%t,
^[l;
<!d!
:\< o
SetWrapMode
_firefoxPath
O ;&
- r3,
- r3-
n"rg
W57O
)* =
i{(:
A A{
Bu[J
CultureToString
vGQIxY#
lkaK
TIMER
W8MVb
AssemblyLoader
CHANGEUISTATE
get_MonikerString
/iy(
z Eu?
L>]j
Sw<_
(j![
windowToRenderHandle
?R9:f"Mh
7Z/\nt+
baseHandle
kkm 47s
GyC4
UVF$)k|)
?BZ
|m5W
eor)4J
f6?3
CreateCompatibleBitmap
:CRJ
e{U*;.Qo
Rrat
5slD
jYl#
Array
Y[X 1
F%;#
>1+$
j*2{
Bv~N
=!ep
ZqKd
" 0u
+ C{G
GetUdpConnections
xb"5K
datetime
9Jme
'6 U
K 5O
z/\@
~_.]
PushKeyLog
CompareExchange
[)=%
slot
WS_SYSMENU
mYs^ >
i/}o
-?}Q
) sj
ProcessPriorityClass
r63S
aqX0Z
OsP|P
,&B^
AdvancedBitmapImage
umGg_S
Oqo
bh<WZ
l]'bye
vistaStartMenuWnd
M\w`
fxte5C8}h
:G`]
SetVisibility
#jK
windowInformation
FromHwnd
S 6G
9{5
|C7?+
A{$:LR
3t8n
?y_e
?m#$
6f:<
:9CY
HANDHELDLAST
WindowsBuiltInRole
\rOW
9zWBh
Hfa<
set_CurrentImage
RegistryCreateValuePackage
` _O
3:[a
P]AR2
x~c3
6|^4
J6iI
z+8c
y")G
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
{iW
E3^1
6]@?
bXJV
6"QT~
H^}
AMA]A
ai|0
LkwY
Q2sf
oCk`5
XLY+
|hOx~S
Gof?
WriteString
DirectSoundDeviceEnumerator
get_Location
pl@=
y)ZY
set_ProcessorName
\_|a
FileTransferEventArgs
% YB
STYLECHANGED
]&s^I
hq}7 <
liO!
8 8 8
qD ?~
lHa}
MoAI
q%tA
d%y*
'cI"p!
GetCurrent
+}EZ
1Aj@
ntv
dc 0
Jo${
dwWindowStatus
Rz9O
@JN*
P*'Nv[
q=d)
EQos
oyJ?X
{Z>m2
i&m:W
get_FullName
RH~s.K!
zxHeE
<IsCsvData>k__BackingField
qkv+
#+ 4K
FreeHGlobal
get_CompiledAssembly
, 3>
1!=
;&ioy
<DatabaseConnection>k__BackingField
.87X
ADDURL_ADDTOHISTORYANDCACHE
+_ o)
|9P'
EventLogEntryCollection
set_ChannelIndex
yzi`
hN=S
DrHY
grVA
set_SoftwareInformation
RuntimeCompatibilityAttribute
gi(c
ActiveConnectionsCommand
Qsb8
hkQe
Ht L
ullTotalPageFile
OnN<
fwD94]
5eY!9
'zpb
p O3
m~/H}
.JvvO
_random
cCL#[2
c"Wf0
)v8"
kBXv
Km'O
d0ZpH
vMAL1
Xgqma}
t1Jt
.}/{
YO.(
Bopj
@V';
%t
D!c}
4?2pBs
P(8-
+m:g
{ [@
X(6
Round
connectionInfo
w%W"
? EU
gXwEq
p?a|
Ev#w
;6L<
?="Wc
"FLw
7'f
dwSecretInfoSize
`J8l
,kH
remove_Disconnected
] ~*
NImH
M F1X0
!;F 5G
/4,U
GraphicDevice
v60f
XBUTTONDBLCLK
VNadd#
remove_KeyUp
get_ApplicationPath
lpCurrentDirectory
Os5Z
l c]
RRsMc
C,[O
7Xj
/4,H
Month
QUERYDRAGICON
\1m_
RECT
UFkv
mD_-
se1 Q
System.Web.Script.Serialization
IkT'l
W pV
hostname
\rc_m
2vg<
4r,&G1I=
System.Security
=CYjX
XdG~
L &GbY
97#T`
F+WG
RenderWindow
'=,s9#
!+sA{
b3@f+
v LD
#q&K
DestroyIcon
IContainer
Clear
BWWh
CURSOR_SHOWING
l]p+)<
Tfou
~nO&qnmr
}mx(
)7U@
get_Identifier
A\3N-
[~&FJ
[L<A^
R$dn
;c#*
OU9
KEYEVENTF_KEYUP
<B#xrl
set_ProcessPath
#|O3
d(W)
Fa|@
93bW
q%<.
p_h5
Orcus.Shared.Commands.Webcam
set_ClientTag
]>1=
'aRx-
SetFilter
Y,~N
jPb%V
a1mkn
b6D2H
6o2r
IsATcpAnaylzerRunning
b$8;R
hovs
$2a34f2e9-77ee-48fe-9315-979980e6fbeb
sN s%?i
deviceName
70]&
T|})
ld^#
INITMENU
+f4s4
QKcF}o
hkni
FhKB
EXITSIZEMOVE
200p
GKZj
+Ba
QeHh
Vdk|
le S6w
c:T4
j'KE3F
get_Is64BitProcess
2%v
#G]<
$3601a898-0fe1-4710-ac30-2e6c417f46bd
Y(K&%
[L6e
<E^f
+R^FU
^J0$&H
orp "8
)=iJoK
GetInstances
Qw7Q
get_ReferencedAssemblies
mhvnry@
2j#/N7
pvmVGMN*
Z ;"
ResourceManager
-b19
ClientActionCommunication
2=Ec
GetExecutingAssembly
cyWindowBorders
3b9.
HitTestValues
yT$1
FromClientPackage
?I d44c
ResultSender
}B:A
Z :e
w`vfA6
8qjS
w%t^
p(?F
ContainerControl
TextChatForm
BeginErrorReadLine
(;&G
3x(6-
1/0c
h(-c0W
:DBf
get_BinaryReader
/E b
8/C\
HSHELL_WINDOWCREATED
^ Hk
5_<K}
ToInt16
1 e
p(?c
+`(C
H+7)
0e`g"
o4J
Y=By
Orcus.Shared.Commands.MessageBox
%H_
!>V3
CommandWarning
Gw>u
d4/K
cg/p
. cQ
,u u
set_CreateNoWindow
F*1
o8SrC
set_DisplayName
RegistryAccessMask
hOg~a
R:J
1xt
MDIDESTROY
JT,
!9`\
v{R
nNPF
Pxu'
set_IpAddresses
WhO@
H>uL
:Nsb
;N>pFbv5S
_counter
O9!p
s8Uv;Lh
Nc3L
`R6B
package
PluginLoader
juA'z&
AddHistoryEntry
/yf y
zq#nP
WindowsModules
hx_c
,V;X
ng:M
38H:
gfL[
[X][QX
xTyIL
Vbxsl%Z(
%g ~
s=oJ
T6 n8&
2(Cx
-Nr
fWriteHistory
!)@
:0$d
DisposeSession
VideoArchitectureToString
XBKf
Empty
"x#PeW)/
.$$.
get_YourName
GetInstalledVoices
#s9N
RSACryptoServiceProvider
Kw"l
:*oY
'q3
biw v
Lq.9)
YV,I
<Main>b__12_1
,xmb@
biosManagmentObject
DpvzOW
pcchCanonicalized
!9b6V
FileShare
,Ms
NBNm
Ut!H
F5Na8
;J%(
ObT~
*g4-
nwb-
N J`+
}:]r
J%PT:
>eM;
;6!d
Sc+I
Bs"[
Orcus.Shared.Commands.AudioVolumeControl
4"=<
B| _
set_ForeColor
JliM%
(g!;!IWqy
p~B-l
RW6Ka
Close
BMGI
o!`T
J,Nd~
l S>:
1nqn
y="&
Encrypt
VMW_HILITE_MENU
7L5+@
+;V+
5{oC
G G Ga{
]+ak
3Y3L
#`q$.4
MM--
StreamExtensions
<ClientPath>k__BackingField
PGWe>ZfXih9
HandleRef
Z}gh/
i58EF
Kg&c
W&^pa
DL8F
Read
GetSubKeyNames
Xp]w
v~v9u
]2j{
PRINTCLIENT
A{}O
A)C/ly O
ttb_N
<Session>k__BackingField
w.2s`
H"b ]
h Rr
zNZ_
screenCursorPos
get_Platform
b=.?
ip13
[=G<V
6OV}
"iL(
[/y4#w
)v%^IP
y06aHag
+g7
gyA$
jyUa
-}$z
)D y
get_StartExplorer
NbV?
uY4_
Z[WV
Ag4'
% ;r
/\do
#=iF
autoResetEvent
lpStartupInfo
wzZNg
u8[9
QO(o
GetFreeTempFileName
3fJKq
MENUDRAG
get_Scheme
$ fNy
O[C"
@k ))
set_Manufacturer
fqjDK
set_CompositingQuality
;raw
zGxse
>=9qU
Yg4m#
\lSg
eventMin
^|&<
f!afi@
+fL3
get_Tasks
GE?7
:4 Q
)Bn
}>C)D
hmodWinEventProc
$b \G
e\7f
OX~ /
PluginInfo
7w|w
RECONNECTDELAY
mscorlib
%~[
U+zK-
FileMode
)v~v
*{ze
BUFFER_SIZE
DISP_CHANGE_FAILED
-`h)C,
_serverConnection
PW u
;JQLG
akKYb
f}L3N=:7k
lpvParam
<AdministrationId>k__BackingField
EMm
LrtgZ
82U.
REGISTRYAUTOSTARTKEYNAME
S%|*
Uv0|
Orcus.Shared.Commands.Keylogger
RequestKeyLogCommand
lLV0
pY W
/+sf
dk4D
8u l
HSHELL_REDRAW
DrawFrame
23 B
ControlCollection
D8Vq
FileName
jIK?
DeriveBytes
SetDesktopWallpaper
X:K+
DQ1(p
5!-=
W:-^
yd?>
IgnoreMove
+b@}
$Se"A8
otoL
%21) iu
N^1/
d$GS
@X:E
CHANGECREATIONDATE
@?!@
ManagementBaseObject
ts<g
z&zu
_a#5;!#k,L ?
<IV>k__BackingField
TABLET_FIRST
{D|ZA
ABfu
ReadOnlyCollectionBase
className
v y 4
*;4Q
~-t7
Q0QnQ
4J^W'
J(&:
{nKw
)A<@
JOrcus.Commands.UninstallPrograms.UninstallProgramsCommand+<GetEntries>d__2
_floodingThread
;Mw8
RuntimeTypeHandle
@:s/
method
<>4__this
Starksoft.Aspen.Proxy
8XU
= Xc
wXJov]
J5Ccb
\M= Xs
>!K
89r
WyS9
d.^P\
IegA
s8yv>
LT>[*Y
<P n
%h vV
\i s
`*[P
V{ {
l=#B
UInt64
sender
P9 (*
DesktopWindowsProc
W|QG
Nn='
IPEndPoint
P$I.
get_Frame
action
sf{/
logData
s%c:
set_SetAdminFlag
B<h1(
CheckDisposed
RedirectPackage
bq%,
&q)/
s R$
-#1,@[
W+4v.
,-*g
R|R|\
^8d$q
rJ*
33z:
p xR
;{"4
ccrp@
jWn|s4
Yo.G
SC_MONITORPOWER
Cq O
4h =
_K4N
WININICHANGE
iSsW
*
gQ}X
DeleteKeyFromContainer
AppendFormat
GetDrives
4!%E
JcNU
uZl2
2 #ffffff
\dQ$z
~DnF
0=;O
FORCEINSTALLERADMINISTRATORPRIVILEGES
}?KnAN
] a]
p*r{D
4bzH
ENTERMENULOOP
3\5<
*4N~]UHY
}w6:
~"AK+
8+p
fk'}8Lx
set_RedirectStandardOutput
iN?F
~Dmz
, 0%
\t,fd.:
f7U
zyk&
1na/
ToLower
P4\_
>heJuo
w(-<L
.wx[
~QM3
7 gV
RBUTTONDBLCLK
=9o8lMow
kdC $
set_Cancel
cZj#
|5gW
>=|5/
4 f8f
"hXW
yWH6
x#|/"_
[[fd
get_ExecutablePath
(9~8
)T!
uJi
ClientConfig
X4zu
fc&f
*|;fh
FromAdministrationPackage
w AK
/ mZ
CH %1
PacketSize
A!mO
set_Revision
Y$b$
I"a4
So-E2
#gX#
9>#=-7
prsN
"| |F
t%BE
vF.~
}n9o
U*w"
Orcus.Commands.FunActions
xB?F
=.Q
)~]Gm{
- [|P)6
# S2
NU%&"
})l
U=oI^
^d8 1
-:\T
6hbb
+f X
Flags
V~Sd
i`+;-
AppConfigWriter
4=#kt@
Nq0_*
|74ys
z?pI\
<CheckRunning>b__13_0
?\ ^
r<cn
lpEnumFunc
{[[00P
HTSIZELAST
~p3
NYO*
%~{3
& 83+
Im<6
ProcessListChangelog
#hfB
i-{@|
hF3e
l*iR
%!.u
W|<C
i^?1C
().!
Dispose
ReverseProxyCommand
rN
D8>Q2
set_Handles
ZFIc
{^A9
]>41
x0>?
Q|!:
}<o -
.V {8
5,%M y
meOWS[wokS
m3G8_
9Oh6
>MkM
os1 }
S_9
?G
qRs}
:P$5
E8Pv
p a:
))()-
{]^y
7Kc
GetDownloadUrl
T$5I
SC_NEXTWINDOW
j]`U
RB_3
bGNalCPA
'^!fR
& kM
Ed'<
" 6W
O/0
$M2LTu
set_ClientSize
#5VU
remotePort2
remotePort3
iM=8uTS
jF[`5
Tv*>?
S,9C+
q x5
*$r/
InstalledVoice
y--oW
0j`|T -2
ec; !
<Source>k__BackingField
.efi
$q63Z
<P}l(
1oZ?
localPort4
_isAdministrator
LS%3
`VE~0
xL)q
CAPTUREBLT
9I-@s
'k8"
get_AsyncOperation
[K+o
M0*C
,Efg
Orcus.Commands.ComputerInformation
x{7a
\ D`V
9 V@& L
Ihpk
);&c
p9v
_b"B
resourceCulture
+sOQ
@SH;"
-l06
get_MainModule
;;?B
U,@I
QnZK
r 2S
[tO
localPort2
#L i)^
IB g
JBI
znQOE
ngp-9P
WBy)$(!A
XT!l
L.}c
op_Inequality
K!q*
QUERYOPEN
um)y
ResponseType
}&?"
4t`g
IPAddressInformation
;Nl0
{" ql
OSType
3&]k
CvHK
fQ,s
5^.V
cAoQ
La_h
&i8E
CancelErrorRead
SC_HOTKEY
l<^,L
S1K 9
Kxr
WriteCsv
kjvM
StaticCommandExecuter
HostsFileCommunication
W.c/*
%tMJ!
uTmb`
S!}!
4D53392A6A24D5E801ADA14E79B43F9BEBB79150
7.lWF9
eSV\
<Guid>k__BackingField
w<c}
Sps>
get_RootFolder
z{Bu
L3b6
G!S!
System.Collections.Specialized
|SMfFp y
+-}`
V)$Oc
P'jH]
q LPDI
get_TextInfo
[of4
O~KX9Y
#A%;
jA'QOY
System.Linq
<Dispose>b__4_0
LiveKeyloggerCommand
x.J|
show
a/ *
2(383
fV CIZq
Lmf3
)miky
0ml[f0L
ub`w
<>m__Finally2
G 9:H
set_RegistryHiddenAutostart
memcmp
<>m__Finally1
=.hh
KBt\
-Z/|
%k2/
8'mV
*]nfO
7,EK
-bZM
T~mR
get_FileName
SPIF_SENDWININICHANGE
8:^f
|>pU
SF`[~
"=qtZ
p!Pe
M^jR_
TK)
2/l=
add_NewFrame
gA>D b
- H
l-M*d
mg_C
m3W^
je cvF
$^)l1?
<Ac%-]
sOR|
}:[5
#JcNBlo
b y}^p
(1
(2
<>c__DisplayClass14_0
get_IsSupportedOnCurrentPlatform
<j?Rp[}
-8s
ExecuteFileAnonymously
%[iL
_sendLock
SizeOf
unixTime
bQA4
UnicastIPAddressInformation
EndRead
bdV/z6(
BV@BB
ApplicationPath
UnhookWindowsHookEx
PluginReceiver
u?P9
m] >
m6e5[d
PKX<b
~ eH
a zs
_>9gJ
phHash
,&mZ
ExceptionFile
(z
. ]#7
1>Y)
},1tR
index
rIV+!3
get_Flags
set_Key
w`^{
9/}$|a
S]|:
0i!U
get_Triggers
SP%Fi
XBUTTONUP
?##:
Title
AyU}]}M}
1tx9
(e
CultureInfo
lpCommandLine
endIndex
0w M
(&8Rb
9 Qq
vKey
K@<P
8F^>h
'BzBJ
_reverseProxyClient_DataReceived
(H
Boolean
WM_RBUTTONDOWN
(B
"-_s%
|wf5
Orcus.Commands.Passwords
8r9 |
V :1
set_Account
NHYE/
a^I0
:bh`<
-.k[\
pWG!
i_{/
registryHive
HE7|I
y0p~
j[ZA
IKm<
T488
w8]G
_K-g%
1.0.0.0
P_qOU38
YuLE
+$yc
Z`[Q
t*;~
StringComparison
B4${
FI&K
O2*J
get_BootMode
CompilationRelaxationsAttribute
xKLD
<]JFK
I{VSN#
X0.%
ApplicationContext
<9{cGZ
;1f/r
@/hMO`k
K^\@fe
<Pipe>k__BackingField
get_Is64BitOperatingSystem
!;Dc
JJn6
MemoryStream
MessageBoxInformation
/Ug7#
<>c__DisplayClass4_2
NewFrameEventHandler
<>c__DisplayClass4_0
<>c__DisplayClass4_1
F2/7[
w.0Sw
;,#E[
HttpWebRequest
K##s
J#zu:;
M{c$ZW
#hZW
!]{6D
@<7o
W6z@X
(J,M
: 9.
/&au 3
bytes
xq7]
: VW
YziZ
set_VncMessage
5oi0?Xf,
CommandLoaded
.o=
5,ry
Buffer
)fZwK
(L:
EVVx
Vv`;nY
CDS_UPDATEREGISTRY
vc!}]
DesktopWallpaper
+ _
unknownZero
6 h2
KS[m
G]L(
B Ym
FileExplorerEntry
[d&A.
0oEz
A3/s6
,Bt_X
MBUTTONUP
0j?U*
configdir
SwapMouseButtons
IsVisible
x>G$f
Orcus.Commands.HostsFile
BmgeCr
a-bZ
<o'O
|bme
2:fK/
Orcus.Service.Extensions
lpMinimumApplicationAddress
X o2
OnStop
a|r@
ne ]71
VvxS
Orcus.Commands.UninstallPrograms
u3k6
Gb#V
6$72S
SslPolicyErrors
( =F
!T/^
MDT4
w 'v
5 '*
r.L&
2,\C5
md5Hash
b8wX
get_Target
53q6\k
u{xq;
't5Sl
dkm2
JifJ]p<
xrQI
@ c$_
-uoJ
get_FriendlyName
m?P^L
Orcus.exe
Vk?d
j\4cK
*dBc
7QK2
|54@^
V.Sv+
+Sa8
: (2
_ }UI
bQ[Yb[
5{6w
lIBT
DoMouseClick
-&jZ
Ol"{
8nbk<
WH_KEYBOARD
!_Eqi
WCF_PAINTMETHOD_PRINT
[{dF
ADDURL_FLAG
Orcus.Commands.Passwords.Applications.Yandex
&s5v
0zL
8;3C
,N;t
desktop
XI1
wiQY7
\uml<o
G^[';
m,[O#.#)O'
;-C}^C
wg@<
PluginVersion
set_ServerConnection
s?
UrlString
\;t&Q]
<4zQ
<Z201
Concat
y%6oPe
' }C
e Ns
:dyu
Orcus.Commands.MessageBox
C&^
get_Data
eaV<
qX_1
y~~W
72bc
func
lpClassName
KHCH
REGISTRYHIDDENAUTOSTART
73_a{
TK
NRgv
UN>>N
.]+/
f<JF
TCP_TABLE_OWNER_MODULE_CONNECTIONS
^PR
/
@?#6
,y [Z
4U:M
X Kg
HvncCommunication
' ZAF,WQ
<Path>k__BackingField
,>q.
1:&|<
databaseConnection
{;G)#
\L!?
bUpi
ucL%
=V v
5J0'
ClientController
U;,u
<PushRequests>b__2
T$,H
BE%T
set_LogicalDrives
f`f.
N)K :
qn"i
get_AddressList
KEYLOGGERENABLED
XYo2
$~!q
ml 8
2.[+6
:foI($
set_Username
VAzk{
k?_x)
duud2
C8#f
`/WY
Orcus.Commands.FileExplorer
JSl{
?N5
1BJX
zEYu
tM#x'
#-#r
Sw#U
ReadStream
nCmdShow
_msvcrDllPtr
sX
\i,jw
ReceiveData
add_ApplicationExit
qZh t
IsCsvData
System.Text
!zgJ
whS/
c0~#blyv
z;_j
4s G
CancelAsync
b?m-J
GW_HWNDLAST
HIw]
O. S
iUp
<InstallIfNotExist>b__0_0
IsNullOrEmpty
b-n7
"CR b3)
-Vx
System.Collections.IEnumerator.get_Current
e+g697
Null
G~Zs
dp"w
dBj
E+Cn
A|wC +e
lpApplicationName
9iyV
hObject
TCARD
,ew mk
RWfs
FDB}
HvncHelper
|;Q|U^
ByteHelper
eqN9
t5gR
.?xnW
b}k-
Component
X1Vy
set_ExpiresUtc
u%+[5
set_DnsName
Bu!}
ec'_
SHGFI_ATTR_SPECIFIED
_eoQg
~n28
3llJ
1fo
J\eZA
U4W8
/I+Rh;#
VuqY
4}~Y
E9Pw
=PLe=d
MOUSEEVENTF_RIGHTUP
p\ '
- r+
SC_RESTORE
a=sS
|=?{/
SY}g
location
-{^7h
^d#x
+p?x
input
bSwap
X3LF
{Ng
t1QG
94A9
=*x
?MU=T
:s+9
XmlDocument
'M x:
>FBg
\Cdi
fAtg(
vm,=ShIH
kx#O
GETHOTKEY
InterpolationMode
|>6k
AeJ7
iF I#
-Hb4
{h:w
h7M_
HV1r
RegistrySubKey
? I,
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=10
AudioVolumeControlCommunication
EqLH
p# W
HostsFileCommand
d!*Hy
oDN"g
i^*
g>S*
R ].
C/ mV`
add_Connected
d[e>#2
5HVt#
2?'S
>2`7\
rz.7_
n C;yH
<GetHardwareInformation>b__10
gXxw
@m>
=]@7@0Y
<GetHardwareInformation>b__11
2,c:
PRINT
<Lenght>k__BackingField
_:+EC
VOF{
b%E:
a @`
]@x
%29/
TryGetValue
[PU`
ljZ\
c Sv
rH
DebuggerNonUserCodeAttribute
mi/F
get_Title
,]?i
g:gh
F,z7
0zO"
remove_KeyDown
Q=!\
t*:6
#@gk
\Q/U+f
a^% U
5o_,v:*
(Su\
fa:
\i3C
R|L?
set_Model
WM_SYSKEYUP
DebuggingModes
EventLogEntryType
P"TW
~9: g
m> |G
WO?Vy
certificate
=KQ
PY|{
.Si
wXmX
CXd.
1dsT!oB*hK
YcPG
% >r
#VF`
HIR'
,#qI
P'QHQ
fsKp
DateTimeKind
8Z3e
F!6Y
y -q
XyHG
O B_V
IsInstalled
z'dmt5y(
,,DiZ
Degrees90
<IsConnected>k__BackingField
h5SC
<%R.G
#=Nc
U8n d*P
>06#}
' vib
Handle_Connect
>!0>?
CompilerParameters
)$-Gt
User
URL_PLUGGABLE_PROTOCOL
ConsoleCommand
<96F#
;:>KJc
{gq}i
hvncAction
set_Device
UgVJ
yeQ1
dwSize
Hy8]
`[BT
z;: `6
L"8t
V_b2
UOI_NAME
:FHk(
NXf
!$wQX
|;,Qk7
|X[>
!(kr
54iU
q}\,
_Vrv<en
ScrollToEnd
'UUv
^D~F
_stream
spa>
h%DK
#Mkh
j,7:t&
Xa2`
PK11_AuthenticatePtr
FirstOrDefault
3*mN
3){iu
<reh
SystemIcons
_@ j*
.nhP
F2 }9
7A.Q
K _5b
/K.1]
"p;7
-*bq
z ?gy5
SN;->
z zZ
psrw
p (N
FromSeconds
YB(A(
yT$'
yT$%
qBlr
('FT&
|UZVCbZYYq
t@u
Re(,(
yT$=
CallingConvention
FkIuJ
set_InternalName
mWB+
NCLBUTTONDBLCLK
p]}U
AddressFamily
}DFg
KEYFIRST
QZU.
AesEncryptor
mjoy
/xS\d.^
A|&2d
^pGc
`5?f
F\:Y0
<Loadables>k__BackingField
DirectoryInfo
Orcus.Commands.ReverseProxy
"~Xf
zJ!G 9R
<EventId>k__BackingField
}9O<
_C7?w
{WGE
i|)s0
{u&[
WH_GETMESSAGE
costura.aforge.video.dll.zip
zVYs
RichTextBoxExtensions
[}IK
u>z&
\EK +9
iK1bj
\ y]
2k(k
:RFZjGs
:} T6
DESKTOP_JOURNALRECORD
set_GenerateInMemory
yT$s
ServerPackageType
@7h+^
FW45
M kL]
code
Q]i)
IrN^
7 _s
ExtraInfo
%u7#
CreateChannel
W 8E
ENABLE
Qkb2
Y)c"rt
^27>
registryType
j_V6e
<ProcessCommand>b__5_0
2N#X
tz=P N
5[G
?f]D
"<if 3bf-
item_name
R. "
<?xml version="1.0" encoding="utf-8"?><assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
B6\ iB
u2^?
/ ]A6
nR^?
B%%T
GetSoftwareInformation
_kMGm
TakeScreenshot
={Q*c
rYzC
tc;k
G:7B@
;)1,
4\2d
g:(:\
+rnoz
xwft[$)c
*FJ5C
version
\)ON
KD/}=
NCDESTROY
O Vu
MUTEX
QueryUrl
2 (n
Q%_$';]
~& U
7]A
\J3]
.!^z
layoutToLoad
Render
CN^O
DisplayFixedOutput
LhlfRS
URcY
Gc =
p@^` +i
z)
L?P=
<GetNetworkInformation>b__9_0
C,o9
MDICREATE
[4^m?
\C"#/:
GetRoot
-XaU"
xQKG
t~\-
oVTL
QDjE
T4v`6
V&9:D
u^CT
hTPD
#O;e
HsM5
f'?1
NEXTMENU
;%(c
>S$G
vH[4
D6j,
=KMR?hMy
2=;N
FZN-s
!J&)}
,ov
DiBNY
get_Length
_Q#~t
n;#\
_'jpC
TUW6g
SetThreadDesktop
c fl as
,M ;
?!]O
p,.hT~
J!|'
SC_DEFAULT
_v ,h_
set_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
HfY8
7^-]
get_Ipv4Address
t'.1:r
7Ox@
.NET Framework 4.5
Xc>'-u
| { 4
0xd=Vb4
tI,_
h2_O
Stream
Orcus.Commands.TextChat.Utilities
U G B
7?Vq
lNJ
&^] 1
F@x
ov]8
@<*7;
UdpFloodPackage
<ToolBase>k__BackingField
<>9__3
>F O Y
R 9H
c,Uo*Op
XN[O
get_BlockSize
PAG+
N*y{
2te3>
I"-O
RT 0h
shlwapi.dll
Hr|"YE
a<,M
1#LO
g.;Rq
SystemTimeToFileTime
Windows Input
zoz]~:
Tld}l
Fh/@
#I66Nk
BindToObject
GetType
USERCHANGED
87s|
'W5
^g)e?!=?J
get_Commands
ZKH)
CPoS
=Zh^ [
5{0/
MIB_TCPTABLE_OWNER_PID
W#v
~hjS
~(Nh
kG[
I*R]
Vixd
vVf
X}O;
~Gci
Hg#L
S at
qE$!
xk&;C
9z>~<x
viR
EndpointAddress
I4?
haK
]\
+-G.
set_Description
wn6h
BeginReceive
HnP7.M
list
>BZ|
pR9_7Z
uAction
URL_ESCAPE_UNSAFE
WH_SYSMSGFILTER
(-3S
cbSize
1_mh
M5f~# N
set_Secure
0:.>n
196;(
TB;Q
dwProcessorType
r%H0
process
eX/S
GAWO
x|s?8'
newWallpaper
r,|<
#I!@
Fc$0
set_ServiceName
u q`
#6L!
H .0
set_PublicIp
F+;*
t=z/
}t+iI
ConnectedLabel
y _W
get_LoaderExceptions
:z.[
T=^
hnBbO
p4hiC
3sc#
m[-^
EventHandler`1
#E-H
,]O2
RX;O
qFMd V
$8UF
t tGi
^MG &
G>K\
ProcessToProcessInfo
<ProcessCommand>b__4_2
<ProcessCommand>b__4_1
<ProcessCommand>b__4_0
<ProcessCommand>b__4_7
ac?4
r_;6 o
_client
get_VoiceName
NCLBUTTONDOWN
` uM
GetProcessByFilename
0VB/A
x2sY,y|
CSCore.DirectSound
|NxM
="$u
+0A!;
L(/A
l='E
set_VolumeScalar
URL_UNESCAPE
Z0 Ru
Mt#8
`Dd/
82Ft
HTMAXBUTTON
0V/a.
>Q)\@z
r{{=4r
b9m.
%35c
`Y<|
WS_CHILD
m O~
GetForegroundWindow
M5ZE
<Connect>b__29_0
hKGo[Sco[g
%-,&
1 ^x
;S)Ah1k
I@90 h
~cYEEA
u;K'
^2t:
GK3&
N<Nz
=emwJ5
)!H
p*r E
Match
F[t >gBse
O|.GT
C8!q
get_SystemPageSize
sYsx
get_LogEntries
<>9__23_0
RN*(
<IsAddedToAutostart>b__2_0
OpenRead
K3F@
)D=6
UrlCanonicalize
~^Yo
"g_O
|O3z
gl]Y
=-Zl
l|v^
2|/yY
BasicComputerInformation
UninstallableProgram
59=;,
Jx_
C7>B
Register
V2*{
,M/J
qbp>
TryConnect
get_Installers
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.get_Current
NgP8
>g"_g<
WI)?
set_Id
]RxY /Ka
remove_SendResult
Mrw
/e04
hObjSource
l|vr
startIndex
VYTJ:
WriteSpecialKey
z(-yrN
playInformation
Passwordcheck
MinimizeAllScreens
_Ca[
=<5[
()D+!Z
set_InterpolationMode
s?2z
Qol"m^
&cc7
System.Drawing.Imaging
mp@jbG
OctetString
SC9jO
get_InvariantCulture
1Orcus.Shared.Commands.Registry.RegistryValueQWord
`2xa
_pageSize
;*VC
T3G)
JaT*
1Q4
8Vp
dmReserved1
FyAk
set_Field2
wRM"
? TY
CurrentConfig
RxN
K4\6
j\_.m
C_?T4SP
Ga;X
I@H$
{8:Du\0'D
.B=E
d]T/+T
1p_V
Y 3{
IsNameOrValueNull
V[V
SETREDRAW
STATURL_QUERYFLAG_NOURL
;9E<OTD
FrameworkVersion
J S yV
#(0[
xQs
set_Culture
Km-V
get_ResourceManager
{$wR
P@$4P=G
c>k\
C?SD
C6c
MK/S
adc N'
oO@2
<ProcessCommand>b__4_6
" ;Q%
{$w@
)=Q
[Ff3
Ak*]pJ
=K/XNY
sM.['
UBY)
System.Collections.Generic.IEnumerator<System.String>.Current
t5e7
set_IsWorking
^ DI5
NewTask
xmJc
length
`BUD'
p}S@
\^?#<
Z>P>
*Y9[
oyM
5^_Q
lJJjUa
Tc;q
hKey
set_HardwareInformation
$| %
Program
Handle
P3c L
DNrO
$yE1
A=B
c|&R
V< p2
Orcus.Shared.Commands.RemoteDesktop
& o:
>B 71
cP;R
start
P. Fd4R
*K;C!
i}da
P :I
vh"V
PmRhl"
8XvF
& o*
kI6
WCF_PAINTMETHOD_PRINTWINDOW
Y bV
P~]_0
rE0"
a ^1
f $C{
M{-{p
hRh0O3(
$D4 3g F
<C>
W *6
h 2#s
FNOZ
^b7
gy,M
@:Pl
PixelOffsetMode
NQ@Y
Integer
B;`
nt@3
*sR
1vM~
nOEE
<ShowWindow>b__1
L%dJ
*sm
{y\]P
B E@
get_TotalMinutes
hY V
?|W!|
&t-
0 X
v~ j
*i9E
Shutdown
Oa+^
KeyDown
RLC+(Ci
!4+s
^m:
j~O>
TRYOTHERAUTOSTARTONFAIL
QKrmr<
CreateDecryptor
set_Connection
<>9__0_2
<>9__0_3
,Q.}
Installer
Or_W8k
"M;
X#WBz_Z
<>9__0_5
r t=
SW_SHOW
-).;
L<Zg
?h+u8x
NCRBUTTONDOWN
g2CS]2
_Y=K
N_)Y!i
Yr5>
foy/
T{(d[
tFyD
Qh+L
%rS:
CANCELJOURNAL
H$4 |
}zYO
Xn?Q
SC_SIZE
7Q C/
Wd4 U
/}2_
get_BinaryWriter
dmDisplayFlags
q)PcNCB
IME_SELECT
VNXy
Multiply
Orcus.Extensions
6q.O
IY|e
=4["
}zY/
J^<ZLi/K|5
ew'Z
2gr1
SETTINGCHANGE
!wb _
H9-7
WSsco
<WindowInformation>k__BackingField
J^<P
>qR~
eHw&
CIM
L2iyW{{
SPI_SETDESKWALLPAPER
Es`J
p*rsC
p*rsD
get_ConnectionInfo
GetBounds
EVENT_SYSTEM_FOREGROUND
;dx_59
nXi
Ec:Zt:
<GetBiosInformation>b__0
ResourceType
Nxe4
:X\HX
modeNum
get_VoiceInfo
usnp?
Zh"!
ivB3
o^sC
<45yhR
filename
COPYDATA
*.:~
\E-=Y
bvyu
YP#
set_VideoResolution
C3?Y
CkK,
;/ZW
SB]F
pszCanonicalized
y7-N
<LogData>k__BackingField
+!]
MQX;@
bs^90
%rR(
gkdV:8&=I/
q6-n|
<GetBiosInformation>b__2
;2h?R
handle
qW6/
:gRY
OLY&
lpReserved2
RegistryHive
`i^F
\r!3
i+dh
r}b-\'
{?N{
<1iVZ+:-5
t\>i
GlobalMemoryStatusEx
ifFn
F'S
GetWindow_Cmd
9Pi#Y
h)@?
timePasswordChanged
W 4k
oeV+
'#'
G<HPi
9=`Mh
j/Dg n&h
| zx
|X/gd
P-z7
ByteArrayToStructure
^
GETTEXTLENGTH
0..gA
'4Nc
"t E
KldmjP
'``O
H?ad"~
|i8X}
get_Resolution
,&id
OpenDesktop
Orcus.Utilities.KeyLogger
set_TotalMemory
Z*Wb
nYSrc
.gJFz
69QY
n?n
E/&w
vYq}
0B/k
Q)KW
<PacketSize>k__BackingField
Settings
*a\+
!gYJ(
<PrivateImplementationDetails>
s1&JE
kEu^
ServiceContractAttribute
GetWindowLong
Nc]DE+
".Fe
get_InternalName
DeleteSubKeyTree
0zc@v
Compress
Tm^4'v$
_isWorking
7?/l
sPg>
}Ele
RegexOptions
HvncAction
_QV.5
<gLB
^^u
CopyFromScreen
BZA^
IDisposable
H5?N
_Ph[~q
Ih>Fy
&dni
$V[q
get_FactoryCommandType
6abz
i:hv
mRhRt
ullAvailVirtual
P$Z@h
_ipEndPoint
/KG<1
)Ocx
<y^-
CreateSubKey
DatabaseConnection
\~4rK
ConnectionInfo
{e%]
h6PoU
]^t?D
j. t
!7@& y
<EcO9
qD`
d @R0
GetWindow
DQ3M
>+g
g$3/
\\mv
txDR
2.KB
xx~j4
set_Resolution
f59IV
.NETFramework,Version=v4.5
ZwVa?
CommandResponse
DoNotChangeOwnerZOrder
RZl6
d{ ^
eu6,
VDHK
set_AdapterName
2IR[~Z
*V~/
<=8"
ebi
get_UnicastAddresses
RemoteActions
UkyCy
^g@y kt
W/;m<
.-Qq2
=t[ \h]
remoteAddr
x(!v
IZ?
Ts$u
fK.;
z%%]G
WMwz
>I z_
Year
get_LastVisited
kSgn-JDJ
n-|_
R 5a
lyT2 c
#\K.cz
$0\X
_isRunning
Sdnx
EndReceive
;a^4
>W 4N
x.scpp5
set_Volume
SC_KEYMENU
@121
set_Enabled
ppvOut
HoF2
Sort
get_Exists
<accountKey>5__2
_firefoxCookieFile
MEMORYSTATUSEX
_isDisposed
IsInRole
;M*x4OG
ae/_
bUA#
ZoM>
E541>~
Passwords
ThreadExceptionEventHandler
W#t`
i{ 2G
S%V9C
>/YJ
kAG9
A#h"
'Cj2:
WS_POPUPWINDOW
%cF)m
VBCodeProvider
Deserialize
\)Mf
L7>s
'#o
E {8zP
r/d{
phProv
executableFile
Oxe \
KillButton
`>/fy
N[;d
p4Qj
N MKDwM
@G(n
Synchronized
Dk^{H;~
_jz Xfz
_j&e
get_IsEnabled
u<_M"
1E63
dwExStyle
gK[WZ
hngdu6h
Fcg[
WS_VISIBLE
command
SgBz
C*7)
5 XB%
GetValueSafe
`M^5
ANTITCPANALYZER
set_DeviceName
FI$|S
NsPS
KeyLogEntry
get_Line
GN$_:b
= S
O }F
get_AllScreens
' $L
5j-H
W|}L8-
NHP1c
uF\!
ardj8
CalculateMd5HashFromFileToString
GetEncoding
+{(O
\Odp
g,i8|
set_Is64BitProcess
zrF!
I[sl
>( A
M,O=
\+ (Y
eO\
ALG_ID
Xl1;<bW;:y
}Pro
[BK'
z>`w
1:M1g
zb$&2
MessageTextBox_KeyDown
JEPM
SETADMINFLAG
$AFA0DC11-C313-11D0-831A-00C04FD5AE38
AJHo
hPT?W
LL.S
}jd
5>2n
NullReferenceException
FromImage
~ZjE
*Wk4*
Y0\g
^c@b
5$E2
WR {
&$x?0*P
*p[W!
.Y};S
_ {Ov8
4avq
4!c,
G/R
<GetFormattedKeyValues>b__4_1
4avy
get_ErrorText
i?um
54N-
dwAllocationGranularity
StartDownload
C\a,/
set_StartInfo
_pluginReceivers
X\/d0
0L`V
STARTF_USEPOSITION
c)`u
UserInteractionCommand
a~L%O
!sD
+,
z1 \??y
UNJ?
{Z$T6q
7#
IWebProxy
NotepadHelper
a&~at
rWIQh!
1M~A
synSockets
cZ`D
th#T
MZnR
AFXFIRST
!Y&@=,
<ApplicationPath>k__BackingField
m8'=
ydd#
get_AllTasks
+%j gK
desktopName
Tp 8
DESKTOP_HOOKCONTROL
Ey%t"M
set_ProxyPort
t zh
4;4|4
y*IT
_-v&
:IY/s}
Szc}mJCC
`N9D
tR2zN
&/25
*'X`^
j #
j8?&
<=p#
I.gG
o -1
Replace
.Wvt
+* j
(2V5
EQV4
CBc8
d9/Y
5c<a
] oK
4!4X
H0&^
:>X=
OY<]{
;u~Q
add_DataReceived
L- kL
nL!Q
%!uV
lpInitData
l!6\
Z_5:i
y{~8
GetServices
m` f
g)[-
browser
J%hT
get_Threads
Bc\)IR
&*D83
mer[
Bu%T
?K6V{,
set_StartType
COMMNOTIFY
:-e+
M 3]
XTg,
@0|o6
n \ z+
ResourceInfo
^ea
Hl4x8
4+bo
!~v
,9e9
Xp0F
pdWFs
remove_FileTransferCompleted
?lF
p]1=\p
W#<y
"S`ia
D+3
Po??
9O6i/
?it<
SHA256Managed
L1FK
tt
:=JL
&2Da
F ]{
set_Position
^!hb
,Hg
get_TcpClient
bbOJ>
t ,y
-/uU
WDW@
*5%-/
SCF_ISSECURE
IMSKIO
N757
_configDir
)Y3"S
<ConnectionInfo>k__BackingField
Mb4R+
Qg@8
DZ\W
Orcus.Shared.Core
C3e)
kiuBd
l kM
wJ_4=K
BeginOutputReadLine
+Vr6
Tfg&
L`d{M%
GO~H
'.X?
ZBvB
.2B#c
#"m
&+K-
K?/
Al1R-eC
B[7y
06-i
SHGFI_DISPLAYNAME
Z?Te
D{9dc
.ge}a_
vZ2r
[ n)
f\%
z5QN
GeneratedCodeAttribute
`Q]Q
#^ N
zCA6
wD|Z
`L o
Ed8U
Orcus.Commands.Passwords.Applications.CoreFTP
AzPU`+
TPA`
MWr p
_tG>
Y7OZfZE
CTLCOLORLISTBOX
SHGFI_LARGEICON
@ &|1
et_`
vuTJ]=
SrA7[
C>]q
r!5
;KW^E
jSa6_o
<dGr_E
trM {
Uj+]
'P!
70cx
z'U~V
+i~YT
CheckProcessIsRunning
C\;X
status
uVirtKey
`d:0
GetActiveWindowTitle
set_Heigth
_cqX
&Bq2
!]O| -
M6|j
\ Sj
X 7K*
@O']
A& N
B:[C
get_WindowsFolder
x|G$
JKN*:
G,Ao
ProtocolName
Orcus.Commands.RemoteDesktop
NCMBUTTONDOWN
! x
O9:&
GetCultureInfo
/i *
!g2Z
jU>49qKG
KW9s
set_RegistryValue
kW[c
\~7qK
K#e_
#isrr
aWP ~
s~G*
)Z_4*B
VC'j,
<SendProcesses>k__BackingField
')Zl
libraryName
!|#x}DP
do=Q
7VPzl
U}p[XR
hc1(xt5
S:e@?5 4
IsTaken
]4m\
Zop(
DESKTOP_ENUMERATE
@jj"f
z6Fr
ullAvailPageFile
iO -k
(;
Y9-W
_errorFile
CannonializeURL
WZyA
}osX
F|Rb
:202Pw
Substring
- rK/
DateTimeToFileTime
_YFwe
B jjU
s>c|
}haL
65976E8BC1E21014EFB963E7F0E54D344F1B81A5
n%Wt
Take
9{|`
MDOt
Sb.:
|D+q
pszPath
l(w
pwR {
E /(
<Version>k__BackingField
tMYu
CompilerErrorCollection
ReadTable
<line>5__1
7myq
lpModuleName
ZZ\
j1!~
-"m#
Culture
@YCu
2Qe~
_;]"
. c z
m? [1.
A{h4
:N{d
hStdOutput
m-9b
Qu 9
jT#%
ANTIVM
ShortcutType
5vy}
RegistryValueBinary
m~7o?
algid
TCP_TABLE_OWNER_MODULE_LISTENER
registryKey
Ceiling
;-Ym
jX(9
+-{*
~[o.
)JM:
D!3B
g,g 9
)ioR
5Oi:H
4XG:
Q qC<
_screenWaitEvent
SC_PREVWINDOW
fkXfu
/o [{
Serialize
'2 I
FhCr
moUq
f!g-
nu<~
encType
6^ Nn
user32.dll
ClassesRoot
dwYSize
< 7`
9w
OpenWebsiteCommand
; DQ0iN
->~
ProcessedByFody
1@7!6
,|P?
sDlvE
~}+lQ
V$Q:
S.;&
aNNp
]a_-
IToolBase
xx[%
jgW5:
df&^tcp+U
starksoft.aspen
"|N)
'IRX
'E
GCHandleType
mcxDjq
<&Bk
*k@@G
~$ C\?
(t
TB6J{
}-0D
=JNJ !
<DrawWindow>b__0
>Fy)$ ^
= %YK
LFvv.1
B6Cv^
v~)t
s3"Y
Vt,"
3;q5RN
O Y
ayQH
rEC
SystemParametersInfo
WbIo@
:'V4
)P>#
UU>_
,! 4
Cv}!
=|2]
b._u
tf$UAC
|u u
(B L
y<?F
5.*O
?p3
Q-|$t
|b/u
,r"P
^Cz-
z`Q|Y
wq|{
UNICHAR
L ST8
AssemblyCompanyAttribute
N{Qt
remove_StringUp
RecoveredPassword
Q#(A
r<@p
qPv6
#+@ E
sg%K
@/:r
SetWindowText
set_TotalPhysicalMemory
0.1.0
iCqE5
HP_HASHVAL
jvvxs
WindowEnumProc
AUTOSTARTMETHOD
hL'b:
_Y\R
W;z#
1O&z
SC_CLOSE
0}_}6
5\5^
k92W
<GetPasswords>d__0
<GetPasswords>d__1
Z%iH
NOTIFYFORMAT
"3c&
R;v
[pkr@
set_RedirectPackage
HTCLOSE
jo+7y
\8V1
!Sul
=<%D
STARTF_USESTDHANDLES
Zx\s
YuF
B2!K
2[M+(
9<0j9
b`%0 l &
Zx6
audioEndpointType
_Vae
SetUnhandledExceptionMode
VoiceGender
WinEventDelegate
Exists
A}cm
; wvB
Q>b-
FromStream
rb=L
CPL_LAUNCHED
PADPADP
&*(
SetCreationTime
h2J88
InitializeFileTransfer
IG3B
-E-5-
c#*!L
Ul*J%
CREATE
uYKq
l|mt
6v,t
X I
vYLu
resourceNames
g@ =t+
- ~l
q/3Z
=n"3
@xHK_p7
<EntryName>k__BackingField
o%> L
/\\g
~5)Q
0'3C\
mL_`
unknown
uBW+HCh
{y[9K.5z
$3ys
v9 =
WS0|
get_CurrentDomain
UserInteractionCommunication
JZ?d
4 J&
4j:7
Y3om
~A]=
EB1y
p06L#
>*v7S|qVn
YogBn
C?zO
W Ao
M{9
1Oyt
/y7bN
h2"~
M\(|o
@6/r
t`!p;
J<L]Uf
w '{
%#|[
p+ r
)cN(COE
RegistrySubKeysPackage
;@ Q
Win32api
Control
<GetFormattedKeyValues>d__4
{')c
$!gAbB
rcClient
XSY
<W{Cp
R6N=?C
OnStart
ELK2
bG9Kyt1`
CompositingMode
[!E#]\r8]
es2C
OR$598
X7 Y
!b^*
2kw>
T(\q
WebcamInfo
&O\;
ToUInt32
= f6
I<Ab=
remove_ActiveWindowChanged
~wZs
9 usB4,
.i8qK
otgi
L,g&
pluginReceiverGuid
> 2|
" 9Ai
Slt*
F pn
LivePerformanceCommand
get_AdministrationId
LObZ
CanTryConnect
Ln*?5
Type
2jH0':)
"f$H
PVD=
F:LoVO
m1x/
#Ix*
LogData
jK/YU"uf
TB?f
cH|D
nFolder
qm^[
\Kf:n
set_Architecture
bqVK
HIDEFILE
Q O4R5
set_SupportedLanguages
+4ga6
@3}j
M]=y
)`\&
o50K
TCP_TABLE_OWNER_PID_LISTENER
5-bo
_i@\
~bl&
{zW)
!f:
AwQ7
w8}=H
TakeFullScreenshot
Orcus.Plugins.IConnectionInfo.ServerConnection
> ??{
I*1~
get_LocalEndpoint
set_VideoModeDescription
ASf$
x=pIO
m)x:
lpSTATURL
-|]j
<>c__DisplayClass1_0
my fv
<Monitor>k__BackingField
&W1/
pV g
KjU8Z
HTBOTTOMRIGHT
kI|Q
Sz)^I
s|D<
eventMax
)?Fs>
\VTg
?M.w"
2>K\
yWPC
Qmn\
!gB'
MERGEPAINT
dY}{_
W/K
#f!2
B3L.
b"Xm
JF5N6
X;&
p~5d
?<Sj
*2&=+
T?NoK
1,\W
GY#3
Wy kb
,@+7
p*r7D
o-mo#Km+
&=Wi5m0%Y
lpReserved
0\C
&\d
e,R
Plb }
>gI:l|
sb|B
HTBOTTOMLEFT
~gir
vB}Y
:%w
_currentChatForm
%=GX
K(R
ZMu$
dJ;
P,[q
h#m#qJn>OM
m|D
U+wy
}28~
DesktopProc
ipVersion
,!nd
Orcus.Shared.StaticCommands.DDoS
tGTm
;'PJ"-
}1Gz".
8=C@
5.d
*R5D
m Jb
MDIMAXIMIZE
get_EthernetAdapters
*1:v
/3+-5
EHzv
$ _1
+eZ%
DESKTOP_CREATEMENU
gdjbjp
7B 6
c 6|HH
Orcus_Service
+OtvV
+] >
/0Aw
$<l=k
opN7
#`o7
add_ActiveWindowChanged
XB1L
get_LocalPort
/7 O
BoEV"
OE> <
GetString
TV\e
WindowsPrincipal
OST"
<D=i=
J +y
Bh^W
MY+*?
{c:~U
AForge.Video
4X>[ /5
?TUt
WH_JOURNALPLAYBACK
?[)h
Orcus.Shared
WaitHandle
*{J
DayOfWeek
a Sh
woO3
}_ #Y
Rp9
Button
D DI
gzip
Orku
get_IsHandled
U:$|
YZMg
=iAO
Dv6
~QBOx5:
~DfM
IL]+iY
732u
8_hG
GetModuleHandle
ff'>
Orcus.Shared.Commands.TaskManager
rV9
xlfa&Vc
set_VoiceGender
OZH p}
r~x{QP
left
e=+
set_Plugins
"!_`5/?
3zPz
O!S
dmPelsWidth
jp$E
vZ4T
YhP*
:ynxh
]&zw
+4!td
Cuaw
q [/e
lpFileTime1
dmPanningHeight
get_ImageQuality
SByte
I%jky&
ServerConnection
CreateDirectory
rgelt
FrameSize
StreamWriter
;sN>S*8
|f}m*WV
\9t:
p s@
&|b%
}ZKJ
SHGFI_SHELLICONSIZE
L4ZRaE
E)i~uA
ji1k
K'g/
_BH
_md5Hash
r#H
dIx;
SWEU
QoDJ
w6N^
8jLZ
OLPFZ
FileTransferTempDirectory
e+:ND
+0k*
XwxL
)=80
WaitForExit
'SrFY
b`C
^n
ToAscii
get_X
b:}g
Pi"T 7
>9x$z
>xP_I
H3| v
@VfAa -'5
&5#2j
$3C374A42-BAE4-11CF-BF7D-00AA006946EE
[AtFy
%~B}+
}K>?
HTRIGHT
?H.Gkk
set_ReadOnly
Zqu6
poctNotify
`.rsrc
2qg\
;M\S
Jl e
InternetCommand
'nvB
uy@'
synData
{Ngv
dmI'
set_LocalAddress
}}`S
]:o?R
> q9
DWe]
Milliseconds
uOW6
set_UsedMemory
\Y
'*>"
,MN/
K0}9
q4=/D=
OpenRegistry
4L=i:F?
e~ ~
AudioDevice
Pyfh
[9 Ib48)7
!cYy{
vr%R
o!r$|
@bQ(
c qm!
,/D>vEK
DeleteValue
EventLogCommand
\#OMi
Bbrh
GETTITLEBARINFOEX
\\Di
[ YLA
/JuG'z
iD$p
d)>U
_keyLog
[ k!=
Mm &fw
HTGROWBOX
~h;6T
f^{s|K
m'S,J
ZV`n
?K$k}
COMMAND
uB<_=f
add_ThreadException
I jLRh
mPVv6
AddToAutostart
6]rI
Aggregate
@7!o
registryValue
8AS~x
E ?
:Hk!
Orcus.Commands.Passwords.Applications.Thunderbird
.k^Y~
;9%A
["@>m
memoryStream
{^<(
4]_l
3Iuu
WcUN
0?u.
' HX
K@o
cxWindowBorders
Vs Gi
w[0S
|i _F
fkir
%r=H
x_(0
k IjJ<
guid
0lKOus
| iX
_screenFactory
E! l
, ):x
2JXFG
ZWff
t@(Y
qZ3P
Gj6ct
XC)$0;
WebRequest
encryptedData
l|(g]G
;r\A
ImageAttributes
}y/
Mj=%:
m5H?j
9b_@8r
iBc^
<>9__0_1
E/lJ
AesEncryptorMain
z[;b
9\KE
}_"(
vL"q
<IsEmpty>k__BackingField
^Yj::+s
5tt8
O\*:
LBUTTONUP
b\n\
m "X
D\Ip
HSCROLLCLIPBOARD
P^y
SRCERASE
{"q^2
set_Processes
[1Oa
EnumAudioEndpoints
X>tMX
Hook
5q^4/
*tj2\
y_w5/
tYXy
-,,h%T
cXm=.
-(ZA
6t*yG
fYNWo
kernel32
HSHELL_ACTIVATESHELLWINDOW
Orcus.Commands.LivePerformance
G ;j
P//\
idChild
6zS.)
ExecAction
J5R)
L5+v*
<DataMode>k__BackingField
^_91
WM_COMMAND
ObsoleteAttribute
Bk z
set_MasterVolumeLevelScalar
Orcus.Commands.Passwords.Utilities
r+TJ
Dg K
.E$
XmlObjectSerializer
set_SystemPageSize
get_BigEndianUnicode
)( {
GetRootOwner
EkmT;J
plii
#c] \w
fbc<
procedureName
+1.w75
0 T@
MOUSEEVENTF_WHEEL
9%<'
K|~w
`gJN5
ToLocalTime
J$?g
c$A woG
Tz<
~=E"
DoMouseScroll
rLDboL
HT,o~
SetTaskManager
P;T{
WoW6432
set_State
rk-
ENDSESSION
lpsa
GetKey
get_Now
t}XZ
WindowElement
(_EyL
client
p"FA
uejM
D=Rct$
kl=0
SequenceEqual
l!c
]' w
Gze=
e.2R
KoUx
onR}
set_NetworkInformation
t)at
>pFB
Z Ws
P%m v
33_u
P@E(
ChangeDisplaySettings
G0cu
BKLS
#bi$P
fo~#V
Zc_h9
-Es;
G/^v
.5+7
WDD'{
!,``4L
~&m(
Kn>!!
tP>x
\nq<
udC
+
@3w-[1HV
<GetPasswords>b__1_5
zrd,
ck#t
=z&;
Rfc2898DeriveBytes
udGS
Reset
kq!V
LOrcus.Commands.Passwords.Applications.FileZilla.FileZilla+<GetPasswords>d__1
ACTIVATEAPP
\U}5s*
tfYh
GetStaticPerformanceData
TmJ
=\;$z8q?
`I8`'
System.Runtime.Versioning
set_ChangeCreationDate
FPEZ
shlwapi_URL
GW_HWNDPREV
1 SK
/ (Z
%`G+
IconSize
set_MaxBufferPoolSize
c7%1.~
BK5
<IsAdministrator>k__BackingField
L]R[C~}
-3sR
#mH`
%qcD{
RegistrySubKeyAction
hwnd
1w0h
FileVersionInfo
q-|<1
TCH!@
nYDest
MOUSEACTIVATE
{D F
B2:7
f+hf
%aHl
S kt3
czxV
{dyd5
YW}^qO
:u*#
System.Collections.IComparer.Compare
;b.Y
*anXB
FilterInfoCollection
S$NR
Rn>G
Ep 8kM
TxpZ
m!z[
set_WindowStyle
aA@[
B0rmc
oJC4
^!q7
_fileLock
nullCache
^OGT
!m$
A4SP&
M T:
yW]}
Z Y*d
GetKeyFromContainer
MENUGETOBJECT
f6kYI
NM:
E&Q.y
pDjV
Q TjiY
Ik+g
lpChar
(p0/8H
oecq
yzBK
64O>
#Strings
+ j"M
k:_m
tGlSM
QUERYENDSESSION
<;&H/
N =]l
"g`G
<GetPasswords>b__1_3
Q"]<J
QbZL$L2h
GetWindowText
vV5N
SMTO_BLOCK
[ S5H3o
; /'
r U-
R?^gz$[
4!Si5
JB%Q?
*OAtFy
l[ ,
J T}
P?
n-b-
gy*q^
qN~h0
FreeLibrary
Registry86
right
`cc/
jH{PC
"aWBQ
i,e}
B _H
ewKV
Y!q,
Cyj
2h}p
PK11_Authenticate
yfFD
[)rL
30(2
Matches
B n0
=3=ZH>y
M2y;
1![
set_Data
nOW 5
EnumWindows
93 6
<CommandResult>k__BackingField
_renderWindows
iThTt8!
bO#\=
6 yJ]D--
Y>?#
QeF
w`.j
set_Mutex
' dB
set_RunLevel
-Yu-+
uP>D
{x
! Fl
%- &s1
6 z
KSq>
GetEnvironmentVariable
{Dtn
;_ YY
^M!E
System.Security.Cryptography.X509Certificates
`uDZ
d*oC
PU34T
pG0km
%- &s"
%- &s!
]5]B
.),1
$XY
ok$G
hrC M}
icon
o.z:K
b|W
g/0)
ov &
dR7.
RNu\
ToInt64
Qe;~
t4gJ
}}]'a7q
q&db
<wx
b!bK
c]x5
0MEf@2
System.Net.Security
f ve
}} ]
_serviceConnection
fP0a
KillCommand
KCc"
&FTv
threadId
+;d5
RegionInfo
62zuHr| rO
{0RN
hwndOwner
iLd{
yti mEAX26
s^ .Mz
<KeyLogFile>k__BackingField
/e6-
jGt/
p~* 1 4
Orcus.Utilities
Windows
Mg}:
J>CWu
j5g]
NCRBUTTONUP
'kOp
dwNumberOfProcessors
taskBarWnd
KuK7
set_OSType
Lt}z
]3QN@]
sProcessName
F+@X
NOTSRCCOPY
p 1J
<O!W
}ecGm
x*k&
}bpO
9$g=
xaI[
bottom
_pSize
]0||~I
LmL
$s -(yT&
+U\Sn
<GetOperatingSystemInformation>b__6
HSHELL_WINDOWACTIVATED
<GetOperatingSystemInformation>b__0
<GetOperatingSystemInformation>b__3
NRMB
\03!
Hn&1*{y
}x|UGf
t\UdrR
SY)UP
KeyDecoder
3MkC
<FWD
YRl}yqz1i
?:Aot
AssemblyProductAttribute
dmDeviceName
SetOutputToDefaultAudioDevice
<FWJ
vO/X+
.>rA
`(3T
}/lz
^yiI(L
-+0A#KI
T,%b
MVcL
TxHR
screenNumber
hri|
UriSchemeHttp
#Vu+VSb
'Yz~["
NS3<
HSHELL_LANGUAGE
FW^Q
S;i!)
yTdf
}sOf
H9 :/
fe5z
y$bF
VLW/?
NewCommandType
ServiceHost
0jK-4
TQW
tg(s
PhysicalAddress
Orcus.StaticCommands.DDoS
Z?T=-C5
e}jS
I_{\X
#! 4
get_URL
2?y
F`z
R[%m
Orcus.Commands.Passwords.Applications.InternetExplorer
:g)E
dwExtraInfo
HN"~
@_jgT}/
&Bn*+
Ne/
!>'s
~&KBp
;vW:[
<>9__11_0
x]a"Jn
NcxH
z}GN
6|\k
_index
3P\$
BitConverter
DO>[
>bBZJ/
_VQh
HTTRANSPARENT
[w`L
N.B: b
CSCore.SoundOut
qyxT
%- &(
&Xl:
k]MD
PK11SDR_Decrypt
<AddToAutostart>b__1
G@<+M
)v,NQ
#NM6
Height
p$Cc
get_Second
Q'X
ProcessThreadCollection
aLVS
v-J+^H
m]~s
lX&z
?szY
NZ'O
gUkT
fv\ :
EVjtu
asyncResult
#|CG
<GetAudioDevices>d__4
IME_REQUEST
H]t)6
ofo;
<FileName>k__BackingField
;9r>
87jp|
8O? t
fNWS8
!yv!
V.4Z
STYLECHANGING
\Js/
~@(M
JEP
Delegate
!iwi
DISP_CHANGE_BADMODE
9wI|]
R3g&
get_IsClosed
%- &s
fb(
*;`Y
*@U%
15Ya
/v.e
^ |
6uFO~
windowHandle
KG Y
MZ6X/A
get_Timestamp
|':_VK
.O"1
[8uNW+?h
_j5+y
uaJj
v"Fa
6H*mL
k!{ {!7@n
DESKTOP_READOBJECTS
pbx0
TP\uW
l"~c
0shA
f0/t
_masterTableEntries
ImageLock
c jl
eUp3
!K7D.
)Tw9V
/4C%
cX=U
Orcus.Commands.Passwords.Applications.Pidgin
;2\$
qV]R
<CurrentImage>k__BackingField
R"f
get_Bmp
%oF3
So|9S9
`3`'
x^5"<t
BWc[
Q2o,
l'PA
Y)`h2O9
8i X
IsClosed
8WIQ
m-z5T
SIZE
hH?4
GetTypes
Z[=B
E'&%:
VideoCapabilities
icn3
T~&"
"KW|]
^&8h
S$S4SnS
Orcus.Commands.Passwords.Applications.WinSCP
MDINEXT
:`N%
GY]k
}6GmtQ
.E{U
GMs|tuL%
dio[c
*! PeN_
set_RemotePort
h*=?
vU*Mx
3/c~Qcr*,
b7V},
v(YI1
QUIT
*NmrN3,
CreateValue
_wn
Yl%ny
V*3M
,Q;dZ
j]_J
XvZ6:
BESn"4
U.$4
5<7h
2i7kb
U'Vtj]
s sd8
sYA9
yx{B
X LJ
j,Uj
riid
\zKN
K^\m
Contains
y9 v
efNk
^3El
{2SY
A`7p
get_Channels
) ID7
mmcJ
YZ.H
?>RI
VideoCardInfo
HkKw
p6`Q
B8e=
M<e?*
Z-_BFR
:2<|n
ValueType
SS?l
!j7-
System.CodeDom.Compiler
7+z,~
nh_]
V~:[
exceptions
# _Uy
OAx
|,n)
]l w3
GetTickCount64
Jd #
Q&6>
|!?R
)J F
ggJ!
set_Size
% @sIM
:Y K
sVS)
&::{
fo0>
L$68
/z[Z
_+Q(z}p
\vgo
Y2AS
SR|_
nx%3
2<@O
, {
RegistryKeyHelper
Z3=
bInheritHandles
?@l8G
CxU-
62'{
xnSN]
@3R%
|F=G
u[}S
localAddr
xhJ\
! Y+
J!N qR
GetValueKind
\I &;
#PZmn
]h/
jR&6
get_ClientPath
Rm NO&
[!O@
5 Cc
FF=]
@9r{
Ry!~
xKkUcM
*jpA
?$~')pE
~R}RET
z~-6
W}xzOVHAd
;L$rGhw<Eb
devMode
wsIuU
0Opq
N"L
03pz
window
LN'\3
<ServicePipe>k__BackingField
s]?eK
.Ro"{
MA_ACTIVATEANDEAT
-Kh/:)
ReleaseDC
5Q 4
2%b^
o8S!
get_ServiceName
!n#N
set_ActiveControl
get_Version
[#<5S
entrySalt
'ZV4:
SETFONT
ToString
H "M
9BYF
e}H
qu;*M
SetCursorPos
oW5*
PROV_RSA_FULL
4oOb
7taT
YkP|
\ g
get_Principal
#c%
Parse
<>9__5_7
Z@ d@-
` `W
bScan
set_RedirectStandardInput
/" (
uz0{
set_SmoothingMode
%g x
add_Disconnected
ZgQ\b
WM_SYSCOMMAND
KXKyK
oR>A{
ReadOnlyCollection`1
3Q?9
&VkF
ResultSender_SendResult
SendBytes
lQ6r
@,b8=~
AudioChannel
ZTy[d9L>
+%,&-M-
fMa
jH]!6}
tblClass
GetLastWin32Error
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
D,y7W
5-6|6
DebuggerHiddenAttribute
4{.X^&SZ
ActionCollection
)$*!Q IJH
p] 7
& ?
/da=
=\Za
MDICASCADE
<IsChar>k__BackingField
get_RegistryValue
Kt|L
;5'=s
>TBv
_udpSockets
args
p0t8|[
n 0
,X|Xu
[{"A
StaticPerformance
]<65
Ptt9
h?'v
i!c_
t)[QO
M4W;5
'csr
hObjectSource
*A0Ih
ZT/u
aW Oa
<GetHardwareInformation>b__8
Xq7+>[@
KE:4
0a?s
y$<;j
k=^|I:;
_|)#5S=
*G8N[
<GetHardwareInformation>b__4
EntryType
<GetHardwareInformation>b__6
<GetHardwareInformation>b__7
<MasterPassword>k__BackingField
6>4'
0v0F
* h HQ
set_Lenght
8\Ldr
/ @7
`7xfC
AK}/g}
7<C%2Z7
!0 R3
yHs_
Combine
HCU_
!p$
#gK>
message
PasswordData
gR]
!0 R?
<UdpSockets>k__BackingField
Iv8Y
{87\:q
5HWQ
u(Co6
n_:}b
\mEg
F% Y
,^=q
jcp2~
HSHELL_TASKMAN
Q.diJ%
sFc_2c
ENY9
=~.
"Doi
; -d
gz\l
Response
[x1%
RegistryKey
4xgc
`f|d.
DontUseHash
/E0R0
get_MasterPassword
!l P9^B
<),&
GiEof
Skip
AvailablePlugins
y[;^
^.]Y
@\AkMu
tcpClient
G {r
_readByteDelegate
u4lEk
IM-
5KzdM
; -.
.ctor
4o9^b4A
IsOpen
8BsT
GetTotalMemory
V;LK
+u z
>Su>S
L1]\
rY1o
uzrl5
get_Message
r,<E[=s
+ayN
p'>vx
VncMessage
$g0$
Y)F#X
:P76
c.\
5E}
dwSecretSize
Main
WCF_MOUSE_CLIENT_TO_SCREEN
A4C"U
get_Rectangle
pr?k
=!"A
get_Text
HttpFloodCommand
GETICON
Ad_S
Fa./0
iRll
EtsCdh
SendOrPostCallback
FromDevice
' "s
0ZaO
9@Mi
L4,i
S*9@$
4hic
U?R3
v4.0.30319
File
dwOemId
{QtB\2K
set_PixelOffsetMode
otP.pFU
S'z7
E-Bl=wS
2q;;
FP >
FO{;f
MDIACTIVATE
)*1HN
System.Net.NetworkInformation
AddUrl
9nR~
W^du
lpSystemTime
#&gk
LZgXu*S
#&gi
V|-5
<>9__40_0
\Y_k:
`}zt9
v}Am
Ep/2
jy#'
XFM
uy{w
X&SI
AqOdk3
U&smC
Nb q
lF~co
Uf4&
get_IsEmpty
9[Dv
_clientsLock
:=.P
Mm7B}
Role
+/v
3.7%
HyK5z
KGu%KS
wt 7
J W]Q[
4bv=
y7gX
V EK
U|H#
W[*Qw
i<`[c
set_VoiceAge
NetworkInterfaceType
WriteAllText
zX?+
nCode
5w\C
2w1N
Rvk8
vl:
get_PriorityClass
awx
|X2\=
P9M
R:Kb
C"pdHg!
IServerConnection
't8AW
.w1E
S,n#
!6_1
<41}yG
7|y
FieldInfo
yi.`
/+'&
NM8=
:"eg
1^paL
S:s)
E=Y@
q[-q
#B1#7
7|Q
Zy ~O#
CAm(
Uq'=?
hetNN
{Hn}
KCfgG
pelWidth
^]Tz
:D&M
*.z1J
rUR~
FT(.
d g
get_ValueObject
@Bpl
^{ z4L2r
p3LLb
Zs<j
tzEs
N}8`
eO.8g
]O/39
gQ:?k
clientCursorPos
oIP'
But^
Bpb[
l %
HgS,
?o]
W]bS
RB>%
Z-.h]
i7W.
Se&st
WL w
VX;
i_L\
WS_POPUP
inLen
K2Oe
Target
~1fW
4?L#
LE-g
iOH,
uC}
6@Yw
GjO7
, r
CALG_MD5
$7^6
Dek +
;71{|
set_TabIndex
O:$z
?C ml
7L} k
{:]Q
SpeechSynthesizer
DISPLAYCHANGE
8wN,
;/8
SC_ICON
|4 s
%LyE
get_IsSearching
b=yK
SetDesktopVisibility
bQXy
<,Ls
<nCx$
NetworkStream
set_Application
?v^{
lpszDevice
e< {
uMapType
P:k\
FileStream
ooD"*}
`~Wt
+HAE
m, jK
msvcrt.dll
!Mhv
%P@B
xg@[
_keyboardHook
:q/H
l:|
H/i@
gl4WY
D"Gw
jQW,
RerT
pUrt
RemovePrivateFiles
gCz!
nC+
lpszOutput
m&!6
globalSalt
LoginData
O<./Z
<>9__29_0
m/sKF
,F(q
ObjectDisposedException
wP?XM
iiRj
R75`
Socks4ProxyClient
g^IT
ExceptionsAvailable
yzX
{(fin]
>|.<
yD;k
c0<n
Td \
:W V
I*I#
H4oii{
Y8 V
9*kg
2/ x
']_/
ReadToEnd
=6k \
~>h
b:y'
4O%5
NCMBUTTONDBLCLK
p-px
prGM
!Z6x
8I8;
3?B;
:c+P
*0(*
D
b _?^N
Orcus.Commands.Passwords.Applications.Thunderbird.Cryptography
oP i
3*N:
2\E#o
F YJ
P9ge
CO44
;g7
^c>{ok
A7f|
kRuf
x]O<
NewGuid
.Me_
PE9:
39TU
#Zn<K?4
D EMEhE
;09z m*
R`-t
p`+l
HMACSHA1
WindowsServiceInstaller
mo&y
Hnk7
IpAddress
<>9__22_0
6z[;!@V<
hMod
=I<$
LoadablePlugin
B'>.+2
:v !
`;<t
.szDT
DoNotReposition
NoyB*
CreateDesktop
q:~I
<PluginsDirectory>k__BackingField
lpqzdClV0
1'EE
%RY G
J3+NM%1
>sf7K
F7&R
kZeI
H iCc
qD >
!}[#
@KkwD$
#l l
<>9__22_2
Orcus.Commands.RegistryExplorer
n8=pz
_keyLog_Saved
Dv 4
}-~z
6n"%U
HTCLIENT
Eu^o
&\wQ
3P}w
Ct3n!
Orcus.Shared.Encryption
F@DS
WS_DISABLED
N M1
"\T`
;w$
;/%u
set_ClockSpeed
ComputerAction
_urlHistory
x6AF
4@\I
up@5
ReverseProxyClient
WwH?2
>IS@
HvncActions
speed
h,rp
.5RF
lpString
^zz)
dmFormName
GetPathRoot
C7h*8
_ R_
[E}
6 }d
appPath
eSD
QT7t
vFz~
Orcus.Service.Properties.Resources.resources
\U.LX
mU?Cm
t+ts
WS_CLIPCHILDREN
get_AppContext
F/qQ =^
DWMCOMPOSITIONCHANGED
L1x\
e7u}
timesUsed
>$/K
X*2)
C>u`
A\+)r
%r1:
5z2w
^G9W
&'`c0
!^KPpm1
ExtensionAttribute
]QeA
@G=]
o1v
Show
g|i 9
*u1+?
7 x_
M65Ka
]T-X
get_CultureInfo
CCz.4
n/?07&7
G6"
AesDecryptorMain
P5'}
dt.u
t6dNO
b(#H
get_IsOpen
x["X
7&g\
v":y
.|7-
j-E
ArgumentException
so_DF
System.Runtime.InteropServices.ComTypes
=#a'
^bGi
responseType
4oA.
Vd5
A\z*
d1cr
^:Q 4
xYS)
sysListView32
pszUrl
<CQj
CTLCOLORSTATIC
9NO
tix
<>3__mmDeviceCollection
t580
IgnoreResize
)@[}
YE\.
?s%R1
|b1W
!?@
NGW
dwFlags
$P h
`I]mJ
h!Fp
<>9__1
<>9__0
g2V2V1v0
<>9__2
9FlW}.f
session
rw?
get_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
dmBitsPerPel
#Dz[
RemoveFirst
mq}s
Cjqg%
<}
[?A
set_VideoArchitecture
<ProcessCommand>b__7_0
[Qhx>
sNo6
@`34`-
asaH
CeUv
FLsj3
;;k]
.'-=
4=*W
stM
add_UnhandledException
J>gUJ
P17Ta}
H6OZ
l&^rY
7{4M
Yl_p
L 'T
GetNetworkInformation
P2,"
z;p0
DoT(
yS=$
M*=*
/n"D
&P/;
F;#)
zTm<
JL+;
defaultValue
LoadKeyboardLayout
HttpWebResponse
'~YB
;#k<
8LuA+
rdQ9rU
&ne,
_kY%
"dHX
get_HandleCount
%l.6D@
C?+e
^uZe^
get_LogData
PlayAudioInformation
UNUh
X509Chain
j;l<+0
lhX _
NvJ=
set_NtVersion
<RegistrySubKeys>k__BackingField
9&bS
O2j%\
Ux&O
'B']
Ktzk
v,3j[-BL
0vh`+
U5~A
w R6D
w5*!
~gv
T{#)J
DownloadString
])Fr
]GL):
e1[u
RZI0
e%UMj8
#M5u
PJ0>: ]
" aE.
!}u
*`)]0
xu7g
BJ O
H}5B
1=8{K
<-;H
* ?
3pY"
fITBNx0Fiv
BSJB
8F 2O
e;w~
CSCore
)JM*
j@GS
3 ~#
7;0Wa=-5W
Computer
hs)
B{L\
_deviceList
Second
I";D
g} 3
LfVF
IpAddressInfo
QFr6
Lc/\
FO8~
.XRk
]oqR4
GetHardwareId
_-6
Dr*
60VQ
'9E&
value__
TaskActionType
+!?o
D34_(
[ ,'&
6%kw
j wY
5~ 0
~Ivk
/0h
c7I"G|
FaNIq+
)QMN
5Kiu
q O]P0
4eZL
z$v0a3
ToolBase
)=E<O
Fsi!
THEMECHANGED
,\Ay
/=sG
6:!e4
:o29
5 ac
r' :
\xpl
$ZO{
^F^8
QQ3+S
Qo_h
SocketType
n:=wR
hzp,
l[qM
{Qk5
M]7^
<subKey>5__1
;&f
ResumeLayout
>lY@
^~@
CancelEventArgs
E]4o!
gp x
IME_NOTIFY
]NtTZ
chain
"6[c
AsyncCallback
ComputeHash
G3G?GXG
$:VV
sIF{~
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
lr^E
|F\l
eZMOjwH=
yObD7
get_Year
Nt1,x
set_ProcessorType
Xu6q
+eA'uwJ
!<EM
_stringCollection
H2Z'd %GF
A4Qy
[G<4
?&J %
Refresh
?H'Kc
{ V
Orcus.Shared.Commands.LiveKeylogger
w'0r
X h
DEVMODE
KJYU
3k/5
set_CompositingMode
[`G
JF~F
94C<
[0 %wP
1!DT
a&{ Q
l `E
Y;u@
yk8z_
QBN<
c0G
`zp
Ql*U
<>2__current
PROXYOPTION
JM;Hcd
add_Stopped
.[{V}yM
& El
)=z=
&i3t
$= [O\
FILE_ATTRIBUTRE_NORMAL
JTL~
get_Oid
<SynSockets>k__BackingField
pwcsUrl
,8cP
TJZx
get_HideEveythingElse
set_L1Cache
uxy
uh?U
MC?
FT?R)
L
g_e=
LogonTrigger
*h@)
qa(
get_OverwriteTryConnect
FmPs
()1.O
1 x
!|PYv
x'5t
'#c'2
ctO1
UuZI
V)?9-.
<a5@uN
PRu;
ib?P
% },
3mf;
#1 4
#f>3
profilePath
VoiceInfo
qz}J
SH;O=
Orcus.Commands.Audio
0P-c
RijndaelManaged
"9 9%^W
L?,Y
gODW
|N*G
7Orcus.Shared.Commands.Registry.RegistryValueMultiString
set_Monitor
:b{h
Form1_Closing
YN/
fL*##=
EnumChildWindows
c1W.
Py79
.&qd
ExyzO
<Ib:
(C
(B
?e:Gr
~pXS
get_ResourceName
w"}t
RegistryView
kK|i
me!]
IList`1
-'Ad
0| {
p-dY1
cButtons
d'Z,
N[;8
ConvertToState
GmQ2b#
8va0v
(e
'[/N
5 .z
Ea3+,.
_OHL
\zwB
6}D<
i&jG
kpKc2
@5u3
|E",A
StreamReader
<IcmpSockets>k__BackingField
B$~L$~
`J f;
YP
k}l=_
IntPtr
WIH
MDIRESTORE
=QpUspys
chR8
d.wE
}5HCAo
O<!'
get_Elapsed
X?- n-
})#v
wRW
`4YtH
b9fP
7z{
C ~
skOi
Y)g`
'g n
_disconnectIsSend
BinaryWriter
)LRN
(1
&zuq
Uiq:1;
<Id>k__BackingField
=|i%
GetInterface
^r(,Eb#h~
&}Cs
q3{k
- r
\$]"
?&J y
d<: O
cHok`
b~7$E
@=lX
wProcessorLevel
*!W
-P(R
GetMsvpPath
<Connection>k__BackingField
l wW'
nEPk
HSK.$Z
utnt
{\H
Orcus.CommandManagement
AddServiceEndpoint
Oa`$
*|f9|
!7 i
plrf
Rp4M
15];
\m+w
wndHandle
JrYW3
get_ActionType
}-'F
(mN
DataReceived
UnlockBits
?]yh/
set_IsLoaded
'eNL!
$CC]
p}4W
[.Pt
KyS
NI}6
?SyL
0#o]k
*[3L
.o,t
)yxq
HjeA
UDP_TABLE_OWNER_MODULE
ManagementObject
3yO
x#)u
mscoree.dll
n'q
D J`,=
FilePushRequest
DesktopHandle
Vh{=.:<[c
5Kbl
k up
<LoadPlugin>b__23_0
'b{ 7
Func`1
ED4{
^Ha4R
Orcus.Shared.Communication
set_InstallationFolder
NOoN
;{ 5
pS ?)
02cfqu
U#]}+
<GetHardwareInformation>b__3
":*c)7
J"b.m'
;uY
n[ [
r1ta
k8=B$Pa_
2! f
K|xN
r~$
1Lme
#')-F5U
N q9
FromArgb
=I2+
A$3l
LK+jEv(*E
DoNotCopyBits
TextInfo
A#xNU
F36r
1\Lm
h+Q':
/lUW
\abd
:Uow[
di<}4
VzMu
5mO/
<>c__DisplayClass47_0
set_Handle
Cw}5
\f<_
get_Key
,d'T.
y%</
yaWb>h(
e!Fl
O=eV
#GUID
*l5h\K
+q1qFd
Peuj.
}U$z
UN89
]vv0g
A 9 t
PYD:%Z Yz
PALETTECHANGED
yvMI
set_Ipv4Address
SC_SEPARATOR
_x[_
@9`-
H%%>
LHy=
q+Mo
* x2
$n07
add_DoubleClick
wNjf"T
=aC_
X ^
set_BytesReceive
8z$n
get_Scan0
!{M M
r a6
WxeG4
sZr\=
q)(2
e<lN3
,FR.
MIN_ALL_UNDO
$K O<
':#K
@$P\
sqlite_master_entry
gN=P
7pY I
!KE
tkZ FQ
H v[}
?F<c
nG n
GetManifestResourceStream
GetIconInfo
Hour
X:F=
*B6H
5~./
mx Y
=w:i]
i5X@
k G
w[*"
A:M3_
@9`~
)$1^
Delete
FG}b
xpNw
zhiXbo
6`Lq
R(~
,zFZ
R}RzG
w&hbr=
B$0
gsyv
UZf+
^c(:
vw:r
_tableEntries
[le lB
TcpClient
L(9:G
QBQF
%T{V
=? E]
+mo
#>7E
t,=iJ
E,Jc
}P 4
w8]zXdd/
NCXBUTTONDBLCLK
@q_%_
?sl"O
iqXM
E=E0C
#idv
8>8ip
CTLCOLORMSGBOX
%s!
43=Wv
O3 !
%s*
%s+
:^{+
JFS>
RecoverCookies
9G]l=
%s2
WS_TABSTOP
[P|K
wuI+
%s:
changeCreationTime
+]IQe^
PFu~
O.*GL
J}Z q
%sG
%sD
S N)
ES=r
(f{h
SetResolution
%f-r
}n=|
%sY
%s^
TextChatCommand
<GetHardwareInformation>b__9
-*s:W
ASq&
SMTO_NOTIMEOUTIFNOTHUNG
JpgCompression
SendIcmp
hDDP,
N ^
rq7
]"ouV@
%sl
=5$CH
{Wr?P
WebResponse
WindowUpdate
set_Length
}IA&6
E'@T
SEL(T
rEbn
set_EntryType
builder
table_entry
set_ServerPackageType
Ez:*
q;kWmg3
Re v
NMSEM;
M";P
*^p=
get_Bytes
)I \
Current
<+CI-
Window
W@)"
JVS3
pDg
*]Qu
6v>x%
get_Ipv6Address
M~BpX
m h:p+
BEA=
IDictionary`2
ywft
7SAj=
:kL%
0$h)^,
or1#
CreateProcess
cOK40+3
set_Title
wcv^
X(3
ltuR
dwFileAttributes
sEIVk?
OCz&
:!2u'"L
SPIF_UPDATEINIFILE
Vy1L
_lkcS
add_Saved
}S'+
mAn
T#?z oc
yP+2$
R5HQ
HEOO89*
_keyboardDelegate
8M}@=
9&`J
7\n>K
H&/I*
drNvx
g3Ya
UdpFloodCommand
9i-$xe
get_Properties
O6|o
@Ow'
;9}V
1AgE
UdAo,
%q)*i
GetDlgItem
aD4
GDvtDd
MOUSEEVENTF_LEFTUP
Ij8=&I{
s!; Q
WS_MINIMIZEBOX
o`8~
packetSize
Orcus.Shared.Commands.Internet
<ProcessCommand>b__3
Lzf
s,#g
i(wu
JJ\8
UPDATEUISTATE
9mZC
=+nnnl
<~E.H
set_Screens
ToUnixTime
b 3
US19%i
,wBX
B:(n)>k
k-2
!@*`O
4l__
, (
ToUInt16
Mx.#
h%~J
kQ(M
PAs&
'?id
{P{j%
hwinsta
\k$$zjf
E$R7
pgAY s
^CXt-
WriteFile
:)3)@
KAcww4
get_HasExited
!oAv[n
8-M[
get_EndOfStream
E2M
m<F>
, r
Connect
System.Configuration
hoB:
3]<0
SHELLDLL_DefView
get_CurrentImage
$?R
-:ih
\r[N3
g\85
2ugI%=
"!.l""
<>c__DisplayClass2_0
ApplicationSettingsBase
set_DriveType
~"Wu
<IsHandled>k__BackingField
SwapMouseButton
KeyStr
channelIndex
22b&
poszFilter
!6p& *
Tz|C
h4LQ
[NqwS
-GWS
passwordField
-m+bG
WS_MINIMIZE
l3R8
nWidth
@RhIJBH
MIB_TCPROW_OWNER_PID
!eF#
)_*|Cc
Ym1}`n$
*{ :
x8g3
ReplaceCarriageReturnsAndLineFeedsFromFieldValues
M:RTc
PY ^%x
p XP
d<2>
+i6P
pdwDataLen
\6B)
;&Q
HvncCommand
GetFiles
Message
7{H4F
@'2'
s@8L
UNINITMENUPOPUP
igKA
8EKfdy
wD#
p:t |6
V]Sp
ThreadStart
:L1`
e*kJ
P!l0E%
jW 3
tjOi
EnumThreadWindows
v=a\
`!3I`
Y#;i
<Oid>k__BackingField
n'\&
jkLh
DLwW
Zspf
9we/
SECItemData
,4Z%
set_UseShellExecute
"Q*5g
NOTIFY
UserCertificateValidationCallback
hW0;
'oWvaA
<Threads>k__BackingField
JkVZai
&9(O
r/Iz
EXITMENULOOP
[+=)
D/J;
W[Lp>f
2-njx'N
TryPushKeyLog
fy-<
P?6
get_IcmpSockets
FilterCategory
SystemIconToMessageBoxIcon
$%t*
a"a^I
@7an
get_White
9>NK
3/!
,+P?
VS"n&]
U|2F
}g&3
5c~S
J l
A;9N
<BinaryReader>k__BackingField
Orcus.Commands.Passwords.Applications.InternetExplorer.Native
TurnOff
wJO `
x<8
kms]k
r6Z-
TB0vu
[^R
|HAV
Z.RJzw"s8P
addQuotes
}b+T ~u
Append
Lv +
SC_ZOOM
V,P^
W EF
7nV8
*FLs
'jb%
g :H
snX):
.qB|
EK(M
InstallerCollection
$a&o
9c`
5<WNvf"
get_Salt
_desktopLock
agbgg
HSHELL_GETMINRECT
Z4Ww`!"c
|dq}
n @{H
&o2
8lc
N[i+
{ *Z
INSTALLATIONFOLDER
3@ V
,\`4
!o(gE
MF,B]|
lpProcessAttributes
<} x
'bG
PropertyData
z";I
PlatformNotSupportedException
*fs
]0kD
xMSl
u)u=w
set_L3CacheSize
B._C
;oRvo
TriggerCollection
[};h^
StartNew
ZiTV
Y)e&
DownloadFile
T%Z=mS:
#e$ ;n
Session
k O+Sk@
Connections
@n$:S4
Cw;;
lpszPath
)Rmx
!#*E
$>">)>/
_synClass
set_Cores
cy==Z
user
XGlP
*Ot7Y
T@K@i
ThST
<>9__4_1
Users
\. +&
ProcessExtensions
set_StartPosition
:i +
NULL
!M !
iIcon
cbReserved2
:ela:
xX+<z
q z`
$ [JISha
e"3M
<_client_Connected>b__6_0
BF<I
IsRunningInVm
VKEYTOITEM
:5nl
ReadInt32
_videoCaptureDevice
RegistryValue
I <e
^aOu
/M"s
f@ }o/
mq9M
gV q
=Jyk=E$
_lastWindow
P'eF
g[~{
f<qFx?;
processorManagementObject
5y|=(
0&: G&
:2f!
zRoN~X
( }fkKN
ggbx4
';=?
b< 4
eucSs
Z P
/3z``
Pr&"
aFocF'1
SendPermissionDenied
M]Ma
get_IsChar
,X l
Hl}2
.en*Z
+ (1
tl)5
IsWorking
p?qMSL
get_TotalSize
K$N#
P3q
]eG
V[ p_V
i)]b
I@Eo;g
\u;`
J6-P&
HQgX
Mc<'
q"Sqb
lyp$
;[_
ZGS+
d\N'K
mS>T>d
XX+.
]qii
ho<R
5ERs$u
vn=}\=
Ybbj"
.y&o
<>c__DisplayClass37_0
ATc~
PZAvo
e(x
NCMOUSEHOVER
ziI_v
iDKcE
vq"A
8y <
+cY*Pn
SC_MAXIMIZE
[v2J
=?kA
RunInstallerAttribute
get_KeyLogFile
KExX
x $i
Rb7b
ImageLockMode
!t4K\]
(`B2
KMJ{KG
n* yz
g}yz
set_Visible
zq q
LivePerformance
(9Iw
w^ 2
get_GraphicDevice
#I 5Ze
q8tb
H{<E
o{<!
Gx"!s
(V^3
2)n9
GNdB|N
rz"<
Dne~,
@w"3
Lc-\W
l< <
mYT=
j'_hw
SHlo
S^,KfM
\.WB&
SHOWWINDOW
STATURLFLAG_ISCACHED
QGWxo
.QM2
Ux:2
get_RegistrySubKeys
Y9~jVN
nH+.
~UIy
ClientPath
kH<B
:5$-
A[E[
0=53?
get_FileVersionInfo
.XBQ(m
=37%h}
`pb8
4^8u
RENDERFORMAT
(?4C*
6%/{
HvncDesktop
l)F%d
F2%_
Tb:1
<GetLogicalDrives>b__3_0
E2~G
Hm$.
r-d
n6T>
vp?@
QZ-6
)\22
=-`k
Keys
Q]E.%
^u<|
UnescapeDataString
type
/>cY
)sJxZ
CopyPixelOperation
WL#V
Q[U?
set_Oid
h5zvw5v
: -b
}8,x3K
System.ServiceModel
>3[U
]7Z8
cFo/}
n![r(:Y
3j#S
_F\{
F.K
9Ith
set_Values
<._+
)Pnay&
isMouseDown
hookType
pZsc
jW1J
SendLogEventArgs
WINDOWPOSCHANGING
,5(R
rraKi
Orcus.Commands.Passwords.Applications.JDownloader
9JS5+!
L 30
B"&
ak%ZY3
<AO2{{Q
get_Instance
@5nZ4<b
m.R+
?L(L
CheckSize
.gP=
K9I:
PF&
%(J
t+n9K
#jw 5/
%(C
%(B
m$&g
SetWindowsHookEx
SendButton
bOjb
RsaDecryptor
<Commands>k__BackingField
0y[|
AFXLAST
ky }
Zz%Hw
%(S
)KNC
set_ProcessMemory
>_/[
$74K
DEVICECHANGE
h+)z=
6/x
ClearHistory
set_CurrentVolume
Jjb87:
\lX$
~qKH
k=]a8
odDM
_duration
`)HK
get_ExceptionObject
FX-d
'J fpv
SG,sIWDZ
<>9__12_2
D }kx
&W$
r Z#
z=^6
p^oC
N4n ;
hi*
^U?a
DEVMODECHANGE
d#x%
=o -
%('
%(%
%e=J
%(#
%("
= P
KL,*
uK_dj
'H`2
resultSender
,,ot
Cn&/1
co=>
PasswordCheck
get_TimeGenerated
DataReceivedEventArgs
%(1
-r^rT
6G>3
?g}Z
eVK 1b
`*&Id
*Ad
;Xn'
[u}T
_unsafeStreamCodecLock
Remove
GetNss3Path
InternalPushFile
YlCJ
<~C>
zSk~
71 ?
Z usvD
SYSDEADCHAR
C=jU
Registry
5~`;%
$'a~
Orcus.Shared.Utilities
XmlNode
S2GH
+M
GetFileName
+3
ComVisibleAttribute
\|efvj
hTT@
octv
9.n-
set_UseVisualStyleBackColor
K8dS
2-)]
)h+`
;i#_L
ReadExistingAssembly
VT*-+c
^ 2U]
!Yo2
ServiceProcessInstaller
PORzf!
xkC:
^r6G
hModule
B4{.
hive
Xjxo
Zz.!
VwY?
AddrOfPinnedObject
adnOnz
O+ zS
v7HL
v-Fbh
`Kx*
fVnE
NO3;=evz
fr /
<Key>k__BackingField
B=28\
Dh*F
V Vpm3
Vh5v
b 1=
82&R
GetCookies
<>c__DisplayClass5_0
AesHelper
-'Pn$
[,@Q|
i-aK
,0J!
celt
km-S
.#v i
s9ez
`B3L
NCRBUTTONDBLCLK
sb'2
SETFOCUS
DataMode
Z D[ Oc
MMDeviceCollection
M&R>
$/QG
2*p
_activeWindowHook_ActiveWindowChanged
hP2w0
usBC
;YVR
R|nTT
WebcamResolution
get_Size
z{YfAT
r`\)m
yB{x
POINTL
xK\w
Aru[
c7|K
(\ng
)sOp
HlFGj
CommandFailed
kvA_
get_Checksum
]c4vU
3g,q#
SETICON
HookProc
vD l
ztZ;
1rZN
GW_ENABLEDPOPUP
{ @]
ah*r
*~r_
L0=
CurrentFrameworkVersion
(Pl+
WS_CAPTION
'^6YM)
IJZ$C
R>mz
NCCALCSIZE
; o*
]n=yns
vgJ}Aj
J4E6{
Tltd
3XI*
MOUSEMOVE
Orcus.Shared.Commands.Registry
r=3/X
administrationId
WAg?
n!p+
q7YJ%
(rD)pI
9+; p
[ R\8
set_BiosInformation
o?L:RZS
+oes6
E ;ZMbG
UW1cz)8
pVh?
/omss_
,b|6
meeV
wI1i 8
1.Qh
_`U`r
<ProcessCommand>b__0
<ProcessCommand>b__1
<ProcessCommand>b__2
Ia_c.
SG[C
<ProcessCommand>b__5
MainForm_Load
<CarriageReturnAndLineFeedReplacement>k__BackingField
AUD;
,B^t
1q>)V
set_Owner
keyName
o)FD
cup9L
DecodeProductKey
Hk"!
?$YI
2Orcus.Shared.Commands.Registry.RegistryValueBinary
0m8k
gN<V}
izBO
:Y:czd"
fxsmF6W
Oluq
nCsp
v:.4
A !,S;
D)~e
g% #/
ivsnf
VNIU
2k,WF#
z8\Tw
KkH\
OperatingSystem
\ F)
! 4E
*+#14W5
ToDecimal
}8m
1+ -
{sZv
hKt$
"lI,V
wc3I 7
WW!/
$ 7q
aH}!
M8|_
get_Right
9'[B
qP"zg
)z9*C
+MC
0B l<
HTLEFT
Alloc
LBq~#
W G]
4=e0
K?m*
eEH@o
,Qgm$
*1[)
Iyx=
] Z7
callback
Value
)jpU
IDDoSOperation
8[fb
CAc(
*Y/@{?C
?ffC
AcOj
SendPackage
ScrollToCaret
NotSupportedException
?D#1
X&K@|
item_type
T.zR
pceltFetched
[P0!Y
^q?I
GetKeyState
disabledHosts
BE5
qqod
znp(
EndPoint
currentCursorPosition
0 l7
-0~
ChTh
SymhC
%T|/
G)knN
J_%9w
R1-:
@.}v
RxJ OIa
%rE:
eNy:
w\&A
"#3;75-
08+\N
EWprn
FQm<
DESKTOP_CREATEWINDOW
@[g.
HKcx+
>Vdc
kKx[
63@r
,0o-
*eU
Am.
TjJ$
K/8
8)'kn]x
get_NetworkInterfaceType
SetCurrent
get_Icon
Viyb[
;+Ti1
Execute
0)%-
?S($
4m%G
bbvb
get_MachineName
RofI
zNtle2
mOA>
(,Yx8W*
]Q^
B(? g
get_RemoteEndPoint
3WKDf
cw{p
N9~J
D+ ni
Ymee
IME_SETCONTEXT
.?T
add_Click
{:#*
F` p
3ID!
yCiX
}\trG^]^8 z
&#X_A?|X
~`!z
DUgA?
,kfA3
q#~9
?=s$
HApO
l[Fj
T9@U
8Q^]
n,RVe
Random
XR _X
GetCursorInfo
7K9V
k/K
FILETIME
get_Minor
wProcessorRevision
^4b-
w1sO
+yOe
set_InUse
dA4D
binaryReader
+
Bs@9
1y;*
dKxA
<GetHardwareInformation>b__12
MRxV
+5
+4
jR
lK7,H
)*)'
dwStyle
%/vJ;\
Sd >
yHotspot
get_StackTrace
SETHOTKEY
^ 57S
ctwa8
<GetTcpConnections>b__5_0
{*.U
z~8]
<GetHardwareInformation>b__13
}77*3*
N/l+
Copyright
PA" @n
(h
CX_#=
*qUc
>T-,=5
95tm
(5h}
YgRkUDnR
3JAv
ZHe?
HANDHELDFIRST
FJ *
yt5[
ProcessKeyAction
eL N
ja\Zk
RemoteDesktopAction
'%s$%
WindowsService
JkD9
p^UU
4|)2
timer
34~g
PE U
>q@d
o3-t
_enumerator
Tn@k)
.B+e
xxjp
Qs [
H2yS(
FhA3>
FileExtensions
dmDisplayFrequency
=r S
5W 3
?4DQ
45P>
^}~2
962
lEl)hft
CHAR
set_Item
=~wx=<&b
&ey
hU>u
AudioEndpointVolumeChannel
!d]C
&($
#}t=
`8h@
\L(C
data
fn2l
@FJ, D
AutoResetEvent
ib 7
Q~E9.
D Hd
+-gD:
!r/j
Y u'e-
4v .
+ZJh
Exception
_framesLock
e]]a
"-)wA
SC_MINIMIZE
Yo2
3 [
2o)M
xpoFM
get_WindowInformation
E_K$m
Stop
+(C H<
F^ W
!k'
WCF_PAINTMETHOD_NOP
get_UserName
GetKeyboardState
_s8u
datapath
@l3
@oes
+~qqL
R;i]!u
uTxfOh
hb6iq
&`O_M
@yoH
J_Lk
77xyW
astable_name
R%,j
JUn*
&a.%3
y(=O
*.sU
FileExplorerCommand
<>9__6_2
GetOsFriendlyName
7yAg
15wjw
y1aV
3uZ<
+D*H
z[1k
DoNotSendChangingEvent
{w\TW
Qe='8ZF
L*OHZ
J~gz
#~Kv
at3R
VC'X
izYcs
8Km3r
Wj~#
>BkK
WL">M
WS_BORDER
((p:
\}$f
_mz=
2CeOE
p98H
5~+WjU
<ProcessCommand>b__3_0
PtrToStringAnsi
eRN%
ym1&
Orcus.Commands.Passwords.Applications.Windows
&?N2
SpeechGender
@b|i
AudioCommunication
TSECItem
H-+a
6p%d
SPOOLERSTATUS
N[WU
get_ImageLock
\uP'
] SN"
S4<kH
hW(O
.o(t
=pgt
e=+4
A"IR)
`:BI
FileAccess
P6y.
5UQn g
gJ|D?
get_IsAdministrator
Point
hCursor
$y)<G
<FactoryCommandPlugins>k__BackingField
-O>
@xP9
T@iR
;MbI&
"}.}%us ud:
Y;^"
nZ*W
%& /8*
Ofb+7
XU6s
`v+KL
~h 'RH
dwMemoryLoad
Math
-zbBm
/3wC
WCF_MOUSE_AUTOCAPTURE
'C1~2
RegistryValuesPackage
s ;D
~T>!mn
r}H
qU)
!Zkn
8qD@25
]e}K U
-pqoW}rQ
=|>k
fkg3
|m}$b
x.;v
advapi32.dll
*.(6
ysA$
<Timestamp>k__BackingField
get_HorizontalResolution
BJTk
H8*[
4;Z4,
_zQl
\z pO#
[EG|
PLUGINS
j}i
]iKG
`2O~
|MO(89
*ve\
in+^
HW`<
hV'Iqw
q{G[
r\}n6
LrtA
<GetPasswords>b__1_4
FpwvR-@
<GetPasswords>b__1_6
<GetPasswords>b__1_0
<GetPasswords>b__1_1
<GetPasswords>b__1_2
3)B]
@>fD]
X>p1
]>a;y'
0g>|w
KL*5
;S 7
%e:L]
_cancellationTokenSource
|A.j
=wWDU:
!,wxX
^Ax?
X+y!5
|;U"]
Ka<w
<voc@V
MfR=
ActiveWindowHook
Send
7 o+
<Bytes>k__BackingField
IESecretHeader
/O+Q
*Gk
-_:sZ
-K"m0z
WaitOne
Microsoft.VisualBasic
?W$+
bnLM5
Y,!]
}ABC
IFactoryClientCommand
5O`B4|
<SendInformation>b__0_2
pocsUrl
.t`8
<liCJ
z"B>
*2,n
I~LV
|@hn
rN;*
m^R3
68i
jycX
P7)|(
X.2LNy
F[Ul
4sC*
Vs#R
foSO
)TVBe)x
NAkDb
qq-Z
ILC_MASK
IJyyfm-
]$>f
x()Pp
C_,T
|zY
EventArgs
'e#b
HOrcus.Commands.Passwords.Applications.Windows.Windows+<GetPasswords>d__0
"a|Z
Z's4
PropertyDataCollection
$/ !
z@/
_ 5%
;,$h
WS_CLIPSIBLINGS
ix[Z9
LinqExtensions
0PX
FontStyle
y4 P(
yzH0
set_Mode
}n"w
IUDm|
_graphicDevice
)&;I,
LFWXv
ZUmi
T`~"
BiosInformation
lL7f
{b,e
: ~ 2n
|@fZ
1Ys
costura.orcus.shared.dll.zip
FJ~
DoNotRedraw
.. V
UMGD
WriteAllBytes
zS}/`
6pm"
Orcus.Service
kIG
RHtI!$
!i_by
LU
`M;jCC
<GetBiosInformation>b__5
$LH=
<GetBiosInformation>b__6
<GetBiosInformation>b__1
}Gt-
J-$0V
bua,.
htd@
!'"s"
Qnkz
p~$E
}\JG
PSize
set_Message
TcpAnalyzerDetector
Fp9
SW"fJ
9 <'K
WinSCP
7GHm
bj8t
D3S&
MassDownloadServer
+}h{
wUO^ ;=
Uplj
DownloadAndExecuteFromUrlCommand
X ]X
LastUpdated
SizeF
%BZ@
<GetAudioDevice>b__0
SetForegroundWindow
Nu N
azhF+O
7WkN
y>2]
#c:JH
_unloaded
% o
SHGFI_ATTRIBUTES
Orcus.Config
>P7R
Z!+ w
( T)P8
@zJtL
/qV7
O5n`
[08B
,9 4
[,"a
H8\k
DeflateStream
_t#Q
@w']
add_Idle
|!fc
[77n
Gh;
5S{q
GOoM
En|2
<$l$
Av_q
'3 i
=<'H7
;Mc|
SMTO_ABORTIFHUNG
4Rb^
*~f
*~g
-9]w
#E`/
U/Op
*~h
DoMouseRightClick
arenaOpt
>q0:
Ad?Q9
Wu=L0
S+^i
srr0o
r5{m
vCode
RR,&
)rn`
l.ww
\)kO:-
Z~#:
Sz)*7
DefaultMemberAttribute
tjSy
;kC]u8
3k)
Centered
:$C!
<ProcessCommand>b__2_2
_1C%
get_StartInfo
rw;7m
\; Wj
|vJ3xq
9~_p4
Fyw$
DS~ZX
~!%]
ir$SI
y=~7
6^ lO
{69J
NEXTDLGCTL
closingSessionId
WasapiOut
$(7-:L#C6
7~$K
OW~bel
|O#f
c m5
/p g
- H
AE,
*V(H
>::6
set_Image
{'}Y
_mozglueDllPtr
t 7*
T^B3
ArgumentOutOfRangeException
c?{
WxEo
S_$n
$9 t
W:f
a M1
CYv
DISP_CHANGE_SUCCESSFUL
Jws p
^ )7
'61f=qh
&Pq7
Q8_7
AE
LgR+
SC_VSCROLL
EventHandler
rI;4
OrderByDescending
<@Se
uFJuv
STATURL_QUERYFLAG_NOTITLE
l5'D
StaticCommand
~jx=
Cookies
SetValue
3&?g
|w|SG
+,j]Vf
jS*>E
set_MaxReceivedMessageSize
U-]p
[.<0
JlsIdP
IM(E
[lZ.6]
8,969w91:@:
(}A/
[8 ^'
B/Fy
}ct^
dmDriverVersion
+rp'E
^g4Q]
get_Age
YjQh|
B.}m5
e4-S)
$Q 4
~4U$
<>3__audioEndpointType
@$IK
w_YB+
2.uI/?
ib7yGK/
Ge "
get_ResponseHeaders
get_StandardInput
LxC5
=,Oq;]
{03c
Xi5?
5&"b
SUL69*
V&D<
D=(x~
MmEW
"'^J<^
w:x"
gKa5e
Play
rV.A
*6(
_fieldNames
SJd}
offset
+/,Ze
System.Text.RegularExpressions
5B^P
,#A_\fP
U1q
u^nHL f
>KZ~
%g65
MnRk1
+)`i
Ph m
<GetBiosInformation>b__5_7
get_Type
kh78
set_Icon
vr4y
System.ComponentModel
>"&PZk1
LocalMachine
h7W_
~r= \
PmS3
rw1O
Q/U8
xG!k
H,Z6m
By7R
8K@sT
j-lq
7 [x
CopyIcon
*{)'
&{ZXI
j]F/ T
]EA7
z9Ww 5
[ m
j/Z!
WindowHelper
o4y]N}. [
8 y<
Bp&#Z'
Mc8}
`+{{
@Bp&`
&J MM+v
wL'M
IcmpFloodCommand
%{C{&
1nQE
Cb6W
KQY~+zR
MD~9
M$SC#w
:DK%
M[m,p
&+4s
Z-WCe
WH_FOREGROUNDIDLE
' C;
DoMouseLeftClick
wincx
Srjh
qoxo
ServiceConnection
r[$}
nRG?
y~$O
Pu-y
OnClosing
add_Closing
j}'l
2l8c
/+@gx!
! D
#DoV
Gl]
AssemblyNameFlags
a]=!
<ProcessCommand>b__3_1
4rf'
System.Windows.Forms
J~Jn
Pxm`
tD;~e
set_Entries
nHeight
IndexOutOfRangeException
iUq>
#fk5uEZ;
9g S
KFI
<|kwT
PostMessage
@7Zs{
1s)fyy
nAOJ
= [/
NameValueCollection
PStL
ta6w
5\Qn
|Hu"
yT$$
set_ClrVersion
MessageReceived
r71
1`Gp
set_EntryName
GetCultureDependentString
COK=
-[)&
set_Password
disposing
+uMr]5{k
z@/
FileExplorerCommunication
set_EventId
G6?R}
set_ReconnectDelay
FW-U
YV#V
IPInterfaceProperties
<u]{n/
J3)Y
f@4{
ToShortTimeString
NI_& H
S6A-b
6rdf
INPUTLANGCHANGE
uNij
xWxxc!<
c(q7
_53c
GetWindowsProductKey
MC3;:4
get_DarkGreen
9T!"1%;
18x+q
?~VR_
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.get_Current
PO 2
Orcus.Commands.Internet
BNXmHmz
OrcusApplicationContext
- pG
=<ni
fz7
s4oz
AdministrationConnections
t7.f
5ixqT3T-^
-x Z
f|q8
lu@l
~9&[
TI@
ullTotalPhys
ft;F
Color
$5GTI
H.SPQ
!)>
RuntimeHelpers
,Ms
qJO!
R3RT
TP*5T
ROG_f
eRxL
t17$
>IKC
Host
'lD\
GetLogicalDrives
N N=
O8Jo
.\X>!,+ .
am2s
TCP_TABLE_BASIC_ALL
IME_COMPOSITIONFULL
Ihdw
SendMessageW
SiM;
IsEnabled
TripleDesHelper
C3IwN
.?OJ%
get_Height
Nvc4
VvIiy!
get_Connection
N9_n
t:G(>
get_AdministrationConnections
( 4B
8T?D
PrimitiveProtocol
n1LV
,ur:
~(hBA7+
3daz
{w0i
set_TaskSchedulerRequestHighestPrivileges
2M >
(A,`
@Tk3
.Z6-?s
9b4}
[C I
NzG]
+E}d]
,\<f
GzN6RK
SHGFI_USEFILEATTRIBUTES
KPNk'}
pp,xU
S7L
]rN<^
Bzx)Y
get_Controls
tJuo
kgfw
n>P1j
Version
add_KeyDown
< y r
get_UdpSockets
KTs[
CommandSelector
E.^.
RylX
NCACTIVATE
:n y
3MZzy
CvWq
,JoZ]
NB4J
J~34iS|
@Nq{
L9!h4
pbKeyState
InformationCollector
U{67z
vT&=
<ProcessCommand>b__0_1
?P]p
GetExtendedTcpTable
tNLE/p
>R??-B
3Bj!
,w2
{4_w
r'
ElolxF
vb ;
r+
$Mvw
WindowsFolder
ProcessorTypeToString
dec_next_char
!qNb
$hq|
v='8
:!Ci"t
)yDW
MWKC
?r=&oV
EM'=
7V~j
GV?{
Rotate
M[./
8(]C~
gC_R
M; 9
z=/"
] 5o
2{RGi"
ByoX
get_ProcessorCount
j*8f
ILD_TRANSPARENT
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.Current
ManagementDateTimeConverter
9+^E1
|:zAts
~r(|~)
ll!M
ASKCBFORMATNAME
<WinSCPDecrypt>b__2_0
U]]2
<RegistryValueTypes>k__BackingField
}s-/u
<LocalEndpoint>k__BackingField
g$##
@vJVV
SYSCOLORCHANGE
pfnEnum
96y4"
get_DnsSuffix
get_CommandCollection
ktcP
_bFV
lEgL
$sB)?J
U e7
kbstate
FY ;
X)|u
"|Z.}
BMToN3
r+X8
j" $Bg
4Nl~
set_LogicalProcessors
EndInvoke
<FE
wCreatorVersion
get_Groups
PV6>}zL
IEnumerator
2u+H
?Oxq
pB4`Op
YK k&
EIk,
/G_H#D
P UC
x.4+,u
|Y.ro]
ICookieRecovery
]#e>v
9^I
iT9U
x:7W
%@y
t''HO
3" L:
7P7d
N3pOf
rSr)
|' S
lpszDesktop
#wR2wX
Va)P
*V+[
JxP
LVQ{
pnoP
YHgb
) *h*~*
~#3
a}_:
output
?`])
t4T\
get_Host
1'bF
set_MinimizeBox
\ sbf6e
j]ag
Qb-R
bf a
_currentFileDownloader
nhmf
=iQ
UxNS
<Main>b__12_0
Chrome
Cx E
\-o,o
gD[
:'tS|
V}^\U
og8fM
Hg C
nWk4
ImageFormat
1p?]
DM_DISPLAYORIENTATION
DH g=L5M
i%U
8xD9
_requestClass
AddRange
1&KR0,
RdxlVm
SXS.2_
D ,;
!@6 W
UninstallProgramEntryLocation
System.Collections.IEnumerator.Current
UMEO
uoG{
ICollection`1
set_Firewalls
.b4c(
[d u/<K#
O6m"=
zQJ~
KeysToSpecialKey
c U#
Ajw'nX^|
=4vz
List`1
_N%X
%/dx0
-5N;
DEADCHAR
RotateDegrees
i%Uy
GTd#
.jz*:
ToDateTime
n,ILe
gQfB
dwNumEntries
;bws
get_Bounds
~ AD?
Pipe
searchTerm
G2q/
{776 }[
+eK]
kaxa
GetExtension
QP\r
K ?l
c`wh>
bLj/%kx
o|
7\aA<b
op
LoadPlugins
6go(
k>c20
ov
mzhzt
CE+8
TextWriter
Authenticate
2Kv(=
ayHuh
kij[[
^'xF
fGS~W
WK&
) K iFQn
ConvertHexStringToByteArray
prh
Z D2-)
ToByte
Ln|l1,
X_o
cvA
M8?UkR
M H
8n1Fg
oH
S(@w>
Item
Ac>j
<IsSearching>k__BackingField
CreatePackage
?=/0
l8(*
!` ?
lacU%>,
x>AN
<h> <l>
QG9]
);$Kv
% -
n p#
F [
VoiceAge
A^\4
GetLanIp
wr{m
70p|
NCMOUSELEAVE
"K@S@
uLr*
set_Objects
jiUi
#Blob
S$'
O.V
<u?V
set_Administration
ppenum
CommunicationObject
@{xTc z
^f`)(,
'FVX
rG>
`<Cu
r/
467w
Gb> 3
~7,N%+
SePH
&;cn
Ei %W}c
Insert
Decrypt
hDlg
l{CS
M^$x
WM_KEYUP
BindingFlags
.W^JtF
b&9v
L7qF
5IMU3
)= 7
~P=(
$- Q
Mm
C }yl
`m6SoB
:, A
content
!/C
qb3P
reader
i+tq
Autostarter
GetName
SmoothingMode
z*qm~)
.y%s
Join
STARTUPINFO
<GetUdpConnections>b__4_0
5mG@
RsaKeyManager
'L83
uAF A]
Cursor
X)_!
Y}7(
!:o|
System.Drawing.Drawing2D
p|pt$
VYGtUy
IH+@Lv
9tD:
remove_FileTransferAccepted
Orcus.Plugins
q&/#~
s=^.
set_KeepAlive
i u
hOm8C]s
=Ch1
get_VCode
Orcus.Protection
IPasswordRecovery
x0|k
|J(@
a#d
urlHash
ProcessModule
AppDomain
ENCRYPTIONKEY
y" >
,Zr<
r,FW
PAINTICON
EmCm
&}%Z]z[y
Y=OYU
t,}%/
lr]rSr
set_AutoFlush
?VRm
KILLFOCUS
66kB
s\K\
MA&YD
&SrnJ
$u:M
Fat?>+
+$(
Hh*4
+$(1
f'WL8
,WV+
4^!U
get_Y
DeleteDC
[.e$
u90`]
@sm3
/>B{
v"
A@[]e}@
(_Eb
XoD
m_3M
Taskbar
3 Y
V {;
PushData
WS a
uuYQW
Hj@1c
cyhi&
*eO]
TCP_TABLE_OWNER_MODULE_ALL
_hookHandleTitleChange
Y /qG6Dj
get_ResourceType
hyBK
.6Vm
(9Wh
O`H1
FactoryCommandPlugins
^qD$77
^A1)
Pc$b
+ r
.tMn
dmCollate
QL[W
?I\Qyz
set_FrameworkVersion
}ueI
e 6OU
ce0_
(F:\
p996
66v0
n>4.
pwszKLID
xx90
=^B_
get_PackageSize
OpenWritableSubKeySafe
C {@
^Gco
0?dD
2!#
)1V"
PT]1#
7`n_f1
WH_JOURNALRECORD
:c1B
'`@9tx
8 .\
`hWsy&
EVJJ
.s~5
DialogResult
N==}
get_RootDirectory
Et=4
INITDIALOG
rowNum
5nBrkb
0PYx&a
^"T@
z *mf
SPe~
/h^5
<.'FV
`ixJ{
set_Proxy
Clone
Ma_H
& 5~
:c1h
wrC&
bBQ{
I @
k/O>
~L#xN
GetDirectoryName
}T
ToList
W.Eh+
( )))G)
set_L3Cache
INSTALL
A<G
zh*e
1N;wI=
WH_HARDWARE
H3@H
F_=Z
[gYLa
_I/)
>'r>
get_Monitor
30yW^[
q7</
INPUT_DEVICE_CHANGE
)2zG
CSCore.CoreAudioAPI
qZu)
De]^
SetMemoryInformation
)|DJ
^F2@Rr`
KnownTypeAttribute
d=~FP
c0gy
0$aH
WRrEsC
,#<Jd~
=`B#X
spf(v.+
{X>F5
?Nf`C(K;
t>X8D
LiPM
|EVep
z-"I
)z<w
<>9__3_0
V:y'
r1
AudioVolumeControlCommand
connectionId
^+`Y
ShowBalloonTip
Kt
Spj? ;
r1;
+$KH*d
_streamWriter
mi3
V*z$
Orcus.MainForm.resources
\mX%m
eo5\
b!1K3*3577
Free
Orcus.Commands.Passwords.Applications.Opera
G#Vr;1+_
b\P>B^
Y^ZD1
$Hs.
1r,S
bX}a&
$KFNY
Zu6Z
Y& f
.F7sv3
b =e+
akNT
DESKTOP_JOURNALPLAYBACK
'ImY
g}5 }
$~U7
Y P^
C =w>/p
&?'a'h'
GB(g
j'r6w
hpmJ
( =
fields
vbr5
ib:t
xt'r
='QV
`l$7
oy
d>PA
STARTF_USESHOWWINDOW
gnS8
MakeTransparent
set_IconData
get_PluginsDirectory
IPAddress
#/^`
IconData
atomWindowType
!M#2M#"M
~"]<
set_MacAddress
I"Vy
j0s5t
*>6
s`V<
9W:;+_(/i
>v.I
>i|z9a
PR^7
S z
JE :M
WCF_PAINTMETHOD_SKIP_HOOK
e:Ky
0:#H
_tempDownloadFile
<Hold>b__0
MouseAction
@cE-LL
}!#V
8lWoM
rFBO:
TaskDefinition
<Dispose>b__3_0
/b@T
CRYPT_VERIFYCONTEXT
5:9:
}P'IF
:xT*
.Xe>
DirectSoundDevice
costura.orcus.shared.utilities.dll.zip
iO^HrE
C[DwD
get_VideoCapabilities
punkISFolder
dW*x]
_nss3DllPtr
X509Certificate
OpenBaseKey
0 :VMg
fullname
ws\A
Orcus.Commands.LiveKeylogger
EnumerateSubKeys
@/r_
ElapsedEventHandler
!_Y)
Sp2R
redirectPackage
j-PDI
b 1z8C
E ?
DhC<
SendUdp
W :4z
<AutoResetEvent>k__BackingField
x\nV
Fg<'j
aXbz
AccessMasks
Pc4Fh
height
_hvncDesktop
j/B[
*Xf*
BNv17
get_AsyncWaitHandle
=hr"^
6Y|4
_r ^C
r8s5
Ilr`
{2F[
ea @
{2`9
>R<!
xS #K
Orcus.Shared.Commands.FileExplorer
Marshal
G @{
SendMessageTimeoutFlags
z'x Q
idObject
lXpa]
~x(J
C60f
LDni
TakeLast
&{
;8>f
:d~4
5m/ !
7#e5'
U,3dq8
H=Wx
lpT,|Gg
/C^a
~`<J5
nNjLp
H,W9
_executionLockObject
CopyArray
exception
/
fc{9
Process
<>3__key
binaryWriter
pC n
b$#?
w8Np
VirtualMachineDetector
2Qe>
vbSC
{*=
set_IV
Bf@~
&^o
eGq2
;3<9<R<
2Pw~$
se`+
Z, m
g2V1
K6ZA
enumerator
F[I(
QE 2t
<entry>5__2
uNJ1
pelHeight
OrderBy
w2}RG\
get_CompanyName
6inim
\P#.
}RIsl
{oVW.
gX7z
P''?
RrbQ$
syi.
$_V[
UInt16
1tQ
^Cb#Gr"
UwXC7
!l|
1z/y
SETTEXT
y:iA
WC02ls
28qce8
j}O.3[
hhT"
lefY
IsHandled
VaO"
GetRegistrySubKeys
EnumDisplaySettings
AP Kc
udpSockets
{ W
qn"
JzTH
H? G
System.IO
Za2
WrapNonExceptionThrows
#+:@
![u`
computerSystemManagmentObject
T"' A
cZ9gg
_Np'
Df6%
lpKeyState
V;_"B
^0"=@
j/ ?
GxO]
Su_&E
l>+H
<C#A
>ZI
$j4wR
;j3{
%ry:
GetLastInputInfo
set_IsServiceRunning
4?}Y
$#?L
+;%~T{
EnumThreadProc
b-<{
BWqhe
e}bQi
@H3w
RuntimeFieldHandle
@s7|
c%NM
7~`/
D3 ;
set_AntiDebugger
ResizeImage
Ro]9
L{{v
Xx~x"fpS
%a/j)
Orcus.Shared.Commands.Password
@JSf
44Qy
ScreenHelper
fqmb
QqsOy
eOnL
#mHZ
7|fa
?&J )
Kl DO
'K y
_-~
@[M&
ILoadable
U)=g
SwqJ
"FI^
get_Session
get_StartTime
(+ |
aO$%l
z}V.
!d
<Data>k__BackingField
WindowInformation
FJrY
,-7X
?&J 3
YAn.
[j
Y&x V
y$89
2-9
localEndpoint
ONhO
]9C3
be/|
<(to
22zJ
8 RtMN
<{6x
?]E3
M,!V
";KC
GZipStream
>/G;
ComObject
N;;
Orcus.Properties.Resources.resources
f<\D
@c`<
(GW^
a8j;iG Lv
C X]
,[ r
;59;R
SHGFI_EXETYPE
user32
y @s
Sc }
f\;/
DoMouseMove
CANCELMODE
ReadFromEmbeddedResources
J+MO
0H I
X%c
*zs
nQyCr
Tq)}
x>G[
B7%t
42.glN
<ImageLock>k__BackingField
set_RegistryAutostartKeyName
ij,V;
costura.aforge.video.directshow.dll.zip
I*Nq
F w
l0}A
p%Q
csvFile
E/@
{,qY
dmSize
B'_B
#`Cy
)t%j
Qnmm%
_ip8
!M[
WrapMode
TextBoxBase
Y9=TW:
Rir
get_Address
TOCB
set_AdminPasswordStatus
<>9__0_0
_aXRH
down
rTI*
+`+ m
?"b
ktDQ
"/MADDds
{o^
SETCURSOR
A PO
,+7I
*T4uaidQ
!4y,
FUe#u
@#M~
~d.!u
HRG`
cuoE
_@"Ud>
x]
NdXd
set_VideoCardInfo
ACA~
O%rD%G
QBi.)-v*)
set_BytesSend
GETFONT
*WmUK~>
nj !_
\\W!
/,A+
',aFo^j"
<E6 /
get_ServicePipe
|w>/
<#n\
6J{##
LQ+([7
ElapsedEventArgs
!nr/T
<ClientPlugins>k__BackingField
System.Diagnostics
0 HX
&oQ?
tXIa
OssOr
}N34c
M/O/
y/#&
rNF:lN
RaiseOne
&,Sl
FM,h
InternetExplorer
SelectObject
c+.-
Fy{T
&}U/
*8JI
~* 4
hWnd
LZA?
"W>/a^|*,
k`$S
|<?Sy
RichTextBox
8`
e$[m_W
]0Sc
u [v#]
'[@nL
<SetProcessorInformation>b__2_1
U<FI
{(]"
bI4(}
B <vX
z2uN
;c 2
GetProcesses
set_Threads
FunActionsCommand
t6573
$r)uBu-7
GetOperatingSystemInformation
ADDURL_ADDTOCACHE
&If<
8 F)
A6{F
Orcus.Properties
:&%:
System.ServiceModel.Channels
-R^k
S+1Z%
so
VistaStartMenuCaption
op_Implicit
DecryptCoreFtpPassword
)rW
)L:q'1X
CompilerResults
Q3 =
QAz[
O\Dg?
String
Timer
bb86)b
p/DT
set_Location
Bb ^
~;|R
:( Y
j]|Blz
3BZa+
dka%
jW8tB
UGF|
yajxZ
yK']i
~]ie
Vb%=
get_KeyLoggerService
`@`v{1
c+f,6
Microsoft.Win32.SafeHandles
'\qO
!S!CvrY
t`! Xh1
Jnt/Dg
APPCOMMAND
+8[Z
get_UTF8
rYrT
5KT*
get_Width
RWy~Q
ERASEBKGND
EX)\
set_Rate
get_Month
KeyLog
HAP+N
!G)m
e5V+
CreateConnection
C1Y<
GetSystemDefaultLCID
PX.yXS
/#{
aqAb
M? z
is_"
u{m?
DN5f
=jJ_B{f9S^g
hWinEventHook
h\fi$
MIB_UDPROW_OWNER_PID
!'!H!
[=3l
q!vk
CancelEventHandler
<SendLock>k__BackingField
CopyTo
vzd:%vS-
={8^
GetGraphicDevice
0Qen
GetValue`1
Where
\T;rQ
qEU!
mQQ-
i0FJ
f}lc
set_AntiTcpAnalyzer
CLWk
0Qe^
fwbh
-|("
get_RegistryValueTypes
W`2|
93
IEnumerator`1
rF)
UnhandledExceptionEventArgs
NDS5
M)Z)
(=xa
_webcamSettings
Su |
%bwp
qS!o
4XGoC
JT:d
OWQ-b>
r3.
vLwgg
t7IO
CLIPBOARDUPDATE
lqz
StartHttpFlood
WS_SIZEFRAME
8]&u
Orcus.Shared.Commands.ReverseProxy
^9M; <
dS$*
o&{
filler
3U=Tr
47nXQ
^%_LW
AuthenticateAsClient
lpbKeyState
NivI
p![ 3f
set_SystemInformation
_synSockets
Fs ;
$Xb:s
V/Dz
a5Cn8
<>c__DisplayClass43_0
U=aN
MPIp9
set_UpTimeSeconds
LASTINPUTINFO
b,ct
uL $[
PATPAINT
t/ :u
ullAvailPhys
/:63g;
X98R
<ConnectionId>k__BackingField
+>??7
Rstch
&No
R)5a
WinEventProc
?*Nt
FiV1r
itxBk6
h&NL0
9 ~j
d?8V
UI=1
tGc8
/p?1
AHO
T4^g
System.Collections.ObjectModel
< A0 A
>T}/
ReadTableFromOffset
q|v%
get_Capacity
>$+a
"*PWcOZ
<>9__7_0
SetProcessorInformation
}(wm
dgZm
4@@j
ytCeo
:aIdQE
Bytes
{*NC
WLpX
7pO
_translatedNames
p oO
bS$\
.4"g
]7 n
set_LocalPort
{ugu
EM VPl
Q<,!
KGYbY
%/{r|
3 IkC
3 uf
- ($
get_Day
\8C.
F^X_$
newCommandType
<s ]
Ow93P6
iV4
3QUPGk
cbSizeFileInfo
set_AntiVMs
ProgMan
ftLastVisited
NFSQ(!$^
L;!,
DeleteSubKey
KJxa>
<PushRequests>b__1
\|.7:9
Degrees0
=KG
zQ5;
kbh@[
*E\{X%
.Y.j.~.
set_StandardOutputEncoding
D1\k
wd?_
HP_ALGID
record_header_field
Wv*i
v -ZLz
-te.t
Qrs%g
2&6A1A
t8 *
V)0>|u
w+YH\4h
+M%B
mD?.
5wUO
set_RenderedWindow
3{gz{9
NDN(O]OlO>P
z;.rU
u."|meh~-{
xAXt
d|Pz
TMBiT
!<Z3
b 5A-8v
\`_<
%eJdoZ
/]'-
+iN;(
KEYDOWN
<TcpClient>k__BackingField
GuidAttribute
0X R!
;9h|uNX
~x6
3!h1
+C+u
PushExceptions
5nvY\
_current
t$J]
GetWindowThreadProcessId
IGl9
W0z(
rQi$q
dwCreationFlags
=.jV9.F9
VideoCaptureDevice
N4?
`6u,S
r{7
NetworkInterface
;Tu@>
4%I0
< |+
;C{M
get_Port
ENUM_CURRENT_SETTINGS
kXzy!
8x+\>
p
T:e>
Trim
DataProtectionScope
sq >
r$[zv
zjgb
po+m
I.Drvw
Qr;U
WS_OVERLAPPED
I=u
o$-4
t3d b
>*x)
*A|
SetKeyboardLayout
8h X
| l7
__StaticArrayInitTypeSize=48
ipAddressInfo
t:U'
set_UserName
GetField
DvG|h]
FileTimeToSystemTime
add_StringUp
SYSTEMTIME
j5/a
S }:
wi-
<ReplaceCarriageReturnsAndLineFeedsFromFieldValues>k__BackingField
nC\ 'G
[R|@
".j3
-iZ.9
iUM8
qr'
lpDesktop
XBqy
9a?/
S5$6
K9x'
_ T/?
set_AllWindows
UInt32
9um
StartsWith
vzPz
K#;4
cH^X
get_DarkRed
set_DeviceId
DesktopName
fileName
set_Is64BitSystem
?Yc8
Right
E Iv{
19'W
hP0E
_fileStream
oR.C
3)+#Yk
aOR=c=
&6,F
Fma6
keybd_event
QhP-
*|Os
pTcpTable
gzrU3
$]#W#
<>9__3_1
p*rW9
:U<%9
a^ v~J
Yh<R>
| )ub
e=+0
DeleteHistoryEntry
dmMediaType
#Ajw
s q(
VSCROLL
]b2(X
ServiceBase
@9YA
>v k
Split
CTLCOLORDLG
RegOpenKeyEx
]:6u
g\6@
Uqe)
M|Sp{
l~m#
qH@X
N09MN
ICryptoTransform
TaskService
Ygy
SHGFI_PIDL
Btj
$WH Y
ApplicationName
0MiR|
mR0*
x4DgD
rjo}}j
VS$H
6TMX0
AssemblyTitleAttribute
+xNP,;
Orcus.Shared.Commands.LivePerformance
&nP_
aZvnQ1
hDesktop
ZLJ1%
=u-%
9`t+
l^j
f&H<
HTHSCROLL
set_NewCreationDate
GetKeyboardLayout
uGn_
P= oe
26 (
__result
/[r{
<>9__4_6
<>9__4_7
</L!
,s+.f
TW]a p
Uk b
<>9__4_0
|.S$
dUg\T
T!0jB
C4\9
8pKM4
f\T
]%>I
add_Load
yBzF
?jg c
Qb3_">
ID3<a
GetRegistryValues
AddSeconds
`HBtE
.~5OS
{4JE
WS_VSCROLL
ps##g
>_ }
.w@9WX
set_IsCancellationRequested
^T6CY
set_IsSearching
HELP
PerformanceCounterCategory
UninstallCommand
~9g1o
eF0c
!=MsO
g" i
_033
hK9H
MA_ACTIVATE
|= X
p.]yP
<^_R
Y{E
'{_c
p5kNz
Post
`;L<kb~
iv1D
QfeI
d|M;
QY{N
y?=
q ?j
*tP#
Dd ;0
]qzL
^Z$y
@h O
B>&;
(KNW
Orcus.Commands.HVNC
LinkedList`1
{&gGm|^
rC
yw/O
get_OEMCodePage
OA?2bW
e$qd
PATCOPY
iO|C
`IH4
rau>E
1=U8A
~eRBy4
qu U
'>'$
set_ProductId
BZk
server
IX 7
2{MO
KKO6
()Tr
_+T
5rFDC
KEYUP
u,v-TEZ7
ChatSettings
Nhl
NCXBUTTONUP
F::ttt
UtaYm!
HZKl<
(v 4
v{eT
67YIh
xoc;
ProcessCommand
cN=O0
e<E4f
G $&}I
_buffer
n J7
STATURL_QUERYFLAG_ISCACHED
_%n
inoRUg
ou_S
74;dI
BsKL
dwIdHeader
EjLX
samDesired
DrawImage
9wJyi
KC&B
lq>/
*w|x
a3&M
MessageBox
GetId
[X;Jk
nFlags
b$#y
ro5=
set_Language
)z%/
COPY
YXs~{
"yq A
~'Pew
Finalize
_Z(JZ
Connection_Disconnected
StandardKey
cM} QO
PixelFormat
FrameworkDisplayName
{%e:
~IJ z
<Module>
~X9#
<t.5
?;"~
X Q
}$#
b,MP
D~Bl1
^w;I3
Kn%GT
0X Rg
VTPV
wTb}_
Width
0k*%
kcCs
StaticCommandResult
@96
~-Pe
get_Hour
$&:=V
W| ~
Wdd8
@7M!O
Pz8
4c4Xa
GetProcessesByName
0 Go
7,@f
yloi).=
4VL)eg
SpecialFolder
<!+A
get_Chars
j! O
rX7:u.
`p$8
CryptoStreamMode
Z6%15'
R$SyA
}>:
G&zE
B0H3
Cw1o
h$sa
DescbcDecryptorByte
PZ"B
0*S`
KYS E
'A1Y
{;$%
&m)F
9<F "
`EJ_{/!k
g%/:
vs,{ OGn
AdministrationConnection
dmPosition
O7#n
nSY^
.Tkc
source
t~ t
pDevmode
WH_KEYBOARD_LL
]J4W
k\1M
mnw!
k4mtVa*
z9{)|
AV
x`=)
FromBase64String
|p_:
[T+J=
get_MessageBoxButtons
+X)o
<HvncActions>k__BackingField
d<Nq
7 sB7
iq+O
SP_(\
set_TaskSchedulerTaskName
0:c?
q!zR
J]rh
EM D
D&S#
{M-m
sql_statement
`hO%
eO+
T7IQ
Orcus.Shared.Commands.Code
set_TotalSize
UDP_TABLE_CLASS
PARENTNOTIFY
j|KM
77,wxXn ,
logins
W r
get_Package
lfi
bwm!l
\:g>
r`(
GroupCollection
CodeCommand
POWERBROADCAST
XlJBex
EnvironmentExtensions
MapVirtualKey
<RegistryValue>k__BackingField
I8D!:
W [T/
, (!
, (
Cr:-B
slK-
CDrB
adA\pf
IsOnVmWare
W0'oN
Uninstall
FM}2R
tXA:p
$Ie?
;|cu6v
>jy4
8IwW
{{zB}
y@m
pbData
c4MpG
-r)(hGh]k
t@%l
RecoveredCookie
&$tfv
5QDN
IServicePipe
Fu9
E5L'
|=5
;&Zu4
2HT@p
>G?-V
RotateScreen
Directory
WebcamCommunication
8mfC5
Decompress
k8 KqK
MIB_TCP_STATE_TIME_WAIT
z%Ma
DZJ"
Wc[3>
3R9(
EI-I
=)T*c
shelldllDefViewParent
uCode
_ b$D)
8! 5
SB9)
,lgo
lH,$
GraphicsUnit
_KAw
=x+<x+
Subtract
0 mz
M5|e
ScreenFactory
IKrEGE
t~}%^
`)Hq
System.Drawing.Size
]`\#
js <}
%- &
d%$K!E )R
><~N
\-mA
Action
:g*
JoUL
SuspendLayout
System.Web.Extensions
qF L
%1Q:
Wr_"p<'
p=7p
_$MS
NLhv
r~Sx]O
Dictionary`2
TSy;^
o|rWZ0P
@ &d
/3'2
)r7,TZ;_
GetWindowClassFlags
qxO.
fBlockIt
Y\k)k
pluginSettings
# gV
Z4~6
(I6e
ga?ol3s
7^dj
?V|0
set_AutoScaleMode
y(5f
ServiceController
CryptHashData
6=c
ofCY
nj=q
(p\k
_cmdProcess
UnmanagedFunctionPointerAttribute
Td,4
h0_;
kt(OP
get_DriveType
get_SendBufferSize
2Q:f
C/r4
arguments
[3>z
childAfterHwnd
~d?;f
RBUTTONDOWN
dmPanningWidth
kiind*
NpiQk
4p?r
dwEventThread
/`=
S~t 5
uKm9
zu9,
v@^}
Expi
{*p3
MEASUREITEM
HTBORDER
<BinaryWriter>k__BackingField
. M@Kzt
Z`)3
}&$`
_unsafeStreamCodec
':oy
Fug#
k@Jw
Y\;W
(0x
Sa`%9b
ua#?
hWndInsertAfter
$&X`
IUrlHistoryStg2
E'_N
ipAddress
kmE:
)3eM
o Z#
SwbK3($
dmDriverExtra
J%nO7
0J=5G
Icon
}pY7
{{w=
t'4
pjJOA
BuUx
WILC!
ey#q
>~>nZG
<T=
,^Ur
ExceptionSent
fuState
+/@O"] W]Y*
P8G8
.JF5
y,F \<
AbEnV
c>"#Z
aH2 !
[k?E
oDG)G
AdminPasswordStatusToString
(zNe
{<_IZ
*s_&
&~Jq
o?Z` 0G
w3V
M2\y7
R{|V
InpM
o6Xz
/-7p{
-zx"
0BX
v*CC
)9*W
,7(O
keyVal
`L,{xu
SHFILEINFO
Operations
RegistryValueMultiString
k "q
-u t
pHkA
/KWe
%(r
UnsafeStreamCodec
GetResponse
Wh>\
lD$A;="
HTCAPTION
~ FB
-Z^i.
waveSource
t=wG
%eYR
B9#Z
ErYK
pNss[
;LpV
U#+1
DWMCOLORIZATIONCOLORCHANGED
^/F
get_Duration
O z
`+hI
wRcG>
lZl=
X`<=M
wFU-
Q&~Y
Reverse
]9>V:
dwFillAttribute
EventLog
N wJY)
TJKQ
6FN\-?
_dbBytes
OvQ7
Je=T
wm<57
_actionLock
= w_
rs+
HJK
z(7
/R\G
GETDLGCODE
/ayu
_chatSettings
GA==w
ClientPlugins
|C_Z{
set_OsName
UjzD
W5*I[LE
BFl8
;vtJ'@
SoftwareInformation
set_UsedMemorySlots
Assembly
c]Yf
}%6X
?3]YB9
.Trl
5^ K
<T r
U`3*
T5c<Qp"(QAt
dataList
A7vMu
xhZ`
Z 34
>F.z
1I y
AssemblyCopyrightAttribute
zUK^
{q]f
4JX|
=iu#
'G0J
6N^B(-"
@C/I
0vT6
W*Od
_"!oq
Dwzb
Fpt;
_lastFrame
K:*x
, r>"
"rQ
^>b%kz+
SetWindowPos
wparam
dwDataLen
GetAudioDevice
GP|Sr
.ag<}Bx
[;#8
AppContext
8~b
5U8D
LogOff
b\qY/[
"` q
DeleteFile
LWKp
.Xy>"C-g$]
+pG~
j+GM
*IIJ
GY]tT
_session
.n>[M
get_ModifierKeys
Iabr
N+ ~
CryptDestroyHash
~)Nt
Ay&:t
set_NewProcesses
GetExactHandle
tSw(
FindWindow
5Es)
ChG
Sequence
HWND_TOPMOST
As
:A'l\
CurrentImage
timeLastUsed
FrFl*
fpj0-#
= >.>v>
GetFreePushFileName
`HH-
E18x
+opju
l~ku
nSoW
Bf]p
(zcm
GetUrlHistory
Orcus.Shared.Commands.ActiveConnections
8(7KXy
|oYV
dwXSize
#V z:
SortFileTimeAscending
Wp*++r
Cg 44
^{)I
MethodInfo
S%&<
file
n!z-
VV]z|x
3$)B
SwitchTo
PF e
MOUSEHOVER
c7sY
MZMM
pwcsTitle
|#nqbq
SetEthernetInformation
l8y/s
FwHg]7
field
!Y]aJN
QueryValue
CreateLink
?=5,
H^"/
LCa#d
{?^l?u
#j D6@
MOUSEEVENTF_RIGHTDOWN
s(t7B
remove_ResponseBytes
InitializeComponent
$\Hz
add_Closed
's*s5
@%z2
get_Value
get_Topmost
%FLw~
Y kc
SRCAND
RegisterWindowMessage
'lyJ
JN7
lpwTransKey
0BA=
6,4,:
MERGECOPY
-,5#|CjC
vS.P
.!N/'
=b|(
.?+C
9 aR
A&]9
x3"s
oC2ErV
set_MonikerString
Sfn,
*Qy M0L
rM*
BH,B\
" /v
set_PasswordType
=JA^
<AiE6u
Ih ~
/v2
9H >Z
zup4J
N,?a`
XX?,_P
<Title>k__BackingField
6 |6#
p 'D
-COum<f
O@z'
.J#hl\
>Em=3
Orcus.Shared.Utilities.Compression
D"5"
^?iK
Fo86
uT`:
<6-g
.cctor
FT>\
p Zkg
WS_MAXIMIZE
L43?
f/\z{
%z !
CMH<
O{Yn<?
dAr
EP3-O
bB"o
EuMn
_Sjm
? M h*NC3
)pP(>
g8X)r
fj<!
Current_ExceptionsAvailable
m|xO
*\:s
ReadBytes
WindowsIdentity
0V2v0F
ENTERSIZEMOVE
Rua'<
GetHardwareInformation
I:w d
n1 MK
=m@{&
Hold
bB"J
Nc9'Z
costura.starksoft.aspen.dll.zip
-y|dK
rm`(9
bU%,#
encoding
bTBbwp
Kernel32.dll
entryCount
Kill
CompositingQuality
TripleDESCryptoServiceProvider
UdpSockets
NfBb
;y[p
L|-Od
=26i
[=bq
h<-J_&Q
0Nd#@
F8,*
5!,4
_'~,
#(u<
UnicastIPAddressInformationCollection
`jfzV&K
R/4!q
ar2&
9pQ`
System.Reflection
MOUSELAST
remove_StringDown
get_IsWorking
W++U
0hSZ~
m&Gx
2} X
$;9O
e^5v
&b*!$|
Y'<+
dX#;
:!, W
bQIDH
Ye '`
7AM_
threads
b[h
get_Png
)B71
vr<B
:.b&a
KJ <JpZ@B
su;_
LoFf
0?w9h
visible
hH3I
yOezJo
"[[.=}
f#X3
.5{%l
Size
PwwL{
R}T ;
eWy5
Object
"7N7
SC_SCREENSAVE
(fH5
set_Source
>k(cP
HgHRn
L=Y"
0|!
R}L_^
e66
^nw!
Orcus.Shared.Commands.Console
@`xGR
@&6(
wH= Z/
32+_
6#[k
<Image>k__BackingField
.7Zh
+,fk0
Qs@*
TaskManagerCommunication
WM_KEYDOWN
<ServerConnection>k__BackingField
>dtv
<y } M
WINDOWINFO
o34
iM4z
a"!\
<>c__DisplayClass11_0
._n]!
NK2M
StyleHaveSizeBorders
u{iC
67j1
RegistryValueQWord
w4 Ds
dg %
}~r0
+%|%
):x*h?
{N^T
6<#w
(K~z-YgV
dkOQ
\4G= vr]:
3OBY
U LT
set_ProductKey
*.s
get_OsName
5Xep
bR>3*e;
SYSTIMER
+ s(
kKn{
/0Gs\
O]Y'
IC@%
IOrderedEnumerable`1
H<0Ao
#=fir
b?_{
MMa_
CWB
_&Bc
>o`W
HoGJ
{3ab
!/o0
`| 0b
STATURLFLAG_ISTOPLEVEL
destination
r$ E
C A
Gc "
4]Z+
set_HttpOnly
Expires
BW%t
NkA3
p8:q
GetWindowDC
=hy1$
3System.Resources.Tools.StronglyTypedResourceBuilder
p*rkC
c4]'
SW_HIDE
Z4 Y
GetData
ulOptions
System.Configuration.Install
m}Q<
CONTEXTMENU
d"6=3
% fTr
T,srR~
Q?\1Gq
J!zE
$mtv)
w0F|oo
ReadMasterTable
0J&.]
W%"czW$
CAPTURECHANGED
R__H
fTr7U7
_listsLock
i a8
s=5$
WS_DLGFRAME
-<?C
hSV1
PO{J:lA
System.IO.Compression
#i;f
QAV-4
Kb}o+
7l/!
U(?V
OperationsLock
s@5
hdcSrc
System.Collections.IEnumerator.Reset
WM_SYSKEYDOWN
S;5tA
~1U]
'[uU
Orcus.Shared.Commands.Audio
XrLi
5na ,Y
TaskFolder
TWca
k: r
76ww
_client_Connected
KEYLAST
GetCurrentProcess
ERc<
LiveData
get_RemotePort
Bbn|im
LD2)q
* j~
MozillaPBE
4IR,
>K}|
\j#%}0
) M~O!
E g#b
PFR:
[;C
5xY{
EGDy
hX|/
IqxQ<X
+[p|
c+y=
/w i
add_CommandLoaded
Vfks
5BT]
ServerApiVersion
xMk
#O'c2
fx=9
CP{=L
H<Ux
s$T<"
i +pI
Ol*5s
ncMessage
>Fn8w
es\'
ckV}
17(a
EntrySalt
I.4h
zvB-2
aN_#
ResolveAssembly
token
s~Ync
get_Millisecond
`iF+
NwqO
az{.
v<rG
f!2D
G\*GX*
w4T3
"phEw
=y 4
get_CurrentCulture
yUv'
n]jy7
KJzv=s
wKs~
LJ|
+Ag
CP=r
*o_Hw
-dmo;
HIQZ(
n>n[
CoreFtp
D;&l4
B%.Y@
9 pYe
HTVSCROLL
MassDownloadManager
RU#{{
lpTitle
e8j n
[=B!
gR.r|I
HTMINBUTTON
WYw^
(F@
3AAg
<EndRead>b__2
>#*ugT
<EndRead>b__0
<EndRead>b__1
n:
n]bZ=v
c_1Q?
DSw.#<K
b [i
SC_TASKLIST
I4"C
1<qd0q
EBs T
ExtractAssociatedIcon
f3`}
_keyboardHook_StringDown
]j#
4OZ"
lC}
i;et
g(v'V
TextToSpeechPackage
BnY\\
u7L}
aKcj.}
b+#
set_InstalledPrograms
KeyboardHook
$OTX
<AsyncOperation>k__BackingField
*+3N
SHGFI_SYSICONINDEX
<MessageReceived>b__0
TLY>y
1YIZ'V
~n
SelectVoice
set_ProtocolName
I<tA=
x]bs
,C,Tq"
`Zxub
set_RegistrySubKeys
3ysaH
ResponseError
R>fi
|{fk
Fields
_keyProcessing
p*rSD
KeyEventHandler
[BeN\
} R5
3X+f
tNIyV
csv
n;7I
WU_-
r"OZ
)0Q<
@}*I
X;!G
yN &FE
- G
SecretKey
ZvkLx
<#Dgxy{
}:?9
QACL
<IsTaken>k__BackingField
IoD_
j%]^
ro:Gf
pJ(v
p rd
$Vg5K
)!M
Vc#
7^2^4^
&%+MJV
H4:0
Lq9[
{/Nj
p M)
]~u
ee~K=
&3%.
AdministrationId
KW[5
}sQ)
z-G
>ERo
\~=*
Objects
Y wD
hitTest
ProcessNames
oZ`Zh
GetDefaultAudioEndpoint
lMON
'#BOp2f:
TNhA
kB(ZR
CryptGetHashParam
KEPx
h\v^ +3;
Juh>
bUiQ
3Db\9&#
Wf3M
\FW/
\Vg*7K
_ "ET
1BK"
,VER
"7>s
[+rH
?=j^OY
a{NaI`
V^ %
UserInteractionWelcomePackage
GKa.
mCm
5z?(S
G8qoR
Zz4V<wZ
oh}Lp
RegistryCommand
[/fw
sQ5*
dwProcessId
pszProvider
w#D)
U>"W
Ve 8
n g
YWf&
abBr
N@?0d
isDown
Q-&r*
4D0R3o
HJr=
r1YE
$Z_{
WriteToStream
s\5g
m7m
YG)7
+3!3
System.Collections.Generic.IEnumerator<System.String>.get_Current
a//H)
tAh`
b#zL
%`aF<
MozillaDecryptor
H/NaF
T0TTTTTTTT,2,4TJTLT2LJ4*,*4TJ*2L**,,2*|%%
e:iB"
'm=
IPHostEntry
<Values>k__BackingField
IE3S
Port
GetMsvcrPath
ActiveWindowChangedEventArgs
ObjectIdentifier
xud
digitalProductId
HardwareInformation
,^g4
_ L;M
Microsoft 2016
&n\a
7Cb5
M`)xE12
SIZECLIPBOARD
HookType
}T
GetInstanceNames
entryName
y1Hg
^VLq
.U,UX
grWW ,
_yO<
&&-%
q~Wa
}h+?
|-q2
get_PacketSize
/j}G
Wy"[
root_num
c~lz
"B;*Ps
K<i]
!Oo`
H*gh=D
(wb<j
1v ]f
crm[
$A^#
O|u{`y
+sEkAR
;*U:
SHGFI_ICON
b&=E
{,{y
b3So[
`wp48
QB s
$2V!
|p6i
W?hP
UninstallProgramsCommunication
?&J
=M a
INITMENUPOPUP
set_SendProcesses
ResolveEventArgs
i-m\
x-tFw
rO<
sW[
target
<>c__DisplayClass0_2
<>c__DisplayClass0_0
Orcus.Shared.Commands.ExceptionHandling
fuq~{aGUR
IsCancellationRequested
N}7y
gOeK3\6Vm
weCzSv
whU=
QiS"
VOO/
r7Sa
L_r$
8 <a
K<>C
mXgg3~
!lY[
R!#
kE"H
r$#
encryptedUsername
Create
?!sf
}e&y
jzyU
AesCryptoServiceProvider
?M!/a
FbFK$c
hBT9
IbM/
S ^
:O0
<Go@C
%S"'
+;p|
set_AcceptsReturn
PackageCompression
RUQ
^&7~
/J+J
<GetSecurityEventLog>b__11_0
1; xwv
P?SF
Ly_e
GetExceptionStackTrace
<>3__location
L8no<@
J~ FM
4TSD
2-i+.
|KzD0
oe+\
j v WH6
[131
)o 59
:0>z
hi*[
,3 i
Bzz9
}Hk^
k|"_
j; C,
H>HE$2
Data3
_staturl
FjYm/j\
i]$`
p %5
wi/M
yqR|
P 9m
OcWpy
#iJN
SC_MOUSEMENU
JnQK(O6\
WczxZ
ZB@
Vb+d
gjz,=S1-
4@)w
1Ov
!>SO
,Q1'
Af(l
1&7kE(NK
Na5$K
Orcus.Commands.Passwords.Applications.Firefox
hNtOr
|eROCI@
add_SendMessage
cG.F
}pV"
Y}PO
e]rQ,
8 t{:
,5D!
c&xN5
}#4-
)Amc'
4S,m
CommandSucceed
IJ97
IsConnected
j y[
qpykyM
{V5
ZSKF
_msvcpDllPtr
GetProcessWindowStation
(&:n
h&j!
&GTn
x6J3
6i I
CTLCOLORSCROLLBAR
ZB
q` v
w ~?
vBNqe(
7 po5
g]&M-8Q
tZ&!
Bb*.)
DirectSoundOut
^BY8
{0fv
IsAlive
q.#i~#
get_DeviceID
b}3 h
<Rectangle>k__BackingField
8ssp
n1_J
SbtD
GetDesktopWindow
J<Sh
gv>H
Z-7&
kq|n~*
SearchOption
IGNq
M^G>
kdOq
#a@
+.@!
X_a>p
\MyG&8
& r27
0=6{
` C`
U[_hP(f
1auc
S(S
+tl#s
<ExecuteCommand>b__1
+Dp)
IsChar
)Ui6
PerformanceCounter
'VL
.mk 1&
R?+<
*(1
SpeechAge
|l6)J
#Tkw
CrxpcC<iH
GetFolderPath
CsQO
bi\
y:|P
8 t h
*(#
Ya9',
n=
AssemblyFileVersionAttribute
r<H
DFh"
KeyDatabase
GetTempPath
y7^P
get_PrimaryScreen
-G-
1/rn
JrDP
T8xO
+S)8p
0l%/
;0s.
System.Resources
\+{v
>x( ?
hzHE
set_UserDomainName
_rp@*;*
CodeCommunication
0gQ)
flags
rl
5 Nm
fTe<
AuthenticationException
Current_CommandLoaded
JmV
x &$E
a)XA
-d{|
W!hb,fhjD
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.GetEnumerator
cu]RJ
_LON|
<GetSoftwareInformation>b__10_0
[|!-
CompareMemCmp
EnumDesktopProc
<GetSoftwareInformation>b__10_1
set_X
MoveTo
iM} 6m
HZ9\
uw'?
l[4me9f
JQ9T
dE~f
|>aq
Sm~0
R66R
set_ProcessorId
r9
~$Ct
p/x4
+knt
}C$-
dkdh
get_CurrentManagedThreadId
)=WRqx
fInherit
ez% 3%
M9MG
-fEf
OH%U\
get_RenderedWindow
UFS:
GYA|
.wPc?U
T5b9Q(
,@[]
DrawWindow
)u3-
whWlW
@D4 =
d;f\2
&W~]
CTLCOLORBTN
i"b7M
dwAttributes
@=\j
! 58}U
*y g
4G:}
Exit
C~;A+
46}&
{u}W
{A5j
q=/z?
#f9]ay<
Uu1.+
La<F4
NSSBase64_DecodeBufferPtr
LlY
"K;f<
\/:5
?Q[K
YajV
PasswordType
AW ~
H[2"g
[d&=Z
B5h_UK
$+896
?/no
WTj*
ExplorerUrlHistory
'My[
[10F
8\t
;[uU
j6aO2
k&J
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
\6b>(
?t,J5
dmPelsHeight
aHF|~
ALG_SID_SHA1
TaskCollection
HTTOPLEFT
KeyValuePair`2
SynFloodPackage
V8kL
(5f>n` !
EpWj0
set_Field1
MIB_TCP_STATE_ESTAB
K}1e
vkCode
lK&H7
ConvertFromOrcusValueKind
|<8}
@foH
?5 h
FxHG
AdministrationApiVersion
nD%2SR
\z3
L]HrF83B$I
>-t}
r/g
~E-
5@,'
%r|+
<urlHistory>5__3
z.@z
GetTickCount
n`K,
Yi)Ei
Int32
Xk}E
get_Success
3=\>N
gBw
!e'>#
a\vu1
EFfp8H
SHGetSpecialFolderPath
2*UJfZ
tB$n
mqSF
by&R9d
# <ei
degrees
^*8e
}thF0
m{#<
GetParent
*.sJ
N9 +i
]~?*
(,EL
UAo_
]ubOPK
*.sL
nt=v
TIMECHANGE
)<*q*
kgh
|avr
,qtmp
2h[b5
*.s\
2X"WEG
a|$p.
$6uj
packageCompression
Lh=2
'h(q(
Ib.~
R(=jiWf
set_StandardErrorEncoding
5 d4
r'wa
eGEe
resourceMan
get_InnerText
{Ea#
J+"
lpEnvironment
vrP*
_hookHandleWinChange
(K c
^*r ;/
*.s4
DeleteObject
*.s
$ m
I5tWUU
~Ot#
N'o"
7W.BOx
get_Minute
Y{.N
System.Drawing
costura.cscore.dll.zip
,V S;
^Bu
LQe\
X1J^
UUC5y
/+M.*B
@R[LZ
Orcus.Shared.Csv
[4Mc
, yx
W
&5l&
]io>L
uLvA
aJqa*
GetProcessTitle
get_EventId
ibuj
CLIENTTAG
{ \^
p*r]E
wF)Z
B9:" G
get_OSVersion
9@ G
F!4G!
*Aei
%Mdd
[We U
set_AudioChannels
DebuggableAttribute
[f2m
get_OperationalStatus
get_EventID
,U('
4~8m
u|\*.
RegisterTaskDefinition
wU,I
6Z Tv}D
$pSm
(((FQ
aWFJ
ScZ3
L*\b
@80
S 2KJ
m =d
RiGD
E}t-
Cast
,zb.>q
8JUtV
(?i'
IkS3eh
A '6
Di -
add_TextChanged
UploadInfo
j_1,
GetFreeFilename
D_9!
DecryptIePassword
91\Y$
0 i
TM=
\2Z5P
~w(z
2G3IkZo
='6.
_proxyClients
HL$1
Ecbv
'&gM c
EyOa{
)*\:-
R` +
I"3}7
dXd2[
|}0wtj'
r@-PQ
V MP
, (
F(G&
- Jzww
K20&
Monitor
<{ F
Mutex
y}3q
rL866a &x1
!; ;
?KrZ
UGB8e
@@,8
r49gWV
SystemTime
Orcus.Plugins.IConnectionInfo.get_ServerConnection
ddKGS"K
B!+!
[Th}
MDIICONARRANGE
wpWJFg
Mqsqq
3}|+
q\/W
Bj vG
assemblyName
ProcessInfo
t',C"
, (I
KeyLoggerService
*IUq
1 AA
_deadKeys
ks%w
IcmpFloodPackage
E3[e
lpFileTime2
[j!0+
D Xu
CommandLoadedEventArgs
8kMw
Select
}l0g
(StX
g6?"
v5Jo
oMz
set_ReleaseDate
JZG.
kbzq
0:c7h
EditorBrowsableState
AssemblyConfigurationAttribute
set_ConnectionInfo
b:p|
$$>X
3sGy
w p Q
\"gH
PALETTEISCHANGING
"}M0
*rm
}iv :
4KWSO
~chK
IME_KEYLAST
LOo'
gaxf
ik_&
seconds
DeleteTask
:N~AW,
?c?MU
OQXa]
<\C
_w"
#9u7
D_D q$
AsyncOperation
:t1<
*/2n
BIfFG
U^$3
{T]B
Q__D
get_Cookies
tyy{{
%<]iy E
1ZP<
JsPZ
g!\;
usernameField
, {"
`rmn
A4Wv
X^v>
ue'N
aeY/ 5t
AudioEndpointType
K,
WaitForInputIdle
EnumDesktopWindows
*r=
SecurityException
+A"a%
T-fM
RS\j
lpdwProcessId
Q{!U
[zKa
a3w-
WA@T?
V9VO
B$Mz
s(
s,
_screenFactoryLock
get_KeyLog
q(<.
mI|@
BodE`
y::
s?
_`V0
T=3
s3
NoTL,+
c?2
@C{
PK11_GetInternalKeySlotPtr
HD&p
}?KnaN
kVl9
ullAvailExtendedVirtual
Rijndael
s"!_
&KXq
SO%?
}BBDj"
S'n(
Ri@4d
t[LdhZ
P$)
{v&]1
get_Primary
]Ob@
Interlocked
get_Culture
fW/H
28["4
S#%.C
M 9
XmlTextReader
**xA
% }+
% }*
Connection
OpenReadonlySubKey
ufDEQxy
W2:A
A9d-x
AM-+
?-4iu
uScanCode
%"8 c9N
sO
CodeImage
%S.Iz
sE
nDf$*
^T|6
Q:9V
rectangle
}@U,
Extract
sT
>WvAl
Oq7udzT%X
:A{c/C
reserved
*-bbZ
ipY$
f 9 t
<GetDesktopWindow>b__0
set_AsyncOperation
DM_PELSHEIGHT
V6a[Y
dM@n
7:tG
t'K7W
get_WorkingSet64
L-KsW
3;q]
dwThreadId
vPfK
TCP_TABLE_OWNER_PID_CONNECTIONS
r?LD
w8'<
[bV@
}s(hJ>
GETMINMAXINFO
jXqCw
]e[
_lastIconImage
MKv
M,MmM
Z- P
WebHeaderCollection
label1
bin4
Orcus.Commands.TaskManager
label2
1c)J'4
Gy (]br
*n(
label3
4tSs
F1_a
!b>;
<GetBiosInformation>b__4
IsUserAdministrator
collection
B!m!+
5 GZ
3b<q
?4G
UninstallButton_Click
g`nx3
d >YV
9sy
SendLock
<yIrur 9
zx U0
z].x
.uf
get_HasErrors
@bm`"
%Tj0
ApplicationOnIdle
n.pw
(Zc7
<ProcessCommand>b__0_5
/C<-
r./C
31j%
<ProcessCommand>b__0_0
1RYHk]
p*r/E
;~
get_ProcessName
n.pg
ckL"
InstallIfNotExist
RSmy
o' s
G+A5
y+'0
ISoundOut
GetEntries
set_Y
^@[7
W"R:e
%g {
VZ-?
!#3nu
QB$w
_livePerformance
T: V
0l?>
1]|\
k"}X
Z|Ai
G?$
zD[l(
e!I&B
%r&'
B YC
5O`,e'
=G <
WM_LBUTTONUP
+,EK
S]]t/
.p7J#eQ.
image
#qXJ
wParam
ComInterfaceType
nScanCode
FW35
H3Jc
$n=l[
?]p
8a2
DmoMp3Decoder
CK s
}+$`-
<>3__registryKey
set_ConnectionType
HSCROLL
BLACKNESS
FileContent
BvAw0FI
tgASV
vMq?
ToLowerInvariant
/(8!
U2''
Ivw0
Debugger
INSTALLSERVICE
"5!&
xL|X
NCMOUSEMOVE
X9M1
`kLk
Y*Os
&- \t
fZ9-9
)a/%jE8
IsNullOrWhiteSpace
C*|A
VirtualKeyCode
_keyboardHookHandle
UC GRao?&
N23`?
>i"pc
<RemoveFromAutostart>b__3_0
7lx*
ih32aAZ
+
Hide
p\W
p k$
$]C"
{k i
set_Width
ManagedInstallerClass
,N +/
z:3&~
K}:NW
@{
dvlR
set_IsHandled
Nh)i.e
i`(e
MIN_ALL
aD>k3
y/XQ
9r+N
CreateEncryptor
)^g~%0
JU/\c1
dwProvType
]}I!E
19gt
2Dp*
B?*.w
<IsInstalled>k__BackingField
u5)a
BG%t
+B
vJBn
ActiveWindowChanged
get_Ticks
bsc[
ArgumentNullException
get_PreventClose
System.Speech
get_Major
Orcus.Service.Native
?RRW
GetPhysicalAddress
set_PersistKeyInCsp
+X
2 {j
e)`Km
wtZ!
X.Qr
ge ?8
Tk,L
Orcus.StaticCommands
S/V]
zq#Y
+h
}_H"?
count
m$+m
AddMilliseconds
VA_t
WKR?
)0vu
3 i
v2.0.50727
B\lx
=Q l
<GetFormattedKeyValues>b__0
VnvIfv
oJD4
iII]
g[34#M4
ALG_CLASS_HASH
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.Password.RecoveredPassword>.GetEnumerator
?"\L
KQte
A+<F
a BlD
gl!G2}}
^=f/
uZ]
e=`R
get_Passwordcheck
O-BU
=/=Pp
~:hf
s" @9
[N2U
D9);
LH>4
get_Default
A#gq
!=3+
dataToParse
X{|O
o`8ay
hexString
)tci
e oCw
L^x7
l,v^
get_Lenght
9z'Y\)
:hF
zyS=
URL_ESCAPE_SPACES_ONLY
x6TW0
O>1bh
'[H8
txKt
op_Division
8co&
F> &6
duration
10g ~
Wu-<
|9+p
Activate
AddUrlAndNotify
zkQ0y
VwR{K
|D>*
\hR
m5if
/Acp
wH$N
EnableVisualStyles
<W_6\
RegistryValueExpandString
)$$I
WriteObject
(~Lq
N]a/^
op3{
bb\@
<Main>b__12_2
Flush
p0e,P
}V!?
)!L
get_Connected
GetEnumerator
e_%S
(fiT
<GetEntries>d__2
~8/r
2R;/
u+3$
&(>
Z uso
+7K(0f(
H3i!
MessageBoxButtons
2~!/
JuZ`7
System.Timers
:q-5
4j[Mlp
xo/^8
1ye;
8Orcus.Shared.Commands.Registry.RegistryValueExpandString
_#Fx
7#97
<RegistryHive>k__BackingField
#y+`
:@d>:B
A7z
s br_!
CzQe
9ZBezVc8
iv&;
oa]G00
TCP_TABLE_CLASS
tT|iI i
&pMg
\"-/ ER
(^iR
RJ\t
get_DocumentElement
ToUInt64
mD7n
l3S7
set_Passwordcheck
B@tZ[a
FileSystemInfo
9cf'
KtP%I"[
`/rE
=W\o
Qp=x
q(ad
CS$<>8__locals1
Orcus.Shared.Commands.ComputerInformation
StopConnect
Pi+M*
aw >~
cBmdN
<password>5__1
ReportError
VTTw
/0au
mD7J
+j@2
z*/jOSr
/t /Py4
;[\#r
=0S,
\/&VT+?
get_LocalEndPoint
pU W
8[kV
idProcess
a QK^
FileExplorerShortcut
text
Application_ApplicationExit
zsR
Rg=b
Tp^,rp0r
67I6
%nc6
& ov
9|~Y%
clWU
_ l%
}>Ui{UU
LFE1Q
eJR8v
V%4iF
}[Aj
ResponseBytes
set_ErrorType
masterPassword
OperatingSystemInformation
cf<)`
3^&t)
_logFile
S.]?
get_FrameworkVersion
""{h
19H^
S5yi
}z*X
nTeD
Mu CUz
a"@L
H N*
c ER1
x%+<@X
:#k,
:d!t
c @ /
qjg3
WkJj^3
`"dt
`#pgb
JN7SJ
get_InstalledUICulture
4I"!X|S
xy99
sIzL
defaultDevice
< Wk
GetWindows
j0>S
S.OA
SysCommands
<>9__5_0
:E]Z|
Microsoft.Win32.TaskScheduler
AudioEndpointVolume
LTF^5]
{6[[o
:eAJ
set_Cookies
PAINTCLIPBOARD
YR?X
m{8b
5ZbG
mu.i
NCLBUTTONUP
qh
]zy~i)W
- oY
~^Z7
lfr*
CaptureCursor
U$"J
#")D
TuO"
xxx`
rcWindow
udpData
zEZ
l,Pm51
UZpeG
PROCESS_INFORMATION
TransformFinalBlock
cl",
$<9 0
hOq
w{w6
\"4~I
}Q;e
kL
set_Font
^G/.
pl;
<%[K#xJV
IComparer
wuzR
|s)<
r[5rG
R:D)
6>"6
J0lGCo{/
sK3]
j&H5#
[1oq
A.L<
5!^5
<AppContext>k__BackingField
82vL
r1Ev
F[*s
Z!]8%W
xl4J
S`>|
Yb=(C
.(+e(
X_6p
p)CR
FromHandle
p<"=%oM#
&}H_
< Yn
E985
"L}*F
hsx1
UvH<
*mLZ~ 5
mv5r
_urlHistoryList
Ak_y
V@G
Label
*'iZ5G
@Te!5
+-e(
FZlH
LpI
PCGH
INPUT
_ +O
n"!.
j%j
"eGu
,^G9
r{_k
=sxp
>>T&
<Type>k__BackingField
_#\Z
4sQp
K/o_Z
:629q
json
get_ChildNodes
cFeJ
(=[q
UninstallProgramsCommand
p%34
gz*+
RXwi
J!M iRHWB
k,J\
&%,GQ
SYNCPAINT
oV:K
# R3
Count
nMaxCount
TargetFrameworkAttribute
_(fz
14.0.0.0
o yY
SpecialKey
r :m
"L"t
Hz}s
0zJ0
AForge.Video.DirectShow
L>SoJ
value
Bitmap
windowTitle
%Z[:
>i>"
DriveInfo
%x9d
4o-b
CsvWriter
^d&m
|p2@
UH;!
ClientActionCommand
!lUo
z:E
fy?Y
!gBz}
r !
}z v
mz x
S=1|
get_IsInstalled
<P4X
IProxyClient
~g*d
:P(
GetVistaStartMenuWnd
x?x6
mouse_event
S1ePt
,Zc^
'_rM
W-O dKy<od
8m`=
cGcxk
Fau6
&3yq
CHILDACTIVATE
!m-_g
iUSZK
GetInformation
DDmS"
BU%T
d2O>
PENWINFIRST
$>2i
R >#
d[jb
EE6001A9EFFBC3E336D7A05124DA53EF8D648CE1
7N1 F
_5yO1
SHGFI_TYPENAME
Degrees270
get_Exception
"L%
MvERU\
`Q^u
sI)v%
yg>U
I&Ki
@rmo
set_SelectionStart
r{*_
{]0:
ev^X
get_Source
3Kvo/
?7l~U
xt6K
eiM3
WriteRecord
_E,A|NT
^v1n_m)
UFt)
wjOW
!" D*
%B[l
Bt?B
]<V~u
get_IsAttached
QOrcus.Commands.AudioVolumeControl.AudioVolumeControlCommand+<GetAudioDevices>d__4
U#$>F
v,h
]jiK[
}OO)c7 o
&Qox
pd5f
qhd#
`COr
5i g
VMW_EXECUTE_MENU
@ )0
}c}w
h{Q# 7v|t
)1J]
!Je(K {
mpX
(F P
get_FileDescription
y# D
N,"a
get_Guid
gRsn
wx4V
> 4i
Tu\~z
<I#x
yeT}
51 Jb
Thread
I}Fg>
SslStream
dwRop
v!-`o
@g'?
|TBw
\j[u
VH{H
(q~ "
4#4#z
9xMA
Orcus.Commands.ActiveConnections
NE-x
FromFile
b[fnB&
sLwf
STATURL_QUERYFLAGS
`pw6
`#
%VZ~
=](a
cLdp-#B
SHA1CryptoServiceProvider
2&O)
WQTM
set_EthernetAdapters
pP w
+b}.h)W\
RIKP
get_CurrentThread
get_UserInteractive
EventLogEntry
8s p
SetAttributes
%$ =
m l$
?&@_@
MW1j
cjOrB0
RsQO
ReadAllText
|C5c
%'} 1
{;uXXe
jx %-
(=-|
ZiJgk
Q]NkT
set_IsPrimary
~"k-
IU6I{
CommandCollection
o/r_A
GetIPProperties
SMTO_NORMAL
&XTO
v2|Jy
;FK5
p.a_
]7O7
5K!,
ManagementClass
2i^/
F7; Z
[qbYqF
gbY[n
{`D=
w~)Pe
M ~d^
<A3L
Vn`%
zm8]!
K[\]
J8cf
host
`- V
=&e
?bk}uJ
?hnH(
z}/X
-%jX#\
[pvY
fHm.
get_GlobalSalt
<reader>5__2
u*[o
WS_MAXIMIZEBOX
4 Ch
q.(Dj
zzH8G
URO<Y!
]i^Y
*.8'7
{2Qe
gmu~&
!rA+ PC
TC?m&s~2
get_IsReady
Orcus.Connection
95s,G
&8<
Cqmg
ZEgZ
n ZXH
J&
UCnEeR
) nx
WindowFromPoint
qCgRn_
|n:u&
I5QL
ii4X
>H>[r
{uW_p
Fu)>K9
dataMode
]\l@
NV}?X>
.s\A)~}
b:zU
(0tZB
Im})
~|Xk
DTnE
GWL_STYLE
\ <.
@L%Q
Yiq=
set_RuntimeVersion
3/Y
Zz;1
set_MaxRefreshRate
ClientOnConnected
1NTN
8N)P
Mouse
)DN
vB40
B^0%
Orcus.Commands.EventLog
$@9?
GETOBJECT
b8}]
&8f
,4(
TaskmanagerCommand
SymmetricAlgorithm
0;dq
<>c__DisplayClass14_1
Serializer
9|3F
S|%=U
Compare
+YK.
<>9__6_0
&8Q
get_VolumeLabel
Y[#(u<
(!?7
Notify
f*;Gf
+
X>V&
3|Pz>
\dxoaj
ApplyWindowInformation
GetDesktops
wHge
GetFrameworkVersion
x_w?
)<\N
SRCPAINT
; ;?'
?P*1I
WriteLine
nD~o
p6'c
l^;4
!5agu
18 u
p1?
v9 J
Ghk1
L:hU3<R
uSan
_C]k=u
giN|4
.A(s
~~R'
$cY\k
}!Zc
FT |
~l[d5
ipEndPoint
}0kM
| m4
${kx
=cL3P
bE6g
_u (
<>9__12_0
<>9__12_1
U)Z%
t 57
=/O&
lVOlU
(<2Wc
HTTOP
LRJ
`~(X
_&kA
ru !nq0
n4q r
h,39
w8Xx
timeout
):%!Xr
" #9#
vutX
3y]x,
4,:%
p~+F
l7.C7
92)]mt
l4hD
T(ES B
mI X
RVfy
UEy,N
L $M 3g
@v9g
34vd
Sleep
j}%)
*W5t
UYRv|
3
1jJE
c |
SVNZ<
&q5p
1Ptq
8u|
& uN
L sY%
;1d?
DateTime
?}b
EnumDesktops
djn
0n /;
$;r~;
Wre$
Pmx(
XYo2
QqIN
I?p.
XYo:
fvTg
Pidgin
Nm#H
bYCsq
j>wxn]
VTZ>
P]QSN2JkPM
XYo%
G|)D
System.Runtime.Serialization.Json
IteratorStateMachineAttribute
Wow6464
yyE`
T5OG
ConsoleCommunication
cP1
<rPF
w!\Wv
g}sN
DesktopWindow
XYo]
,#qIG
e2,M+
get_TwoLetterISOLanguageName
zA?
I?Ir
[11x
2_c0
ChangeWallpaperCommand
XAo<
&lht
St*
i|2v'
y.Ty
E~r
Ff$]
d+Zt]v
T|o%
[}-)
{oB{
Pb\7&rp
~:?@
H H-HhH
% |@
TVLl
J4nSZ`
<GetExceptionStackTrace>b__0
J h`
]1bs
0>
xK_Ff
dN6&
MnR
Rasr
D|/F[m
_uninstallPaths
4DFy
?:^=
YY9s
yZF&
w*K^g}Nz ]g
CommandResult
BZFBy
<e \
r ;
_]g7
LockBits
<RTE==x:
S]^~
ptScreenPos
6@12P
qIpkU@
e,[^z2
>qx{
cb 3
S Ma
FileTransferAccepted
Wl'm
]bBR
tGU
Q)P^J
S._O
ExitThread
Orcus.Shared.Commands.UserInteraction
W2$0V
b|vJ.
z F>Y F
hi<M*
Mw-u1
Orcus.Shared.Commands.HVNC
HDP]
FoM|
path
zne1
omWn
0V5=#h
/yqa
uYg8
|*mE
tavV+
4]=U
HtWQ
OWnj
hl&
^7^~
*{_
;XB]Ekxiz;f.
ekT{
q]sG [l
ProcessStartInfo
SMTO_ERRORONEXIT
G1S}
c^xE
4N 5
rA6\
su.2
L+/w
iM'=_
TpZs
C[/@
GetMethod
set_StackTrace
$6)2
<key>5__1
3w(w
GetIconFromProcess
:% !
e`+K
HiveKeys
RecoverPasswords
R}nt i(V
JxB>
8Q?
NN&t
B,<-
SynFlood
a.}9
T,9d
~F[<
X+->
vp2U
_reverseProxyClient_Connected
]p U
H k*6N
h428
"rI$
IsAddedToAutostart
6 ,9
IsDeadKey
PCr$
?9OAV6b#
HM>d
{yo
}| p6
5Z ]M
@_'nvx
Consts
}FH
set_CanChangePriorityClass
Cs@8^;
]AIt
HZfT
Costura
IntToIp
Pl?'
wu|Y
p1P'
O Bu
InterfaceTypeAttribute
<Target>k__BackingField
J:KGKdK
AM,W
hz d
9>4b
*l}I
/^#^'.
!^7n(0
{R'>_>
1Ka-
COMPACTING
>*R(M
6Z {
q#mJ/V
3MwW\o'
ZrqXp
j0d=b
LNuF
hDYNz
_ 4h~
IoDd
Zu^
<<7b
9~[L
bg^
1y]$
|Y&V
9$#X`
ex]9
jd?a
JoFgu
50p
O Ljkf
V5^%
lg9-{Xn
UM X
i |p
rU7
UYnw-
Orcus.Shared.NetSerializer
d&[^r
WS_HSCROLL
ifML
xz,08
?8(x
get_BitsPerPixel
{C=M,
Asn1Der
=4z&7
\Qen
+(ka
AZ?#(hU
get_Definition
_databaseConnection
3H2Y
$C4
?TVa
GetAncestorFlags
`,Lr
$3bRwO
8GiC
M<W;
N,Md(
h&Zt
SRCINVERT
m(]
ForEach
GetConstructor
get_PSize
tVS[
Zr(*E
~$wVM
CTLCOLOREDIT
_v?0}P
Q&Yw
Nwyt=
cWhq
9!N3
e,H5/
m/vQDx|D8
u"f.~j
{r\7
dwOffset
Z0~G
uQP;
'W7c
9C}]
HP_HASHSIZE
<U6Ix
AssemblyTrademarkAttribute
ZO" j
|y%a
Eb,
e&KQ
FVZ
uyC<
f( 2
EnumDesktopWindowsProc
yE}K
sY Y"
]bLTw
CPL_LAUNCH
A*iI
RSQTME
S*DM
nc?H
P4%G)P
^Ds;
=!:e
Nz%1
add_ExceptionsAvailable
R,SI+D
m _\d
n(9M
/4N>
BiBPCmC
xH@2+
^.JMt
D+$kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG$kG$k
h>Z<
4k+O
System.Management
7L#]
{r l
StringSplitOptions
dc)tJ
B6Kx
mH0}
2!>g]
JDownloader
GetTcpConnections
- c#
Connected
c@E
;9guRdQ
y@?v7F
<}] "
lpProcessInformation
~?Ed+
2p&9
DoKeyPress
n+.*
I4H@
set_FormBorderStyle
-uuz
-A=Q
h?Xy
*!V qJ
SYSKEYDOWN
}SY8/
~(VD
_u.'
gLo+
< 6q`
+*r=C
8-W
IEnumerable
P8Ok9nO
gm=5
<mT(
z$l
rXEz
QA
v2Z3
EDBU
get_VerticalResolution
o.h<
IgnoreZOrder
\Ah|
pl!85M,6
9? Y#
{P/~
B,!Z
Uk?H
)+8=
=f#<
Thunderbird
CwzN
VideoMemoryTypeToString
Bbq_
026&
riLu$
F `
Ku-b
<>c__DisplayClass5_1
KnUN[j
tp,1G
m =K
05L3
JrwB
EY\~
O<e68
IME_COMPOSITION
#ma+
Ghvm
1Orcus.Shared.Commands.Registry.RegistryValueDWord
set_SuppressKeyPress
UriBuilder
z7N%
S[Dj
d267
2Q)S
YZv4
&+U]
IsSubclassOf
Jk{Uh
.T(
s ?`
|)8@(
get_Name
;9j?
M\o
windowText
*-Y0
0,Y<
)f!C1
o+|.
UpdateCommand
EthernetAdapterData
VC94U
]>eA
DoesUrlMatchWithHash
pQn1fiJ
XSU
inStr
lastestWindowFromPoint
1q|c
6f4k
r*/ |i
J|[B
3qa=
StartSynFlood
nNh#\
/(4l
P\zXY
$)ctJ
[iOO
&G<RWK
gy _
]s/O
set_Passwords
TFH~
&BB8
No B
BWIg
get_EntrySalt
FromUnixTime
2V"
$ 0P
AP?gI
l3-H
|F>+
a!fc!2}
% }-
H3w _
/VGZ
z)-?cj
)vbT
5b7%
UDP_TABLE_OWNER_PID
e~g,~
_receiveCounters
+bzM2
=5hb
+`J
BlockUserInput
StringCollection
y|"yZ
*s9b
'aN=!|n
USER
=}qa@
w@zy
get_Headers
MBUTTONDBLCLK
i!d2
+ r
pass
get_KeyCode
{@.b
Raq[B
. Whm
rd 3
$- 9
set_IsCsvData
w_Wu
p*r#:
$k:yG
m3LMP
4.nmi
ZKAf5P
rj&
2$f=
: xMX
SRCCOPY
x`.
OpenReadonlySubKeySafe
~M0
)=Td
D .0
Q .v
y:OEf?_
F((
get_Values
Convert
WinSCPDecrypt
IsSearching
E,uX
h"C*
?XU
MakeUnique
-!%D*NI
_standardInput
Y#;`j
5e,W
{l<S
\J6xY
H[OR
=%U[
MouseActivate
EO5IGi=]x
_$[7
aa b
Ev+U
n{ w
?[X
jp"B'
FlagsAttribute
naL
jvO @
J:gp/!
set_KeySize
pXX<
bf|I
dmReserved2
SoundOutDevice
,4ef
& UK
#njiR
bbX?
op_Subtraction
mSd*)
dwmsEventTime
MN;H
1J>V
Nx(P
GetTableNames
Bw%t
ZDuXM8
30Bz
get_Description
nzg"ozg
IEnumSTATURL
xlxx
" [
WH_CBT
uploadInfo
IfVL
P5`+[
yzCy
pSize
get_HasValue
Records
]Qe N
e;Ct:P
SecretId
O7WK }2
pRotateDegrees
defaultDeviceId
LogicalDrive
k :(
|4>?
(Csm,'e
+4'F
J@l 0a
~= :Z2=
3;^%
,U_x\t
nzzf:
get_VolumeScalar
StaticPerformanceData
MinValue
WindowChanged
Z/#R
_appPath
System.Net
I!\
URL_DONT_SIMPLIFY
z8p,4
S:|;
Ld_:
DROPFILES
\ba%
s XH8
4r,&G19 ~<
Z~e7Q
[u1=
}[39N
}F\p
v,KT
i+8_%
UYb.i
get_DeviceName
qJ_@
ServiceStartMode
;B,`
[Q;
!8?VL
O*rV
KKi
NextValue
XMEL
prg@
Nm-d
&v7|
)];Q
t&.)
kernel32.dll
get_CustomName
UnD?
qoMp
66I9
Enumerator
NotifyIcon
Image
8Dw*
?sQ
FK/NIn0,
DK3S.
l`x?~
B~H-W
RestoreMouseButtons
e_)W
staticCommandResult
z(mC
(W*2 {l
Oyc$
|Cc\Ax
{=z<~b
uCmd
K!.x
9rdt!_
f f]
Uy.:
GetTypeFromHandle
<& "
Lh;K
QNKu
L[j6
JiLh
B/r^n
i1J
Q3ID
jH2+
get_RunLevel
vClp0
get_EntryName
1,,Q
y)EZm
q_1;a
SendText
pHe.
7gE^.(S
CheckRunning
|\?b
ZtC;
( e*f
PENWINLAST
[mz
i`9ck
Regex
2hf&P
N Db
Rrbc;
PlatformID
JsonUtil
$~_;N
[F<m
_Wt4
x3skp
Cn_i
set_IsConnected
kt(x
jbC[
gs?l
dmICMIntent
5-E[
{`$(iWw
piconinfo
p*r[C
8[oJ
90ITGM-+O
$3C374A40-BAE4-11CF-BF7D-00AA006946EE
v&YJ
_windows
e"MNc
_`(a
r}@
get_NewCommandType
0"S=
_sock
p/Uw
A#f:1
Tk#;
GetPath
"r9+,iq9s
MakeAdminCommand
wGSx%
MethodInvoker
a>{W
~k`tOV
remove_CommandLoaded
v uKG
_otherColor
Fst#
jo45
R ggn8wQ
MajJ
*o Z
y4w[(>.
n3?Q
Uq7k[
=e1:
pM;m
get_Application
m eSS
!MHs
ResponseResultEventArgs
<IsClosed>k__BackingField
vJ#.
IcmpSockets
JC+5q u[S
G73:
\ n
X`dQ
W {G
5<R
SafeHandleZeroOrMinusOneIsInvalid
J0jh
5q\k
Write
pR 1
pZ+ j
hIcon
<>9__6_1
~d{_n
>A5)
SpeechVoice
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.GetEnumerator
Int64
YE F_ub
AnchorStyles
hs)3
Nw7|g!5?C
*.s2
&^[o
gjZac
=B m
MainForm
T+G=
<FileTransferTempDirectory>k__BackingField
-e&eo
GK4I
}NnC
xHZTu^
get_VncMessage
\kxH\
NY)S 2
,v Z
%("p
Kf1;
imXu
InternetCommunication
MDISETMENU
=V k<
[w|MAU
get_ValueKind
:q)ns
A4O[K
5{E]
ks/L
Xs_+
jT=+
^>`G
ExecuteCommand
IConnectionInfo
BNj>
g?{\x
jV/o
}Z-w&@
AsymmetricAlgorithm
JM>^W
!}(f
N|pCL
M t^
t_6{*
2gZ`
uPSRXf
iHFg?7
';Oo
Fv1T
lMEh
T&:;7?
^]WT
Action`1
[* y
dataPath
w;iR
.,-H
bBv
I#~ 7
Z,,^
System.Security.Principal
a51y
<PushRequests>b__0
UN%ouV
wIY;
GoC3s
SHELLDLL_DefViewParent
.{zq7
`D9V
<g1,
A!uzD
"
^h#qw
K;Pe
JW
get_AvailableFreeSpace
mObject
pZ} Bke
$5KG
STAThreadAttribute
&H%
$0$K$
M>WZ
Graphics
:Ie
q/N;
~LWN
add_StringDown
System.Globalization
JyVLK
}XX]
` X
f;k|
!Iy{
_X9
eventArgs
set_TryOtherAutostartMethodsIfChosenOneFails
X}m:
WH_CALLWNDPROC
zYQm
IsDE!
- rW.
mW2}
ConvertToInteger
Oii&#
?z{SXK
<P^\CQ
6_|Pw
h~tp
u& @
[2Wv
\ r{
-fr%
[ 4s
VMyn
E28z
nyvQ
jM6S
Gn
System.Drawing.Icon
bB4m
Fo.m
ww~}6n
,8.n
vQ5{
C4N Y
JA$D
]T+ u_
1\q}
qN .
RemoveAt
GFBXM
`,16
Qy52
yMr0
get_Jpeg
[q x
SystemDirectory
yJFn
(4{_
d^A?#&
zP%P
y)W}
CreateInstance
mnQrm
sTl{F
C KN1
+5<Dy
7i4b"
ItHX
_>5]J
ImageExtensions
=&=}9
#a 4
N6~`
MDITILE
= 2L
TVB
a"gJ
UdpFlood
jd R
=P}9
hpsoi
System.Collections
<3_p
MRX}
+/,X
q%/4NO b3
;QP>`H
V@^?
(GEY
<>l%
ENTERIDLE
pkk1
Y,J#
Orcus.Commands.Passwords.Applications.FileZilla
SendInformation
remove_ExceptionsAvailable
8^ie
get_Actions
P_6't
|~EP
1(0A
gRfj
x@-SM
@xlm+
$uR5
1818q8 8
m{Yp
^{CESd
sM.j
>.{vu
,&u&E
dmTTOption
uzdC@
fm)|
tC&P
%2NjOd
set_Padding
,7RL
H^[cA
nIndex
c_51
5?gC6
peAl
_["Ma
IJTG
,c I
set_EntrySalt
n*07o
get_SendLock
}=\
xCJ;H
C1$Z9
)<z+p
Decimal
zF_V'
0w/.q
*.s.
qB"#
IME_CHAR
NiyB
]aASH_
mw@<{
w />o
IET2
%`T
q %.
<Attach>b__0
LocalPort
oaP>a
^AAv%:~
EK6KO
WJBx=
}pnchM>
baseName
:S]Q
,Myz]s
J^Av
<,r9
"2ga
>n(F
O2.-/
k4BPg
-CIs
39Qm
g2V2
SynFloodCommand
I<-u
q4Y'm
[oT%
F|s2hk
p u.
vK\w
<>9__22_1
kV3l
Microsoft.CSharp
AssemblyDescriptionAttribute
get_Path
* G}N
^Xby
t7JA7
R.s_\
h9Ph
{,+&
Activator
O/jY
qs~q
Xw30
s1 =
A$Kt
H/4]
_translatedDescriptions
5&[z
UpdateFromUrlCommand
atcfH
SetWindowLong
9gw)
$I8
IsAdministrator
_ I
"zs.
pr]H
set_Anchor
CDH 7
,}Ic
DN<M.
ParameterModifier
Y%$
;y >
6"'rV
\g/q{
Double
AJ ?
"efnS
iz
eqbb
?~p;8
n=(1
Qs 0[O
uEu`
NormalText
77ba
DI0c
]FiE:
H's1
e ;&
PK11_GetInternalKeySlot
uFlags
CRK j
9];C
<>9__2_0
}T{;s
>4i_
l^x6W
<>9__2_1
WM_RBUTTONUP
} eT
L 6
;*/
PushFile
W] >
V;5g
get_BaseStream
] 7_
X&cIA<
} C^q%Ay7
Dd7*
S|nc
WINDOWPOSCHANGED
GetSecurityEventLog
2 #
H7st
-lu@Xi
PaddingMode
HL?C
get_AudioData
%M P
% oI
IsOnParallelsDesktop
Gzybe
_D)}
VFwmp
inverse
.2"%Q
MOVING
MENUSELECT
Sm !!
s3:
set_OSName
ClientStartup
MyGetKeyboardState
/aho
"n_
~,&[
90;<{o
^?7z
get_Handles
1S3HM
Kb8k
IX.d{N>A
&;KK
RBUTTONUP
PivJs
TaKR
Socket
filePath
y|\G
MyG_
K!B
x6Bqb
(nvU
LA/J
#&3@X
cZ<;2'
0(z`Uf9
IEAutoComplteSecretHeader
qL$K
outItemOpt
#ffffff
ftExpires
g_#b8
CHANGECBCHAIN
LeTh,#
) 0 H
gBUf\U
SetWindowPosFlags
get_Device
d^'y
!&=U\
+a$9
P|{*
rPK8
% o)
J[|"
_cpuPerformanceCounter
get_IsCsvData
*wJ4g[
{I=5
)=|{Y
DSTINVERT
YY}7
YY}6
CG[-6w
#AG
:[UC
get_DesktopHandle
port
,s[.f
TextReader
set_Guid
k+}
#%|$
G,!v
set_Platform
ltp
PG p
ImageUtilities
K0_3
3[,O
Orcus.Service.Properties
t<{b
System.Core
c}JEN
H03C_
})^5
]BEj
nD)
i36]C
B1_.
+) T
Orcus.Commands.Passwords.Applications.Chrome
_SQy
EkI>|
u un;
,#]p
WG~!
>mAgI
remove_SendMessage
H>sQP
BYz$
x6:2
xZqvtAr
AssemblyName
qD:b
^?Bf
V\^.
Pvq
s2_y
.D!T
ToBitmap
z*lp;(8t-
C1qB*
fEVk
|q6W
_sqlDataTypeSize
}X[x
+) m
SC_CONTEXTHELP
preL
A?Old\
5C/?
(4{N
requestedAssemblyName
-:CWj
1VY%c
e\abO
4+!^
]R%-
O*oM5.1
*^=@ 6
!wGR
IAtd]U
0=rjD
_commandSelector
Microsoft
#$z0
y![
^" P^_|
Jmr]w
AsynchronousWindowPosition
}PRm
r8Io]
Enum
_cursorLock
Fz n
0 W2
Loadables
H[(P
K]o:y
7ww2
CryptReleaseContext
set_ApplicationName
YP3%
Opera
=Pa~H
DESKTOP_WRITEOBJECTS
~fr~:>
>G}W
JY;.I
(u-b
dzV+
k9w*.
zf*Z<X
'1}k:
}n+~
hK214
Y +g
il4l
EXy?)
ProtocolType
ahvh
~Gm-
A~(u
24{~
DZLu7
M?R9
[gg}
vBg;(
^n-n
Cancel
P"$
UZ4|C
xjTp
TG;Y
dEQ~
;!;
stream
!E#T7
@0Wv(o
o#)&
nqc=i
$v6b
2'3wJx
} [BH
AX 8h
SetWinEventHook
l|8/
['dgM
StringExtensions
<Z`Z
e Ed
ReverseProxyConnectedEventArgs
set_VideoMemoryType
-@U?^
/;[F
)1#W#%
u5}$3
)Af.
p*rEC
CNz>
.)rm
c@bTDcF
e<2Y
2AmA
e%m(
V' SM
\GWQ
Id;pa
DnX0kNYp
bG\>
5Ug^R
@!aQ!`
"k5`zak
]b~k
tD;%`
>OaS
2A z,
loadCerts
_uploadInfo
%;7>
GCHandle
j1|
s66U
jhZb.W
IsOdd
ea.{
ScanCode
i=^\
CompareFileTime
j1O
ComponentResourceManager
{/D-
%`G4o
"lN
pg ^G
BRdY
<>9__1_3
<>9__1_2
<>9__1_1
<>9__1_0
<>9__1_6
<>9__1_5
<>9__1_4
HWND_TOP
m3%e
nXDest
RcSrw
szDisplayName
Z;CD
r^/?^
@c wfj
LNylw
Y J$5
HttpFloodPackage
c$Fz
Orcus.Commands.Webcam
;Ia8W
-Q[J&
PerformLayout
_reverseProxyClient_Disconnected
D9,5lZ
y1r!-v
{@O6
N27P
FormBorderStyle
k{3Vm"
ti0:
Equals
_gVZ
X=1y
DeferErase
BNq*
<VCode>k__BackingField
MPHC
a/S
OP{<I
5S JS
@s'8
G@.Tw
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.get_Current
set_SelectionLength
L0&i4J
<dataList>5__1
pOrX
D 5"
J7Xy
dmDisplayOrientation
, ("
\LYl
B z
28 E)
+'
Environment
F}r (_
name
Sg`
DescbcDecryptor
;\2ti
OxF52
JgQi~
x2NGm
b xO V
Threads
)bK*.-$
set_ProcessTime
_icmpSockets
\g M
5B}C
GCJ
J DK
/ #d
]C9J
qqqK*
:f9a
2Orcus.Shared.Commands.Registry.RegistryValueString
j;/-
c%^&
4<1:
s]^"
2XDUh
aeMK
W@k:
oP_
-QQVo$
l4\O
JN#a
\Sr)[4
set_Workgroup
Zt"G
?^ M
>t G
,G=_
_sent
p Z5
9n$A
PluginsDirectory
y(:_a
QUERYNEWPALETTE
{ Zt
~-CT
=yd*
J+[i
wh+KJ^l
WritePlugin
DwfL
t}/p
#`sm
(/]Y$
mLhL
`Oj$
SendToTargetServer
.p V
^O~]
L3/a
uB8oLqu
%$0V
D;`o
allProcesses
8~v$
Ve{E
L3/V
JO?i0
r_|_
5| 9G
b`Mc#
p}\d
(4fUN
SendSyn
2e!"e
{<@G
7zD8
}GhU
PDW_
jSnGJ
0 I9
L3/D
>MOo
Wtv*
P'5V
get_CommandResult
ConstructorInfo
)+1N
o0
SecretId3
SecretId4
SecretId5
SecretId6
aOFM
Start
xbIU
K7HI/.
Socks5ProxyClient
V,xK
(VTV{
F|WO
8K.}
RotateFlip
DESKTOP_SWITCHDESKTOP
get_ServerConnection
)!!mTZ6
93"|
g[e#
VHt;!
!^jJ>
H04seee
CmdProcess_OutputDataReceived
xP R
|7xtx
.v
System.Collections.IEnumerable.GetEnumerator
B4!
SendTo
Data
EnumUrls
get_Expires
=5,T
CancellationTokenSource
Tr]
p,|EH^
Jtd9f
IClientStartup
"83ByHw
KeyContainerName
YJ2[
~t1[
Awq
c:C9
]Ig
1-)a
om
8l^qI
PzFW
4T Pq
System.IDisposable.Dispose
oY
a$
~P~a
Lid+
YyYN
A>'7d Q|
Lenght
3qh>C
StartUdpFlood
sort
oI
g[e}
nc3i
set_GenerateExecutable
<>3__defaultDeviceId
6r8f@
'N w
v3CU
,VX|l*
_sendCounters
!This program cannot be run in DOS mode. $
Hg7V
get_Orcus_Service
(G
^.f{
#nQZ
8x~;
chXk}
M vy
get_AddressPreferredLifetime
{*Cl
NlW*
TY(f~
gL6p
CsvRecords
OfType
x_5R
:VAN
<IsEnabled>k__BackingField
MDm(lA
l~@b
V"dm%We
i Gh
EthernetAdapter
j8ea{
==D}
Orcus.Commands.UserInteraction
writer
`-yb
H/lg1
q_p{
kA~8G
dwActiveProcessorMask
^)=*Iv
Zbg$*
O I<
set_AvailableResolutions
5UK)-B]
Screen
owningPid
GlobalSalt
!rYj
|{_@
|eM}).0
|>WZ R4_
9g]v
sUr:7
w5al
WO[V
8nht
}B \
SocketFlags
yJI/S
g2i
a h!
HTMENU
3E\s
httpData
_E}(
`hAfhAfhAfhAfhAfhAfhAfh
jf<YX5
;y^
lk2b%
MIB_UDPTABLE_OWNER_PID
!1e8
~fKMs
!QVg
"Eb6
Jso$
set_HideFile
CrAF
srZ~^~A
FC0
<L*4F
dV%"e'9
HOTKEY
vNxv
<f*?
h9Vg
KeyboardHookProc
localPort1
set_Ipv6Address
Qx}3
get_ExceptionFile
lWJl
Bn6F
Q9h|u
e $ul2
8?w~
<,=6
CJs7
R> _
StartIcmpFlood
wk+>E
akw=
Byte
Left
3Kl
?n.4V
cah[G*M
containerName
YJz)
# 6
MoveNext
o,5;d
$)xl
lParam
Socks4aProxyClient
z.@V} 8
7eT!
Fc]s
_containerName
x6@j
RF`=`
4L\<
A~3b
n6 y}.W
<SendInformation>b__0_0
<SendInformation>b__0_1
mD;1;B
<SendInformation>b__0_3
0zbx
wLRM
Jmp@oo
GetUrlHashString
wHg&)
zhX#
H-c
ADDH
psfi
`|Xb
q y9
MOUSEWHEEL
p#n'f#
M*>H
k|<p~
%a<S<
DB)F
z&?|
?9F 9I
/ /
flc=
,"\XS:
sW<Ra
4Tef
WebException
}%{g
v',7
e&gC}
Cu ]/
KC d
G >
9\I
T=_V
UninstallButton
pkHG
set_ManufactureId
t]I5
06^1
set_AudioEndpointType
oE=HS
1 XM
p KO
d*\$
04-XL/
rkr$t0 e
}W `h
MI?I
Iyj
V{Ms
ptEx
e/nX
/hS5q
vID^:
[qTW
hKRt
Pywo'
IList
G [(
+Hmq
=q<W
Vs:c
&uS?8
User32.dll
4wFx]
HashParameters
dmFields
YHw
GW_HWNDNEXT
b/ y
bI?`
FW40
=*M?
TrimStart
Orcus.Shared.Commands.HostsFile
ChromiumBase
SystemInformation
get_Item
configDir
}w&5
TmO4
%I5Y
Location
3Qe>
HOh
8bnq+t
CHARTOITEM
GEwC
dmSpecVersion
X= *
k?~P
JavaScriptSerializer
uSzed
o)5kj$Ov
h@:h3@ y
u,I4(
mmDeviceCollection
~&W)B
F 64FA
y<yqa
x+7gqY
m Mj0
JT*)
y#3@?6
tl9
|s2D
E\Uw
, r
Z#JW
d?DH
QP1Nj
Gv@[L?
/O-z6
J^za
}m:\
FindWindowEx
C:4b
z.=M#
G u
d~nvnaZ
!Qm+@
+$Nk
NSS_InitPtr
4:,a9
$?/BT
N+j,
LOLUQG
<StaticCommands>k__BackingField
IpU"
^T zV
-wSS
&X |
T3,'
Pi^G
v p>
s4%c
J; tj
get_IsCancellationRequested
\N,
4gh4 v
x6`\ u
P%G
p? 3'
.65T
#FMz
*sHr
Open
GetHdc
M%5#
{(%q
<T F
_currentHvncDesktop
X7fT
Om;<
gKC%
F-W1
9-s+
[x
nZvX
Q&!;6
SortFileTimeAscendingHelper
'u}}X
d<a0(p
GW_HWNDFIRST
G$;, A
a)&73W
Format
['A
_ ^+
T2
WINEVENT_OUTOFCONTEXT
<iOa
WH_MOUSE_LL
jvl(
UnhandledExceptionMode
,`$)
s%;_
I{$?
2PD}
x ObD
pT8&
N'Y>
<VncMessage>k__BackingField
_@Ft
IZb!
StringDownEventArgs
mR=J
enumAudioEndpoint
x`H>
u<?
WindowsInput
defaultInstance
Z~tL1
<Exists>b__0
e KT
2gWBv
~Y[sq
K[nX
Z%Pz$
<>m__Finally3
o?Zq*
)Y^=X
<),Hol
<>m__Finally4
j J15
xB}BC
K K,q
YSM4[
B~8D
6 sY\
components
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
nh19
.:R
^] y8
[5dv
YSY
>fBy
*Ow6
< 9j
Js8#Z
La34
>t.8k!J
?;xr
x|,=
[a[/
ZpsT
| \k
~633u
X_*\wY
(dd:
34vy-
d Q?
ILC_COLORDDB
JGU=)
h*PkR
p=\K
BH7
remotePort1
uYiQ
&=F-
Yq_>
managementObject
A2+A
Minute
<b1
o (sV
S`wY
ieR(
remotePort4
Group
set_AutoSize
1+i 4a
$ak*
WebClient
/B8z
AnVu
L5`y
A&hCA
2/=GB
36%K
vkcode
|H)A
eB8l
MDIGETACTIVE
%eK,
stFw+y{]
p 6=
color
.]<p
r K
KCn?
UUID
*;G;
BitString
3)#`
m >n,
{i9aa
l-
<>1__state
;9HN
EnumerateDevices
si 9t
at]
Mj[q
CcJW"
dH{F
SendProcesses
4~[8
$ZV
get_KeySize
o%byx
'x Q
S#_b
table
_host
b0(
ServerPackage
p#p3p;
})"L
~\X[
Fz5d.
Rfa"m
1Mqa
a >,
add_OutputDataReceived
set_MaximizeBox
Wk|W
ReadByte
"?V
uoT~f
"^5%
G+)E
Bo :q
lpBuffer
7O_.
NCXBUTTONDOWN
IYef
wmr>
E2_]
^>||
;,&wp @W
L,P&
&UQf
2KF-_D
CodeDomProvider
\_6R
get_RegistryHive
w:jo
)[F`
VL~o
:xM
d %d
]"6e
|Uq)
SendServerPackage
_stopwatch
Fhy!
*"/"?b6
-eOD
M8At
v5Ae4IN
(O`z=
AllocHGlobal
n;#}
*T-R
<6wg
(c1L
iI9;
'x 1
Blw A
CLy,
Orcus.Service.Core
4FN?
97 d
q r ?M
^75k
xT0*\
<S|[
4ER
~J8z
<AvailablePlugins>k__BackingField
/g?g
RxG
BitmapData
9_)v$
CSCore.Win32
2RT:B
V]uh
.sgu
_filePushRequests
[]8I
XzX4
J6tP3P
&$itoM
$A=K
OgI#
`aJ;
Cx?&
R1gc
FRzxo
\X;ra
|6a
MOUSEFIRST
&u: [
n0`_
}6/t
Z fB
C$<o'
iXo,
hkResult
E@ )
U%'<
Compute
FileNotFoundException
O\e.
X$5ib
y.qt
TASKSCHREQUESTHIGHESTPRIVILEGES
h;h
,]a4
'\ ,=
+-:(
nIDDlgItem
R\K%
get_Keys
Orcus.Service.exe
\? A
c^c= e
UWkZ
IndexOf
WH_MOUSE
:}gs
set_AvailableFreeSpace
Pm"c
Twq:
9;bC
A Z&
DecodeProductKeyWin8AndUp
4a'A
OTM
27N F
HSHELL_WINDOWREPLACED
C|1&z
4#6X
V=,"
/-O
g H
*M&1
S9m
MK_LBUTTON
StringUp
H o
&)U'B^
PQI,
ForceClose
.VT]
HD(k
,Jb^SX
;P;
]MWF=
#GlV
8,xy
wgh,
?O\y
!:sH
W E;
iphlpapi.dll
IsPrintableKey
set_RenderedWindowHandle
'|:`
gdRH)
3KHc
7ZJ
MD5CryptoServiceProvider
9E;b
"dzgJ
v6'm
PzD3
get_SystemDirectory
StopAll
0at0
bv&<S>
w+8w
qK0j
'l\
add_AssemblyResolve
c21cdd5d987146dc914a71c5d4b043db
<GetOperatingSystemInformation>b__2
2 ,b
zI]r
i;p@
Y%udW
:l&--
set_Interval
8 ^
|V !
.NE=
z]Qg
BerkeleyDb
8#X2h
Orcus.Commands.AudioVolumeControl
r((
!R*GJ'I
MulticastDelegate
MRTJ
_?oo
3L )
j.wB
Zs\G
Oa<z
GetExtendedUdpTable
;O>q
TaskRunLevel
[JU3
&E4J
Ix~t>A
Yz,:
eventType
B`Q+T
get_Uri
AutoScaleMode
6M"F
`W$T
Nm} F
wc C
get_LastUpdated
gn%qO
WxK*
q5~#
MBUTTONDOWN
BbO
z ww
e}k<
6OD*
12TH
nI,sz
R1RSR
SYSTEM_INFO
MainRichTextBox
u$y3
ZY>=
q[p;8
3yk8y
IDatabaseConnection
RegistryValueKind
5h#\
`ElU.V
.o-}
o6"A%`
f50(
GoG=!
DWMWINDOWMAXIMIZEDCHANGE
)/L95
N;@Q
.r-/(
Headers
B1 m
CreateDesktopInformation
m'%os
P_=2z
|r>Uj7,siX
0G 8G/
CallNextHookEx
QV8"
9} M
ShowMessage
% .(ps
6=:],
`Zlj
*V,9/e#
Binding
TUca
F$$ q
dJJtl
+$ig
FH{H
H` ,NZ
=/wN
dmDitherType
lisb
set_MaxBufferSize
Q0Ri
zO4~
?+6X
*-_4
MC"rf
cOb\E
A6NV7K
}GR
FileTransferCompleted
-I:v
1nNIcG
B?f,
p*<b
AsO
Niyv
K !
FnT2
/ kl^
)\[H[
tr4I
Jsy#
g'-K
qx9
uZ 7
n6OW
{+cg
<Passwordcheck>k__BackingField
[x~'
)l1v
(Q :
z(zL
)l1k
Wt;<=
!s5>
gF:[
oTo{ )
='n*
j\mo
idThread
><{;
h)Ox
xj!
7< kpyR(mh
E!AIw
8kZp
8Awn
ka!"7
;I=B
hWxO
l83_
%7JU
set_RegistryHive
DESTROY
za,S/
Tlp"CC0H
ZtD):
>1_^
M#U-
9"u-
Re4ZhJg
#Lxg
wstrUrl
!<!Z
y+1<
)1B|
&!Yo
JFR:
set_AvailableMemory
-|g1
oS
nk6e2
StaticCommands
Y\VB
bmJ,<
n4hhn[
Style
.~)Oq
FileZilla
/acEz'O`
`i5"
#5H
c3z;{
g?!J-
System.ServiceProcess
op_Equality
leJ D
_activeWindowHook
b _M
4Qgc;
us q
get_WorkingArea
94 `
72? N
ReflectionTypeLoadException
m8;p
'88~
qqXW
Pt*\
| m&
LBUTTONDBLCLK
lmN(
=mc{
KDolx
YHn
9 y
rp'
iRZ|
>iV6X?L
.Nj?
<>l__initialThreadId
INPUTLANGCHANGEREQUEST
hHash
NI2D
yJD>
dwParam
ZYboW~a
&aH3
get_PrivateMemorySize64
N!Q:g
6OwF\
d)Q`}a
1~7$HQ_
=K N
J{ye
@Pp
gE5L
DataFlow
_unloadLock
get_UrlString
6qw.~}
d[Q6
get_Parent
<z /#
\6=
Taw]
zPz>
VOr@MV
_encoding
8}Lv
g4:i
Ry&d
DiE2
Z:I
AC>(d
uy6ta
>T^6
K~'K:
dmColor
ZXT8"bG
DesktopWallpaperStyle
costura.orcus.plugins.dll.zip
!# y/s
ReadLine
DESTROYCLIPBOARD
8H\o
wVgPZ
1Bf;
l17a
WLfA
ChangeComputerStateCommand
h'zE
}rhF
Np/\
f`/p
<f):5
PrintWindow
@GKZCv
6MA(
E4F(
$T}aR
ye =
WY!I
set_StartTime
!_A
q=z&C
B +
"N%
Ucv0'
yNq?
p? 11
;&X{
fnJV
Dq{[d6[
eyVEB
get_StaticCommands
fids
- ro0
\}%(vS
VAaE}/
?~I?""
u!Y"VkH
lfg;
.?[wI
rv~_
8Yh H?If
XNF=
Bottom
l\!</p5Z^$C
ba={.~
<dCR
7&>s
I O3
n?]V
N FY
^9%uZK
IZ 4
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.Current
;F6
>u\
GetIconFromPath
tu 4
KhUO
style
f$B!
QUEUESYNC
dV@NFj#
\9Yu
% ty
;7t[
}a$Y
add_ErrorDataReceived
Binder
taZv
3MscY
set_IsEmpty
)nk<H%
^tx!\
)2 O
B)L9
Ri 5
get_FactoryCommandPlugins
A[CdC
SC_HSCROLL
ProtectedData
AppendLine
dVKf
5 WS
gdi32.dll
GetCommandLineArgs
#j],)
e *H
\VC.
Rpx[
jHc!
a3<@o
0u J
M2t
"WG+l
\:Of
7BY.U
X4t7
=@d3
H<7+

<Decrypt>b__1_0
Microsoft.Win32
IEur
<DesktopName>k__BackingField
3(BJ
aP9d
SendMessageTimeout
=UAfW
LivePerformanceCommunication
Mzb]
<E!@7So#
0M}*
+k$H
Da]E
~ n.
*7(-J
c4bN
f(cZ
+ W9
Z)AG
}QExs
dL #
forcePush
_JRd
'7yk!
tvt<K
?Pw=
PackageReceived
*~e
pE 7
?&J ?
?&J #
?&J '
\-Xj
?&J (
zZ(#
zt(
Bz D
?_Sd
;V@;
J"| _$
ACTIVATE
hB [c{N~t
f"4M
get_Stride
7Pvw
r H|/
dmLogPixels
set_MemorySpeed
< W'^
SHr(
[#8X-F
2|Z}
get_PluginVersion
Ca:Z
QX%|%|+t
Block
TextBox
NPf=
> Fh7
{BR/K
CkJ0<
a.DLL
_instance
wx\
?&J {
?V B?J
?&J ~
9<r
set_IsEnabled
/)2v
DataContractJsonSerializer
+G[b}
<`:R{
ErI
eMW/
RsaEncryptor
KillButton_Click
KP[
{zK
@lhB
dwPageSize
ToSingle
HTHELP
<Port>k__BackingField
X-GJX
cM u6
${N3K
SRd~
kyi
2VvTp
6,7qJ8n
h=C=
he6
c|J1?a\
-S zA?
&oIE
MasterPassword
IsDataAvailable
B+<%2D
pg!6B
- |A`
set_IconBytes
>6IKS
`q(;
ZN0g
MFEA
K6v&
]p9#
2fxA
jD@0
lpfnWinEventProc
6z K
InitializeArray
#Y,N
LocalEndpoint
o}I~ |r
JJ@!
L%g&
`8H\
!NW[
Orcus
b&ZG@ T
?%o.
4/aM
Orcus.Shared.Commands.ClientAction
<Keys>k__BackingField
6i<u
PtOj
hDci
m{u.
x/$;
R3r!
LBUTTONDOWN
li)?
RsaHelper
ud\U!6
ph2<
#Rvi
@@]&l
P IJ
<AddToAutostart>b__0
zq}''P
Tl9]
Y16IL$_
Drm[[
eYz
5]Hh
TimeSpan
k(?G,
!~1:
dD F
yY!2
YR\Y
)O8,A
desktopWindow
]#*ru
9Dmcm
o] O
r'+
set_WorkingSet
cV*l
v[,hh
ResponseBytesEventArgs
ManagementObjectSearcher
g e,
<6tY!
Dz z
q6_j
3 8?{
63CU
>1Bo
`p9\
=H{Q
!1 a
cgd"
DPya:
#/o|
@?r"W ;
O\0~
ZJm(V
k@ =o
(kg,k
UtRR
dO[O
jT`~
YUva
c '
{`rc
Form
??Z7
\1CW>qC
IsOnVirtualPc
=Xg5v
//X\5}
recoverCookies
!W}U
G P45V
DataReceivedEventHandler
set_DriveFormat
&2H
^Wz-
RemoteDesktopCommunication
vA}z
IWaveSource
&6v-
FilterInfo
LiveKeyloggerCommunication
_keyboardHook_StringUp
i6CbB
DDoSManager
a["
PushRequests
PtrToStructure
Degrees180
I=D=
FileInfo
%h#/+C
/i//
>3?B?W?
yEGR
'hMb
RegistryKeyPermissionCheck
}@Y]
@L=+
8 *z
&,W>=
D? Y
a4o%c
GW_CHILD
<$BIG
q%y h
PG u
tq=/
AddLast
: N&{
mikiv6
R~kW
icmpData
set_L2CacheSize
bHrO
{IvVGNq
pe9Id
'q?L
3]q72s
's
Pez91
GetAssemblies
<>c__DisplayClass6_0
r*R/
<E F
K{i~
iqag
T33{+A
Nk :
cy S
SXL/
Dy5m[
ExpandEnvironmentVariables
R |l
get_Shield
CreateOperation
<ValueKind>k__BackingField
ha/[
W%;a
add_Elapsed
SendMessage
UDP_TABLE_BASIC
8 G0
r ;W4"P
x+syp
1-?
FindTask
/6`'?
set_IsDefault
4i=m
lOJN
SbbR
6Q(
gL v
8}.c
E [.
c^^l
|Iv^
SysListView32
X$<=&
$}F{
NCHITTEST
set_VideoProcessor
HTERROR
7m6H
gqd
bO/
G wc
mV<_
8w48?
=xz5
set_IsVisible
@6/b
,a.?
] v)8
t.V?
nQ9@
serverPackageType
0XH!i
c<Uy
Path
,MaL%
5<!
Ik@|
%cD-
S_sQ;k
059
ag34
^!N)
get_TwoLetterISORegionName
ICONERASEBKGND
-+vO
`q\T`k
R}E0
=S~N<^
&]La.
<Value>k__BackingField
Ku[
*T 1
"E1)
NEWCREATIONDATE
,W s
&"?A
S U~ ?.
'j[g
GaVJ{'
}#%z
/gy)
littleEndian
MessageBoxCommand
5 X<
m=xz
E 4M
SendButton_Click
3)_k
BlockCopy
3-R+
?iB)
lpRect
&Q\
Orcus.Commands.Console
BmIUO
u[wT0
2KFX
\%4 $
i\f#
R!wj4f
B~dA
N=|M
shelldllDefView
TdF
isCs
Q$0
GetAllNetworkInterfaces
DF1b
gfKAr
$"BM
FileTime
)L+\R
get_Handle
{NCG
bL [
_obj
*^~
Yx4>
)%\(
CSharpCodeProvider
26q=c'/C}
NativeMethods
wj?S
T\5i6!+T
StringBuilder
W@N}
x>t(
3@(b
get_TextLength
G&n4
UnhookWinEvent
p<UTj
7IHf_
yN{,h
#|\ @
get_VirtualScreen
dwXCountChars
Au6b>
*^
get_Errors
L):uE
PM4Jk
<ShowWindow>b__0
y`~7
NCCREATE
C<B`
<dh8
%r5
E(/R iL
F5o0
%r1
COMPAREITEM
CompilerGeneratedAttribute
pocsTitle
5nt1
[U_>
Sso#
FactoryCommand
%oh{
6$59
9m1EK
6Rl'
mt c
3<[Z
pr'
.[<y
"y@G
GetFile
h a#
get_Extension
result
,BCT
CHc?-3
`*&*vq
u-lC
get_DatabaseConnection
get_ItemOf
{.3#
"Y9!-
/~jm
O =y
N[x[
rK;^
aryDes
z2:vK
Pw3
:Xpt
CLEAR
get_IV
set_ClientPath
ZOEkxq
gF5"t
U JB
timeCreated
layoutId
Mi o
set_IsKeyloggerEnabled
ef rUh!
FO:
PS 5
W %C
7%dbx
]D-#
C8^<
3]>i
FW6
get_Ip
-Br
|l*J
| u5
2|wu
lm@^
@'v(
get_Id
get_ForeColor
SECItemType
O%wv3u
<.Zl
<7Z[#xnT
)/'"]
sslStream
B u<,
e.2mi
(1
1a%\
Ng@8
c$mP
UH 2U
@~ZV
=P5@QmP
U: =*kf
@ |s
-hmv
8AC
[&k{
N//
Stopwatch
l3_|(
1C%!
JnKzZ
H8jjep;
TCP_TABLE_BASIC_LISTENER
h%J w
Z|9NEG
symbolNames
\8^&T
<>9__9_0
jLH
xuYmd
EycO
':Wlt
Initialize
GetAddressBytes
IME_ENDCOMPOSITION
;A/E
ActiveConnection
n2E}
L+qv
P Y>V
Last
5mad
dUEO+
g3B|
enable
SendTextMessageEventArgs
DrawDesktop
3_0{]
c3A 5
ree:_H
GetStream
BxV!<
Orcus.Shared.Commands.FunActions
TCP_TABLE_OWNER_PID_ALL
~4!NR
WCF_PAINTMETHOD_PAINT
get_Unicode
HJo944J
set_Verb
Y b }
$O4QX~
_hookDelegate
WindowHandles
_h=O
71zSM
P_T:k
get_ConnectionId
set_VolumeLabel
#f>A^
i}l@8
PasswordRecoveryCommand
HTOBJECT
\`(
6c-w
:_?#J
)<MQtF
>6 6
7w9'
'.&`
h#M{
ftLastUpdated
w`'z
bPM}10u
IRV,
'#z=
`\;AR
GetCpuSpeedInGHz
PCTz
h}C}
mBO <
,!AQ6
RxC oH
`%M)
Gzqm
PbHL
<LPyE
-1x {
o`Gr
get_EntryType
#Z Y8M
<7T(
Orcus.Shared.Plugins
9zo
Yandex
\g;"
VQvj
Orcus.Shared.Commands.EventLog
u/@#z
mx: ;
m[x
G[ sM
&f,d3g
7h;]
o=b`i
_tBg0
\_nGh
Command
CompilerError
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.Current
zZml_f C
<2"M
x`L"
J%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'I%'I%
#333333
TsF >
Tig/
6X~}
n8g2
PAINT
RSKA
)si1H
R/>~4
.W._
v\c=
get_Top
v`SL5
<foFgF3S
Kx>a
| MP
$#:|
|d7e5W
+;8S
yrc|
i) 1
(WkJfG
\6C,
{& &
t^ggP
EditorBrowsableAttribute
CP$6G
`Cb}C
get_Image
l\ti
]t,b[
fas@
' DH
ihhi
&4YA
JXdK
l2d>
CarriageReturnAndLineFeedReplacement
RgN6[
j0-Y
h]ff
g o<Z+
c/u
WM_LBUTTONDOWN
_|b7
=5@FG
{&)pf
"neqw6L
1-P;
get_DriveFormat
nXSrc
|Ys
A8!8
_sslStream
x:rF
Pz_H
PV e
state
E/yY
b?^,
)r E0 |J
Ohb (:WI*
Load
i9E,
1^|w
+KMS2M
EiB0
; q d
GW_OWNER
2F3b
Nkl8
set_IsClosed
[t{
lxo
shell32.dll
&VBd4
CurrentUser
nir|''
%8|-
;a;*2
|&)_
9Of;B
IME_KEYUP
SIl:
yeRAi
yu==
V"nl
lJRc
<nPx a
Attach
Y y}
get_IsConnected
BeginInvoke
GetValueOrDefault
lte-4{
Orcus.Shared.Compression
dEK4
ProcessId
q h1
F(YE
TDOT
q;~?
7E<:
fl%>
"dhc
$q|2r
i7H/
B:9<\
setRunAsAdminFlag
BNYGW
g#~H
Nspd
ICONINFO
p }pB
gZP-
G*.V
"!oA
MQ.!
C? }
bG&H
SHGFI_ICONLOCATION
A~,RK
EntryName
S}g
_receiveLock
3bOs
get_Entries
?4L
c@T\f
\W:
U96Iy
M$:U5
uJ-g
<IsDataAvailable>k__BackingField
IE+X+
cv;zA
GetMozgluePath
Py4W
~>}l-
9jc/H
(&wu2
,qjy
set_Arguments
QF'K
e@[=j
get_TickCount
gIm=
_U?vx
M,CzDC
<LoadPlugins>b__22_2
lkJ(
)$z
<LoadPlugins>b__22_1
MKgS
Q:8Ne
5bZC
4E9P
<LoadPlugins>b__22_0
%aI{
- \8
>7v}
Time
fNFFz
^N({@
add_KeyUp
e~O$
U:[c@
dGGM
_G.Gl
pCIN
^{Hl
dGGu
*cR/
1/~dM
g|h'
cpBBe
Orcus.Service.WindowsService.resources
_lastWindowTitle
I% z
qis!
dmYResolution
C:L ;7
4S^p
}_9|
tks |!
X 1r?
JEx>
)
6&c\p
27HwfM
\p@
|LN|
L.jS
FBXq
ExceptionInfo
KeyboardHookStruct
rk>O
Px38|
w7Ma
GETTEXT
<bz:
,))w
i4x_
'N~s
V."-
CDS_TEST
,h"V
trg8
caseInsensitive
G+V%
)9]3
h(eW,
lH:b
2 rh'
/IU?)
E{-y
sw*K
<EntrySalt>k__BackingField
[m ?
`N/U
i(.w
]|qb'Yr%]
SYSCOMMAND
<GetOperatingSystemInformation>b__4
)~E!
<$8\7
e~OO
Orcus.Commands.ClientAction
p}f)Z
$<>f
Packages
F0Y3
(pk ~W
~KM VS
tn(vv
> <7
`qK0
at!s
;L W6
gP>h
//y{
fc%]
(!E
&8Tk?
H<Hcs>M
Sj>z"]_
g ) SA
@XfI
1t3:
L/s&p+
@0NX
cPcnz
xs_p{
)2*%
<>7__wrap3
<>7__wrap2
<>7__wrap1
fnr)
zi?OI5
<>7__wrap5
<>7__wrap4
<*x
Ri-P
L\ |L
S_YI
AllAccess
zrbfk
<,d8
X!G
v.&rH
ResponseByte
q(5Q[6
=Ga5.
desktopHandle
f` z
=Fw5
dsy7
t ->
wShowWindow
]FJ
/'yt
m:6a
7lWJ
qB>
B'%t
3;9O ]
ON~q
I}Jjv
(G=2
<CommandCollection>k__BackingField
O> \r
e Y =
040KY
\$W)g;eJ]KY`z
sh(q
<@ }eY{x
remove_Connected
<mb7
5ZNM
HgR\
J2A!M
w|Gx
l9Ty
FOrcus.Commands.Passwords.Applications.Pidgin.Pidgin+<GetPasswords>d__0
3<:W4Gy
get_Bottom
qeo !
g~7u;
lQ~Y
7x,j
_lastWasDeadKey
}uIfO
BsC
tgYL
a\WI
aH7R
H_uqC
.ZRT
QPfwv
3a>
?!^;
lpMaximumApplicationAddress
r^(P
_0v%b
<PSize>k__BackingField
"$T{
7X9Q8
8*3w:2
D6?g
Lv>M
3-*5
get_DirectoryName
y"4_
b}O!
_$7>~<|
2g R
D9c/
Kc ;
P (2
qG~g
smC]#
Q'r4
n$tW
costura.microsoft.win32.taskscheduler.dll.zip
s\1T$
RcD3/
?aW#
chEG)
uB;4
f*KAq
s83C
;:(Zmu
Z !#
mFfuP$_W7Cs{(
Y ~M
set_IsAdministrator
Orcus.Shared.DynamicCommands
eWKl
=$zI,$q=
SendError
<.\:
<GetAudioDevices>b__4_0
T6GTS
1.}U
wqwu
F'`+
<FrameworkVersion>k__BackingField
5<J<n
keyDown
1d-J
tJC|Y>i
MessageTextBox
d^rs
<AdministrationConnections>k__BackingField
lparam
TOrcus.Commands.Passwords.Utilities.RegistryKeyExtensions+<GetFormattedKeyValues>d__4
hS</d?+z1
commandResult
'M1h
U+J&
L4_z
IME_CONTROL
[dVt
LoadPlugin
%DEy
set_AppContext
FJ%6
{cezz
c%9d
M`-(Yu
FormStartPosition
V"N1O
U"_`
GTT
isInstalled
MessageBoxIcon
;[`Sa \-
GetValueNames
set_ExternalClockSpeed
qzwU\
6 \X
System.Threading
65pK
ReleaseHdc
65:A o
oD5X
TimeHelper
,<:j
q''0m4&
$ [*k
AsyncReceive
ZiS [
UnhandledExceptionEventHandler
3!&
eGlP
Yv4d
GeKG
set_IsReady
GetDirectories
:m 9
_5@*3m
lQ)s
?u^Ib
ashs
e8Cj
1 Nr]^
wohD}U
3=Uz
~b/q
e(S_%C
GetHostName
i8m!
sQ^o9
sydD
YiE
0 Nfs
'=!`
MMDevice
[G$$
Trigger
[4zo
m#5N]
efgfw
Qvi+
encryptedPassword
>sG0
^9L9c _
rM!2
!:R~
Orcus.Shared.Commands.UninstallPrograms
get_Current
>qiv
A]X;R[
Rectangle
t_nX
JMpEk
RotateFlipType
w^a}
:d.m
9yu7
<GetOperatingSystemInformation>b__1
SetCompatibleTextRenderingDefault
Task
xm4p
efYS
n8=L
% !*
;1Q;
@UfB
+1r,
n jU
get_TotalSeconds
<>c__DisplayClass0_1
r,j]
Y;2t
yqG&
G|:_
fFO$
AsyncOperationManager
rXF?{
r%ZP
-qgU
N-Oo
paE&
OVZf
n{;X
o=E[O
BlockInput
C0'
`3Ug
vi@lMJ
zQvw
currentFile
dms$
RvUO
j2J6
G#b5R\
dwTime
Lp/h
DoAction
_keyProcessing_StringDown
$/PL
x{^4
Ohj
#eX9
az&H
kEJT
Next
EndsWith
@W*Z
4Vq]
T G(
d;zig
w^M2
set_SelectionColor
DISP_CHANGE_RESTART
*Vsd
(oZ?
GetClassName
I}i~
!v ^p
5k]Ey
Z%9$&
+6(S
,y|4K
uW=X
&I;n
get_Objects
VvibE
[ zz
set_ProxyOption
q^y#
t#;(
T{LM
set_Timestamp
ndu|
dictionary
Fr}T
n<!E
SynSockets
L1V4
ANUp
7#v&
VE)c
H[WK"
culture
*@a
;IV#
5k j
Xt z2
sRT{
~Dp;
3p)V
? /
wP:fSEv
k]]}K
MyEnumThreadWindowsProc
<'=&
q>x
EVENT_OBJECT_NAMECHANGE
"W^Wb
5W)/
4rl
MAKELPARAM
Disconnect
fVo
|d f
WebcamSettings
)0jI
S?a87
S`CA\
pT6>
R+^Nf
N)RH
}9xPi
HX;h
CreateCompatibleDC
L8@\
get_HvncActions
timestamp
.7px
Ja ~
`9AT0
HBjD
El_dx
hideFile
~"; G
?$XN
E!'RN
eo"Ai'
get_AutoResetEvent
set_ProxyHost
WH_CALLWNDPROCRET
pa
BYr4
Rfr|
7so#
Fk 5E
get_DesktopName
HY>v
ah~_
I;K|sENp
&+ N
xHotspot
%yYb
qR8O.v
SYSCHAR
;Xc4
H~Cy)
I7%5'=
OH ?
'#AGv
;uD7W
_@@
Bg%t
EventLogCommunication
GetHashCode
UBWC
6Y tl9 Y &
w2Z0
set_DesktopName
YiiYh
&1B6
sX6 ^
WriteByte
7m,o
IAsyncResult
Yvm
FileAttributes
Kgc O
zk^}
sdUJG
Oin#
U8OF
l=[Y
vCr}+\
+e JY/
TextChatCommunication
Z }+9
;OxW
rPli
AccessRights
GetDelegateForFunctionPointer
^^yD
/bF:h.Pu
pO?C
IgjxA
'|u]U
ButtonBase
GetBytes
B|8'
WfC?k
]NOg
~#y
>mJH(,
nmi&
IcmpFlood
4Z&a
iu@3c1
7dRK
Bq!u
BdFZ
>PH?A{
isChar
2N E
Nqi
b.wB
X/@W
?Xxc
childAfter
W|&l
dwOutBufLen
Q|/V
System.Runtime.Serialization
gU,8
u x`{< _Z
$g@h
tqCokmZ
k+>$
(|D=
\]*5
X Zt
# ^
BiJ6
SHGetFileInfo
J)wDa+G
KeyUp
-.,-
qJfX&3,
C^zw
o$Z#8
4iyF
GetProcessById
lpFileTime
`*Fy
x (.
v0.p
;nW'
Ujf1
V^i3
Cug= C
p$B D
LoadLibrary
YSA>Z77
IESecretInfoHeader
:EG]
ResponseResult
NewFrameEventArgs
System.Runtime.InteropServices
set_TotalMemorySlots
RegistryExtensions
MA_NOACTIVATE
soundOut
Jm!x
GetSystemProxy
DRAWCLIPBOARD
r{Wv
E_W/
1 Qx
wZbz
<wK}P
Py*2
r
s
}oX78
1T9&
~
[9}$
VSCROLLCLIPBOARD
.d&8@Ab
`t;Sc
&Vn7
Mu!y
NOTSRCERASE
xBpa
o
_N,'Chb
o(l8
&pZ
MNip
/n:>YL<
W,"
#j#i6
Is7/
<GlobalSalt>k__BackingField
IaN/
System.Runtime.CompilerServices
_Ras
cN9'
ioy2
_currentConnectionInfo
[}+W78%
o;S-c
#[5W
WS_OVERLAPPEDWINDOW
<-9M
)O)w+w)!
[9}j
Q ZBg
hF}4
0!XpCK
,.,c
Li$d
"o?*}
C/A$]
eg$@
FileDownloader
,
-
hProcess
(
Q/]]mF
$L$*I
J?
ReadObject
:so(
V9Fg
K#1;"&
set_AutoScaleDimensions
*bs
oU3z
HECi
-; =
/+1A
PxlN
j+O
[GYA
dmDuplex
"M;8fhk?2
QNka
l8g
aB[k
7AZ
get_MasterVolumeLevelScalar
6Zrz
&
buZX
/*|nm
p f#,
96?#
get_Client
AYP5"v
\XS_
rO"iDP
^7
Hu>l
OperationContractAttribute
UIntPtr
_=.d
Unprotect
Otn
get_Gender
!O6
SC_MOVE
W!cU5
CSCore.Codecs.MP3
\CwN
N=e:
Sioy
x8uyF
:oP_
Firefox
SECItemLen
EQXP
v)+r
SN O
&k:!
M6?I
X UL(
- EkXB
cG{l
$ehV ^
+{zx
5}ih
UY,Q
O^q8
&%&.&7&|&
;J=h
#sxtk
TmRJt
MENUCOMMAND
_pDHJ
#}uQ
c83)
od^:
@0)=
CompressionMode
Enter
_floodingJob
X>2-
;BVs
Lt.E
* i
%Tr2UT
dwYCountChars
d{Qa~r
i? x
*Wg8
YMjF
rY8
}YQe&D
Q=?gb
ZTZ OWi-b
"z%R2
Y~8/
set_L2Cache
WMV25
tfKQ
>#l.
Gc]#!
V+z{-
W9-
4K~DFJ
4O@#
:d q
0`&Q
o%Z,
scrollDown
.Fdg"
<%N
ji:m
MaxWaitTime
pszContainer
=v,R
c6u\N
;WZ#
STATURLEnumerator
/&>,&
MENURBUTTONUP
,>|s!1Q
!sGgic
RQZ`
Asn1DerObject
;$%$
Y6qBZ
r6!
yd3*
([!e
0q}"
8j,G
[)A
h9z!N
P ^
InfluenceStartup
=^5
@ZA^@&
Cc.O?
UnauthorizedAccessException
lZe L
J+l
Y"_g
<Handle>k__BackingField
xDz=
DriveType
YuVW
NIw ZYS
zA?
S T:TrT
a78i
.4)_
q}6S
RPUA}
o4z1
m.TJJ|
e.ws
connection
set_Height
ProcessWindowStyle
.8lcS
AO\_
7B@
RemoveAllDependencies
`$#2+0
jr YCn%k
XX2
ghE{_
Qe]g
wN~y
P-~`
&z`M|X'
|k)\
HTSIZEFIRST
]"4S
54xc
$JzQ
~7!u?
y/KB
%K*B
1(:3
GetHostEntry
_videoCaptureDevice_NewFrame
J]5 bA&
4WAV;
^q]M
Y)(p
uu>[
CALG_SHA1
IME_STARTCOMPOSITION
System.Net.Sockets
CspParameters
MOUSEEVENTF_LEFTDOWN
Ee,[
WR1r
DuGdDF
$kEY
U[eq
xp"G
B#Cp
C:l*
MessageTextBox_TextChanged
*0r4
TPiRA
GetAncestor
SendingType
uF|WHc
set_SystemDirectory
get_PixelFormat
3i'e
3q].
| <c
RotateScreenshotScreenByScreen
$y+9"l[lg
vY\J
c9
XOl"
Sx=,
4@[=
POINTAPI
set_BitsPerPixel
3lS9
2Ky{A
7.|s
s~ ZrA
# <[
: H
p\x:
point
d`'
Y C G
Xw%}
6+O
set_BootMode
K~BzE
fCreate
get_Passwords
ToCharArray
`O:[
mZ;#
get_IsDataAvailable
KZi'
Unload
gnnhxCL
_ U
t0"T|
$x`h?
<IsCancellationRequested>k__BackingField
GetResponseStream
u\|H
3 -as
J7K{
b~L
>#K\
eUvveG
v~("Z
Bh-o
8w\FKj
cYj
75d^}gC
Encoding
httprealm
?@IW
[U%(
x;+_
e~(:
E >NG
V$UY
8DaY
N4Wi@k
VideoInputDevice
Tv_n
get_TotalMilliseconds
MENUCHAR
-J6H
IEnumerable`1
!]&MI
<EntryType>k__BackingField
SetClockVisibility
,j[tZ
@{
set_Port
Z*&T
(n|1
5/NN)
QWL5
3 1 4
QK5@
~P[?
get_ToolBase
CryptographicException
;092
mB}K
AesDecryptor
C&h7
Haof%
09|1
JAW#ONg
System.Security.Authentication
TASKSCHNAME
f.IaM
DWMNCRENDERINGCHANGED
L_dn:)
!KHJ
set_LoadablePlugins
c {c4
9V%K
8@-[
-Qj@
pr#6
elk\
set_ClientVersion
dS_b
, )h^.
\P[C
J5_Y
S <)
<>c__DisplayClass13_0
PF~Z
io#R
rnyf
6Q{m
}]_7
!wA 8
~ #~
gT{Y
w~ZIJvVNnZ^
lz>:?I
FromHbitmap
`Y^O+
;BnBo
6DIS
get_Directory
cb=}
Iks|T
NwCg
~1!S9w
Zero
PlaybackStoppedEventArgs
rNWm
>?%q#Y
<|lo
ZM3pg
"_%_//
%k%4#
/9fQ
<FL4A
*QbM{
PaMA
.[[<
H9F)
KeyboardLayout
,Rf,
7V>@<h
M_x3D
z#IG
p{][
WH_DEBUG
hv}
hLD^
/n;'
!;Dy
[9o #
_length
%a;2
CryptCreateHash
<SetMemoryInformation>b__1_2
>'Q
L"h,
j.xz
yY]O
>`|~
lsNh
ServicePipe
lQ_P
MA_NOACTIVATEANDEAT
4r'y'i
CLOSE
<>9__10_1
n)}@;
set_Value
y}$6
MOUSELEAVE
Commands
Orcus.Shared.Commands.TextChat
StringDown
!0 R
KeyEventArgs
V R,z!cNE
^A.h
VR*@
tS~)
System.Collections.Generic
wBx5
& o @
tnSV
+#Po
/n;R
#`}EB
e@f?D
y58
~$x3
Orcus.Commands.Code
zn2I2
!6sK
\?[B{7
w\pG
`-}\0MUa
fYTj
()R6
G_Y>m
ygwqe
Vm-p
f 9
<Message>k__BackingField
.`M;
MDIREFRESHMENU
!"'W
gLYC:
:t7Az
&c*M
OnClosed
G8B[<
e|vn
set_CurrentCulture
:!^P
+_gj
Data4
dA~qe~!
Data1
H^;!
Data2
get_ModuleName
Save
zJ<C
set_Voices
MouseEvent
RegistryValueDWord
98:\=
Uv]`
&QZ+QZ
rkG.
]P3c
FBzr>
uRm/T
8{D"sa
) Ka% ]o
*6U++
w|AgY
oLf'
SUW2
JN7fUs
yhM-Jk
serverConnection
+9sD
7j!:
Qn)
XmlNodeList
qkoX?F0
<>9__10_0
AppendText
)_">XJ
LpT^
c\Hb
~k5?
~}'8
_MB9
5 a8!9
.;EpA
TABLET_LAST
set_Blocking
%x~^>
P1 \!
'=T$=
ckq]

#infosec #automation

TheSystem Itself @ 2016-07-05 15:33:06