rat.exe

Error loading and creating {0} of plugin {1}
OBJECTIDENTIFIER
Revision
InternalName
Software\Microsoft\Windows\CurrentVersion\Policies\System
Shell_TrayWnd
keep-alive
WorkerW
SELECT Caption FROM Win32_OperatingSystem
Host
Unknown
{0:X2}
Yandex\YandexBrowser\User Data\Default\Cookies
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381
Bytes Sent/sec
Windows 8
Windows 7
Shutdown plugin"
LegalCopyright
+*-,0/21547686A@CBSRTRURVRWRXRYRgfkjrqsqut{z
CoreFtp/sites.idx
nss3.dll
Kill
GHz (
r Windows-basierte Programme. Wenn dieser Dienst beendet wird, funktionieren Eingabeger
cookies
System.Core.dll
A+s
-)E
PK11SDR_Decrypt
Version
<supportedRuntime version="v4.0.30319" sku=".NETFramework,Version=v4.0,Profile=Client" />
MIPS
System.Windows.Forms.dll
port
^[0-9](\.[0-9]{1,3})?
Math Processor
explorer.exe
1.0.0.0
version
rundll32.exe
Orcus.CodeExecution
/test
/wait
AdminPasswordStatus
0.1.0.22738
Status:
path
/l /t 0
v3.5
Firefox does not have any profiles, has it ever been launched?
ExtClock
action
OrcusUtilities
bad ret
Architecture
expires_utc
secure
Yandex\YandexBrowser\User Data\Default\Login Data
Pidgin
Google Chrome
SEQUENCE {
Internet Explorer
SVGA
Security
SELECT * FROM AntivirusProduct
Windows CE
<supportedRuntime version="v2.0.50727" />
MDA
https
[Idle]
Keyboard Hook Dispose
SOFTWARE\Mozilla\Mozilla Firefox
FM]
4YqQipgwGNVrmOypaDfCq5/H3akUfF3xfb0KrNCv9vM=
UninstallString
Opera
N/A
cookies.sqlite
orcus.shared.utilities
JDownloader 2.0
*.nfo
2V5Ql5gt7nfRdd0MbUd/4qBBuJAhLpcOsyTy5eyWJzW40fwd43v5gdjN3s5yJcoZ
logins.json
{0} x {1}
No Firefox profiles could be found
costura.microsoft.win32.taskscheduler.dll.zip
wallpaper.bmp
WRAM
StreamCodec can not be null.
Microsoft\Speech\Files\plg_{0}
System.Xml.Linq.dll
-Hv
keyName
costura.orcus.plugins.dll.zip
MemoryDevices
0.1.0
ConnectedLabel
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>
_Total
HostName
costura.cscore.dll.zip
Pipelined Burst SRAM
parameter
host_key
ListOfLanguages
FileVersion
Windows 3.1
--install
ProductVersion
DigitalProductId
Model
HGC
OriginalFilename
No Firefox logins.json was found
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Win32 Windows
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
origin_url
NSSBase64_DecodeBuffer
Mozilla Thunderbird
Orcus.Properties.Resources
Firefox does not have any cookie file
password_value
NSS_Init
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
@=<VY]BUQM{sp&hH%xbLJcUd/2sWgR+YA&-_Z>/$skSXZR!:(yZ5!>t>ZxaPTrS[Z/'R,ssg'.&4yZN?S)My+:QV2(c&x/TU]Yq2?g?*w7*r@pmh
[{0} Me]: {1}
CurrentBuild
Load plugin: "
EGA
MaxCacheSize
style
drivers\etc\hosts
Unknow database format
FromHandle
MHz)
runas
SELECT * FROM Win32_PhysicalMemoryArray
moz_cookies
TCPVIEW
Whistler Server
net.pipe://localhost/69e001dd06a44ff1b3260a75a6f10381/OrcusUtilities
nnen die Dienste, die von diesem Dienst explizit abh
Central Processor
The platform or operating system must be Windows 2000 or later.
name
SELECT * FROM Win32_PhysicalMemory
Parallels Video Adapter
^(?<guid>([0-9A-Fa-f]{32}))_(?<version>(\d+(?:\.\d+)+))$
Mozilla Firefox install folder cannot be found.
A/}
A/{
Not connected
hoster
The binary key cannot have an odd number of digits: {0}
HARDWARE\DESCRIPTION\System\CentralProcessor\0
orcus.shared
{0}||{1}
bad ret on check
SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions
ProxyEnable
Workgroup
\e3c6cefd462d48f0b30a5ebcd238b5b1
1.85 (Hash, version 2, native byte-order)
http://speedtest.netcologne.de/test_100mb.bin
/SMV7RYPoqRdeZRq4FdU5g==
PortNumber
root\CIMV2
Windows 10
Copyright
3DRAM
Linear Frame Buffer
xaRYWOz+pf5KC4AA5RVotg==
PC-98
collection
Install string was null or empty
msvcr100.dll
isSecure
WinInput.exe
http://speedtest.reliableservers.com/100MBtest.bin
CurrentMajorVersionNumber
Microsoft\Speech\Files\psh_{0}
PrimaryOwnerName
/wait /upgrade "{0}"
VendorIdentifier
Start
Occurred while executing command "{0}" (Command ID: {1})
DisplayVersion
WinSCP
ProcessorType
VideoProcessor
Opera Software\Opera Stable\Cookies
CurrentClockSpeed
WIRESHARK
\.(?<extension>([a-zA-Z]{3,4}))$
te f
case FromAdministrationPackage.GetScreen
VS_VERSION_INFO
VMware SVGA
<Pass encoding="base64">
Enabled
CDRAM
D:\Dokumente\HfLogo.png
Couldn't determine file name
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
ping 127.0.0.1 > nul
Orcus Client
<Host>(?<host>(.*?))</Host>\s*<Port>(?<port>([0-9]{1,4}?))</Port>.*?<User>(?<login>(.*?))</User>.*?<Pass encoding="base64">(?<password>(.*?))</Pass>
root\SecurityCenter2
Select * FROM WIN32_Processor
.purple\accounts.xml
DisplayIcon
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Connected to {0}:{1}
Other
<supportedRuntime version="v4.0" />
KiB
CoreFTP
Main
% Processor Time
encryptedPassword
No admin rights and service isn't running
5GGgXlcPwEeaPSZfuJHPwvcNNHnXnOhx48RlBBy0qwNQyk57+lC73R1MPd3NSBa10NuGEMbahJSkWaFXDmNIfg==
Could not read cookie table
Software\Microsoft\Windows\CurrentVersion\Run
{0}{1}{0}{2}
Automatic Key Log
piqiz
Verwaltet Eingabeger
eab
Name
Button
img\
VirtualBox Graphics Adapter
Caption
Processor
userName
exe
displayName
CurrentMinorVersionNumber
ARM
InstallLocation
PK11_GetInternalKeySlot
Microsoft 2016
DeviceID
Comments
MaxClockSpeed
{0}.{1}
registryHive
MainRichTextBox
00:00:00:00:00:00
PublicKeyFile
{0}x{1}
Mozilla\Firefox\Profiles
mozglue.dll
.nfo
encryptedUsername
Translation
00061561
Assembly Version
$1:$2:$3:$4:$5:$6
</configuration>
Level
label1
label2
label3
OCTETSTRING
Safe mode without network support
bat
IsWow64Process
[{0} {1}]: {2}
SHELLDLL_DefView
Disabled
.ico
SELECT * FROM Win32_VideoController
ZnqfVtgJLX255UVs9SM3pw==
Send
#32768
</startup>
echo j | del {1}
Longhorn
msvcr120.dll
{0}_{1}
Segoe UI
Not a valid SQLite 3 Database File
WallpaperStyle
aforge.video
{{Left={0},Top={1},Right={2},Bottom={3}}}
(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})
Orcus.Service.Properties.Resources
Opera Software\Opera Stable\Login Data
<configuration>
A-w
JDownloader v2.0\cfg\org.jdownloader.settings.AccountSettings.accounts.ejs
ngig sind, nicht mehr gestartet werden.
UnhandledException
costura.aforge.video.directshow.dll.zip
logins
costura.orcus.shared.utilities.dll.zip
Safe mode with network support
notepad.exe
VGA
SGRAM
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\
Uninstall
csrss
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites\{0}
SystemType
LegalTrademarks
MHz
ClientActionCommand.UpdateFromUrl: 10/10 tries unsuccessfully
Bytes Received/sec
login
Firefox Application Data folder does not exist!
"{0}"
UserName
Google\Chrome\User Data\Default\Cookies
RUNASADMIN
username_value
table
Windows Input
guid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
A)`
-Jz
/forceInstall
A)_
--uninstall
costura.orcus.shared.dll.zip
VideoModeDescription
@ECHO OFF
SOFTWARE\Microsoft\Windows NT\CurrentVersion
echo j | del "{0}"
DisableTaskMgr
Orcus.Service.exe
MDIClient
ProgramFiles(x86)
FolderView
content-disposition
[Build
aforge.video.directshow
en-US
SELECT * FROM Win32_ComputerSystem
CurrentVersion
Whistler
ABCDEF
NETMON
Video Processor
<?xml version="1.0" encoding="utf-8"?>
value
EstimatedSize
Burst Synchronous DRAM
costura.starksoft.aspen.dll.zip
Windows-Eingabe
VM Additions S3 Trio32/64
filename=
CiceroUIWndFrame
starksoft.aspen
kernel32
\Mozilla\Firefox\Profiles
shutdown.exe
. Wenn dieser Dienst deaktiviert wird, k
signons.sqlite
VRAM
http://mirror.internode.on.net/pub/test/100meg.test
orcus.plugins
FileZilla\recentservers.xml
Software\Microsoft\Windows NT\CurrentVersion
N@ncyl
hostname
x64
MainForm
status
SDRAM
Firefox is not installed, or the install path could not be located
http
x86
Win32_CacheMemory
NumberOfCores
DSP Processor
"(?<hoster>(.+?))" : \[\ \{.+?"password" : "(?<password>(.*?))".*?"user" : "(?<userName>(.*?))".*?"statusString" : "(?<status>(.*?))"
000004b0
The graphics mode is not supported (BADMOVE)
KillButton
FileDescription
encrypted_value
Description
NumberOfLogicalProcessors
WinInp.exe
Requested Key Log
eaVZ3qyF3tFRjpKzecEyqzdmMYo4gTX06IYxVWAOy24Ncv8TWMc2OAgE549AOcRb
BCDFGHJKMPQRTVWXY2346789
Threshold
Manages input devices for Windows-based programs. If this service is stopped, input devices will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Port
Auto-vacuum capable database is not supported
L3CacheSize
L2CacheSize
cmd.exe
ThreadException
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
SysListView32
SELECT * FROM FirewallProduct
VideoMemoryType
Activating keylogger
EDO RAM
ReleaseDate
password
MCGA
SOFTWARE\Microsoft\NET Framework Setup\NDP
moz_logins
Control Panel\Desktop
https://api.ipify.org/
Network Interface
Thunderbird\Profiles
Occurred while executing static command "{0}" (Command ID: {1})
Blackcomb, Vienna
Orcus.exe
Alpha
Release
UNIQUE
InfluenceStartup() at plugin: "
UBR
Itanium-based systems
No installs of firefox recorded in its key.
MessageTextBox
server
Yandex
CanStart() at plugin: "
Product Key
httponly
DisplayName
00000000
VarFileInfo
key3.db
System
LoaderExceptions:
Application
.jpg
CrackedByWardow
PowerPC
.zip
SELECT * FROM Win32_Processor
root\SecurityCenter
TileWallpaper
XBox
<Server>
Edit
SQLite format 3
case FromAdministrationPackage.GetActiveWindow
WindowsInput
The process does not exist
System.dll
Microsoft\Speech\Files\err_{0}.dat
[^\u0020-\u007F]
System.Xml.dll
expiry
ReleaseId
host
ConsoleWindowClass
te nicht ordnungsgem
http://www.speedtestx.de/testfiles/data_100mb.test
Not Implemented
Microsoft
S3 Trio32/64
VolumeSerialNumber
System restart required
extension
/r /t 0
ProductName
<startup>
MaxRefreshRate
[PRIVATE KEY LOCATION: "{0}"]
Win32_Processor
cscore
A$H
A-v
TotalPhysicalMemory
file:
DISPLAY
Microsoft\Speech\Files\klg_{0}.dat
VideoArchitecture
PK11_Authenticate
Normal
CGA
.config
msvcp120.dll
CompilerVersion
User
00000002
Manufacturer
Orcus_Service
Install Directory
Longhorn Server
~MHz
DRAM
true
WindowsInput.exe
Load
\Mozilla Firefox\
hdfzpysvpzimorhk
CompanyName
rXY
UninstallButton
n must be 0 or greater
3$;'<(=+>,?/@0N6P8]:j@pEqFvJwMyNzP|W
microsoft.win32.taskscheduler
Copyright Orcus Technologies
Vista
SysShadow
Microsoft.Win32.SafeHandles.SafeRegistryHandle
SRAM
SerialNumber
SendButton
/s /t 0
INTEGER
8514A
XGA
global-salt
ProcessorId
SELECT * FROM Win32_BIOS
msvcp100.dll
StringFileInfo
Password
Google\Chrome\User Data\Default\Login Data
password-check
Mystic, Orient
Windows
IFactoryClientCommand
FileZilla
URL.DLL,FileProtocolHandler "{0}"
$this.Icon
Mozilla Firefox
costura.aforge.video.dll.zip
Input.exe
Speed
CurrentLanguage
ProxyServer
win32_logicaldisk.deviceid="
-{0}
2008
Berkelet DB
CalculateMd5HashFromFile
q%:D
^~z
f11b
*;_{
J|\Xr
{42]vD
WHITENESS
WM_SYSCOMMAND
J-oV
Wc}uo
KeyLog
<NewCommandType>k__BackingField
6j)g')`U
L.o
Uw,s
set_Type
v_Q)e
get_Speed
4!>Bx
Connected
Fi-*
get_ChildNodes
"]l?=
C@p
h9w
y2
KEYEVENTF_KEYDOWN
|VdI
ToggleDesktopIcons
s.?h
get_DataMode
RemoteCertificateValidationCallback
~HB)
9}V{B
subKey
+2M/
MWYj2
jbwb
g7BU
sff6
set_Scheme
IWebProxy
set_Capacity
ArrayList
5`}h
HSHELL_WINDOWDESTROYED
SwapExtents
q \?
1A('
XZj:
get_Factory
i`60
Xuce
qfgN1
set_EntryLocation
)I*^*y*Y,
V?5sR
OnShown
a^HWbX
(3}?P
parentHandle
UxCrL
set_MaxClockSpeed
Bvb=
regKey
iPeu
CryptoStream
SIZING
\\9E
Orcus.Commands.TextChat.TextChatForm.resources
>T}M
SendResult
lM&
GetWindowAtPosition
NoD[
_desktop
V^k}
get_MainWindowHandle
mF)=
I.7[&
K$ZZGs
GsEs
g(-+Y
iVLE3
RestoreAllScreens
get_NewWindows
Z9%*k
MZaK}
+2	o
,#	o
MOUSEEVENTF_RIGHTDOWN
hvncDesktop
(;}
EnumWindowsProc
set_PriorityClass
$VzT:;
add_SendResult
m_7
FunActionsCommunication
Vwd0
U]ptL
set_AntiVirusPrograms
*:	'
l3kd
Ru[*_
sU=P
0
$m
uninstallableProgram
ClientController
.ZL}7
SuppressFinalize
V2I`h
Sa;p
TaskPrincipal
`?[b
$L&a
u()BO
$ZHxHt
Nullable`1
Tiled
GetFirefoxInstallPath
:`2-cXR>l
hStdInput
get_SendProcesses
KDg'*
WK N
UNDO
RegistryValueString
.Ul
SC_ARRANGE
!~;"
s9!`
jv\n
`))
\@]U
DRs"myP
Handle
Nfo&
ReleaseComObject
&+D
M:=MM
?OH"z4S
#$]D
2cE,|
set_RemoteAddress
Mvo7
get_Language
layoutToLoad
ConnectionState
r[(
p2]N
ToolTipIcon
Enumerable
~;4r@
ManagementObjectCollection
ResolveEventHandler
&+
MatchCollection
cK7}
z!HAb~
set_RedirectStandardError
,6D"
BootMode
T9cQ$
T(AV
hbmMask
ThreadExceptionEventArgs
System.Security.Cryptography
B5%T
8(X*
FromAdministrationPackage
<GetHardwareInformation>b__5
VAzk{
MaxLogSize
yZ3Nv
Speak
Asn1Der
\2l^
OpenSubKey
WriteAppConfig
WH_SHELL
w.
G
get_UpdatedWindows
_keyProcessing_StringUp
xEv[
\r
((sY
NCMBUTTONUP
C.B;
globalSalt
Mt	FG
^f<~
fz(r
^#2e
sQY&s}
CURSORINFO
/~|/=
'j<^
set_Text
newCreationTime
i7F_)
<SetMemoryInformation>b__1_1
IsOnVirtualBox
?%1#
<SetMemoryInformation>b__1_0
d5[%
u.od
get_FileTransferTempDirectory
<s
:p3c
P\r\
MT;'Y
`bN]j
Copy
~d?;f
HardwareInformation
W{Ql
=Lk7C
%o&D
CJ8$
>pVh
+t\
z
SHGFI_SMALLICON
add_FileTransferAccepted
windowinfo
7fU,
s`W
System.Speech.Synthesis
9^&Hd
/&hvo
=i~E?~(
h}:I
)%V:
set_GenerateInMemory
add_OutputDataReceived
RTfeA
ErrorReporter
pp7]c
{wtk
Yo8
IQH2
vz?wO
op_Division
CANCELMODE
DzK=
<>c__DisplayClass3_0
QK?/|
set_AddressFamily
p`8H9t
5
k^
gDZjl)bVM
SNm
IUrlHistoryStg
DI?}~>
>@zl
BnYP\`]
/b,9
1iq0
l}:[
_
Gko
K.Dl\`
<PrivateImplementationDetails>
Char
\
3:
!0R
_g
=#1^
dwNewLong
RemoteDesktopCommand
7(l'
s(
aXc7
(j
j]`U
&P7f6
GetValue
B5@^
<ValueObject>k__BackingField
4=h
StopDDoSCommand
%n
OnConnect
assemblyNames
HashAlgorithm
n{?h
UDP_TABLE_OWNER_PID
a)MO
keyf
5,Ey.'M	m9
MOUSEHWHEEL
<LogData>k__BackingField
MRob
DELETEITEM
set_ClosedProcesses
(/
5i'4q
GetBiosInformation
HSHELL_APPCOMMAND
QBZU
^w!D
|
4~n)F
%zm'
get_LCID
fG!`
YlZo`
L|mL
7RPWu
MMDeviceEnumerator
EVj\W
'~2tad
pR},f
rxE
\r]
I=+6
RWp)O
g
.)
VCode
deviceId
=k"c
w&u6
m$x?ps
Nmj/y
6G9
9bc<
_/Zk
WN2\
GetShellWindow
cO6OP
.text
&R(
iE>,E
GW_HWNDLAST
V/5t
ye|a
~
LW
ServiceInstaller
Component
-r(
XmlReader
GetObject
*s-?G\
f4\
c6<X
Uv3JR
wqUSx
object
%@xW
~<di
InstallHelper
g@o[
LocalPort
kBY!3d
'[/N
z#W>
UserInteractionCommunication
hX=~
.6r9
.,N
Client
.,YIe
EndConnect
=]\c
<FileName>k__BackingField
fuWinIni
xiqm%
oy{uF
&p[G
y2vjE
d"XH
kh N
Resources
3]<ln
CipherMode
,R	r'
B7&}
Orcus.Commands.Passwords.Applications.WinSCP
1iRY
<ToolBase>k__BackingField
"kQp>u
AeBg
NORMAL_PRIORITY_CLASS
g>K
encryptedUsername
EndpointAddress
W#e}
(P'	-<
lpReserved2
)i3H
-r@,
NSSBase64_DecodeBuffer
38iI
lpClassName
bg:9
qH_u
PluginFactory
get_SynSockets
UrlHistoryClass
ChromiumBase
C=_|k
4.0.0.0
AddRegistryKeyValue
IFormatProvider
get_ImageQuality
4^
Y
Y]m6
Uw.e
!O=*
parentHwnd
UserCertificateValidationCallback
{u4f
gEZV
o@[}
CryptoApi
l=_I
wjzT
<reader>5__2
\GeT
UseHashToken
pLG`
M~U.
Orcus.Extensions
EntrySalt
SW_NORMAL
m{-0_|
XBUTTONDOWN
ew-]
<ProcessCommand>b__7_0
<ProcessCommand>b__7_1
set_ClientConfig
^f|DP
>:=1
set_IsBackground
%
}
TernaryRasterOperations
k("+(
_is64BitProcess
#Ece
remove_NewFrame
d#6q
R#I=
c9C*B
vKTR;
w!'!
$2w/vG
e3oX
set_IsDataAvailable
rlgi
SHGFI_ATTRIBUTES
GetWindowInfo
0>+X
HF98H
%\{
RENDERALLFORMATS
%\x
F"D<
%\~
ANTIDEBUGGER
dwDesiredAccess
TakeFullScreenshot
f=W>
$3C374A41-BAE4-11CF-BF7D-00AA006946EE
AudioCommand
dmDeviceName
K@H_
rzRf
8SS{e5
Pv%G
GetWindowRect
hStdError
WH3%
T3HkU,Q
o O(
7u
K
GetProcAddress
HWND_BROADCAST
MP\n
:lwiSr
\_W/
DM:.
ServiceAccount
Eep>
$!<i?
pOfi
qpz
rgiu
V!+Cj
sslPolicyErrors
set_AdministrationRightsRequired
^.f{
registryType
A}?f
Z3gZ
$fUQ:
H!PE
Culture
ReadAllBytes
GetCookies
h"v[
Icon
}YI1
HttpFlood
SbO!
@.v1
starksoft.aspen
Z-I6
ApmU
C
Xw
JM$B
AssemblyNameFlags
"
GC
INSTALL
_deadKeyOver
+]	r
STARTF_USESTDHANDLES
Z9\
get_IsWarning
remove_DataReceived
get_Assembly
X(6-
,T:iwk~
System.Xml
r=!RZD?4E
I_=/
p7on0L
uParam
UYCT
" z9
\T;r
NXz
SMTO_ABORTIFHUNG
dFos+|b
$[yW,=
{&zFQs
o6x
x)
},
Q]iN\*U&
lpszDriver
B*!>ee
1c`1
-v|.
*T>LI
nZ(!
_isClosing
z@%>
ADMINISTRATIONRIGHTSREQUIRED
ullTotalVirtual
"IU4
SecretEntry
$-	eJ
PathContent
>Z*?W\
\:,Z
MOVE
STATURL_QUERYFLAG_TOPLEVEL
%XvMt
3`Kt
Qs<
kYBt
^:?@
#K"6O~
sz
HideWindow
DescbcDecryptorByte
jYl#
MO!)
op_Explicit
qX''
]hck
FpO U
\!9{V
0H}P
+V-?]
`>D^G
_k=H
}q{ -`
[LUom
URL_ESCAPE_PERCENT
(e=t
(J*J)
aF6'd0o
[Is/
'GinvI7
r28
G=_Q
rRRx
NKr87
hwnd
"S#l#
FileTimeToDateTime
2N+X
p
d%
+oIt
/~G#
aj4pbG
yE*9q
]+ev
right
Uk/8
"lg(
c>LV
tableName
System
[U|_f
G,F$F
Application
L{WH
|{S)
Orcus.Shared.Commands.UninstallPrograms
NetworkInformation
hwndOwner
p)i`
PasswordsCommand
Du\P|
ba;<V
$$O)
pfnEnum
;l.
5y
aak{Z
NznX53
get_VistaOrHigher
cypherText
4Q|
,x-u
_y^!U*
ProcessorInfo
y[k
LBUTTONDBLCLK
cT?Z
8\B't
set_InstallService
<ExceptionFile>k__BackingField
get_IsClosed
7k3_
SH\J"
ToByteArray
set_Version
ImageLock
DoNotActivate
exception1
bG3
MethodBase
First
Font
p*rnA
t}
mk
get_VersionString
Stretched
bGJ
.i	S
set_CarriageReturnAndLineFeedReplacement
8uV=
i7+V
WTSSESSION_CHANGE
?)jP0
+.ni
Capture
y#;#
_receivedBytes
TryConnectDelegate
"G~+_
cAs<
?	-
SecretId7
`C&'
noW
b,_6
*Vs
<ExecuteCommand>b__0
<ExecuteCommand>b__1
NCPAINT
}iJZ
width
XnG(
J}6#
ISIL
get_EthernetAdapterData
,^v-
hp-X
HTBOTTOM
add_FileTransferCompleted
get_AvailablePlugins
zK>sdy
S-giy
CsvRecord
wB<B
STATURL
RSDSy4
~O{
D.l9
Orcus.Shared.Connection
aA
get_Position
m.V"es|
f;]f
2}c/q
hxxP
?B!t%
;ZjUY^r/
w)i%
'C'!}$t
ig
St%
H,=l
(tJX
~O&6
EYS"a+
,scbjt
X_Z#!
CloseDesktop
dt9u
{]
J
"4sm
u"=Iq
HTCLIENT
<Name>k__BackingField
HvncActions
get_PluginName
3,5f6,7
appPath
ky
|
Registry64
'%L0
;"vh
X.E$
6|X
:ZMDw>L
get_UserDomainName
z"	@_
D:\Dokumente\Visual Studio 2015\Projects\Orcus\MainSource\Features\Orcus.Service\obj\Release\Orcus.Service.pdb
27zen
k!5Y
currentTime
<@Kh
DeleteRegistryKeyValue
n-~++
6+r
MIB_TCP_STATE_CLOSE_WAIT
rzH
aT?hO
qRLR
IME_KEYDOWN
'	o(
set_BackColor
_CorExeMain
W
c{}#
e<+e-
get_Rectangle
CompareTo
Title
ContainsKey
>^fF
'\/g
Bc=Tyz
set_LocalPort
>w6
}v
a&hV
?;<f
icmpSockets
]'I$
u@{Z
0=?A
}7A6
6SZ6SZ6SZ6[
_cancelActions
+LMp
|]EA
OnKeyActionFurtherProcessing2
p*rVB
3bXw
pnbE
4W}Z
ComputerInformation
<LoadPlugin>b__23_0
@.reloc
Func`2
Func`3
dwTotalSecrets
WebcamCommand
g+Uw
1]$K
,y\;K
%o'
A+']g
)>U
$@B	%
#=k?x6
wo#0
RemoveFromAutostart
gV?x
dwLength
get_IsTaken
ug1G/'
RegistryCommand
<GetHardwareInformation>b__6_1
<GetHardwareInformation>b__6_0
<GetHardwareInformation>b__6_2
:&nn
#[s&
mg
kw&]
oX.a
UatV
(Su\
TrimEnd
@VW@
7	I}
CsvFile
isCsvData
V7[y
localPort2
'rt
sC6k
bNj
localPort3
2n#=`
get_ChannelIndex
Y)?B(
CaptureScreen
GetProfilePath
<Objects>k__BackingField
=W
S
6x<-
HttpRequest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
Sz`Am
r95EO
get_ClientPlugins
Sp^D9/Q
gkK!
\?}h
+r\9
TT S
BinaryReader
3NYx
B2)q
set_EthernetAdapterData
b3Ma
{>4O
I+s2U
{vO$
]wkc
OnClosing
?dHZ
(#4MN
cds(
oH]>#$
Uj`M
E1v.M
9}j_d%^
DeleteUrl
L##8
Pe4DH
rB1
4Bz
<GetWindows>b__40_0
TCP_TABLE_BASIC_CONNECTIONS
t$(U)4
XmlElement
GetRowCount
@?sg
i&!Qf
l:l/7-
SQLiteHandler
Restart
7tEOC
set_Name
DEVICECHANGE
Default
{/4L\
FileDownloader
kEXv
;7b[
rBF
set_Path
rBE
!{"|v
UrlString
/B8
{bVk
N:X#0
,!9W
ConnectionId
TB,7
set_Install
set_ApiVersion
GetHbitmap
POWER
GetEntryAssembly
F\G0
qzQo
6I=iS
h9]N
M/_zo'
GetSystemInfo
set_PrivateBytes
;)c
%&EJ
A+Xq
#_g!V
<qcZ
G3bfd[
CompileAssemblyFromSource
SIZECLIPBOARD
$D8;0
Bj A
]Klse
SystemIcon
)V^y
nz)V
R/JA?
A=>,
Z%vza:
set_Blocking
set_IsTaken
eUDW^f
c{^l
2Su9
_vfv5sG
p9J8R
uBUU
get_Count
W
#o
:[?8
IESecretHeader
"wly
z
f3
#VMe--]
<SetProcessorInformation>b__2_0
hklE
hICu
1u%5
O<#~v}z
h&=y
Xt{3
sH4_
Q3vi
<>9__7_1
c#qr
WS_GROUP
|.Wa
f}oT
System.Collections.Generic.IEnumerator<System.String>.get_Current
GetFormattedKeyValues
dbrP
HTSYSMENU
4#*d
[d|
DescbcDecryptor
,<#"D
GcqR
&bcc
set_FriendlyName
i*P[2P
_containerName
ToInt32
kOw
WFZ?
_=I<
3F(#4
(BwJTE
SpecialKeyType
KeyProcessing
cMs<
HSHELL_ACCESSIBILITYSTATE
({q
8QU65
>DK
.Y+
)9e6
<KeyLoggerService>k__BackingField
3 `
Autostarter
PASTE
MIB_TCP_STATE_LISTEN
6;T5I
TaskFolder
&
set_CompanyName
RegistryValueUnknown
get_Pipe
[Gk::"\
set_AutoResetEvent
PK11SDR_DecryptPtr
TK5UCM
|]TA?F
TojjB
)f|L
mZ O
ReverseProxyCommunication
q+QA#
ShowWindow
l%dK
ProxyHelper
get_File
An}t
t8r=
y{S5y
GetNss3Path
Mf8X
_currentHvncDesktop
p*rF@
BitBlt
Ouo~|)
set_Host
1;^
.VX]
4(p^J>R
!kx1f
r<=
ShowDialog
v(`e
b+,jx
~6Be^
lfvI63;
CryptAcquireContext
6QklB
_connectionInfo
add_NewFrame
|a1|)
NumberStyles
m;q
+
GetPasswords
NetNamedPipeBinding
Orcus.Commands.TextChat
parallelDownloads
i5Wx
SettingsBase
R`50
l
Orcus.Native
1%?w
CancelOutputRead
aH?X
,qtmp
l&n?w(
//1\d
set_FileName
pOX%
4_P`
@GuT
r&AJ(X
,5|~
x_lg
get_CurrentDomain
get_CarriageReturnAndLineFeedReplacement
LinkedListNode`1
yzV+
'W^)
HK]
lgE
EI$-
get_SoundOutId
vz+?
ToBase64String
Install
yzV7
dtcf
<GetOperatingSystemInformation>b__5
:p7(
caD|
set_Passwords
e2]u
e2]l
J=~
fullname
V8|6>
get_EnumUrls
z(t:ddb}z&
lpThreadAttributes
Pmq5
<ProcessCommand>b__4
PTC!V
}4#
<Host>k__BackingField
'UC
iv]?
aJ?
<entry>5__1
<entry>5__2
DownloadAndExecuteCommand
hProv
<GetOperatingSystemInformation>b__7
qof);
Invoke
StartProcess
3'5k~
KeyLogFile
G+H7H
"K
=L%t,
^[l;
:\<o
SetWrapMode
_firefoxPath
O;&
n"rg
W57O
)*
=
A A{
CultureToString
vGQIxY#
lkaK
_systemPageSize
TIMER
W8MVb
get_MonikerString
z	Eu?
L>]j
Sw<_
(j![
windowToRenderHandle
7Z/\nt+
baseHandle
LQ+([7
UVF$)k|)
|m5W
RichTextBox
CreateCompatibleBitmap
:CRJ
e{U*;.Qo
Rrat
5slD
jYl#
Array
Y[X 1
F%;#
>1+$
Bv~N
%}[
ZqKd
datetime
SwapMouseButton
WS_SIZEFRAME
~_.]
PushKeyLog
CompareExchange
IsOnVirtualPc
slot
WS_SYSMENU
i/}o
-?}Q
ProcessPriorityClass
r63S
AdvancedBitmapImage
umGg_S
Oqo
l]'bye
vistaStartMenuWnd
M\w`
:G`]
SetVisibility
#jK
windowInformation
S6G
3t8n
?y_e
?m#$
:9CY
9zWBh
Hfa<
set_CurrentImage
RegistryCreateValuePackage
`
_O
3:[a
P]AR2
6|^4
+Ms<
z+8c
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
{iW
E3^1
6]@?
bXJV
6"QT~
H^}
|hOx~S
Gof?
WriteString
DirectSoundDeviceEnumerator
get_Location
set_ProcessorName
\_|a
STYLECHANGED
]&s^I
p*rP6
MoAI
logins
GetCurrent
Directory
Jo${
P*'Nv[
q=d)
EQos
oyJ?X
i&m:W
get_FullName
zxHeE
<IsCsvData>k__BackingField
qkv+
FreeHGlobal
get_CompiledAssembly
,3>
.87X
ADDURL_ADDTOHISTORYANDCACHE
fuState
|9P'
EventLogEntryCollection
set_ChannelIndex
hN=S
+_	o'
grVA
RuntimeCompatibilityAttribute
gi(c
ActiveConnectionsCommand
Qsb8
hkQe
Ht	L
ullTotalPageFile
eF@
OnN<
5eY!9
'zpb
m~/H}
.JvvO
_random
cCL#[2
c"Wf0
FindWindow
kBXv
Km'O
enable
vMAL1
Xgqma}
pRotateDegrees
Bopj
@V';
6f f2
P(8-
+m:g
{[@
X(6
Round
connectionInfo
w%W"
RaiseOne
gXwEq
Ev#w
{!B!
?="Wc
"FLw
7'f
remove_Disconnected
] ~*
NImH
GraphicDevice
XBUTTONDBLCLK
remove_KeyUp
get_ApplicationPath
lpCurrentDirectory
Os5Z
l	c]
C,[O
STATURLFLAG_ISTOPLEVEL
QUERYDRAGICON
\1m_
RECT
mD_-
System.Web.Script.Serialization
IkT'l
W
pV
hostname
\rc_m
4r,&G1I=
System.Security
Objects
97#T`
F+WG
RenderWindow
v
LD
#q&K
DestroyIcon
zzZ
IContainer
Clear
CURSOR_SHOWING
l]p+)<
lpEnvironment
)7U@
get_Identifier
[~&FJ
[L<A^
<B#xrl
set_ProcessPath
93bW
q%<.
p_h5
Orcus.Shared.Commands.Webcam
94v2
set_ClientTag
Port
SetFilter
Y,~N
jPb%V
a1mkn
b6D2H
6o2r
IsATcpAnaylzerRunning
b$8;R
$2a34f2e9-77ee-48fe-9315-979980e6fbeb
sN
s%?i
deviceName
INITMENU
+f4s4
QKcF}o
hkni
FhKB
EXITSIZEMOVE
200p
QeHh
c:T4
j'KE3F
get_Is64BitProcess
#G]<
$3601a898-0fe1-4710-ac30-2e6c417f46bd
fIcon
[L6e
PerformLayout
^J0$&H
sort
)=iJoK
GetInstances
get_ReferencedAssemblies
mhvnry@
ResourceManager
-b19
ClientActionCommunication
GetExecutingAssembly
cyWindowBorders
3b9.
HitTestValues
FromClientPackage
?Id44c
ResultSender
w%t^
p(?F
ContainerControl
BeginErrorReadLine
(;&G
set_PasswordType
Is64BitProcess
costura.cscore.dll.zip
h(-c0W
get_BinaryReader
r!
ToInt16
1
e
+`(C
0e`g"
o4J
j;T;
Y=By
Orcus.Shared.Commands.MessageBox
!>V3
CommandWarning
Gw>u
d4/K
.
cQ
8kMw
F*1
set_DisplayName
RegistryAccessMask
hOg~a
R:J
logData
!9`\
+
ri
7Y8h8
set_IpAddresses
WhO@
H>uL
Interlocked
Location
_counter
O9!p
s8Uv;Lh
Nc3L
`R6B
package
PluginLoader
+
rQ
#
X
o
WindowsModules
hx_c
,V;X
Di_)R
gfL[
set_Y
xTyIL
image
Orcus.Commands.Passwords.Applications.CoreFTP
-Nr
fWriteHistory
1t%!
:0$d
VideoArchitectureToString
XBKf
Empty
"x#PeW)/
get_YourName
GetInstalledVoices
#s9N
RSACryptoServiceProvider
Kw"l
YnA!!
WS_BORDER
MassDownloadServer
YV,I
<Main>b__12_1
,xmb@
pcchCanonicalized
FileShare
,Ms
NBNm
Ut!H
F5Na8
;J%(
StopConnect
prV@
N
J`+
}:]r
set_X
_logFile
Bs"[
Orcus.Shared.Commands.AudioVolumeControl
B|	_
set_ForeColor
RW6Ka
Close
BMGI
_unsafeStreamCodec
l
S>:
_urlHistoryList
y="&
Encrypt
VMW_HILITE_MENU
7L5+@
+;V+
5{oC
G G Ga{
]+ak
#`q$.4
MM--
<ClientPath>k__BackingField
HandleRef
Kg&c
Read
GetSubKeyNames
Xp]w
v~v9u
A{}O
ttb_N
<Session>k__BackingField
w.2s`
zNZ_
screenCursorPos
b=.?
6OV}
[/y4#w
gyA$
jyUa
)D	y
get_StartExplorer
Z[WV
Ag4'
/\do
lpStartupInfo
wzZNg
ToSingle
GetFreeTempFileName
p*rjB
3fJKq
MENUDRAG
get_Scheme
$	fNy
fqjDK
set_CompositingQuality
zGxse
Yg4m#
eventMin
+fL3
GE?7
:4 Q
hmodWinEventProc
e\7f
PluginInfo
7w|w
RECONNECTDELAY
mscorlib
8Q?
%r{$
)v~v
BUFFER_SIZE
RegistryKeyExtensions
_serverConnection
PW	u
;JQLG
akKYb
d
lpvParam
<AdministrationId>k__BackingField
LrtgZ
AdministrationConnections
H%C
S%|*
Uv0|
Orcus.Shared.Commands.Keylogger
RequestKeyLogCommand
lLV0
pY
W
/+sf
8u
l
HSHELL_REDRAW
DrawFrame
23
B
ControlCollection
FileName
jIK?
DeriveBytes
VideoMemoryTypeToString
IME_COMPOSITION
5!-=
IgnoreMove
$Se"A8
otoL
%21)iu
ClientStartup
ManagementBaseObject
WindowsIdentity
z&zu
<IV>k__BackingField
TABLET_FIRST
ReadOnlyCollectionBase
className
g
$J
4J^W'
{nKw
_floodingThread
RuntimeTypeHandle
@:s/
method
Starksoft.Aspen.Proxy
8XU
wXJov]
J5Ccb
uCmd
d.^P\
IegA
LT>[*Y
<P n
-%(
MozillaDecryptor
`*[P
V{
{
l=#B
UInt64
sender
P9(*
DesktopWindowsProc
W|QG
Nn='
IPEndPoint
P$I.
get_Frame
action
sf{/
GetExtendedUdpTable
set_SetAdminFlag
B<h1(
RedirectPackage
bq%,
-#1,@[
,-*g
R|R|\
^8d$q
33z:
_is64BitOperatingSystem
ConvertToState
Yo.G
SC_MONITORPOWER
_K4N
WININICHANGE


*
gQ}X
DeleteKeyFromContainer
AppendFormat
JcNU
2#ffffff
WindowsBuiltInRole
>n(F
0=;O
FORCEINSTALLERADMINISTRATORPRIVILEGES
}?KnAN
]a]
(kg,k
3\5<
*4N~]UHY
~"AK+
8+p
set_RedirectStandardOutput
,	0%
\t,fd.:
zyk&
1na/
P4\_
>heJuo
.wx[
GetProcessByFilename
7gV
remove_SendMessage
set_Cancel
4	f8f
"hXW
x#|/"_
get_ExecutablePath
(9~8
)T!
>G}W
X4zu
CH%1
PacketSize
set_Revision
Y$b$
t%BE
vF.~
U*w"
)~]Gm{
- [|P)6
#
S2
})l
^d8
1
get_WorkingArea
UdpFloodPackage
+f X
Flags
V~Sd
i`+;-
4=#kt@
Nq0_*
|74ys
z?pI\
<CheckRunning>b__13_0
?\
^
~p3
NYO*
StaticPerformance
NextValue
#hfB
l*iR
%!.u
W|<C
i^?1C
().!
Dispose
ReverseProxyCommand
rN
ZFIc
GetHashCode
x0>?
}<o
-
5,%My
meOWS[wokS
m3G8_
9Oh6
S_9
?G
:P$5
E8Pv
pa:
))()-
{]^y
GetDownloadUrl
T$5I
SC_NEXTWINDOW
RB_3
bGNalCPA
'^!fR
D&E<EJE
&	kM
Ed'<
"6W
O/0
set_ClientSize
#5VU
remotePort2
remotePort3
iM=8uTS
jF[`5
Tv*>?
qx5
JNm
InstalledVoice
y--oW
0j`|T
-2
<Source>k__BackingField
.efi
$q63Z
%y
$a	+
1oZ?
_isAdministrator
LS%3
`VE~0
xL)q
'k8"
[K+o
,Efg
Orcus.Commands.ComputerInformation
N%i%
9	V@&
L
);&c
p9v
lpSystemInfo
resourceCulture
@SH;"
get_MainModule
;;?B
U,@I
QnZK
TextChatForm
IB
g
JBI
znQOE
_client
WBy)$(!A
XT!l
L.}c
op_Inequality
QUERYOPEN
ResponseType
}&?"
4t`g
IPAddressInformation
;Nl0
{"	ql
OSType
3&]k
5^.V
cAoQ
GW_HWNDPREV
CancelErrorRead
SC_HOTKEY
l<^,L
J
defaultInstance
WriteCsv
kjvM
StaticCommandExecuter
HostsFileCommunication
W.c/*
%tMJ!
uTmb`
4D53392A6A24D5E801ADA14E79B43F9BEBB79150
get_StaticCommands
<Guid>k__BackingField
w<c}
Sps>
get_RootFolder
z{Bu
System.Collections.Specialized
+-}`
P'jH]
q
LPDI
get_TextInfo
[of4
jA'QOY
System.Linq
<Dispose>b__4_0
LiveKeyloggerCommand
x.J|
get_Channels
fV CIZq
Lmf3
0ml[f0L
ub`w
G9:H
set_RegistryHiddenAutostart
=.hh
-Z/|
=Xg5v
*]nfO
7,EK
-bZM
T~mR
get_FileName
SPIF_SENDWININICHANGE
|>pU
<$BIG
"=qtZ
p!Pe
TK)
gA>D	b
Cancel
GetCultureInfo
mg_C
m3W^
$^)l1?
<Ac%-]
b y}^p
(2
<>c__DisplayClass14_0
get_IsSupportedOnCurrentPlatform
<j?Rp[}
-8s
ExecuteFileAnonymously
(/
_sendLock
SizeOf
UnicastIPAddressInformation
bdV/z6(
ApplicationPath
UnhookWindowsHookEx
PluginReceiver
m] >
PKX<b
a	zs
phHash
,&mZ
ExceptionFile
(|
},1tR
index
get_Flags
set_Key
w`^{
0i!U
get_Triggers
SP%Fi
XBUTTONUP
(
)()
5P5p5
(d
RgN6[
CultureInfo
lpCommandLine
endIndex
kd0!
9Qq
vKey
K@<P
8F^>h
_reverseProxyClient_DataReceived
(H
Boolean
WM_RBUTTONDOWN
(A
"-_s%
|wf5
V:1
set_Account
NHYE/
GETTEXT
-.k[\
session
i_{/
registryHive
TakeScreenshot
y0p~
j[ZA
w8]G
1.0.0.0
P_qOU38
YuLE
Z`[Q
t*;~
StringComparison
B4${
writer
CompilationRelaxationsAttribute
xKLD
X0.%
,(
i
<9{cGZ
@/hMO`k
AesDecryptorMain
get_Is64BitOperatingSystem
AesHelper
MemoryStream
MessageBoxInformation
/Ug7#
-4.E.Y.r.{.
<>c__DisplayClass4_2
NewFrameEventHandler
<>c__DisplayClass4_0
<>c__DisplayClass4_1
set_Screens
w.0Sw
;,#E[
HttpWebRequest
K##s
J#zu:;
M{c$ZW
#hZW
!]{6D
@<7o
W6z@X
(J,M
:9.
bytes
set_VncMessage
5oi0?Xf,
HSHELL_WINDOWCREATED
.o=
k]]}K
)fZwK
(L:
CDS_UPDATEREGISTRY
DesktopWallpaper
+ _
KS[m
BYm
FileExplorerEntry
0oEz
A3/s6
0j?U*
configdir
x>G$f
Orcus.Commands.HostsFile
<o'O
|bme
set_TotalMemorySlots
Orcus.Service.Extensions
X	o0
lpMinimumApplicationAddress
OnStop
a|r@
VvxS
Orcus.Commands.UninstallPrograms
u3k6
6$72S
SslPolicyErrors
(
=F
!T/^
MDT4
5'*
r.L&
53q6\k
set_Height
't5Sl
dkm2
@
c$_
Orcus.exe
Vk?d
connection
7QK2
|54@^
V.Sv+
+Sa8
:
(2
_
}UI
5{6w
DoMouseClick
-&jZ
Ol"{
8nbk<
!_Eqi
WCF_PAINTMETHOD_PRINT
[{dF
ADDURL_FLAG
Orcus.Commands.Passwords.Applications.Yandex
!G!
0zL
8;3C
,N;t
desktop
Rectangle
wiQY7
\uml<o
qNm
;-C}^C
wg@<
set_ServerConnection
s$
s=
pV
\;t&Q]
<4zQ
<Z201
Concat
' }C
eNs
:dyu
Orcus.Commands.MessageBox
C&^
get_Data
eaV<
func
REGISTRYHIDDENAUTOSTART
73_a{
get_FileVersionInfo
f<JF
^PR
/
@?#6
iIcon
4U:M
X
Kg
HvncCommunication
' ZAF,WQ
<Path>k__BackingField
,>q.
1:&|<
{;G)#
bUpi
ucL%
=Vv
5J0'
BE%T
set_LogicalDrives
N)K:
get_AddressList
KEYLOGGERENABLED
XYo0
$~!q
2.[+6
set_Username
pXN.
k?_x)
duud2
C8#f
Orcus.Commands.FileExplorer
JSl{
?N5
1BJX
zEYu
tM#x'
#-#r
Sw#U
ReadStream
nCmdShow
_msvcrDllPtr
ReceiveData
add_ApplicationExit
qZht
System.Text
!zgJ
q
"!
4s	G
CancelAsync
add_ResponseBytes
HIw]
iUp
<InstallIfNotExist>b__0_0
-Vx
System.Collections.IEnumerator.get_Current
e+g697
G~Zs
dp"w
A|wC +e
lpApplicationName
hObject
TCARD
,ewmk
FDB}
sa
HvncHelper
|;Q|U^
ByteHelper
eqN9
t5gR
.?xnW
b}k-
HTNOWHERE
u%+[5
set_DnsName
SHGFI_ATTR_SPECIFIED
1fo
J\eZA
AudioEndpointVolume
=PLe=d
MOUSEEVENTF_RIGHTUP
p\
'
-
	r+
SC_RESTORE
a=sS
|=?{/
SY}g
location
^d#x
+p?x
input
bSwap
{Ng
94A9
?MU=T
:s+9
XmlDocument
>FBg
vm,=ShIH
kx#O
|>6k
o<s<
AeJ7
Lr_)
RegistrySubKey
?I,
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=10
EqLH
HostsFileCommand
d!*Hy
i^*
N*y{
nextId
d[e>#2
5HVt#
2?'S
rz.7_
g
~M
n	C;yH
<GetHardwareInformation>b__10
gXxw
=]@7@0Y
<GetHardwareInformation>b__11
2,c:
PRINT
_:+EC
a	@`
]@x
%29/
TryGetValue
ljZ\
rH
DebuggerNonUserCodeAttribute
mi/F
get_Title
,]?i
g:gh
0zO"
remove_KeyDown
#@gk
\Q/U+f
a^%U
r%#
fa:
set_Model
WM_SYSKEYUP
DebuggingModes
EventLogEntryType
P"TW
System.Configuration
m>
|G
WO?Vy
certificate
PY|{
.Si
CXd.
%
>r
ToArray
DateTimeKind
F!6Y
y -q
XyHG
set_InterpolationMode
IsInstalled
Degrees90
<IsConnected>k__BackingField
<%R.G
#=Nc
U8n
d*P
>06#}
'	vib
Handle_Connect
CompilerParameters
User
URL_PLUGGABLE_PROTOCOL
<96F#
;:>KJc
{gq}i
UgVJ
dwSize
Hy8]
Orcus_Service
UOI_NAME
:FHk(
NXf
!$wQX
|;,Qk7
dmDitherType
!(kr
54iU
_Vrv<en
ScrollToEnd
_stream
h%DK
#Mkh
j,7:t&
Xa2`
7uu
FirstOrDefault
3){iu
<reh
SystemIcons
_@ j*
duration
F2
}9
7A.Q
/K.1]
"p;7
-*bq
p	(L
psrw
FromSeconds
('FT&
|UZVCbZYYq
t@u
Re(,(
CallingConvention
FkIuJ
mWB+
NCLBUTTONDBLCLK
p]}U
AddressFamily
KEYFIRST
Degrees0
^pGc
<Loadables>k__BackingField
DirectoryInfo
Orcus.Commands.ReverseProxy
"~Xf
zJ!G	9R
<EventId>k__BackingField
_C7?w
{WGE
P
costura.aforge.video.dll.zip
RichTextBoxExtensions
[}IK
u>z&
\EK+9
iK1bj
2k(k
:}T6
.Bs<
@7h+^
FW45
M
kL]
code
Q]i)
FW40
7 _s
ExtraInfo
%u7#
CreateChannel
^27>
j_V6e
<ProcessCommand>b__5_0
2N#X
tz=PN
IsWow64ProcessDelegate
item_name
R."
prR3
B6\
iB
/
]A6
B%%T
GetSoftwareInformation
rYzC
tc;k
G:7B@
ClientConfig
1	Wy
g:(:\
+rnoz
<SendInformation>b__0_2
KD/}=
NCDESTROY
ProcessListChangelog
MUTEX
QueryUrl
2(n
Q%_$';]
~&
U
7]A
\J3]
.!^z
8I
+
Render
CAPTUREBLT
LhlfRS
URcY
Gc=
add_Connected
L?P=
<GetNetworkInformation>b__9_0
C,o9
[4^m?
GetRoot
-XaU"
t~\-
QDjE
V&9:D
hTPD
#O;e
NEXTMENU
;%(c
vH[4
D6j,
<!0Q
,ov
DiBNY
get_Length
_Q#~t
SetThreadDesktop
c
flas
,M;
&K$i
SC_DEFAULT
_v
,h_
get_Target
get_Ipv4Address
7Ox@
0xd=Vb4
tI,_
nHeight
Stream
Orcus.Commands.TextChat.Utilities
U
G	B
lNJ
&^]1
set_Field2
ov]8
@<*7;
9#D
>F	O Y
SYSCHAR
c,Uo*Op
XN[O
HTGROWBOX
PAG+
R].
2te3>
I"-O
RT	0h
shlwapi.dll
Hr|"YE
1#LO
Windows Input
Tld}l
BindToObject
87s|
'W5
^g)e?!=?J
get_Commands
ZKH)
CPoS
MIB_TCPTABLE_OWNER_PID
W#v
~hjS
~(Nh
Vixd
9&`J
X}O;
~Gci
Sat
9z>~<x
haK
]\
set_Description
BeginReceive
HnP7.M
>BZ|
uAction
WH_SYSMSGFILTER
DISP_CHANGE_FAILED
cbSize
set_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
M5f~# N
0:.>n
196;(
dwProcessorType
r%H0
process
eX/S
GAWO
x|s?8'
newWallpaper
Fc$0
set_ServiceName
pocsUrl
#6L!
set_Image
t=z/
}t+iI
y
_W
get_LoaderExceptions
hnBbO
m[-^
EventHandler`1
,]O2
qFMd
V
t
tGi
^MG&
G>K\
ProcessToProcessInfo
<ProcessCommand>b__4_2
<ProcessCommand>b__4_1
<ProcessCommand>b__4_0
<ProcessCommand>b__4_7
ac?4
get_VoiceName
SHGFI_SYSICONINDEX
0VB/A
x2sY,y|
CSCore.DirectSound
="$u
GetAudioDevices
Mt#8
KEYEVENTF_KEYUP
82Ft
HTMAXBUTTON
>Q)\@z
r{{=4r
b9m.
`Y<|
WS_CHILD
m
O~
GetForegroundWindow
<Connect>b__29_0
hKGo[Sco[g
%-,&
~cYEEA
u;K'
^2t:
GK3&
N<Nz
=emwJ5
)!H
Match
O|.GT
get_SystemPageSize
sYsx
get_LogEntries
RN*(
WoW6432
OpenRead
K3F@
set_Resolution
~^Yo
"g_O
>Iz_
l|v^
2|/yY
ppvOut
UninstallableProgram
AesCryptoServiceProvider
Jx_
C7>B
Register
V2*{
,M/J
qbp>
TryConnect
get_Installers
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.get_Current
NgP8
>g"_g<
WI)?
set_Id
]RxY	/Ka
remove_SendResult
Mrw
/e04
hObjSource
l|vr
startIndex
VYTJ:
WriteSpecialKey
RotateFlipType
playInformation
Passwordcheck
MinimizeAllScreens
=<5[
()D+!Z
C'mQ
Qol"m^
System.Drawing.Imaging
OctetString
SC9jO
1Orcus.Shared.Commands.Registry.RegistryValueQWord
;*VC
JaT*
1Q4
8Vp
dmReserved1
?	TY
CurrentConfig
RxN
K4\6
j\_.m
Ga;X
{8:Du\0'D
.B=E
d]T/+T
1p_V
IsNameOrValueNull
SETREDRAW
STATURL_QUERYFLAG_NOURL
;9E<OTD
FrameworkVersion
J	SyV
#(0[
xQs
set_Culture
Km-V
get_ResourceManager
{$wR
P@$4P=G
c>k\
<ProcessCommand>b__4_6
{$w@
Ak*]pJ
=K/XNY
sM.['
UBY)
System.Collections.Generic.IEnumerator<System.String>.Current
t5e7
set_IsWorking
^
DI5
NewTask
length
p}S@
VoiceGender
oyM
5^_Q
hKey
set_HardwareInformation
$| %
Program
DNrO
$yE1
c|&R
V<p2
Orcus.Shared.Commands.RemoteDesktop
&	o:
>B71
cP;R
start
P.	Fd4R
vh"V
PmRhl"
kI6
&	o(
WCF_PAINTMETHOD_PRINTWINDOW
Y bV
P~]_0
M{-{p
hRh0O3(
<C>
h2#s
FNOZ
^b7
GetModuleHandle
PixelOffsetMode
Integer
*sP
nOEE
L%dJ
*sm
{y\]P
B
E@
?|W!|
&t-
v~
j
set_Length
Shutdown
RLC+(Ci
!4+s
^m:
TRYOTHERAUTOSTARTONFAIL
/C<-
CreateDecryptor
set_Connection
<>9__0_2
<>9__0_3
<>9__0_0
Installer
X#WBz_Z
<>9__0_5
rt=
SW_SHOW
-).;
L<Zg
NCRBUTTONDOWN
g2CS]2
N_)Y!i
Yr5>
foy/
EndPoint
tFyD
Qh+L
CANCELJOURNAL
.5+7
Xn?Q
7Q	C/
/}2_
dmDisplayFlags
q)PcNCB
IME_SELECT
VNXy
Multiply
lpChar
=4["
}zY/
ew'Z
BeginConnect
SETTINGCHANGE
!wb_
H9-7
WSsco
<WindowInformation>k__BackingField
J^<P
eHw&
CIM
SPI_SETDESKWALLPAPER
get_ConnectionInfo
GetBounds
EVENT_SYSTEM_FOREGROUND
;dx_59
nXi
Ec:Zt:
ResourceType
Nxe4
<>9__9_0
modeNum
get_VoiceInfo
usnp?
Zh"!
ivB3
o^sC
<45yhR
*.:~
\E-=Y
bvyu
set_VideoResolution
C3?Y
CkK,
UNICHAR
pszCanonicalized
y7-N
+!]
q6-n|
<GetBiosInformation>b__2
;2h?R
handle
qW6/
OLY&
`i^F
r}b-\'
{?N{
<1iVZ+:-5
t\>i
GlobalMemoryStatusEx
ifFn
F'S
GetWindow_Cmd
timePasswordChanged
W
4k
oeV+
'#'
j/Dg	n&h
|X/gd
ByteArrayToStructure
MOUSELAST
GETTEXTLENGTH
'4Nc
"t E
KldmjP
'``O
|i8X}
get_Resolution
_readByteDelegate
Orcus.Utilities.KeyLogger
set_TotalMemory
Z*Wb
n?n
Orcus.Commands.RegistryExplorer
0B/k
Q)KW
<PacketSize>k__BackingField
Settings
*a\+
s1&JE
kEu^
ServiceContractAttribute
GetWindowLong
".Fe
get_InternalName
DeleteSubKeyTree
Tm^4'v$
_isWorking
7?/l
sPg>
RegexOptions
HvncAction
_QV.5
<gLB
CopyFromScreen
IDisposable
Ih>Fy
get_FactoryCommandType
SHFILEINFO
mRhRt
ullAvailVirtual
P$Z@h
_ipEndPoint
/KG<1
<y^-
CreateSubKey
DatabaseConnection
\~4rK
set_SupportedLanguages
{e%]
]^t?D
4eBe
j.	t
<EcO9
qD`
g$3/
\\mv
txDR
2.KB
f59IV
ZwVa?
CommandResponse
DoNotChangeOwnerZOrder
DownloadString
d{	^
eu6,
VDHK
set_AdapterName
2IR[~Z
\AF#
<=8"
ebi
RemoteActions
*V~2
CancelEventArgs
.-Qq2
=t[\h]
Orcus.Shared.Commands.LiveKeylogger
6
>D!
IZ?
Ts$u
WMwz
get_LastVisited
n-|_
&
R 5a
lyT2
c
#\K.cz
_isRunning
Sdnx
EndReceive
>W	4N
x.scpp5
SC_KEYMENU
@121
set_Enabled
Sort
get_Exists
<accountKey>5__2
UDP_TABLE_OWNER_MODULE
IsInRole
ae/_
M
ZoM>
E541>~
Passwords
ThreadExceptionEventHandler
i{	2G
>/YJ
kAG9
A#h"
WS_POPUPWINDOW
%cF)m
VBCodeProvider
\)Mf
L7>s
'#o
E{8zP
phProv
executableFile
KillButton
`>/fy
N[;d
p4Qj
Synchronized
Dk^{H;~
_jz
Xfz
_j&e
u<_M"
1E63
dwExStyle
hngdu6h
WS_VISIBLE
command
SgBz
C*7)
GetValueSafe
ANTITCPANALYZER
set_DeviceName
FI$|S
NsPS
KeyLogEntry
get_Line
GN$_:b
O}F
get_AllScreens
' $L
5j-H
uF\!
ardj8
CalculateMd5HashFromFileToString
GetEncoding
\Odp
set_Is64BitProcess
FilterCategory
I[sl
M,O=
\+
(Y
eO\
ALG_ID
Xl1;<bW;:y
}Pro
z>`w
1:M1g
zb$&2
JEPM
SETADMINFLAG
$AFA0DC11-C313-11D0-831A-00C04FD5AE38
AJHo
hPT?W
5>2n
NullReferenceException
~ZjE
*Wk4*
Y0\g
^c@b
5$E2
WR
{
&$x?0*P
r,
.Y};S
pluginSettings
G/R
4avy
get_ErrorText
i?um
54N-
StartDownload
C\a,/
set_StartInfo
_pluginReceivers
STARTF_USEPOSITION
c)`u
a~L%O
<Commands>k__BackingField
+,
Is32BitProcessOn64BitProcessor
UNJ?
7#
NotepadHelper
a&~at
MouseAction
*/2n
synSockets
cZ`D
1M~D
th#T
MZnR
Xuu
AFXFIRST
!Y&@=,
<ApplicationPath>k__BackingField
m8'=
get_AllTasks
+%j
gK
desktopName
Tp8
set_ProxyPort
y*IT
get_Size
`N9D
set_Arguments
j8?&
<=p#
I.gG
Si"
Replace
+*	j
(2V5
CBc8
H0&^
GetCommandLineArgs
<UdpSockets>k__BackingField
add_DataReceived
L- kL
nL!Q
%!uV
lpInitData
Z_5:i
y{~8
GetServices
m`f
browser
J%hT
Bc\)IR
&*D83
Bu%T
HANDHELDFIRST
set_StartType
COMMNOTIFY
dmDisplayFrequency
@0|o6
n\
z+
%rI0
ResourceInfo
Hl4x8
!~v
pdWFs
?lF
p]1=\p
W#<y
Po??
9O6i/
?it<
SHA256Managed
SC_SIZE
:=JL
&2Da
F]{
,Hg
get_TcpClient
bbOJ>
-/uU
WDW@
*5%-/
SCF_ISSECURE
&?/
_configDir
)Y3"S
<ConnectionInfo>k__BackingField
Mb4R+
NCACTIVATE
DZ\W
Orcus.Shared.Core
C3e)
kiuBd
l kM
wJ_4=K
BeginOutputReadLine
Tfg&
NULL
GO~H
},Il
.2B#c
#"m
DWMNCRENDERINGCHANGED
K?/
Al1R-eC
06-i
SHGFI_DISPLAYNAME
<>4__this
vZ2r
&?1
[	n)
f\%
GeneratedCodeAttribute
#^N
wD|Z
e(v(
`Lo
AzPU`+
TPA`
MWrp
_tG>
&?=
SHGFI_LARGEICON
et_`
xDY
SrA7[
C>]q
;KW^E
get_IsInstalled
trM
{
Uj+]
'P!
70cx
z'U~V
+i~YT
CheckProcessIsRunning
C\;X
status
uVirtKey
`d:0
GetActiveWindowTitle
&Bq2
!]O|
-
\Sj
X
7K*
@O']
B:[C
get_WindowsFolder
x|G$
G,Ao
ProtocolName
Orcus.Commands.RemoteDesktop
{~9#
GetExtendedTcpTable
ResponseBytes
jU>49qKG
KW9s
set_RegistryValue
\~7qK
Orcus.Shared.Commands.ActiveConnections
#isrr
aWP ~
s~G*
)Z_4*B
<SendProcesses>k__BackingField
')Zl
do=Q
7VPzl
U}p[XR
Pipe
IsTaken
]4m\
Zop(
DESKTOP_ENUMERATE
GetWindow
ullAvailPageFile
iO -k
Y9-W
_errorFile
}osX
:202Pw
Substring
DateTimeToFileTime
_YFwe
BjjU
s>c|
}haL
65976E8BC1E21014EFB963E7F0E54D344F1B81A5
n%Wt
_clientsLock
MDOt
Sb.:
|D+q
g#;
l(v
pwR	{
E
/(
<Version>k__BackingField
tMYu
CompilerErrorCollection
<line>5__1
lpModuleName
ZZ\
-"m#
CreateDC
_;]"
m?
[1.
A{h4
hStdOutput
jT#%
ANTIVM
ShortcutType
_otherColor
RegistryValueBinary
m~7o?
algid
_tempDownloadFile
,`u
O
Ceiling
;-Ym
jX(8
get_Left
D!3B
g,g	9
)ioR
Q	qC<
_screenWaitEvent
SC_PREVWINDOW
set_SystemDirectory
/o[{
Serialize
'2 I
FhCr
moUq
f!g-
nu<~
encType
6^ Nn
user32.dll
ClassesRoot
dwYSize
9w
OpenWebsiteCommand
; DQ0iN
->~
ProcessedByFody
1@7!6
sDlvE
V$Q:
S.;&
aNNp
]a_-
xx[%
jgW5:
GCHandleType
<&Bk
(v
~$
C\?
TB6J{
<DrawWindow>b__0
>Fy)$	^
LFvv.1
Consts
v~)t
{%9
_windowPrintTypes
rEC
SystemParametersInfo
)P>#
get_Top
Orcus.Shared.Commands.FunActions
=|2]
System.Net.NetworkInformation
{~9#a
CryptGetHashParam
Point
y<?F
Q-|$t
|b/u
^Cz-
z`Q|Y
%r/"
LST8
AssemblyCompanyAttribute
TASKSCHNAME
remove_StringUp
RecoveredPassword
Q#(A
r<@p
qPv6
#+@	E
SMTO_NOTIMEOUTIFNOTHUNG
SetWindowText
set_TotalPhysicalMemory
0.1.0
iCqE5
HP_HASHVAL
jvvxs
WindowEnumProc
hL'b:
_Y\R
1O&z
SC_CLOSE
0}_}6
<GetPasswords>d__0
<GetPasswords>d__1
Z%iH
NOTIFYFORMAT
set_RedirectPackage
HTCLOSE
\8V1
!Sul
AppDomain
9<0j9
b`%0
l
&
Zx6
audioEndpointType
SetUnhandledExceptionMode
WinEventDelegate
A}cm
;wvB
Q>b-
FromStream
rb=L
CPL_LAUNCHED
PADPADP
SetCreationTime
h2J88
DESKTOP_CREATEWINDOW
-E-5-
-mf;
CREATE
uYKq
XI
vYLu
- ~n
=n"3
@xHK_p7
<EntryName>k__BackingField
mL_`
[!:
RecoveredCookie
get_TotalMinutes
#`o7
JZ?d
4j:7
Y3om
~A]=
EB1y
p06L#
>*v7S|qVn
YogBn
C?zO
W	Ao
M{9
h2"~
@6/r
J<L]Uf
w	'{
%#|[
BuUx
)cN(COE
RegistrySubKeysPackage
Win32api
Control
(^
<GetFormattedKeyValues>d__4
rcClient
R6N=?C
OnStart
ELK2
CompositingMode
[!E#]\r8]
OR$598
X7
Y
2kw>
T(\q
WebcamInfo
ToUInt32
=
f6
I<Ab=
remove_ActiveWindowChanged
GetAudioDevice
CommandCollection
list
pluginReceiverGuid
> 2|
"
9Ai
LivePerformanceCommand
get_AdministrationId
LObZ
CanTryConnect
Ln*?5
Type
2jH0':)
PVD=
m1x/
op_Implicit
LogData
jK/YU"uf
TB?f
BasicComputerInformation
nFolder
qm^[
bqVK
HIDEFILE
Q
O4R5
@3}j
TCP_TABLE_OWNER_PID_LISTENER
_i@\
AwQ7
Orcus.Plugins.IConnectionInfo.ServerConnection
I*1~
get_LocalEndpoint
set_VideoModeDescription
ASf$
x=pIO
lpSTATURL
<>c__DisplayClass1_0
myfv
<Monitor>k__BackingField
pV	g
KjU8Z
kI|Q
Sz)^I
s|D<
eventMax
)?Fs>
\VTg
?M.w"
Qmn\
MERGEPAINT
#f!2
B3L.
b"Xm
p~5d
DeviceState
*2&=+
T?NoK
GY#3
Wykb
DM_PELSWIDTH
o-mo#Km+
lpReserved
0\C
Plb}
>gI:l|
sb|B
~gir
vB}Y
:%w
_currentChatForm
K(R
ZMu$
P,[q
h#m#qJn>OM
U+wy
}28~
IsCancellationRequested
,!nd
Orcus.Shared.StaticCommands.DDoS
;'PJ"-
8=C@
5.d
MDIMAXIMIZE
get_EthernetAdapters
*1:v
SC_MOUSEMENU
$
_1
YDK
+eZ%
DESKTOP_CREATEMENU
gdjbjp
7B6
><?U?
+]	>
$<l=k
opN7
,$
add_ActiveWindowChanged
XB1L
/7
O
OE>
<
GetString
TV\e
remove_Connected
WindowsPrincipal
OST"
J+y
4X>[/5
WH_JOURNALPLAYBACK
WaitHandle
*{J
DayOfWeek
Button
gzip
<urlHistory>5__3
get_IsHandled
U:$|
YZMg
~QBOx5:
IL]+iY
732u
8_hG
Orcus.Shared.Commands.TaskManager
rV9
set_VoiceGender
left
e=+
"!_`5/?
dmPelsWidth
jp$E
vZ4T
YhP*
:ynxh
+4!td
Cuaw
lpFileTime1
dmPanningHeight
ServerConnection
CreateDirectory
rgelt
FrameSize
StreamWriter
;sN>S*8
L4ZRaE
get_ASCII
ji1k
get_Primary
DJD\D`D
_BH
set_Passwordcheck
SWEU
rectangle
8jLZ
FileTransferTempDirectory
+0k*
XwxL
)=80
WaitForExit
'SrFY
^n
|Y%q
get_X
b:}g
nWidth
>xP_I
WM_LBUTTONUP
&5#2j
$3C374A42-BAE4-11CF-BF7D-00AA006946EE
[AtFy
}K>?
HTRIGHT
?H.Gkk
set_ReadOnly
Zqu6
poctNotify
`.rsrc
;M\S
Jl
e
InternetCommand
uy@'
synData
{Ngv
]:o?R
uOW6
\Y
'*>"
,MN/
q4=/D=
OpenRegistry
e~ ~
AudioDevice
DesktopProc
System.ServiceModel.Description
o!r$|
,/D>vEK
DeleteValue
\#OMi
Bbrh
GETTITLEBARINFOEX
\\Di
/JuG'z
iD$p
d)>U
f`u
O
_keyLog
[k!=
~h;6T
f^{s|K
ZV`n
?K$k}
COMMAND
uB<_=f
add_ThreadException
IjLRh
mPVv6
AddToAutostart
6]rI
registryValue
E?
.k^Y~
;9%A
["@>m
4]_l
3Iuu
WcUN
0?u.
K@o
cxWindowBorders
|i	_F
fkir
p[Kk
k IjJ<
guid
0lKOus
|iX
E!	l
, ):x
2JXFG
qZ3P
XC)$0;
WebRequest
encryptedData
l|(g]G
;r\A
ImageAttributes
}y/
Mj=%:
m5H?j
9b_@8r
iBc^
<>9__0_1
AesEncryptorMain
9\KE
vL"q
<IsEmpty>k__BackingField
^Yj::+s
9"u-
O\*:
LBUTTONUP
b\n\
D\Ip
SRCERASE
{"q^2
set_Processes
EnumAudioEndpoints
X>tMX
Hook
5q^4/
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.Current
y_w5/
tYXy
%r="
cXm=.
-(ZA
6t*yG
GetIconFromProcess
kernel32
HSHELL_ACTIVATESHELLWINDOW
P//\
idChild
6zS.)
ExecAction
set_AutoScaleDimensions
L5+v*
<DataMode>k__BackingField
^_91
WM_COMMAND
Orcus.Commands.Passwords.Utilities
r+TJ
Stop
.E$
set_SystemPageSize
get_BigEndianUnicode
GetRootOwner
EkmT;J
plii
procedureName
+1.w75
MOUSEEVENTF_WHEEL
9%<'
`gJN5
ToLocalTime
J$?g
Tz<
rLDboL
P;T{
mObject
:!
A
ENDSESSION
lpsa
rk
get_Now
t}XZ
WindowElement
(_EyL
client
SequenceEqual
ExyzO
]'w
KoUx
set_NetworkInformation
t)at
DROPFILES
P@E(
ChangeDisplaySettings
BKLS
?e:Gr
fo~#V
Zc_h9
G/^v
-Es=
}zYO
!,``4L
~&m(
\nq<
udC
+
@3w-[1HV
zrd,
=z&;
Reset
ApplicationContext
ACTIVATEAPP
FromHwnd
GetStaticPerformanceData
&]&f&
FPEZ
shlwapi_URL
1SK
/
(Z
Instance
IconSize
set_MaxBufferPoolSize
c7%1.~
BK5
<IsAdministrator>k__BackingField
xHotspot
L]R[C~}
-3sP
RegistrySubKeyAction
1w0h
FileVersionInfo
QzS
nYDest
MOUSEACTIVATE
{D	F
B2:7
IME_CHAR
czxV
{dyd5
YW}^qO
:u*#
System.Collections.IComparer.Compare
*anXB
FilterInfoCollection
S$NR
Rn>G
Ep	8kM
hu
i
m!z[
f'@
y
aA@[
_fileLock
nullCache
^OGT
GetKeyFromContainer
MENUGETOBJECT
NM:
E&Q.y
ToUInt64
QTjiY
(p0/8H
GetClassName
yzBK
#Strings
k:_m
tGlSM
QUERYENDSESSION
yQ$i
Image
Q"]<J
QbZL$L2h
GetWindowText
SMTO_BLOCK
[	S5H3o
<Handle>k__BackingField
rU-
R?^gz$[
JB%Q?
HI:IAIZI
*OAtFy
l[ ,
gy*q^
FreeLibrary
Registry86
jH{PC
"aWBQ
i,e}
B	_H
Cyj
2h}p
PK11_Authenticate
yfFD
2-9
30(2
Matches
B
n0
=3=ZH>y
M2y;
set_Data
nOW5
936
<CommandResult>k__BackingField
_renderWindows
iThTt8!
bO#\=
6yJ]D--
Y>?#
set_Mutex
' 
dB
EventArgs
HTMENU
Left
%-&s1
6
z
KSq>
GetEnvironmentVariable
GetType
;_	YY
set_StartPosition
System.Security.Cryptography.X509Certificates
`uDZ
d*oC
PU34T
pG0km
%-&s!
]5]B
.),1
%-&s+
$XY
icon
ov&
RNu\
Qe;~
}}]'a7q
q&db
<wx
ShowMessage
0MEf@2
System.Net.Security
f ve
_serviceConnection
fP0a
KillCommand
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
&FTv
+;d5
RegionInfo
62zuHr|	rO
iLd{
<>1__state
<KeyLogFile>k__BackingField
Orcus.Utilities
Windows
Mg}:
j5g]
'kOp
;n$!
taskBarWnd
KuK7
set_OSType
Lt}z
]3QN@]
sProcessName
NOTSRCCOPY
<O!W
}ecGm
}bpO
9$g=
xaI[
bottom
_pSize
LmL
$s -(yT&
+U\Sn
<GetOperatingSystemInformation>b__6
<GetOperatingSystemInformation>b__1
<GetOperatingSystemInformation>b__0
<GetOperatingSystemInformation>b__3
<GetOperatingSystemInformation>b__2
\03!
SY)UP
5i24
KeyDecoder
<FWD
get_Elapsed
?:Aot
AssemblyProductAttribute
SetOutputToDefaultAudioDevice
<FWJ
vO/X+
`(3T
}/lz
set_ServerPackageType
-+0A#KI
MVcL
TxHR
screenNumber
UriSchemeHttp
'Yz~["
NS3<
HSHELL_LANGUAGE
FW^Q
yTdf
%rM"
H9:/
y$bF
VLW/?
NewCommandType
ServiceHost
SECItemType
PhysicalAddress
get_PackageSize
I_{\X
get_URL
2?y
F`z
:g)E
HN"~
&Bn*+
~&KBp
;vW:[
<>9__11_0
&J!
x]a"Jn
z}GN
6|\k
3P\$
BitConverter
>bBZJ/
[w`L
qyxT
%-&(
&Xl:
PK11SDR_Decrypt
<AddToAutostart>b__1
<AddToAutostart>b__0
)v,NQ
#NM6
get_Second
ProcessThreadCollection
Form
gUkT
fv\:
#|CG
<GetAudioDevices>d__4
IME_REQUEST
H]t)6
ofo;
;9r>
8O?
t
V.4Z
STYLECHANGING
~@(M
Delegate
r-(
Orcus.Commands.Console
%-&s
*;`Y
15Ya
^
|
6uFO~
windowHandle
MZ6X/A
get_Timestamp
|':_VK
[8uNW+?h
aryDes
v"Fa
6H*mL
k!{ {!7@n
DESKTOP_READOBJECTS
pbx0
get_Tasks
l"~c
0shA
f0/t
_masterTableEntries
cjl
eUp3
!K7D.
/4C%
cX=U
Orcus.Commands.Passwords.Applications.Pidgin
qV]R
<CurrentImage>k__BackingField
R"f
get_Bmp
So|9S9
x^5"<t
get_Volume
Q2o,
l'PA
Y)`h2O9
Bytes
m-z5T
SIZE
hH?4
GetTypes
Z[=B
E'&%:
"KW|]
^&8h
MDINEXT
:`N%
}6GmtQ
GMs|tuL%
dio[c
h*=?
vU*Mx
b7V},
QUIT
CreateValue
get_BootMode
Yl%ny
p%Q
j]_J
BESn"4
U.$4
5<7h
yx{B
pszPath
riid
\zKN
Contains
ResumeLayout
efNk
{2SY
LastVisited
YZ.H
?>RI
VideoCardInfo
HkKw
p6`Q
B8e=
Deserialize
:2<|n
ValueType
SS?l
!j7-
System.CodeDom.Compiler
7+z,~
nh_]
SetCompatibleTextRenderingDefault
OAx
GetTickCount64
Jd#
|!?R
Y	9|'%
set_Size
%
@sIM
:Y	K
&::{
fo0>
L$68
Y2AS
SR|_
nx%3
ButtonBase
FT?R)
Z3=
bInheritHandles
?@l8G
CxU-
62'{
xnSN]
@3R%
|F=G
u[}S
localAddr
xhJ\
J!N	qR
GetValueKind
#PZmn
]h/
get_ClientPath
Rm
NO&
FF=]
SetWindowPos
Orcus.Shared.Commands.HostsFile
~R}RET
z~-6
;L$rGhw<Eb
devMode
wsIuU
0Opq
N"L
WindowFromPoint
window
LN'\3
<ServicePipe>k__BackingField
s]?eK
.Ro"{
MA_ACTIVATEANDEAT
ReleaseDC
L5/f
Orcus.Commands.LivePerformance
set_ActiveControl
get_Version
entrySalt
IME_STARTCOMPOSITION
MOUSEEVENTF_LEFTDOWN
ToString
H"M
qu;*M
oW5*
PROV_RSA_FULL
7taT
YkP|
Skip
get_Principal
#c%
Parse
<>9__5_7
Z@
d@-
` `W
set_RedirectStandardInput
/"
(
prZK
add_Disconnected
ZgQ\b
oR>A{
ReadOnlyCollection`1
&VkF
SendBytes
chatSettings
@,b8=~
fMa
tblClass
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
D,y7W
DebuggerHiddenAttribute
4{.X^&SZ
ActionCollection
)$*!Q
IJH
p]
7

StringDown
MDICASCADE
<IsChar>k__BackingField
get_RegistryValue
Kt|L
_udpSockets
args
p0t8|[
,X|Xu
Ptt9
t)[QO
ZT/u
aWOa
<GetHardwareInformation>b__8
<GetHardwareInformation>b__9
KE:4
0a?s
y$<;j
k=^|I:;
*G8N[
<GetHardwareInformation>b__4
EntryType
<GetHardwareInformation>b__6
<GetHardwareInformation>b__7
<MasterPassword>k__BackingField
6>4'
* hHQ
8\Ldr
7<C%2Z7
!0R3
Combine
#gK>
message
gR]
!0R?
size
Iv8Y
\mEg
F%Y
jcp2~
HSHELL_TASKMAN
Q.diJ%
sFc_2c
ENY9
=~.
; -d
gz\l
Response
[x1%
RegistryKey
4xgc
`f|d.
DontUseHash
get_MasterPassword
!l
P9^B
<),&
GiEof
AvailablePlugins
y[;^
tcpClient
HTSIZELAST
u4lEk
; -.
.ctor
4o9^b4A
8BsT
GetTotalMemory
+uz
>Su>S
rY1o
get_Message
r,<E[=s
g
kK
+ayN
CommandSelector
$g0$
Y)F#X
5E}
dwSecretSize
Main
WCF_MOUSE_CLIENT_TO_SCREEN
A4C"U
=!"A
get_Text
HttpFloodCommand
GETICON
Ad_S
Fa./0
EtsCdh
SendOrPostCallback
FromDevice
L4,i
S*9@$
U?R3
File
dwOemId
{QtB\2K
set_PixelOffsetMode
otP.pFU
r
2
MDIACTIVATE
AddUrl
9nR~
W^du
lpSystemTime
#&gk
#&gi
V|-5
\Y_k:
`}zt9
Ep/2
jy#'
X&SI
AqOdk3
Nb
q
lF~co
get_IsEmpty
9[Dv
:=.P
Role
+/v
3.7%
HyK5z
KGu%KS
wt7
JW]Q[
Uh{#
y7gX
V	EK
U|H#
title
i<`[c
set_VoiceAge
NetworkInterfaceType
WriteAllText
zX?+
2w1N
FrameChanged
get_PriorityClass
awx
P9M
R:Kb
IServerConnection
't8AW
S,n#
!6_1
<41}yG
7|y
/+'&
NM8=
:"eg
1^paL
q[-q
#B1#7
IME_KEYLAST
Zy
~O#
CAm(
SwapMouseButtons
KCfgG
pelWidth
^]Tz
*.z1J
rUR~
get_ValueObject
@Bpl
p3LLb
tzEs
N}8`
]O/39
gQ:?k
clientCursorPos
But^
Bpb[
l
%
5J<
HgS,
?o]
W]bS
RB>%
Z-.h]
&,Sl
WLw
VX;
WS_POPUP
Target
~1fW
4?L#
LE-g
iOH,
uC}
6@Yw
CALG_MD5
set_TabIndex
?C
ml
{:]Q
DISPLAYCHANGE
8wN,
;/8
get_IsSearching
b=yK
SetDesktopVisibility
bQXy
<nCx$
NetworkStream
set_Application
TCP_TABLE_OWNER_PID_CONNECTIONS
uMapType
P:k\
FileStream
$3C374A40-BAE4-11CF-BF7D-00AA006946EE
msvcrt.dll
!Mhv
_keyboardHook
:q/H
set_CreateNoWindow
D"Gw

RerT
pUrt
RemovePrivateFiles
DisposeSession
lpszOutput
biosManagmentObject
LoginData
<>9__29_0
m/sKF
,F(q
ObjectDisposedException
wP?XM
R75`
Socks4ProxyClient
g^IT
ExceptionsAvailable
{(fin]
>|.<
c0<n
AUTOSTARTMETHOD
9*kg
']_/
ReadToEnd
=6k	\
~>h
4O%5
SetDesktopWallpaper
W:-^
8I8;
3?B;
:c+P
System.Security.Principal
b
_?^N
MozillaPBE
2\E#o
F
YJ
P9ge
CO44
^c>{ok
A7f|
kRuf
x]O<
NewGuid
.Me_
PE9:
;09z	m*
SystemPageSize
HMACSHA1
WindowsServiceInstaller
mo&y
hDesktop
<>9__22_0
hMod
LoadablePlugin
.szDT
}7nt
DoNotReposition
CreateDesktop
q:~I
<PluginsDirectory>k__BackingField
lpqzdClV0
get_ServerConnection
%RY	G
set_DataMode
>sf7K
F7&R
kZeI
HiCc
qD >
!}[#
)	ty
@KkwD$
#ll
unixTime
n8=pz
_keyLog_Saved
EndRead
6n"%U
Eu^o
Ct3n!
Orcus.Shared.Encryption
F@DS
WS_DISABLED
"\T`
;w$
set_ClockSpeed
ComputerAction
_urlHistory
x6AF
4@\I
up@5
ReverseProxyClient
WwH?2
>IS@
speed
lpString
dmFormName
N7e7
GetPathRoot
C7h*8
_R_
WH_KEYBOARD
6
}d
QT7t
vFz~
Orcus.Service.Properties.Resources.resources
IPAddress
.(+e(
WS_CLIPCHILDREN
get_AppContext
F/qQ
=^
DWMCOMPOSITIONCHANGED
e7u}
timesUsed
X*2)
C>u`
set_ExpiresUtc
ExtensionAttribute
]QeA
@G=]
o1v
Show
g|i
9
M65Ka
CCz.4
n/?07&7
P5'}
dt.u
t6dNO
get_IsOpen
v":y
.|7-
j-E
ArgumentException
System.Runtime.InteropServices.ComTypes
Orcus.Commands.Passwords.Applications.Chrome
=#a'
responseType
get_DeviceName
Vd5
F/
d1cr
xYS)
sysListView32
pszUrl
<CQj
szTypeName
tix
<>3__mmDeviceCollection
t580
IgnoreResize
)@[}
NGW
dwFlags
`I]mJ
h!Fp
<>9__1
<>9__0
<>9__3
<>9__2
get_BlockSize
get_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
dmBitsPerPel
#Dz[
RemoveFirst
mq}s
set_VideoArchitecture
[Qhx>
CeUv
FLsj3
;;k]
<IsAddedToAutostart>b__2_0
4=*W
J>gUJ
H6OZ
l&^rY
7{4M
GetNetworkInformation
P2,"
yS=$
M*=*
&P/;
<StaticCommands>k__BackingField
zTm<
defaultValue
LoadKeyboardLayout
HttpWebResponse
;#k<
rdQ9rU
&ne,
_kY%
%l.6D@
C?+e
^uZe^
get_LogData
PlayAudioInformation
UNUh
X509Chain
<RegistrySubKeys>k__BackingField
9&bS
'B']
v,3j[-BL
0vh`+
U5~A
IsOpen
w5*!
~gv
[f f
TASKSCHREQUESTHIGHESTPRIVILEGES
IsClosed
Color
e%UMj8
#M5u
PJ0>:	]
"
aE.
ConnectionInfo
&?I
get_UnicastAddresses
fITBNx0Fiv
BSJB
8F2O
e;w~
CSCore
)JM*
j@GS
7;0Wa=-5W
Computer
B{L\
_deviceList
Second
get_Scan0
I";D
g}
3
IpAddressInfo
QFr6
.XRk
]oqR4
&?~
&?{
60VQ
'9E&
value__
D34_(
[
,'&
Fields
j 
wY
5~0
&?
/0h
c7I"G|
FaNIq+
)QMN
?>s<
z$v0a3
Fsi!
&?!
THEMECHANGED
,\Ay
&?-
/=sG
6:!e4
\xpl
&?3
&?2
$ZO{
QQ3+S
SocketType
n:=wR
hzp,
{Qk5
CannonializeURL
Take
^~@
E]4o!
gpx
IME_NOTIFY
]NtTZ
chain
AsyncCallback
ComputeHash
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
lr^E
|F\l
yObD7
set_ProcessorType
H2Z'd%GF
[G<4
Refresh
set_CompositingMode
JF~F
94C<
1!DT
l`E
Y;u@
yk8z_
QBN<
c0G
`zp
<>2__current
PROXYOPTION
JM;Hcd
add_Stopped
.[{V}yM
TaskCollection
&i3t
FILE_ATTRIBUTRE_NORMAL
JTL~
get_Oid
<SynSockets>k__BackingField
set_SuppressKeyPress
L/"^
get_HideEveythingElse
set_L1Cache
L
g_e=
set_Plugins
*h@)
get_OverwriteTryConnect
FmPs
searchTerm
costura.starksoft.aspen.dll.zip
!|PYv
'#c'2
ctO1
2J2Z2
3mf;
%}/
#f>3
profilePath
VoiceInfo
qz}J
SH;O=
Orcus.Commands.Audio
0P-c
RijndaelManaged
_screenFactory
gODW
|N*G
7Orcus.Shared.Commands.Registry.RegistryValueMultiString
set_Monitor
:b{h
Form1_Closing
YN/
fL*##=
c1W.
Py79
p*r@B
(A
<Ib:
(E
RegistryView
kK|i
IList`1
FromUnixTime
cButtons
d'Z,
GmQ2b#
oecq
(d
5 .z
$.t
\zwB
6}D<
MDIDESTROY
kpKc2
StreamReader
B$~L$~
`Jf;
k}l=_
IntPtr
MDIRESTORE
=QpUspys
chR8
5Ns<
BH,B\
X?- n-
76A6
wRW
`4YtH
7z{
dwExtraInfo
Y)g`
'g n
BinaryWriter
(/
Height
&zuq
$uu
Uiq:1;
<Id>k__BackingField
GetInterface
&}Cs
q3{k
-r
d<:	O
set_RootDirectory
b~7$E
get_OSName
*!W
-P(R
GetMsvpPath
l	wW'
HSK.$Z
{\H
Orcus.CommandManagement
AddServiceEndpoint
*|f9|
15];
JrYW3
SETFONT
}-'F
DataReceived
UnlockBits
?]yh/
set_IsLoaded
'eNL!
$CC]
p}4W
& 'B'I'h'
0#o]k
)yxq
HjeA
ManagementObject
3yO
x#)u
mscoree.dll
D J`,=
FilePushRequest
DesktopHandle
k up
r\5
'b{ 7
Func`1
^Ha4R
set_InstallationFolder
NOoN
pS
?)
02cfqu
<GetHardwareInformation>b__3
":*c)7
n[
[
encoding
1Lme
Nq9
FromArgb
=I2+
DoNotCopyBits
TextInfo
A#xNU
BP5,;FT
F36r
1\Lm
h+Q':
/lUW
\abd
:Uow[
di<}4
<>c__DisplayClass47_0
set_Handle
Cw}5
get_Key
get_CultureInfo
y%</
yaWb>h(
e!Fl
O=eV
#GUID
WindowPrintTypes
+q1qFd
Peuj.
UN89
A 9t
PYD:%ZYz
PALETTECHANGED
set_Ipv4Address
SC_SEPARATOR
_x[_
VistaOrHigher
H%%>
set_NtVersion
* x2
$n07
add_DoubleClick
wNjf"T
set_BytesReceive
-r$*
!{MM
WxeG4
q)(2
ToolBase
,FR.
MIN_ALL_UNDO
':#K
sqlite_master_entry
gN=P
0_0l0{0
?F<c
GetManifestResourceStream
GetIconInfo
Hour
X:F=
*B6H
5~./
mx
Y
=w:i]
i5X@
k G
w[*"
A:M3_
)$1^
Delete
FG}b
xpNw
zhiXbo
%s$
,zFZ
R}RzG
w&hbr=
B$0
^c(:
vw:r
_tableEntries
TcpClient
L(9:G
=?
E]
+mo
%s
DM_DISPLAYORIENTATION
_cmdProcess
@q_%_
WinSCP
E=E0C
#idv
8>8ip
%s'
43=Wv
O3!
%s*
NCXBUTTONDBLCLK
CTLCOLORMSGBOX
%s3
%s4
%s;
changeCreationTime
PFu~
%sC
O.*GL
J}Z	q
IDictionary`2
S	N)
%sM
%sP
%f-r
}n=|
%s[
Label
TextChatCommand
ASq&
JpgCompression
%sg
hDDP,
N^
poszFilter
]"ouV@
CodeCommand
}IA&6
%su
rEbn
set_EntryType
builder
table_entry
Ez:*
Re
v
NMSEM;
M";P
*^p=
get_Bytes
CSCore.SoundOut
Current
<+CI-
Window
W@)"
JVS3
*]Qu
6v>x%
get_Ipv6Address
M~BpX
BEA=
Users
<GetLogicalDrives>b__3_0
7SAj=
:kL%
InitializeFileTransfer
CreateProcess
_lastWindow
set_Title
X(1
ltuR
dwFileAttributes
sEIVk?
OCz&
:!2u'"L
Vy1L
_lkcS
add_Saved
}S'+
R5HQ
_keyboardDelegate
8M}@=
(f{h
UploadInfo
drNvx
ILoadable
hookType
O6|o
SetWindowsHookEx
<subKey>5__1
1AgE
UdAo,
%q)*i
!Yo0
GetDlgItem
GDvtDd
MOUSEEVENTF_LEFTUP
DesktopWindow
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.get_Current
WS_MINIMIZEBOX
o`8~
packetSize
s,#g
i(wu
re"
UPDATEUISTATE
=+nnnl
ToUnixTime
b3
ENTERMENULOOP
,wBX
B:(n)>k
,(
ToUInt16
Mx.#
kQ(M
PAs&
hwinsta
E$R7
^CXt-
WriteFile
:)3)@
KAcww4
get_HasExited
8-M[
get_EndOfStream
E2M
m<F>
4m%G
|
hoB:
SHELLDLL_DefView
get_CurrentImage
MMNnN
$?R
-:ih
\r[N3
"!.l""
<>c__DisplayClass2_0
ApplicationSettingsBase
z*A<
<IsHandled>k__BackingField
KeyStr
channelIndex
AutoResetEvent
yA!q	+
Tz|C
add_Click
[NqwS
-GWS
passwordField
-m+bG
WS_MINIMIZE
l3R8
HTBOTTOMRIGHT
@RhIJBH
MIB_TCPROW_OWNER_PID
*R*g*
Ym1}`n$
*{
:
ReplaceCarriageReturnsAndLineFeedsFromFieldValues
M:RTc
PY
^%x
d<2>
+i6P
pdwDataLen
;&Q
HvncCommand
s@8L
UNINITMENUPOPUP
igKA
8EKfdy
wD#
ThreadStart
:L1`
}\JG
P!l0E%
jW3
tjOi
EnumThreadWindows
{V{B
`!3I`
<Oid>k__BackingField
SC_SCREENSAVE
g
o%
DLwW
DoMouseRightClick
9we/
SECItemData
wShowWindow
set_UseShellExecute
NOTIFY
Orcus.Commands.Passwords.Applications.Windows
hW0;
'oWvaA
<Threads>k__BackingField
JkVZai
EXITMENULOOP
[+=)
set_Objects
W[Lp>f
2-njx'N
TryPushKeyLog
get_HandleCount
SystemIconToMessageBoxIcon
a"a^I
@7an
get_White
hDlg
,+P?
FONTCHANGE
U|2F
5c~S
ijX}
<BinaryReader>k__BackingField
Orcus.Commands.Passwords.Applications.InternetExplorer.Native
TurnOff
kms]k
r6Z-
|HAV
Z.RJzw"s8P
addQuotes
Message
Lv	+
SC_ZOOM
V,P^
W
EF
7nV8
*FLs
FirefoxLogins
get_AdministrationConnections
InstallerCollection
$a&o
9c`
get_Salt
_desktopLock
HSHELL_GETMINRECT
|dq}
ILD_TRANSPARENT
get_HasValue
INSTALLATIONFOLDER
set_ProcessorInfo
!o(gE
MF,B]|
lpProcessAttributes
<} x
PropertyData
z";I
PlatformNotSupportedException
*fs
]0kD
xMSl
u)u=w
set_L3CacheSize
TriggerCollection
[};h^
StartNew
DownloadFile
T%Z=mS:
SC_ICON
Session
get_ResourceName
@n$:S4
Cw;;
lpszPath
!#*E
_synClass
set_Cores
cy==Z
user
XGlP
T@K@i
ThST
\. +&
cbReserved2
:ela:
q
z`
e"3M
<_client_Connected>b__6_0
IsRunningInVm
:5nl
ReadInt32
_videoCaptureDevice
RegistryValue
I<e
^aOu
ManagementObjectSearcher
f@
}o/
gV
q
g[~{
processorManagementObject
5y|=(
:2f!
zRoN~X
(}fkKN
ggbx4
';=?
b<4
ZP
/3z``
Pr&"
aFocF'1
+(/
SendPermissionDenied
M]Ma
get_IsChar
,X
l
Hl}2
.en*Z
<C#A
tl)5
IsWorking
p?qMSL
get_TotalSize
K$N#
P3q
]eG
I@Eo;g
\u;`
GZipStream
P'm1
Mc<'
DoMouseMove
WindowStyles
get_Orcus_Service
ZGS+
]qii
5ERs$u
vn=}\=
Ybbj"
.y&o
<>c__DisplayClass37_0
WINEVENT_OUTOFCONTEXT
PZAvo
e(x
iDKcE
<Pipe>k__BackingField
8y	<
SC_MAXIMIZE
RunInstallerAttribute
atomWindowType
KExX
DRAWITEM
dwAttributes
ImageLockMode
get_KeyLoggerService
set_VolumeLabel
set_Visible
LivePerformance
get_GraphicDevice
#I5Ze
q8tb
o{<!
_webcamSettings
GNdB|N
rz"<
Lc-\W
l<<
mYT=
j'_hw
S^,KfM
SHOWWINDOW
STATURLFLAG_ISCACHED
QGWxo
.QM2
Ux:2
get_RegistrySubKeys
Y9~jVN
\`_<
ClientPath
kH<B
:5$-
A[E[
<Lenght>k__BackingField
SYSTEMTIME
isWow64Process
=37%h}
`pb8
4^8u
RENDERFORMAT
<Connection>k__BackingField
6%/{
HvncDesktop
l)F%d
Tb:1
Hm$.
r-d
isChar
vp?@
QZ-6
)\22
'i
z
Keys
Q]E.%
^u<|
type
)sJxZ
CopyPixelOperation
Q[U?
set_Oid
h5zvw5v
J
U
:-b
System.ServiceModel
>3[U
]7Z8
n![r(:Y
_F\{
set_Values
<._+
2Ms<
WINDOWPOSCHANGING
,5(R
rraKi
Orcus.Commands.Passwords.Applications.JDownloader
B"&
get_Instance
@5nZ4<b
?L(L
CheckSize
.gP=
K9I:
%(L
MIB_TCP_STATE_TIME_WAIT
t+n9K
pr$J
#jw5/
%(C
m$&g
%(@
SendButton
bOjb
RsaDecryptor
mBs<
AFXLAST
Zz%Hw
Td,4
)KNC
set_ProcessMemory
>_/[
6/x
get_ManagedThreadId
Jjb87:
\lX$
odDM
_duration
`)HK
get_ExceptionObject
'Jfpv
SG,sIWDZ
D}kx
&W$
r
Z#
N4n ;
hi*
DEVMODECHANGE
%(/
@yX
%(,
%(+
=o-
%('
%e=J
%(#
=
	P
KL,*
resultSender
,,ot
Cn&/1
co=>
PasswordCheck
get_TimeGenerated
DataReceivedEventArgs
-r^rT
6G>3
eVK
1b
`*&Id
*Ad
[u}T
_unsafeStreamCodecLock
<~C>
zSk~
71 ?
Z usvD
@Ps<
SYSDEADCHAR
Registry
5~`;%
$'a~
Orcus.Shared.Utilities
XmlNode
S2GH
IOrderedEnumerable`1
GetFileName
+3
ComVisibleAttribute
\|efvj
9.n-
set_UseVisualStyleBackColor
)h+`
;i#_L
VT*-+c
^2U]
ServiceProcessInstaller
hModule
B4{.
hive
Zz.!
VwY?
AddrOfPinnedObject
adnOnz
_keyProcessing
`Kx*
fr/
<Key>k__BackingField
Dh*F
V Vpm3
b1=
add_ErrorDataReceived
,0J!
celt
entryName
.#vi
s9ez
NCRBUTTONDBLCLK
SETFOCUS
DataMode
MMDeviceCollection
$/QG
2*p
usBC
;YVR
R|nTT
WebcamResolution
r`\)m
yB{x
POINTL
xK\w
Aru[
)sOp
HlFGj
CommandFailed
kvA_
get_Checksum
]c4vU
SETICON
FunActionsCommand
encryptedPassword
GW_ENABLEDPOPUP
PATINVERT
L0=
CurrentFrameworkVersion
(Pl+
WS_CAPTION
'^6YM)
R>mz
NCCALCSIZE
;o*
J4E6{
Tltd
IME_COMPOSITIONFULL
Orcus.Shared.Commands.Registry
r=3/X
administrationId
WAg?
n!p+
[
R\8
set_BiosInformation
o?L:RZS
pVh?
,b|6
wI1i 8
1.Qh
<ProcessCommand>b__0
<ProcessCommand>b__1
<ProcessCommand>b__2
OpenDesktop
SG[C
<ProcessCommand>b__5
MainForm_Load
<CarriageReturnAndLineFeedReplacement>k__BackingField
get_IsAttached
1q>)V
cup9L
DecodeProductKey
?$YI
2Orcus.Shared.Commands.Registry.RegistryValueBinary
0m8k
gN<V}
:Y:czd"
fxsmF6W
AudioVolumeControlCommunication
p*rLB
uScanCode
D)~e
g% #/
ivsnf
2k,WF#
KkH\
OperatingSystem
\	F)
!	4E
ToDecimal
get_Threads
{sZv
wc3I 7
WW!/
Orcus.Shared.Communication
0Bl<
HTLEFT
Alloc
LBq~#
W
G]
K?m*
eEH@o
,Qgm$
]Z7
IDDoSOperation
CAc(
*Y/@{?C
AcOj
O	U
ScrollToCaret
?D#1
item_type
T.zR
pceltFetched
^q?I
BE5
qqod
znp(
currentCursorPosition
-0~
ChTh
%T|/
G)knN
J_%9w
R1-:
RxJ	OIa
MinValue
IComparer
08+\N
EWprn
Buffer
AssemblyLoader
63@r
TjJ$
K/8
8)'kn]x
get_NetworkInterfaceType
SetCurrent
Viyb[
FromImage
Execute
0)%-
?S($
bbvb
get_MachineName
zNtle2
(,Yx8W*
get_RemoteEndPoint
cw{p
D+ ni
Ymee
IME_SETCONTEXT
.?T
NotSupportedException
parameter
3ID!
yCiX
}\trG^]^8 z
~`!z
DUgA?
q#~9
?=s$
HApO
T9@U
8Q^]
Random
GetCursorInfo
k/K
FILETIME
get_Minor
wProcessorRevision
+yOe
set_InUse
dA4D
T
binaryReader
ToLower
Bs@9
<GetHardwareInformation>b__12
MRxV
+5
+4
jR
lK7,H
)*)'
Sd
>
get_StackTrace
SETHOTKEY
^57S
ctwa8
<GetTcpConnections>b__5_0
z~8]
<GetHardwareInformation>b__13
CommandResult
N/l+
Copyright
PA"
@n
(h
CX_#=
*qUc
>T-,=5
AudioChannel
(5h}
YgRkUDnR
(z
+I
ZHe?
CTLCOLORSTATIC
ProcessKeyAction
eL
N
(G
RemoteDesktopAction
'%s$%
WindowsService
p^UU
4|)2
timer
PE	U
HANDHELDLAST
_enumerator
Tn@k)
.B+e
xxjp
Qs[
FhA3>
FileExtensions
=r	S
CPL_LAUNCH
962
lEl)hft
CHAR
set_Item
dwXSize
AudioEndpointVolumeChannel
!d]C
#}t=
`8h@
\L(C
&(-
@FJ,	D
_uploadInfo
DHd
Yu'e-
+ZJh
Exception
_framesLock
"-)wA
SC_MINIMIZE
3	[
Yo0
xpoFM
get_WindowInformation
E_K$m
WH_CBT
i"z
T(i%
!k'
WCF_PAINTMETHOD_NOP
GetKeyboardState
_s8u
datapath
@oes
Connect
hb6iq
@yoH
J_Lk
77xyW
1	G,g
astable_name
R%,j
*.s^
&a.%3
y(=O
N3O<OWOyO
FileExplorerCommand
<>9__6_2
GetOsFriendlyName
7yAg
SortFileTimeAscending
3uZ<
+D*H
z[1k
ReadTable
{w\TW
Qe='8ZF
J~gz
8Km3r
Wj~#
WL">M
((p:
\}$f
_mz=
2CeOE
<ProcessCommand>b__3_0
<ProcessCommand>b__3_1
eRN%
/
U
SpeechGender
AudioCommunication
TSECItem
H-+a
SPOOLERSTATUS
N[WU
get_ImageLock
]
SN"
S4<kH
.o(t
=pgt
e=+4
!9+
FileAccess
P6y.
5UQn
g
gJ|D?
get_IsAdministrator
C/?V
*.s;
hCursor
*.s7
<FactoryCommandPlugins>k__BackingField
@xP9
T@iR
;MbI&
Y;^"
`v+KL
dwMemoryLoad
Math
-zbBm
/3wC
WCF_MOUSE_AUTOCAPTURE
RegistryValuesPackage
~T>!mn
pE	W
!Zkn
8qD@25
]e}K
U
=|>k
fkg3
|m}$b
advapi32.dll
*.(6
ysA$
<Timestamp>k__BackingField
get_HorizontalResolution
BJTk
H8*[
4;Z4,
_zQl
\z
pO#
[EG|
r}%
j}l
]iKG
`2O~
*ve\
HW`<
hV'Iqw
q{G[
r\}n6
LrtA
<GetPasswords>b__1_4
<GetPasswords>b__1_5
<GetPasswords>b__1_6
<GetPasswords>b__1_0
<GetPasswords>b__1_1
<GetPasswords>b__1_2
<GetPasswords>b__1_3
0g>|w
KL*5
;S
7
%e:L]
_cancellationTokenSource
|A.j
=wWDU:
!,wxX
^Ax?
X+y!5
Ka<w
<voc@V
MfR=
ActiveWindowHook
Send
<Bytes>k__BackingField
/O+Q
WaitOne
Microsoft.VisualBasic
bnLM5
Y,!]
}ABC
set_RemotePort
<liCJ
z"B>
*2,n
I~LV
|@hn
rN;*
68i
jycX
4sC*
Vs#R
)TVBe)x
ILC_MASK
C_,T
|zY
"a|Z
z@/
ix[Z9
Z%Pz$
Aggregate
"("w"#)#9$a$|$
FontStyle
yzH0
set_Mode
set_UsedMemory
IUDm|
_graphicDevice
,Qrh9
ZUmi
T`~"
BiosInformation
lL7f
|@fZ
1Ys
$!	+
DoNotRedraw
..
V
UMGD
WriteAllBytes
:
Orcus.Service
kIG
RHtI!$
!i_by
`M;jCC
<GetBiosInformation>b__5
<GetBiosInformation>b__4
<GetBiosInformation>b__6
<GetBiosInformation>b__1
}Gt-
<GetBiosInformation>b__3
bua,.
htd@
Qnkz
p~$E
e*kJ
PSize
set_Message
TcpAnalyzerDetector
SW"fJ
9<'K
Te^e
7GHm
bj8t
$QP
D3S&
MDISETMENU
wUO^
;=
Uplj
DownloadAndExecuteFromUrlCommand
X]X
LastUpdated
SizeF
<GetAudioDevice>b__0
SetForegroundWindow
Nu
N
azhF+O
7WkN
y>2]
#c:JH
_unloaded
@$I+
%	o
LoadStream
>P7R
@zJtL
O5n`
[08B
[,"a
DeflateStream
_t#Q
@w']
add_Idle
CommandSucceed
[77n
Gh;
5S{q
GOoM
En|2
<$l$
;Mc|
4Rb^
*~f
*~g
-9]w
#E`/
U/Op
*~h
arenaOpt
>q0:
Ad?Q9
Wu=L0
vCode
RR,&
)rn`
l.ww
giN|4
Sz)*7
DefaultMemberAttribute
;kC]u8
3k)
Centered
<ProcessCommand>b__2_2
_1C%
get_StartInfo
rw;7m
9~_p4
DS~ZX
~!%]
ir$SI
y=~7
6^
lO
NEXTDLGCTL
closingSessionId
WasapiOut
$(7-:L#C6
7~$K
'(l'
OW~bel
|O#f
c	m5
TCP_TABLE_OWNER_MODULE_LISTENER
*V(H
>::6
get_PrimaryScreen
{'}Y
_mozglueDllPtr
t
7*
ArgumentOutOfRangeException
c?{
WxEo
S_$n
W:f
DISP_CHANGE_SUCCESSFUL
dwOutBufLen
&Pq7
Q&z1
EventHandler
rI;4
j
OrderByDescending
<@Se
l5'D
StaticCommand
~jx=
Cookies
SetValue
3&?g
|w|SG
jS*>E
set_MaxReceivedMessageSize
U-]p
[.<0
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.Current
IM(E
(}A/
[8
^'
B/Fy
nYSrc
+rp'E
^g4Q]
get_Age
B.}m5
threadId
<>3__audioEndpointType
@$IK
2.uI/?
ib7yGK/
<LoadPlugins>b__22_1
get_ResponseHeaders
get_StandardInput
LxC5
=,Oq;]
Xi5?
5&"b
<>9__3_0
V&D<
D=(x~
w:x"
gKa5e
rV.A
*6(
_fieldNames
SJd}
offset
,#A_\fP
U1q
u^nHL	f
>KZ~
+)`i
Ph
m
<GetBiosInformation>b__5_7
]
|1
set_Icon
%re
System.ComponentModel
LocalMachine
isInstalled
PmS3
DF1b
By7R
8K@sT
j-lq
CopyIcon
*{)'
]EA7
z9Ww
5
j/Z!
WindowHelper
Bp&#Z'
Mc8}
MyEnumThreadWindowsProc
@Bp&`
&J
MM+v
wL'M
IcmpFloodCommand
%{C{&
1nQE
Cb6W
MD~9
M$SC#w
M[m,p
&+4s
DoMouseLeftClick
wincx
Srjh
qoxo
ServiceConnection
r[$}
Pu-y
add_Closing
j}'l
2l8c
/+@gx!
ReadObject
rZ2
4rf'
System.Windows.Forms
,c-x-
Pxm`
tD;~e
set_Entries
iUq>
#fk5uEZ;
|{V{
9g	S
SC_CONTEXTHELP
@7Zs{
1s)fyy
=
[/
p
5\Qn
|Hu"
set_ClrVersion
MessageReceived
GetMethod
1`Gp
set_EntryName
GetCultureDependentString
COK=
set_Password
disposing
+uMr]5{k
z@/
FileExplorerCommunication
set_EventId
G6?R}
set_ReconnectDelay
Remove
J3)Y
f@4{
ToShortTimeString
NI_&H
S6A-b
6rdf
INPUTLANGCHANGE
xWxxc!<
c(q7
GetWindowsProductKey
MC3;:4
get_DarkGreen
18x+q
?~VR_
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.get_Current
PO2
Orcus.Commands.Internet
OrcusApplicationContext
-pG
fz7
s4oz
5ixqT3T-^
lu@l
~9&[
TI@
ullTotalPhys
LB/r
,Ms
,rM
R3RT
TP*5T
eRxL
t17$
Host
'lD\
GetLogicalDrives
am2s
TCP_TABLE_BASIC_ALL
SendMessageW
SiM;
IsEnabled
TripleDesHelper
C3IwN
get_Height
Nvc4
VvIiy!
WS_CLIPSIBLINGS
(
4B
8T?D
PrimitiveProtocol
Orcus.Shared.Commands.ExceptionHandling
2M	>
3gKg
.Z6-?s
[C
I
NzG]
+E}d]
,\<f
SHGFI_USEFILEATTRIBUTES
pp,xU
S7L
]rN<^
get_Controls
kgfw
n>P1j
Version
add_KeyDown
<	y
r
get_UdpSockets
KTs[
RylX
:n
y
3MZzy
NB4J
@Nq{
L9!h4
pbKeyState
InformationCollector
U{67z
vT&=
<9I9
tNLE/p
3Bj!
,w2
Wre$
r'
ElolxF
)
r+
WindowsFolder
dec_next_char
!qNb
PtrToStructure
:!Ci"t
)yDW
GV?{
ProcessThread
M[./
8(]C~
gC_R
z=/"
]	5o
2{RGi"
currentFile
get_ProcessorCount
j*8f
rcWindow
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.Current
ManagementDateTimeConverter
9+^E1
=g=q=
|:zAts
~r(|~)
ll!M
ASKCBFORMATNAME
<WinSCPDecrypt>b__2_0
U]]2
<RegistryValueTypes>k__BackingField
}s-/u
<LocalEndpoint>k__BackingField
SYSCOLORCHANGE
/D0K051k1w1&232<2
96y4"
get_DnsSuffix
get_CommandCollection
_bFV
$sB)?J
kbstate
X)|u
"|Z.}
BMToN3
r+X8
j"$Bg
4Nl~
set_LogicalProcessors
EndInvoke
wCreatorVersion
get_Groups
PV6>}zL
IEnumerator
/	+
pB4`Op
YK k&
]
.
|
/G_H#D
RegistryCommunication
IsCtrlPressed
SHGFI_PIDL
]#e>v
9^I
iT9U
x:7W
%@y
N3pOf
rSr)
|' S
lpszDesktop
#wR2wX
JxP
LVQ{
pnoP
YHgb
a}_:
?`])
Win32Exception
get_Host
exceptions
set_MinimizeBox
\sbf6e
j]ag
Qb-R
_currentFileDownloader
nhmf
=iQ
UxNS
<Main>b__12_0
Chrome
CxE
\-o,o
V}^\U
og8fM
nWk4
ImageFormat
DHg=L5M
i%U
_requestClass
RdxlVm
D
,;
!@6	W
UninstallProgramEntryLocation
System.Collections.IEnumerator.Current
ICollection`1
set_Firewalls
KeysToSpecialKey
set_SoftwareInformation
=4vz
_N%X
INPUT_DEVICE_CHANGE
DEADCHAR
RotateDegrees
i%Uy
.jz*:
ToDateTime
n,ILe
dwNumEntries
;bws
get_Bounds
~
AD?
G2q/
{776 }[
+eK]
GetExtension
HSCROLLCLIPBOARD
K	?l
c`wh>
bLj/%kx
Hide
7\aA<b
op
LoadPlugins
ot
mzhzt
prh?
TextWriter
Authenticate
2Kv(=
ayHuh
fGS~W
)K
iFQn
ConvertHexStringToByteArray
prh
ToByte
X_o
cvA
M8?UkR
8n1Fg
@
S(@w>
=M>h>
Ac>j
<IsSearching>k__BackingField
CreatePackage
?=/0
oF
x>AN
);$Kv
%-
n p#
VoiceAge
A^\4
GetLanIp
70p|
jiUi
#Blob
S$'
O.V
<u?V
ppenum
CommunicationObject
^f`)(,
'FVX
`<Cu
r/
467w
Gb>	3
hThread
&;cn
"2wb
Decrypt
M^$x
WM_KEYUP
BindingFlags
L7qF
5IMU3
)=	7
~P=(
$-	Q
autoResetEvent
content
qb3P
reader
i+tq
NCMOUSEHOVER
GetName
SmoothingMode
z*qm~)
Join
STARTUPINFO
<GetUdpConnections>b__4_0
RsaKeyManager
'L83
uAFA]
Cursor
X)_!
Y}7(
!:o|
System.Drawing.Drawing2D
p|pt$
VYGtUy
get_VolumeScalar
remove_FileTransferAccepted
Orcus.Plugins
q&/#~
s=^.
set_KeepAlive
Item
hOm8C]s
RBUTTONDBLCLK
get_VCode
Orcus.Protection
x0|k
|J(@
Orcus.Commands.FunActions
urlHash
ProcessModule
ENCRYPTIONKEY
y">
,Zr<
set_Handles
EmCm
Y=OYU
lr]rSr
set_AutoFlush
?VRm
KILLFOCUS
66kB
bScan
&SrnJ
$u:M
+$(
Hh*4
+$(0
4^!U
get_Y
DeleteDC
u90`]
/>B{
XoB
v"
A@[]e}@
(_Eb
memcmp
m_3M
Taskbar
V{;
PushData
WS
a
uuYQW
Hj@1c
cyhi&
*eO]
TCP_TABLE_OWNER_MODULE_ALL
Y /qG6Dj
get_ResourceType
.6Vm
(9Wh
O`H1
FactoryCommandPlugins
+ r
WriteObject
dmCollate
QL[W
e6OU
ce0_
CommandLoaded
66v0
pwszKLID
MBUTTONUP
=^B_
OpenWritableSubKeySafe
C	{@
0?dD
)1V"
7`n_f1
WH_JOURNALRECORD
:c1B
8 .\
EVJJ
.s~5
DialogResult
N==}
Et=4
rowNum
0PYx&a
^"T@
z*mf
SPe~
<.'FV
set_Proxy
Clone
Ma_H
:c1h
wrC&
bBQ{
I@
k/O>
~L#xN
GetDirectoryName
}T
ToList
W.Eh+
NOTSRCERASE
set_L3Cache
A<G
zh*e
1N;wI=
InternalPushFile
H3@H
F_=Z
[gYLa
>'r>
q7</
CSCore.CoreAudioAPI
qZu)
De]^
SetMemoryInformation
UdpFloodCommand
^F2@Rr`
KnownTypeAttribute
d=~FP
Int64
0$aH
WRrEsC
,#<Jd~
=`B#X
ENABLE
LogicalDrive
)z<w
V:y'
r1
AudioVolumeControlCommand
^+`Y
ShowBalloonTip
Kt
J!|'
_streamWriter
mi3
V*z$
Orcus.MainForm.resources
\mX%m
b!1K3*3577
Free
$Hs.
1r,S
bX}a&
$KFNY
UH2U
CmdProcess_OutputDataReceived
ICookieRecovery
"W]
URL_UNESCAPE
DESKTOP_JOURNALPLAYBACK
g}5}
$~U7
Y
P^
-r%
GB(g
j'r6w
(
=
fields
_index
ib:t
xt'r
='QV
`l$7
oy
d>PA
STARTF_USESHOWWINDOW
gnS8
MakeTransparent
set_IconData
get_PluginsDirectory
IconData
!M#2M#"M
~"]<
set_MacAddress
I"Vy
j0s5t
KeyDown
Stopwatch
>v.I
>i|z9a
PR^7
S		z
JE	:M
WCF_PAINTMETHOD_SKIP_HOOK
e:Ky
n3!
SHGFI_SHELLICONSIZE
<Hold>b__0
filename
}!#V
8lWoM
TaskDefinition
<Dispose>b__3_0
RegistryHive
CRYPT_VERIFYCONTEXT
5:9:
.Xe>
DirectSoundDevice
costura.orcus.shared.utilities.dll.zip
get_VideoCapabilities
punkISFolder
_nss3DllPtr
X509Certificate
OpenBaseKey
0
:VMg
ws\A
Orcus.Commands.LiveKeylogger
EnumerateSubKeys
ElapsedEventHandler
!_Y)
Sp2R
_isDisposed
b1z8C
E
?
DhC<
SendUdp
<AutoResetEvent>k__BackingField
x\nV
Fg<'j
Pc4Fh
height
_hvncDesktop
j/B[
*Xf*
BitString
get_AsyncWaitHandle
r8s5
ea
@
>R<!
Orcus.Shared.Commands.FileExplorer
Marshal
SendMessageTimeoutFlags
idObject
lXpa]
C60f
LDni
TakeLast
&{
Orcus.Config
Hf f2
:d~4
7#e5'
ry
H=Wx
lpT,|Gg
/C^a
~`<J5
H,W9
_executionLockObject
exception
get_StartTime
fc{9
Process
<>3__key
binaryWriter
pCn
b$#?
VirtualMachineDetector
vbSC
.j/
0
set_IV
b,	+
2Pw~$
se`+
Z,m
K6ZA
enumerator
F[I(
QE
2t
uNJ1
OrderBy
w2}RG\
get_CompanyName
6inim
\P#.
}RIsl
{oVW.
gX7z
RrbQ$
syi.
$_V[
UInt16
mouse_event
^Cb#Gr"
UwXC7
SETTEXT
j}O.3[
lefY
IsHandled
VaO"
GetRegistrySubKeys
APKc
udpSockets
{W
JzTH
System.IO
G $&}I
WrapNonExceptionThrows
get_LocalPort
computerSystemManagmentObject
T"'A
Df6%
lpKeyState
V;_"B
^0"=@
XBs<
GxO]
Su_&E
;j3{
get_ActionType
set_IsServiceRunning
get_InvariantCulture
+;%~T{
BWqhe
@H3w
RuntimeFieldHandle
@s7|
7~`/
D3	;
set_AntiDebugger
ResizeImage
get_Unicode
L{{v
Xx~x"fpS
%a/j)
Orcus.Shared.Commands.Password
@JSf
44Qy
ScreenHelper
fqmb
QqsOy
7|fa
_-~
@[M&
gNm
U)=g
SwqJ
"FI^
get_Session
<Data>k__BackingField
WindowInformation
NCMOUSELEAVE
N,Md(
localEndpoint
ONhO
]9C3
be/|
<(to
MessageTextBox
M,!V
>/G;
N;;
@c`<
f f2
a8j;iGLv
C
X]
SHGFI_EXETYPE
user32
Orcus.StaticCommands.DDoS
Sc}
f\;/
ReadFromEmbeddedResources
J+MO
0HI
X%c
*zs
nQyCr
Tq)}
x>G[
B7%t
<ImageLock>k__BackingField
set_RegistryAutostartKeyName
ij,V;
F
w
l0}A
,Q;dZ
csvFile
E/@
{,qY
dmSize
#`Cy
)t%j
Qnmm%
_ip8
WrapMode
TextBoxBase
asyncResult
Rir
get_Address
TOCB
set_AdminPasswordStatus
_aXRH
down
g
;
+`+
m
ktDQ
"/MADDds
p*rJA
SETCURSOR
A	PO
FUe#u
PasswordData
_@"Ud>
set_VideoCardInfo
*k@@G
O%rD%G
QBi.)-v*)
set_BytesSend
GETFONT
*WmUK~>
/,A+
',aFo^j"
<E6
/
get_ServicePipe
P+PIPYP
_pageSize
6J{##
kkm
47s
!nr/T
<ClientPlugins>k__BackingField
System.Diagnostics
0 HX
&oQ?
OssOr
M/O/
rNF:lN
i7W.
FM,h
InternetExplorer
SelectObject
xW	x
Fy{T
&}U/
EventLogCommand
dwStyle
hWnd
LZA?
"W>/a^|*,
<GetEntries>d__2
|<?Sy
8`
]0Sc
u [v#]
'[@nL
IpAddress
{(]"
bI4(}
z2uN
;c
2
set_Threads
t6573
$r)uBu-7
GetOperatingSystemInformation
ADDURL_ADDTOCACHE
&If<
Orcus.Properties
:&%:
System.ServiceModel.Channels
sm
VistaStartMenuCaption
DecryptCoreFtpPassword
CompilerResults
Q3 =
String
Timer
bb86)b
p/DT
set_Location
Bb
^
~;|R
dka%
UGF|
yK']i
~]ie
Vb%=
`@`v{1
c+f,6
=
O'i
Jnt/Dg
=!ep
APPCOMMAND
+8[Z
get_UTF8
rYrT
5KT*
get_Width
RWy~Q
ERASEBKGND
EX)\
set_Rate
get_Month
e5V+
show
GetSystemDefaultLCID
PX.yXS
/#{
M?z
7`82;<@<V<
u{m?
DN5f
=jJ_B{f9S^g
hWinEventHook
h\fi$
[=3l
q!vk
CancelEventHandler
<SendLock>k__BackingField
CopyTo
vzd:%vS-
GetGraphicDevice
GetValue`1
Where
\T;rQ
qEU!
set_State
set_AntiTcpAnalyzer
fwbh
get_RegistryValueTypes
W`2|
IEnumerator`1
UnhandledExceptionEventArgs
(=xa
Su
|
%bwp
OWQ-b>
r30
vLwgg
WindowUpdate
8]&u
Orcus.Shared.Commands.ReverseProxy
^9M;
<
o&{
filler
3U=Tr
47nXQ
AuthenticateAsClient
lpbKeyState
NivI
set_SystemInformation
_synSockets
Fs
;
$Xb:s
V/Dz
]Nm
<>c__DisplayClass43_0
LASTINPUTINFO
PATPAINT
t/:u
ullAvailPhys
<ConnectionId>k__BackingField
&No
R)5a
WinEventProc
itxBk6
h&NL0
9	~j
d?8V
UI=1
tGc8
/p?1
T4^g
System.Collections.ObjectModel
<
A0
A
wq|{
+$r>A
get_Capacity
<>9__7_0
SetProcessorInformation
}(wm
m
:aIdQE
{*NC
WLpX
_translatedNames
p	oO
]7
n
{ugu
-(-
CopyArray
KGYbY
%/{r|
3
IkC
3
uf
SendLogEventArgs
get_Day
\8C.
F^X_$
<s
]
Ow93P6
iV4
`,Lrd+
cbSizeFileInfo
set_AntiVMs
ProgMan
ftLastVisited
RecoverCookies
L;!,
DeleteSubKey
<PushRequests>b__1
\|.7:9
=KG
kbh@[
*E\{X%
set_StandardOutputEncoding
GetDrives
wd?_
HP_ALGID
Wv*i
v
-ZLz
Qrs%g
2&6A1A
MERGECOPY
w+YH\4h
+M%B
mD?.
set_RenderedWindow
3{gz{9
keyName
xAXt
MDICREATE
!<Z3
b
5A-8v
~UIy
%eJdoZ
KEYDOWN
<TcpClient>k__BackingField
GuidAttribute
0X
R!
;9h|uNX
~x6
3!h1
+C+u
PushExceptions
5nvY\
_current
GetWindowThreadProcessId
W0z(
rQi$q
dwCreationFlags
VideoCaptureDevice
NetworkInterface
;C{M
get_Port
ENUM_CURRENT_SETTINGS
8x+\>
Trim
sq>
MessageBoxIcon
zjgb
po+m
I.Drvw
remoteAddr
WS_OVERLAPPED
DoNotSendChangingEvent
o$-4
t3d
b
>*x)
*A|
SetKeyboardLayout
8hX
__StaticArrayInitTypeSize=48
ipAddressInfo
set_UserName
GetField
DvG|h]
FileTimeToSystemTime
add_StringUp
S}:
ProcessorTypeToString
<ReplaceCarriageReturnsAndLineFeedsFromFieldValues>k__BackingField
[R|@
-iZ.9
iUM8
lpDesktop
XBqy
9a?/
UInt32
StartsWith
K#;4
cH^X
get_DarkRed
set_DeviceId
DesktopName
fileName
set_Is64BitSystem
GetLastWin32Error
Right
EIv{
19'W
hP0E
_fileStream
3)+#Yk
aOR=c=
&6,F
Fma6
keybd_event
QhP-
*|Os
pTcpTable
$]#W#
<>9__3_1
SUL69*
a^
v~J
Yh<R>
ComObject
DeleteHistoryEntry
dmMediaType
s
q(
VSCROLL
ServiceBase
@9YA
>v
k
Split
CTLCOLORDLG
]:6u
Uqe)
M|Sp{
SpeechSynthesizer
N09MN
ICryptoTransform
TaskService
get_Connection
ElapsedEventArgs
Btj
$WH
Y
ApplicationName
0MiR|
x4DgD
rjo}}j
VS$H
AssemblyTitleAttribute
+xNP,;
Orcus.Shared.Commands.LivePerformance
set_AvailableResolutions
ZLJ1%
=u-%
l^j
set_NewCreationDate
GetKeyboardLayout
uGn_
P=oe
26 (
__result
/[r{
<>9__4_6
<>9__4_7
</L!
SafeHandleZeroOrMinusOneIsInvalid
<>9__4_0
|.S$
dUg\T
]%>I
add_Load
yBzF
?jg	c
Qb3_">
GetRegistryValues
>s.
`HBtE
{4JE
WS_VSCROLL
set_IsCancellationRequested
^T6CY
set_IsSearching
HELP
PerformanceCounterCategory
UninstallCommand
set_LocalAddress
!=MsO
_033
MA_ACTIVATE
Y{E
'{_c
Post
set_FrameworkVersion
GetIsWow64ProcessDelegate
iv1D
QfeI
d|M;
y?=
q?j
*tP#
Dd ;0
]qzL
^Z$y
@h
O
B>&;
(KNW
Orcus.Commands.HVNC
LinkedList`1
{&gGm|^
rC
Orcus.Commands.Passwords.Applications.Opera
get_OEMCodePage
iO|C
`IH4
rau>E
1=U8A
~eRBy4
<IsWorking>k__BackingField
'>'$
I
JpJ
server
IX7
2{MO
KKO6
()Tr
_+T
KEYUP
ChatSettings
IsOnVmWare
NCXBUTTONUP
F::ttt
UtaYm!
HZKl<
67YIh
xoc;
ProcessCommand
e<E4f
p*rtB
n
J7
_%n
EnumThreadProc
ou_S
BsKL
, r$:
samDesired
DrawImage
KC&B
MessageBox
GetId
[X;Jk
nFlags
b$#y
ro5=
COPY
YXs~{
~'Pew
_Z(JZ
Connection_Disconnected
StandardKey
PixelFormat
~IJz
<Module>
~X9#
<t.5
?;"~
}$#
D~Bl1
<IcmpSockets>k__BackingField
Kn%GT
0X
Rg
VTPV
Width
StaticCommandResult
@96
data
~-Pe
$&:=V
ReadTableFromOffset
Pz8
4c4Xa
GetProcessesByName
0
Go
7,@f
yloi).=
isMouseDown
SpecialFolder
<!+A
get_Chars
j! O
rX7:u.
`p$8
CryptoStreamMode
R$SyA
IToolBase
G&zE
_client_Disconnected
Cw1o
9|'%G
DataProtectionScope
PZ"B
KYSE
{;$%
&m)F
`EJ_{/!k
g%/:
vs,{OGn
AdministrationConnection
dmPosition
RegOpenKeyEx
.Tkc
pDevmode
WH_KEYBOARD_LL
]J4W
k\1M
AV
AddSeconds
FromBase64String
|p_:
[T+J=
get_MessageBoxButtons
<HvncActions>k__BackingField
d<Nq
SP_(\
6Ss<
q!zR
J]rh
r`H
{M-m
sql_statement
Finalize
Orcus.Shared.Commands.Code
set_TotalSize
UDP_TABLE_CLASS
PARENTNOTIFY
j|KM
77,wxXn ,
ja\Zk
ApplyWindowInformation
get_Package
lfi
bwm!l
\:g>
GroupCollection
POWERBROADCAST
EnvironmentExtensions
MapVirtualKey
<RegistryValue>k__BackingField
W
 [T/
CHANGEUISTATE
g
s6
CDrB
,
()
,
(*
W0'oN
Uninstall
FM}2R
tXA:p
8IwW
get_SendBufferSize
pbData
c4MpG
-r)(hGh]k
t@%l
5QDN
IServicePipe
Fu9
E5L'
|=5
;&Zu4
NameValueCollection
>G?-V
ReleaseHdc
WebcamCommunication
k8KqK
DZJ"
Wc[3>
3R9(
WS_TABSTOP
=)T*c
SendButton_Click
uCode
_b$D)
IJ'
8!
5
SB9)
lH,$
GraphicsUnit
_KAw
=x+<x+
Subtract
M5|e
`)Hq
System.Drawing.Size
]`\#
lpwTransKey
%- &
d%$K!E	)R
><~N
\-mA
Action
+{(O
JoUL
SuspendLayout
System.Web.Extensions
qF
L
%1Q:
Wr_"p<'
p=7p
_$MS
r~Sx]O
Dictionary`2
o|rWZ0P
@ &d
GetWindowClassFlags
IsCsvData
fBlockIt
#gV
Z4~6
(I6e
set_AutoScaleMode
y(5f
CryptHashData
ofCY
nj=q
(p\k
UnmanagedFunctionPointerAttribute
h0_;
kt(OP
get_DriveType
C/r4
arguments
childAfterHwnd
%(P
WinSCPDecrypt
dmPanningWidth
kiind*
4p?r
dwEventThread
MBUTTONDOWN
Expi
MEASUREITEM
HTBORDER
<BinaryWriter>k__BackingField
ReadExistingAssembly
':oy
Fug#
Y\;W
CHILDACTIVATE
hWndInsertAfter
IUrlHistoryStg2
ipAddress
)3eM
SwbK3($
dmDriverExtra
J%nO7
dmDriverVersion
nCode
{{w=
t'4
set_CurrentVolume
get_Lenght
ey#q
>~>nZG
<T=
set_Manufacturer
ExceptionSent
+/@O"] W]Y*
.JF5
y,F\<
PK11_AuthenticatePtr
[k?E
oDG)G
AdminPasswordStatusToString
(zNe
{<_IZ
o?Z`0G
w3V
M2\y7
DrHY
InpM
o6Xz
-zx"
)9*W
,7(O
<ShowWindow>b__0
Operations
RegistryValueMultiString
-u
t
pHkA
/KWe
%(r
UnsafeStreamCodec
GetResponse
Wh>\
lD$A;="
-Z^i.
waveSource
t=wG
%eYR
B9#Z
GetParent
pNss[
dwRop
U#+1
DWMCOLORIZATIONCOLORCHANGED
^/F
get_Duration
O
z
`+hI
wRcG>
9@	G
Q&~Y
Reverse
get_Year
dwFillAttribute
EventLog
TJKQ
6FN\-?
_dbBytes
OvQ7
Je=T
wm<57
_actionLock
z(6
/R\G
GETDLGCODE
_chatSettings
GA==w
ClientPlugins
~F&y
|C_Z{
set_OsName
SetClockVisibility
BFl8
;vtJ'@
SoftwareInformation
set_UsedMemorySlots
Assembly
}BBDj"
.Trl
<Tr
U`3*
T5c<Qp"(QAt
dataList
xhZ`
>F.z
1Iy
AssemblyCopyrightAttribute
{q]f
4JX|
=iu#
nIndex
6N^B(-"
hdcSrc
0vT6
Dwzb
Fpt;
_lastFrame
K:*x
"rQ
^>b%kz+
gi|i
wparam
dwDataLen
.ag<}Bx
AppContext
8~b
LogOff
b\qY/[
DeleteFile
LWKp
.Xy>"C-g$]
RuntimeHelpers
_session
.n>[M
get_ModifierKeys
CryptDestroyHash
~)Nt
set_NewProcesses
GetExactHandle
ChG
Sequence
HWND_TOPMOST
CurrentImage
timeLastUsed
fpj0-#
`HH-
l~ku
nSoW
Bf]p
GetUrlHistory
8(7KXy
|oYV
#V	z:
9[:a:z:
Wp*++r
Cg
44
^{)I
S%&<
file
VV]z|x
3$)B
SwitchTo
PF	e
MOUSEHOVER
MZMM
pwcsTitle
SetEthernetInformation
l8y/s
FwHg]7
field
!Y]aJN
QueryValue
CreateLink
?=5,
STATURL_QUERYFLAGS
{?^l?u
#j
D6@
s(t7B
remove_ResponseBytes
InitializeComponent
add_Closed
's*s5
@%z2
get_Value
get_Topmost
IFactoryClientCommand
'(
i
RegisterWindowMessage
JN7
0BA=
6,4,:
-,5#|CjC
o3c-
vS.P
.!N/'
NCLBUTTONDOWN
.?+C
9aR
A&]9
x3"s
oC2ErV
set_MonikerString
prrI
rM*
rM(
"
/v
<AiE6u
Ih
~
9H>Z
zup4J
filetime
<Title>k__BackingField
6|6#
O@z'
.J#hl\
get_Icon
D"5"
^?iK
Fo86
<6-g
.cctor
FT>\
WS_MAXIMIZE
L43?
f/\z{
%z !
O{Yn<?
dAr
EP3-O
bB"o
EuMn
)pP(>
g8X)r
fj<!
Current_ExceptionsAvailable
m|xO
*\:s
ReadBytes
ENTERSIZEMOVE
<>9__23_0
I:w d
Hold
bB"J
set_Volume
-y|dK
bU%,#
Kernel32.dll
entryCount
Kill
CompositingQuality
TripleDESCryptoServiceProvider
UdpSockets
NfBb
;y[p
CCTC
h<-J_&Q
0Nd#@
TaskActionType
u
5
GetHardwareInformation
#(u<
UnicastIPAddressInformationCollection
ResultSender_SendResult
System.Reflection
GetTableNames
get_IsWorking
W++U
URL_DONT_SIMPLIFY
m&Gx
e^5v
&b*!$|
Y'<+
dX#;
bQIDH
7AM_
?(i%
threads
b[h
get_Png
)B71
vr<B
su;_
ToInt64
0?w9h
hH3I
yOezJo
_mpK
"[[.=}
f#X3
Size
uPSRXf
PostMessage
md5Hash
"7N7
<PushRequests>b__0
(fH5
set_Source
L=Y"
0|!
R}L_^
IsSubclassOf
[
ncMessage
@&6(
CheckDisposed
32+_
6#[k
.7Zh
+,fk0
TaskManagerCommunication
WM_KEYDOWN
<ServerConnection>k__BackingField
WINDOWINFO
a"!\
<>c__DisplayClass11_0
NK2M
StyleHaveSizeBorders
u{iC
67j1
RegistryValueQWord
dg %
rb8
SelectVoice
+%|%
):x*h?
6<#w
(K~z-YgV
\4G= vr]:
3OBY
U
LT
set_ProductKey
*.s
get_OsName
get_Device
SYSTIMER
+s(
/0Gs\
P0Q^Q
IC@%
H<0Ao
#=fir
b?_{
r?0
MMa_
CWB
>o`W
{3ab
!/o0
StartHttpFlood
destination
r$	E
r?(
CA
CompareFileTime
4]Z+
set_HttpOnly
Expires
BW%t
NkA3
GetWindowDC
=hy1$
3System.Resources.Tools.StronglyTypedResourceBuilder
SecretId
c4]'
SW_HIDE
GetData
ulOptions
System.Configuration.Install
m}Q<
CONTEXTMENU
d"6=3
T,srR~
J!zE
$mtv)
ReadMasterTable
0J&.]
W%"czW$
CAPTURECHANGED
fTr7U7
_listsLock
s=5$
WS_DLGFRAME
-<?C
[)rL
System.IO.Compression
QAV-4
Kb}o+
!U
q
7l/!
OperationsLock
s@5
System.Collections.IEnumerator.Reset
WM_SYSKEYDOWN
S;5tA
~1U]
Orcus.Shared.Commands.Audio
k:r
WebException
_client_Connected
KEYLAST
GetCurrentProcess
ERc<
get_RemotePort
TrimStart
* j~
Orcus.Commands.EventLog
4IR,
>K}|
) M~O!
E
g#b
PFR:
[;C
5xY{
SC_HSCROLL
hX|/
add_CommandLoaded
5BT]
ServerApiVersion
xMk
fx=9
CP{=L
H<Ux
s$T<"
DesktopWallpaperStyle
17(a
I.4h
aN_#
ResolveAssembly
token
get_Millisecond
`iF+
az{.
v<rG
f!2D
"phEw
get_CurrentCulture
yUv'
n]jy7
wKs~
DecodeProductKeyWin8AndUp
*o_Hw
MK_LBUTTON
ForceClose
set_UpTimeSeconds
CoreFtp
D;&l4
9
pYe
HTVSCROLL
MassDownloadManager
lpTitle
e8j
n
HTMINBUTTON
3AAg
<EndRead>b__2
>#*ugT
<EndRead>b__0
<EndRead>b__1
n:
DSw.#<K
SC_TASKLIST
I4"C
1<qd0q
EBs	T
ExtractAssociatedIcon
f3`}
_keyboardHook_StringDown
]j#
:g*
g(v'V
TextToSpeechPackage
BnY\\
set_InstalledPrograms
KeyboardHook
$OTX
<AsyncOperation>k__BackingField
*+3N
<MessageReceived>b__0
ChangeComputerStateCommand
set_ProtocolName
x]bs
set_RegistrySubKeys
3ysaH
ResponseError
R>fi
|{fk
Microsoft.Win32
KeyEventHandler
[BeN\
3X+f
tNIyV
csv
WU_-
)0Q<
Screen
yN	&FE
SecretKey
ZvkLx
<#Dgxy{
QACL
<IsTaken>k__BackingField
DESKTOP_JOURNALRECORD
j%]^
ro:Gf
pJ(v
p	rd
$Vg5K
)!M
XqQ"
7^2^4^
&%+MJV
H4:0
GetProcesses
ee~K=
DDoSManager
AdministrationId
FileInfo
}sQ)
z-G
>ERo
Y
wD
hitTest
ProcessNames
GetDefaultAudioEndpoint
lMON
'#BOp2f:
TNhA
KEPx
Juh>
bUiQ
3Db\9&#
,rJ.
\FW/
_hookHandleTitleChange
1BK"
,VER
"7>s
[+rH
?=j^OY
UserInteractionWelcomePackage
GKa.
5z?(S
layoutId
Zz4V<wZ
oh}Lp
[/fw
dwProcessId
pszProvider
w#D)
U>"W
abBr
isDown
4D0R3o
$Z_{
WriteToStream
m7m
YG)7
a//H)
tAh`
b#zL
%`aF<
H/NaF
set_DriveType
T0TTTTTTTT,2,4TJTLT2LJ4*,*4TJ*2L**,,2*|%%
e:iB"
IPHostEntry
<Values>k__BackingField
IE3S
GetMsvcrPath
ActiveWindowChangedEventArgs
ObjectIdentifier
xud
digitalProductId
GetMozgluePath
_L;M
Microsoft 2016
M`)xE12
HookType
}T
GetInstanceNames
.U,UX
grWW
,
_yO<
&&-%
q~Wa
IsVisible
|-q2
get_PacketSize
/j}G
c~lz
K<i]
!Oo`
H*gh=D
O|u{`y
+sEkAR
;*U:
SHGFI_ICON
b&=E
{,{y
`wp48
QBs
SendError
|p6i
UninstallProgramsCommunication
IConnectionInfo
set_SendProcesses
ResolveEventArgs
i-m\
x-tFw
sW[
target
<>c__DisplayClass0_2
<>c__DisplayClass0_0
<>c__DisplayClass0_1
fuq~{aGUR
N}7y
gOeK3\6Vm
weCzSv
QiS"
r7Sa
L_r$
K<>C
mXgg3~
!lY[
kE"H
Create
?!sf
jzyU
?M!/a
FbFK$c
hBT9
IbM/
r$:
<Go@C
+;p|
PackageCompression
RUQ
/J+J
<GetSecurityEventLog>b__11_0
1;
xwv
P?SF
Ly_e
GetExceptionStackTrace
<>3__location
J~	FM
get_Guid
|KzD0
oe+\
HTCAPTION
[131
)o
59
:0>z
hi*[
RecoverPasswords
MENUCOMMAND
}Hk^
k|"_
j;	C,
H>HE$2
r$F
_stringCollection
yqR|
P9m
set_ApplicationName
*&pQ
JnQK(O6\
WczxZ
Vb+d
gjz,=S1-
!>SO
,Q1'
Orcus.Commands.Passwords.Applications.Firefox
|eROCI@
add_SendMessage
Y}PO
e]rQ,
,5D!
c&xN5
)Amc'
IJ97
IsConnected
qpykyM
ZSKF
_msvcpDllPtr
GetProcessWindowStation
f'WL8
1	dy
x6J3
OpenReadonlySubKeySafe
CTLCOLORSCROLLBAR
q`
v
w~?
vBNqe(
g]&M-8Q
Bb*.)
DirectSoundOut
FileSystemInfo
{0fv
IsAlive
q.#i~#
get_DeviceID
<Rectangle>k__BackingField
8ssp
n1_J
SbtD
GetDesktopWindow
J<Sh
gv>H
Z-7&
SearchOption
M^G>
<>8__1
+.@!
X_a>p
& r27
0=6{
`	C`
U[_hP(f
1auc
dmICMIntent
+Dp)
n&5L
PerformanceCounter
'VL
.mk1&
*(0
SpeechAge
#Tkw
GetFolderPath
*(,
CsQO
*(/
bi\
y:|P
8
th
List`1
Ya9',
AssemblyFileVersionAttribute
r<H
DFh"
KeyDatabase
GetTempPath
y7^P
B.BYB
!7
T8xO
;0s.
System.Resources
>x(?
set_UserDomainName
CodeCommunication
flags
rl
5
Nm
HookProc
AuthenticationException
JmV
set_MaximizeBox
-d{|
W!hb,fhjD
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.GetEnumerator
<GetSoftwareInformation>b__10_0
[|!-
CompareMemCmp
EnumDesktopProc
<GetSoftwareInformation>b__10_1
MoveTo
iM}6m
HZ9\
uw'?
LocalEndpoint
dE~f
source
R66R
set_ProcessorId
r9
SoundOutDevice
p/x4
+knt
}C$-
dkdh
fInherit
ez%
3%
M9MG
get_RenderedWindow
.wPc?U
T5b9Q(
,@[]
DrawWindow
)u3-
whWlW
SYSKEYUP
&W~]
CPW
i"b7M
VKEYTOITEM
MOVING
C~;A+
46}&
_firefoxCookieFile
#f9]ay<
La<F4
NSSBase64_DecodeBufferPtr
()+
PasswordType
AW
~
H[2"g
[d&=Z
B5h_UK
?/no
ExplorerUrlHistory
'My[
[10F
8\t
;[uU
k&J
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
\6b>(
?t,J5
dmPelsHeight
aHF|~
ALG_SID_SHA1
HTTOPLEFT
KeyValuePair`2
SynFloodPackage
V8kL
(5f>n`
!
STATURLFLAGS
MIB_TCP_STATE_ESTAB
vkCode
lK&H7
ConvertFromOrcusValueKind
|<8}
@foH
?5 h
FxHG
AdministrationApiVersion
nD%2SR
\z3
L]HrF83B$I
>-t}
r/g
~E-
5@,'
pelHeight
n`K,
Xk}E
get_Success
r2:
gBw
!e'>#
a\vu1
2*UJfZ
mqSF
by&R9d
#
<ei
degrees
^*8e
N9+i
]~?*
(,EL
UAo_
Q<,!
TIMECHANGE
*.s[
*.sS
$6uj
packageCompression
Lh=2
*.sU
R(=jiWf
set_StandardErrorEncoding
5
d4
r'wa
_disconnectIsSend
resourceMan
get_InnerText
{Ea#
4I+
vrP*
_hookHandleWinChange
*.s=
(Kc
^*r;/
DeleteObject
bh<WZ
I5tWUU
N'o"
)G{
7W.BOx
Y{.N
System.Drawing
FileTransferEventArgs
,V	S;
^Bu
X1J^
/+M.*B
@R[LZ
Orcus.Shared.Csv
[4Mc
, yx
&5l&
]io>L
uLvA
GetProcessTitle
get_EventId
dwSecretInfoSize
CLIENTTAG
wF)Z
get_OSVersion
lZl=
GetLastInputInfo
*Aei
%Mdd
[We
U
rL
set_AudioChannels
DebuggableAttribute
[f2m
get_OperationalStatus
get_EventID
,U('
4~8m
u|\*.
RegisterTaskDefinition
(((FQ
aWFJ
L*\b
MOUSEMOVE
S
2KJ
set_FormBorderStyle
E}t-
Cast
,zb.>q
(?i'
add_TextChanged
j_1,
D_9!
DecryptIePassword
91\Y$
0
i
StreamExtensions
\2Z5P
PRINTCLIENT
get_Platform
='6.
_proxyClients
HL$1
Ecbv
Qmu
'&gM
c
EyOa{
R`	+
dXd2[
|}0wtj'
r@-PQ
V MP
,(
F(G&
Monitor
<{F
DoMouseScroll
!; ;
set_OSName
G
{%?R.
r49gWV
w:I9
SystemTime
Orcus.Plugins.IConnectionInfo.get_ServerConnection
[Th}
MDIICONARRANGE
Mqsqq
3}|+
Bj
vG
assemblyName
ProcessInfo
,(I
*IUq
_deadKeys
IcmpFloodPackage
E3[e
lpFileTime2
[j!0+
CommandLoadedEventArgs
,u	u
Select
}l0g
{Nm
g6?"
v5Jo
oMz
set_ReleaseDate
kbzq
EditorBrowsableState
AssemblyConfigurationAttribute
set_ConnectionInfo
b:p|
$$>X
\"gH
}iv
:
4KWSO
~chK
LOo'
gaxf
ik_&
seconds
<\C
_w"
#9u7
D_Dq$
AsyncOperation
:t1<
BIfFG
{T]B
get_Cookies
1ZP<
JsPZ
usernameField
,	{"
A4Wv
,	{%
X^v>
AudioEndpointType
WaitForInputIdle
EnumDesktopWindows
*r=
SecurityException
+A"a%
T-fM
RS\j
lpdwProcessId
IsNullOrEmpty
Null
zm.
V9VO
s(
s,
_screenFactoryLock
get_KeyLog
InterpolationMode
BodE`
y::
s=
set_VolumeScalar
T=3
s3
c?2
@C{
HD&p
}?KnaN
ullAvailExtendedVirtual
Rijndael
&KXq
EnumChildWindows
?3]YB9
Ri@4d
t[LdhZ
hvncAction
get_Culture
M 	9
XmlTextReader
set_InternalName
AesEncryptor
%
}-
%
}.
Connection
OpenReadonlySubKey
WriteRecord
%"8c9N
sL
CodeImage
sG
nDf$*
^T|6
Q:9V
}@U,
Extract
sT
Oq7udzT%X
:A{c/C
reserved
SystemTimeToFileTime
%/&~&
USERCHANGED
<GetDesktopWindow>b__0
set_AsyncOperation
dM@n
7:tG
get_WorkingSet64
ConnectedLabel
vPfK
r?LD
w8'<
}s(hJ>
GETMINMAXINFO
jXqCw
]e[
_lastIconImage
>p?z?
MKv
WebHeaderCollection
bin4
Orcus.Commands.TaskManager
1c)J'4
Gy
(]br
*n(
label3
4tSs
F1_a
!b>;
IsUserAdministrator
collection
idProcess
5	GZ
UninstallButton_Click
g`nx3
9sy
SendLock
<yIrur 9
zx
U0
z].x
.uf
get_HasErrors
ApplicationOnIdle
<ProcessCommand>b__0_5
'M1h
<ProcessCommand>b__0_1
<ProcessCommand>b__0_0
ToAscii
;~
;?;T;|;
n.pg
InstallIfNotExist
o'
s
y+'0
ISoundOut
GetEntries
.Q
^@[7
<SetProcessorInformation>b__2_1
VZ-?
QB$w
_livePerformance
ComponentResourceManager
set_Administration
k"}X
G?$
zD[l(
e!I&B
z.@V}
8
B
YC
5O`,e'
=G	<
+,EK
S]]t/
.p7J#eQ.
Microsoft.Win32.SafeHandles
wParam
ComInterfaceType
nScanCode
FW35
MEMORYSTATUSEX
$n=l[
DmoMp3Decoder
Orcus.Commands.Passwords.Applications.InternetExplorer
set_ConnectionType
HSCROLL
BLACKNESS
FileContent
BvAw0FI
tgASV
ToLowerInvariant
/(8!
U2''
Ivw0
Debugger
<GetFormattedKeyValues>b__4_1
ConsoleCommand
HSHELL_WINDOWACTIVATED
Y*Os
DESKTOP_HOOKCONTROL
IsNullOrWhiteSpace
VirtualKeyCode
_keyboardHookHandle
N23`?
>i"pc
<RemoveFromAutostart>b__3_0
7lx*
+
p\W
$]C"
set_Width
ManagedInstallerClass
,N
+/
z:3&~
K}:NW
dvlR
set_IsHandled
i`(e
MIN_ALL
aD>k3
y/XQ
9r+N
)^g~%0
dwProvType
19gt
<IsInstalled>k__BackingField
BG%t
+B
vJBn
ActiveWindowChanged
get_Ticks
bsc[
ArgumentNullException
get_PreventClose
get_Major
Orcus.Service.Native
GetPhysicalAddress
set_PersistKeyInCsp
+X
2	{j
wtZ!
X.Qr
ge ?8
Orcus.StaticCommands
S/V]
+h
count
AddMilliseconds
WKR?
v2.0.50727
<GetFormattedKeyValues>b__0
resourceNames
oJD4
iII]
ALG_CLASS_HASH
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.Password.RecoveredPassword>.GetEnumerator
^=f/
e=`R
get_Passwordcheck
O-BU
=/=Pp
D9);
set_Architecture
A#gq
dataToParse
X{|O
o`8ay
hexString
get_IsEnabled
RotateScreenshotScreenByScreen
g
6C
l,v^
9z'Y\)
:hF
zyS=
URL_ESCAPE_SPACES_ONLY
O>1bh
txKt
8co&
AForge.Video
10g
~
Activate
GetKey
\hR
m5if
wH$N
EnableVisualStyles
IndexOutOfRangeException
RegistryValueExpandString
)$$I
N]a/^
OperationalStatus
bb\@
<Main>b__12_2
Flush
p0e,P
Orcus.Commands.Passwords.Applications.Thunderbird
)!L
get_Connected
GetEnumerator
(fiT
SymmetricAlgorithm
~8/r
2R;/
Z	uso
MessageBoxButtons
2~!/
JuZ`7
System.Timers
:q-5
xo/^8
1ye;
8Orcus.Shared.Commands.Registry.RegistryValueExpandString
_#Fx
7#97
<RegistryHive>k__BackingField
#y+`
:@d>:B
CzQe
9ZBezVc8
iv&;
set_Lenght
TCP_TABLE_CLASS
tT|iI	i
pr43
&pMg
\"-/ER
(^iR
get_DocumentElement
9{V{
mD7n
l3S7
9cf'
KtP%I"[
Qp=x
r>:
CS$<>8__locals1
Orcus.Shared.Commands.ComputerInformation
Pi+M*
aw
>~
cBmdN
<password>5__1
ReportError
dwYCountChars
/0au
mD7J
+j@2
dwNumberOfProcessors
set_Position
get_LocalEndPoint
pU	W
aQK^
FileExplorerShortcut
text
Application_ApplicationExit
Rg=b
zsT
%nc6
&	ot
_
l%
}>Ui{UU
set_ErrorType
masterPassword
OperatingSystemInformation
cf<)`
3^&t)
S.]?
get_FrameworkVersion
19H^
S5yi
}z*X
Mu
CUz
cER1
x%+<@X
xU	6
:#k,
:d!t
c
@/
qjg3
PlaybackStoppedEventArgs
NCRBUTTONUP
ArchitectureToString
get_InstalledUICulture
4I"!X|S
xy99
SByte
defaultDevice
<
Wk
GetWindows
j0>S
SysCommands
<>9__5_0
Microsoft.Win32.TaskScheduler
LTF^5]
:eAJ
set_Cookies
PAINTCLIPBOARD
m{8b
5ZbG
KeyLoggerService
NCLBUTTONUP
set_RunLevel
]zy~i)W
-
	oY
lfr*
CaptureCursor
U$"J
TuO"
udpData
muu
UZpeG
PROCESS_INFORMATION
TransformFinalBlock
$<90
}Q;e
set_Font
^G/.
pl;
<%[K#xJV
wuzR
|s)<
r[5rG
FileTime
6>"6
J0lGCo{/
sK3]
j&H5#
[1oq
A.L<
5!^5
<AppContext>k__BackingField
82vL
r1Ev
Exists
Yb=(C
X_6p
p)CR
p<"=%oM#
y
<Yn
UvH<
Ak_y
*'iZ5G
@Te!5
LpI
INPUT
_
+O
j%j
r{_k
=sxp
<Type>k__BackingField
_#\Z
Equals
K/o_Z
:629q
json
hObjectSource
cFeJ
UninstallProgramsCommand
root_num
gz*+
J!M	iRHWB
SYNCPAINT
oV:K
Count
nMaxCount
14.0.0.0
oyY
SpecialKey
r :m
Hz}s
0zJ0
AForge.Video.DirectShow
value
Bitmap
windowTitle
>i>"
DriveInfo
#
(2
CsvWriter
^d&m
|p2@
ClientActionCommand
!lUo
z:E
fy?Y
mzx
S=1|
<P4X
IProxyClient
~g*d
r 1
GetVistaStartMenuWnd
x?x6
nXSrc
'_rM
W-O
dKy<od
cGcxk
iUSZK
GetInformation
DDmS"
BU%T
PENWINFIRST
$>2i
R
>#
AzU
EE6001A9EFFBC3E336D7A05124DA53EF8D648CE1
7N1
F
SHGFI_TYPENAME
get_Exception
MvERU\
`Q^u
sI)v%
yg>U
I&Ki
set_SelectionStart
r{*_
{]0:
get_Source
3Kvo/
?7l~U
eiM3
r C
_E,A|NT
wjOW
!"D*
P'mQ
U#$>F
v,h
&Qox
pd5f
`COr
5i
g
606O6
GetFiles
Degrees270
!Je(K	{
mpX
get_FileDescription
y#	D
N,"a
wx4V
Tu\~z
<I#x
Thread
I}Fg>
SslStream
ProcessExtensions
(q~	"
4#4#z
Orcus.Commands.ActiveConnections
FromFile
XmlObjectSerializer
`pw6
`#
%VZ~
cLdp-#B
SHA1CryptoServiceProvider
2&O)
set_EthernetAdapters
+b}.h)W\
RIKP
get_CurrentThread
get_UserInteractive
EventLogEntry
8s	p
SetAttributes
%$	=
GETHOTKEY
MW1j
cjOrB0
RsQO
ReadAllText
|C5c
record_header_field
(=-|
Q]NkT
set_IsPrimary
o/r_A
GetIPProperties
SMTO_NORMAL
&XTO
;FK5
]7O7
5K!,
ManagementClass
2i^/
Qn<!!
gbY[n
{`D=
w~)Pe
M
~d^
zm8]!
K[\]
J8cf
host
`-
V
<>9__40_0
?bk}uJ
z}/X
-%jX#\
get_GlobalSalt
u*[o
WS_MAXIMIZEBOX
URO<Y!
SRCAND
gmu~&
!rA+	PC
TC?m&s~2
Orcus.Connection
95s,G
&8<
R!]!~!
nZXH
|n:u&
yHotspot
{uW_p
dataMode
]\l@
~|Xk
DTnE
GWL_STYLE
\<.
@L%Q
Yiq=
set_RuntimeVersion
Zz;1
3P3h4
ClientOnConnected
8N)P
Mouse
get_EntryName
B^0%
PtrToStringAnsi
GETOBJECT
b8}]
&8f
,4(
TaskmanagerCommand
G
0;dq
<>c__DisplayClass14_1
Serializer
S|%=U
Compare
&8Q
get_VolumeLabel
Y[#(u<
(!?7
Notify
f*;Gf
+
GetDesktops
wHge
GetFrameworkVersion
)<\N
SRCPAINT
yFM
WriteLine
p6'c
l^;4
!5agu
18u
p1?
Ghk1
L:hU3<R
uSan
_C]k=u
Sfn,
.A(s
~~R'
$cY\k
}!Zc
FT
|
ipEndPoint
}0kM
p+r@@
_u	(
<>9__12_0
<>9__12_1
<>9__12_2
WH_FOREGROUNDIDLE
DEVMODE
HTTOP
LRJ
`~(X
Year
ru
!nq0
n4q	r
h,39
w8Xx
timeout
vutX
3y]x,
l7.C7
l4hD
T(ES
B
mIX
L

$M	3g
34vd
Sleep
j}%)
UYRv|
1jJE
c
|
SVNZ<
1Ptq
MethodInvoker
LsY%
DateTime
?}b
EnumDesktops
djn
XYo0
UDP_TABLE_BASIC
]
.
QqIN
XYo8
I?p.
fvTg
Pidgin
Nm#H
GetBytes
j>wxn]
XYo#
G|)D
System.Runtime.Serialization.Json
DM_PELSHEIGHT
Wow6464
yyE`
T5OG
ConsoleCommunication
pr2:
<rPF
w!\Wv
g}sN
set_Secure
get_TwoLetterISOLanguageName
zA?
I?Ir
2_c0
ChangeWallpaperCommand
St*
y.Ty
E~r
Ff$]
d+Zt]v
get_RootDirectory
XYof
databaseConnection
Pb\7&rp
%
|@
TVLl
J4nSZ`
<GetExceptionStackTrace>b__0
J h`
0>
xK_Ff
dN6&
MnR
_uninstallPaths
4DFy
?:^=
YY9s
w*K^g}Nz
]g
MessageTextBox_KeyDown
BZFBy
<e\
get_Monitor
LockBits
<RTE==x:
S]^~
ptScreenPos
6@12P
qIpkU@
>qx{
S Ma
FileTransferAccepted
r
]bBR
tGU
Q)P^J
S._O
ExitThread
Orcus.Shared.Commands.UserInteraction
get_AsyncOperation
<Keys>k__BackingField
Mw-u1
Orcus.Shared.Commands.HVNC
HDP]
FoM|
path
zne1
omWn
0V5=#h
/yqa
uYg8
|*mE
L6LWLlLuL
tavV+
HtWQ
OWnj
hl&
*{_
;XB]Ekxiz;f.
ekT{
ProcessStartInfo
SMTO_ERRORONEXIT
G1S}
c^xE
Orcus.Shared.NetSerializer
lParam
su.2
iM'=_
TpZs
C[/@
visible
set_StackTrace
unknownZero
<key>5__1
3w(w
.-.*l
VMW_EXECUTE_MENU
:%!
HiveKeys
%~X
B,<-
SynFlood
a.}9
T,9d
~F[<
X+->
_reverseProxyClient_Connected
h428
"rI$
IsAddedToAutostart
6 ,9
IsDeadKey
?9OAV6b#
FileMode
HM>d
{yo
5Z
]M
CreateConnection
}FH
set_CanChangePriorityClass
Cs@8^;
]AIt
HZfT
Costura
IntToIp
wu|Y
O	Bu
InterfaceTypeAttribute
<Target>k__BackingField
hz
d
QUEUESYNC
*l}I
HTTRANSPARENT
!^7n(0
{R'>_>
1Ka-
COMPACTING
6Z{
q#mJ/V
j0d=b
LNuF
hDYNz
IoDd
Zu^
<<7b
RotateResult
9$#X`
!!W
JoFgu
50p
OLjkf
i|p
UYnw-
WS_HSCROLL
xz,08
?8(x
get_BitsPerPixel
{C=M,
+(ka
w}{K
AZ?#(hU
get_Definition
_databaseConnection
$C4
?TVa
GetAncestorFlags
$3bRwO
8GiC
M<W;
q]sG [l
h&Zt
SRCINVERT
m(]
ForEach
GetConstructor
get_PSize
tVS[
REGISTRYAUTOSTARTKEYNAME
~$wVM
CTLCOLOREDIT
_v?0}P
Q&Yw
9!N3
{r\7
Z0~G
'W7c
9C}]
<U6Ix
AssemblyTrademarkAttribute
|y%a
Eb,
VncMessage
uyC<
RotateScreen
EnumDesktopWindowsProc
Decompress
shelldllDefViewParent
]bLTw
A*iI
g@s<
RSQTME
S*DM
nc?H
Nz%1
add_ExceptionsAvailable
R,SI+D
m_\d
n(9M
D+$kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG$kG$k
4k+O
7L#]
{r	l
StringSplitOptions
B6Kx
mH0}
JDownloader
GetTcpConnections
set_Device
;9guRdQ
y@?v7F
<}]
"
lpProcessInformation
~?Ed+
2p&9
DoKeyPress
I4H@
,1+
-A=Q
*!V
qJ
SYSKEYDOWN
~(VD
_u.'
gLo+
<6q`
<Image>k__BackingField
IEnumerable
NCMOUSEMOVE
gm=5
<mT(
z$l
rXEz
QA
v2Z3
EDBU
get_VerticalResolution
o.h<
IgnoreZOrder
\Ah|
pl!85M,6
B,!Z
)+8=
CwzN
Bbq_
026&
riLu$
F
`
Is64BitOperatingSystem
<>c__DisplayClass5_1
<>c__DisplayClass5_0
Orcus.Shared.Commands.Console
m=K
JrwB
O<e68
Guid
Ghvm
1Orcus.Shared.Commands.Registry.RegistryValueDWord
UriBuilder
z7N%
d267
YZv4
&+U]
Jk{Uh
.T(
s	?`
|)8@(
d$$!
get_Name
;9j?
M\o
windowText
)f!C1
o+|.
UpdateCommand
EthernetAdapterData
VC94U
DoesUrlMatchWithHash
inStr
lastestWindowFromPoint
6f4k
3qa=
StartSynFlood
nNh#\
/(4l
P\zXY
&G<RWK
UrlCanonicalize
TFH~
&BB8
No B
BWIg
get_EntrySalt
CHANGECREATIONDATE
2V"
IDatabaseConnection
|F>+
%}-
)vbT
5b7%
INITMENUPOPUP
e~g,~
_receiveCounters
+bzM2
=5hb
"&mV
+`J
#bi$P
BlockUserInput
StringCollection
y|"yZ
*s9b
'aN=!|n
USER
w@zy
get_Headers
MBUTTONDBLCLK
pass
get_KeyCode
{@.b
Raq[B
rd 3
$-
9
set_IsCsvData
w_Wu
R*r,
$k:yG
m3LMP
4.nmi
ZKAf5P
2$f=
: xMX
7
SRCCOPY
~M0
gtnt
y:OEf?_
F((
get_Values
Convert
IsSearching
rjF
h"C*
MakeUnique
-!%D*NI
_standardInput
get_AddressFamily
5e,W
{l<S
MouseActivate
EO5IGi=]x
_$[7
Ev+U
n{
w
lpRect
FlagsAttribute
naL
J:gp/!
set_KeySize
bf|I
dmReserved2
&UK
#njiR
bbX?
op_Subtraction
mSd*)
dwmsEventTime
MN;H
Bw%t
30Bz
IEnumSTATURL
xlxx
set_AutostartMethod
Orcus.Shared.Utilities.Compression
uploadInfo
IfVL
P5`+[
yzCy
pSize
PK11_GetInternalKeySlotPtr
Records
O7WK
}2
defaultDeviceId
k:(
|4>?
+4'F
J@l 0a
~=
:Z2=
label1
label2
nzzf:
StaticPerformanceData
WindowChanged
_appPath
System.Net
I!\
S:|;
s
XH8
4r,&G19 ~<
}[39N
v,KT
i+8_%
UYb.i
System.Speech
ServiceStartMode
[Q;
KKi
get_Default
)tci
Nm-d
)];Q
kernel32.dll
get_CustomName
UnD?
qoMp
Enumerator
NotifyIcon
?sQ
l`x?~
RestoreMouseButtons
e_)W
staticCommandResult
g
|Cc\Ax
{=z<~b
,`u
MasterPassword
GetTypeFromHandle
<&"
JiLh
B/r^n
e_)2
jH2+
get_RunLevel
vClp0
_buffer
q_1;a
SendText
D
pHe.
7gE^.(S
CheckRunning
|\?b
PENWINLAST
i`9ck
Regex
WH_HARDWARE
NDb
Rrbc;
PlatformID
JsonUtil
x3skp
Cn_i
set_IsConnected
kt(x
jbC[
5-E[
piconinfo
get_IsReady
v&YJ
_windows
4hic
NCMBUTTONDOWN
_`(b
r}@
get_NewCommandType
AddHistoryEntry
_sock
HTTOPRIGHT
A#f:1
set_AllWindows
GetPath
"r9+,iq9s
MakeAdminCommand
wGSx%
]
		Xs
remove_CommandLoaded
v uKG
Fst#
jo45
Rggn8wQ
ClearHistory
y4w[(>.
n3?Q
dwThreadId
=e1:
pM;m
get_Application
vkcode
!MHs
ResponseResultEventArgs
<IsClosed>k__BackingField
IcmpSockets
JC+5q
u[S
G73:
\n
5<R
Write
<>9__6_0
pZ+j
hIcon
<>9__6_1
~d{_n
>A5)
SpeechVoice
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.GetEnumerator
AnchorStyles
"Ms<
hs)3
PushRequests
gjZac
System.Management
MainForm
<FileTransferTempDirectory>k__BackingField
Disconnected
}NnC
xHZTu^
get_VncMessage
Thunderbird
NY)S 2
,vZ
Kf1;
=V
k<
get_ValueKind
5{E]
ks/L
Xs_+
jT=+
^>`G
ExecuteCommand
LogonTrigger
jV/o
}Z-w&@
AsymmetricAlgorithm
!}(f
N|pCL
M t^
t_6{*
2gZ`
PwwL{
iHFg?7
';Oo
set_ChangeCreationDate
Fv1T
T&:;7?
Action`1
[*
y
dataPath
w;iR
.,-H
I#~7
<PushRequests>b__2
get_ProcessName
a51y
UN%ouV
GoC3s
SHELLDLL_DefViewParent
7F7^7n7
A!uzD
"
K;Pe
get_AvailableFreeSpace
STAThreadAttribute
&H%
M>WZ
Graphics
q/N;
~LWN
add_StringDown
rW&
System.Globalization
JyVLK
`	X
prx3
eventArgs
set_TryOtherAutostartMethodsIfChosenOneFails
WH_CALLWNDPROC
zYQm
IsDE!
=&=}9
GetKeyState
ConvertToInteger
Oii&#
<P^\CQ
s
-fr%
VMyn
Microsoft.CSharp
nyvQ
z;
System.Drawing.Icon
bB4m
wProcessorLevel
ww~}6n
,8.n
C4NY
JA$D
]T+ u_
1\q}
GFBXM
Qy52
PropertyDataCollection
get_Jpeg
SystemDirectory
(4{_
zP%P
y)W}
CreateInstance
mnQrm
sTl{F
CKN1
+5<Dy
7i4b"
ItHX
_>5]J
ImageExtensions
(4{N
N6~`
MDITILE
=
2L
TVB
a"gJ
UdpFlood
jdR
=P}9
hpsoi
System.Collections
<3_p
+/,X
q%/4NO	b3
V@^?
(GEY
<>l%
ENTERIDLE
Y,J#
Orcus.Commands.Passwords.Applications.FileZilla
SendInformation
remove_ExceptionsAvailable
get_Actions
P_6't
|~EP
Enter
x@-SM
@xlm+
1818q8	8
sM.j
>.{vu
,&u&E
dmTTOption
I;T;
fm)|
%2NjOd
set_Padding
,7RL
H^[cA
5?gC6
peAl
p*rx7
,c	I
set_EntrySalt
n*07o
get_SendLock
xCJ;H
C1$Z9
)<z+p
Decimal
!QVg
qB"#
mw@<{
w
/>o
%`T
<Attach>b__0
PALETTEISCHANGING
oaP>a
WJBx=
}pnchM>
baseName
Qot!!
LiveData
J^Av
<,r9
"2ga
~DnF
k4BPg
-CIs
SynFloodCommand
q4Y'm
[oT%
F|s2hk
p u.
vK\w
kV3l
AssemblyDescriptionAttribute
get_Path
*
G}N
^Xby
t7JA7
R.s_\
h9Ph
{,+&
Activator
O/jY
<>9__22_2
Xw30
A$Kt
H/4]
_translatedDescriptions
UpdateFromUrlCommand
atcfH
SetWindowLong
9gw)
$I8
IsAdministrator
_
I
set_Anchor
EnumerateDevices
DN<M.
ParameterModifier
;y
>
6"'rV
\g/q{
Double
AJ ?
iz
?~p;8
n=(1
uEu`
NormalText
77ba
DI0c
HTBOTTOMLEFT
H's1
e ;&
PK11_GetInternalKeySlot
uFlags
CRK
j
}T{;s
<>9__2_1
WM_RBUTTONUP
}
eT
get_KeyLogFile
MD5CryptoServiceProvider
W]>
get_BaseStream
]
7_
X&cIA<
} C^q%Ay7
S|nc
WINDOWPOSCHANGED
GetSecurityEventLog
2#
H7st
-lu@Xi
PaddingMode
HL?C
get_AudioData
%MP
%	oG
/
kl^
IsOnParallelsDesktop
set_WindowStyle
inverse
GetHardwareId
MENUSELECT
rt9
MyGetKeyboardState
/aho
"n_
~,&[
90;<{o
^?7z
1S3HM
Kb8k
&;KK
RBUTTONUP
PivJs
Socket
filePath
K!B
x6Bqb
outItemOpt
#ffffff
ftExpires
g_#b8
CHANGECBCHAIN
LeTh,#
gBUf\U
SetWindowPosFlags
d^'y
!&=U\
rPK8
=-Zl
%	o*
_cpuPerformanceCounter
get_IsCsvData
*wJ4g[
{I=5
get_Handles
DSTINVERT
YY}7
YY}6
CG[-6w
#AG
:[UC
get_DesktopHandle
q,	[
port
TextReader
set_Guid
k+}
#%|$
G,!v
set_Platform
ltp
ImageUtilities
K0_3
3[,O
Orcus.Service.Properties
t<{b
System.Core
c}JEN
H03C_
})^5
nD)
B1_.
URL_ESCAPE_UNSAFE
%rt5
EkI>|
u
un;
,#]p
WG~!
BYz$
xZqvtAr
AssemblyName
qD:b
^?Bf
V\^.
Pvq
s2_y
set_TaskSchedulerTaskName
ToBitmap
z*lp;(8t-
C1qB*
|q6W
_sqlDataTypeSize
+)
m
1a%\
5C/?
requestedAssemblyName
1VY%c
e\abO
4+!^
]R%-
*^=@6
IAtd]U
_commandSelector
Microsoft
#$z0
y![
^"	P^_|
Jmr]w
AsynchronousWindowPosition
}PRm
Enum
_cursorLock
Fz	n
Loadables
H[(P
K]o:y
7ww2
CryptReleaseContext
YP3%
Opera
^6n6
HP_HASHSIZE
DESKTOP_WRITEOBJECTS
~fr~:>
uJi
(u-b
zf*Z<X
'1}k:
}n+~
p
|
hK214
Y+g
ProtocolType
set_MasterVolumeLevelScalar
24{~
DZLu7
M?R9
[gg}
xjTp
TG;Y
r	&
stream
!E#T7
@0Wv(o
o#)&
AppConfigWriter
set_IsAdministrator
AX
8h
SetWinEventHook
l|8/
StringExtensions
<Z`Z
eEd
ReverseProxyConnectedEventArgs
SetTaskManager
)Af.
CNz>
.)rm
c@bTDcF
e<2Y
2AmA
e%m(
V'
SM
Id;pa
DnX0kNYp
5Ug^R
GetFreeFilename
]b~k
tD;%`
2A z,
loadCerts
GCHandle
j1|
s66U
IsOdd
CS$<>9__CachedAnonymousMethodDelegate1
ScanCode
i=^\
j1O
AccessRights
g
?0
UserInteractionCommand
xx:w
System.ServiceModel.Web
"lN
pg^G
BRdY
<>9__1_3
<>9__1_2
<>9__1_1
<>9__1_0
<>9__1_6
<>9__1_5
<>9__1_4
HWND_TOP
nXDest
RcSrw
szDisplayName
Z;CD
@c
wfj
LNylw
YJ$5
HttpFloodPackage
c$Fz
Orcus.Commands.Webcam
;Ia8W
_reverseProxyClient_Disconnected
D9,5lZ
{@O6
N27P
FormBorderStyle
_gVZ
X=1y
DeferErase
inLen
<VCode>k__BackingField
InfluenceStartup
OP{<I
5S
JS
@s'8
G@.Tw
+3
set_SelectionLength
^
set_MaxRefreshRate
<dataList>5__1
pOrX
,(+
J7Xy
dmDisplayOrientation
+'
Environment
name
Sg`
iphlpapi.dll
OxF52
JgQi~
x2NGm
b
xOV
Threads
+
set_ProcessTime
_icmpSockets
5B}C
JDK
]C9J
qqqK*
add_UnhandledException
2Orcus.Shared.Commands.Registry.RegistryValueString
j;/-
c%^&
4<1:
s]^"
aeMK
W@k:
oP_
-QQVo$
l4\O
JN#a
set_Workgroup
>t	G
get_UserName
_sent
p Z5
9n$A
PluginsDirectory
state
WritePlugin
t}/p
#`sm
_meColor
mLhL
`Oj$
SendToTargetServer
^O~]
allProcesses
Ve{E
r_|_
5|
9G
formSubmitURL
p}\d
(4fUN
SendSyn
2e!"e
{<@G
7zD8
}GhU
row_id
jSnGJ
>MOo
Wtv*
P'5V
get_CommandResult
ConstructorInfo
o2
SecretId1
SecretId2
SecretId3
SecretId4
SecretId5
SecretId6
aOFM
Start
Socks5ProxyClient
V,xK
RotateFlip
DESKTOP_SWITCHDESKTOP
g[e#
VHt;!
!^jJ>
H04seee
|7xtx
.v
System.Collections.IEnumerable.GetEnumerator
B4!
SendTo
Data
EnumUrls
get_Expires
CancellationTokenSource
Tr]
IJTG
Jtd9f
IClientStartup
"83ByHw
KeyContainerName
Awq
c:C9
]Ig
ol
COPYDATA
8l^qI
IESecretInfoHeader
System.IDisposable.Dispose
oY
a$
~P~a
YyYN
Lenght
3qh>C
StartUdpFlood
Cq O
g[e}
nc3i
SendIcmp
<>3__defaultDeviceId
oG
6r8f@
v3CU
,VX|l*
_sendCounters
!This program cannot be run in DOS mode.

$
!F}#
#nQZ
1&i%
;y
\|
chXk}
Mvy
get_AddressPreferredLifetime
{*Cl
NlW*
CsvRecords
OfType
x_5R
GenKey_SaveInContainer
MDm(lA
l~@b
V"dm%We
i Gh
EthernetAdapter
Orcus.Commands.UserInteraction
`-yb
H/lg1
y@$i
q_p{
kA~8G
dwActiveProcessorMask
5UK)-B]
owningPid
GlobalSalt
|{_@
|>WZ R4_
9g]v
y@$q
w5al
}B \
SocketFlags
yJI/S
a	h!
QUERYUISTATE
httpData
_E}(
`hAfhAfhAfhAfhAfhAfhAfh
jf<YX5
MIB_UDPTABLE_OWNER_PID
!1e8
~fKMs
"Eb6
set_HideFile
CrAF
srZ~^~A
<L*4F
HOTKEY
localPort4
h9Vg
KeyboardHookProc
localPort1
set_Ipv6Address
set_TaskSchedulerRequestHighestPrivileges
get_ExceptionFile
NCMBUTTONDBLCLK
<,=6
set_Language
StartIcmpFlood
akw=
Byte
containerName
YJz)
#
6
MoveNext
$)xl
Socks4aProxyClient
HUI{I
GU
A~3b
n6y}.W
<SendInformation>b__0_0
<SendInformation>b__0_1
mD;1;B
<SendInformation>b__0_3
set_AcceptsReturn
CLIPBOARDUPDATE
GetUrlHashString
wHg&)
H-c
0
`|Xb
MOUSEWHEEL
k|<p~
DB)F
z&?|
?9F
9I
/	/
sW<Ra
e&gC}
Cu
]/
rv2
9\I
UninstallButton
set_ManufactureId
t]I5
06^1
set_AudioEndpointType
oE=HS
1XM
rkr$t0e
}W`h
MI?I
V{Ms
ptEx
add_AssemblyResolve
vID^:
dwWindowStatus
hKRt
IList
G
[(
=q<W
Vs:c
&uS?8
User32.dll
4wFx]
HashParameters
dmFields
GW_HWNDNEXT
Month
=*M?
SystemInformation
get_Item
configDir
}w&5
TmO4
color
HOh
GEwC
dmSpecVersion
JavaScriptSerializer
o)5kj$Ov
h@:h3@
y
u,I4(
mmDeviceCollection
~&W)B
x+7gqY
JT*)
y#3@?6
|s2D
E\Uw
,r
Z#JW
d?DH
QP1Nj
/O-z6
}m:\
FindWindowEx
C:4b
z.=M#
!Qm+@
+$Nk
NSS_InitPtr
output
$?/BT
LOLUQG
^T
zV
-wSS
&X|
T3,'
Pi^G
J;tj
get_IsCancellationRequested
\N,
4gh4	v
x6`\	u
(Q
set_GenerateExecutable
Open
GetHdc
<TF
gKC%
F-W1
9-s+
SortFileTimeAscendingHelper
'u}}X
GW_HWNDFIRST
j}V{
Format
_^+
T2
<iOa
WH_MOUSE_LL
UnhandledExceptionMode
,`$)
s%;_
timestamp
VideoCapabilities
N'Y>
<VncMessage>k__BackingField
_@Ft
StringDownEventArgs
mR=J
enumAudioEndpoint
WindowsInput
iXo.
<Exists>b__0
e
KT
2gWBv
~Y[sq
K[nX
LinqExtensions
<>m__Finally3
<>m__Finally2
<>m__Finally1
<),Hol
<>m__Finally4
j
J15
xB}BC
KK,q
YSM4[
6	sY\
components
nh19
.:R
YSY
>fBy
*Ow6
get_Properties
>t.8k!J
?;xr
[a[/
|\k
dQ?
ILC_COLORDDB
JGU=)
h*PkR
p=\K
BH7
remotePort1
managementObject
A2+A
Minute
<b1
PluginVersion
remotePort4
Group
set_AutoSize
TCP_TABLE_OWNER_MODULE_CONNECTIONS
WebClient
/B8z
AnVu
L5`y
A&hCA
2/=GB
36%K
YHm{
|H)A
MDIGETACTIVE
stFw+y{]
.]<p
a#d
UUID
*;G;
get_Description
l-
8rzi
Mj[q
DisplayFixedOutput
dH{F
SendProcesses
Orcus.Properties.Resources.resources
get_KeySize
o%byx
table
_host
ServerPackage
Connections
Fz5d.
Rfa"m
1Mqa
ServerPackageType
Wk|W
ReadByte
uoT~f
"^5%
G+)E
lpBuffer
NCXBUTTONDOWN
wmr>
;,&wp @W
&UQf
Orcus.Shared
CodeDomProvider
\_6R
get_RegistryHive
)[F`
VL~o
]"6e
|Uq)
SendServerPackage
_stopwatch
costura.orcus.shared.dll.zip
*"/"?b6
S~y&
(O`z=
AllocHGlobal
*T-R
(c1L
iI9;
Orcus.Service.Core
EnumDisplaySettings
4ER
~J8z
<AvailablePlugins>k__BackingField
RxG
BitmapData
+o3c
CSCore.Win32
2RT:B
_filePushRequests
[]8I
J6tP3P
&$itoM
Cx?&
R1gc
FRzxo
\X;ra
MOUSEFIRST
}6/t
Z
	fB
hkResult
E@	)
U%'<
Compute
FileNotFoundException
X$5ib
y.qt
h;h
,]a4
+-:(
nIDDlgItem
get_Keys
Orcus.Service.exe
\?A
set_Heigth
UWkZ
IndexOf
WH_MOUSE
:}gs
set_AvailableFreeSpace
9;bC
OTM
HSHELL_WINDOWREPLACED
C|1&z
4#6X
V=,"
gH
*M&1
StringUp
Ho
&)U'B^
.VT]
HD(k
<GetBiosInformation>b__0
#GlV
8,xy
wgh,
?O\y
<GetOperatingSystemInformation>b__4
IsPrintableKey
set_RenderedWindowHandle
'|:`
gdRH)
7ZJ
9E;b
"dzgJ
v6'm
PzD3
get_SystemDirectory
StopAll
0at0
w+8w
qK0j
2 ,b
SetCursorPos
set_Interval
|V
!
BerkeleyDb
8#X2h
Orcus.Commands.AudioVolumeControl
!R*GJ'I
MulticastDelegate
MRTJ
AddRange
3L)
<IsEnabled>k__BackingField
Oa<z
CTLCOLORLISTBOX
;O>q
TaskRunLevel
[JU3
&E4J
eventType
libraryName
get_Uri
AutoScaleMode
Nm}
F
wc	C
get_LastUpdated
WxK*
M(N?NVN
registryKey
z
ww
e}k<
12TH
nI,sz
SYSTEM_INFO
MainRichTextBox
u$y3
ZY>=
q[p;8
$n3c
RegistryValueKind
5h#\
-O.~/
.o-}
pwcsUrl
DWMWINDOWMAXIMIZEDCHANGE
)/L95
N;@Q
.r-/(
Headers
newCommandType
CreateDesktopInformation
m'%os
P_=2z
|r>Uj7,siX
CallNextHookEx
QV8"
9}
M
%
.(ps
dwIdHeader
Current_CommandLoaded
Binding
dJJtl
+$ig
=/wN
set_MaxBufferSize
Q0Ri
Disconnect
A6NV7K
}GR
FileTransferCompleted
-I:v
B?f,
ipVersion
AsO
K !
FnT2
+OtvV
Jsy#
g'-K
qx9
uZ	7
IsChar
<Passwordcheck>k__BackingField
[x~'
version
oTo{
)
='n*
j\mo
idThread
><{;
rL+
h)Ox
xj!
7<	kpyR(mh
8Awn
hWxO
l83_
set_RegistryHive
DESTROY
za,S/
Tlp"CC0H
set_Owner
>1_^
M#U-
5tt8
Re4ZhJg
#Lxg
)1B|
JFR:
set_AvailableMemory
-|g1
oS
nk6e2
StaticCommands
Append
n4hhn[
Style
}sOf
FileZilla
/acEz'O`
`i5"
Rfc2898DeriveBytes
c3z;{
System.ServiceProcess
op_Equality
_activeWindowHook
b
_M
SetResolution
us q
"
94
`
72?
N
ReflectionTypeLoadException
m8;p
'88~
qqXW
lmN(
=mc{
KDolx
YHn
9	y
>iV6X?L
<>l__initialThreadId
INPUTLANGCHANGEREQUEST
hHash
w
5
dwParam
v
get_PrivateMemorySize64
INITDIALOG
d)Q`}a
=KN
J{ye
gE5L
DataFlow
_unloadLock
get_UrlString
<z	/#
\6=
_encoding
get_FriendlyName
IPasswordRecovery
AC>(d
dmColor
costura.orcus.plugins.dll.zip
ReadLine
DESTROYCLIPBOARD
8H\o
wVgPZ
WLfA
}rhF
Np/\
f`/p
[&i%
PrintWindow
6MA(
E4F(
<'9
ye	=
WY!I
set_StartTime
q=z&C
B	+
"N%
Ucv0'
yNq?
p?11
;&X{
fnJV
Dq{[d6[
callback
B4)J
\}%(vS
VAaE}/
lfg;
.?[wI
rv~_
CreateEncryptor
XNF=
Bottom
l\!</p5Z^$C
lD i
<dCR
7&>s
n?]V
^9%uZK
IZ
4
>u\
GetIconFromPath
tu4
style
f$B!
dV@NFj#
lpszDevice
%
ty
}a$Y
Binder
taZv
3MscY
set_IsEmpty
get_Loadables
InternetCommunication
Orcus.Commands.Passwords.Applications.Thunderbird.Cryptography
Ri5
get_FactoryCommandPlugins
ProtectedData
AppendLine
dVKf
5WS
-
gdi32.dll
Insert
#j],)
e*H
Rpx[
0u
J
M2t
"WG+l
\:Of
X4t7
=@d3

<Decrypt>b__1_0
GetTickCount
IEur
3(BJ
SendMessageTimeout
=UAfW
LivePerformanceCommunication
<E!@7So#
0M}*
+k$H
Da]E
~
n.
*7(-J
c4bN
f(cZ
}QExs
dL#
forcePush
AddUrlAndNotify
tvt<K
*~e
pE
7
unknown
(l'
zZ(#
BzD
?_Sd
ACTIVATE
f"4M
get_Stride
rH|/
dmLogPixels
set_MemorySpeed
<	W'^
SHr(
[#8X-F
2|Z}
get_PluginVersion
a9
Block
TextBox
NPf=
get_Right
{BR/K
CkJ0<
a.DLL
_instance
?V
B?J
9<r
set_IsEnabled
DataContractJsonSerializer
ErI
RsaEncryptor
KillButton_Click
@lhB
dwPageSize
HTHELP
<Port>k__BackingField
X-GJX
cMu6
${N3K
SRd~
2VvTp
6,7qJ8n
h=C=
he6
SC_VSCROLL
-S
zA?
GetUdpConnections
IsDataAvailable
B+<%2D
pg!6B
- |A`
set_IconBytes
>6IKS
`q(;
ZN0g
MFEA
Packages
2fxA
jD@0
lpfnWinEventProc
InitializeArray
usd#
<>9__4_1
&I(R(e(u(
L%g&
Orcus.Shared.Commands.Internet
Orcus
b&ZG@T
?%o.
4/aM
Orcus.Shared.Commands.ClientAction
PtOj
hDci
m{u.
x/$;
R3r!
LBUTTONDOWN
RsaHelper
ud\U!6
#Rvi
P
IJ
zq}''P
Tl9]
Y16IL$_
eYz
TimeSpan
k(?G,
dD	F
yY!2
YR\Y
)O8,A
desktopWindow
9Dmcm
memoryStream
<ProcessCommand>b__3
set_WorkingSet
v[,hh
ResponseBytesEventArgs
<6tY!
38?{
63CU
dwAllocationGranularity
`p9\
cgd"
#/o|
@?r"W
;
O\0~
ZJm(V
k@ =o
yBMS
hideFile
UnescapeDataString
jT`~
YUva
c
'
Int32
??Z7
8'mV
//X\5}
recoverCookies
!W}U
G
P45V
DataReceivedEventHandler
set_DriveFormat
^Wz-
RemoteDesktopCommunication
vA}z
IWaveSource
&6v-
FilterInfo
LiveKeyloggerCommunication
_keyboardHook_StringUp
a["
lpfn
Degrees180
I=D=
%h#/+C
_activeWindowHook_ActiveWindowChanged
PackageReceived
_md5Hash
'hMb
RegistryKeyPermissionCheck
}@Y]
D? Y
GW_CHILD
SF`[~
q%y
h
PG	u
<?xml version="1.0" encoding="utf-8"?><assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
AddLast
icmpData
set_L2CacheSize
Value
SendPackage
3]q72s
disabledHosts
Pez91
GetAssemblies
<>c__DisplayClass6_0
r*R/
<E
F
K{i~
iqag
SXL/
Dy5m[
ExpandEnvironmentVariables
get_Type
get_Shield
CreateOperation
<ValueKind>k__BackingField
ha/[
W%;a
add_Elapsed
SendMessage
"@s<
8G0
x+syp
FindTask
/6`'?
set_IsDefault
lOJN
SbbR
6Q(
E
[.
c^^l
|Iv^
SysListView32
$}F{
NCHITTEST
set_VideoProcessor
HTERROR
gqd
bO/
G wc
8w48?
set_IsVisible
,a.?
]	v)8
t.V?
serverPackageType
Path
costura.aforge.video.directshow.dll.zip
5<!
Ik@|
%cD-
059
get_TwoLetterISORegionName
ICONERASEBKGND
-+vO
=S~N<^
&]La.
<Value>k__BackingField
"E1)
NEWCREATIONDATE
,W	s
&"?A
S
U~
?.
'j[g
ServiceController
}#%z
littleEndian
MessageBoxCommand
5X<
E4M
3)_k
BlockCopy
3-R+
STATURL_QUERYFLAG_NOTITLE
\%4
$
R!wj4f
Play
shelldllDefView
Q$0
GetAllNetworkInterfaces
xG!k
)L+\R
get_Handle
bL	[
_obj
*^~
Yx4>
)%\(
CSharpCodeProvider
26q=c'/C}
NativeMethods
wj?S
T\5i6!+T
StringBuilder
x>t(
3@(b
get_TextLength
G&n4
UnhookWinEvent
f'l'
7IHf_
yN{,h
#|\ @
get_VirtualScreen
dwXCountChars
Au6b>
*^
get_Errors
<ShowWindow>b__1
PM4Jk
m!>
y`~7
NCCREATE
Mutex
F5o0
%r1
COMPAREITEM
CompilerGeneratedAttribute
pocsTitle
<DesktopName>k__BackingField
[U_>
FactoryCommand
%oh{
%[iL
wndHandle
pr'
.[<y
"y@G
GetFile
h a#
get_Extension
result
,BCT
CHc?-3
get_DatabaseConnection
get_ItemOf
{.3#
"Y9!-
O =y
get_IcmpSockets
CLEAR
get_IV
set_ClientPath
ZOEkxq
timeCreated
Mi
o
set_IsKeyloggerEnabled
FO:
PS	5
PAINTICON
C8^<
FW6
get_Ip
-Br
|l*J
|u5
2|wu
lm@^
get_Id
get_ForeColor
<7Z[#xnT
)/'"]
sslStream
B
u<,
eo5\
Ng@8
Zu6Z
=P5@QmP
U:
=*kf
@
|s
8AC
[&k{
(/
l3_|(
JnKzZ
RemotePort
TCP_TABLE_BASIC_LISTENER
symbolNames
\8^&T
M)_)
EycO
Initialize
GetAddressBytes
IME_ENDCOMPOSITION
;A/E
ActiveConnection
n2E}
PY>V
Last
5mad
g3B|
SendTextMessageEventArgs
DrawDesktop
ree:_H
GetStream
BxV!<
TCP_TABLE_OWNER_PID_ALL
WCF_PAINTMETHOD_PAINT
HJo944J
set_Verb
lpEnumFunc
$O4QX~
_hookDelegate
WindowHandles
_h=O
get_ConnectionId
#f>A^
PasswordRecoveryCommand
8	8	8
)<MQtF
>66
h#M{
ftLastUpdated
w`'z
F#)
+
bPM}10u
'#z=
`\;AR
GetCpuSpeedInGHz
PCTz
h}C}
5Qzm.Q
EventWaitHandle
RxC	oH
`%M)
PbHL
-1x {
MIB_UDPROW_OWNER_PID
get_EntryType
<7T(
Orcus.Shared.Plugins
Yandex
\g;"
VQvj
Orcus.Shared.Commands.EventLog
m[x
&f,d3g
0
1A1S1
IPInterfaceProperties
_tBg0
Command
CompilerError
<2"M
x`L"
J%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'I%'I%
#333333
RegistryKeyHelper
IEAutoComplteSecretHeader
PAINT
R/>~4
.W._
Kx>a
$#:|
|d7e5W
i)1
\6C,
{&&
EditorBrowsableAttribute
`Cb}C
get_Image
l\ti
'	DH
ihhi
&4YA
HTHSCROLL
CarriageReturnAndLineFeedReplacement
WebResponse
h]ff
g	o<Z+
PATCOPY
WM_LBUTTONDOWN
_|b7
set_ProductId
get_DriveFormat
A8!8
_sslStream
Pz_H
PV	e
)r	E0
|J
Load
i9E,
+KMS2M
;q
d
2F3b
set_IsClosed
[t{
lxo
shell32.dll
CurrentUser
%8|-
9Of;B
IME_KEYUP
ScreenFactory
yu==
V"nl
<nPxa
Attach
Yy}
get_IsConnected
BeginInvoke
GetValueOrDefault
Orcus.Shared.Compression
dEK4
ProcessId
q
h1
F(YE
TDOT
q;~?
fl%>
$q|2r
i7H/
B:9<\
setRunAsAdminFlag
XsK#
g#~H
Nspd
ICONINFO
p
}pB
gZP-
MQ.!
bG&H
SHGFI_ICONLOCATION
EntryName
_receiveLock
3bOs
get_Entries
?4L
c@T\f
\W:
uJ-g
<IsDataAvailable>k__BackingField
IE+X+
cv;zA
9jc/H
(&wu2
,qjy
QF'K
e@[=j
get_TickCount
gIm=
_U?vx
M,CzDC
<LoadPlugins>b__22_2
)$z
MKgS
5bZC
4E9P
<LoadPlugins>b__22_0
>7v}
Time
fNFFz
^N({@
add_KeyUp
U:[c@
remove_StringDown
dGGu
1/~dM
Object
Orcus.Service.WindowsService.resources
_lastWindowTitle
I% z
qis!
dmYResolution
C:L
;7
4S^p
tks
|!
RBUTTONDOWN
)
27HwfM
\p@
L.jS
FBXq
ExceptionInfo
KeyboardHookStruct
connectionId
w7Ma
<bz:
keyVal
i4x_
'N~s
CDS_TEST
,h"V
caseInsensitive
G+V%
)9]3
h(eW,
E{-y
sw*K
<EntrySalt>k__BackingField
`N/U
ObsoleteAttribute
]|qb'Yr%]
SYSCOMMAND
)~E!
e~OO
Orcus.Commands.ClientAction
F0Y3
(pk
~W
~KM
VS
MethodInfo
>	<7
at!s
(!E
get_ElapsedMilliseconds
Sj>z"]_
1t3:
cPcnz
xs_p{
)2*%
<>7__wrap3
<>7__wrap2
<>7__wrap1
fnr)
zi?OI5
<>7__wrap4
@9AJASAaA|A
AllAccess
_staturl
v.&rH
ResponseByte
q(5Q[6
set_ForceInstallerAdministratorRights
H
y
=Fw5
dsy7
]FJ
/'yt
m:6a
FieldInfo
B'%t
ON~q
I}Jjv
<CommandCollection>k__BackingField
eY	=
040KY
sh(q
<@
}eY{x
'!
Q
<mb7
5ZNM
J2A!M
w|Gx
Exit
3<:W4Gy
get_Bottom
qeo
!
lQ~Y
7x,j
_lastWasDeadKey
System.Text.RegularExpressions
BsC
tgYL
a\WI
Orcus.Commands.Passwords
.ZRT
get_Minute
?!^;
lpMaximumApplicationAddress
r^(P
_0v%b
<PSize>k__BackingField
"$T{
7X9Q8
8*3w:2
Lv>M
3-*5
get_DirectoryName
y"4_
b}O!
p*r`B
set_PublicIp
Kc;
P
(2
GetFreePushFileName
n$tW
costura.microsoft.win32.taskscheduler.dll.zip
s\1T$
RcD3/
?aW#
chEG)
uB;4
s83C
;:(Zmu
Z	!#
Orcus.Shared.DynamicCommands
eWKl
=$zI,$q=
<.\:
<GetAudioDevices>b__4_0
T6GTS
1.}U
wqwu
F'`+
<FrameworkVersion>k__BackingField
5<J<n
<AdministrationConnections>k__BackingField
lparam
hS</d?+z1
commandResult
L&/Y
vr4y
IME_CONTROL
[dVt
>;Z#
LoadPlugin
%DEy
set_AppContext
FJ%6
{cezz
c%9d
M`-(Yu
FormStartPosition
INSTALLSERVICE
GTT
;[`Sa \-
GetValueNames
set_ExternalClockSpeed
6	\X
System.Threading
Fuu
65pK
` g
65:A
o
oD5X
,<:j
$
[*k
AsyncReceive
ZiS
[
UnhandledExceptionEventHandler
3!&
eGlP
STATURL_QUERYFLAG_ISCACHED
set_IsReady
GetDirectories
lQ)s
?u^Ib
e8Cj
1
Nr]^
wohD}U
3=Uz
~b/q
e(S_%C
GetHostName
desktopHandle
sydD
<DatabaseConnection>k__BackingField
0Nfs
'=!`
MMDevice
[G$$
Trigger
[4zo
efgfw
"'i%
^9L9c
_
rM!2
FromHandle
get_Current
>qiv
JMpEk
w^a}
:d.m
9yu7
Task
xm4p
n8=L
% !*
@UfB
get_TotalSeconds
yqG&
fFO$
AsyncOperationManager
r%ZP
N-Oo
OVZf
o=E[O
BlockInput
C0'
`3Ug
j2J6
dwTime
Compress
DoAction
_keyProcessing_StringDown
$/PL
x{^4
#eX9
Next
EndsWith
@W*Z
4Vq]
d;zig
w^M2
set_SelectionColor
DISP_CHANGE_RESTART
*Vsd
(oZ?
SPIF_UPDATEINIFILE
I}i~
!v
^p
5k]Ey
Z%9$&
+6(S
,y|4K
&I;n
get_Objects
[zz
q^y#
t#;(
T{LM
set_Timestamp
dictionary
Fr}T
SynSockets
L1V4
ANUp
VE)c
H[WK"
culture
5kj
Xt z2
sRT{
3p)V
? /
wP:fSEv
5,ry
<'=&
EVENT_OBJECT_NAMECHANGE
4rl
MAKELPARAM
dwOffset
fVo
k|3%
WebcamSettings
S?a87
S`CA\
R+^Nf
N)RH
}9xPi
HX;h
CreateCompatibleDC
L8@\
get_HvncActions
.7px
Ja
~
`9AT0
El_dx
~";	G
?$XN
DeleteTask
get_AutoResetEvent
set_ProxyHost
WH_CALLWNDPROCRET
pa
Rfr|
Fk
5E
get_DesktopName
HY>v
ah~_
&+  N
%rC
qR8O.v
;Xc4
H~Cy)
I7%5'=
OH?
;uD7W
Bg%t
EventLogCommunication
set_DesktopName
&1B6
WriteByte
7m,o
IAsyncResult
FileAttributes
zk^}
sdUJG
U8OF
+e
JY/
TextChatCommunication
Z
}+9
;OxW
GetDelegateForFunctionPointer
^^yD
/bF:h.Pu
pO?C
B|8'
WfC?k
rD5
~#y
nmi&
IcmpFlood
4Z&a
iu@3c1
7dRK
Bq!u
BdFZ
>PH?A{
2N
E
WH_GETMESSAGE
X/@W
childAfter
W|&l
Q|/V
System.Runtime.Serialization
gU,8
(|D=
\]*5
X	Zt
'4<
BiJ6
SHGetFileInfo
J)wDa+G
KeyUp
<>9__22_1
qJfX&3,
o$Z#8
GetProcessById
lpFileTime
`*Fy
RemoveAt
<>9__2_0
;nW'
PushFile
Cug= C
p$B
D
LoadLibrary
:EG]
ResponseResult
NewFrameEventArgs
System.Runtime.InteropServices
RegistryExtensions
MA_NOACTIVATE
soundOut
Jm!x
GetSystemProxy
DRAWCLIPBOARD
r{Wv
<wK}P
Py*2
r
s
}oX78
1T9&
~
[9}$
VSCROLLCLIPBOARD
.d&8@Ab
`t;Sc
Mu!y
h8S
o
&pZ
set_VideoMemoryType
<GlobalSalt>k__BackingField
IaN/
System.Runtime.CompilerServices
cN9'
ioy2
_currentConnectionInfo
[}+W78%
o;S-c
dmICMMethod
WS_OVERLAPPEDWINDOW
SHGetSpecialFolderPath
[9}j
get_BinaryWriter
Li$d
"o?*}
C/A$]
eg$@
,
-
hProcess
(
Q/]]mF
$L$*I
i55
V9Fg
K#1;"&
CTLCOLORBTN
*bs
HECi
-;
=
/+1A
PxlN
j+O
[GYA
dmDuplex
"M;8fhk?2
QNka
l8g
aB[k
7AZ
get_MasterVolumeLevelScalar
&
/*|nm
p
f#,
get_Client
AYP5"v
\XS_
psfi
Hu>l
OperationContractAttribute
UIntPtr
Unprotect
Otn
get_Gender
!O6
CHARTOITEM
CSCore.Codecs.MP3
N=e:
x8uyF
:oP_
Firefox
SECItemLen
EQXP
SNO
&k:!
M6?I
-
EkXB
5}ih
UY,Q
hbmColor
get_ServiceName
#}uQ
od^:
CompressionMode
_floodingJob
X>2-
;BVs
Lt.E
%Tr2UT
i? x
*Wg8
}YQe&D
Q=?gb
Y~8/
set_L2Cache
WMV25
Gc]#!
set_Field1
*rt5
W9-
4K~DFJ
:dq
0`&Q
o%Z,
scrollDown
.Fdg"
<%N
MaxWaitTime
pszContainer
=v,R
c6u\N
STATURLEnumerator
/&>,&
MENURBUTTONUP
redirectPackage
!sGgic
RQZ`
Asn1DerObject
;$%$
yd3*
get_Hour
wstrUrl
8j,G
[)A
get_Parent
4
UnauthorizedAccessException
Y"_g
DriveType
YuVW
zA?
a78i
.4)_
q}6S
RPUA}
o4z1
m.TJJ|
e.ws
AccessMasks
ProcessWindowStyle
Milliseconds
RemoveAllDependencies
ChannelFactory`1
XX2
Qe]g
wN~y
P-~`
&z`M|X'
|k)\
HTSIZEFIRST
54xc
$JzQ
~7!u?
y/KB
%K*B
1(:3
GetHostEntry
_videoCaptureDevice_NewFrame
J]5	bA&
uu>[
CALG_SHA1
QUERYNEWPALETTE
System.Net.Sockets
CspParameters
Ee,[
$kEY
xp"G
B#Cp
C:l*
D
5"
MessageTextBox_TextChanged
*0r4
TPiRA
GetAncestor
SendingType
uF|WHc
3i'e
|	<c
$y+9"l[lg
vY\J
c9
XOl"
Sx=,
4@[=
POINTAPI
set_BitsPerPixel
3lS9
7.|s
s~ZrA
: H
point
YC
G
Xw%}
6+O
set_BootMode
DISP_CHANGE_BADMODE
fCreate
get_Passwords
ToCharArray
`O:[
mZ;#
get_IsDataAvailable
KZi'
Unload
gnnhxCL
_U
t0"T|
<IsCancellationRequested>k__BackingField
GetResponseStream
u\|H
b~L
arySrc
v~("Z
cYj
Encoding
httprealm
HTOBJECT
[U%(
E
>NG
8DaY
N4Wi@k
VideoInputDevice
get_TotalMilliseconds
MENUCHAR
-J6H
IEnumerable`1
!]&MI
<EntryType>k__BackingField
set_Port
Z*&T
(n|1
QWL5
GW_OWNER
get_ToolBase
CryptographicException
mB}K
AesDecryptor
C&h7
09|1
System.Security.Authentication
L_dn:)
!KHJ
set_LoadablePlugins
c {c4
9V%K
8@-[
-Qj@
elk\
set_ClientVersion
dS_b
,	)h^.
\P[C
J5_Y
S <)
<>c__DisplayClass13_0
a
6Q{m
}]_7
!wA
8
~	#~
gT{Y
w~ZIJvVNnZ^
lz>:?I
FromHbitmap
;BnBo
set_SmoothingMode
6DIS
get_Directory
cb=}
keyDown
Zero
rNWm
>?%q#Y
<|lo
ZM3pg
TimeHelper
/9fQ
<FL4A
*QbM{
PaMA
H9F)
KeyboardLayout
,Rf,
M_x3D
z#IG
WH_DEBUG
hLD^
/n;'
remove_FileTransferCompleted
_length
PLUGINS
CryptCreateHash
<SetMemoryInformation>b__1_2
>'Q
L"h,
j.xz
yY]O
>`|~
ServicePipe
MA_NOACTIVATEANDEAT
4r'y'i
CLOSE
<>9__10_1
set_Value
Commands
Orcus.Shared.Commands.TextChat
<>3__registryKey
!0R
KeyEventArgs
EnumWindows
tS~)
System.Collections.Generic
wBx5
&o@
tnSV
+#Po
/n;R
#`}EB
y58
~$x3
Orcus.Commands.Code
zn2I2
!6sK
\?[B{7
w\pG
`-}\0MUa
fYTj
G_Y>m
ygwqe
SC_MOVE
<Message>k__BackingField
MDIREFRESHMENU
gLYC:
:t7Az
e|vn
set_CurrentCulture
:!^P
g
q2
Data4
dA~qe~!
Data1
Data3
Data2
get_ModuleName
Save
set_Voices
MouseEvent
RegistryValueDWord
get_PixelFormat
]P3c
set_ProxyOption
Rotate
)
Ka%]o
*6U++
w|AgY
oLf'
SUW2
+9sM
JN7fUs
yhM-Jk
serverConnection
7j!:
XmlNodeList
qkoX?F0
<>9__10_0
AppendText
MOUSELEAVE
y#$Q
LpT^
c\Hb
~k5?
~}'8
OnClosed
TABLET_LAST
Za2
P1\!
'=T$=
ckq]