CriticalGen.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 36/58 Related 2805
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 1301.50 KB (1332735 bytes)
Compile time: 2016-08-31 17:56:55
MD5: 7e01233645216b6a40d634d0fc73001c
SHA1: d94b614733a5a45b5b08b5b1f88161d9d74deaa3
SHA256: 3f51bf988cb0696bad182af5225c5d6105bcdc2005be4ad170ac26ac0adb2ab4
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2016-09-01 15:15:08
Last submission: 2016-09-01 15:15:08
Filename detected: - CriticalGen.exe (1)
URL file hosting
hXXp://mitteoderso.bplaced.net/CriticalGen.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-09-01 12:54:07 [36/58] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x12c164 1229312 2c5d1fa9c6219c0b98c91b02f8f24df7 5ba4eeeb59332834ef0054ca9287a092ee230891
.rsrc 0x130000 0x18c00 101376 2aa77e834a4fd53d8de22c9196dabd12 1cab98fae9d54daedaa1163b53bc19b0b25a1171
.reloc 0x14a000 0xc 512 bd8f027b71f5cd02cc70fb3ceb957d0e 55f0d44104c882f79bb6b326873118b70a302f1b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x137ed0 67624 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x1486f8 76 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x148744 716 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x148a10 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 1.0.0.0
InternalName: Orcus.exe
FileVersion: 1.0.0.0
CompanyName:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription:
Translation: 0x0000 0x04b0
OriginalFilename: Orcus.exe
XOR
8 131394
1 131394
2 131394
4 131394
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Binary
http://speedtest.netcologne.de/test_100mb.bin
http://speedtest.reliableservers.com/100MBtest.bin
FIle type: Compressed
costura.microsoft.win32.taskscheduler.dll.zip
costura.orcus.plugins.dll.zip
costura.cscore.dll.zip
costura.aforge.video.directshow.dll.zip
costura.orcus.shared.utilities.dll.zip
costura.orcus.shared.dll.zip
costura.starksoft.aspen.dll.zip
costura.aforge.video.dll.zip
FIle type: Data
Microsoft\Speech\Files\err_{0}.dat
Microsoft\Speech\Files\klg_{0}.dat
FIle type: XML
.purple\accounts.xml
FileZilla\recentservers.xml
System.Xml
FIle type: Database
key3.db
FIle type: Library
nss3.dll
System.Core.dll
System.Windows.Forms.dll
System.Xml.Linq.dll
msvcr100.dll
mozglue.dll
msvcr120.dll
System.dll
System.Xml.dll
msvcp120.dll
msvcp100.dll
SHLWAPI.dll
USER32.dll
MSVCRT.dll
mscoree.dll
ADVAPI32.dll
KERNEL32.dll
IPHLPAPI.DLL
GDI32.dll
a.DLL
SHELL32.dll
IP Found
127.0.0.1
URL(s)
http://mirror.internode.on.net/pub/test/100meg.test
https://api.ipify.org/
http://speedtest.reliableservers.com/100MBtest.bin
http://speedtest.netcologne.de/test_100mb.bin
http://www.speedtestx.de/testfiles/data_100mb.test
String too long
r/JUP9jjr5y66KnTa0+hO1TIYNOExiki87AIsjrTkLiw2xiyrMQ78Bzoqmmgd3xWJ8nlONJxuoJXUCgSfDTaw44vkwUJ0LA8gUzzVWRk67Enk8u57nsxYT6Hxs4daz08q0B1R05Oddf6q9p+pGkYS2PIBdfUbqg1L2isqYBXsNmQbIbPxYRIEpUKqMx7ExSwCcNk5jZB2ZhwZaJg4Swgtpdy5vXEDdnZtVwk/lljV60+00AUoRDEJh/UiirirALtSDvNt4jjnj7YjlIpLnqXhdBJv/rrwbD9SWkLp59BWhnlMOmc7KORorbc5fwrVQBxV0evg+KhVNGPv6LXL5Lx8mXRLsxJsQ3bAZfBYeaTla9sNd2HI+4fAK73ferCyxHvd2hhDkWg4nmRYQaAIzfJtgZG/rRuHmQixgnBuwbLJIZjgQO+LX2nXdoJ7op4nbqF7qwisakrDizlQdbA/C9YI4AOH/r5irOyy9KeIdV7h++rHI8N6svMuxhd5n5/ufRSs1S5g9I65wwOHbm7A+Uh3pQuiSqxZBYRrGFtTQ18e7b9HvVb8eCSOPpjmSVhBYUkcW/7lUQSC8He5lmMCJQj8f6pkNX6EDK+Sz5pDDjelXnVKFxoHXl/yO8rMs73KwxurpyOI0hcyZZNmykmWjt3bSFIsThQt+wvMn/BeyUg0414VOvF4el/a0WF61rHSdK5
VLLw3T25XgdQL7O0ubrAOTUa+gYkodiQntBGaH29b1HHaCkVT44yPVsrpwHlXZe9o/10760nIL1KZswBvsMB8j2JrxvNDiRfkHsv95Z2cLKYqt/TP5RPUsvnYuKi8rEJOwTasYTrd8tF/6dSQE3OnUqSkJFiWZTlFNe/DjW3Lu8=
Error loading and creating {0} of plugin {1}
OBJECTIDENTIFIER
Revision
InternalName
Software\Microsoft\Windows\CurrentVersion\Policies\System
Shell_TrayWnd
keep-alive
WorkerW
SELECT Caption FROM Win32_OperatingSystem
Host
Unknown
{0:X2}
Yandex\YandexBrowser\User Data\Default\Cookies
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381
Bytes Sent/sec
Windows 8
Windows 7
Shutdown plugin"
LegalCopyright
+*-,0/21547686A@CBSRTRURVRWRXRYRgfkjrqsqut{z
CoreFtp/sites.idx
nss3.dll
Kill
GHz (
r Windows-basierte Programme. Wenn dieser Dienst beendet wird, funktionieren Eingabeger
cookies
System.Core.dll
A+s
-)E
PK11SDR_Decrypt
Version
<supportedRuntime version="v4.0.30319" sku=".NETFramework,Version=v4.0,Profile=Client" />
MIPS
System.Windows.Forms.dll
port
^[0-9](\.[0-9]{1,3})?
Math Processor
explorer.exe
1.0.0.0
version
rundll32.exe
Orcus.CodeExecution
/test
/wait
AdminPasswordStatus
0.1.0.22738
Status:
path
/l /t 0
v3.5
Firefox does not have any profiles, has it ever been launched?
ExtClock
action
OrcusUtilities
bad ret
Architecture
expires_utc
secure
Yandex\YandexBrowser\User Data\Default\Login Data
Pidgin
Google Chrome
SEQUENCE {
Internet Explorer
SVGA
Security
SELECT * FROM AntivirusProduct
Windows CE
<supportedRuntime version="v2.0.50727" />
MDA
https
[Idle]
Keyboard Hook Dispose
SOFTWARE\Mozilla\Mozilla Firefox
FM]
UninstallString
Opera
N/A
cookies.sqlite
orcus.shared.utilities
JDownloader 2.0
*.nfo
logins.json
{0} x {1}
No Firefox profiles could be found
costura.microsoft.win32.taskscheduler.dll.zip
wallpaper.bmp
WRAM
StreamCodec can not be null.
Microsoft\Speech\Files\plg_{0}
System.Xml.Linq.dll
-Hv
keyName
costura.orcus.plugins.dll.zip
MemoryDevices
0.1.0
ConnectedLabel
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>
_Total
HostName
costura.cscore.dll.zip
Pipelined Burst SRAM
parameter
host_key
ListOfLanguages
FileVersion
Windows 3.1
--install
ProductVersion
DigitalProductId
Model
HGC
OriginalFilename
No Firefox logins.json was found
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Win32 Windows
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
origin_url
NSSBase64_DecodeBuffer
Mozilla Thunderbird
Orcus.Properties.Resources
Firefox does not have any cookie file
password_value
NSS_Init
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
@=<VY]BUQM{sp&hH%xbLJcUd/2sWgR+YA&-_Z>/$skSXZR!:(yZ5!>t>ZxaPTrS[Z/'R,ssg'.&4yZN?S)My+:QV2(c&x/TU]Yq2?g?*w7*r@pmh
[{0} Me]: {1}
CurrentBuild
Load plugin: "
EGA
MaxCacheSize
style
drivers\etc\hosts
Unknow database format
FromHandle
MHz)
runas
eaVZ3qyF3tFRjpKzecEyqxLf2ZOb64Du05bJWrgGzOFt4IZ1Urc2c9O+nD4wkdjy
SELECT * FROM Win32_PhysicalMemoryArray
moz_cookies
TCPVIEW
Whistler Server
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381/OrcusUtilities
nnen die Dienste, die von diesem Dienst explizit abh
Central Processor
The platform or operating system must be Windows 2000 or later.
name
SELECT * FROM Win32_PhysicalMemory
Parallels Video Adapter
^(?<guid>([0-9A-Fa-f]{32}))_(?<version>(\d+(?:\.\d+)+))$
Mozilla Firefox install folder cannot be found.
A/}
A/{
Not connected
hoster
The binary key cannot have an odd number of digits: {0}
HARDWARE\DESCRIPTION\System\CentralProcessor\0
orcus.shared
{0}||{1}
bad ret on check
SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
ProxyEnable
Workgroup
\e3c6cefd462d48f0b30a5ebcd238b5b1
1.85 (Hash, version 2, native byte-order)
http://speedtest.netcologne.de/test_100mb.bin
/SMV7RYPoqRdeZRq4FdU5g==
PortNumber
root\CIMV2
Windows 10
Copyright
3DRAM
Linear Frame Buffer
PC-98
collection
Install string was null or empty
msvcr100.dll
isSecure
9ycKaDqbXCRKjzyOrTtOiQ==
WinInput.exe
http://speedtest.reliableservers.com/100MBtest.bin
CurrentMajorVersionNumber
Microsoft\Speech\Files\psh_{0}
PrimaryOwnerName
/wait /upgrade "{0}"
VendorIdentifier
Start
Occurred while executing command "{0}" (Command ID: {1})
DisplayVersion
WinSCP
ProcessorType
VideoProcessor
snsV1Z1QzMZBv7NPRF4mSW942P9ae5ylde5/PVCZlzk=
Opera Software\Opera Stable\Cookies
CurrentClockSpeed
WIRESHARK
\.(?<extension>([a-zA-Z]{3,4}))$
te f
case FromAdministrationPackage.GetScreen
VS_VERSION_INFO
VMware SVGA
<Pass encoding="base64">
Enabled
CDRAM
D:\Dokumente\HfLogo.png
Couldn't determine file name
r/JUP9jjr5y66KnTa0+hO1TIYNOExiki87AIsjrTkLiw2xiyrMQ78Bzoqmmgd3xWJ8nlONJxuoJXUCgSfDTaw44vkwUJ0LA8gUzzVWRk67Enk8u57nsxYT6Hxs4daz08q0B1R05Oddf6q9p+pGkYS2PIBdfUbqg1L2isqYBXsNmQbIbPxYRIEpUKqMx7ExSwCcNk5jZB2ZhwZaJg4Swgtpdy5vXEDdnZtVwk/lljV60+00AUoRDEJh/UiirirALtSDvNt4jjnj7YjlIpLnqXhdBJv/rrwbD9SWkLp59BWhnlMOmc7KORorbc5fwrVQBxV0evg+KhVNGPv6LXL5Lx8mXRLsxJsQ3bAZfBYeaTla9sNd2HI+4fAK73ferCyxHvd2hhDkWg4nmRYQaAIzfJtgZG/rRuHmQixgnBuwbLJIZjgQO+LX2nXdoJ7op4nbqF7qwisakrDizlQdbA/C9YI4AOH/r5irOyy9KeIdV7h++rHI8N6svMuxhd5n5/ufRSs1S5g9I65wwOHbm7A+Uh3pQuiSqxZBYRrGFtTQ18e7b9HvVb8eCSOPpjmSVhBYUkcW/7lUQSC8He5lmMCJQj8f6pkNX6EDK+Sz5pDDjelXnVKFxoHXl/yO8rMs73KwxurpyOI0hcyZZNmykmWjt3bSFIsThQt+wvMn/BeyUg0414VOvF4el/a0WF61rHSdK5
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
ping 127.0.0.1 > nul
Orcus Client
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>.*?<Pass encoding="base64">(?<password>(.*?))</Pass>
root\SecurityCenter2
Select * FROM WIN32_Processor
.purple\accounts.xml
DisplayIcon
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Connected to {0}:{1}
Other
<supportedRuntime version="v4.0" />
KiB
CoreFTP
Main
% Processor Time
encryptedPassword
No admin rights and service isn't running
Could not read cookie table
Software\Microsoft\Windows\CurrentVersion\Run
{0}{1}{0}{2}
Automatic Key Log
piqiz
Verwaltet Eingabeger
eab
Name
Button
img\
VirtualBox Graphics Adapter
Caption
Processor
userName
exe
displayName
CurrentMinorVersionNumber
ARM
InstallLocation
PK11_GetInternalKeySlot
Microsoft 2016
DeviceID
Comments
MaxClockSpeed
{0}.{1}
registryHive
MainRichTextBox
00:00:00:00:00:00
PublicKeyFile
{0}x{1}
Mozilla\Firefox\Profiles
mozglue.dll
.nfo
encryptedUsername
Translation
00061561
Assembly Version
$1:$2:$3:$4:$5:$6
</configuration>
Level
label1
label2
label3
OCTETSTRING
Safe mode without network support
bat
IsWow64Process
[{0} {1}]: {2}
SHELLDLL_DefView
Disabled
.ico
SELECT * FROM Win32_VideoController
ZnqfVtgJLX255UVs9SM3pw==
Send
#32768
</startup>
echo j | del {1}
Longhorn
msvcr120.dll
{0}_{1}
Segoe UI
Not a valid SQLite 3 Database File
WallpaperStyle
aforge.video
{{Left={0},Top={1},Right={2},Bottom={3}}}
(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})
Orcus.Service.Properties.Resources
Opera Software\Opera Stable\Login Data
<configuration>
A-w
JDownloader v2.0\cfg\org.jdownloader.settings.AccountSettings.accounts.ejs
ngig sind, nicht mehr gestartet werden.
UnhandledException
costura.aforge.video.directshow.dll.zip
logins
costura.orcus.shared.utilities.dll.zip
Safe mode with network support
notepad.exe
VGA
SGRAM
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\
Uninstall
csrss
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites\{0}
SystemType
LegalTrademarks
MHz
ClientActionCommand.UpdateFromUrl: 10/10 tries unsuccessfully
Bytes Received/sec
login
Firefox Application Data folder does not exist!
"{0}"
UserName
Google\Chrome\User Data\Default\Cookies
RUNASADMIN
username_value
table
Windows Input
guid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
A)`
-Jz
/forceInstall
A)_
--uninstall
costura.orcus.shared.dll.zip
VideoModeDescription
@ECHO OFF
SOFTWARE\Microsoft\Windows NT\CurrentVersion
echo j | del "{0}"
DisableTaskMgr
Orcus.Service.exe
MDIClient
ProgramFiles(x86)
FolderView
content-disposition
[Build
aforge.video.directshow
en-US
SELECT * FROM Win32_ComputerSystem
CurrentVersion
Whistler
ABCDEF
NETMON
Video Processor
<?xml version="1.0" encoding="utf-8"?>
value
EstimatedSize
Burst Synchronous DRAM
costura.starksoft.aspen.dll.zip
Windows-Eingabe
VM Additions S3 Trio32/64
filename=
CiceroUIWndFrame
starksoft.aspen
kernel32
\Mozilla\Firefox\Profiles
shutdown.exe
. Wenn dieser Dienst deaktiviert wird, k
signons.sqlite
VRAM
http://mirror.internode.on.net/pub/test/100meg.test
orcus.plugins
FileZilla\recentservers.xml
Software\Microsoft\Windows NT\CurrentVersion
N@ncyl
hostname
x64
MainForm
status
SDRAM
Firefox is not installed, or the install path could not be located
http
x86
Win32_CacheMemory
VLLw3T25XgdQL7O0ubrAOTUa+gYkodiQntBGaH29b1HHaCkVT44yPVsrpwHlXZe9o/10760nIL1KZswBvsMB8j2JrxvNDiRfkHsv95Z2cLKYqt/TP5RPUsvnYuKi8rEJOwTasYTrd8tF/6dSQE3OnUqSkJFiWZTlFNe/DjW3Lu8=
NumberOfCores
DSP Processor
"(?<hoster>(.+?))" : \[\ \{.+?"password" : "(?<password>(.*?))".*?"user" : "(?<userName>(.*?))".*?"statusString" : "(?<status>(.*?))"
000004b0
The graphics mode is not supported (BADMOVE)
KillButton
FileDescription
encrypted_value
Description
NumberOfLogicalProcessors
WinInp.exe
00000002
Requested Key Log
BCDFGHJKMPQRTVWXY2346789
Threshold
Manages input devices for Windows-based programs. If this service is stopped, input devices will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
X91w7ETM3eZBMWScm+BIHg==
Port
Auto-vacuum capable database is not supported
L3CacheSize
L2CacheSize
cmd.exe
ThreadException
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
SysListView32
SELECT * FROM FirewallProduct
VideoMemoryType
Activating keylogger
EDO RAM
ReleaseDate
password
MCGA
SOFTWARE\Microsoft\NET Framework Setup\NDP
moz_logins
Control Panel\Desktop
https://api.ipify.org/
Network Interface
Thunderbird\Profiles
Occurred while executing static command "{0}" (Command ID: {1})
Blackcomb, Vienna
Orcus.exe
Alpha
Release
UNIQUE
InfluenceStartup() at plugin: "
UBR
Itanium-based systems
No installs of firefox recorded in its key.
MessageTextBox
server
Yandex
CanStart() at plugin: "
Product Key
httponly
DisplayName
00000000
VarFileInfo
key3.db
System
LoaderExceptions:
Application
.jpg
CrackedByWardow
PowerPC
.zip
SELECT * FROM Win32_Processor
root\SecurityCenter
TileWallpaper
XBox
<Server>
Windows
SQLite format 3
case FromAdministrationPackage.GetActiveWindow
WindowsInput
The process does not exist
System.dll
Microsoft\Speech\Files\err_{0}.dat
[^\u0020-\u007F]
System.Xml.dll
expiry
ReleaseId
host
ConsoleWindowClass
te nicht ordnungsgem
http://www.speedtestx.de/testfiles/data_100mb.test
Not Implemented
Microsoft
S3 Trio32/64
VolumeSerialNumber
System restart required
extension
/r /t 0
ProductName
<startup>
MaxRefreshRate
[PRIVATE KEY LOCATION: "{0}"]
Win32_Processor
cscore
A$H
A-v
TotalPhysicalMemory
file:
DISPLAY
Microsoft\Speech\Files\klg_{0}.dat
VideoArchitecture
PK11_Authenticate
Normal
CGA
.config
msvcp120.dll
CompilerVersion
User
/tGvwoOXNPOAmRgl0JxnC4zNtozM2OFNG/VA0LvVR2Die91s1g3xr5DJmHSta1WF
Manufacturer
Orcus_Service
Install Directory
Longhorn Server
~MHz
DRAM
true
WindowsInput.exe
Load
\Mozilla Firefox\
hdfzpysvpzimorhk
CompanyName
rXY
UninstallButton
n must be 0 or greater
3$;'<(=+>,?/@0N6P8]:j@pEqFvJwMyNzP|W
microsoft.win32.taskscheduler
Copyright Orcus Technologies
Vista
SysShadow
Microsoft.Win32.SafeHandles.SafeRegistryHandle
SRAM
SerialNumber
SendButton
/s /t 0
INTEGER
8514A
XGA
global-salt
ProcessorId
SELECT * FROM Win32_BIOS
msvcp100.dll
StringFileInfo
Password
Google\Chrome\User Data\Default\Login Data
password-check
Mystic, Orient
Edit
IFactoryClientCommand
FileZilla
URL.DLL,FileProtocolHandler "{0}"
$this.Icon
Mozilla Firefox
costura.aforge.video.dll.zip
Input.exe
Speed
CurrentLanguage
ProxyServer
win32_logicaldisk.deviceid="
-{0}
2008
Berkelet DB
mE:r
o&[I
j?E
q%:D
^~z
f11b
*;_{
256A
2%ba
J|\Xr
{42]vD
WHITENESS
e[9=/
.rx)
RegistryCommunication
J-oV
Wc}uo
c$8B
<NewCommandType>k__BackingField
6j)g')`U
bKl#
mn'8
L .o
Uw,s
set_Type
v_Q)e
get_Speed
4!>Bx
(7[_
Fi-*
3;z)u)q/ !gd
S;Bt
I3s[

"]l?=
AFN)
lcv_
C@ p
h9w y2
.]+/
KEYEVENTF_KEYDOWN
|VdI
ToggleDesktopIcons
s.?h
get_DataMode
RemoteCertificateValidationCallback
~HB)
})8" T
subKey
n#]
+2M/
MWYj2
@SS813
g7BU
mcT#E6+
sff6
set_Scheme
p*r-H
set_Capacity
DxK8[
ArrayList
5`}h
HSHELL_WINDOWDESTROYED
U_ce
SwapExtents
q \?
get_Left
1A('
XZj:
get_Factory
i`60
Xuce
qfgN1
set_EntryLocation
)B]'
G L3 =
V?5sR
OnShown
a^HWbX
-`zk
8vD
(3}?P
parentHandle
UxCrL
set_MaxClockSpeed
Bvb=
y(LW
regKey
iPeu
CryptoStream
SIZING
\\9E
[,|*A
t9m$
>T}M
Zb?<O
$9 +
SendResult
lM&
GetWindowAtPosition
NoD[
'm 1
V^k}
get_MainWindowHandle
mF)=
LastVisited
I.7[&
<fqw(
K$ZZGs
LSOQ
GsEs
g(-+Y
iVLE3
p*rOH
RestoreAllScreens
get_NewWindows
Z9%*k
/T)r
MZaK}
+2 o
,# o
_meColor
'VLi
a|cddL
U6Sn
(;}
1-+
set_PriorityClass
x~Fq
$VzT:;
add_SendResult
u,OIc
m_7
|5V w
Vwd0
U]ptL
set_AntiVirusPrograms
*: '
l3kd
Ru[*_
^i_{1
:Wyq
n,RVe
sU=P
0 $m
uninstallableProgram
@ 4J
.ZL}7
SuppressFinalize
V2I`h
Sa;p
TaskPrincipal
RemotePort
`?[b
BI%Yp
$L&a
u()BO
$ZHxHt
Nullable`1
Tiled
GetFirefoxInstallPath
:`2-cXR>l
hStdInput
Ri,g
! 9@!9@!9
get_SendProcesses
KDg'*
WK N
UNDO
# j+T
OxPS
$)ks
RegistryValueString
.Ul
SC_ARRANGE
!~;"
}J &U
s9!`
jv\n
y&9Y0
` ))
%\qQ
4!0 4
R'jPMx3
\@]U
DRs"myP
e@Ly
4;D>sg
A;C{
3hHz{
<'d3
Nfo&
ZbS#Fg3
ReleaseComObject
P2GO
&+D
01KM
M:=MM
?OH"z4S
#$]D
7\dAHZ*
#E,Y}
z6Fr
2cE,|
formSubmitURL
set_RemoteAddress
(i
8@|Oi
Mvo7
get_Language
layoutToLoad
fLH0\
]|9Je=
T ot
chatSettings
ConnectionState
fLbK}
p2]N
ToolTipIcon
x?lF
Enumerable
=PaE
ONr*
~;4r@
ManagementObjectCollection
ResolveEventHandler
&+
MatchCollection
cK7}
z!H Ab~
set_RedirectStandardError
>.wCn
,6D"
BootMode
r[@
nqc=i
T9cQ$
T(AV
ti7]
ThreadExceptionEventArgs
System.Security.Cryptography
B5%T
8(X*
t^uv
" ki
<GetHardwareInformation>b__5
."/1
VAzk{
entryName
MaxLogSize
nt Q
yZ3Nv
Speak
Asn1Der
6Q^o
e{zfL
\2l^
OpenSubKey
WriteAppConfig
WH_SHELL
;c!XU
>
get_UpdatedWindows
_keyProcessing_StringUp
xEv[
U(C,p
A( r
\ r
((sY
NCMBUTTONUP
,i*EZ
QFFV
C.B;
FNQbNr
Mt FG
3kl<S
^f<~
fz(r
v"Em
xM2^7
^#2e
sQY&s}
+"M)
;~4C/
"E7j
CURSORINFO
)+1N
/~|/=
'j<^
set_Text
\= k
newCreationTime
i7F_)
X g
&9
p CZ
?% 1#
<SetMemoryInformation>b__1_0
get_ElapsedMilliseconds
d5[%
u.od
get_FileTransferTempDirectory
K-OoU"
jal.j
<s
@/$c
P\r\
MT;'Y
`bN]j
Copy
~d?;f
oJS1
W{Ql
#Z4(
=Lk7C
) z)$
%o&D
CJ8$
>pVh
+t\ z
SHGFI_SMALLICON
Im/0
add_FileTransferAccepted
windowinfo
0,Y<
7fU,
s`W
get_Loadables
R|`%
System.Speech.Synthesis
9^&Hd
/&hvo
=i ~E?~(
9xJh]<
h}:I
szTypeName
<>8__1
C=Ha
)%V:
| UL6
\lmvp
!Vt$
Guid
9o,X
~v%o
Cf$r
RTfeA
ErrorReporter
pp7]c
{wtk
Yo8
'-AC|
uejM
!FUcQ
IQH2
size
vz?wO
U e2K{
vf*+
-i/aP
LT=-F
DzK=
<>c__DisplayClass3_0
QK?/|
set_IsAdministrator
p`8H9t
GetFreeFilename
5 k^
gDZjl)bVM
IUrlHistoryStg
DI?}~>
>@zl
BnYP\`]
%. t
/b,9
F6;V4k|
1iq0
p6 5i
l}:[
_ Gko
K.Dl\`
GHg{
Char
&[Ni
DM_PELSWIDTH
\ 3:
!0 R
eo&q4
_g
=#1^
dwNewLong
RemoteDesktopCommand
k&? !
s(
aXc7
(j
z|"1
j]`U
&P7f6
HK'/T
GetValue
B5@^
<ValueObject>k__BackingField
4= h
StopDDoSCommand
%n
P6)/+/)
OnConnect
rx.
^[rS@
assemblyNames
HashAlgorithm
5y;[a
aX`q
Xeu7W
n{?h
1C\i
q{Yo
][:Lja
a)MO
keyf
i7,
5,Ey.'M m9
MOUSEHWHEEL
1)5
Yiu#
MRob
_AC6
DELETEITEM
set_ClosedProcesses
FZ; (
(/
Xkt%
GetBiosInformation
=*z98
HSHELL_APPCOMMAND
QBZU
IzgO=t0b+
^w!D |
4~n)F
^{LTJT
3kl8
%zm'
get_LCID
fG!`
YlZo`
co:Hw
BN^Iq
L|mL
7RPWu
8A6OZ
MMDeviceEnumerator
+|+}
EVj\W
'~2tad
zqJlV
pR},f
yBMS
\ r]
I=+6
RWp)O
VCode
deviceId
~3E
=k"c
w&u6
m$x?ps
Nmj/y
6G9
P2Y\
9bc<
_/ Zk
WN2\
xC#5
GetShellWindow
9iyV
cO6OP
.text
&R(
iE>,E
JO'Z
sCBC
?%OW
V/5t
ye|a
~ LW
UYfR
ServiceInstaller
Disconnected
]-_#
| y\
XmlReader
GetObject
Mwv)Zv
?0N2h+
*s-?G\
T{'h
f4\
=u.@
FB1[Jf$
c6<X
Uv3JR
wqUSx
YJ2[
object
%@xW
9T=
~<di
InstallHelper
>C<P
v )[
ZC c
0'(2Hqm
dw1*O}
g@o[
Ro^g
VJ+;>
Orcus.Commands.TextChat.TextChatForm.resources
kBY!3d
'[/N
z#W>
$v:]-
UserInteractionCommunication
hX=~
[SnH;
.6r9
. ,N
add_ResponseBytes
Client
xf+2
<IsWorking>k__BackingField
.,YIe
EndConnect
Z>Fm"
=]\c
cV?K
fuWinIni
x}!)q
xiqm%
oy{uF
&p[G
set_ForceInstallerAdministratorRights
y2vjE
m4X^
d"XH
kh N
Resources
3]<ln
CipherMode
,R r'
<GetBiosInformation>b__3
7u-q_
B7&}
y V%tP
G @{
1iRY
rt :
"kQp>u
of[$
wJ{V
WindowPrintTypes
AeBg
NORMAL_PRIORITY_CLASS
g>K
+>z;7
encryptedUsername
s9?c
W#e}
?}}
&Znx
( P' -<
\{1:Iz>
=)X {
)i3H
Id
&k/FD
#G'FnF
XmlElement
VistaOrHigher
?kj,
NSSBase64_DecodeBuffer
38iI
,mGe
bg:9
qH_u
PluginFactory
H+{N
get_SynSockets
UrlHistoryClass
u'l'
C=_|k
4.0.0.0
`!sJjX
AddRegistryKeyValue
IFormatProvider
q1.+
Ompm
,+f|
4^ Y
Y]m6
Uw.e
!O=*
parentHwnd
UserCertificateValidationCallback
{u4 f
#qw2
gEZV
o@[}
CryptoApi
l=_I
-9vc
wjzT
<reader>5__2
\GeT
UseHashToken
pLG`
]h|Y
M~U.
)(W,
e#H#
SW_NORMAL
P6{XK
c*E
m{-0_|
XBUTTONDOWN
ew-]
/ENH-k
<ProcessCommand>b__7_1
set_ClientConfig
^f|DP
>:=1
V]7~
set_IsBackground
% }
TernaryRasterOperations
k("+(
N%F@V
_is64BitProcess
56+;W7
#Ece
-W2<}
remove_NewFrame
d#6q
|lxN
R#I=
c9C*B
vKTR;
w!'!
lpfn
KP[
$2w/vG
e3oX
iX$ k
U5vJ#
QU$7
set_IsDataAvailable
{Xz2
rlgi
,OJ ^
+)p5z
GetWindowInfo
bVTI
0>+X
|5{@X
HF98H
RENDERALLFORMATS
F"D<
K 9j
@#ndz
DnA;
pI!q
T9P52
ANTIDEBUGGER
dwDesiredAccess
uiFx:
f=W>
$3C374A41-BAE4-11CF-BF7D-00AA006946EE
AudioCommand
J{Gj6$2
K@H_
r zRf
t}cC '
IsOnVirtualBox
8SS{e5
Pv%G
GetWindowRect
hStdError
WH3%
T3HkU ,Q
!9dI
o O(
ProcessThread
biWkC
7u K
GetProcAddress
HWND_BROADCAST
MP\n
:lwiSr
[26v~3
\_W/
DM: .
ServiceAccount
[\\J _
Eep>
$!<i?
s pU+Jw$
U aj
set_ProcessorId
%rX.
fIcon
fX^~
pOfi
qpz
rgiu
V!+Cj
sslPolicyErrors
set_AdministrationRightsRequired
>e-j.`
^.f{
| Vi
A}?f
Z3gZ
$fUQ:
H!PE
pZ}
ReadAllBytes
^Rl#k
h"v[
ySxU
141w
}YI1
HttpFlood
SbO!
@.v1
]:L'
Jvo@
Z-I6
ApmU
C Xw
PathContent
JM$B
6{\AZ
2 GK
" GC
lZYN
Connect
on]O;
_deadKeyOver
X=,&
5X~[
+] r
Z#PY^
Z9 \
get_IsWarning
remove_DataReceived
get_Assembly
X(6-
bBw '
hvncDesktop
,T:iwk~
System.Xml
}*`Cq>
n ip|
r=!RZD?4E
I_=/
get_Volume
p7on0L
hN"~rb
dwFlags
EnumWindowsProc
m$weF
uParam
UYCT
" z9
~:BD
\T;r
^"?f
NXz
R65
dFos+|b
$[yW,=
{&zFQs
o6x
x) },
Q]iN\*U&
lpszDriver
B*!>ee
PDK%
1c`1
-v|.
*T>LI
\Q*A
GenKey_SaveInContainer
nZ(!
_isClosing
z@%>
.Un/
_windowPrintTypes
ADMINISTRATIONRIGHTSREQUIRED
ullTotalVirtual
"IU4
SecretEntry
get_AddressFamily
$- eJ
get_OSName
'eWwWt
qf ~3}
_Jyt
Rjw(
>Z*?W\
\:,Z
MOVE
STATURL_QUERYFLAG_TOPLEVEL
%XvMt
3`Kt
FunActionsCommunication
kYBt
hbmColor
^:?@
#K"6O~
sz
c qm!
HideWindow
/i':
RegistryKeyExtensions
jYl#
MO!)
prJ(
dmICMMethod
op_Explicit
4Bm
f-z?-zG-zz
Drx/">(
qX''
]hck
YdH2
#q@;=,
+]5yv
FpO U
y]{,r
d[)f
\!9{V
0H}P
+V-?]
`>D^G
_k=H
}q{ -`
[LUom
URL_ESCAPE_PERCENT
(e=t
(J*J)
aF6'd0o
*rp!
[Is/
'GinvI7
G=_Q
}@ ,
rRRx
NKr87
% 9m
SYSKEYUP
SecretId1
"S#l#
FileTimeToDateTime
W7bk
+ieg
2N+X
p d%
+oIt
6,eS
/~G#
aj4pbG
yE*9q
]+ev
Ro1)
Kt9)p
Uk/8
O}J,
"lg(
c>LV
tableName
System
[U|_f
G,F $F
Application
L{WH
OJK}
|{S)
rXl 96
NetworkInformation
]?,'
p)i`
PasswordsCommand
Du\P|
ba;<V
$$O)
pfnEnum
;l. 5y
aak{Z
NznX53
V;.S
get_VistaOrHigher
cypherText
rt9%X
dvGV
85mR
)&\ {
,x-u
#Ozg
_y^!U*
ProcessorInfo
y[ k
4RCjI
cT?Z
{->X
8\B't
XPD,
set_InstallService
<ExceptionFile>k__BackingField
BeginConnect
7k3_
SH\J"
ToByteArray
set_Version
!0?
DoNotActivate
RD2\L
exception1
b G3
MethodBase
First
.R{<z
Font
t} mk
/CWDN
. |
wad4
({ 0
get_VersionString
Stretched
bG J
.i S
set_CarriageReturnAndLineFeedReplacement
8uV=
[0_4x
i7+V
WTSSESSION_CHANGE
?)jP0
+.ni
k s9 {}
Capture
4Y-
y#;#
_receivedBytes
- r!4
9 !p ;
TryConnectDelegate
"G~+_
*.-K
?bl
? -
SecretId7
yU}p
`C &'
set_AutostartMethod
n oW
}fZY
b,_6
*Vs
<ExecuteCommand>b__0
7l{
NCPAINT
}iJZ
Vd~Rz
width
XnG(
mQo;
Yt=,
J}6#
ISIL
get_EthernetAdapterData
/p^XS
,^v-
hp-X
&! {
HTBOTTOM
add_FileTransferCompleted
get_AvailablePlugins
zK>sdy
S-giy
CsvRecord
wB<B
STATURL
RSDSy4
~O{
D.l9
Orcus.Shared.Connection
aA
get_Position
/bCF
m.V"es|
sfr \
Mu +
CreateDC
f;]f
2}c/q
hxxP
?B!t%
;ZjUY^r/
'C'!}$t ig
St%
H,=l
PATINVERT
6 Lh?
"3'^
Cl^B
(tJX
|'%G
~O&6
EYS"a+
,scbjt
X_Z#!
d $[I
CloseDesktop
dt9u
{] J
IsCtrlPressed
"4sm
u"=Iq
gN=88
<Name>k__BackingField
(=;3
b=zv
EANF
c`}k
get_PluginName
3,5f6,7
*,\l@
`1OS
hbmMask
IKm`
ky |
Registry64
'%L0
;"vh
; EGU
VV(<
X.E$
6|X
SAg"
EventWaitHandle
:ZMDw>L
get_UserDomainName
z" @_
)I*^*y*Y,
D:\Dokumente\Visual Studio 2015\Projects\Orcus\MainSource\Features\Orcus.Service\obj\Release\Orcus.Service.pdb
a Wi
27zen
k!5Y
)zQ
T+zg-
currentTime
v6Q+
<@Kh
XYLB
0]h1D
DeleteRegistryKeyValue
n-~++
6+r
MIB_TCP_STATE_CLOSE_WAIT
aT?hO
qRLR
IME_KEYDOWN
' o(
w00)
set_BackColor
_CorExeMain
c{}#
hy$6
*@U%
[6r\
2fEt
e<+e-
L=]T 4
CompareTo
.3^C
ContainsKey
>^fF
'\/g
{:+;J
Bc=Tyz
2|tC0
>w6 }v
a&hV
?;<f
icmpSockets
]'I$
u@{Z
0=?A
tcOH
v'fC>
TuPW
BmSNc
ZMyb
7W+z
6SZ6SZ6SZ6[
sYk~
_cancelActions
+LMp
|]EA
OnKeyActionFurtherProcessing2
set_RootDirectory
CalculateMd5HashFromFile
v3w
; 6eXP
3bXw
pnbE
4W}Z
kI|%
ComputerInformation
sF%?
u^Vo
@.reloc
Func`2
Func`3
dwTotalSecrets
FVr7
WebcamCommand
g+Uw
1]$K
,y\;K
% o'
A+']g
)>U
xU<qPbe
Bb&3
i]s}U
$@B %
#=k?x6
wo#0
RemoveFromAutostart
gV?x
dwLength
}RD.b
get_IsTaken
D$}r!
ug1G/'
FirefoxLogins
JnD9a
<GetHardwareInformation>b__6_1
<GetHardwareInformation>b__6_0
eR,S
<GetHardwareInformation>b__6_2
:&nn
\m v+
TVX~*
#[s&
mg
O sn
`u O
kw&]
oX.a
:Mk0>_q
UatV
]22t v
@VW@
7 I}
%_BE"3^
CsvFile
isCsvData
T(
V7[y
d2N
'r t
sC6k
bN j
localPort3
\}W0
2n#=`
get_ChannelIndex
Y)?B(
CaptureScreen
GetProfilePath
<Objects>k__BackingField
=W S
STATURLFLAGS
6x<-
HttpRequest
Cv )
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
`HF n
Win32Exception
Sz`Am
uuek%
&p Q
r95EO
get_ClientPlugins
S?J]
Sp^D9/Q
K}1e
gkK!
\?}h
^^b*
FONTCHANGE
<jQ{
TT S
y\e'>G
]Go
K HB
BinaryReader
3NYx
B2)q
title
jRs
set_EthernetAdapterData
b3Ma
Xx6A
cekS
hThread
-s`
Qa0(
{>4O
I+s2U
ntHP
{ vO$
]wkc
puV&
?dHZ
~q/b
(#4MN
cds(
oH]>#$
Uj`M
E1v.M
9}j_d%^
DeleteUrl
L##8
RotateResult
*2qZ
Pe4DH
ofG
A:|'
4 Bz
get_VirtualScreen
<GetWindows>b__40_0
wT(G
TCP_TABLE_BASIC_CONNECTIONS
; {\
t$(U)4
R.G!
} JF
GetRowCount
@?sg
i&!Qf
l:l/7-
SQLiteHandler
Restart
set_DataMode
7tEOC
set_Name
f\#>
Default
{/4L\
QUERYUISTATE
mL}s=
kEXv
;7b[
@yX
set_Path
ArchitectureToString
!{"|v
I^@
/B 8
{bVk
N:X#0
c HW
,!9W
ConnectionId
8U2'
FrameChanged
TB,7
set_Install
set_ApiVersion
GetHbitmap
Nm3i@
POWER
GetEntryAssembly
F\ G0
qzQo
6I=iS
h9 ]N
M/_zo'
Ttk2L
GetSystemInfo
7U2u
%&ER
set_PrivateBytes
;)c
2"A=
%&EJ
A+Xq
8N8K-
#_g!V
<qcZ
G3bfd[
CompileAssemblyFromSource
h0f]
SIZECLIPBOARD
$D8;0
Bj A
]Klse
2o=A
SystemIcon
)V^y
gIUP
nz)V
R/JA?
!2GQf
A=>,
Z%vza:
set_IsTaken
uD:H
l{IV
eUDW^f
c{^l
QL)i
2Su9
_vfv5sG
p9J8R
uBUU
get_Count
W #o
:[?8
s'fM
!VM,
IESecretHeader
"wly
z f3
parameter
#VMe--]
Vggy
0_fK
<SetProcessorInformation>b__2_0
fe6*D;
hklE
?("OX
hICu
Z@Lt
1u% 5
O<#~v}z
h&=y
Xt{3
k&? -
sH4_
Q3vi
<>9__7_1
c#qr
WS_GROUP
)Z:L
*}6-
|.Wa
f}oT
wkOr
b>*;
GetFormattedKeyValues
dbrP
d*Fe
OperationalStatus
NDM&EK
HTSYSMENU
4#*d
[d|
{MKY
R2`)
,<#"D
\#M5Ko
lL7f
&bcc
set_FriendlyName
#VCG
i*P[2P
HUI{I
ToInt32
k Ow
8wi."z
WFZ?
_=I<
a'DX
3F(#4
(BwJTE
HTTOPRIGHT
SpecialKeyType
KeyProcessing
t\`X&
HSHELL_ACCESSIBILITYSTATE
Ct`
({q
8QU65
>DK
kx4@
)9e6
p\;P|
<KeyLoggerService>k__BackingField
B{yN
3 `
4Vo{l
PASTE
>,;sa
o mW
MIB_TCP_STATE_LISTEN
# <ei
6;T5I
C15f
cv_+
&
set_CompanyName
RegistryValueUnknown
get_Pipe
[Gk::"\
set_AutoResetEvent
PK11SDR_DecryptPtr
TK5UCM
|]TA?F
Tojj B
) f|L
rg8
GLLG
ReverseProxyCommunication
q+QA#
ShowWindow
l%dK
ProxyHelper
get_File
An}t
zNtle2
t8r=
M MB7
?h4T
y{S5y
tln$6
vC#>
Mf8X
;q J
:$^$=N8
20RV
YEjq%
eb98W
qgu
BitBlt
Ouo~|)
set_Host
1;^
.VX]
~0t l
4(p^J>R
lpSystemInfo
CGlQ
5&8Xi^J
!kx1f
v s]
ShowDialog
pelWidth
F@x
v(`e
b+,jx
~6Be^
=.K!
oR_b
lfvI63;
CryptAcquireContext
-@;lr ^+u
:)Be
6QklB
_connectionInfo
#'e{
|a1|)
NumberStyles
Pnw9
GetPasswords
+NOe#
6PY,
2.8Xn7/
NetNamedPipeBinding
5,~
fzyT
Orcus.Commands.TextChat
parallelDownloads
Vm4
i5Wx
SettingsBase
"@hH
~&;Sc
R`50 l
ut(f
te~Bi
Orcus.Native
ZYN9
CancelOutputRead
aH?X
,qtmp
l&n?w(
)&\
//1\d
set_FileName
B-|lK]S
pOX%
4_P`
@GuT
mIb(
r&A J(X
,5|~
x_lg
ply|
get_CarriageReturnAndLineFeedReplacement
LinkedListNode`1
yzV+
h^*+I'
F\f#
'W^)
HK]
lgE
EI$-
get_SoundOutId
h!?iS2
vz+?
ToBase64String
Install
2X"WEG
|I|?
yzV7
TrimEnd
dtcf
<GetOperatingSystemInformation>b__5
CS$<>9__CachedAnonymousMethodDelegate1
3JAv
:p7(
caD|
jxe]
[$PG
e2]u
:[w/
e2]l
n$ !
J=~
P?l}
V8|6>
get_EnumUrls
z(t:ddb}z&
- r^/
lpThreadAttributes
Pmq5
@;sD
_sd/m
<ProcessCommand>b__4
PTC!V
-aK`i
}4#
<Host>k__BackingField
'UC
u\r!
iv]?
uSF#
aJ?
<entry>5__1
q6X%
h! !7 Y i
DownloadAndExecuteCommand
hProv
<GetOperatingSystemInformation>b__7
set_ProcessorInfo
qof);
zoG,
Invoke
StartProcess
3'5k~
KeyLogFile
G+H7H
"K
(l?}
=L%t,
^[l;
<!d!
:\< o
SetWrapMode
_firefoxPath
O ;&
Uf4&
n"rg
W57O
)* =
i{(:
A A{
Bu[J
CultureToString
vGQIxY#
lkaK
_systemPageSize
TIMER
W8MVb
get_MonikerString
/iy(
DecodeProductKeyWin8AndUp
z Eu?
L>]j
Sw<_
(j![
windowToRenderHandle
?R9:f"Mh
7Z/\nt+
baseHandle
LQ+([7
GyC4
UVF$)k|)
?BZ
|m5W
eor)4J
f6?3
CreateCompatibleBitmap
:CRJ
e{U*;.Qo
Rrat
5slD
jYl#
Array
Y[X 1
F%;#
>1+$
j*2{
Bv~N
% }[
ZqKd
" 0u
+ C{G
GetUdpConnections
xb"5K
datetime
9Jme
'6 U
K 5O
z/\@
~_.]
PushKeyLog
CompareExchange
[)=%
slot
WS_SYSMENU
mYs^ >
i/}o
-?}Q
) sj
ProcessPriorityClass
r63S
aqX0Z
<FileName>k__BackingField
,&B^
AdvancedBitmapImage
umGg_S
Oqo
l]'bye
vistaStartMenuWnd
M\w`
fxte5C8}h
:G`]
6go(
#jK
windowInformation
FromHwnd
S 6G
9{5
|C7?+
A{$:LR
3t8n
?y_e
?m#$
6f:<
:9CY
HANDHELDLAST
WindowsBuiltInRole
\rOW
9zWBh
Hfa<
set_CurrentImage
7F!
RegistryCreateValuePackage
` _O
3:[a
P]AR2
x~c3
6|^4
J6iI
z+8c
y")G
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
{iW
p*r G
E3^1
6]@?
bXJV
6"QT~
H^}
ai|0
LkwY
xWs:
Q2sf
oCk`5
XLY+
|hOx~S
CreateOperation
ro5=
WriteString
DirectSoundDeviceEnumerator
get_Location
pl@=
y)ZY
set_ProcessorName
\_|a
FileTransferEventArgs
STYLECHANGED
]&s^I
hq}7 <
liO!
8 8 8
qD ?~
lHa}
MoAI
q%tA
d%y*
'cI"p!
GetCurrent
+}EZ
1Aj@
ntv
dc 0
Jo${
dwWindowStatus
Rz9O
@JN*
:oC
P*'Nv[
q=d)
EQos
oyJ?X
{Z>m2
i&m:W
get_FullName
RH~s.K!
zxHeE
<IsCsvData>k__BackingField
qkv+
#+ 4K
FreeHGlobal
get_CompiledAssembly
, 3>
1!=
;&ioy
<DatabaseConnection>k__BackingField
.87X
ADDURL_ADDTOHISTORYANDCACHE
fuState
|9P'
EventLogEntryCollection
set_ChannelIndex
yzi`
hN=S
+_ o'
grVA
set_SoftwareInformation
RuntimeCompatibilityAttribute
gi(c
ActiveConnectionsCommand
Qsb8
hkQe
Ht L
ullTotalPageFile
OnN<
fwD94]
5eY!9
'zpb
m~/H}
.JvvO
_random
cCL#[2
c"Wf0
)v8"
kBXv
Km'O
d0ZpH
vMAL1
Xgqma}
t1Jt
.}/{
YO.(
Bopj
@V';
%t
D!c}
4?2pBs
P(8-
+m:g
{ [@
X(6
Round
connectionInfo
w%W"
? EU
gXwEq
p?a|
Ev#w
;6L<
?="Wc
"FLw
7'f
dwSecretInfoSize
`J8l
,kH
remove_Disconnected
] ~*
NImH
M F1X0
7^-]
!;F 5G
/4,U
GraphicDevice
v60f
XBUTTONDBLCLK
VNadd#
{ \^
get_ApplicationPath
lpCurrentDirectory
Os5Z
l c]
RRsMc
C,[O
7Xj
/4,H
Month
QUERYDRAGICON
\1m_
RECT
UFkv
mD_-
:'tS|
System.Web.Script.Serialization
IkT'l
W pV
hostname
\rc_m
2vg<
4r,&G1I=
System.Security
=CYjX
XdG~
L &GbY
97#T`
F+WG
RenderWindow
'=,s9#
ot!!
!+sA{
v LD
#q&K
DestroyIcon
z zZ
IContainer
Clear
CURSOR_SHOWING
l]p+)<
Tfou
TLY>y
}mx(
)7U@
get_Identifier
A\3N-
[~&FJ
[L<A^
R$dn
;c#*
OU9
KEYEVENTF_KEYUP
<B#xrl
set_ProcessPath
#|O3
d(W)
Fa|@
93bW
q%<.
p_h5
Orcus.Shared.Commands.Webcam
]-Z]-v
set_ClientTag
]>1=
'aRx-
SetFilter
Y,~N
jPb%V
a1mkn
b6D2H
6o2r
IsATcpAnaylzerRunning
b$8;R
hovs
$2a34f2e9-77ee-48fe-9315-979980e6fbeb
sN s%?i
deviceName
70]&
T|})
INITMENU
+f4s4
QKcF}o
hkni
FhKB
EXITSIZEMOVE
200p
GKZj
+Ba
QeHh
Vdk|
le S6w
c:T4
j'KE3F
get_Is64BitProcess
2%v
#G]<
$3601a898-0fe1-4710-ac30-2e6c417f46bd
Y(K&%
[L6e
<E^f
+R^FU
^J0$&H
orp "8
)=iJoK
GetInstances
M5so
<>l__initialThreadId
mhvnry@
2j#/N7
pvmVGMN*
Z ;"
ResourceManager
-b19
ClientActionCommunication
2=Ec
GetExecutingAssembly
p*ruH
3b9.
HitTestValues
FromClientPackage
?I d44c
ResultSender
}B:A
Z :e
w`vfA6
8qjS
w%t^
p(?F
ContainerControl
TextChatForm
BeginErrorReadLine
(;&G
3x(6-
Is64BitProcess
1/0c
h(-c0W
:DBf
get_BinaryReader
/E b
8/C\
HSHELL_WINDOWCREATED
^ Hk
5_<K}
ToInt16
1 e
p(?c
+`(C
H+7)
0e`g"
o4J
Y=By
Orcus.Shared.Commands.MessageBox
!>V3
CommandWarning
Gw>u
d4/K
VK9}
. cQ
rG8
set_CreateNoWindow
F*1
o8SrC
set_DisplayName
RegistryAccessMask
hOg~a
R:J
1xt
MDIDESTROY
JT,
!9`\
v{R
nNPF
Pxu'
set_IpAddresses
WhO@
H>uL
:Nsb
;N>pFbv5S
_counter
O9!p
s8Uv;Lh
Nc3L
`R6B
package
PluginLoader
juA'z&
AddHistoryEntry
O`H1
# X o
/yf y
zq#nP
WindowsModules
hx_c
,V;X
ng:M
38H:
gfL[
[X][QX
xTyIL
Vbxsl%Z(
s=oJ
T6 n8&
2(Cx
-Nr
fWriteHistory
1t%!
!)@
:0$d
DisposeSession
VideoArchitectureToString
XBKf
Empty
"x#PeW)/
.$$.
get_YourName
GetInstalledVoices
#s9N
RSACryptoServiceProvider
Kw"l
:*oY
biw v
Lq.9)
YV,I
<Main>b__12_1
,xmb@
biosManagmentObject
DpvzOW
pcchCanonicalized
!9b6V
FileShare
,Ms
NBNm
Ut!H
F5Na8
;J%(
ObT~
*g4-
WM_KEYUP
nwb-
N J`+
}:]r
J%PT:
>eM;
YajV
Sc+I
Bs"[
Orcus.Shared.Commands.AudioVolumeControl
4"=<
B| _
set_ForeColor
JliM%
(g!;!IWqy
p~B-l
RW6Ka
Close
BMGI
o!`T
J,Nd~
l S>:
1nqn
y="&
Encrypt
VMW_HILITE_MENU
7L5+@
+;V+
5{oC
G G Ga{
]+ak
3Y3L
#`q$.4
MM--
StreamExtensions
<ClientPath>k__BackingField
PGWe>ZfXih9
HandleRef
Z}gh/
i58EF
Kg&c
W&^pa
DL8F
Read
GetSubKeyNames
Xp]w
v~v9u
]2j{
PRINTCLIENT
A{}O
A)C/ly O
ttb_N
<Session>k__BackingField
w.2s`
zNZ_
screenCursorPos
get_Platform
b=.?
ip13
[=G<V
6OV}
"iL(
[/y4#w
d0 !
label2
)v%^IP
y06aHag
+g7
gyA$
jyUa
-}$z
)D y
get_StartExplorer
NbV?
uY4_
Z[WV
Ag4'
% ;r
/\do
#=iF
autoResetEvent
lpStartupInfo
wzZNg
u8[9
QO(o
GetFreeTempFileName
3fJKq
MENUDRAG
get_Scheme
$ fNy
O[C"
@k ))
set_Manufacturer
fqjDK
set_CompositingQuality
;raw
zGxse
>=9qU
Yg4m#
\lSg
eventMin
^|&<
f!afi@
+fL3
get_Tasks
GE?7
:4 Q
)Bn
}>C)D
hmodWinEventProc
$b \G
e\7f
OX~ /
PluginInfo
7w|w
RECONNECTDELAY
mscorlib
8Q?
U+zK-
FileMode
)v~v
*{ze
BUFFER_SIZE
DISP_CHANGE_FAILED
-`h)C,
_serverConnection
PW u
;JQLG
akKYb
f}L3N=:7k
lpvParam
<AdministrationId>k__BackingField
EMm
LrtgZ
AdministrationConnections
REGISTRYAUTOSTARTKEYNAME
S%|*
Uv0|
Orcus.Shared.Commands.Keylogger
RequestKeyLogCommand
lLV0
pY W
/+sf
dk4D
8u l
HSHELL_REDRAW
DrawFrame
23 B
ControlCollection
D8Vq
FileName
jIK?
DeriveBytes
;Y a
SetDesktopWallpaper
X:K+
DQ1(p
5!-=
yd?>
IgnoreMove
+b@}
$Se"A8
otoL
%21) iu
N^1/
d$GS
@X:E
ClientStartup
@?!@
ManagementBaseObject
ts<g
z&zu
_a#5;!#k,L ?
<IV>k__BackingField
TABLET_FIRST
{D|ZA
ABfu
ReadOnlyCollectionBase
className
*;4Q
);o;j)>j
LoadStream
4J^W'
J(&:
{nKw
)A<@
_floodingThread
;Mw8
RuntimeTypeHandle
@:s/
method
<>4__this
Starksoft.Aspen.Proxy
8XU
= Xc
wXJov]
J5Ccb
\M= Xs
>!K
89r
WyS9
d.^P\
IegA
s8yv>
LT>[*Y
<P n
%h vV
-%(
\i s
`*[P
V{ {
l=#B
IsWow64ProcessDelegate
UInt64
sender
P9 (*
DesktopWindowsProc
W|QG
Nn='
IPEndPoint
P$I.
get_Frame
action
sf{/
logData
s%c:
set_SetAdminFlag
B<h1(
CheckDisposed
RedirectPackage
bq%,
&q)/
s R$
-#1,@[
W+4v.
,-*g
R|R|\
^8d$q
set_OSName
33z:
_is64BitOperatingSystem
;{"4
ccrp@
jWn|s4
Yo.G
SC_MONITORPOWER
4h =
_K4N
WININICHANGE
iSsW
*
gQ}X
DeleteKeyFromContainer
#l?
GetDrives
4!%E
JcNU
uZl2
2 #ffffff
\dQ$z
>n(F
0=;O
FORCEINSTALLERADMINISTRATORPRIVILEGES
}?KnAN
] a]
(kg,k
4bzH
ENTERMENULOOP
3\5<
*4N~]UHY
}w6:
~"AK+
8+p
fk'}8Lx
set_RedirectStandardOutput
iN?F
~Dmz
, 0%
\t,fd.:
f7U
zyk&
1na/
rcWindow
P4\_
>heJuo
w(-<L
.wx[
~QM3
7 gV
RBUTTONDBLCLK
=9o8lMow
kdC $
set_Cancel
cZj#
|5gW
>=|5/
4 f8f
"hXW
yWH6
x#|/"_
[[fd
get_ExecutablePath
(9~8
)T!
uJi
ClientConfig
X4zu
fc&f
*|;fh
FromAdministrationPackage
/ mZ
CH %1
PacketSize
A!mO
set_Revision
Y$b$
I"a4
So-E2
#gX#
9>#=-7
"| |F
t%BE
vF.~
}n9o
U*w"
Orcus.Commands.FunActions
xB?F
=.Q
)~]Gm{
- [|P)6
# S2
NU%&"
})l
U=oI^
^d8 1
-:\T
6hbb
+f X
Flags
V~Sd
i`+;-
AppConfigWriter
4=#kt@
Nq0_*
|74ys
z?pI\
<CheckRunning>b__13_0
?\ ^
r<cn
lpEnumFunc
{[[00P
HTSIZELAST
~p3
NYO*
%~{3
& 83+
Im<6
ProcessListChangelog
#hfB
i-{@|
hF3e
l*iR
%!.u
W|<C
i^?1C
().!
Dispose
ReverseProxyCommand
rN
D8>Q2
set_Handles
ZFIc
r:'
]>41
x0>?
Q|!:
}<o -
.V {8
5,%M y
meOWS[wokS
m3G8_
9Oh6
>MkM
os1 }
S_9
?G
qRs}
:P$5
E8Pv
p a:
))()-
{]^y
7Kc
GetDownloadUrl
T$5I
SC_NEXTWINDOW
rN'
RB_3
bGNalCPA
'^!fR
D&E<EJE
& kM
Ed'<
" 6W
O/0
$M2LTu
set_ClientSize
#5VU
remotePort2
remotePort3
iM=8uTS
jF[`5
Tv*>?
S,9C+
q x5
*$r/
InstalledVoice
y--oW
0j`|T -2
<Source>k__BackingField
.efi
{6u
$q63Z
<P}l(
1oZ?
localPort4
_isAdministrator
LS%3
`VE~0
xL)q
CAPTUREBLT
9I-@s
'k8"
get_AsyncOperation
[K+o
M0*C
,Efg
Orcus.Commands.ComputerInformation
x{7a
\ D`V
9 V@& L
Ihpk
);&c
p9v
_b"B
resourceCulture
+sOQ
@SH;"
-l06
get_MainModule
;;?B
U,@I
QnZK
r 2S
[tO
localPort2
#L i)^
IB g
JBI
znQOE
ngp-9P
WBy)$(!A
XT!l
L.}c
op_Inequality
K!q*
CommandLoadedEventArgs
um)y
ResponseType
}&?"
4t`g
IPAddressInformation
;Nl0
{" ql
OSType
3&]k
CvHK
fQ,s
5^.V
cAoQ
La_h
&i8E
CancelErrorRead
SC_HOTKEY
l<^,L
S1K 9
defaultInstance
Kxr
WriteCsv
kjvM
StaticCommandExecuter
HostsFileCommunication
W.c/*
%tMJ!
uTmb`
S!}!
4D53392A6A24D5E801ADA14E79B43F9BEBB79150
7.lWF9
eSV\
<Guid>k__BackingField
w<c}
Sps>
get_RootFolder
z{Bu
L3b6
G!S!
System.Collections.Specialized
|SMfFp y
+-}`
V)$Oc
P'jH]
q LPDI
get_TextInfo
[of4
O~KX9Y
#A%;
jA'QOY
System.Linq
<Dispose>b__4_0
LiveKeyloggerCommand
x.J|
show
a/ *
-j.
fV CIZq
Lmf3
)miky
0ml[f0L
ub`w
<>m__Finally2
G 9:H
set_RegistryHiddenAutostart
<>m__Finally1
=.hh
KBt\
-Z/|
%k2/
=Xg5v
*]nfO
7,EK
-bZM
T~mR
get_FileName
SPIF_SENDWININICHANGE
8:^f
|>pU
<$BIG
( )
"=qtZ
p!Pe
M^jR_
TK)
2/l=
add_NewFrame
+mY
gA>D b
- H
GetCultureInfo
mg_C
m3W^
je cvF
$^)l1?
<Ac%-]
sOR|
}:[5
#JcNBlo
b y}^p
8K.}
(2
<>c__DisplayClass14_0
get_IsSupportedOnCurrentPlatform
<j?Rp[}
-8s
ExecuteFileAnonymously
(/
_sendLock
SizeOf
unixTime
bQA4
UnicastIPAddressInformation
EndRead
bdV/z6(
BV@BB
ApplicationPath
UnhookWindowsHookEx
PluginReceiver
u?P9
m] >
m6e5[d
PKX<b
~ eH
a zs
_>9gJ
phHash
,&mZ
ExceptionFile
. ]#7
(|
},1tR
index
rIV+!3
get_Flags
set_Key
w`^{
9/}$|a
S]|:
0i!U
get_Triggers
SP%Fi
XBUTTONUP
( )()
?##:
Title
AyU}]}M}
1 =y
1tx9
(d
RgN6[
CultureInfo
lpCommandLine
endIndex
0w M
(&8Rb
9 Qq
vKey
K@<P
8F^>h
_reverseProxyClient_DataReceived
(H
Boolean
WM_RBUTTONDOWN
(A
"-_s%
|wf5
Orcus.Commands.Passwords
V :1
set_Account
NHYE/
a^I0
h(eW,
pWG!
i_{/
registryHive
HE7|I
y0p~
j[ZA
IKm<
T488
w8]G
_K-g%
AddUrlAndNotify
1.0.0.0
P_qOU38
YuLE
+$yc
Z`[Q
t*;~
StringComparison
B4${
FI&K
O2*J
get_BootMode
CompilationRelaxationsAttribute
xKLD
<]JFK
I{VSN#
X0.%
ApplicationContext
<9{cGZ
;1f/r
@/hMO`k
K^\@fe
<Pipe>k__BackingField
get_Is64BitOperatingSystem
!;Dc
JJn6
MemoryStream
MessageBoxInformation
/Ug7#
-4.E.Y.r.{.
<>c__DisplayClass4_2
NewFrameEventHandler
<>c__DisplayClass4_0
<>c__DisplayClass4_1
F2/7[
w.0Sw
;,#E[
HttpWebRequest
K##s
J#zu:;
M{c$ZW
#hZW
!]{6D
@<7o
) ey
W6z@X
(J,M
: 9.
/&au 3
bytes
xq7]
: VW
YziZ
set_VncMessage
5oi0?Xf,
CommandLoaded
.o=
=Q l
k]]}K
Buffer
)fZwK
(L:
EVVx
Vv`;nY
CDS_UPDATEREGISTRY
vc!}]
DesktopWallpaper
+ _
unknownZero
6 h2
KS[m
G]L(
B Ym
FileExplorerEntry
[d&A.
0oEz
A3/s6
,Bt_X
MBUTTONUP
0j?U*
configdir
SwapMouseButtons
IsVisible
x>G$f
Orcus.Commands.HostsFile
BmgeCr
a-bZ
<o'O
|bme
2:fK/
Orcus.Service.Extensions
X o0
lpMinimumApplicationAddress
OnStop
a|r@
ne ]71
VvxS
Orcus.Commands.UninstallPrograms
u3k6
Gb#V
6$72S
SslPolicyErrors
( =F
!T/^
MDT4
w 'v
5 '*
r.L&
2,\C5
md5Hash
^zz)
b8wX
get_Target
53q6\k
u{xq;
't5Sl
dkm2
JifJ]p<
xrQI
@ c$_
-uoJ
get_FriendlyName
m?P^L
Orcus.exe
Vk?d
j\4cK
*dBc
7QK2
|54@^
V.Sv+
+Sa8
: (2
_ }UI
bQ[Yb[
5{6w
lIBT
DoMouseClick
-&jZ
Ol"{
8nbk<
WH_KEYBOARD
!_Eqi
WCF_PAINTMETHOD_PRINT
[{dF
ADDURL_FLAG
Orcus.Commands.Passwords.Applications.Yandex
&s5v
0zL
8;3C
,N;t
desktop
XI1
wiQY7
?"S
\uml<o
G^[';
m,[O#.#)O'
;-C}^C
wg@<
PluginVersion
set_ServerConnection
s$
s=
\;t&Q]
<4zQ
<Z201
Concat
y%6oPe
' }C
e Ns
:dyu
Orcus.Commands.MessageBox
~|g
C&^
get_Data
eaV<
qX_1
y~~W
ZP[U
func
lpClassName
KHCH
REGISTRYHIDDENAUTOSTART
73_a{
TK
NRgv
UN>>N
r'1
f<JF
TCP_TABLE_OWNER_MODULE_CONNECTIONS
^PR
/
@?#6
,y [Z
4U:M
"'u
X Kg
HvncCommunication
' ZAF,WQ
<Path>k__BackingField
,>q.
1:&|<
databaseConnection
{;G)#
\L!?
bUpi
ucL%
=V v
5J0'
ClientController
U;,u
<PushRequests>b__2
T$,H
BE%T
set_LogicalDrives
f`f.
N)K :
get_AddressList
KEYLOGGERENABLED
XYo0
$~!q
ml 8
2.[+6
:foI($
set_Username
pXN.
k?_x)
duud2
C8#f
`/WY
Orcus.Commands.FileExplorer
JSl{
?N5
1BJX
zEYu
tM#x'
#-#r
Sw#U
ReadStream
nCmdShow
_msvcrDllPtr
jLH
\i,jw
ReceiveData
add_ApplicationExit
qZh t
IsCsvData
System.Text
!zgJ
whS/
c0~#blyv
z;_j
4s G
CancelAsync
b?m-J
GW_HWNDLAST
HIw]
O. S
iUp
<InstallIfNotExist>b__0_0
IsNullOrEmpty
b-n7
"CR b3)
-Vx
System.Collections.IEnumerator.get_Current
e+g697
Null
G~Zs
dp"w
dBj
E+Cn
A|wC +e
lpApplicationName
p*r =
hObject
TCARD
,ew mk
RWfs
FDB}
sa
HvncHelper
|;Q|U^
ByteHelper
eqN9
t5gR
.?xnW
b}k-
Component
X1Vy
HTNOWHERE
u%+[5
set_DnsName
Bu!}
ec'_
SHGFI_ATTR_SPECIFIED
_eoQg
~n28
3llJ
1fo
J\eZA
U4W8
/I+Rh;#
VuqY
4}~Y
E9Pw
=PLe=d
MOUSEEVENTF_RIGHTUP
p\ '
- r+
SC_RESTORE
a=sS
|=?{/
SY}g
location
-{^7h
^d#x
+p?x
input
bSwap
X3LF
{Ng
t1QG
94A9
=*x
?MU=T
:s+9
XmlDocument
'M x:
>FBg
\Cdi
fAtg(
vm,=ShIH
kx#O
GETHOTKEY
InterpolationMode
|>6k
AeJ7
iF I#
-Hb4
{h:w
h7M_
HV1r
RegistrySubKey
? I,
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=10
AudioVolumeControlCommunication
EqLH
p# W
HostsFileCommand
d!*Hy
oDN"g
i^*
g>S*
N*y{
nextId
add_Connected
d[e>#2
5HVt#
2?'S
>2`7\
rz.7_
n C;yH
<GetHardwareInformation>b__10
gXxw
@m>
=]@7@0Y
2,c:
PRINT
<Lenght>k__BackingField
_:+EC
VOF{
b%E:
a @`
]@x
%29/
TryGetValue
[PU`
ljZ\
c Sv
rH
DebuggerNonUserCodeAttribute
mi/F
get_Title
,]?i
g:gh
F,z7
0zO"
remove_KeyDown
Q=!\
t*:6
#@gk
\Q/U+f
a^% U
5o_,v:*
(Su\
fa:
avR97
\i3C
R|L?
set_Model
WM_SYSKEYUP
DebuggingModes
EventLogEntryType
P"TW
~9: g
m> |G
WO?Vy
certificate
=KQ
PY|{
.Si
wXmX
CXd.
1dsT!oB*hK
YcPG
ipAddressInfo
% >r
#VF`
HIR'
ToArray
fsKp
DateTimeKind
8Z3e
F!6Y
y -q
XyHG
O B_V
UOI_NAME
IsInstalled
z'dmt5y(
Degrees90
<IsConnected>k__BackingField
h5SC
<%R.G
#=Nc
U8n d*P
>06#}
' vib
Handle_Connect
>!0>?
CompilerParameters
)$-Gt
User
URL_PLUGGABLE_PROTOCOL
ConsoleCommand
<96F#
ro@
{gq}i
;! A
UgVJ
yeQ1
dwSize
Hy8]
`[BT
z;: `6
L"8t
V_b2
FromUnixTime
:FHk(
NXf
!$wQX
|;,Qk7
|X[>
!(kr
54iU
q}\,
_Vrv<en
ScrollToEnd
'UUv
^D~F
_stream
spa>
h%DK
#Mkh
j,7:t&
Xa2`
PK11_AuthenticatePtr
FirstOrDefault
3*mN
3){iu
<reh
SystemIcons
_@ j*
.nhP
F2 }9
7A.Q
K _5b
/K.1]
"p;7
-*bq
z ?gy5
SN;->
p (L
psrw
~nO&qnmr
FromSeconds
YB(A(
qBlr
('FT&
|UZVCbZYYq
t@u
Re(,(
CallingConvention
FkIuJ
set_InternalName
mWB+
NCLBUTTONDBLCLK
p]}U
AddressFamily
}DFg
KEYFIRST
QZU.
AesEncryptor
mjoy
/xS\d.^
A|&2d
dc4e934a219e4881bb6cfc88ccbeba7b
^pGc
`5?f
F\:Y0
<Loadables>k__BackingField
DirectoryInfo
Orcus.Commands.ReverseProxy
"~Xf
zJ!G 9R
<EventId>k__BackingField
}9O<
_C7?w
{WGE
i|)s0
{u&[
WH_GETMESSAGE
costura.aforge.video.dll.zip
zVYs
RichTextBoxExtensions
[}IK
u>z&
\EK +9
iK1bj
\ y]
2k(k
:RFZjGs
:} T6
DESKTOP_JOURNALRECORD
set_GenerateInMemory
."U q
@7h+^
FW45
M kL]
code
Q]i)
IrN^
7 _s
ExtraInfo
%u7#
CreateChannel
W 8E
ENABLE
Qkb2
Y)c"rt
^27>
registryType
j_V6e
<ProcessCommand>b__5_0
2N#X
tz=P N
5[G
?f]D
"<if 3bf-
item_name
R. "
B6\ iB
u2^?
/ ]A6
nR^?
B%%T
GetSoftwareInformation
_kMGm
TakeScreenshot
={Q*c
prR#
rYzC
tc;k
G:7B@
;)1,
4\2d
g:(:\
+rnoz
xwft[$)c
*FJ5C
version
\)ON
KD/}=
NCDESTROY
O Vu
MUTEX
r:+
QueryUrl
2 (n
Q%_$';]
~& U
7]A
\J3]
.!^z
r:"
Render
CN^O
DisplayFixedOutput
LhlfRS
d.Mml
URcY
Gc =
p@^` +i
z)
L?P=
<GetNetworkInformation>b__9_0
C,o9
MDICREATE
[4^m?
\C"#/:
GetRoot
-XaU"
xQKG
t~\-
QDjE
T4v`6
V&9:D
u^CT
hTPD
#O;e
HsM5
f'?1
NEXTMENU
;%(c
>S$G
vH[4
D6j,
=KMR?hMy
2=;N
FZN-s
!J&)}
,ov
DiBNY
get_Length
_Q#~t
n;#\
_'jpC
TUW6g
SetThreadDesktop
c fl as
,M ;
?!]O
p,.hT~
lqz
Z D[ Oc
SC_DEFAULT
_v ,h_
set_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
HfY8
NGW
get_Ipv4Address
t'.1:r
7Ox@
Xc>'-u
Orcus.Shared
0xd=Vb4
tI,_
h2_O
V*z$
Stream
Orcus.Commands.TextChat.Utilities
U G B
7?Vq
lNJ
&^] 1
set_Field2
ov]8
@<*7;
UdpFloodPackage
<ToolBase>k__BackingField
<>9__3
>F O Y
R 9H
c,Uo*Op
XN[O
get_BlockSize
PAG+
R ].
2te3>
I"-O
RT 0h
shlwapi.dll
Hr|"YE
a<,M
1#LO
g.;Rq
SystemTimeToFileTime
Windows Input
zoz]~:
Tld}l
Fh/@
#I66Nk
BindToObject
GetType
USERCHANGED
87s|
'W5
^g)e?!=?J
get_Commands
ZKH)
CPoS
=Zh^ [
5{0/
MIB_TCPTABLE_OWNER_PID
W#v
~hjS
~(Nh
kG[
I*R]
Vixd
vVf
9&`J
X}O;
~Gci
Hg#L
S at
qE$!
xk&;C
9z>~<x
viR
EndpointAddress
I4?
haK
]\
+-G.
set_Description
wn6h
BeginReceive
HnP7.M
list
>BZ|
pR9_7Z
uAction
URL_ESCAPE_UNSAFE
WH_SYSMSGFILTER
(-3S
cbSize
1_mh
M5f~# N
set_Secure
0:.>n
196;(
TB;Q
dwProcessorType
r%H0
process
eX/S
GAWO
x|s?8'
newWallpaper
r,|<
#I!@
Fc$0
set_ServiceName
u q`
#6L!
set_Image
Cp% k{
"G !
F+;*
t=z/
}t+iI
cSt(
ConnectedLabel
!7 V
y _W
get_LoaderExceptions
:z.[
T=^
hnBbO
p4hiC
3sc#
m[-^
EventHandler`1
#E-H
,]O2
RX;O
qFMd V
$8UF
t tGi
^MG &
G>K\
ProcessToProcessInfo
<ProcessCommand>b__4_2
<ProcessCommand>b__4_1
<ProcessCommand>b__4_0
<ProcessCommand>b__4_7
ac?4
r_;6 o
_client
get_VoiceName
NCLBUTTONDOWN
` uM
GetProcessByFilename
0VB/A
x2sY,y|
CSCore.DirectSound
|NxM
="$u
+0A!;
GetAudioDevices
l='E
set_VolumeScalar
URL_UNESCAPE
Z0 Ru
Mt#8
e%m(
82Ft
HTMAXBUTTON
0V/a.
>Q)\@z
r{{=4r
b9m.
%35c
`Y<|
WS_CHILD
m O~
GetForegroundWindow
M5ZE
<Connect>b__29_0
hKGo[Sco[g
%-,&
;S)Ah1k
I@90 h
~cYEEA
u;K'
^2t:
GK3&
N<Nz
=emwJ5
)!H
% YB
Match
F[t >gBse
O|.GT
R!
C8!q
get_SystemPageSize
sYsx
get_LogEntries
<>9__23_0
RN*(
<IsAddedToAutostart>b__2_0
OpenRead
K3F@
)D=6
UrlCanonicalize
~^Yo
"g_O
|O3z
gl]Y
>I z_
l|v^
2|/yY
BasicComputerInformation
UninstallableProgram
59=;,
Jx_
C7>B
Register
V2*{
,M/J
qbp>
TryConnect
get_Installers
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.get_Current
NgP8
>g"_g<
WI)?
set_Id
]RxY /Ka
remove_SendResult
Mrw
/e04
hObjSource
l|vr
startIndex
VYTJ:
WriteSpecialKey
z(-yrN
playInformation
Passwordcheck
MinimizeAllScreens
_Ca[
=<5[
()D+!Z
set_InterpolationMode
s?2z
Qol"m^
&cc7
System.Drawing.Imaging
mp@jbG
OctetString
SC9jO
get_InvariantCulture
1Orcus.Shared.Commands.Registry.RegistryValueQWord
_pageSize
;*VC
T3G)
JaT*
1Q4
8Vp
dmReserved1
_containerName
FyAk
wRM"
? TY
CurrentConfig
RxN
K4\6
j\_.m
C_?T4SP
Ga;X
I@H$
{8:Du\0'D
.B=E
d]T/+T
1p_V
IsNameOrValueNull
V[V
SETREDRAW
STATURL_QUERYFLAG_NOURL
;9E<OTD
FrameworkVersion
J S yV
#(0[
xQs
set_Culture
Km-V
get_ResourceManager
{$wR
P@$4P=G
c>k\
C?SD
C6c
MK/S
adc N'
oO@2
<ProcessCommand>b__4_6
" ;Q%
{$w@
)=Q
[Ff3
Ak*]pJ
=K/XNY
sM.['
UBY)
System.Collections.Generic.IEnumerator<System.String>.Current
t5e7
set_IsWorking
^ DI5
NewTask
xmJc
length
`BUD'
p}S@
\^?#<
Z>P>
*Y9[
oyM
5^_Q
rJ*
lJJjUa
Tc;q
hKey
set_HardwareInformation
$| %
Program
Handle
P3c L
DNrO
$yE1
A=B
c|&R
V< p2
Orcus.Shared.Commands.RemoteDesktop
& o:
>B 71
cP;R
start
P. Fd4R
*K;C!
i}da
P :I
vh"V
PmRhl"
8XvF
<IcmpSockets>k__BackingField
kI6
& o(
WCF_PAINTMETHOD_PRINTWINDOW
Y bV
P~]_0
rE0"
HsWs
a ^1
f $C{
M{-{p
hRh0O3(
$D4 3g F
<C>
W *6
h 2#s
FNOZ
^b7
gy,M
@:Pl
PixelOffsetMode
NQ@Y
Integer
B;`
*sP
1vM~
nOEE
<ShowWindow>b__1
L%dJ
*sm
{y\]P
B E@
get_TotalMinutes
hY V
?|W!|
&t-
0 X
v~ j
*i9E
Shutdown
Oa+^
KeyDown
RLC+(Ci
!4+s
^m:
j~O>
TRYOTHERAUTOSTARTONFAIL
/C<-
CreateDecryptor
set_Connection
<>9__0_2
<>9__0_3
,Q.}
Installer
Or_W8k
"M;
X#WBz_Z
<>9__0_5
r t=
SW_SHOW
-).;
L<Zg
?h+u8x
NCRBUTTONDOWN
g2CS]2
_Y=K
N_)Y!i
Yr5>
foy/
T{(d[
tFyD
Qh+L
CANCELJOURNAL
H$4 |
}zYO
Xn?Q
`Dd/
7Q C/
Wd4 U
/}2_
get_BinaryWriter
dmDisplayFlags
q)PcNCB
IME_SELECT
VNXy
Multiply
Orcus.Extensions
6q.O
IY|e
=4["
}zY/
J^<ZLi/K|5
ew'Z
K}e%
2gr1
SETTINGCHANGE
!wb _
H9-7
WSsco
<WindowInformation>k__BackingField
J^<P
>qR~
eHw&
CIM
L2iyW{{
SPI_SETDESKWALLPAPER
Es`J
HD`mNq
get_ConnectionInfo
GetBounds
EVENT_SYSTEM_FOREGROUND
;dx_59
nXi
Ec:Zt:
<GetBiosInformation>b__0
ResourceType
Nxe4
:X\HX
modeNum
get_VoiceInfo
usnp?
Zh"!
ivB3
o^sC
<45yhR
filename
*.:~
\E-=Y
bvyu
YP#
set_VideoResolution
C3?Y
CkK,
;/ZW
SB]F
pszCanonicalized
y7-N
<LogData>k__BackingField
+!]
MQX;@
bs^90
gkdV:8&=I/
q6-n|
<GetBiosInformation>b__2
;2h?R
handle
qW6/
:gRY
OLY&
lpReserved2
RegistryHive
`i^F
\r!3
i+dh
r}b-\'
{?N{
<1iVZ+:-5
t\>i
GlobalMemoryStatusEx
ifFn
F'S
GetWindow_Cmd
9Pi#Y
~DOy
timePasswordChanged
W 4k
oeV+
'#'
G<HPi
9=`Mh
j/Dg n&h
| zx
|X/gd
P-z7
98f5f218da81456795da0aa2ba7ba85b
MOUSELAST
GETTEXTLENGTH
0..gA
'4Nc
"t E
KldmjP
'``O
H?ad"~
|i8X}
get_Resolution
,&id
OpenDesktop
Orcus.Utilities.KeyLogger
set_TotalMemory
Z*Wb
nYSrc
.gJFz
69QY
n?n
E/&w
vYq}
0B/k
Q)KW
<PacketSize>k__BackingField
Settings
*a\+
!gYJ(
<PrivateImplementationDetails>
s1&JE
kEu^
ServiceContractAttribute
GetWindowLong
Nc]DE+
".Fe
get_InternalName
DeleteSubKeyTree
0zc@v
Tm^4'v$
_isWorking
7?/l
sPg>
}Ele
RegexOptions
HvncAction
_QV.5
<gLB
^^u
CopyFromScreen
BZA^
IDisposable
H5?N
_Ph[~q
Ih>Fy
&dni
$V[q
get_FactoryCommandType
i:hv
mRhRt
ullAvailVirtual
P$Z@h
_ipEndPoint
/KG<1
)Ocx
<y^-
CreateSubKey
DatabaseConnection
\~4rK
ConnectionInfo
{e%]
h6PoU
]^t?D
}F3
j. t
!7@& y
<EcO9
qD`
d @R0
GetWindow
DQ3M
>+g
g$3/
\\mv
txDR
2.KB
xx~j4
set_Resolution
f59IV
ZwVa?
CommandResponse
DoNotChangeOwnerZOrder
RZl6
d{ ^
eu6,
VDHK
set_AdapterName
2IR[~Z
\Kf:n
<=8"
ebi
get_UnicastAddresses
RemoteActions
*V~2
UkyCy
EnumerateSubKeys
^g@y kt
W/;m<
.-Qq2
=t[ \h]
remoteAddr
x(!v
IZ?
Ts$u
fK.;
z%%]G
WMwz
~h 'RH
Year
get_LastVisited
kSgn-JDJ
n-|_
R 5a
lyT2 c
#\K.cz
$0\X
_isRunning
Sdnx
EndReceive
;a^4
>W 4N
x.scpp5
SC_KEYMENU
@121
set_Enabled
ppvOut
HoF2
Sort
get_Exists
<accountKey>5__2
_firefoxCookieFile
MEMORYSTATUSEX
_isDisposed
IsInRole
;M*x4OG
ae/_
bUA#
ZoM>
E541>~
Passwords
ThreadExceptionEventHandler
W#t`
i{ 2G
SHGFI_ICON
>/YJ
kAG9
A#h"
'Cj2:
WS_POPUPWINDOW
%cF)m
VBCodeProvider
Deserialize
\)Mf
L7>s
'#o
E {8zP
r/d{
phProv
executableFile
Oxe \
KillButton
`>/fy
N[;d
p4Qj
N MKDwM
@G(n
HTERROR
Synchronized
Dk^{H;~
nA!!
_jz Xfz
_j&e
get_IsEnabled
u<_M"
1E63
dwExStyle
gK[WZ
hngdu6h
Fcg[
WS_VISIBLE
command
SgBz
C*7)
5 XB%
GetValueSafe
`M^5
ANTITCPANALYZER
set_DeviceName
FI$|S
r`!
NsPS
pr5:
KeyLogEntry
get_Line
GN$_:b
= S
O }F
get_AllScreens
' $L
5j-H
W|}L8-
NHP1c
uF\!
ardj8
CalculateMd5HashFromFileToString
GetEncoding
"Q*5g
\Odp
g,i8|
set_Is64BitProcess
FilterCategory
I[sl
>( A
M,O=
\+ (Y
eO\
ALG_ID
Xl1;<bW;:y
}Pro
[BK'
z>`w
1:M1g
zb$&2
MessageTextBox_KeyDown
JEPM
SETADMINFLAG
$AFA0DC11-C313-11D0-831A-00C04FD5AE38
AJHo
hPT?W
LL.S
}jd
5>2n
NullReferenceException
FromImage
~ZjE
*Wk4*
Y0\g
^c@b
5$E2
WR {
&$x?0*P
*p[W!
.Y};S
_ {Ov8
StopAll
4avq
4!c,
G/R
<GetFormattedKeyValues>b__4_1
4avy
get_ErrorText
(Bm
i?um
54N-
dwAllocationGranularity
StartDownload
C\a,/
set_StartInfo
_pluginReceivers
X\/d0
0L`V
STARTF_USEPOSITION
c)`u
UserInteractionCommand
a~L%O
!sD
+,
<KB
z1 \??y
UNJ?
{Z$T6q
7#
IWebProxy
NotepadHelper
a&~at
rWIQh!
*/2n
synSockets
cZ`D
1M~D
th#T
p*r5H
MZnR
AFXFIRST
!Y&@=,
<ApplicationPath>k__BackingField
m8'=
get_AllTasks
+%j gK
desktopName
Tp 8
DESKTOP_HOOKCONTROL
Ey%t"M
set_ProxyPort
t zh
dwXSize
y*IT
_-v&
:IY/s}
Szc}mJCC
`N9D
tR2zN
&/25
*'X`^
j #
j8?&
<=p#
I.gG
o -1
Replace
.Wvt
+* j
(2V5
EQV4
CBc8
d9/Y
5c<a
] oK
r7?
H0&^
:>X=
OY<]{
;u~Q
add_DataReceived
L- kL
nL!Q
%!uV
lpInitData
l!6\
Z_5:i
y{~8
GetServices
m` f
g)[-
browser
J%hT
get_Threads
Bc\)IR
&*D83
mer[
Bu%T
?K6V{,
set_StartType
COMMNOTIFY
:-e+
M 3]
XTg,
@0|o6
n \ z+
set_Arguments
ResourceInfo
^ea
Hl4x8
4+bo
!~v
,9e9
Xp0F
pdWFs
remove_FileTransferCompleted
?lF
p]1=\p
W#<y
"S`ia
D+3
Po??
9O6i/
?it<
SHA256Managed
L1FK
tt
:=JL
&2Da
F ]{
set_Position
^!hb
,Hg
get_TcpClient
bbOJ>
t ,y
-/uU
WDW@
*5%-/
SCF_ISSECURE
IMSKIO
N757
_configDir
)Y3"S
<ConnectionInfo>k__BackingField
Mb4R+
Qg@8
DZ\W
Orcus.Shared.Core
C3e)
kiuBd
l kM
wJ_4=K
BeginOutputReadLine
+Vr6
Tfg&
5 ac
GO~H
'.X?
ZBvB
.2B#c
#"m
&+K-
LDni
Al1R-eC
B[7y
06-i
SHGFI_DISPLAYNAME
Z?Te
D{9dc
.ge}a_
vZ2r
[ n)
f\%
z5QN
GeneratedCodeAttribute
`Q]Q
#^ N
zCA6
wD|Z
`L o
Ed8U
Orcus.Commands.Passwords.Applications.CoreFTP
AzPU`+
TPA`
MWr p
_tG>
Y7OZfZE
CTLCOLORLISTBOX
SHGFI_LARGEICON
@ &|1
et_`
vuTJ]=
SrA7[
C>]q
;KW^E
jSa6_o
<dGr_E
trM {
Uj+]
'P!
70cx
%oA!
z'U~V
+i~YT
CheckProcessIsRunning
C\;X
status
uVirtKey
`d:0
GetActiveWindowTitle
set_Heigth
_cqX
&Bq2
!]O| -
M6|j
\ Sj
X 7K*
@O']
A& N
B:[C
get_WindowsFolder
x|G$
JKN*:
G,Ao
ProtocolName
Orcus.Commands.RemoteDesktop
NCMBUTTONDOWN
! x
O9:&
/i *
!g2Z
jU>49qKG
KW9s
set_RegistryValue
kW[c
\~7qK
K#e_
#isrr
aWP ~
s~G*
)Z_4*B
VC'j,
<SendProcesses>k__BackingField
')Zl
libraryName
!|#x}DP
do=Q
7VPzl
U}p[XR
hc1(xt5
S:e@?5 4
IsTaken
]4m\
Zop(
DESKTOP_ENUMERATE
@jj"f
ullAvailPageFile
iO -k
(;
Y9-W
_errorFile
CannonializeURL
WZyA
}osX
F|Rb
:202Pw
Substring
I<-u
DateTimeToFileTime
_YFwe
B jjU
s>c|
}haL
65976E8BC1E21014EFB963E7F0E54D344F1B81A5
n%Wt
Take
9{|`
MDOt
Sb.:
|D+q
= g=< N"
pszPath
l(v
pwR {
E /(
<Version>k__BackingField
tMYu
CompilerErrorCollection
ReadTable
<line>5__1
7myq
lpModuleName
ZZ\
j1!~
."L
-"m#
Culture
@YCu
2Qe~
_;]"
m? [1.
A{h4
:N{d
hStdOutput
m-9b
Qu 9
jT#%
ANTIVM
ShortcutType
5vy}
RegistryValueBinary
m~7o?
algid
TCP_TABLE_OWNER_MODULE_LISTENER
registryKey
Ceiling
;-Ym
jX(8
+-{*
~[o.
)JM:
D!3B
g,g 9
)ioR
5Oi:H
4XG:
Q qC<
_screenWaitEvent
SC_PREVWINDOW
fkXfu
/o [{
Serialize
'2 I
FhCr
moUq
f!g-
nu<~
encType
6^ Nn
user32.dll
ClassesRoot
dwYSize
< 7`
9w
OpenWebsiteCommand
; DQ0iN
->~
ProcessedByFody
1@7!6
,|P?
sDlvE
~}+lQ
V$Q:
S.;&
aNNp
]a_-
IToolBase
xx[%
jgW5:
df&^tcp+U
starksoft.aspen
"|N)
'IRX
'E
GCHandleType
mcxDjq
<&Bk
(v
~$ C\?
TB6J{
}-0D
=JNJ !
<DrawWindow>b__0
>Fy)$ ^
= %YK
LFvv.1
B6Cv^
v~)t
s3"Y
Vt,"
&~Jq
O Y
ayQH
rEC
SystemParametersInfo
WbIo@
:'V4
)P>#
UU>_
Cv}!
=|2]
b._u
tf$UAC
|u u
(B L
y<?F
-( i
5.*O
?p3
ri2
Q-|$t
-O.~/
|b/u
H I-$
,r"P
^Cz-
z`Q|Y
wq|{
UNICHAR
L ST8
AssemblyCompanyAttribute
N{Qt
remove_StringUp
RecoveredPassword
Q#(A
r<@p
qPv6
#+@ E
sg%K
@/:r
SetWindowText
set_TotalPhysicalMemory
0.1.0
iCqE5
HP_HASHVAL
jvvxs
WindowEnumProc
AUTOSTARTMETHOD
hL'b:
_Y\R
W;z#
1O&z
SC_CLOSE
0}_}6
7"Uj
k92W
<GetPasswords>d__0
<GetPasswords>d__1
Z%iH
NOTIFYFORMAT
"3c&
K~4J>8
[pkr@
set_RedirectPackage
HTCLOSE
jo+7y
\8V1
!Sul
=<%D
Wn,!
Zx\s
YuF
B2!K
2[M+(
9<0j9
b`%0 l &
Zx6
'm Q
audioEndpointType
_Vae
SetUnhandledExceptionMode
VoiceGender
WinEventDelegate
Exists
A}cm
; wvB
Q>b-
Headers
FromStream
rb=L
CPL_LAUNCHED
PADPADP
SetCreationTime
h2J88
IG3B
-E-5-
c#*!L
Ul*J%
CREATE
uYKq
l|mt
6v,t
X I
vYLu
resourceNames
g@ =t+
- ~n
=n"3
@xHK_p7
<EntryName>k__BackingField
o%> L
/\\g
~5)Q
0'3C\
mL_`
uBW+HCh
{y[9K.5z
$3ys
WS0|
get_CurrentDomain
#`o7
JZ?d
4 J&
4j:7
Y3om
~A]=
EB1y
p06L#
>*v7S|qVn
YogBn
C?zO
W Ao
M{9
1Oyt
/y7bN
h2"~
M\(|o
@6/r
t`!p;
J<L]Uf
w '{
%#|[
p+ r
)cN(COE
RegistrySubKeysPackage
;@ Q
Win32api
Control
( ^
<GetFormattedKeyValues>d__4
{')c
$!gAbB
rcClient
XSY
<W{Cp
R6N=?C
OnStart
ELK2
bG9Kyt1`
CompositingMode
[!E#]\r8]
es2C
OR$598
X7 Y
!b^*
2kw>
T(\q
WebcamInfo
&O\;
ToUInt32
= f6
I<Ab=
remove_ActiveWindowChanged
~wZs
9 usB4,
.i8qK
pr=9
L,g&
pluginReceiverGuid
> 2|
" 9Ai
Slt*
F pn
LivePerformanceCommand
get_AdministrationId
LObZ
CanTryConnect
Ln*?5
Type
2jH0':)
"f$H
PVD=
F:LoVO
m1x/
#Ix*
LogData
jK/YU"uf
TB?f
cH|D
nFolder
qm^[
CMH<
set_Architecture
bqVK
HIDEFILE
Zrlp
Q O4R5
set_SupportedLanguages
+4ga6
@3}j
M]=y
)`\&
o50K
TCP_TABLE_OWNER_PID_LISTENER
$f9 0
5-bo
_i@\
~bl&
{zW)
!f:
AwQ7
w8}=H
TakeFullScreenshot
Orcus.Plugins.IConnectionInfo.ServerConnection
JUn*
> ??{
I*1~
get_LocalEndpoint
set_VideoModeDescription
ASf$
x=pIO
m)x:
lpSTATURL
-|]j
<>c__DisplayClass1_0
my fv
<Monitor>k__BackingField
&W1/
pV g
KjU8Z
HTBOTTOMRIGHT
kI|Q
Sz)^I
s|D<
eventMax
)?Fs>
\VTg
?M.w"
2>K\
lpqzdClV0
TWca
Qmn\
!gB'
MERGEPAINT
dY}{_
W/K
#f!2
B3L.
b"Xm
JF5N6
X;&
p~5d
?<Sj
*2&=+
T?NoK
1,\W
GY#3
Wy kb
,@+7
o-mo#Km+
&=Wi5m0%Y
lpReserved
0\C
&\d
e,R
Plb }
>gI:l|
sb|B
HTBOTTOMLEFT
~gir
vB}Y
:%w
_currentChatForm
%=GX
K(R
ZMu$
P,[q
h#m#qJn>OM
m|D
U+wy
}28~
DesktopProc
ipVersion
,!nd
Orcus.Shared.StaticCommands.DDoS
tGTm
;'PJ"-
}1Gz".
8=C@
5.d
*R5D
m Jb
MDIMAXIMIZE
get_EthernetAdapters
*1:v
/3+-5
EHzv
$ _1
+eZ%
DESKTOP_CREATEMENU
gdjbjp
7B 6
c 6|HH
Orcus_Service
&GTn
><?U?
+] >
/0Aw
$<l=k
opN7
,$
add_ActiveWindowChanged
XB1L
get_LocalPort
/7 O
BoEV"
OE> <
GetString
TV\e
remove_Connected
WindowsPrincipal
OST"
J +y
Bh^W
MY+*?
nIDDlgItem
{c:~U
AForge.Video
4X>[ /5
?TUt
WH_JOURNALPLAYBACK
?[)h
WaitHandle
*{J
DayOfWeek
a Sh
woO3
}_ #Y
Rp9
Button
gzip
Orku
get_IsHandled
U:$|
YZMg
=iAO
Dv6
~QBOx5:
~DfM
IL]+iY
732u
8_hG
GetModuleHandle
ff'>
Orcus.Shared.Commands.TaskManager
rV9
xlfa&Vc
set_VoiceGender
OZH p}
r~x{QP
- r 2
e=+
set_Plugins
"!_`5/?
O!S
dmPelsWidth
jp$E
vZ4T
YhP*
:ynxh
]&zw
set_CurrentVolume
+4!td
Cuaw
q [/e
lpFileTime1
dmPanningHeight
get_ImageQuality
nt@3
I%jky&
ServerConnection
CreateDirectory
rgelt
FrameSize
StreamWriter
;sN>S*8
|f}m*WV
\9t:
pr{:
}ZKJ
SHGFI_SHELLICONSIZE
L4ZRaE
E)i~uA
ji1k
K'g/
DJD\D`D
_BH
_md5Hash
set_Passwordcheck
dIx;
SWEU
QoDJ
w6N^
8jLZ
OLPFZ
FileTransferTempDirectory
e+:ND
+0k*
XwxL
r#;
WaitForExit
'SrFY
b`C
^n
ToAscii
get_X
b:}g
Pi"T 7
>9x$z
>xP_I
H3| v
@VfAa -'5
&5#2j
$3C374A42-BAE4-11CF-BF7D-00AA006946EE
[AtFy
%~B}+
}K>?
HTRIGHT
?H.Gkk
set_ReadOnly
Zqu6
poctNotify
`.rsrc
2qg\
;M\S
Jl e
InternetCommand
'nvB
uy@'
synData
{Ngv
dmI'
set_LocalAddress
}}`S
]:o?R
DWe]
Milliseconds
uOW6
set_UsedMemory
\Y
'*>"
,MN/
K0}9
q4=/D=
OpenRegistry
4L=i:F?
e~ ~
AudioDevice
Pyfh
[9 Ib48)7
!cYy{
System.ServiceModel.Description
o!r$|
@bQ(
,/D>vEK
DeleteValue
EventLogCommand
\#OMi
Bbrh
GETTITLEBARINFOEX
\\Di
[ YLA
/JuG'z
iD$p
d)>U
_keyLog
[ k!=
Mm &fw
HTGROWBOX
~h;6T
f^{s|K
m'S,J
ZV`n
?K$k}
COMMAND
uB<_=f
add_ThreadException
I jLRh
mPVv6
AddToAutostart
6]rI
Aggregate
@7!o
registryValue
8AS~x
E ?
:Hk!
Orcus.Commands.Passwords.Applications.Thunderbird
.k^Y~
;9%A
["@>m
memoryStream
{^<(
4]_l
3Iuu
WcUN
0?u.
' HX
K@o
cxWindowBorders
Vs Gi
w[0S
|i _F
fkir
p[Kk
x_(0
k IjJ<
guid
0lKOus
| iX
_screenFactory
E! l
, ):x
2JXFG
ZWff
t@(Y
qZ3P
Gj6ct
XC)$0;
WebRequest
encryptedData
l|(g]G
;r\A
ImageAttributes
}y/
Mj=%:
m5H?j
9b_@8r
iBc^
<>9__0_1
E/lJ
AesEncryptorMain
z[;b
9\KE
}_"(
RRCZ
vL"q
<IsEmpty>k__BackingField
^Yj::+s
5tt8
O\*:
LBUTTONUP
b\n\
m "X
D\Ip
HSCROLLCLIPBOARD
P^y
SRCERASE
{"q^2
set_Processes
[1Oa
EnumAudioEndpoints
X>tMX
Hook
5q^4/
*tj2\
y_w5/
tYXy
-,,h%T
cXm=.
-(ZA
6t*yG
fYNWo
kernel32
HSHELL_ACTIVATESHELLWINDOW
Orcus.Commands.LivePerformance
G ;j
P//\
idChild
6zS.)
ExecAction
J5R)
L5+v*
<DataMode>k__BackingField
^_91
WM_COMMAND
ObsoleteAttribute
Bk z
set_MasterVolumeLevelScalar
Orcus.Commands.Passwords.Utilities
r+TJ
Dg K
.E$
XmlObjectSerializer
set_SystemPageSize
get_BigEndianUnicode
)( {
GetRootOwner
EkmT;J
plii
#c] \w
fbc<
procedureName
+1.w75
MOUSEEVENTF_WHEEL
9%<'
K|~w
`gJN5
'@ y
ToLocalTime
J$?g
c$A woG
Tz<
~=E"
DoMouseScroll
rLDboL
HT,o~
SetTaskManager
P;T{
WoW6432
set_State
a!fc!2}
ENDSESSION
lpsa
GetKey
get_Now
t}XZ
WindowElement
(_EyL
client
p"FA
D=Rct$
kl=0
SequenceEqual
ExyzO
]' w
Gze=
e.2R
KoUx
onR}
set_NetworkInformation
t)at
R!]!~!
>pFB
Z Ws
P%m v
33_u
P@E(
ChangeDisplaySettings
G0cu
BKLS
?e:Gr
fo~#V
Zc_h9
G/^v
-Es=
.5+7
WDD'{
!,``4L
~&m(
tP>x
\nq<
udC
+
@3w-[1HV
<GetPasswords>b__1_5
zrd,
ck#t
=z&;
Rfc2898DeriveBytes
udGS
Reset
kq!V
ACTIVATEAPP
\U}5s*
tfYh
GetStaticPerformanceData
TmJ
=\;$z8q?
`I8`'
&]&f&
FPEZ
shlwapi_URL
GW_HWNDPREV
1 SK
/ (Z
Instance
IconSize
set_MaxBufferPoolSize
c7%1.~
BK5
<IsAdministrator>k__BackingField
L]R[C~}
#mH`
-3sP
%qcD{
RegistrySubKeyAction
hwnd
1w0h
FileVersionInfo
q-|<1
TCH!@
nYDest
MOUSEACTIVATE
{D F
B2:7
f+hf
%aHl
S kt3
czxV
{dyd5
YW}^qO
:u*#
System.Collections.IComparer.Compare
;b.Y
*anXB
FilterInfoCollection
S$NR
Rn>G
Ep 8kM
TxpZ
m!z[
set_WindowStyle
aA@[
B0rmc
oJC4
^!q7
_fileLock
nullCache
^OGT
!m$
A4SP&
M T:
yW]}
Z Y*d
GetKeyFromContainer
MENUGETOBJECT
f6kYI
NM:
@N
E&Q.y
pDjV
Q TjiY
Ik+g
lpChar
(p0/8H
GetClassName
yzBK
64O>
#Strings
+ j"M
k:_m
tGlSM
QUERYENDSESSION
<;&H/
N =]l
"g`G
<GetPasswords>b__1_3
Q"]<J
QbZL$L2h
GetWindowText
vV5N
SMTO_BLOCK
[ S5H3o
; /'
r U-
R?^gz$[
4!Si5
JB%Q?
H I:IAIZI
*OAtFy
l[ ,
J T}
P?
gy*q^
>=yZJz
FreeLibrary
Registry86
right
`cc/
jH{PC
"aWBQ
i,e}
B _H
ewKV
Y!q,
Cyj
2h}p
PK11_Authenticate
yfFD
2-9
30(2
Matches
B n0
=3=ZH>y
M2y;
1![
set_Data
nOW 5
EnumWindows
$vl_
93 6
<CommandResult>k__BackingField
_renderWindows
iThTt8!
bO#\=
6 yJ]D--
Y>?#
QeF
w`.j
set_Mutex
' dB
set_RunLevel
VA*y
-Yu-+
uP>D
{x
! Fl
%- &s1
6 z
KSq>
GetEnvironmentVariable
{Dtn
;_ YY
^M!E
System.Security.Cryptography.X509Certificates
`uDZ
d*oC
PU34T
pG0km
yBm3
%- &s!
]5]B
.),1
%- &s+
$XY
ok$G
hrC M}
icon
o.z:K
&z 1
b|W
g/0)
ov &
dR7.
RNu\
Qe;~
t4gJ
}}]'a7q
q&db
<wx
b!bK
c]x5
0MEf@2
System.Net.Security
f ve
}} ]
_serviceConnection
fP0a
KillCommand
KCc"
&FTv
threadId
+;d5
RegionInfo
62zuHr| rO
{0RN
hwndOwner
iLd{
yti mEAX26
s^ .Mz
<KeyLogFile>k__BackingField
/e6-
jGt/
get_ASCII
Orcus.Utilities
Windows
Mg}:
J>CWu
j5g]
NCRBUTTONUP
'kOp
dwNumberOfProcessors
taskBarWnd
KuK7
set_OSType
Lt}z
]3QN@]
sProcessName
F+@X
NOTSRCCOPY
<O!W
}ecGm
x*k&
}bpO
9$g=
xaI[
bottom
_pSize
]0||~I
LmL
$s -(yT&
+U\Sn
<GetOperatingSystemInformation>b__6
HSHELL_WINDOWACTIVATED
<GetOperatingSystemInformation>b__0
<GetOperatingSystemInformation>b__3
NRMB
\03!
Hn&1*{y
}x|UGf
t\UdrR
SY)UP
KeyDecoder
3MkC
<FWD
YRl}yqz1i
?:Aot
AssemblyProductAttribute
dmDeviceName
SetOutputToDefaultAudioDevice
<FWJ
vO/X+
.>rA
`(3T
}/lz
^yiI(L
-+0A#KI
T,%b
MVcL
TxHR
screenNumber
hri|
UriSchemeHttp
#Vu+VSb
'Yz~["
NS3<
HSHELL_LANGUAGE
FW^Q
S;i!)
yTdf
}sOf
H9 :/
fe5z
y$bF
VLW/?
NewCommandType
ServiceHost
%rM>
TQW
tg(s
PhysicalAddress
Orcus.StaticCommands.DDoS
Z?T=-C5
e}jS
I_{\X
get_URL
2?y
F`z
R[%m
Orcus.Commands.Passwords.Applications.InternetExplorer
:g)E
dwExtraInfo
HN"~
@_jgT}/
)&\ x
&Bn*+
R?+<
Ne/
!>'s
~&KBp
)&\ ~
;vW:[
<>9__11_0
x]a"Jn
NcxH
z}GN
6|\k
_index
3P\$
BitConverter
DO>[
>bBZJ/
_VQh
HTTRANSPARENT
[w`L
N.B: b
CSCore.SoundOut
qyxT
%- &(
JNWw
&Xl:
k]MD
PK11SDR_Decrypt
<AddToAutostart>b__1
G@<+M
)v,NQ
#NM6
Height
p$Cc
get_Second
Q'X
ProcessThreadCollection
aLVS
v-J+^H
m]~s
lX&z
?szY
NZ'O
gUkT
fv\ :
EVjtu
asyncResult
#|CG
<GetAudioDevices>d__4
IME_REQUEST
H]t)6
Uiq:1;
r-;
87jp|
8O? t
fNWS8
!yv!
V.4Z
STYLECHANGING
\Js/
~@(M
JEP
Delegate
!iwi
DISP_CHANGE_BADMODE
9wI|]
R3g&
get_IsClosed
%- &s
fb(
*;`Y
15Ya
/v.e
^ |
6uFO~
windowHandle
KG Y
MZ6X/A
get_Timestamp
|':_VK
.O"1
[8uNW+?h
_j5+y
uaJj
v"Fa
6H*mL
k!{ {!7@n
DESKTOP_READOBJECTS
pbx0
TP\uW
l"~c
0shA
f0/t
_masterTableEntries
ImageLock
c jl
eUp3
!K7D.
)Tw9V
/4C%
cX=U
Orcus.Commands.Passwords.Applications.Pidgin
;2\$
qV]R
<CurrentImage>k__BackingField
R"f
get_Bmp
%oF3
So|9S9
`3`'
x^5"<t
BWc[
Q2o,
l'PA
Y)`h2O9
8i X
IsClosed
8WIQ
m-z5T
SIZE
hH?4
GetTypes
Z[=B
E'&%:
VideoCapabilities
icn3
T~&"
"KW|]
^&8h
Orcus.Commands.Passwords.Applications.WinSCP
MDINEXT
:`N%
GY]k
}6GmtQ
.E{U
GMs|tuL%
dio[c
*! PeN_
set_RemotePort
h*=?
vU*Mx
3/c~Qcr*,
b7V},
aF+
QUIT
*NmrN3,
CreateValue
_wn
Yl%ny
V*3M
p%Q
j]_J
XvZ6:
BESn"4
U.$4
5<7h
2i7kb
U'Vtj]
s sd8
sYA9
yx{B
X LJ
j,Uj
riid
\zKN
K^\m
Contains
y9 v
efNk
set_Language
^3El
{2SY
A`7p
get_Channels
) ID7
mmcJ
YZ.H
?>RI
VideoCardInfo
HkKw
p6`Q
B8e=
M<e?*
Z-_BFR
:2<|n
ValueType
SS?l
!j7-
System.CodeDom.Compiler
7+z,~
nh_]
V~:[
exceptions
# _Uy
OAx
|,n)
]l w3
GetTickCount64
Jd #
Q&6>
zQ$i 9zA!q
|!?R
)J F
ggJ!
set_Size
% @sIM
:Y K
sVS)
&::{
fo0>
L$68
/z[Z
_+Q(z}p
\vgo
Y2AS
SR|_
nx%3
2<@O
FT?R)
RegistryKeyHelper
Z3=
bInheritHandles
?@l8G
CxU-
62'{
xnSN]
@3R%
|F=G
u[}S
localAddr
xhJ\
J!N qR
GetValueKind
\I &;
#PZmn
]h/
jR&6
get_ClientPath
Rm NO&
[!O@
5 Cc
FF=]
@9r{
Ry!~
xKkUcM
*jpA
?$~')pE
~R}RET
z~-6
W}xzOVHAd
;L$rGhw<Eb
devMode
wsIuU
0Opq
N"L
WindowFromPoint
window
LN'\3
<ServicePipe>k__BackingField
s]?eK
.Ro"{
MA_ACTIVATEANDEAT
-Kh/:)
ReleaseDC
2%b^
o8S!
L5/f
!n#N
set_ActiveControl
get_Version
[#<5S
h)@?
'ZV4:
SETFONT
ToString
H "M
9BYF
e}H
qu;*M
SetCursorPos
oW5*
PROV_RSA_FULL
4oOb
7taT
YkP|
\ g
get_Principal
#c%
Parse
<>9__5_7
Z@ d@-
` `W
bScan
set_RedirectStandardInput
/" (
uz0{
set_SmoothingMode
_client_Disconnected
add_Disconnected
ZgQ\b
WM_SYSCOMMAND
oR>A{
ReadOnlyCollection`1
3Q?9
&VkF
ResultSender_SendResult
SendBytes
lQ6r
@,b8=~
AudioChannel
ZTy[d9L>
fMa
jH]!6}
tblClass
GetLastWin32Error
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
D,y7W
DebuggerHiddenAttribute
4{.X^&SZ
O~d~
ActionCollection
)$*!Q IJH
p] 7
& ?
/da=
=\Za
MDICASCADE
<IsChar>k__BackingField
get_RegistryValue
Kt|L
;5'=s
>TBv
_udpSockets
<>9__6_0
args
p0t8|[
n 0
,X|Xu
[{"A
StaticPerformance
]<65
Ptt9
h?'v
i!c_
t)[QO
MF&
M4W;5
'csr
*A0Ih
ZT/u
aW Oa
<GetHardwareInformation>b__8
Xq7+>[@
KE:4
0a?s
y$<;j
k=^|I:;
_|)#5S=
*G8N[
<GetHardwareInformation>b__4
EntryType
<GetHardwareInformation>b__6
<GetHardwareInformation>b__7
<MasterPassword>k__BackingField
6>4'
0v0F
* h HQ
set_Lenght
8\Ldr
/ @7
`7xfC
AK}/g}
7<C%2Z7
!0 R3
yHs_
Combine
HCU_
!p$
#gK>
message
PasswordData
gR]
!0 R?
<UdpSockets>k__BackingField
Iv8Y
{87\:q
5HWQ
u(Co6
n_:}b
\mEg
F% Y
,^=q
jcp2~
HSHELL_TASKMAN
Q.diJ%
sFc_2c
ENY9
=~.
"Doi
; -d
gz\l
Response
[x1%
RegistryKey
4xgc
`f|d.
DontUseHash
~d~"
get_MasterPassword
!l P9^B
<),&
OoW!
GiEof
Skip
AvailablePlugins
y[;^
^.]Y
@\AkMu
tcpClient
G {r
_readByteDelegate
u4lEk
IM-
5KzdM
; -.
.ctor
4o9^b4A
IsOpen
8BsT
GetTotalMemory
V;LK
+u z
>Su>S
L1]\
rY1o
uzrl5
get_Message
r,<E[=s
+ayN
p'>vx
eyVEB
VncMessage
Jiu i
$g0$
Y)F#X
:P76
c.\
5E}
dwSecretSize
Main
WCF_MOUSE_CLIENT_TO_SCREEN
A4C"U
get_Rectangle
pr?k
=!"A
get_Text
HttpFloodCommand
GETICON
Ad_S
Fa./0
iRll
EtsCdh
SendOrPostCallback
FromDevice
' "s
0ZaO
9@Mi
L4,i
S*9@$
U?R3
File
dwOemId
{QtB\2K
set_PixelOffsetMode
otP.pFU
bf866ae9f6744a068b1dd16105528263
S'z7
E-Bl=wS
2q;;
FP >
FO{;f
MDIACTIVATE
)*1HN
System.Net.NetworkInformation
AddUrl
9nR~
W^du
lpSystemTime
#&gk
LZgXu*S
#&gi
V|-5
<>9__40_0
\Y_k:
`}zt9
J!'1
v}Am
Ep/2
jy#'
X&SI
AqOdk3
U&smC
Nb q
lF~co
get_IsEmpty
9[Dv
_clientsLock
:=.P
' mS
Mm7B}
Role
+/v
3.7%
HyK5z
KGu%KS
wt 7
J W]Q[
4bv=
y7gX
V EK
U|H#
W[*Qw
i<`[c
set_VoiceAge
NetworkInterfaceType
t}#|B
WriteAllText
zX?+
nCode
5w\C
2w1N
Rvk8
vl:
get_PriorityClass
awx
|X2\=
P9M
R:Kb
C"pdHg!
IServerConnection
't8AW
mZ O
lD i
.w1E
S,n#
!6_1
<41}yG
7|y
yi.`
/+'&
NM8=
:"eg
1^paL
S:s)
E=Y@
q[-q
#B1#7
7|Q
Zy ~O#
CAm(
Uq'=?
hetNN
{Hn}
KCfgG
) Sr
^]Tz
:D&M
*.z1J
rUR~
FT(.
d g
get_ValueObject
@Bpl
^{ z4L2r
p3LLb
Zs<j
tzEs
N}8`
eO.8g
]O/39
gQ:?k
clientCursorPos
oIP'
But^
Bpb[
l %
HgS,
?o]
W]bS
on3!
RB>%
Z-.h]
&,Sl
Se&st
WL w
VX;
i_L\
WS_POPUP
inLen
K2Oe
Target
~1fW
4?L#
LE-g
iOH,
uC}
6@Yw
GjO7
, r
CALG_MD5
$7^6
Dek +
;71{|
set_TabIndex
O:$z
?C ml
7L} k
{:]Q
SpeechSynthesizer
DISPLAYCHANGE
8wN,
;/8
AppendFormat
SC_ICON
|4 s
get_IsSearching
b=yK
SetDesktopVisibility
bQXy
<,Ls
<nCx$
NetworkStream
cm{
?v^{
lpszDevice
e< {
uMapType
P:k\
FileStream
ooD"*}
`~Wt
+HAE
m, jK
msvcrt.dll
!Mhv
%P@B
xg@[
_keyboardHook
:q/H
l:|
H/i@
gl4WY
D"Gw
jQW,
RerT
pUrt
RemovePrivateFiles
gCz!
nC+
lpszOutput
m&!6
globalSalt
LoginData
O<./Z
<>9__29_0
m/sKF
,F(q
ObjectDisposedException
wP?XM
iiRj
R75`
Socks4ProxyClient
g^IT
ExceptionsAvailable
yzX
{(fin]
>|.<
yD;k
c0<n
Td \
:W V
I*I#
H4oii{
Y8 V
9*kg
2/ x
']_/
ReadToEnd
=6k \
~>h
b:y'
4O%5
NCMBUTTONDBLCLK
p-px
W:-^
!Z6x
8I8;
3?B;
:c+P
*0(*
D
b _?^N
Orcus.Commands.Passwords.Applications.Thunderbird.Cryptography
oP i
3*N:
2\E#o
F YJ
P9ge
DoNotCopyBits
CO44
^c>{ok
A7f|
kRuf
x]O<
NewGuid
.Me_
PE9:
39TU
#Zn<K?4
p*r{G
;09z m*
R`-t
p`+l
HMACSHA1
WindowsServiceInstaller
mo&y
Hnk7
<>9__22_0
6z[;!@V<
hMod
=I<$
LoadablePlugin
B'>.+2
:v !
`;<t
.szDT
DoNotReposition
NoyB*
CreateDesktop
q:~I
<PluginsDirectory>k__BackingField
r/L
1'EE
%RY G
J3+NM%1
>sf7K
F7&R
kZeI
H iCc
qD >
!}[#
@KkwD$
#l l
<>9__22_2
Orcus.Commands.RegistryExplorer
n8=pz
_keyLog_Saved
Dv 4
}-~z
6n"%U
HTCLIENT
Eu^o
"Lf
&\wQ
3P}w
Ct3n!
Orcus.Shared.Encryption
F@DS
WS_DISABLED
"\T`
;w$
;/%u
set_ClockSpeed
ComputerAction
_urlHistory
x6AF
4@\I
up@5
ReverseProxyClient
WwH?2
>IS@
HvncActions
speed
h,rp
.5RF
lpString
R\g,
dmFormName
GetPathRoot
'K9
C7h*8
_ R_
[E}
6 }d
appPath
eSD
QT7t
vFz~
Orcus.Service.Properties.Resources.resources
\U.LX
.(+e(
t+ts
WS_CLIPCHILDREN
get_AppContext
F/qQ =^
DWMCOMPOSITIONCHANGED
L1x\
e7u}
timesUsed
>$/K
X*2)
C>u`
A\+)r
set_ExpiresUtc
5z2w
^G9W
&'`c0
!^KPpm1
entrySalt
ExtensionAttribute
]QeA
@G=]
o1v
Show
g|i 9
*u1+?
7 x_
M65Ka
]T-X
get_CultureInfo
CCz.4
n/?07&7
G6"
AesDecryptorMain
P5'}
dt.u
t6dNO
b(#H
get_IsOpen
x["X
7&g\
v":y
.|7-
j-E
ArgumentException
so_DF
System.Runtime.InteropServices.ComTypes
=#a'
^bGi
responseType
4oA.
Vd5
A\z*
d1cr
xYS)
sysListView32
pszUrl
<CQj
CTLCOLORSTATIC
9NO
tix
<>3__mmDeviceCollection
t580
IgnoreResize
)@[}
YE\.
?s%R1
|b1W
!?@
r0(
S+1Z%
$P h
`I]mJ
h!Fp
<>9__1
<>9__0
g2V2V1v0
<>9__2
9FlW}.f
session
^F^8
get_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
dmBitsPerPel
#Dz[
RemoveFirst
mq}s
rw1
Cjqg%
<}
[?A
set_VideoArchitecture
<ProcessCommand>b__7_0
[Qhx>
sNo6
@`34`-
asaH
CeUv
FLsj3
;;k]
.'-=
4=*W
add_UnhandledException
J>gUJ
P17Ta}
H6OZ
l&^rY
7{4M
Yl_p
L 'T
GetNetworkInformation
P2,"
z;p0
DoT(
yS=$
M*=*
/n"D
&P/;
F;#)
zTm<
JL+;
defaultValue
LoadKeyboardLayout
HttpWebResponse
'~YB
;#k<
8LuA+
rdQ9rU
&ne,
_kY%
"dHX
get_HandleCount
%l.6D@
C?+e
^uZe^
get_LogData
PlayAudioInformation
UNUh
X509Chain
j;l<+0
lhX _
NvJ=
set_NtVersion
<RegistrySubKeys>k__BackingField
9&bS
O2j%\
Ux&O
'B']
Ktzk
v,3j[-BL
0vh`+
U5~A
RBUTTONDOWN
w5*!
~gv
T{#)J
DownloadString
])Fr
]GL):
e1[u
RZI0
e%UMj8
#M5u
PJ0>: ]
" aE.
!}u
*`)]0
xu7g
BJ O
H}5B
1=8{K
<-;H
* ?
3pY"
fITBNx0Fiv
BSJB
8F 2O
e;w~
CSCore
)JM*
j@GS
set_BytesReceive
3 ~#
7;0Wa=-5W
Computer
hs)
B{L\
_deviceList
Second
I";D
g} 3
LfVF
IpAddressInfo
QFr6
FO8~
.XRk
]oqR4
GetHardwareId
_-6
60VQ
'9E&
value__
+!?o
D34_(
[ ,'&
6%kw
j wY
5~ 0
~Ivk
/0h
c7I"G|
FaNIq+
)QMN
5Kiu
q O]P0
4eZL
z$v0a3
ToolBase
)=E<O
Fsi!
THEMECHANGED
,\Ay
/=sG
6:!e4
:o29
<: 2(a
r' :
\xpl
$ZO{
QQ3+S
Qo_h
SocketType
n:=wR
hzp,
l[qM
{Qk5
M]7^
<subKey>5__1
;&f
ResumeLayout
>lY@
^~@
CancelEventArgs
E]4o!
gp x
IME_NOTIFY
]NtTZ
chain
"6[c
AsyncCallback
ComputeHash
$:VV
sIF{~
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
lr^E
|F\l
eZMOjwH=
yObD7
get_Year
Nt1,x
set_ProcessorType
Xu6q
+eA'uwJ
!<EM
_stringCollection
H2Z'd %GF
A4Qy
[G<4
Refresh
?H'Kc
Orcus.Shared.Commands.LiveKeylogger
w'0r
X h
DEVMODE
KJYU
3k/5
set_CompositingMode
[`G
JF~F
94C<
[0 %wP
1!DT
l `E
Y;u@
yk8z_
QBN<
c0G
`zp
Ql*U
<>2__current
PROXYOPTION
JM;Hcd
add_Stopped
.[{V}yM
& El
)=z=
&i3t
$= [O\
FILE_ATTRIBUTRE_NORMAL
JTL~
get_Oid
<SynSockets>k__BackingField
pwcsUrl
,8cP
L/"^
TJZx
get_HideEveythingElse
set_L1Cache
uxy
uh?U
MC?
L
g_e=
set_UpTimeSeconds
LogonTrigger
*h@)
>v 8"v
qa(
get_OverwriteTryConnect
FmPs
()1.O
costura.starksoft.aspen.dll.zip
p*r=H
!|PYv
x'5t
'#c'2
ctO1
UuZI
V)?9-.
<a5@uN
PRu;
ib?P
2J2Z2
3mf;
% }/
#f>3
profilePath
VoiceInfo
qz}J
SH;O=
Orcus.Commands.Audio
0P-c
RijndaelManaged
"9 9%^W
L?,Y
gODW
|N*G
7Orcus.Shared.Commands.Registry.RegistryValueMultiString
set_Monitor
:b{h
Form1_Closing
YN/
fL*##=
EnumChildWindows
c1W.
Py79
.&qd
(A
<Ib:
(E
~pXS
get_ResourceName
w"}t
RegistryView
kK|i
me!]
IList`1
-'Ad
0| {
1-)a
p-dY1
cButtons
d'Z,
N[;8
ConvertToState
GmQ2b#
8va0v
oecq
(d
5 .z
Ea3+,.
_OHL
\zwB
6}D<
i&jG
kpKc2
|E",A
StreamReader
B$~L$~
`J f;
YP
k}l=_
IntPtr
WIH
MDIRESTORE
=QpUspys
chR8
d.wE
}5HCAo
O<!'
get_Elapsed
X?- n-
})#v
wRW
`4YtH
b9fP
7z{
C ~
skOi
Y)g`
'g n
_disconnectIsSend
BinaryWriter
(/
)LRN
R(^9
&zuq
ofo;
<Id>k__BackingField
GetInterface
^r(,Eb#h~
&}Cs
q3{k
- r
\$]"
L+qv
d<: O
cHok`
remove_KeyUp
b~7$E
@=lX
ec@&
wProcessorLevel
*!W
-P(R
GetMsvpPath
<Connection>k__BackingField
l wW'
nEPk
HSK.$Z
utnt
{\H
Orcus.CommandManagement
AddServiceEndpoint
Oa`$
*|f9|
!7 i
plrf
Rp4M
15];
\m+w
wndHandle
JrYW3
get_ActionType
}-'F
(mN
DataReceived
UnlockBits
?]yh/
set_IsLoaded
'eNL!
$CC]
p}4W
[.Pt
NI}6
?SyL
0#o]k
*[3L
.o,t
)yxq
HjeA
UDP_TABLE_OWNER_MODULE
ManagementObject
3yO
x#)u
mscoree.dll
D J`,=
FilePushRequest
DesktopHandle
Vh{=.:<[c
5Kbl
k up
<LoadPlugin>b__23_0
set_ProductId
'b{ 7
Func`1
ED4{
^Ha4R
Orcus.Shared.Communication
set_InstallationFolder
NOoN
;{ 5
pS ?)
02cfqu
U#]}+
<GetHardwareInformation>b__3
":*c)7
J"b.m'
;uY
n[ [
r1ta
k8=B$Pa_
K|xN
<Handle>k__BackingField
1Lme
#')-F5U
N q9
FromArgb
=I2+
A$3l
LK+jEv(*E
r)C
TextInfo
A#xNU
BP5,;FT
F36r
1\Lm
h+Q':
/lUW
E,Jc
\abd
:Uow[
di<}4
VzMu
5mO/
<>c__DisplayClass47_0
set_Handle
Cw}5
\f<_
get_Key
,d'T.
y%</
yaWb>h(
e!Fl
O=eV
#GUID
*l5h\K
+q1qFd
Peuj.
}U$z
UN89
]vv0g
A 9 t
PYD:%Z Yz
PALETTECHANGED
yvMI
set_Ipv4Address
Stopwatch
_x[_
@9`-
H%%>
LHy=
q+Mo
* x2
$n07
add_DoubleClick
wNjf"T
=aC_
f!! W
8z$n
get_Scan0
!{M M
WxeG4
sZr\=
q)(2
e<lN3
,FR.
MIN_ALL_UNDO
$K O<
':#K
@$P\
sqlite_master_entry
gN=P
7pY I
!KE
tkZ FQ
H v[}
?F<c
nG n
GetManifestResourceStream
GetIconInfo
Hour
X:F=
*B6H
5~./
mx Y
=w:i]
i5X@
k G
w[*"
A:M3_
@9`~
)$1^
Delete
FG}b
xpNw
zhiXbo
43=Wv
6`Lq
R(~
,zFZ
R}RzG
w&hbr=
B$0
gsyv
UZf+
^c(:
vw:r
_tableEntries
[le lB
TcpClient
L(9:G
QBQF
%T{V
=? E]
,,DiZ
+mo
#>7E
t,=iJ
%s
}P 4
w8]zXdd/
?n#!
@q_%_
?sl"O
iqXM
E=E0C
#idv
8>8ip
%s'
%s$
O3 !
%s*
:^{+
JFS>
RecoverCookies
9G]l=
CTLCOLORMSGBOX
%s3
[P|K
wuI+
%s4
COPYDATA
%s;
changeCreationTime
+]IQe^
PFu~
%sC
O.*GL
J}Z q
m h:p+
IDictionary`2
S N)
ES=r
%sM
SetResolution
%sP
%f-r
}n=|
%s[
Label
TextChatCommand
-*s:W
ASq&
SMTO_NOTIMEOUTIFNOTHUNG
JpgCompression
%sg
hDDP,
N ^
poszFilter
]"ouV@
PORzf!
=5$CH
{Wr?P
WebResponse
WindowUpdate
set_Length
}IA&6
%su
E'@T
SEL(T
rEbn
set_EntryType
!030
table_entry
set_ServerPackageType
Ez:*
q;kWmg3
Re v
NMSEM;
M";P
*^p=
get_Bytes
)I \
Current
<+CI-
Window
W@)"
JVS3
pDg
*]Qu
6v>x%
get_Ipv6Address
M~BpX
BEA=
Users
ywft
7SAj=
:kL%
0$h)^,
InitializeFileTransfer
CreateProcess
cOK40+3
set_Title
X(1
wcv^
ltuR
dwFileAttributes
sEIVk?
OCz&
:!2u'"L
Vy1L
_lkcS
add_Saved
}S'+
mAn
T#?z oc
yP+2$
R5HQ
HEOO89*
_keyboardDelegate
8M}@=
(f{h
7\n>K
H&/I*
drNvx
g3Ya
UdpFloodCommand
9i-$xe
get_Properties
O6|o
@Ow'
;9}V
1AgE
UdAo,
%q)*i
!Yo0
GetDlgItem
aD4
GDvtDd
MOUSEEVENTF_LEFTUP
Ij8=&I{
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.get_Current
WS_MINIMIZEBOX
o`8~
packetSize
0}Y%q
Orcus.Shared.Commands.Internet
<ProcessCommand>b__3
Lzf
s,#g
i(wu
JJ\8
UPDATEUISTATE
9mZC
=+nnnl
<~E.H
set_Screens
ToUnixTime
b 3
US19%i
,wBX
B:(n)>k
k-2
!@*`O
R(3
4l__
, (
ToUInt16
Mx.#
h%~J
kQ(M
PAs&
'?id
{P{j%
hwinsta
\k$$zjf
E$R7
pgAY s
^CXt-
WriteFile
:)3)@
KAcww4
get_HasExited
!oAv[n
8-M[
get_EndOfStream
E2M
m<F>
, r
System.Configuration
*rkM
3]<0
SHELLDLL_DefView
get_CurrentImage
MMNnN
$?R
-:ih
\r[N3
g\85
2ugI%=
"!.l""
<>c__DisplayClass2_0
ApplicationSettingsBase
z*A<
~"Wu
<IsHandled>k__BackingField
SwapMouseButton
KeyStr
channelIndex
22b&
!6p& *
Tz|C
add_Click
[NqwS
-GWS
passwordField
-m+bG
WS_MINIMIZE
l3R8
nWidth
@RhIJBH
MIB_TCPROW_OWNER_PID
!eF#
)_*|Cc
*R*g*
Ym1}`n$
*{ :
x8g3
ReplaceCarriageReturnsAndLineFeedsFromFieldValues
M:RTc
PY ^%x
d<2>
+i6P
pdwDataLen
\6B)
;&Q
HvncCommand
GetFiles
Message
7{H4F
@'2'
s@8L
UNINITMENUPOPUP
igKA
8EKfdy
wD#
p:t |6
V]Sp
ThreadStart
:L1`
e*kJ
P!l0E%
jW 3
tjOi
EnumThreadWindows
v=a\
`!3I`
Y#;i
<Oid>k__BackingField
n'\&
jkLh
DLwW
Zspf
9we/
SECItemData
,4Z%
set_UseShellExecute
NOTIFY
Orcus.Commands.Passwords.Applications.Windows
hW0;
'oWvaA
<Threads>k__BackingField
JkVZai
&9(O
r/Iz
EXITMENULOOP
[+=)
D/J;
W[Lp>f
2-njx'N
TryPushKeyLog
fy-<
P?6
get_IcmpSockets
SystemIconToMessageBoxIcon
$%t*
a"a^I
@7an
get_White
9>NK
3/!
,+P?
VS"n&]
U|2F
}g&3
5c~S
ijX}
A;9N
<BinaryReader>k__BackingField
Orcus.Commands.Passwords.Applications.InternetExplorer.Native
TurnOff
wJO `
x<8
kms]k
r6Z-
TB0vu
[^R
|HAV
Z.RJzw"s8P
addQuotes
}b+T ~u
Append
Lv +
SC_ZOOM
V,P^
W EF
7nV8
*FLs
'jb%
g :H
snX):
.qB|
wx4V
EK(M
InstallerCollection
$a&o
9c`
5<WNvf"
get_Salt
_desktopLock
agbgg
HSHELL_GETMINRECT
Z4Ww`!"c
|dq}
n @{H
&o2
N[i+
{ *Z
INSTALLATIONFOLDER
3@ V
,\`4
!o(gE
MF,B]|
lpProcessAttributes
<} x
'bG
PropertyData
z";I
IUrlHistoryStg2
PlatformNotSupportedException
*fs
]0kD
xMSl
u)u=w
set_L3CacheSize
B._C
;oRvo
TriggerCollection
[};h^
StartNew
ZiTV
Y)e&
DownloadFile
T%Z=mS:
#e$ ;n
Session
k O+Sk@
Connections
@n$:S4
Cw;;
lpszPath
)Rmx
!#*E
$>">)>/
_synClass
set_Cores
cy==Z
user
XGlP
*Ot7Y
T@K@i
ThST
<>9__4_1
W %C
\. +&
ProcessExtensions
set_StartPosition
:i +
NULL
<GetLogicalDrives>b__3_0
iIcon
cbReserved2
:ela:
xX+<z
q z`
$ [JISha
e"3M
<_client_Connected>b__6_0
BF<I
IsRunningInVm
VKEYTOITEM
:5nl
ReadInt32
_videoCaptureDevice
RegistryValue
I <e
^aOu
/M"s
f@ }o/
mq9M
gV q
=Jyk=E$
_lastWindow
P'eF
g[~{
f<qFx?;
processorManagementObject
5y|=(
0&: G&
:2f!
zRoN~X
( }fkKN
ggbx4
';=?
b< 4
eucSs
Z P
/3z``
Pr&"
aFocF'1
+ (/
SendPermissionDenied
M]Ma
get_IsChar
,X l
Hl}2
.en*Z
<C#A
tl)5
IsWorking
p?qMSL
get_TotalSize
K$N#
P3q
]eG
V[ p_V
i)]b
I@Eo;g
\u;`
ax,Xi
J6-P&
HQgX
HTLEFT
Mc<'
q"Sqb
WindowStyles
;[_
ZGS+
d\N'K
mS>T>d
XX+.
]qii
ho<R
5ERs$u
vn=}\=
Ybbj"
.y&o
<>c__DisplayClass37_0
ATc~
PZAvo
e(x
NCMOUSEHOVER
ziI_v
iDKcE
vq"A
8y <
+cY*Pn
SC_MAXIMIZE
[v2J
=?kA
RunInstallerAttribute
get_KeyLogFile
KExX
DRAWITEM
Rb7b
ImageLockMode
!t4K\]
(`B2
KMJ{KG
n* yz
g}yz
set_Visible
zq q
LivePerformance
(9Iw
get_GraphicDevice
#I 5Ze
q8tb
H{<E
o{<!
Gx"!s
(V^3
2)n9
GNdB|N
rz"<
Dne~,
@w"3
Lc-\W
l< <
mYT=
j'_hw
SHlo
S^,KfM
\.WB&
SHOWWINDOW
STATURLFLAG_ISCACHED
QGWxo
.QM2
Ux:2
get_RegistrySubKeys
Y9~jVN
nH+.
\`_<
ClientPath
kH<B
:5$-
A[E[
0=53?
get_FileVersionInfo
isWow64Process
.XBQ(m
=37%h}
`pb8
4^8u
RENDERFORMAT
(?4C*
6%/{
HvncDesktop
l)F%d
F2%_
Tb:1
'i I
E2~G
Hm$.
r-d
isChar
vp?@
QZ-6
)\22
=-`k
Keys
Q]E.%
^u<|
EM VPl
UnescapeDataString
type
CopyArray
)sJxZ
CopyPixelOperation
WL#V
Q[U?
set_Oid
h5zvw5v
: -b
}8,x3K
System.ServiceModel
>3[U
]7Z8
cFo/}
n![r(:Y
3j#S
_F\{
F.K
9Ith
set_Values
<._+
)Pnay&
isMouseDown
hookType
pZsc
jW1J
WINDOWPOSCHANGING
,5(R
rraKi
Orcus.Commands.Passwords.Applications.JDownloader
9JS5+!
B"&
ak%ZY3
<AO2{{Q
get_Instance
@5nZ4<b
m.R+
?L(L
CheckSize
.gP=
K9I:
PF&
%(L
MIB_TCP_STATE_TIME_WAIT
t+n9K
#jw 5/
%(C
m$&g
%(@
SendButton
bOjb
RsaDecryptor
<Commands>k__BackingField
0y[|
AFXLAST
ky }
Zz%Hw
Td,4
)KNC
set_ProcessMemory
>_/[
$74K
DEVICECHANGE
h+)z=
6/x
ClearHistory
get_ManagedThreadId
Jjb87:
\lX$
~qKH
k=]a8
odDM
_duration
`)HK
get_ExceptionObject
FX-d
Is32BitProcessOn64BitProcessor
'J fpv
SG,sIWDZ
<>9__12_2
D }kx
&W$
r Z#
z=^6
p^oC
N4n ;
hi*
^U?a
DEVMODECHANGE
d#x%
%(/
%(,
%(+
=o -
%('
set_TaskSchedulerRequestHighestPrivileges
%e=J
%(#
'BzBJ
= P
KL,*
uK_dj
'H`2
resultSender
,,ot
Cn&/1
co=>
PasswordCheck
get_TimeGenerated
DataReceivedEventArgs
-r^rT
!0 Q
6G>3
?g}Z
eVK 1b
`*&Id
*Ad
;Xn'
[u}T
_unsafeStreamCodecLock
Remove
GetNss3Path
InternalPushFile
<~C>
zSk~
71 ?
Z usvD
SYSDEADCHAR
C=jU
Registry
5~`;%
$'a~
Orcus.Shared.Utilities
XmlNode
S2GH
03pz
GetFileName
+3
ComVisibleAttribute
\|efvj
hTT@
octv
9.n-
set_UseVisualStyleBackColor
K8dS
2-)]
)h+`
;i#_L
ReadExistingAssembly
VT*-+c
^ 2U]
ServiceProcessInstaller
Vfks
;FK5
xkC:
^r6G
hModule
B4{.
hive
Xjxo
Zz.!
VwY?
AddrOfPinnedObject
adnOnz
O+ zS
v7HL
v-Fbh
`Kx*
fVnE
NO3;=evz
fr /
<Key>k__BackingField
B=28\
Dh*F
V Vpm3
Vh5v
b 1=
82&R
XKR
GetCookies
<>c__DisplayClass5_0
AesHelper
-'Pn$
[,@Q|
i-aK
,0J!
celt
km-S
.#v i
s9ez
`B3L
NCRBUTTONDBLCLK
SETFOCUS
DataMode
s~!=B
MMDeviceCollection
M&R>
$/QG
2*p
_activeWindowHook_ActiveWindowChanged
hP2w0
usBC
;YVR
R|nTT
WebcamResolution
get_Size
z{YfAT
r`\)m
yB{x
Kt"v
POINTL
xK\w
Aru[
c7|K
(\ng
)sOp
HlFGj
CommandFailed
kvA_
get_Checksum
]c4vU
3g,q#
SETICON
HookProc
vD l
ztZ;
1rZN
( Q
GW_ENABLEDPOPUP
{ @]
ah*r
*~r_
L0=
CurrentFrameworkVersion
(Pl+
WS_CAPTION
'^6YM)
IJZ$C
R>mz
NCCALCSIZE
; o*
]n=yns
vgJ}Aj
J4E6{
Tltd
3XI*
MOUSEMOVE
Orcus.Shared.Commands.Registry
r=3/X
administrationId
WAg?
n!p+
q7YJ%
(rD)pI
9+; p
[ R\8
set_BiosInformation
o?L:RZS
+oes6
E ;ZMbG
UW1cz)8
z@$i
pVh?
/omss_
,b|6
meeV
wI1i 8
1.Qh
_`U`r
<ProcessCommand>b__0
<ProcessCommand>b__1
<ProcessCommand>b__2
Ia_c.
SG[C
<ProcessCommand>b__5
MainForm_Load
<CarriageReturnAndLineFeedReplacement>k__BackingField
AUD;
,B^t
1q>)V
set_Owner
keyName
o)FD
cup9L
DecodeProductKey
Hk"!
?$YI
2Orcus.Shared.Commands.Registry.RegistryValueBinary
0m8k
gN<V}
izBO
:Y:czd"
fxsmF6W
Oluq
nCsp
v:.4
A !,S;
&5L
D)~e
g% #/
ivsnf
VNIU
2k,WF#
z8\Tw
KkH\
OperatingSystem
\ F)
! 4E
*+#14W5
ToDecimal
}8m
1+ -
{sZv
hKt$
"lI,V
wc3I 7
WW!/
$ 7q
aH}!
M8|_
get_Right
9'[B
qP"zg
)z9*C
+MC
0B l<
AGi
Alloc
LBq~#
W G]
4=e0
K?m*
eEH@o
,Qgm$
*1[)
Iyx=
] Z7
callback
~9#a
Value
)jpU
IDDoSOperation
8[fb
CAc(
*Y/@{?C
?ffC
AcOj
SendPackage
ScrollToCaret
?D#1
X&K@|
item_type
T.zR
pceltFetched
[P0!Y
^q?I
GetKeyState
disabledHosts
BE5
qqod
znp(
EndPoint
currentCursorPosition
0 l7
-0~
ChTh
SymhC
%T|/
G)knN
J_%9w
R1-:
@.}v
RxJ OIa
MinValue
eNy:
w\&A
"#3;75-
08+\N
EWprn
FQm<
DESKTOP_CREATEWINDOW
@[g.
HKcx+
>Vdc
kKx[
63@r
,0o-
*eU
-$g
Am.
TjJ$
K/8
8)'kn]x
get_NetworkInterfaceType
SetCurrent
get_Icon
Viyb[
;+Ti1
Execute
0)%-
?S($
4m%G
bbvb
get_MachineName
RofI
p*r9I
mOA>
(,Yx8W*
]Q^
B(? g
get_RemoteEndPoint
3WKDf
cw{p
N9~J
D+ ni
Ymee
IME_SETCONTEXT
.?T
NotSupportedException
{:#*
F` p
3ID!
yCiX
}\trG^]^8 z
&#X_A?|X
~`!z
DUgA?
,kfA3
q#~9
?=s$
HApO
l[Fj
T9@U
8Q^]
[lRQFw
hoB:
XR _X
GetCursorInfo
7K9V
k/K
FILETIME
get_Minor
wProcessorRevision
^4b-
w1sO
+yOe
set_InUse
dA4D
binaryReader
ToLower
Bs@9
1y;*
dKxA
<GetHardwareInformation>b__12
MRxV
+5
+4
jR
lK7,H
)*)'
dwStyle
%/vJ;\
Sd >
yHotspot
get_StackTrace
SETHOTKEY
^ 57S
ctwa8
<GetTcpConnections>b__5_0
{*.U
z~8]
<GetHardwareInformation>b__13
{+cg
}77*3*
N/l+
Copyright
PA" @n
(h
I {
CX_#=
*qUc
>T-,=5
95tm
(5h}
YgRkUDnR
(z
+I
ZHe?
HANDHELDFIRST
FJ *
yt5[
ProcessKeyAction
eL N
(G
RemoteDesktopAction
'%s$%
WindowsService
JkD9
p^UU
4|)2
timer
hDlg
34~g
PE U
>q@d
o3-t
_enumerator
Tn@k)
.B+e
/2*x
xxjp
Qs [
H2yS(
FhA3>
FileExtensions
dmDisplayFrequency
=r S
5W 3
?4DQ
45P>
^}~2
962
lEl)hft
CHAR
p*raH
=~wx=<&b
&ey
hU>u
AudioEndpointVolumeChannel
!d]C
yJD>
#}t=
`8h@
\L(C
&(-
fn2l
@FJ, D
AutoResetEvent
ib 7
rr+
Q~E9.
D Hd
+-gD:
!r/j
Y u'e-
4v .
+ZJh
Exception
_framesLock
e]]a
"-)wA
SC_MINIMIZE
3 [
Yo0
xpoFM
cyWindowBorders
get_WindowInformation
E_K$m
Stop
+(C H<
F^ W
!k'
WCF_PAINTMETHOD_NOP
get_UserName
GetKeyboardState
_s8u
datapath
@l3
@oes
+~qqL
~C|
R;i]!u
uTxfOh
hb6iq
&`O_M
@yoH
J_Lk
77xyW
m;q
astable_name
R%,j
*.s^
&a.%3
y(=O
N3O<OWOyO
FileExplorerCommand
<>9__6_2
GetOsFriendlyName
7yAg
15wjw
SortFileTimeAscending
y1aV
3uZ<
+D*H
z[1k
DoNotSendChangingEvent
{w\TW
Qe='8ZF
L*OHZ
J~gz
#~Kv
at3R
VC'X
izYcs
8Km3r
Wj~#
>BkK
WL">M
WS_BORDER
((p:
\}$f
_mz=
2CeOE
p98H
5~+WjU
<ProcessCommand>b__3_0
PtrToStringAnsi
eRN%
ym1&
&?N2
SpeechGender
@b|i
AudioCommunication
TSECItem
H-+a
6p%d
SPOOLERSTATUS
N[WU
get_ImageLock
\uP'
] SN"
S4<kH
hW(O
.o(t
=pgt
e=+4
A"IR)
`:BI
FileAccess
P6y.
5UQn g
gJ|D?
get_IsAdministrator
Point
*.s;
hCursor
$y)<G
*.s7
<FactoryCommandPlugins>k__BackingField
-O>
@xP9
T@iR
;MbI&
"}.}%us ud:
Y;^"
nZ*W
%& /8*
XU6s
uyv]
`v+KL
4A ."
dwMemoryLoad
Math
-zbBm
/3wC
WCF_MOUSE_AUTOCAPTURE
'C1~2
RegistryValuesPackage
s ;D
~T>!mn
pE W
qU)
!Zkn
8qD@25
]e}K U
-pqoW}rQ
=|>k
fkg3
|m}$b
x.;v
advapi32.dll
*.(6
ysA$
<Timestamp>k__BackingField
get_HorizontalResolution
BJTk
H8*[
4;Z4,
_zQl
\z pO#
[EG|
j}l
]iKG
`2O~
|MO(89
*ve\
r}7
6f4k
HW`<
hV'Iqw
q{G[
r\}n6
LrtA
<GetPasswords>b__1_4
FpwvR-@
<GetPasswords>b__1_6
<GetPasswords>b__1_0
<GetPasswords>b__1_1
<GetPasswords>b__1_2
3)B]
@>fD]
X>p1
]>a;y'
0g>|w
KL*5
;S 7
%e:L]
_cancellationTokenSource
|A.j
=wWDU:
!,wxX
^Ax?
X+y!5
|;U"]
Ka<w
<voc@V
MfR=
ActiveWindowHook
Send
<Bytes>k__BackingField
/O+Q
*Gk
-_:sZ
-K"m0z
WaitOne
Microsoft.VisualBasic
?W$+
bnLM5
Y,!]
}ABC
IFactoryClientCommand
5O`B4|
<SendInformation>b__0_2
pocsUrl
.t`8
<liCJ
z"B>
*2,n
I~LV
IsOnVmWare
|@hn
rN;*
m^R3
68i
jycX
P7)|(
X.2LNy
F[Ul
4sC*
Vs#R
foSO
)TVBe)x
NAkDb
qq-Z
ILC_MASK
IJyyfm-
]$>f
x()Pp
C_,T
|zY
|2bI
EventArgs
'e#b
"a|Z
Z's4
PropertyDataCollection
z@/
_ 5%
;,$h
WS_CLIPSIBLINGS
ix[Z9
Z%Pz$
0PX
"("w" #)#9$a$|$
FontStyle
y4 P(
yzH0
set_Mode
}n"w
IUDm|
_graphicDevice
)&;I,
lpDesktop
LFWXv
ZUmi
T`~"
BiosInformation
GcqR
{b,e
: ~ 2n
|@fZ
1Ys
costura.orcus.shared.dll.zip
FJ~
STARTF_USESTDHANDLES
DoNotRedraw
.. V
UMGD
WriteAllBytes
zS}/`
6pm"
Orcus.Service
kIG
RHtI!$
!i_by
LU
`M;jCC
<GetBiosInformation>b__5
$LH=
<GetBiosInformation>b__6
<GetBiosInformation>b__1
}Gt-
DescbcDecryptor
bua,.
htd@
Qnkz
p~$E
}\JG
PSize
set_Message
TcpAnalyzerDetector
Fp9
SW"fJ
9 <'K
WinSCP
7GHm
bj8t
$QP
D3S&
MassDownloadServer
+}h{
wUO^ ;=
Uplj
DownloadAndExecuteFromUrlCommand
X ]X
LastUpdated
SizeF
%BZ@
<GetAudioDevice>b__0
SetForegroundWindow
Nu N
azhF+O
7WkN
y>2]
#c:JH
_unloaded
prj"
% o
SHGFI_ATTRIBUTES
Orcus.Config
>P7R
Z!+ w
( T)P8
@zJtL
vYc7[
/qV7
O5n`
[08B
[,"a
H8\k
DeflateStream
_t#Q
@w']
add_Idle
|!fc
[77n
Gh;
5S{q
GOoM
En|2
<$l$
Av_q
ServiceController
=<'H7
;Mc|
SMTO_ABORTIFHUNG
4Rb^
*~f
*~g
-9]w
#E`/
U/Op
*~h
DoMouseRightClick
arenaOpt
>q0:
Ad?Q9
Wu=L0
FV (%
srr0o
r5{m
vCode
RR,&
)rn`
G>=L
l.ww
\)kO:-
Sz)*7
DefaultMemberAttribute
tjSy
;kC]u8
3k)
Centered
:$C!
<ProcessCommand>b__2_2
_1C%
get_StartInfo
rw;7m
\; Wj
|vJ3xq
9~_p4
Fyw$
K?/
DS~ZX
~!%]
ir$SI
y=~7
6^ lO
{69J
NEXTDLGCTL
closingSessionId
WasapiOut
$(7-:L#C6
7~$K
OW~bel
|O#f
c m5
/p g
- H
*V(H
>::6
1 |E
get_PrimaryScreen
{'}Y
_mozglueDllPtr
t 7*
T^B3
ArgumentOutOfRangeException
c?{
WxEo
S_$n
W:f
a M1
CYv
DISP_CHANGE_SUCCESSFUL
Jws p
^ )7
'61f=qh
&Pq7
Q8_7
LgR+
SC_VSCROLL
EventHandler
rI;4
OrderByDescending
<@Se
uFJuv
STATURL_QUERYFLAG_NOTITLE
l5'D
StaticCommand
~jx=
Cookies
SetValue
HTTOPLEFT
3&?g
|w|SG
+,j]Vf
jS*>E
set_MaxReceivedMessageSize
U-]p
[.<0
JlsIdP
IM(E
[lZ.6]
(}A/
[8 ^'
B/Fy
Y/G
}ct^
dmDriverVersion
+rp'E
^g4Q]
get_Age
YjQh|
B.}m5
e4-S)
WH_FOREGROUNDIDLE
~4U$
<>3__audioEndpointType
@$IK
w_YB+
2.uI/?
ib7yGK/
}sM/k
get_ResponseHeaders
)bK*.-$
SByte
LxC5
=,Oq;]
{03c
Xi5?
5&"b
:bh`<
V&D<
D=(x~
MmEW
"'^J<^
w:x"
SystemTime
gKa5e
Play
rV.A
*6(
_fieldNames
SJd}
offset
+/,Ze
System.Text.RegularExpressions
5B^P
,#A_\fP
U1q
u^nHL f
@$I
>KZ~
;YO2;
MnRk1
+)`i
Ph m
<GetBiosInformation>b__5_7
get_Type
kh78
set_Icon
%re
System.ComponentModel
>"&PZk1
LocalMachine
h7W_
~r= \
PmS3
rw1O
Q/U8
%"!T
xG!k
H,Z6m
By7R
8K@sT
j-lq
7 [x
CopyIcon
*{)'
&{ZXI
j]F/ T
]EA7
z9Ww 5
[ m
j/Z!
WindowHelper
o4y]N}. [
8 y<
Bp&#Z'
Mc8}
`+{{
@Bp&`
&J MM+v
wL'M
IcmpFloodCommand
%{C{&
1nQE
Cb6W
KQY~+zR
MD~9
M$SC#w
:DK%
M[m,p
&+4s
Z-WCe
' C;
DoMouseLeftClick
wincx
SC_SIZE
Srjh
qoxo
ServiceConnection
r[$}
bWxLp
nRG?
y~$O
Pu-y
OnClosing
add_Closing
1>Y)
j}'l
2l8c
/+@gx!
! D
#DoV
Gl]
AssemblyNameFlags
prOQ
a]=!
rZ,
4rf'
*/]0
,c-x-
J~Jn
Pxm`
tD;~e
set_Entries
nHeight
IndexOutOfRangeException
iUq>
#fk5uEZ;
9g S
SC_CONTEXTHELP
<|kwT
PostMessage
@7Zs{
1s)fyy
nAOJ
= [/
NameValueCollection
PStL
ta6w
5\Qn
|Hu"
set_ClrVersion
MessageReceived
GetMethod
1`Gp
set_EntryName
GetCultureDependentString
COK=
-[)&
set_Password
disposing
+uMr]5{k
z@/
FileExplorerCommunication
set_EventId
G6?R}
set_ReconnectDelay
FW-U
PEA|
YV#V
IPInterfaceProperties
<u]{n/
J3)Y
f@4{
ToShortTimeString
NI_& H
S6A-b
6rdf
INPUTLANGCHANGE
uNij
xWxxc!<
c(q7
_53c
GetWindowsProductKey
MC3;:4
get_DarkGreen
9T!"1%;
18x+q
?~VR_
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.get_Current
PO 2
Orcus.Commands.Internet
BNXmHmz
OrcusApplicationContext
- pG
xDY O
=<ni
fz7
s4oz
t7.f
5ixqT3T-^
-x Z
f|q8
lu@l
~9&[
TI@
ullTotalPhys
ft;F
Color
$5GTI
H.SPQ
!)>
LB/r
RuntimeHelpers
,Ms
qJO!
R3RT
TP*5T
ROG_f
eRxL
t17$
>IKC
Host
'lD\
GetLogicalDrives
N N=
O8Jo
.\X>!,+ .
am2s
TCP_TABLE_BASIC_ALL
IME_COMPOSITIONFULL
Ihdw
SendMessageW
SiM;
IsEnabled
TripleDesHelper
C3IwN
.?OJ%
get_Height
Nvc4
VvIiy!
get_Connection
N9_n
t:G(>
get_AdministrationConnections
( 4B
8T?D
PrimitiveProtocol
n1LV
,ur:
~(hBA7+
3daz
{w0i
q7X5_G
2M >
(A,`
@Tk3
.Z6-?s
9b4}
[C I
NzG]
+E}d]
,\<f
GzN6RK
SHGFI_USEFILEATTRIBUTES
KPNk'}
pp,xU
S7L
]rN<^
Bzx)Y
get_Controls
tJuo
kgfw
n>P1j
Version
add_KeyDown
< y r
get_UdpSockets
KTs[
CommandSelector
E.^.
RylX
NCACTIVATE
:n y
3MZzy
CvWq
,JoZ]
NB4J
J~34iS|
@Nq{
L9!h4
pbKeyState
InformationCollector
U{67z
vT&=
<ProcessCommand>b__0_1
?P]p
GetExtendedTcpTable
tNLE/p
>R??-B
3Bj!
,w2
Wre$
!tr#
{4_w
r'
fE
ElolxF
vb ;
r+
$Mvw
WindowsFolder
ProcessorTypeToString
OperatingSystemInformation
!qNb
$hq|
v='8
:!Ci"t
)yDW
MWKC
?r=&oV
EM'=
7V~j
GV?{
Rotate
M[./
8(]C~
gC_R
M; 9
z=/"
] 5o
2{RGi"
ByoX
get_ProcessorCount
j*8f
ILD_TRANSPARENT
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.Current
ManagementDateTimeConverter
9+^E1
=g=q=
|:zAts
~r(|~)
ll!M
ASKCBFORMATNAME
<WinSCPDecrypt>b__2_0
U]]2
<RegistryValueTypes>k__BackingField
}s-/u
<LocalEndpoint>k__BackingField
g$##
@vJVV
SYSCOLORCHANGE
/D0K051k1w1&232<2
96y4"
get_DnsSuffix
get_CommandCollection
ktcP
_bFV
lEgL
$sB)?J
U e7
kbstate
X)|u
"|Z.}
BMToN3
r+X8
j" $Bg
4Nl~
set_LogicalProcessors
EndInvoke
wCreatorVersion
get_Groups
PV6>}zL
IEnumerator
2u+H
?Oxq
pB4`Op
YK k&
EIk,
/G_H#D
P UC
x.4+,u
|Y.ro]
ICookieRecovery
]#e>v
9^I
iT9U
x:7W
%@y
t''HO
3" L:
7P7d
N3pOf
rSr)
|' S
lpszDesktop
#wR2wX
Va)P
*V+[
JxP
LVQ{
pnoP
YHgb
a}_:
output
?`])
t4T\
get_Host
1'bF
set_MinimizeBox
\ sbf6e
j]ag
Qb-R
bf a
_currentFileDownloader
nhmf
=iQ
UxNS
<Main>b__12_0
Chrome
Cx E
\-o,o
gD[
V}^\U
og8fM
Hg C
nWk4
ImageFormat
1p?]
DM_DISPLAYORIENTATION
DH g=L5M
i%U
8xD9
_requestClass
AddRange
1&KR0,
RdxlVm
SXS.2_
D ,;
!@6 W
UninstallProgramEntryLocation
System.Collections.IEnumerator.Current
UMEO
uoG{
ICollection`1
set_Firewalls
.b4c(
[d u/<K#
O6m"=
zQJ~
KeysToSpecialKey
c U#
Ajw'nX^|
=4vz
_N%X
%/dx0
-5N;
DEADCHAR
RotateDegrees
i%Uy
GTd#
.jz*:
ToDateTime
n,ILe
gQfB
dwNumEntries
;bws
get_Bounds
~ AD?
Pipe
searchTerm
G2q/
{776 }[
+eK]
GetExtension
QP\r
K ?l
c`wh>
bLj/%kx
_desktop
7\aA<b
op
LoadPlugins
ot
k>c20
mzhzt
CE+8
TextWriter
Authenticate
2Kv(=
ayHuh
kij[[
^'xF
fGS~W
WK&
) K iFQn
ConvertHexStringToByteArray
prh
Z D2-)
ToByte
Ln|l1,
X_o
cvA
M8?UkR
M H
8n1Fg
S(@w>
=M>h>
Ac>j
<IsSearching>k__BackingField
CreatePackage
?=/0
l8(*
!` ?
oF
lacU%>,
x>AN
<h> <l>
QG9]
);$Kv
% -
]
n p#
F [
VoiceAge
A^\4
GetLanIp
wr{m
70p|
NCMOUSELEAVE
"K@S@
uLr*
set_Objects
jiUi
#Blob
S$'
O.V
<u?V
set_Administration
ppenum
CommunicationObject
@{xTc z
^f`)(,
'FVX
%H_
`<Cu
r/
WS_VSCROLL
467w
Gb> 3
~7,N%+
SePH
&;cn
Ei %W}c
Insert
Decrypt
\FwP
l{CS
M^$x
Q :{
BindingFlags
.W^JtF
b&9v
L7qF
5IMU3
1d$
)= 7
~P=(
$- Q
Mm
C }yl
`m6SoB
ChannelFactory`1
content
!/C
qb3P
reader
i+tq
Autostarter
GetName
SmoothingMode
z*qm~)
.y%s
Join
STARTUPINFO
<GetUdpConnections>b__4_0
5mG@
RsaKeyManager
'L83
uAF A]
Cursor
X)_!
Y}7(
!:o|
System.Drawing.Drawing2D
p|pt$
VYGtUy
IH+@Lv
9tD:
remove_FileTransferAccepted
Orcus.Plugins
q&/#~
s=^.
set_KeepAlive
Item
hOm8C]s
=Ch1
get_VCode
Orcus.Protection
IPasswordRecovery
x0|k
|J(@
D DI
urlHash
ProcessModule
AppDomain
ENCRYPTIONKEY
y" >
,Zr<
r,FW
EmCm
&}%Z]z[y
Y=OYU
t,}%/
lr]rSr
set_AutoFlush
?VRm
KILLFOCUS
66kB
s\K\
MA&YD
&SrnJ
$u:M
Fat?>+
+$(
y +y
Hh*4
C]
+$(0
,WV+
4^!U
get_Y
DeleteDC
[.e$
u90`]
@sm3
/>B{
XoB
v"
A@[]e}@
(_Eb
memcmp
m_3M
Taskbar
V {;
PushData
WS a
uuYQW
Hj@1c
cyhi&
*eO]
TCP_TABLE_OWNER_MODULE_ALL
_hookHandleTitleChange
Y /qG6Dj
get_ResourceType
hyBK
.6Vm
(9Wh
p*r%G
FactoryCommandPlugins
^qD$77
^A1)
Pc$b
-.k[\
.tMn
dmCollate
p*r%H
QL[W
?I\Qyz
set_FrameworkVersion
}ueI
e 6OU
ce0_
(F:\
p996
66v0
n>4.
pwszKLID
xx90
=^B_
get_PackageSize
OpenWritableSubKeySafe
C {@
^Gco
0?dD
2!#
)1V"
PT]1#
7`n_f1
WH_JOURNALRECORD
:c1B
'`@9tx
8 .\
`hWsy&
EVJJ
.s~5
DialogResult
N==}
Et=4
INITDIALOG
rowNum
5nBrkb
0PYx&a
^"T@
z *mf
SPe~
<.'FV
`ixJ{
get_ServiceName
set_Proxy
Clone
Ma_H
& 5~
:c1h
wrC&
bBQ{
I @
k/O>
~L#xN
GetDirectoryName
}T
ToList
W.Eh+
<GetHardwareInformation>b__11
set_L3Cache
INSTALL
A<G
zh*e
1N;wI=
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADD
WH_HARDWARE
H3@H
F_=Z
Qw7Q
[gYLa
_I/)
>'r>
30yW^[
q7</
INPUT_DEVICE_CHANGE
)2zG
CSCore.CoreAudioAPI
qZu)
De]^
SetMemoryInformation
)|DJ
^F2@Rr`
KnownTypeAttribute
d=~FP
c0gy
0$aH
WRrEsC
,#<Jd~
=`B#X
spf(v.+
72bc
{X>F5
?Nf`C(K;
t>X8D
LiPM
|EVep
z-"I
)z<w
<>9__3_0
V:y'
r1
AudioVolumeControlCommand
connectionId
^+`Y
ShowBalloonTip
Kt
Spj? ;
J!|'
+$KH*d
_streamWriter
mi3
p*rmH
Orcus.MainForm.resources
\mX%m
oVTL
b!1K3*3577
Free
Orcus.Commands.Passwords.Applications.Opera
G#Vr;1+_
b\P>B^
Y^ZD1
$Hs.
1r,S
bX}a&
$KFNY
UH 2U
Y& f
.F7sv3
b =e+
akNT
DESKTOP_JOURNALPLAYBACK
'ImY
g}5 }
$~U7
Y P^
C =w>/p
GB(g
j'r6w
hpmJ
( =
fields
vbr5
ib:t
xt'r
='QV
`l$7
oy
d>PA
STARTF_USESHOWWINDOW
gnS8
MakeTransparent
set_IconData
get_PluginsDirectory
IPAddress
#/^`
IconData
atomWindowType
!M#2M#"M
~"]<
set_MacAddress
I"Vy
j0s5t
*>6
s`V<
9W:;+_(/i
>v.I
>i|z9a
PR^7
S z
JE :M
WCF_PAINTMETHOD_SKIP_HOOK
e:Ky
0:#H
_tempDownloadFile
<Hold>b__0
MouseAction
@cE-LL
}!#V
8lWoM
rFBO:
TaskDefinition
<Dispose>b__3_0
/b@T
CRYPT_VERIFYCONTEXT
5:9:
}P'IF
:xT*
.Xe>
DirectSoundDevice
costura.orcus.shared.utilities.dll.zip
iO^HrE
get_VideoCapabilities
punkISFolder
dW*x]
_nss3DllPtr
X509Certificate
OpenBaseKey
0 :VMg
fullname
ws\A
Orcus.Commands.LiveKeylogger
JLv
@/r_
ElapsedEventHandler
!_Y)
Sp2R
redirectPackage
j-PDI
b 1z8C
E ?
DhC<
SendUdp
W :4z
<AutoResetEvent>k__BackingField
x\nV
Fg<'j
aXbz
AccessMasks
Pc4Fh
height
_hvncDesktop
j/B[
*Xf*
BNv17
get_AsyncWaitHandle
=hr"^
6Y|4
_r ^C
r8s5
Ilr`
{2F[
ea @
{2`9
>R<!
xS #K
Orcus.Shared.Commands.FileExplorer
Marshal
G @{
SendMessageTimeoutFlags
idObject
lXpa]
~x(J
C60f
ry4
TakeLast
&{
;8>f
:d~4
7#e5'
U,3dq8
H=Wx
lpT,|Gg
/C^a
~`<J5
nNjLp
H,W9
_executionLockObject
exception
/
fc{9
Process
<>3__key
binaryWriter
pC n
b$#?
w8Np
VirtualMachineDetector
2Qe>
vbSC
{*=
set_IV
Bf@~
&^o
eGq2
2Pw~$
se`+
Z, m
g2V1
K6ZA
enumerator
F[I(
QE 2t
<entry>5__2
uNJ1
OrderBy
w2}RG\
get_CompanyName
6inim
\P#.
}RIsl
{oVW.
gX7z
P''?
RrbQ$
syi.
$_V[
UInt16
1tQ
^Cb#Gr"
UwXC7
!l|
1z/y
SETTEXT
y:iA
WC02ls
28qce8
j}O.3[
hhT"
set_Device
lefY
IsHandled
VaO"
GetRegistrySubKeys
AP Kc
udpSockets
{ W
JzTH
H? G
System.IO
Za2
WrapNonExceptionThrows
#+:@
![u`
computerSystemManagmentObject
T"' A
cZ9gg
_Np'
Df6%
lpKeyState
V;_"B
^0"=@
j/ ?
GxO]
Su_&E
l>+H
ddKGS"K
>ZI
$j4wR
;j3{
;7S3Qj
GetLastInputInfo
set_IsServiceRunning
4?}Y
$#?L
+;%~T{
EnumThreadProc
b-<{
BWqhe
e}bQi
@H3w
RuntimeFieldHandle
@s7|
c%NM
7~`/
D3 ;
set_AntiDebugger
ResizeImage
Ro]9
L{{v
Xx~x"fpS
%a/j)
Orcus.Shared.Commands.Password
@JSf
44Qy
ScreenHelper
fqmb
QqsOy
eOnL
#mHZ
7|fa
Kl DO
_-~
@[M&
ILoadable
U)=g
SwqJ
"FI^
get_Session
get_StartTime
(+ |
aO$%l
z}V.
!d
<Data>k__BackingField
WindowInformation
FJrY
,-7X
YAn.
[j
y$89
N,Md(
localEndpoint
ONhO
]9C3
be/|
<(to
22zJ
8 RtMN
<{6x
?]E3
M,!V
";KC
GZipStream
>/G;
ComObject
N;;
Orcus.Properties.Resources.resources
f<\D
@c`<
(GW^
a8j;iG Lv
C X]
,[ r
;59;R
e`+K
SHGFI_EXETYPE
user32
y @s
Sc }
f\;/
DoMouseMove
CANCELMODE
ReadFromEmbeddedResources
J+MO
0H I
X%c
& >
*zs
nQyCr
Tq)}
x>G[
B7%t
42.glN
<ImageLock>k__BackingField
set_RegistryAutostartKeyName
wi-
ij,V;
costura.aforge.video.directshow.dll.zip
I*Nq
F w
l0}A
,Q;dZ
csvFile
E/@
{,qY
dmSize
B'_B
#`Cy
)t%j
Qnmm%
_ip8
!M[
WrapMode
TextBoxBase
Y9=TW:
Rir
get_Address
TOCB
set_AdminPasswordStatus
<>9__0_0
_aXRH
down
rTI*
+`+ m
?"b
ktDQ
"/MADDds
{o^
SETCURSOR
A PO
,+7I
*T4uaidQ
!4y,
FUe#u
@#M~
~d.!u
HRG`
cuoE
_@"Ud>
x]
set_VideoCardInfo
ACA~
*k@@G
O%rD%G
QBi.)-v*)
set_BytesSend
GETFONT
*WmUK~>
nj !_
\\W!
/,A+
',aFo^j"
<E6 /
get_ServicePipe
|w>/
<#n\
6J{##
kkm 47s
ElapsedEventArgs
!nr/T
<ClientPlugins>k__BackingField
System.Diagnostics
0 HX
&oQ?
tXIa
OssOr
}N34c
M/O/
y/#&
rNF:lN
RaiseOne
i7W.
FM,h
InternetExplorer
SelectObject
x W x
c+.-
Fy{T
&}U/
*8JI
~* 4
hWnd
LZA?
"W>/a^|*,
k`$S
|<?Sy
RichTextBox
8`
e$[m_W
]0Sc
u [v#]
'[@nL
IpAddress
U<FI
{(]"
bI4(}
B <vX
z2uN
;c 2
set_Threads
FunActionsCommand
t6573
$r)uBu-7
GetOperatingSystemInformation
ADDURL_ADDTOCACHE
&If<
8 F)
A6{F
Orcus.Properties
:&%:
System.ServiceModel.Channels
-R^k
sm
VistaStartMenuCaption
op_Implicit
3;q5RN
)rW
)L:q'1X
CompilerResults
Q3 =
QAz[
O\Dg?
%r./
Timer
bb86)b
p/DT
set_Location
Bb ^
~;|R
:( Y
j]|Blz
3BZa+
dka%
jW8tB
UGF|
yajxZ
yK']i
~]ie
Vb%=
get_KeyLoggerService
`@`v{1
c+f,6
Microsoft.Win32.SafeHandles
'\qO
!S!CvrY
t`! Xh1
Jnt/Dg
=!ep
pF/
APPCOMMAND
+8[Z
get_UTF8
rYrT
5KT*
get_Width
RWy~Q
ERASEBKGND
EX)\
set_Rate
get_Month
KeyLog
HAP+N
!G)m
e5V+
CreateConnection
C1Y<
GetSystemDefaultLCID
PX.yXS
/#{
aqAb
M? z
is_"
7`82; <@<V<
u{m?
DN5f
=jJ_B{f9S^g
hWinEventHook
h\fi$
MIB_UDPROW_OWNER_PID
[=3l
rf,
q!vk
CancelEventHandler
<SendLock>k__BackingField
CopyTo
vzd:%vS-
={8^
GetGraphicDevice
0Qen
GetValue`1
Where
\T;rQ
qEU!
mQQ-
i0FJ
f}lc
set_AntiTcpAnalyzer
CLWk
0Qe^
fwbh
-|("
get_RegistryValueTypes
W`2|
93
IEnumerator`1
UnhandledExceptionEventArgs
NDS5
CryptGetHashParam
(=xa
_webcamSettings
Su |
%bwp
qS!o
4XGoC
JT:d
OWQ-b>
stM
vLwgg
t7IO
CLIPBOARDUPDATE
CHILDACTIVATE
StartHttpFlood
WS_SIZEFRAME
r38
8]&u
Orcus.Shared.Commands.ReverseProxy
^9M; <
o&{
filler
3U=Tr
47nXQ
^%_LW
AuthenticateAsClient
lpbKeyState
NivI
p![ 3f
set_SystemInformation
_synSockets
Fs ;
$Xb:s
V/Dz
a5Cn8
<>c__DisplayClass43_0
U=aN
MPIp9
:Cg
LASTINPUTINFO
b,ct
uL $[
p*ro=
PATPAINT
t/ :u
ullAvailPhys
/:63g;
X98R
<ConnectionId>k__BackingField
+>??7
Rstch
&No
R)5a
WinEventProc
?*Nt
FiV1r
itxBk6
h&NL0
9 ~j
d?8V
UI=1
tGc8
/p?1
AHO
r3N
T4^g
System.Collections.ObjectModel
< A0 A
>T}/
ReadTableFromOffset
get_Capacity
>$+a
"*PWcOZ
<>9__7_0
SetProcessorInformation
}(wm
dgZm
4@@j
ytCeo
:aIdQE
Bytes
{*NC
WLpX
7pO
_translatedNames
|tA!
p oO
t130
bS$\
.4"g
]7 n
set_LocalPort
{ugu
- (-
/>cY
KGYbY
%/{r|
3 IkC
3 uf
SendLogEventArgs
get_Day
\8C.
F^X_$
newCommandType
<s ]
Ow93P6
iV4
3QUPGk
cbSizeFileInfo
set_AntiVMs
ProgMan
ftLastVisited
NFSQ(!$^
L;!,
DeleteSubKey
KJxa>
<PushRequests>b__1
\|.7:9
Degrees0
=KG
zQ5;
kbh@[
*E\{X%
set_StandardOutputEncoding
D1\k
wd?_
HP_ALGID
record_header_field
Wv*i
v -ZLz
-te.t
Qrs%g
2&6A1A
t8 *
V)0>|u
w+YH\4h
+M%B
mD?.
5wUO
set_RenderedWindow
3{gz{9
z;.rU
u."|meh~-{
xAXt
TMBiT
!<Z3
b 5A-8v
~UIy
%eJdoZ
/]'-
+iN;(
KEYDOWN
<TcpClient>k__BackingField
GuidAttribute
0X R!
;9h|uNX
~x6
3!h1
+C+u
SetVisibility
PushExceptions
5nvY\
#;UQ
_current
t$J]
GetWindowThreadProcessId
IGl9
W0z(
rQi$q
dwCreationFlags
=.jV9.F9
VideoCaptureDevice
N4?
`6u,S
NetworkInterface
;Tu@>
4%I0
;C{M
get_Port
/t /Py4
ENUM_CURRENT_SETTINGS
kXzy!
8x+\>
p
T:e>
Trim
DataProtectionScope
sq >
r$[zv
zjgb
po+m
I.Drvw
Qr;U
WS_OVERLAPPED
I=u
o$-4
q,
t3d b
>*x)
*A|
SetKeyboardLayout
8h X
| l7
__StaticArrayInitTypeSize=48
p*rWH
t:U'
set_UserName
GetField
DvG|h]
FileTimeToSystemTime
add_StringUp
SYSTEMTIME
9];C
j5/a
S }:
5\5^
<ReplaceCarriageReturnsAndLineFeedsFromFieldValues>k__BackingField
nC\ 'G
[R|@
".j3
-iZ.9
iUM8
qr'
;mu
XBqy
9a?/
S5$6
K9x'
_ T/?
set_AllWindows
UInt32
9um
StartsWith
K#;4
cH^X
get_DarkRed
set_DeviceId
DesktopName
fileName
set_Is64BitSystem
?Yc8
Right
E Iv{
R;v
19'W
hP0E
_fileStream
oR.C
3)+#Yk
aOR=c=
&6,F
Fma6
keybd_event
QhP-
*|Os
pTcpTable
gzrU3
$]#W#
<>9__3_1
SUL69*
:U<%9
a^ v~J
Yh<R>
| )ub
e=+0
DeleteHistoryEntry
dmMediaType
#Ajw
s q(
VSCROLL
]b2(X
ServiceBase
@9YA
>v k
Split
CTLCOLORDLG
RegOpenKeyEx
]:6u
g\6@
Uqe)
M|Sp{
l~m#
qH@X
N09MN
ICryptoTransform
TaskService
Ygy
SHGFI_PIDL
Btj
$WH Y
ApplicationName
0MiR|
mR0*
x4DgD
rjo}}j
VS$H
6TMX0
AssemblyTitleAttribute
+xNP,;
Orcus.Shared.Commands.LivePerformance
&nP_
aZvnQ1
49 v
hDesktop
ZLJ1%
=u-%
AssemblyLoader
l^j
f&H<
HTHSCROLL
set_NewCreationDate
GetKeyboardLayout
uGn_
P= oe
26 (
__result
/[r{
<>9__4_6
<>9__4_7
</L!
,s+.f
TW]a p
Uk b
<>9__4_0
|.S$
dUg\T
T!0jB
C4\9
8pKM4
f\T
]%>I
add_Load
yBzF
?jg c
Qb3_">
ID3<a
GetRegistryValues
AddSeconds
`HBtE
{4JE
DecryptCoreFtpPassword
ps##g
>_ }
.w@9WX
set_IsCancellationRequested
^T6CY
set_IsSearching
HELP
PerformanceCounterCategory
UninstallCommand
~9g1o
eF0c
!=MsO
g" i
_033
hK9H
MA_ACTIVATE
|= X
p.]yP
<^_R
{^A9
Y{E
'{_c
p5kNz
Post
`;L<kb~
GetIsWow64ProcessDelegate
iv1D
QfeI
d|M;
QY{N
y?=
q ?j
*tP#
Dd ;0
]qzL
^Z$y
@h O
B>&;
(KNW
Orcus.Commands.HVNC
LinkedList`1
{&gGm|^
rC
yw/O
get_OEMCodePage
OA?2bW
e$qd
PATCOPY
iO|C
`IH4
rau>E
1=U8A
~eRBy4
qu U
'>'$
*b* "
BZk
I JpJ
server
IX 7
2{MO
KKO6
()Tr
_+T
5rFDC
KEYUP
u,v-TEZ7
ChatSettings
Nhl
NCXBUTTONUP
F::ttt
UtaYm!
HZKl<
(v 4
v{eT
67YIh
xoc;
ProcessCommand
cN=O0
e<E4f
G $&}I
_buffer
n J7
STATURL_QUERYFLAG_ISCACHED
_%n
inoRUg
ou_S
74;dI
BsKL
dwIdHeader
EjLX
samDesired
DrawImage
9wJyi
KC&B
lq>/
*w|x
a3&M
MessageBox
GetId
[X;Jk
nFlags
b$#y
Gof?
.j/ 0
)z%/
COPY
YXs~{
"yq A
~'Pew
Finalize
_Z(JZ
Connection_Disconnected
StandardKey
cM} QO
PixelFormat
~IJ z
~X9#
<t.5
?;"~
X Q
}$#
b,MP
D~Bl1
^w;I3
Kn%GT
0X Rg
VTPV
wTb}_
Width
0k*%
kcCs
StaticCommandResult
WS_TABSTOP
@96
data
~-Pe
get_Hour
$&:=V
W| ~
Wdd8
@7M!O
Pz8
4c4Xa
GetProcessesByName
0 Go
7,@f
yloi).=
4VL)eg
SpecialFolder
<!+A
get_Chars
j! O
rX7:u.
`p$8
CryptoStreamMode
q/3Z
Z6%15'
R$SyA
}>:
G&zE
B0H3
Cw1o
h$sa
DescbcDecryptorByte
PZ"B
0*S`
KYS E
'A1Y
{;$%
&m)F
9<F "
`EJ_{/!k
g%/:
vs,{ OGn
AdministrationConnection
dmPosition
O7#n
nSY^
.Tkc
source
t~ t
pDevmode
WH_KEYBOARD_LL
]J4W
k\1M
k4mtVa*
z9{)|
AV
x`=)
FromBase64String
|p_:
[T+J=
get_MessageBoxButtons
+X)o
<HvncActions>k__BackingField
d<Nq
7 sB7
ZCY)
iq+O
SP_(\
set_TaskSchedulerTaskName
kqAm
q!zR
J]rh
EM D
D&S#
{M-m
sql_statement
`hO%
eO+
T7IQ
Orcus.Shared.Commands.Code
set_TotalSize
UDP_TABLE_CLASS
PARENTNOTIFY
j|KM
77,wxXn ,
logins
ja\Zk
W r
get_Package
MapVirtualKey
lfi
bwm!l
\:g>
&u: [
GroupCollection
CodeCommand
POWERBROADCAST
XlJBex
EnvironmentExtensions
r`!
<RegistryValue>k__BackingField
I8D!:
W [T/
CHANGEUISTATE
Cr:-B
slK-
CDrB
, ()
adA\pf
, (*
W0'oN
Uninstall
FM}2R
tXA:p
$Ie?
;|cu6v
>jy4
8IwW
{{zB}
y@m
pbData
c4MpG
-r)(hGh]k
t@%l
RecoveredCookie
&$tfv
5QDN
IServicePipe
Fu9
E5L'
|=5
;&Zu4
2HT@p
>G?-V
ReleaseHdc
RotateScreen
Directory
WebcamCommunication
r=8
8mfC5
Decompress
k8 KqK
z%Ma
DZJ"
Wc[3>
3R9(
EI-I
=)T*c
shelldllDefViewParent
uCode
_ b$D)
8! 5
SB9)
,lgo
lH,$
GraphicsUnit
_KAw
=x+<x+
Subtract
0 mz
M5|e
ScreenFactory
IKrEGE
t~}%^
`)Hq
System.Drawing.Size
]`\#
js <}
%- &
d%$K!E )R
><~N
\-mA
Action
+{(O
JoUL
SuspendLayout
System.Web.Extensions
qF L
%1Q:
Wr_"p<'
p=7p
_$MS
NLhv
r~Sx]O
Dictionary`2
TSy;^
o|rWZ0P
@ &d
/3'2
)r7,TZ;_
GetWindowClassFlags
qxO.
fBlockIt
Y\k)k
pluginSettings
# gV
Z4~6
(I6e
ga?ol3s
7^dj
?V|0
set_AutoScaleMode
y(5f
CryptHashData
6=c
ofCY
nj=q
(p\k
_cmdProcess
UnmanagedFunctionPointerAttribute
h0_;
kt(OP
get_DriveType
get_SendBufferSize
2Q:f
C/r4
arguments
[3>z
childAfterHwnd
%(P
WinSCPDecrypt
dmPanningWidth
kiind*
NpiQk
4p?r
dwEventThread
/`=
S~t 5
uKm9
zu9,
v@^}
Expi
{*p3
MEASUREITEM
HTBORDER
<BinaryWriter>k__BackingField
. M@Kzt
Z`)3
}&$`
_unsafeStreamCodec
':oy
Fug#
(wb<j
Y\;W
(0x
Sa`%9b
ua#?
hWndInsertAfter
$&X`
1 y
E'_N
ipAddress
kmE:
)3eM
o Z#
SwbK3($
dmDriverExtra
J%nO7
0J=5G
Icon
}pY7
zs~s
{{w=
t'4
pjJOA
BuUx
WILC!
ey#q
>~>nZG
<T=
,^Ur
ExceptionSent
+/@O"] W]Y*
P8G8
.JF5
y,F \<
AbEnV
aH2 !
[k?E
oDG)G
AdminPasswordStatusToString
(zNe
{<_IZ
*s_&
J l
o?Z` 0G
w3V
M2\y7
DrHY
InpM
o6Xz
/-7p{
-zx"
0BX
v*CC
)9*W
,7(O
keyVal
`L,{xu
SHFILEINFO
Operations
RegistryValueMultiString
k "q
-u t
pHkA
WR/
/KWe
%(r
UnsafeStreamCodec
GetResponse
Wh>\
lD$A;="
HTCAPTION
~ FB
-Z^i.
waveSource
t=wG
%eYR
B9#Z
ErYK
pNss[
;LpV
U#+1
DWMCOLORIZATIONCOLORCHANGED
p*rQG
^/F
get_Duration
O z
`+hI
wRcG>
9@ G
X`<=M
wFU-
Q&~Y
Reverse
]9>V:
dwFillAttribute
EventLog
N wJY)
TJKQ
6FN\-?
_dbBytes
OvQ7
Je=T
wm<57
_actionLock
= w_
rs+
z(6
/R\G
GETDLGCODE
/ayu
_chatSettings
GA==w
ClientPlugins
~F&y
|C_Z{
set_OsName
UjzD
W5*I[LE
BFl8
;vtJ'@
SoftwareInformation
set_UsedMemorySlots
Assembly
c]Yf
}%6X
}BBDj"
.Trl
5^ K
<T r
U`3*
T5c<Qp"(QAt
dataList
A7vMu
xhZ`
Z 34
>F.z
1I y
AssemblyCopyrightAttribute
zUK^
{q]f
4JX|
=iu#
lpProcessInformation
'G0J
6N^B(-"
@C/I
0vT6
W*Od
_"!oq
Dwzb
Fpt;
_lastFrame
K:*x
"rQ
^>b%kz+
SetWindowPos
wparam
dwDataLen
GetAudioDevice
GP|Sr
.ag<}Bx
[;#8
AppContext
8~b
5U8D
LogOff
b\qY/[
otgi
DeleteFile
LWKp
.Xy>"C-g$]
+pG~
j+GM
*IIJ
GY]tT
_session
.n>[M
get_ModifierKeys
Iabr
N+ ~
CryptDestroyHash
~)Nt
Ay&:t
set_NewProcesses
GetExactHandle
tSw(
FindWindow
5Es)
ChG
Sequence
HWND_TOPMOST
As
:A'l\
CurrentImage
timeLastUsed
FrFl*
fpj0-#
GetFreePushFileName
`HH-
E18x
+opju
l~ku
nSoW
Bf]p
(zcm
GetUrlHistory
Orcus.Shared.Commands.ActiveConnections
8(7KXy
|oYV
#V z:
9[:a:z:
Wp*++r
Cg 44
^{)I
MethodInfo
S%&<
file
n!z-
VV]z|x
3$)B
SwitchTo
PF e
MOUSEHOVER
c7sY
MZMM
pwcsTitle
|#nqbq
SetEthernetInformation
l8y/s
FwHg]7
field
!Y]aJN
QueryValue
CreateLink
?=5,
H^"/
LCa#d
{?^l?u
#j D6@
MOUSEEVENTF_RIGHTDOWN
s(t7B
remove_ResponseBytes
InitializeComponent
$\Hz
add_Closed
's*s5
@%z2
get_Value
get_Topmost
%FLw~
Y kc
'( i
RegisterWindowMessage
'lyJ
JN7
lpwTransKey
0BA=
6,4,:
MERGECOPY
-,5#|CjC
vS.P
.!N/'
=b|(
.?+C
9 aR
A&]9
x3"s
oC2ErV
set_MonikerString
Sfn,
*Qy M0L
rM*
BH,B\
" /v
set_PasswordType
=JA^
<AiE6u
Ih ~
/v2
9H >Z
zup4J
N,?a`
XX?,_P
<Title>k__BackingField
6 |6#
{ 9#D
-COum<f
O@z'
.J#hl\
>Em=3
Orcus.Shared.Utilities.Compression
D"5"
^?iK
Fo86
uT`:
<6-g
.cctor
FT>\
p Zkg
WS_MAXIMIZE
L43?
f/\z{
%z !
O{Yn<?
dAr
EP3-O
bB"o
EuMn
_Sjm
? M h*NC3
)pP(>
g8X)r
fj<!
Current_ExceptionsAvailable
m|xO
*\:s
ReadBytes
WindowsIdentity
0V2v0F
ENTERSIZEMOVE
Rua'<
GetHardwareInformation
I:w d
n1 MK
=m@{&
Hold
bB"J
Nc9'Z
set_Volume
-y|dK
rm`(9
bU%,#
encoding
bTBbwp
Kernel32.dll
entryCount
Kill
CompositingQuality
TripleDESCryptoServiceProvider
UdpSockets
NfBb
;y[p
QUERYOPEN
L|-Od
C CTC
=26i
[=bq
h<-J_&Q
0Nd#@
F8,*
TaskActionType
u 5
_'~,
#(u<
UnicastIPAddressInformationCollection
`jfzV&K
R/4!q
ar2&
#2Hm
9pQ`
System.Reflection
GetTableNames
remove_StringDown
get_IsWorking
W++U
0hSZ~
m&Gx
2} X
$;9O
e^5v
&b*!$|
Y'<+
dX#;
bQIDH
Ye '`
7AM_
threads
b[h
get_Png
)B71
vr<B
:.b&a
KJ <JpZ@B
su;_
ToInt64
0?w9h
hH3I
yOezJo
"[[.=}
f#X3
.5{%l
Size
Is64BitOperatingSystem
uPSRXf
R}T ;
eWy5
Object
"7N7
& 'B'I'h'
SC_SCREENSAVE
(fH5
set_Source
>k(cP
HgHRn
L=Y"
0|!
R}L_^
e66
IsSubclassOf
Orcus.Shared.Commands.Console
@`xGR
L`d{M%
@&6(
wH= Z/
SystemPageSize
32+_
6#[k
<Image>k__BackingField
.7Zh
+,fk0
Qs@*
TaskManagerCommunication
WM_KEYDOWN
<ServerConnection>k__BackingField
>dtv
1 XM
WINDOWINFO
o34
iM4z
a"!\
<>c__DisplayClass11_0
._n]!
NK2M
StyleHaveSizeBorders
u{iC
67j1
RegistryValueQWord
w4 Ds
dg %
SC_SEPARATOR
}~r0
rb'
):x*h?
{N^T
6<#w
(K~z-YgV
dkOQ
\4G= vr]:
3OBY
U LT
set_ProductKey
*.s
get_OsName
5Xep
bR>3*e;
SYSTIMER
+ s(
kKn{
/0Gs\
P0Q^Q
O]Y'
IC@%
IOrderedEnumerable`1
P]QSN2JkPM
H<0Ao
#=fir
b?_{
MMa_
CWB
_&Bc
>o`W
HoGJ
{3ab
%rW1
`| 0b
STATURLFLAG_ISTOPLEVEL
destination
r$ E
C A
. Q
Gc "
4]Z+
set_HttpOnly
Expires
BW%t
NkA3
p8:q
GetWindowDC
=hy1$
3System.Resources.Tools.StronglyTypedResourceBuilder
lMEh
c4]'
Gn
p*rkG
Z4 Y
GetData
ulOptions
System.Configuration.Install
m}Q<
CONTEXTMENU
d"6=3
% fTr
T,srR~
Q?\1Gq
J!zE
$mtv)
w0F|oo
ReadMasterTable
0J&.]
W%"czW$
CAPTURECHANGED
R__H
fTr7U7
;:>KJc
3)OkR~
_listsLock
i a8
s=5$
WS_DLGFRAME
-<?C
[)rL
hSV1
PO{J:lA
System.IO.Compression
#i;f
QAV-4
Kb}o+
7l/!
U(?V
)"S&
s@5
hdcSrc
System.Collections.IEnumerator.Reset
WM_SYSKEYDOWN
S;5tA
~1U]
'[uU
Orcus.Shared.Commands.Audio
XrLi
5na ,Y
TaskFolder
k: r
76ww
_client_Connected
KEYLAST
GetCurrentProcess
ERc<
LiveData
get_RemotePort
Bbn|im
LD2)q
* j~
Orcus.Commands.EventLog
4IR,
>K}|
\j#%}0
) M~O!
E g#b
PFR:
[;C
5xY{
EGDy
hX|/
IqxQ<X
+[p|
c+y=
/w i
add_CommandLoaded
5BT]
ServerApiVersion
xMk
#O'c2
fx=9
CP{=L
H<Ux
s$T<"
i +pI
Ol*5s
ncMessage
>Fn8w
es\'
ckV}
17(a
EntrySalt
I.4h
zvB-2
aN_#
ResolveAssembly
token
s~Ync
get_Millisecond
`iF+
NwqO
az{.
v<rG
f!2D
G\*GX*
k&? 2
k&? 1
"phEw
get_CurrentCulture
yUv'
n]jy7
KJzv=s
k&? =
wKs~
LJ|
+Ag
CP=r
*o_Hw
-dmo;
HIQZ(
n>n[
k&? /
CoreFtp
D;&l4
B%.Y@
9 pYe
HTVSCROLL
MassDownloadManager
RU#{{
lpTitle
e8j n
[=B!
gR.r|I
HTMINBUTTON
WYw^
DeviceState
3AAg
<EndRead>b__2
>#*ugT
<EndRead>b__0
<EndRead>b__1
n:
n]bZ=v
c_1Q?
DSw.#<K
b [i
SC_TASKLIST
k&? {
I4"C
1<qd0q
pQn1fiJ
EBs T
ExtractAssociatedIcon
f3`}
_keyboardHook_StringDown
]j#
4OZ"
lC}
:g*
g(v'V
TextToSpeechPackage
BnY\\
u7L}
aKcj.}
b+#
set_InstalledPrograms
KeyboardHook
$OTX
<AsyncOperation>k__BackingField
*+3N
SHGFI_SYSICONINDEX
<MessageReceived>b__0
ChangeComputerStateCommand
1YIZ'V
~n
1q|c
SelectVoice
k&? I
I<tA=
x]bs
,C,Tq"
`Zxub
set_RegistrySubKeys
3ysaH
ResponseError
R>fi
|{fk
Fields
_keyProcessing
Microsoft.Win32
KeyEventHandler
[BeN\
} R5
'232
3X+f
tNIyV
csv
n;7I
WU_-
r"OZ
)0Q<
@}*I
X;!G
yN &FE
- G
SecretKey
ZvkLx
<#Dgxy{
}:?9
QACL
<IsTaken>k__BackingField
IoD_
j%]^
ro:Gf
pJ(v
p rd
$Vg5K
)!M
Vc#
7^2^4^
&%+MJV
H4:0
Lq9[
{/Nj
GetProcesses
]~u
ee~K=
&3%.
AdministrationId
KW[5
}sQ)
z-G
>ERo
\~=*
Objects
Y wD
hitTest
k@Jw
oZ`Zh
GetDefaultAudioEndpoint
lMON
'#BOp2f:
TNhA
kB(ZR
KEPx
h\v^ +3;
Juh>
bUiQ
3Db\9&#
Wf3M
\FW/
\Vg*7K
_ "ET
1BK"
,VER
"7>s
[+rH
?=j^OY
a{NaI`
V^ %
UserInteractionWelcomePackage
GKa.
mCm
5z?(S
G8qoR
Zz4V<wZ
oh}Lp
RegistryCommand
[/fw
row_id
sQ5*
dwProcessId
pszProvider
w#D)
U>"W
Ve 8
n g
YWf&
abBr
N@?0d
isDown
Q-&r*
4D0R3o
HJr=
r1YE
$Z_{
'K$i
s\5g
m7m
YG)7
+3!3
System.Collections.Generic.IEnumerator<System.String>.get_Current
a//H)
tAh`
b#zL
%`aF<
MozillaDecryptor
H/NaF
set_DriveType
T0TTTTTTTT,2,4TJTLT2LJ4*,*4TJ*2L**,,2*|%%
e:iB"
'm=
IPHostEntry
<Values>k__BackingField
IE3S
Port
GetMsvcrPath
ActiveWindowChangedEventArgs
ObjectIdentifier
xud
digitalProductId
HardwareInformation
,^g4
_ L;M
Microsoft 2016
&n\a
7Cb5
M`)xE12
HookType
}T
GetInstanceNames
@Bm
y1Hg
^VLq
.U,UX
grWW ,
_yO<
&&-%
q~Wa
}h+?
|-q2
get_PacketSize
/j}G
Wy"[
root_num
c~lz
"B;*Ps
K<i]
!Oo`
H*gh=D
rOL
1v ]f
crm[
$A^#
O|u{`y
+sEkAR
;*U:
String
b&=E
{,{y
b3So[
`wp48
QB s
$2V!
|p6i
W?hP
UninstallProgramsCommunication
IConnectionInfo
=M a
INITMENUPOPUP
set_SendProcesses
ResolveEventArgs
i-m\
x-tFw
sW[
target
<>c__DisplayClass0_2
builder
<>c__DisplayClass0_0
Orcus.Shared.Commands.ExceptionHandling
fuq~{aGUR
IsCancellationRequested
N}7y
gOeK3\6Vm
weCzSv
whU=
QiS"
VOO/
r7Sa
L_r$
8 <a
K<>C
mXgg3~
!lY[
R!#
kE"H
Create
?!sf
jzyU
AesCryptoServiceProvider
?M!/a
FbFK$c
hBT9
IbM/
:O0
<Go@C
%S"'
+;p|
set_AcceptsReturn
PackageCompression
RUQ
^&7~
/J+J
<GetSecurityEventLog>b__11_0
1; xwv
P?SF
Ly_e
GetExceptionStackTrace
<>3__location
L8no<@
J~ FM
4TSD
2-i+.
|KzD0
oe+\
j v WH6
[131
)o 59
:0>z
hi*[
RecoverPasswords
Bzz9
}Hk^
k|"_
j; C,
H>HE$2
Data3
_staturl
FjYm/j\
i]$`
wi/M
yqR|
P 9m
OcWpy
#iJN
SC_MOUSEMENU
JnQK(O6\
GetStream
WczxZ
ZB@
Vb+d
gjz,=S1-
4@)w
1Ov
!>SO
,Q1'
Af(l
1&7kE(NK
Na5$K
Orcus.Commands.Passwords.Applications.Firefox
hNtOr
|eROCI@
add_SendMessage
cG.F
Y}PO
e]rQ,
8 t{:
,5D!
c&xN5
}#4-
)Amc'
4S,m
CommandSucceed
IJ97
IsConnected
j y[
qpykyM
{V5
ZSKF
_msvcpDllPtr
GetProcessWindowStation
(&:n
h&j!
f'WL8
x6J3
6i I
CTLCOLORSCROLLBAR
ZB
q` v
w ~?
vBNqe(
7 po5
g]&M-8Q
h$|E
Bb*.)
DirectSoundOut
^BY8
{0fv
IsAlive
q.#i~#
get_DeviceID
b}3 h
<Rectangle>k__BackingField
8ssp
n1_J
SbtD
GetDesktopWindow
J<Sh
gv>H
Z-7&
C/ mV`
SearchOption
IGNq
M^G>
kdOq
#a@
+.@!
X_a>p
\MyG&8
& r27
0=6{
` C`
U[_hP(f
1auc
dmICMIntent
+tl#s
<ExecuteCommand>b__1
R{|V
+Dp)
IsChar
)Ui6
PerformanceCounter
'VL
.mk 1&
*(0
<GetHardwareInformation>b__9
SpeechAge
|l6)J
#Tkw
CrxpcC<iH
GetFolderPath
*(,
CsQO
*(/
bi\
y:|P
8 t h
List`1
Ya9',
n=
AssemblyFileVersionAttribute
r<H
DFh"
KeyDatabase
GetTempPath
y7^P
B.BYB
-G-
1/rn
JrDP
T8xO
+S)8p
rl'
0l%/
;0s.
System.Resources
\+{v
ieR(
>x( ?
hzHE
set_UserDomainName
_rp@*;*
CodeCommunication
0gQ)
flags
rl
5 Nm
fTe<
AuthenticationException
Current_CommandLoaded
Ib.~
JmV
x &$E
a)XA
-d{|
W!hb,fhjD
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.GetEnumerator
cu]RJ
_LON|
<GetSoftwareInformation>b__10_0
[|!-
CompareMemCmp
EnumDesktopProc
<GetSoftwareInformation>b__10_1
set_X
MoveTo
iM} 6m
HZ9\
uw'?
l[4me9f
JQ9T
dE~f
|>aq
Sm~0
R66R
&t?mB
r9
~$Ct
p/x4
+knt
}C$-
dkdh
)=WRqx
fInherit
ez% 3%
M9MG
OH%U\
get_RenderedWindow
UFS:
GYA|
.wPc?U
T5b9Q(
,@[]
DrawWindow
)u3-
whWlW
@D4 =
d;f\2
&W~]
CPW
i"b7M
dwAttributes
@=\j
! 58}U
*y g
4G:}
Exit
C~;A+
46}&
{u}W
{A5j
q=/z?
#f9]ay<
Uu1.+
La<F4
NSSBase64_DecodeBufferPtr
LlY
"K;f<
\/:5
?Q[K
TTUH}
PasswordType
AW ~
H[2"g
[d&=Z
B5h_UK
$+896
?/no
WTj*
ExplorerUrlHistory
'My[
[10F
8\t
;[uU
j6aO2
k&J
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
\6b>(
?t,J5
dmPelsHeight
aHF|~
ALG_SID_SHA1
TaskCollection
[9U@
KeyValuePair`2
SynFloodPackage
V8kL
(5f>n` !
EpWj0
set_Field1
MIB_TCP_STATE_ESTAB
4!4X
vkCode
lK&H7
ConvertFromOrcusValueKind
|<8}
@foH
?5 h
ux8m
FxHG
AdministrationApiVersion
nD%2SR
\z3
EJ
L]HrF83B$I
>-t}
r/g
~E-
5@,'
pelHeight
<urlHistory>5__3
z.@z
n`K,
Yi)Ei
Int32
Xk}E
get_Success
3=\>N
gBw
!e'>#
a\vu1
EFfp8H
SHGetSpecialFolderPath
2*UJfZ
tB$n
mqSF
by&R9d
p*rQI
degrees
^*8e
}thF0
m{#<
GetParent
N9 +i
]~?*
(,EL
UAo_
]ubOPK
Q<,!
nt=v
TIMECHANGE
kgh
|avr
fE
*.s[
2h[b5
*.sS
a|$p.
$6uj
packageCompression
Lh=2
*.sU
R(=jiWf
set_StandardErrorEncoding
5 d4
r'wa
eGEe
resourceMan
get_InnerText
{Ea#
J+"
lpEnvironment
vrP*
_hookHandleWinChange
*.s=
(K c
n~b`cf}
^*r ;/
DeleteObject
bh<WZ
I5tWUU
~Ot#
N'o"
7W.BOx
get_Minute
Y{.N
System.Drawing
costura.cscore.dll.zip
,V S;
^Bu
LQe\
X1J^
UUC5y
/+M.*B
@R[LZ
Orcus.Shared.Csv
[4Mc
, yx
&5l&
]io>L
uLvA
aJqa*
GetProcessTitle
get_EventId
ibuj
CLIENTTAG
p*r]I
se1 Q
wF)Z
B9:" G
get_OSVersion
lZl=
F!4G!
*Aei
%Mdd
[We U
rL
set_AudioChannels
DebuggableAttribute
[f2m
get_OperationalStatus
get_EventID
,U('
4~8m
u|\*.
RegisterTaskDefinition
wU,I
6Z Tv}D
$pSm
(((FQ
aWFJ
ScZ3
L*\b
@80
S 2KJ
m =d
RiGD
E}t-
Cast
,zb.>q
8JUtV
(?i'
IkS3eh
A '6
Di -
add_TextChanged
UploadInfo
j_1,
rI1
D_9!
DecryptIePassword
91\Y$
0 i
TM=
\2Z5P
~w(z
2G3IkZo
='6.
_proxyClients
HL$1
Ecbv
'&gM c
EyOa{
)*\:-
R` +
I"3}7
dXd2[
|}0wtj'
r@-PQ
V MP
, (
F(G&
- Jzww
K20&
Monitor
<{ F
Mutex
y}3q
rL866a &x1
!; ;
?KrZ
UGB8e
@@,8
{%?R.
r49gWV
0 1A1S1
Orcus.Plugins.IConnectionInfo.get_ServerConnection
;9r>
B!+!
[Th}
MDIICONARRANGE
wpWJFg
Mqsqq
3}|+
q\/W
Bj vG
assemblyName
ProcessInfo
t',C"
, (I
KeyLoggerService
cg/p
*IUq
1 AA
_deadKeys
ks%w
IcmpFloodPackage
E3[e
lpFileTime2
[j!0+
D Xu
HJK
WRYf
,u u
Select
}l0g
(StX
g6?"
v5Jo
oMz
set_ReleaseDate
JZG.
kbzq
0:c7h
EditorBrowsableState
AssemblyConfigurationAttribute
set_ConnectionInfo
b:p|
$$>X
3sGy
\"gH
;|#%
"}M0
*rm
}iv :
4KWSO
~chK
IME_KEYLAST
LOo'
gaxf
ik_&
seconds
DeleteTask
:N~AW,
?c?MU
OQXa]
<\C
_w"
#9u7
D_D q$
AsyncOperation
:t1<
&m V
BIfFG
U^$3
{T]B
Q__D
get_Cookies
tyy{{
%<]iy E
rI;
1ZP<
JsPZ
g!\;
usernameField
, {"
`rmn
A4Wv
, {%
X^v>
ue'N
aeY/ 5t
AudioEndpointType
K,
WaitForInputIdle
EnumDesktopWindows
*r=
SecurityException
+A"a%
T-fM
RS\j
lpdwProcessId
Q{!U
[zKa
a3w-
WA@T?
V9VO
B$Mz
s(
NCXBUTTONDBLCLK
s,
_screenFactoryLock
get_KeyLog
q(<.
mI|@
BodE`
y::
s=
idProcess
_`V0
T=3
s3
NoTL,+
c?2
@C{
PK11_GetInternalKeySlotPtr
HD&p
}?KnaN
kVl9
ullAvailExtendedVirtual
Rijndael
s"!_
&KXq
SO%?
?3]YB9
S'n(
Ri@4d
t[LdhZ
hvncAction
{v&]1
get_Primary
]Ob@
Interlocked
get_Culture
fW/H
28["4
S#%.C
M 9
XmlTextReader
**xA
zJ<C
% }-
% }.
Connection
OpenReadonlySubKey
ufDEQxy
W2:A
A9d-x
AM-+
?-4iu
uScanCode
%"8 c9N
sL
CodeImage
%S.Iz
kq|n~*
sG
nDf$*
^T|6
Q:9V
rectangle
}@U,
Extract
sT
>WvAl
Oq7udzT%X
:A{c/C
reserved
*-bbZ
%/&~&
ipY$
<GetDesktopWindow>b__0
set_AsyncOperation
V6a[Y
dM@n
7:tG
t'K7W
get_WorkingSet64
L-KsW
3;q]
dwThreadId
vPfK
TCP_TABLE_OWNER_PID_CONNECTIONS
r?LD
w8'<
[bV@
}s(hJ>
GETMINMAXINFO
jXqCw
]e[
_lastIconImage
>p?z?
MKv
Z- P
WebHeaderCollection
label1
bin4
Orcus.Commands.TaskManager
)=80
1c)J'4
Gy (]br
*n(
label3
4tSs
F1_a
!b>;
<GetBiosInformation>b__4
IsUserAdministrator
collection
B!m!+
5 GZ
3b<q
?4G
UninstallButton_Click
g`nx3
d >YV
9sy
SendLock
<yIrur 9
zx U0
z].x
.uf
get_HasErrors
@bm`"
%Tj0
ApplicationOnIdle
n.pw
(Zc7
<ProcessCommand>b__0_5
'M1h
r./C
31j%
<ProcessCommand>b__0_0
1RYHk]
;~
;?;T;|;
n.pg
ckL"
InstallIfNotExist
RSmy
o' s
G+A5
y+'0
ISoundOut
GetEntries
set_Y
^@[7
W"R:e
<SetProcessorInformation>b__2_1
VZ-?
!#3nu
QB$w
_livePerformance
T: V
0l?>
1]|\
k"}X
Z|Ai
G?$
zD[l(
e!I&B
z.@V} 8
B YC
5O`,e'
=G <
WM_LBUTTONUP
+,EK
S]]t/
.p7J#eQ.
image
#qXJ
wParam
ComInterfaceType
nScanCode
FW35
H3Jc
$n=l[
?]p
8a2
DmoMp3Decoder
CK s
}+$`-
<>3__registryKey
set_ConnectionType
HSCROLL
BLACKNESS
FileContent
BvAw0FI
tgASV
vMq?
ToLowerInvariant
/(8!
U2''
Ivw0
Debugger
INSTALLSERVICE
"5!&
xL|X
NCMOUSEMOVE
X9M1
`kLk
Y*Os
&- \t
fZ9-9
)a/%jE8
IsNullOrWhiteSpace
C*|A
VirtualKeyCode
_keyboardHookHandle
UC GRao?&
N23`?
>i"pc
<RemoveFromAutostart>b__3_0
7lx*
ih32aAZ
+
Hide
p\W
$]C"
set_Width
ManagedInstallerClass
,N +/
z:3&~
K}:NW
@{
dvlR
set_IsHandled
Nh)i.e
i`(e
MIN_ALL
aD>k3
y/XQ
9r+N
CreateEncryptor
)^g~%0
JU/\c1
dwProvType
]}I!E
19gt
2Dp*
B?*.w
<IsInstalled>k__BackingField
u5)a
BG%t
+B
vJBn
ActiveWindowChanged
get_Ticks
bsc[
ArgumentNullException
get_PreventClose
System.Speech
get_Major
Orcus.Service.Native
?RRW
GetPhysicalAddress
set_PersistKeyInCsp
+X
2 {j
e)`Km
wtZ!
X.Qr
ge ?8
Tk,L
Orcus.StaticCommands
S/V]
zq#Y
+h
}_H"?
count
m$+m
;6!d
VA_t
WKR?
)0vu
v2.0.50727
B\lx
N b 4,'A
<GetFormattedKeyValues>b__0
VnvIfv
oJD4
iII]
g[34#M4
ALG_CLASS_HASH
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.Password.RecoveredPassword>.GetEnumerator
?"\L
KQte
A+<F
gl!G2}}
^=f/
uZ]
e=`R
get_Passwordcheck
O-BU
=/=Pp
~:hf
s" @9
[N2U
D9);
LH>4
get_Default
A#gq
!=3+
dataToParse
X{|O
tZ&!
o`8ay
hexString
yWPC
e oCw
L^x7
l,v^
get_Lenght
9z'Y\)
:hF
zyS=
URL_ESCAPE_SPACES_ONLY
x6TW0
O>1bh
'[H8
txKt
op_Division
Y$FT
8co&
F> &6
duration
10g ~
Wu-<
|9+p
Activate
.Y
zkQ0y
VwR{K
|D>*
\hR
m5if
/Acp
wH$N
EnableVisualStyles
<W_6\
RegistryValueExpandString
)$$I
WriteObject
(~Lq
N]a/^
op3{
bb\@
<Main>b__12_2
Flush
p0e,P
}V!?
)!L
get_Connected
GetEnumerator
e_%S
(fiT
<GetEntries>d__2
~8/r
2R;/
u+3$
Z uso
+7K(0f(
H3i!
MessageBoxButtons
YLYe
2~!/
JuZ`7
System.Timers
:q-5
4j[Mlp
xo/^8
1ye;
8Orcus.Shared.Commands.Registry.RegistryValueExpandString
_#Fx
7#97
<RegistryHive>k__BackingField
#y+`
:@d>:B
A7z
s br_!
CzQe
9ZBezVc8
iv&;
oa]G00
TCP_TABLE_CLASS
tT|iI i
&pMg
\"-/ ER
(^iR
RJ\t
get_DocumentElement
ToUInt64
mD7n
l3S7
B@tZ[a
FileSystemInfo
9cf'
KtP%I"[
`/rE
=W\o
Qp=x
q(ad
CS$<>8__locals1
Orcus.Shared.Commands.ComputerInformation
StopConnect
Pi+M*
aw >~
cBmdN
<password>5__1
ReportError
VTTw
/0au
mD7J
+j@2
z*/jOSr
vr%R
;[\#r
=0S,
\/&VT+?
get_LocalEndPoint
pU W
8[kV
a QK^
FileExplorerShortcut
text
Application_ApplicationExit
LoFf
Rg=b
zsT
Tp^,rp0r
67I6
%nc6
& ot
9|~Y%
clWU
_ l%
}>Ui{UU
LFE1Q
eJR8v
V%4iF
}[Aj
ResponseBytes
set_ErrorType
masterPassword
cf<)`
3^&t)
_logFile
S.]?
get_FrameworkVersion
""{h
19H^
S5yi
}z*X
nTeD
Mu CUz
a"@L
H N*
c ER1
x%+<@X
:#k,
:d!t
c @ /
qjg3
WkJj^3
`"dt
`#pgb
JN7SJ
get_InstalledUICulture
4I"!X|S
xy99
sIzL
XK(B
defaultDevice
< Wk
GetWindows
j0>S
S.OA
SysCommands
<>9__5_0
:E]Z|
Microsoft.Win32.TaskScheduler
AudioEndpointVolume
LTF^5]
{6[[o
:eAJ
set_Cookies
PAINTCLIPBOARD
YR?X
m{8b
5ZbG
mu.i
NCLBUTTONUP
qh
]zy~i)W
- oY
~^Z7
lfr*
CaptureCursor
U$"J
#")D
TuO"
xxx`
udpData
zEZ
l,Pm51
UZpeG
PROCESS_INFORMATION
TransformFinalBlock
cl",
$<9 0
hOq
\"4~I
}Q;e
kL
set_Font
^G/.
pl;
<%[K#xJV
IComparer
wuzR
|s)<
r[5rG
R:D)
6>"6
J0lGCo{/
sK3]
j&H5#
[1oq
A.L<
5!^5
<AppContext>k__BackingField
82vL
r1Ev
F[*s
Z!]8%W
xl4J
S`>|
Yb=(C
;g7
X_6p
p)CR
FromHandle
p<"=%oM#
&}H_
< Yn
IR<9
E985
"L}*F
hsx1
z@$q
UvH<
*mLZ~ 5
mv5r
_urlHistoryList
Ak_y
V@G
*'iZ5G
@Te!5
+-e(
FZlH
LpI
PCGH
INPUT
_ +O
PALETTEISCHANGING
n"!.
j%j
"eGu
,^G9
r{_k
=sxp
>>T&
<Type>k__BackingField
_#\Z
4sQp
K/o_Z
:629q
json
hObjectSource
cFeJ
(=[q
UninstallProgramsCommand
p%34
gz*+
RXwi
J!M iRHWB
k,J\
&%,GQ
SYNCPAINT
oV:K
# R3
Count
nMaxCount
_(fz
14.0.0.0
o yY
SpecialKey
r :m
"L"t
Hz}s
9 +y
0zJ0
AForge.Video.DirectShow
L>SoJ
value
Bitmap
windowTitle
%Z[:
>i>"
DriveInfo
%x9d
# (2
CsvWriter
^d&m
|p2@
UH;!
ClientActionCommand
!lUo
z:E
fy?Y
!gBz}
@5u3
}z v
mz x
S=1|
get_IsInstalled
<P4X
IProxyClient
~g*d
:P(
GetVistaStartMenuWnd
x?x6
mouse_event
S1ePt
,Zc^
'_rM
W-O dKy<od
8m`=
cGcxk
Fau6
&3yq
!m-_g
iUSZK
GetInformation
DDmS"
BU%T
d2O>
PENWINFIRST
$>2i
R >#
d[jb
EE6001A9EFFBC3E336D7A05124DA53EF8D648CE1
7N1 F
_5yO1
SHGFI_TYPENAME
Degrees270
get_Exception
"L%
MvERU\
`Q^u
sI)v%
yg>U
I&Ki
@rmo
set_SelectionStart
r{*_
{]0:
ev^X
get_Source
3Kvo/
?7l~U
xt6K
eiM3
WriteRecord
_E,A|NT
^v1n_m)
UFt)
wjOW
!" D*
%B[l
Bt?B
]<V~u
get_IsAttached
U#$>F
v,h
]jiK[
}OO)c7 o
&Qox
pd5f
qhd#
`COr
5i g
VMW_EXECUTE_MENU
606O6
}c}w
h{Q# 7v|t
)1J]
!Je(K {
mpX
(F P
get_FileDescription
y# D
N,"a
get_Guid
gRsn
pr%R
> 4i
Tu\~z
<I#x
yeT}
51 Jb
Thread
I}Fg>
SslStream
dwRop
v!-`o
@g'?
|TBw
\j[u
VH{H
(q~ "
4#4#z
9xMA
Orcus.Commands.ActiveConnections
NE-x
FromFile
b[fnB&
sLwf
STATURL_QUERYFLAGS
`pw6
`#
%VZ~
=](a
cLdp-#B
SHA1CryptoServiceProvider
2&O)
WQTM
set_EthernetAdapters
pP w
+b}.h)W\
RIKP
get_CurrentThread
get_UserInteractive
EventLogEntry
8s p
SetAttributes
%$ =
m l$
set_IsConnected
MW1j
cjOrB0
RsQO
ReadAllText
|C5c
{;uXXe
jx %-
(=-|
ZiJgk
Q]NkT
set_IsPrimary
~"k-
IU6I{
CommandCollection
o/r_A
GetIPProperties
SMTO_NORMAL
&XTO
v2|Jy
Orcus.Service.exe
p.a_
]7O7
5K!,
ManagementClass
2i^/
F7; Z
[qbYqF
gbY[n
{`D=
w~)Pe
M ~d^
<A3L
Vn`%
zm8]!
K[\]
J8cf
host
`- V
=&e
?bk}uJ
?hnH(
z}/X
-%jX#\
[pvY
fHm.
get_GlobalSalt
u*[o
WS_MAXIMIZEBOX
4 Ch
q.(Dj
zzH8G
URO<Y!
]i^Y
SRCAND
*.8'7
{2Qe
gmu~&
!rA+ PC
TC?m&s~2
Orcus.Connection
95s,G
&8<
Cqmg
ZEgZ
n ZXH
get_ChildNodes
UCnEeR
qCgRn_
|n:u&
I5QL
ii4X
>H>[r
{uW_p
Fu)>K9
dataMode
]\l@
NV}?X>
.s\A)~}
b:zU
(0tZB
Im})
~|Xk
DTnE
GWL_STYLE
\ <.
@L%Q
Yiq=
set_RuntimeVersion
3/Y
Zz;1
3P3h4
ClientOnConnected
1NTN
8N)P
Mouse
)DN
vB40
B^0%
$@9?
GETOBJECT
b8}]
&8f
,4(
TaskmanagerCommand
G
SymmetricAlgorithm
0;dq
<>c__DisplayClass14_1
Serializer
9|3F
S|%=U
Compare
+YK.
|2qI
&8Q
get_VolumeLabel
ServerPackageType
Y[#(u<
(!?7
Notify
f*;Gf
+
X>V&
\dxoaj
ApplyWindowInformation
GetDesktops
wHge
GetFrameworkVersion
x_w?
)<\N
SRCPAINT
; ;?'
?P*1I
WriteLine
nD~o
p6'c
l^;4
!5agu
18 u
p1?
v9 J
Ghk1
L:hU3<R
uSan
_C]k=u
giN|4
.A(s
~~R'
$cY\k
}!Zc
FT |
~l[d5
ipEndPoint
}0kM
| m4
${kx
=cL3P
bE6g
_u (
<>9__12_0
<>9__12_1
U)Z%
t 57
=/O&
lVOlU
(<2Wc
HTTOP
LRJ
`~(X
_&kA
ru !nq0
n4q r
h,39
w8Xx
timeout
):%!Xr
0eK"
vutX
3y]x,
4,:%
p~+F
l7.C7
92)]mt
l4hD
T(ES B
mI X
RVfy
UEy,N
L $M 3g
@v9g
34vd
Sleep
j}%)
*W5t
UYRv|
3
1jJE
c |
SVNZ<
&q5p
1Ptq
8u|
& uN
L sY%
;1d?
DateTime
?}b
EnumDesktops
djn
0n /;
$;r~;
XYo0
Pmx(
dec_next_char
QqIN
XYo8
I?p.
left
fvTg
d{Qa~r
Pidgin
Nm#H
bYCsq
j>wxn]
VTZ>
XYo#
>Ot6
G|)D
System.Runtime.Serialization.Json
DM_PELSHEIGHT
Wow6464
yyE`
T5OG
ConsoleCommunication
cP1
<rPF
w!\Wv
g}sN
DesktopWindow
qq "!
filetime
e2,M+
get_TwoLetterISOLanguageName
zA?
I?Ir
[11x
2_c0
ChangeWallpaperCommand
XAo<
&lht
St*
i|2v'
y.Ty
E~r
WriteToStream
Ff$]
d+Zt]v
get_RootDirectory
[}-)
XYof
{oB{
Pb\7&rp
~:?@
% |@
TVLl
J4nSZ`
<GetExceptionStackTrace>b__0
J h`
]1bs
0>
xK_Ff
dN6&
MnR
Rasr
D|/F[m
_uninstallPaths
4DFy
?:^=
YY9s
{% 9
yZF&
w*K^g}Nz ]g
CommandResult
BZFBy
<e \
get_Monitor
_]g7
LockBits
<RTE==x:
S]^~
ptScreenPos
6@12P
qIpkU@
e,[^z2
>qx{
cb 3
S Ma
FileTransferAccepted
Wl'm
]bBR
tGU
Q)P^J
S._O
ExitThread
Orcus.Shared.Commands.UserInteraction
b|vJ.
<Keys>k__BackingField
hi<M*
Mw-u1
Orcus.Shared.Commands.HVNC
HDP]
FoM|
path
zne1
omWn
0V5=#h
/yqa
uYg8
|*mE
L6LWLlLuL
tavV+
4]=U
HtWQ
OWnj
hl&
^7^~
*{_
;XB]Ekxiz;f.
ekT{
Ofb+7
ProcessStartInfo
SMTO_ERRORONEXIT
G1S}
c^xE
4N 5
rA6\
su.2
L+/w
iM'=_
TpZs
C[/@
visible
set_StackTrace
$6)2
<key>5__1
3w(w
GetIconFromProcess
:% !
^ELj
HiveKeys
%~X
R}nt i(V
JxB>
NN&t
B,<-
SynFlood
a.}9
T,9d
~F[<
X+->
vp2U
_reverseProxyClient_Connected
]p U
H k*6N
h428
"rI$
$! #
IsAddedToAutostart
6 ,9
IsDeadKey
PCr$
?9OAV6b#
HM>d
{yo
}| p6
Random
5Z ]M
@_'nvx
Consts
}FH
set_CanChangePriorityClass
Cs@8^;
]AIt
HZfT
Costura
IntToIp
Pl?'
wu|Y
p1P'
O Bu
InterfaceTypeAttribute
<Target>k__BackingField
AM,W
hz d
9>4b
*l}I
/^#^'.
!^7n(0
{R'>_>
1Ka-
COMPACTING
>*R(M
6Z {
q#mJ/V
3MwW\o'
ZrqXp
j0d=b
LNuF
hDYNz
_ 4h~
IoDd
Zu^
<<7b
9~[L
bg^
|Y&V
9$#X`
ex]9
jd?a
JoFgu
50p
O Ljkf
V5^%
lg9-{Xn
UM X
i |p
UYnw-
Orcus.Shared.NetSerializer
d&[^r
WS_HSCROLL
ifML
xz,08
?8(x
rX'
get_BitsPerPixel
{C=M,
=4z&7
\Qen
+(ka
AZ?#(hU
get_Definition
_databaseConnection
3H2Y
$C4
?TVa
GetAncestorFlags
`,Lr
$3bRwO
7Y8h8
8GiC
M<W;
q]sG [l
h&Zt
SRCINVERT
m(]
ForEach
GetConstructor
get_PSize
tVS[
Zr(*E
~$wVM
CTLCOLOREDIT
_v?0}P
Q&Yw
Nwyt=
cWhq
9!N3
e,H5/
m/vQDx|D8
b,
u"f.~j
{r\7
dwOffset
Z0~G
uQP;
'W7c
9C}]
$$ !
HP_HASHSIZE
r"+
<U6Ix
AssemblyTrademarkAttribute
ZO" j
|y%a
Eb,
e&KQ
FVZ
uyC<
f( 2
EnumDesktopWindowsProc
yE}K
sY Y"
]bLTw
CPL_LAUNCH
A*iI
RSQTME
S*DM
nc?H
P4%G)P
^Ds;
=!:e
Nz%1
add_ExceptionsAvailable
R,SI+D
m _\d
n(9M
/4N>
xH@2+
^.JMt
D+$kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG$kG$k
h>Z<
4k+O
System.Management
7L#]
{r l
StringSplitOptions
dc)tJ
B6Kx
mH0}
2!>g]
JDownloader
GetTcpConnections
- c#
Connected
c@E
;9guRdQ
y@?v7F
<}] "
!d(
~?Ed+
2p&9
DoKeyPress
n+.*
I4H@
set_FormBorderStyle
-uuz
-A=Q
h?Xy
*!V qJ
SYSKEYDOWN
}SY8/
~(VD
_u.'
gLo+
< 6q`
8-W
IEnumerable
P8Ok9nO
gm=5
<mT(
z$l
rXEz
QA
v2Z3
EDBU
get_VerticalResolution
o.h<
IgnoreZOrder
\Ah|
pl!85M,6
9? Y#
{P/~
B,!Z
Uk?H
)+8=
=f#<
Thunderbird
CwzN
VideoMemoryTypeToString
Bbq_
026&
riLu$
F `
Ku-b
<>c__DisplayClass5_1
KnUN[j
tp,1G
m =K
05L3
JrwB
EY\~
O<e68
IME_COMPOSITION
%rW8
#ma+
Ghvm
1Orcus.Shared.Commands.Registry.RegistryValueDWord
UriBuilder
z7N%
S[Dj
d267
2Q)S
YZv4
&+U]
Jk{Uh
.T(
s ?`
|)8@(
get_Name
;9j?
M\o
windowText
*-Y0
)f!C1
o+|.
UpdateCommand
EthernetAdapterData
VC94U
]>eA
DoesUrlMatchWithHash
|!5}~!
XSU
inStr
lastestWindowFromPoint
pr_F
pr_D
r*/ |i
J|[B
3qa=
StartSynFlood
nNh#\
/(4l
P\zXY
$)ctJ
[iOO
&G<RWK
gy _
]s/O
set_Passwords
TFH~
&BB8
No B
BWIg
get_EntrySalt
CHANGECREATIONDATE
2V"
$ 0P
AP?gI
l3-H
pr_9
|F>+
vCr}+\
% }-
H3w _
/VGZ
z)-?cj
)vbT
5b7%
UDP_TABLE_OWNER_PID
e~g,~
_receiveCounters
+bzM2
=5hb
+`J
rJ*
#bi$P
BlockUserInput
StringCollection
y|"yZ
*s9b
'aN=!|n
USER
=}qa@
w@zy
get_Headers
MBUTTONDBLCLK
i!d2
+ r
pass
get_KeyCode
{@.b
Raq[B
. Whm
rd 3
$- 9
set_IsCsvData
w_Wu
R*r,
$k:yG
m3LMP
4.nmi
ZKAf5P
rj&
2$f=
: xMX
SRCCOPY
x`.
OpenReadonlySubKeySafe
~M0
)=Td
Q .v
y:OEf?_
F((
get_Values
Convert
IsSearching
E,uX
h"C*
?XU
MakeUnique
-!%D*NI
_standardInput
Y#;`j
5e,W
{l<S
\J6xY
2o)M
H[OR
=%U[
MouseActivate
EO5IGi=]x
_$[7
aa b
Ev+U
n{ w
?[X
jp"B'
FlagsAttribute
naL
jvO @
J:gp/!
set_KeySize
pXX<
bf|I
dmReserved2
SoundOutDevice
UpdateFromUrlCommand
,4ef
& UK
#njiR
bbX?
op_Subtraction
mSd*)
dwmsEventTime
MN;H
1J>V
Nx(P
Bw%t
ZDuXM8
30Bz
get_Description
nzg"ozg
IEnumSTATURL
xlxx
" [
WH_CBT
uploadInfo
IfVL
P5`+[
yzCy
pSize
get_HasValue
Records
]Qe N
e;Ct:P
SecretId
O7WK }2
pRotateDegrees
defaultDeviceId
LogicalDrive
k :(
|4>?
(Csm,'e
+4'F
J@l 0a
~= :Z2=
3;^%
,U_x\t
nzzf:
get_VolumeScalar
StaticPerformanceData
WindowChanged
Z/#R
_appPath
System.Net
I!\
URL_DONT_SIMPLIFY
z8p,4
S:|;
Ld_:
DROPFILES
\ba%
s XH8
4r,&G19 ~<
[u1=
}[39N
}F\p
v,KT
i+8_%
UYb.i
get_DeviceName
qJ_@
ServiceStartMode
;B,`
[Q;
!8?VL
O*rV
KKi
NextValue
XMEL
)tci
Nm-d
&v7|
)];Q
t&.)
kernel32.dll
d o
get_CustomName
UnD?
qoMp
66I9
Enumerator
NotifyIcon
Image
8Dw*
?sQ
FK/NIn0,
DK3S.
l`x?~
B~H-W
RestoreMouseButtons
e_)W
staticCommandResult
z(mC
(W*2 {l
|Cc\Ax
{=z<~b
uCmd
'&dW
K!.x
9rdt!_
f f]
Uy.:
7m,o
<& "
Lh;K
QNKu
L[j6
JiLh
B/r^n
i1J
Q3ID
jH2+
get_RunLevel
vClp0
get_EntryName
1,,Q
y)EZm
q_1;a
SendText
pHe.
7gE^.(S
CheckRunning
|\?b
ZtC;
( e*f
PENWINLAST
[mz
i`9ck
Regex
2hf&P
N Db
Rrbc;
PlatformID
JsonUtil
$~_;N
[F<m
_Wt4
7F7^7n7
x3skp
Cn_i
k&? 3
kt(x
jbC[
gs?l
5-E[
{`$(iWw
piconinfo
get_IsReady
8[oJ
90ITGM-+O
$3C374A40-BAE4-11CF-BF7D-00AA006946EE
v&YJ
_windows
e"MNc
4hic
_`(b
r}@
get_NewCommandType
0"S=
_sock
p/Uw
A#f:1
Tk#;
GetPath
"r9+,iq9s
MakeAdminCommand
wGSx%
MethodInvoker
a>{W
~k`tOV
remove_CommandLoaded
v uKG
_otherColor
Fst#
8 :F
jo45
R ggn8wQ
MajJ
*o Z
y4w[(>.
n3?Q
Uq7k[
=e1:
pM;m
get_Application
m eSS
!MHs
ResponseResultEventArgs
<IsClosed>k__BackingField
vJ#.
IcmpSockets
JC+5q u[S
G73:
\ n
X`dQ
W {G
5<R
SafeHandleZeroOrMinusOneIsInvalid
J0jh
5q\k
Write
pR 1
pZ+ j
hIcon
<>9__6_1
~d{_n
>A5)
SpeechVoice
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.GetEnumerator
Int64
YE F_ub
AnchorStyles
hs)3
Nw7|g!5?C
PushRequests
&^[o
gjZac
=B m
MainForm
T+G=
<FileTransferTempDirectory>k__BackingField
-e&eo
GK4I
}NnC
xHZTu^
get_VncMessage
\kxH\
NY)S 2
,v Z
%("p
Kf1;
imXu
InternetCommunication
MDISETMENU
=V k<
[w|MAU
get_ValueKind
:q)ns
A4O[K
5{E]
ks/L
Xs_+
jT=+
^>`G
ExecuteCommand
BNj>
g?{\x
jV/o
}Z-w&@
AsymmetricAlgorithm
JM>^W
!}(f
N|pCL
M t^
t_6{*
2gZ`
PwwL{
iHFg?7
';Oo
set_ChangeCreationDate
Fv1T
T&:;7?
^]WT
Action`1
[* y
dataPath
w;iR
.,-H
bBv
I#~ 7
Z,,^
System.Security.Principal
get_ProcessName
a51y
<PushRequests>b__0
UN%ouV
wIY;
GoC3s
SHELLDLL_DefViewParent
.{zq7
`D9V
<g1,
A!uzD
"
^h#qw
K;Pe
JW
get_AvailableFreeSpace
mObject
pZ} Bke
$5KG
STAThreadAttribute
&H%
M>WZ
Graphics
:Ie
q/N;
~LWN
add_StringDown
System.Globalization
JyVLK
C&$
}XX]
` X
f;k|
!Iy{
_X9
eventArgs
set_TryOtherAutostartMethodsIfChosenOneFails
X}m:
WH_CALLWNDPROC
zYQm
IsDE!
=&=}9
mW2}
ConvertToInteger
Oii&#
?z{SXK
<P^\CQ
6_|Pw
h~tp
u& @
[2Wv
\ r{
-fr%
[ 4s
r,*
E28z
nyvQ
jM6S
687|^
System.Drawing.Icon
bB4m
Fo.m
ww~}6n
,8.n
vQ5{
C4N Y
JA$D
]T+ u_
1\q}
qN .
RemoveAt
GFBXM
`,16
Qy52
yMr0
get_Jpeg
[q x
SystemDirectory
yJFn
(4{_
d^A?#&
zP%P
y)W}
CreateInstance
mnQrm
sTl{F
C KN1
+5<Dy
7i4b"
ItHX
_>5]J
ImageExtensions
(4{N
N6~`
MDITILE
= 2L
TVB
a"gJ
UdpFlood
jd R
=P}9
hpsoi
System.Collections
<3_p
MRX}
+/,X
q%/4NO b3
;QP>`H
V@^?
(GEY
<>l%
ENTERIDLE
pkk1
Y,J#
Orcus.Commands.Passwords.Applications.FileZilla
SendInformation
remove_ExceptionsAvailable
8^ie
get_Actions
P_6't
|~EP
1(0A
gRfj
x@-SM
@xlm+
$uR5
1818q8 8
m{Yp
^{CESd
sM.j
>.{vu
,&u&E
dmTTOption
uzdC@
fm)|
tC&P
%2NjOd
set_Padding
,7RL
%riI
nIndex
c_51
5?gC6
peAl
_["Ma
IJTG
,c I
set_EntrySalt
n*07o
get_SendLock
}=\
xCJ;H
C1$Z9
)<z+p
Decimal
zF_V'
0w/.q
!QVg
qB"#
IME_CHAR
NiyB
<y } M
]aASH_
mw@<{
w />o
IET2
%`T
q %.
<Attach>b__0
LocalPort
oaP>a
^AAv%:~
EK6KO
WJBx=
}pnchM>
baseName
:S]Q
,Myz]s
J^Av
g *
<,r9
"2ga
~DnF
O2.-/
k4BPg
-CIs
39Qm
g2V2
i;et
SynFloodCommand
q4Y'm
[oT%
F|s2hk
p u.
vK\w
<>9__22_1
kV3l
Microsoft.CSharp
AssemblyDescriptionAttribute
get_Path
* G}N
^Xby
t7JA7
R.s_\
h9Ph
{,+&
Activator
O/jY
qs~q
Xw30
s1 =
A$Kt
H/4]
_translatedDescriptions
5&[z
ry4
atcfH
SetWindowLong
9gw)
$I8
IsAdministrator
_ I
"zs.
set_Anchor
CDH 7
,}Ic
DN<M.
ParameterModifier
Y%$
;y >
6"'rV
\g/q{
Double
AJ ?
"efnS
iz
eqbb
?~p;8
n=(1
Qs 0[O
uEu`
NormalText
77ba
DI0c
]FiE:
H's1
e ;&
PK11_GetInternalKeySlot
uFlags
CRK j
+%|%
<>9__2_0
}T{;s
>4i_
l^x6W
<>9__2_1
WM_RBUTTONUP
} eT
L 6
;*/
PushFile
W] >
V;5g
get_BaseStream
] 7_
X&cIA<
} C^q%Ay7
Dd7*
S|nc
WINDOWPOSCHANGED
GetSecurityEventLog
2 #
H7st
-lu@Xi
PaddingMode
HL?C
get_AudioData
%M P
% oG
/ kl^
IsOnParallelsDesktop
Gzybe
_D)}
VFwmp
inverse
.2"%Q
MOVING
MENUSELECT
s3:
r31
MyGetKeyboardState
/aho
rt$
"n_
~,&[
90;<{o
^?7z
get_Handles
1S3HM
Kb8k
IX.d{N>A
&;KK
RBUTTONUP
PivJs
TaKR
Socket
filePath
y|\G
MyG_
K!B
x6Bqb
(nvU
#&3@X
cZ<;2'
0(z`Uf9
IEAutoComplteSecretHeader
qL$K
outItemOpt
#ffffff
ftExpires
g_#b8
CHANGECBCHAIN
LeTh,#
gBUf\U
SetWindowPosFlags
get_Device
d^'y
!&=U\
+a$9
P|{*
9)v
rPK8
=-Zl
% o*
J[|"
_cpuPerformanceCounter
get_IsCsvData
*wJ4g[
{I=5
)=|{Y
DSTINVERT
YY}7
YY}6
CG[-6w
#AG
:[UC
get_DesktopHandle
port
,s[.f
TextReader
set_Guid
k+}
#%|$
G,!v
set_Platform
ltp
PG p
ImageUtilities
K0_3
3[,O
Orcus.Service.Properties
t<{b
System.Core
c}JEN
H03C_
})^5
]BEj
nD)
i36]C
B1_.
+) T
Orcus.Commands.Passwords.Applications.Chrome
_SQy
EkI>|
u un;
,#]p
WG~!
>mAgI
D/?V
remove_SendMessage
H>sQP
BYz$
x6:2
xZqvtAr
AssemblyName
qD:b
r}I
V\^.
Pvq
s2_y
.D!T
ToBitmap
z*lp;(8t-
C1qB*
fEVk
|q6W
_sqlDataTypeSize
}X[x
+) m
1a%\
preO
A?Old\
5C/?
requestedAssemblyName
-:CWj
1VY%c
e\abO
4+!^
]R%-
O*oM5.1
*^=@ 6
!wGR
IAtd]U
0=rjD
_commandSelector
Microsoft
#$z0
y![
^" P^_|
Jmr]w
AsynchronousWindowPosition
}PRm
r8Io]
Enum
_cursorLock
Fz n
Loadables
H[(P
K]o:y
7ww2
0_0l0{0
set_Application
CryptReleaseContext
set_ApplicationName
YP3%
Opera
=Pa~H
DESKTOP_WRITEOBJECTS
~fr~:>
>G}W
JY;.I
(u-b
dzV+
k9w*.
zf*Z<X
'1}k:
}n+~
p |
hK214
Y +g
il4l
EXy?)
ProtocolType
~Gm-
A~(u
24{~
DZLu7
M?R9
[gg}
vBg;(
^n-n
Cancel
7lWJ
!/o0
UZ4|C
xjTp
TG;Y
dEQ~
;!;
stream
!E#T7
@0Wv(o
o#)&
248\
$v6b
2'3wJx
} [BH
AX 8h
SetWinEventHook
GETTEXT
l|8/
['dgM
StringExtensions
<Z`Z
e Ed
ReverseProxyConnectedEventArgs
set_VideoMemoryType
-@U?^
/;[F
)1#W#%
u5}$3
)Af.
CNz>
.)rm
c@bTDcF
e<2Y
2AmA
p*rEI
V' SM
\GWQ
Id;pa
DnX0kNYp
bG\>
5Ug^R
@!aQ!`
"k5`zak
]b~k
tD;%`
>OaS
2A z,
loadCerts
_uploadInfo
%;7>
GCHandle
j1|
s66U
jhZb.W
IsOdd
ea.{
ScanCode
i=^\
CompareFileTime
j1O
ComponentResourceManager
{/D-
%`G4o
xx:w
System.ServiceModel.Web
"lN
pg ^G
BRdY
<>9__1_3
<>9__1_2
<>9__1_1
<>9__1_0
<>9__1_6
<>9__1_5
<>9__1_4
HWND_TOP
m3%e
nXDest
0:c?
RcSrw
szDisplayName
Z;CD
r^/?^
@c wfj
LNylw
Y J$5
HttpFloodPackage
c$Fz
Orcus.Commands.Webcam
;Ia8W
-Q[J&
PerformLayout
_reverseProxyClient_Disconnected
D9,5lZ
y1r!-v
{@O6
N27P
FormBorderStyle
k{3Vm"
ti0:
Equals
_gVZ
X=1y
DeferErase
BNq*
<VCode>k__BackingField
MPHC
a/S
OP{<I
5S JS
@s'8
G@.Tw
qN~h0
+3
set_SelectionLength
set_MaxRefreshRate
L0&i4J
<dataList>5__1
pOrX
, (+
J7Xy
dmDisplayOrientation
\LYl
B z
28 E)
+'
Environment
F}r (_
name
Sg`
;\2ti
OxF52
JgQi~
x2NGm
b xO V
Threads
+
set_ProcessTime
_icmpSockets
\g M
5B}C
GCJ
J DK
/ #d
]C9J
qqqK*
:f9a
2Orcus.Shared.Commands.Registry.RegistryValueString
j;/-
c%^&
4<1:
s]^"
2XDUh
aeMK
W@k:
oP_
-QQVo$
l4\O
JN#a
\Sr)[4
set_Workgroup
Zt"G
?^ M
>t G
,G=_
_sent
p Z5
9n$A
PluginsDirectory
y(:_a
QUERYNEWPALETTE
{ Zt
~-CT
rQ8
=yd*
J+[i
wh+KJ^l
WritePlugin
DwfL
t}/p
#`sm
(/]Y$
mLhL
`Oj$
SendToTargetServer
.p V
^O~]
uB8oLqu
D;`o
allProcesses
8~v$
Ve{E
JO?i0
r_|_
5| 9G
b`Mc#
p}\d
(4fUN
SendSyn
$L$*I
{<@G
7zD8
}GhU
PDW_
jSnGJ
>MOo
Wtv*
P'5V
get_CommandResult
ConstructorInfo
o2
H^[cA
SecretId2
SecretId3
SecretId4
SecretId5
SecretId6
aOFM
Start
xbIU
K7HI/.
Socks5ProxyClient
V,xK
(VTV{
F|WO
RotateFlip
DESKTOP_SWITCHDESKTOP
get_ServerConnection
)!!mTZ6
93"|
g[e#
VHt;!
!^jJ>
H04seee
CmdProcess_OutputDataReceived
xP R
|7xtx
.v
System.Collections.IEnumerable.GetEnumerator
B4!
SendTo
{ 6+
Data
EnumUrls
get_Expires
=5,T
CancellationTokenSource
Tr]
p,|EH^
Jtd9f
IClientStartup
"83ByHw
KeyContainerName
?aoKo
~t1[
Awq
c:C9
]Ig
ol
6abz
8l^qI
PzFW
4T Pq
System.IDisposable.Dispose
oY
a$
~P~a
Lid+
YyYN
A>'7d Q|
Lenght
3qh>C
StartUdpFlood
sort
Cq O
g[e}
nc3i
SendIcmp
set_GenerateExecutable
<>3__defaultDeviceId
OperationsLock
oG
6r8f@
'N w
v3CU
,VX|l*
_sendCounters
!This program cannot be run in DOS mode. $
Hg7V
get_Orcus_Service
BWWh
!F}#
#nQZ
8x~;
chXk}
M vy
get_AddressPreferredLifetime
{*Cl
NlW*
TY(f~
gL6p
CsvRecords
OfType
x_5R
:VAN
<IsEnabled>k__BackingField
MDm(lA
l~@b
V"dm%We
i Gh
EthernetAdapter
j8ea{
==D}
Orcus.Commands.UserInteraction
writer
`-yb
H/lg1
q_p{
kA~8G
dwActiveProcessorMask
^)=*Iv
Zbg$*
O I<
set_AvailableResolutions
5UK)-B]
Screen
owningPid
GlobalSalt
!rYj
|{_@
|eM}).0
|>WZ R4_
9g]v
sUr:7
w5al
WO[V
8nht
}B \
SocketFlags
yJI/S
g2i
a h!
HTMENU
3E\s
httpData
_E}(
`hAfhAfhAfhAfhAfhAfhAfh
jf<YX5
lk2b%
MIB_UDPTABLE_OWNER_PID
!1e8
~fKMs
SW_HIDE
"Eb6
Jso$
set_HideFile
CrAF
srZ~^~A
FC0
<L*4F
dV%"e'9
HOTKEY
vNxv
<f*?
h9Vg
KeyboardHookProc
localPort1
set_Ipv6Address
Qx}3
get_ExceptionFile
lWJl
Bn6F
Q9h|u
e $ul2
8?w~
<,=6
CJs7
R> _
StartIcmpFlood
wk+>E
akw=
Byte
Left
?n.4V
cah[G*M
containerName
YJz)
# 6
MoveNext
o,5;d
$)xl
x\{?
lParam
6Rl'
Socks4aProxyClient
F#)
7eT!
Fc]s
QKrmr<
x6@j
RF`=`
4L\<
A~3b
n6 y}.W
<SendInformation>b__0_0
<SendInformation>b__0_1
mD;1;B
<SendInformation>b__0_3
0zbx
wLRM
Jmp@oo
GetUrlHashString
wHg&)
zhX#
H-c
ADDH
psfi
`|Xb
q y9
MOUSEWHEEL
p#n'f#
M*>H
k|<p~
%a<S<
DB)F
z&?|
?9F 9I
/ /
flc=
,"\XS:
sW<Ra
4Tef
WebException
}%{g
v',7
~-t7
e&gC}
Cu ]/
KC d
G >
9\I
T=_V
UninstallButton
pkHG
set_ManufactureId
t]I5
06^1
rv'
set_AudioEndpointType
oE=HS
r~!
t"W ]
d*\$
04-XL/
rkr$t0 e
}W `h
MI?I
Iyj
V{Ms
ptEx
e/nX
add_AssemblyResolve
vID^:
[qTW
hKRt
Pywo'
IList
G [(
(dd:
+Hmq
=q<W
Vs:c
&uS?8
User32.dll
4wFx]
HashParameters
dmFields
YHw
GW_HWNDNEXT
b/ y
bI?`
FW40
=*M?
TrimStart
Orcus.Shared.Commands.HostsFile
ChromiumBase
SystemInformation
get_Item
configDir
}w&5
TmO4
%I5Y
Location
3Qe>
HOh
8bnq+t
CHARTOITEM
GEwC
dmSpecVersion
X= *
k?~P
JavaScriptSerializer
uSzed
o)5kj$Ov
h@:h3@ y
u,I4(
mmDeviceCollection
~&W)B
F 64FA
y<yqa
x+7gqY
m Mj0
JT*)
y#3@?6
|s2D
E\Uw
, r
Z#JW
d?DH
QP1Nj
Gv@[L?
/O-z6
J^za
}m:\
FindWindowEx
C:4b
z.=M#
G u
d~nvnaZ
!Qm+@
+$Nk
NSS_InitPtr
4:,a9
$?/BT
N+j,
LOLUQG
<StaticCommands>k__BackingField
IpU"
^T zV
-wSS
&X |
T3,'
Pi^G
v p>
s4%c
J; tj
get_IsCancellationRequested
\N,
4gh4 v
x6`\ u
( Q
P%G
p? 3'
.65T
#FMz
*sHr
Open
GetHdc
M%5#
<T F
_currentHvncDesktop
X7fT
Om;<
gKC%
F-W1
9-s+
[x
nZvX
Q&!;6
SortFileTimeAscendingHelper
'u}}X
d<a0(p
GW_HWNDFIRST
G$;, A
a)&73W
Format
_ ^+
T2
WINEVENT_OUTOFCONTEXT
<iOa
WH_MOUSE_LL
jvl(
UnhandledExceptionMode
,`$)
s%;_
I{$?
2PD}
x ObD
pT8&
N'Y>
<VncMessage>k__BackingField
_@Ft
IZb!
StringDownEventArgs
mR=J
enumAudioEndpoint
x`H>
u<?
WindowsInput
iXo.
Z~tL1
<Exists>b__0
e KT
2gWBv
~Y[sq
K[nX
LinqExtensions
<>m__Finally3
o?Zq*
)Y^=X
<),Hol
<>m__Finally4
j J15
xB}BC
K K,q
0eK"
YSM4[
B~8D
6 sY\
components
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
nh19
.:R
^] y8
[5dv
YSY
>fBy
*Ow6
< 9j
Js8#Z
La34
>t.8k!J
?;xr
x|,=
[a[/
ZpsT
| \k
~633u
X_*\wY
r <
34vy-
d Q?
ILC_COLORDDB
JGU=)
h*PkR
p=\K
BH7
remotePort1
uYiQ
&=F-
Yq_>
managementObject
A2+A
Minute
<b1
o (sV
S`wY
p*rGH
remotePort4
Group
set_AutoSize
1+i 4a
$ak*
WebClient
/B8z
AnVu
L5`y
A&hCA
2/=GB
36%K
vkcode
|H)A
eB8l
MDIGETACTIVE
%eK,
stFw+y{]
-.*l
color
.]<p
a#d
KCn?
UUID
*;G;
BitString
3)#`
m >n,
{i9aa
l-
<>1__state
;9HN
EnumerateDevices
8rzi
si 9t
at]
Mj[q
CcJW"
dH{F
SendProcesses
4~[8
$ZV
get_KeySize
o%byx
S#_b
table
_host
b0(
ServerPackage
p#p3p;
})"L
~\X[
Fz5d.
Rfa"m
1Mqa
a >,
add_OutputDataReceived
set_MaximizeBox
Wk|W
ReadByte
"?V
uoT~f
"^5%
G+)E
Bo :q
lpBuffer
7O_.
NCXBUTTONDOWN
IYef
wmr>
E2_]
^>||
;,&wp @W
L,P&
&UQf
2KF-_D
CodeDomProvider
\_6R
get_RegistryHive
w:jo
)[F`
VL~o
:xM
d %d
]"6e
|Uq)
SendServerPackage
_stopwatch
Fhy!
*"/"?b6
-eOD
M8At
v5Ae4IN
(O`z=
AllocHGlobal
n;#}
*T-R
<6wg
(c1L
iI9;
CLy,
Orcus.Service.Core
4FN?
97 d
q r ?M
^75k
EnumDisplaySettings
<S|[
4ER
~J8z
<AvailablePlugins>k__BackingField
/g?g
RxG
BitmapData
9_)v$
CSCore.Win32
2RT:B
V]uh
.sgu
_filePushRequests
[]8I
XzX4
J6tP3P
&$itoM
$A=K
MozillaPBE
`aJ;
Cx?&
R1gc
FRzxo
\X;ra
|6a
MOUSEFIRST
}6/t
Z fB
C$<o'
hkResult
E@ )
U%'<
Compute
FileNotFoundException
O\e.
X$5ib
y.qt
TASKSCHREQUESTHIGHESTPRIVILEGES
h;h
,]a4
'\ ,=
+-:(
+'r1A
R\K%
get_Keys
<Module>
\? A
c^c= e
UWkZ
IndexOf
WH_MOUSE
:}gs
set_AvailableFreeSpace
Pm"c
Twq:
9;bC
A Z&
7Lo
4a'A
OTM
27N F
HSHELL_WINDOWREPLACED
C|1&z
4#6X
V=,"
/-O
g H
*M&1
S9m
MK_LBUTTON
StringUp
H o
&)U'B^
PQI,
ForceClose
.VT]
HD(k
,Jb^SX
;P;
]MWF=
#GlV
8,xy
wgh,
?O\y
!:sH
W E;
iphlpapi.dll
IsPrintableKey
set_RenderedWindowHandle
'|:`
gdRH)
3KHc
7ZJ
MD5CryptoServiceProvider
9E;b
"dzgJ
v6'm
PzD3
get_SystemDirectory
rS?
0at0
bv&<S>
w+8w
qK0j
<GetOperatingSystemInformation>b__2
2 ,b
zI]r
i;p@
Y%udW
:l&--
set_Interval
|V !
.NE=
z]Qg
BerkeleyDb
8#X2h
Orcus.Commands.AudioVolumeControl
!R*GJ'I
MulticastDelegate
MRTJ
_?oo
3L )
j.wB
Zs\G
Oa<z
GetExtendedUdpTable
;O>q
TaskRunLevel
[JU3
&E4J
Ix~t>A
Yz,:
eventType
B`Q+T
get_Uri
AutoScaleMode
6M"F
`W$T
Nm} F
wc C
get_LastUpdated
gn%qO
WxK*
q5~#
M(N?NVN
MBUTTONDOWN
BbO
z ww
e}k<
6OD*
12TH
nI,sz
SYSTEM_INFO
MainRichTextBox
u$y3
ZY>=
ZYTSV
q[p;8
3yk8y
IDatabaseConnection
RegistryValueKind
5h#\
`ElU.V
.o-}
o6"A%`
f50(
GoG=!
DWMWINDOWMAXIMIZEDCHANGE
)/L95
N;@Q
.r-/(
k&?
B1 m
CreateDesktopInformation
m'%os
P_=2z
|r>Uj7,siX
0G 8G/
CallNextHookEx
QV8"
9} M
ShowMessage
% .(ps
6=:],
`Zlj
*V,9/e#
Binding
TUca
dJJtl
+$ig
FH{H
H` ,NZ
=/wN
dmDitherType
lisb
set_MaxBufferSize
Q0Ri
zO4~
?+6X
*-_4
MC"rf
cOb\E
A6NV7K
}GR
FileTransferCompleted
-I:v
1nNIcG
B?f,
p*<b
AsO
Niyv
K !
FnT2
+OtvV
)\[H[
tr4I
Jsy#
g'-K
qx9
uZ 7
n6OW
9=71k
<Passwordcheck>k__BackingField
[x~'
)l1v
(Q :
z(zL
)l1k
Wt;<=
!s5>
gF:[
oTo{ )
='n*
VCp
j\mo
idThread
><{;
h)Ox
xj!
7< kpyR(mh
E!AIw
8kZp
8Awn
k&? ~
ka!"7
;I=B
<LoadPlugins>b__22_1
hWxO
l83_
%7JU
set_RegistryHive
DESTROY
za,S/
Tlp"CC0H
ZtD):
>1_^
M#U-
9"u-
Re4ZhJg
#Lxg
!<!Z
y+1<
)1B|
&!Yo
JFR:
set_AvailableMemory
-|g1
oS
nk6e2
StaticCommands
Y\VB
bmJ,<
n4hhn[
Style
.~)Oq
FileZilla
/acEz'O`
`i5"
#5H
c3z;{
g?!J-
System.ServiceProcess
op_Equality
leJ D
_activeWindowHook
b _M
4Qgc;
us q
get_WorkingArea
94 `
72? N
ReflectionTypeLoadException
m8;p
'88~
qqXW
Pt*\
| m&
LBUTTONDBLCLK
lmN(
=mc{
KDolx
YHn
9 y
P"$
iRZ|
>iV6X?L
.Nj?
0jK-4
INPUTLANGCHANGEREQUEST
hHash
NI2D
w 5
dwParam
ZYboW~a
&aH3
get_PrivateMemorySize64
N!Q:g
6OwF\
d)Q`}a
1~7$HQ_
=K N
J{ye
@Pp
gE5L
DataFlow
_unloadLock
get_UrlString
6qw.~}
d[Q6
get_Parent
<z /#
\6=
Taw]
VOr@MV
_encoding
8}Lv
g4:i
Ry&d
DiE2
Z:I
AC>(d
uy6ta
>T^6
K~'K:
dmColor
ZXT8"bG
DesktopWallpaperStyle
costura.orcus.plugins.dll.zip
!# y/s
ReadLine
DESTROYCLIPBOARD
8H\o
wVgPZ
f{}{
1Bf;
UrlString
l17a
WLfA
h'zE
}rhF
Np/\
f`/p
<f):5
PrintWindow
@GKZCv
6MA(
E4F(
<'9
$T}aR
ye =
WY!I
set_StartTime
!_A
q=z&C
set_ProtocolName
B +
"N%
Ucv0'
yNq?
p? 11
;&X{
fnJV
Dq{[d6[
B\Ym
get_StaticCommands
fids
@~ZV
\}%(vS
VAaE}/
?~I?""
u!Y"VkH
lfg;
.?[wI
rv~_
8Yh H?If
XNF=
Bottom
l\!</p5Z^$C
ba={.~
<dCR
7&>s
I O3
n?]V
N FY
^9%uZK
IZ 4
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.Current
;F6
>u\
GetIconFromPath
tu 4
KhUO
style
f$B!
QUEUESYNC
dV@NFj#
\9Yu
% ty
;7t[
}a$Y
add_ErrorDataReceived
Binder
taZv
3MscY
set_IsEmpty
)nk<H%
^tx!\
)2 O
B)L9
Ri 5
get_FactoryCommandPlugins
SC_HSCROLL
ProtectedData
AppendLine
dVKf
5 WS
gdi32.dll
GetCommandLineArgs
#j],)
e *H
\VC.
Rpx[
jHc!
a3<@o
0u J
M2t
"WG+l
\:Of
7BY.U
X4t7
=@d3
H<7+

<Decrypt>b__1_0
GetTickCount
IEur
<DesktopName>k__BackingField
3(BJ
aP9d
SendMessageTimeout
=UAfW
LivePerformanceCommunication
Mzb]
<E!@7So#
0M}*
+k$H
Da]E
~ n.
*7(-J
c4bN
f(cZ
+ W9
Z)AG
}QExs
dL #
forcePush
_JRd
'7yk!
tvt<K
?Pw=
*~e
pE 7
unknown
!B !
\-Xj
zZ(#
zt(
Bz D
?_Sd
;V@;
J"| _$
ACTIVATE
hB [c{N~t
f"4M
get_Stride
7Pvw
r H|/
dmLogPixels
set_MemorySpeed
< W'^
SHr(
[#8X-F
2|Z}
get_PluginVersion
Ca:Z
QX%|%|+t
Block
TextBox
NPf=
> Fh7
{BR/K
CkJ0<
a.DLL
_instance
wx\
?V B?J
9<r
set_IsEnabled
/)2v
DataContractJsonSerializer
+G[b}
<`:R{
ErI
eMW/
RsaEncryptor
KillButton_Click
S+^i
{zK
@lhB
dwPageSize
ToSingle
HTHELP
<Port>k__BackingField
X-GJX
cM u6
${N3K
SRd~
kyi
2VvTp
6,7qJ8n
h=C=
he6
c|J1?a\
-S zA?
&oIE
MasterPassword
IsDataAvailable
B+<%2D
pg!6B
- |A`
set_IconBytes
>6IKS
`q(;
ZN0g
MFEA
K6v&
]p9#
2fxA
jD@0
lpfnWinEventProc
6z K
InitializeArray
#Y,N
LocalEndpoint
o}I~ |r
JJ@!
&I(R(e(u(
L%g&
`8H\
!NW[
Orcus
b&ZG@ T
?%o.
4/aM
Orcus.Shared.Commands.ClientAction
6i<u
PtOj
hDci
m{u.
x/$;
R3r!
LBUTTONDOWN
li)?
RsaHelper
ud\U!6
ph2<
#Rvi
@@]&l
P IJ
<AddToAutostart>b__0
zq}''P
Tl9]
Y16IL$_
Drm[[
eYz
5]Hh
TimeSpan
k(?G,
!~1:
dD F
yY!2
YR\Y
)O8,A
x. G
desktopWindow
]#*ru
9Dmcm
o] O
r'+
set_WorkingSet
set_AddressFamily
cV*l
v[,hh
ResponseBytesEventArgs
ManagementObjectSearcher
g e,
<6tY!
Dz z
q6_j
3 8?{
63CU
>1Bo
`p9\
=H{Q
!1 a
cgd"
DPya:
#/o|
@?r"W ;
O\0~
ZJm(V
k@ =o
n6T>
UtRR
dO[O
jT`~
YUva
c '
{`rc
Form
??Z7
\1CW>qC
IsOnVirtualPc
8'mV
//X\5}
recoverCookies
!W}U
G P45V
DataReceivedEventHandler
set_DriveFormat
&2H
^Wz-
RemoteDesktopCommunication
vA}z
IWaveSource
&6v-
FilterInfo
LiveKeyloggerCommunication
_keyboardHook_StringUp
i6CbB
DDoSManager
a["
PtrToStructure
Degrees180
I=D=
FileInfo
%h#/+C
/i//
PackageReceived
yEGR
'hMb
RegistryKeyPermissionCheck
}@Y]
@L=+
8 *z
&,W>=
D? Y
a4o%c
GW_CHILD
SF`[~
q%y h
PG u
tq=/
AddLast
: N&{
mikiv6
R~kW
icmpData
set_L2CacheSize
bHrO
{IvVGNq
pe9Id
'q?L
3]q72s
's
Pez91
GetAssemblies
<>c__DisplayClass6_0
r*R/
<E F
K{i~
iqag
T33{+A
Nk :
cy S
SXL/
Dy5m[
ExpandEnvironmentVariables
R |l
get_Shield
r*!
},I
<ValueKind>k__BackingField
ha/[
W%;a
add_Elapsed
SendMessage
1oII
UDP_TABLE_BASIC
8 G0
r ;W4"P
x+syp
1-?
FindTask
/6`'?
set_IsDefault
4i=m
lOJN
SbbR
6Q(
gL v
8}.c
E [.
3lS9
|Iv^
SysListView32
X$<=&
$}F{
NCHITTEST
set_VideoProcessor
ProcessNames
7m6H
gqd
bO/
G wc
mV<_
8w48?
=xz5
set_IsVisible
@6/b
,a.?
] v)8
t.V?
nQ9@
serverPackageType
0XH!i
c<Uy
Path
,MaL%
5<!
Ik@|
%cD-
S_sQ;k
m. Q A
059
ag34
^!N)
get_TwoLetterISORegionName
ICONERASEBKGND
-+vO
`q\T`k
R}E0
=S~N<^
&]La.
<Value>k__BackingField
Ku[
*T 1
"E1)
NEWCREATIONDATE
,W s
&"?A
S U~ ?.
'j[g
GaVJ{'
}#%z
/gy)
littleEndian
MessageBoxCommand
5 X<
m=xz
E 4M
SendButton_Click
3)_k
BlockCopy
3-R+
?iB)
lpRect
&Q\
Orcus.Commands.Console
BmIUO
u[wT0
2KFX
\%4 $
i\f#
R!wj4f
B~dA
N=|M
shelldllDefView
TdF
isCs
Q$0
GetAllNetworkInterfaces
DF1b
gfKAr
$"BM
FileTime
)L+\R
get_Handle
{NCG
bL [
_obj
*^~
Yx4>
)%\(
CSharpCodeProvider
26q=c'/C}
NativeMethods
wj?S
T\5i6!+T
StringBuilder
W@N}
x>t(
3@(b
get_TextLength
G&n4
UnhookWinEvent
p<UTj
7IHf_
yN{,h
#|\ @
^?Bf
dwXCountChars
Au6b>
*^
get_Errors
L):uE
PM4Jk
<ShowWindow>b__0
y`~7
NCCREATE
C<B`
<dh8
E(/R iL
F5o0
%r1
COMPAREITEM
CompilerGeneratedAttribute
pocsTitle
5nt1
[U_>
FactoryCommand
%oh{
6$59
9m1EK
%[iL
mt c
3<[Z
pr'
.[<y
"y@G
GetFile
h a#
get_Extension
result
,BCT
CHc?-3
`*&*vq
u-lC
get_DatabaseConnection
get_ItemOf
{.3#
"Y9!-
/~jm
O =y
N[x[
rK;^
aryDes
z2:vK
Pw3
:Xpt
CLEAR
get_IV
set_ClientPath
ZOEkxq
gF5"t
U JB
timeCreated
layoutId
Mi o
set_IsKeyloggerEnabled
ef rUh!
FO:
PS 5
PAINTICON
7%dbx
]D-#
C8^<
3]>i
FW6
get_Ip
-Br
|l*J
| u5
2|wu
lm@^
@'v(
get_Id
get_ForeColor
SECItemType
O%wv3u
<.Zl
<7Z[#xnT
)/'"]
sslStream
B u<,
e.2mi
eo5\
Ng@8
c$mP
Zu6Z
=P5@QmP
U: =*kf
@ |s
-hmv
8AC
[&k{
N//
(/
l3_|(
arySrc
JnKzZ
PLUGINS
H8jjep;
TCP_TABLE_BASIC_LISTENER
Z|9NEG
symbolNames
\8^&T
<>9__9_0
set_SuppressKeyPress
xuYmd
EycO
':Wlt
Initialize
GetAddressBytes
IME_ENDCOMPOSITION
;A/E
ActiveConnection
n2E}
o0o*
P Y>V
Last
5mad
dUEO+
g3B|
enable
SendTextMessageEventArgs
DrawDesktop
3_0{]
c3A 5
ree:_H
JT&y
BxV!<
Orcus.Shared.Commands.FunActions
TCP_TABLE_OWNER_PID_ALL
~4!NR
WCF_PAINTMETHOD_PAINT
get_Unicode
HJo944J
set_Verb
Y b }
$O4QX~
_hookDelegate
WindowHandles
_h=O
71zSM
P_T:k
get_ConnectionId
set_VolumeLabel
#f>A^
i}l@8
PasswordRecoveryCommand
HTOBJECT
\`(
6c-w
:_?#J
)<MQtF
>6 6
7w9'
'.&`
h#M{
ftLastUpdated
w`'z
bPM}10u
IRV,
'#z=
`\;AR
GetCpuSpeedInGHz
PCTz
h}C}
mBO <
,!AQ6
RxC oH
`%M)
Gzqm
PbHL
<LPyE
-1x {
o`Gr
get_EntryType
#Z Y8M
<7T(
Orcus.Shared.Plugins
9zo
Yandex
\g;"
VQvj
Orcus.Shared.Commands.EventLog
u/@#z
mx: ;
m[x
G[ sM
&f,d3g
7h;]
o=b`i
_tBg0
\_nGh
Command
CompilerError
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.Current
zZml_f C
<2"M
x`L"
J%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'I%'I%
#333333
TsF >
Tig/
6X~}
n8g2
PAINT
RSKA
)si1H
R/>~4
.W._
v\c=
get_Top
v`SL5
<foFgF3S
Kx>a
| MP
$#:|
|d7e5W
+;8S
yrc|
i) 1
(WkJfG
get_ReferencedAssemblies
\6C,
{& &
t^ggP
EditorBrowsableAttribute
CP$6G
5P5p5
`Cb}C
get_Image
l\ti
]t,b[
fas@
' DH
ihhi
&4YA
JXdK
l2d>
CarriageReturnAndLineFeedReplacement
EK)E
c>"#Z
j0-Y
h]ff
g o<Z+
c/u
WM_LBUTTONDOWN
_|b7
=5@FG
{&)pf
"neqw6L
1-P;
get_DriveFormat
nXSrc
|Ys
A8!8
_sslStream
x:rF
Pz_H
PV e
state
E/yY
b?^,
)r E0 |J
Ohb (:WI*
Load
i9E,
1^|w
+KMS2M
EiB0
; q d
2F3b
Nkl8
set_IsClosed
[t{
lxo
shell32.dll
&VBd4
CurrentUser
nir|''
%8|-
;a;*2
|&)_
9Of;B
IME_KEYUP
SIl:
yeRAi
yu==
V"nl
lJRc
<nPx a
Attach
Y y}
get_IsConnected
BeginInvoke
GetValueOrDefault
lte-4{
Orcus.Shared.Compression
dEK4
ProcessId
q h1
F(YE
TDOT
AddMilliseconds
q;~?
7E<:
fl%>
"dhc
$q|2r
i7H/
B:9<\
setRunAsAdminFlag
BNYGW
g#~H
Nspd
ICONINFO
p }pB
gZP-
G*.V
"!oA
MQ.!
C? }
bG&H
O'i
SHGFI_ICONLOCATION
A~,RK
EntryName
S}g
_receiveLock
3bOs
get_Entries
?4L
c@T\f
\W:
U96Iy
M$:U5
uJ-g
<IsDataAvailable>k__BackingField
IE+X+
cv;zA
GetMozgluePath
Py4W
~>}l-
9jc/H
(&wu2
,qjy
P+PIPYP
QF'K
e@[=j
get_TickCount
gIm=
_U?vx
M,CzDC
<LoadPlugins>b__22_2
lkJ(
)$z
Ge "
MKgS
Q:8Ne
5bZC
4E9P
<LoadPlugins>b__22_0
%aI{
- \8
>7v}
Time
%? w
fNFFz
^N({@
add_KeyUp
e~O$
U:[c@
dGGM
_G.Gl
pCIN
^{Hl
dGGu
*cR/
1/~dM
get_StandardInput
g|h'
cpBBe
Orcus.Service.WindowsService.resources
_lastWindowTitle
I% z
qis!
dmYResolution
C:L ;7
4S^p
}_9|
tks |!
X 1r?
JEx>
)
6&c\p
27HwfM
\p@
|LN|
L.jS
D#n!
FBXq
ExceptionInfo
KeyboardHookStruct
rk>O
Px38|
w7Ma
pr@#
<bz:
,))w
i4x_
'N~s
V."-
CDS_TEST
,h"V
trg8
caseInsensitive
G+V%
)9]3
dS$*
lH:b
2 rh'
/IU?)
E{-y
sw*K
<EntrySalt>k__BackingField
[m ?
`N/U
i(.w
]|qb'Yr%]
SYSCOMMAND
<GetOperatingSystemInformation>b__4
)~E!
<$8\7
e~OO
Orcus.Commands.ClientAction
p}f)Z
$<>f
Packages
F0Y3
(pk ~W
~KM VS
tn(vv
> <7
`qK0
at!s
;L W6
gP>h
//y{
fc%]
(!E
&8Tk?
H<Hcs>M
Sj>z"]_
g ) SA
@XfI
1t3:
L/s&p+
@0NX
cPcnz
xs_p{
)2*%
<>7__wrap3
<>7__wrap2
<>7__wrap1
fnr)
zi?OI5
<>7__wrap4
<*x
Ri-P
@9AJASAaA|A
L\ |L
S_YI
AllAccess
zrbfk
VMyn
<,d8
X!G
v.&rH
ResponseByte
q(5Q[6
=Ga5.
desktopHandle
f` z
H y
=Fw5
dsy7
t ->
wShowWindow
]FJ
/'yt
m:6a
FieldInfo
qB>
B'%t
3;9O ]
ON~q
I}Jjv
(G=2
<CommandCollection>k__BackingField
O> \r
e Y =
040KY
\$W)g;eJ]KY`z
sh(q
<@ }eY{x
'! Q
>D! .
<mb7
5ZNM
HgR\
J2A!M
w|Gx
1 ty
l9Ty
3<:W4Gy
get_Bottom
qeo !
g~7u;
lQ~Y
7x,j
_lastWasDeadKey
}uIfO
BsC
tgYL
a\WI
aH7R
H_uqC
.ZRT
QPfwv
3a>
?!^;
lpMaximumApplicationAddress
r^(P
_0v%b
<PSize>k__BackingField
"$T{
7X9Q8
8*3w:2
D6?g
Lv>M
3-*5
get_DirectoryName
y"4_
b}O!
_$7>~<|
2g R
D9c/
Kc ;
P (2
qG~g
smC]#
Q'r4
n$tW
costura.microsoft.win32.taskscheduler.dll.zip
s\1T$
RcD3/
?aW#
chEG)
uB;4
f*KAq
s83C
;:(Zmu
Z !#
mFfuP$_W7Cs{(
Y ~M
i'4q
Orcus.Shared.DynamicCommands
eWKl
=$zI,$q=
SendError
<.\:
<GetAudioDevices>b__4_0
T6GTS
1.}U
wqwu
F'`+
<FrameworkVersion>k__BackingField
5<J<n
keyDown
1d-J
tJC|Y>i
MessageTextBox
d^rs
<AdministrationConnections>k__BackingField
lparam
hS</d?+z1
commandResult
L&/Y
vr4y
U+J&
L4_z
IME_CONTROL
[dVt
LoadPlugin
%DEy
set_AppContext
FJ%6
{cezz
c%9d
M`-(Yu
FormStartPosition
V"N1O
U"_`
GTT
isInstalled
MessageBoxIcon
;[`Sa \-
GetValueNames
set_ExternalClockSpeed
qzwU\
6 \X
System.Threading
set_PublicIp
65pK
` g
65:A o
oD5X
TimeHelper
,<:j
q''0m4&
$ [*k
AsyncReceive
ZiS [
UnhandledExceptionEventHandler
3!&
eGlP
Yv4d
GeKG
set_IsReady
GetDirectories
:m 9
_5@*3m
lQ)s
?u^Ib
set_Item
e8Cj
1 Nr]^
wohD}U
3=Uz
~b/q
e(S_%C
GetHostName
i8m!
RP&7
sQ^o9
sydD
YiE
0 Nfs
'=!`
MMDevice
[G$$
Trigger
[4zo
m#5N]
efgfw
Qvi+
encryptedPassword
>sG0
^9L9c _
rM!2
!:R~
Orcus.Shared.Commands.UninstallPrograms
get_Current
>qiv
A]X;R[
Rectangle
t_nX
JMpEk
RotateFlipType
w^a}
:d.m
9yu7
<GetOperatingSystemInformation>b__1
SetCompatibleTextRenderingDefault
Task
xm4p
efYS
n8=L
% !*
;1Q;
@UfB
+1r,
n jU
get_TotalSeconds
<>c__DisplayClass0_1
r,j]
Y;2t
yqG&
G|:_
fFO$
AsyncOperationManager
rXF?{
r%ZP
-qgU
N-Oo
paE&
OVZf
n{;X
o=E[O
BlockInput
C0'
`3Ug
vi@lMJ
zQvw
currentFile
dms$
RvUO
j2J6
G#b5R\
dwTime
Compress
DoAction
_keyProcessing_StringDown
$/PL
x{^4
Ohj
#eX9
az&H
kEJT
Next
EndsWith
@W*Z
4Vq]
T G(
d;zig
w^M2
set_SelectionColor
DISP_CHANGE_RESTART
*Vsd
(oZ?
SPIF_UPDATEINIFILE
I}i~
n<!!
!v ^p
5k]Ey
Z%9$&
+6(S
,y|4K
uW=X
&I;n
get_Objects
VvibE
[ zz
set_ProxyOption
q^y#
t#;(
T{LM
set_Timestamp
ndu|
dictionary
Fr}T
n<!E
SynSockets
L1V4
ANUp
7#v&
VE)c
H[WK"
culture
*@a
;IV#
5k j
Xt z2
sRT{
~Dp;
3p)V
? /
wP:fSEv
5,ry
MyEnumThreadWindowsProc
<'=&
q>x
EVENT_OBJECT_NAMECHANGE
"W^Wb
5W)/
4rl
MAKELPARAM
Disconnect
fVo
|d f
WebcamSettings
)0jI
k&?
S?a87
S`CA\
pT6>
R+^Nf
N)RH
}9xPi
HX;h
CreateCompatibleDC
L8@\
get_HvncActions
timestamp
.7px
Ja ~
`9AT0
HBjD
El_dx
hideFile
~"; G
?$XN
E!'RN
eo"Ai'
get_AutoResetEvent
set_ProxyHost
WH_CALLWNDPROCRET
pa
BYr4
Rfr|
Fk 5E
get_DesktopName
HY>v
ah~_
I;K|sENp
&+ N
xHotspot
%yYb
qR8O.v
SYSCHAR
;Xc4
H~Cy)
y $a
I7%5'=
OH ?
'#AGv
;uD7W
_@@
Bg%t
EventLogCommunication
GetHashCode
UBWC
w2Z0
SetWindowsHookEx
set_DesktopName
YiiYh
&1B6
sX6 ^
WriteByte
GetTypeFromHandle
IAsyncResult
Yvm
FileAttributes
Kgc O
zk^}
sdUJG
Oin#
U8OF
l=[Y
+e JY/
TextChatCommunication
Z }+9
;OxW
rPli
AccessRights
GetDelegateForFunctionPointer
^^yD
/bF:h.Pu
pO?C
IgjxA
rD'
'|u]U
ButtonBase
GetBytes
B|8'
WfC?k
]NOg
~#y
>mJH(,
nmi&
IcmpFlood
4Z&a
iu@3c1
7dRK
Bq!u
BdFZ
>PH?A{
2N E
Nqi
b.wB
X/@W
?Xxc
childAfter
W|&l
dwOutBufLen
Q|/V
System.Runtime.Serialization
gU,8
u x`{< _Z
$g@h
tqCokmZ
k+>$
(|D=
\]*5
X Zt
# ^
BiJ6
SHGetFileInfo
J)wDa+G
KeyUp
-.,-
qJfX&3,
C^zw
o$Z#8
4iyF
GetProcessById
lpFileTime
`*Fy
x (.
v0.p
;nW'
Ujf1
VB.1
V^i3
Cug= C
p$B D
LoadLibrary
YSA>Z77
IESecretInfoHeader
:EG]
ResponseResult
NewFrameEventArgs
System.Runtime.InteropServices
set_TotalMemorySlots
RegistryExtensions
MA_NOACTIVATE
soundOut
Jm!x
GetSystemProxy
DRAWCLIPBOARD
r{Wv
E_W/
wZbz
<wK}P
Py*2
in+^
s
}oX78
1T9&
~
[9}$
VSCROLLCLIPBOARD
.d&8@Ab
`t;Sc
&Vn7
Mu!y
NOTSRCERASE
xBpa
o
_N,'Chb
o(l8
&pZ
MNip
/n:>YL<
W,"
#j#i6
Is7/
<GlobalSalt>k__BackingField
IaN/
System.Runtime.CompilerServices
_Ras
cN9'
ioy2
_currentConnectionInfo
[}+W78%
o;S-c
#[5W
WS_OVERLAPPEDWINDOW
<-9M
)O)w+w)!
[9}j
hF}4
0!XpCK
,.,c
Li$d
"o?*}
C/A$]
eg$@
FileDownloader
,
-
hProcess
(
Q/]]mF
+ r?A
J?
ReadObject
:so(
V9Fg
K#1;"&
set_AutoScaleDimensions
CTLCOLORBTN
*bs
oU3z
HECi
-; =
/+1A
PxlN
j+O
%r+>
[GYA
dmDuplex
"M;8fhk?2
QNka
l8g
aB[k
7AZ
2e!"e
get_MasterVolumeLevelScalar
6Zrz
&
buZX
/*|nm
p f#,
96?#
get_Client
AYP5"v
\XS_
System.Windows.Forms
rO"iDP
^7
Hu>l
OperationContractAttribute
UIntPtr
_=.d
Unprotect
Otn
get_Gender
!O6
SC_MOVE
W!cU5
mU?Cm
CSCore.Codecs.MP3
\CwN
N=e:
Sioy
x8uyF
:oP_
Firefox
SECItemLen
EQXP
v)+r
SN O
&k:!
M6?I
X UL(
- EkXB
cG{l
$ehV ^
+{zx
5}ih
UY,Q
O^q8
;J=h
#sxtk
TmRJt
MENUCOMMAND
_pDHJ
#}uQ
c83)
od^:
@0)=
CompressionMode
Enter
_floodingJob
X>2-
;BVs
Lt.E
* i
%Tr2UT
dwYCountChars
^C=B
i? x
*Wg8
YMjF
xT0*\
}YQe&D
Q=?gb
ZTZ OWi-b
"z%R2
Y~8/
set_L2Cache
WMV25
tfKQ
>#l.
Gc]#!
V+z{-
W9-
4K~DFJ
4O@#
:d q
0`&Q
o%Z,
scrollDown
.Fdg"
<%N
ji:m
MaxWaitTime
pszContainer
=v,R
c6u\N
;WZ#
STATURLEnumerator
/&>,&
MENURBUTTONUP
,>|s!1Q
!sGgic
RQZ`
Asn1DerObject
;$%$
Y6qBZ
yd3*
#9 ey
([!e
wstrUrl
8j,G
[)A
h9z!N
InfluenceStartup
=^5
@ZA^@&
Cc.O?
UnauthorizedAccessException
lZe L
J+l
Y"_g
xDz=
DriveType
YuVW
NIw ZYS
zA?
a78i
.4)_
q}6S
RPUA}
o4z1
m.TJJ|
e.ws
connection
set_Height
ProcessWindowStyle
.8lcS
AO\_
7B@
RemoveAllDependencies
`$#2+0
jr YCn%k
XX2
ghE{_
Qe]g
wN~y
P-~`
&z`M|X'
|k)\
HTSIZEFIRST
]"4S
54xc
$JzQ
~7!u?
y/KB
%K*B
1(:3
GetHostEntry
_videoCaptureDevice_NewFrame
J]5 bA&
4WAV;
^q]M
Y)(p
uu>[
CALG_SHA1
IME_STARTCOMPOSITION
System.Net.Sockets
CspParameters
MOUSEEVENTF_LEFTDOWN
Ee,[
WR1r
DuGdDF
$kEY
U[eq
xp"G
B#Cp
C:l*
D 5"
MessageTextBox_TextChanged
*0r4
TPiRA
GetAncestor
SendingType
uF|WHc
set_SystemDirectory
3i'e
3q].
| <c
RotateScreenshotScreenByScreen
$y+9"l[lg
vY\J
c9
XOl"
Sx=,
4@[=
POINTAPI
set_BitsPerPixel
c^^l
2Ky{A
7.|s
s~ ZrA
# <[
: H
p\x:
point
d`'
ByteArrayToStructure
Y C G
Xw%}
6+O
set_BootMode
K~BzE
fCreate
get_Passwords
ToCharArray
`O:[
mZ;#
get_IsDataAvailable
KZi'
Unload
gnnhxCL
_ U
t0"T|
$x`h?
<IsCancellationRequested>k__BackingField
GetResponseStream
u\|H
3 -as
J7K{
b~L
>#K\
eUvveG
v~("Z
Bh-o
8w\FKj
cYj
75d^}gC
Encoding
httprealm
?@IW
[U%(
x;+_
E >NG
V$UY
8DaY
N4Wi@k
VideoInputDevice
Tv_n
get_TotalMilliseconds
MENUCHAR
-J6H
IEnumerable`1
!]&MI
<EntryType>k__BackingField
SetClockVisibility
,j[tZ
@{
set_Port
Z*&T
(n|1
5/NN)
QWL5
GW_OWNER
QK5@
~P[?
get_ToolBase
CryptographicException
;092
mB}K
AesDecryptor
C&h7
Haof%
09|1
JAW#ONg
System.Security.Authentication
TASKSCHNAME
f.IaM
DWMNCRENDERINGCHANGED
L_dn:)
!KHJ
set_LoadablePlugins
c {c4
9V%K
8@-[
-Qj@
.~5OS
elk\
set_ClientVersion
dS_b
, )h^.
\P[C
<SetMemoryInformation>b__1_1
J5_Y
S <)
<>c__DisplayClass13_0
PF~Z
io#R
rnyf
6Q{m
}]_7
!wA 8
~ #~
gT{Y
w~ZIJvVNnZ^
lz>:?I
FromHbitmap
8kMw
`Y^O+
;BnBo
%g65
6DIS
get_Directory
cb=}
Iks|T
NwCg
~1!S9w
Zero
PlaybackStoppedEventArgs
rNWm
>?%q#Y
<|lo
ZM3pg
"_%_//
%k%4#
/9fQ
<FL4A
*QbM{
PaMA
.[[<
H9F)
KeyboardLayout
,Rf,
7V>@<h
M_x3D
z#IG
p{][
WH_DEBUG
hv}
hLD^
/n;'
!;Dy
[9o #
_length
%a;2
CryptCreateHash
<SetMemoryInformation>b__1_2
>'Q
L"h,
j.xz
yY]O
>`|~
lsNh
ServicePipe
lQ_P
MA_NOACTIVATEANDEAT
4r'y'i
CLOSE
<>9__10_1
n)}@;
set_Value
MOUSELEAVE
Commands
Orcus.Shared.Commands.TextChat
StringDown
!0 R
KeyEventArgs
V R,z!cNE
^A.h
VR*@
tS~)
System.Collections.Generic
wBx5
& o @
tnSV
+#Po
/n;R
#`}EB
e@f?D
y58
~$x3
Orcus.Commands.Code
zn2I2
!6sK
\?[B{7
w\pG
`-}\0MUa
fYTj
()R6
G_Y>m
ygwqe
Vm-p
<Message>k__BackingField
.`M;
MDIREFRESHMENU
!"'W
gLYC:
:t7Az
&c*M
OnClosed
G8B[<
e|vn
set_CurrentCulture
:!^P
l!c
+_gj
Data4
dA~qe~!
Data1
H^;!
Data2
get_ModuleName
Save
set_Voices
MouseEvent
RegistryValueDWord
get_PixelFormat
Uv]`
&QZ+QZ
rkG.
]P3c
<ProcessCommand>b__3_1
FBzr>
uRm/T
8{D"sa
) Ka% ]o
*6U++
w|AgY
oLf'
SUW2
+9sM
JN7fUs
yhM-Jk
serverConnection
7j!:
Qn)
XmlNodeList
qkoX?F0
<>9__10_0
AppendText
)_">XJ
y#$Q
LpT^
c\Hb
~k5?
~}'8
_MB9
5 a8!9
.;EpA
TABLET_LAST
set_Blocking
%x~^>
P1 \!
'=T$=
ckq]

#infosec #automation

TheSystem Itself @ 2016-09-01 15:15:08