Sample details: 82a602c8f6c804f5f390ee094564bd7b --

Hashes
MD5: 82a602c8f6c804f5f390ee094564bd7b
SHA1: efa568f9aab8b688a03a59484735eedd67372ef9
SHA256: 5abc230221c54fff85631aa479bd7223fe363b203945d066a16ad5e30c717640
SSDEEP: 24576:opS04YNEMuExDiU6E5R9s8xY/2l/dot1Ibt+re:oL4auS+UjfU2TorIbt+r
Details
File Type: PE32
Yara Hits
CuckooSandbox/vmdetect | YRP/Microsoft_Visual_Studio_NET | YRP/Microsoft_Visual_C_v70_Basic_NET_additional | YRP/Microsoft_Visual_C_Basic_NET | YRP/Microsoft_Visual_Studio_NET_additional | YRP/Microsoft_Visual_C_v70_Basic_NET | YRP/NET_executable_ | YRP/NET_executable | YRP/NETexecutableMicrosoft | YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/System_Tools | YRP/VM_Generic_Detection | YRP/VMWare_Detection | YRP/Dropper_Strings | YRP/WMI_strings | YRP/Misc_Suspicious_Strings | YRP/vmdetect | YRP/WMI_VM_Detect | YRP/network_dns | YRP/screenshot | YRP/keylogger | YRP/win_hook | YRP/Big_Numbers1 | YRP/Advapi_Hash_API | YRP/CAP_HookExKeylogger |
Source
http://vrvid.ru/rat.exe
http://vrvid.ru/rat.exe
Strings
		!This program cannot be run in DOS mode.
`.rsrc
@.reloc
#ffffff
	`,Lrd+
#ffffff
#ffffff
#333333
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
IconData
IconSize
System.Drawing.Size
System.Drawing.Size
height
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v2.0.50727
#Strings
<>9__11_0
<GetSecurityEventLog>b__11_0
LinkedListNode`1
IEnumerable`1
IEnumerator`1
LinkedList`1
Microsoft.Win32
UInt32
Func`2
KeyValuePair`2
IDictionary`2
UInt64
<Module>
get_EventID
System.IO
value__
mscorlib
System.Collections.Generic
get_EventId
set_EventId
Thread
get_TimeGenerated
<EventId>k__BackingField
<ValueKind>k__BackingField
<Source>k__BackingField
<Message>k__BackingField
<Name>k__BackingField
<EntryType>k__BackingField
<Value>k__BackingField
<RegistryValue>k__BackingField
<RegistryHive>k__BackingField
<Path>k__BackingField
<Timestamp>k__BackingField
<RegistryValueTypes>k__BackingField
<Values>k__BackingField
<RegistrySubKeys>k__BackingField
<ValueObject>k__BackingField
<Key>k__BackingField
<IsEmpty>k__BackingField
get_ValueKind
GetValueKind
RegistryValueKind
RegistryValueDWord
RegistryValueQWord
set_Password
Orcus.Service
WindowsService
get_Source
set_Source
ServiceStartMode
DeleteSubKeyTree
RegistryCreateValuePackage
RegistryValuesPackage
RegistrySubKeysPackage
get_Message
set_Message
IEnumerable
IDisposable
RuntimeTypeHandle
GetTypeFromHandle
DeleteFile
WriteFile
get_Name
set_Name
set_ServiceName
get_TwoLetterISOLanguageName
fileName
set_DisplayName
set_Username
DateTime
LocalMachine
IServicePipe
OfType
set_StartType
get_EntryType
set_EntryType
EventLogEntryType
Orcus.Service.Core
System.Core
get_InstalledUICulture
get_Culture
set_Culture
resourceCulture
ServiceBase
Dispose
EditorBrowsableState
Delete
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
KnownTypeAttribute
AssemblyTrademarkAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
RunInstallerAttribute
CompilationRelaxationsAttribute
ServiceContractAttribute
OperationContractAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
get_Value
set_Value
CreateValue
DeleteValue
GetValue
SetValue
get_RegistryValue
set_RegistryValue
registryValue
get_RegistryHive
set_RegistryHive
registryHive
IsAlive
Orcus.Service.Native
get_UserInteractive
Orcus.Service.exe
set_MaxReceivedMessageSize
set_MaxBufferPoolSize
set_MaxBufferSize
CurrentConfig
System.Threading
NetNamedPipeBinding
RegistryValueExpandString
RegistryValueString
RegistryValueMultiString
GetCultureDependentString
disposing
Orcus.Shared.Commands.EventLog
GetSecurityEventLog
get_Path
set_Path
GetPath
RegistryKeyPermissionCheck
System.ServiceModel
System.ComponentModel
System.Configuration.Install
user32.dll
Program
get_Item
System
resourceMan
TimeSpan
get_Location
System.Globalization
System.Runtime.Serialization
RegistrySubKeyAction
System.Reflection
InstallerCollection
EventLogEntryCollection
collection
ArgumentOutOfRangeException
ArgumentNullException
System.ServiceModel.Description
set_Description
RegistryValueUnknown
CultureInfo
get_Timestamp
set_Timestamp
OnStop
System.Linq
get_ResourceManager
System.CodeDom.Compiler
WindowsServiceInstaller
ServiceProcessInstaller
IContainer
InstallHelper
CurrentUser
IEnumerator
GetEnumerator
.cctor
System.Diagnostics
FromSeconds
seconds
NativeMethods
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
Orcus.Service.WindowsService.resources
Orcus.Service.Properties.Resources.resources
DebuggingModes
get_Entries
Orcus.Service.Properties
_translatedNames
GetValueNames
GetSubKeyNames
get_RegistryValueTypes
get_Values
set_Values
GetRegistryValues
System.ServiceModel.Channels
Orcus.Service.Extensions
LinqExtensions
RegistryExtensions
System.Collections
_translatedDescriptions
get_Installers
ManagedInstallerClass
System.ServiceProcess
StartProcess
arguments
components
get_RegistrySubKeys
set_RegistrySubKeys
GetRegistrySubKeys
fBlockIt
Concat
get_ValueObject
CommunicationObject
Select
Environment
InitializeComponent
get_Current
content
AddServiceEndpoint
get_Count
entryCount
set_Account
ServiceAccount
ClassesRoot
OnStart
AddLast
TakeLast
ToList
ServiceHost
RemoveFirst
BlockInput
BlockUserInput
MoveNext
WriteAllText
get_Key
set_Key
CreateSubKey
DeleteSubKey
OpenSubKey
RegistrySubKey
ContainsKey
RegistryKey
get_Assembly
GetExecutingAssembly
GetEntryAssembly
RegistryValueBinary
dictionary
EventLogEntry
Orcus.Shared.Commands.Registry
OpenRegistry
op_Equality
get_IsEmpty
set_IsEmpty
WrapNonExceptionThrows
Windows Input
	Microsoft
WindowsInput
Copyright 
 Microsoft 2016
$2a34f2e9-77ee-48fe-9315-979980e6fbeb
2Orcus.Shared.Commands.Registry.RegistryValueBinary
1Orcus.Shared.Commands.Registry.RegistryValueDWord
8Orcus.Shared.Commands.Registry.RegistryValueExpandString
7Orcus.Shared.Commands.Registry.RegistryValueMultiString
1Orcus.Shared.Commands.Registry.RegistryValueQWord
2Orcus.Shared.Commands.Registry.RegistryValueString
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
RSDSy4
D:\Dokumente\Visual Studio 2015\Projects\Orcus\MainSource\Features\Orcus.Service\obj\Release\Orcus.Service.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
2&6A1A
.d&8@Ab
!Y]aJN
=QpUspys
hOm8C]s
$Se"A8
U[_hP(f
LT>[*Y
+1.w75
6j)g')`U
;kC]u8
P@$4P=G
)cN(COE
RLC+(Ci
m{-0_|
J4nSZ`
oH]>#$
O|u{`y
qR8O.v
EYS"a+
\?[B{7
;:(Zmu
aF6'd0o
b\qY/[
<RTE==x:
CHc?-3
~cYEEA
'Yz~["
7Z/\nt+
QKcF}o
>i|z9a
q(5Q[6
J)wDa+G
hL'b:	
-r)(hGh]k
XC)$0;
@RhIJBH
LQ+([7
l&n?w(
OWQ-b>
bb86)b
gdjbjp
z$v0a3
hV'Iqw
>Z*?W\
7gE^.(S
e+g697
rLDboL
t$(U)4
+sEkAR
$s -(yT&
4{.X^&SZ
w&hbr=
@FJ,	D
9b_@8r
',aFo^j"
[#8X-F
F|s2hk
DnX0kNYp
	vMAL1
<P^\CQ
otP.pFU
<voc@V
}>Ui{UU
KldmjP
[8uNW+?h
1<qd0q
Pb\7&rp
LFvv.1
<9{cGZ
meOWS[wokS
O%rD%G
-#1,@[
y@?v7F
bPM}10u
&G<RWK
'oWvaA
x]a"Jn
aOR=c=
gBUf\U
lD$A;="
B$~L$~
xWxxc!<
rX7:u.
e%UMj8
;'PJ"-
stFw+y{]
Jnt/Dg
RHtI!$
e(S_%C
q4=/D=
<j?Rp[}
h5zvw5v
"kQp>u
vBNqe(
oC2ErV
fpj0-#
pB4`Op
I5tWUU
T,srR~
i*P[2P
,scbjt
r=!RZD?4E
D+$kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG%kG$kG$k
J%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'K%'I%'I%
(p0/8H
qJfX&3,
x2sY,y|
&%+MJV
`hAfhAfhAfhAfhAfhAfhAfh
fITBNx0Fiv
n4hhn[
AZ?#(hU
mXgg3~
&)U'B^
rkr$t0
?9OAV6b#
J:gp/!
$sB)?J
<#Dgxy{
JnQK(O6\
L]R[C~}
`@`v{1
)^g~%0
:lwiSr
GNdB|N
yloi).=
xHZTu^
sFc_2c
{&zFQs
GMs|tuL%
=wWDU:
MZ6X/A
wJ_4=K
@0Wv(o
<E!@7So#
&b*!$|
p]1=\p
zf*Z<X
QbZL$L2h
<45yhR
OW~bel
53q6\k
>Q)\@z
'GinvI7
!M#2M#"M
TC?m&s~2
>heJuo
T5b9Q(
LOLUQG
2*UJfZ
' ZAF,WQ
=]@7@0Y
2-njx'N
3Db\9&#
) M~O!
%eJdoZ
k IjJ<
;XB]Ekxiz;f.
}?KnAN
}?KnaN
BnYP\`]
LTF^5]
I.Drvw
X?- n-
n	C;yH
hS</d?+z1
8(7KXy
Bp&#Z'
NMSEM;
iThTt8!
F::ttt
J0lGCo{/
zNtle2
}\trG^]^8 z
iM=8uTS
y#3@?6
qIpkU@ 
7\aA<b
dFos+|b
gOeK3\6Vm
Xgqma}
wXJov]
} C^q%Ay7
&$x?0*P
BP5,;FT
5ERs$u
RSQTME
yhM-Jk
]T+ u_
O<#~v}z
1N;wI=
SUL69*
Q%_$';]
j>wxn]
1s)fyy
[}+W78%
7`n_f1
z*qm~)
{R'>_>
M,CzDC
>~>nZG
_E,A|NT
]3QN@]
<41}yG
'C'!}$t
+/@O"] W]Y*
k=^|I:;
p<"=%oM#
iu@3c1
{776 }[
)Z_4*B
x^5"<t
NznX53
T0TTTTTTTT,2,4TJTLT2LJ4*,*4TJ*2L**,,2*|%%
|hOx~S
?H.Gkk
7W.BOx
Dq{[d6[
J#zu:;
d)Q`}a
_v?0}P
*Y/@{?C
:ZMDw>L
Sj>z"]_
YW}^qO
+b}.h)W\
<),Hol
Wr_"p<'
wc3I 7
^"	P^_|
=S~N<^
uB<_=f
jA'QOY
>iV6X?L
|UZVCbZYYq
DI?}~>
w*K^g}Nz
IL]+iY
{?^l?u
3{gz{9
by&R9d
rdQ9rU
}BBDj"
Ec:Zt:
q%/4NO	b3
"r9+,iq9s
*"/"?b6
mD;1;B
lr]rSr
90;<{o
26q=c'/C}
AzPU`+
x|s?8'
):x*h?
m$x?ps
Ow93P6
7^2^4^
gjz,=S1-
,VX|l*
P.	Fd4R
@5nZ4<b
dKy<od
2k,WF#
4=#kt@
~T>!mn
":*c)7
>*v7S|qVn
M{c$ZW
#VMe--]
0lKOus
8)'kn]x
\;t&Q]
=x+<x+
|eROCI@
m.V"es|
;ZjUY^r/
%Tr2UT
h<-J_&Q
EO5IGi=]x
Uiq:1;
]|qb'Yr%]
02cfqu
B+<%2D
_Vrv<en
$3bRwO
*WmUK~>
!,``4L
=PLe=d
r{{=4r
	S|%=U
VAaE}/
Ak*]pJ
X&cIA<
tT|iI	i
$^)l1?
SG,sIWDZ
o-mo#Km+
;9h|uNX
=+nnnl
8EKfdy
vzd:%vS-
.J#hl\
H*gh=D
Y /qG6Dj
y4w[(>.
},1tR	
wNjf"T
27HwfM
$2w/vG
:Y:czd"
\}%(vS
RdxlVm
Bc\)IR
}}]'a7q
bdV/z6(
x6`\	u
|:zAts
!Y&@=,
R!wj4f
D9,5lZ
TK5UCM
*4N~]UHY
hngdu6h
Oq7udzT%X
#`q$.4
,	)h^.
R,SI+D
R(=jiWf
T%Z=mS:
B:(n)>k
FaNIq+
=3=ZH>y
CG[-6w
zi?OI5
JkVZai
v,3j[-BL
Zz4V<wZ
`-}\0MUa
'aN=!|n
E541>~
'~2tad
62zuHr|	rO
PJ0>:	]
BvAw0FI
6FN\-?
yOezJo
yN	&FE
uPSRXf
>F	O Y
QBi.)-v*)
|>WZ R4_
jK/YU"uf
\Q/U+f
>#*ugT
,T:iwk~
fTr7U7
?bk}uJ
yJ]D--
$y+9"l[lg
-!%D*NI
{&gGm|^
J<L]Uf
d[e>#2
^Yj::+s
lpT,|Gg
7<	kpyR(mh
	Z%9$&
$r)uBu-7
srZ~^~A
tNLE/p
rjo}}j
"M;8fhk?2
!R*GJ'I
EtsCdh
Cug= C
HSK.$Z
umGg_S
T5c<Qp"(QAt
r}b-\'
?3]YB9
@,b8=~
UN%ouV
$VzT:;
l|(g]G
jf<YX5
z*lp;(8t-
^f`)(,
P_qOU38
x#|/"_
x%+<@X
Z.RJzw"s8P
_y^!U*
M`-(Yu
,#<Jd~
>T-,=5
|r>Uj7,siX
p7on0L
u^nHL	f
>t.8k!J
wohD}U
w+YH\4h
`EJ_{/!k
[	S5H3o
5ixqT3T-^
DSw.#<K
|]TA?F
o)5kj$Ov
uF|WHc
B5h_UK
g]&M-8Q
/bF:h.Pu
}q{ -`
/JuG'z
Ym1}`n$
jU>49qKG
HnP7.M
<Ac%-]
	!$wQX
77,wxXn ,
6,7qJ8n
UtaYm!
j'KE3F
{QtB\2K
M`)xE12
G $&}I
=,Oq;]
L]HrF83B$I
"/MADDds
<AiE6u
q#mJ/V
!rA+	PC
4gh4	v
2.uI/?
zhiXbo
(BwJTE
:!Ci"t
|;,Qk7
JN7fUs
}s(hJ>
adnOnz
/+@gx!
lpqzdClV0
6SZ6SZ6SZ6[
j}O.3[
0ml[f0L
Y[#(u<
n![r(:Y
5,Ey.'M	m9
*wJ4g[
2jH0':)
kiind*
*s-?G\
Qb3_">
wP:fSEv
eUDW^f
iHFg?7
.[{V}yM
=emwJ5
d+Zt]v
V"dm%We
!Je(K	{
$(7-:L#C6
&$itoM
_C]k=u
<B#xrl
$O4QX~
<%[K#xJV
<7Z[#xnT
s8Uv;Lh
aj4pbG
q)PcNCB
EkmT;J
BMToN3
@KkwD$
.Xy>"C-g$]
c@bTDcF
~eRBy4
gDZjl)bVM
>PH?A{
4r,&G1I=
4r,&G19 ~<
Qol"m^
c,Uo*Op
MvERU\
q.#i~#
8(]C~ 
:@d>:B
4K~DFJ
%2NjOd
=K/XNY
"W>/a^|*,
)=iJoK
*E\{X%
B*!>ee
k!{ {!7@n
G G Ga{
z(t:ddb}z&
I7%5'=
<yIrur 9
Al1R-eC
Q.diJ%
2{RGi"
/G_H#D
"x#PeW)/
V Vpm3
@xHK_p7
H04seee
"!_`5/?
:aIdQE
MC3;:4
&f,d3g
GDvtDd
dA~qe~!
;:>KJc
+q1qFd
zK>sdy
fL*##=
lEl)hft
VYGtUy
	A|wC +e
m.TJJ|
\uml<o
2IR[~Z
{8:Du\0'D
=37%h}
=jJ_B{f9S^g
l]p+)<
r49gWV
,/D>vEK
N4Wi@k
=P5@QmP
~R}RET
GmQ2b#
NY)S 2
.p7J#eQ.
4o9^b4A
vn=}\=
>gI:l|
bLj/%kx
3<:W4Gy
5oi0?Xf,
w2}RG\
l:l/7-
J6tP3P
}Z-w&@
fV CIZq
p`8H9t
kBY!3d
p0t8|[
VT*-+c
Bc=Tyz
OR$598
?OH"z4S
Jjb87:
~r(|~)
1818q8	8
Sp^D9/Q
pl!85M,6
e{U*;.Qo
+KMS2M
(K~z-YgV
Q/]]mF
ree:_H
9z'Y\)
\|efvj
Q]iN\*U&
J@l 0a
lz>:?I
R6N=?C
T&:;7?
~fr~:>
b!1K3*3577
LeTh,#
cCL#[2
.wPc?U
}YQe&D
^9%uZK
>g"_g<
DvG|h]
Cs@8^;
L:hU3<R
MF,B]|
P_6't 
%l.6D@
j/Dg	n&h
GN$_:b
4r'y'i
/acEz'O`
@n$:S4
xZqvtAr
bGNalCPA
sEIVk?
4(p^J>R
hRh0O3(
Re4ZhJg
,#A_\fP
YgRkUDnR
ElolxF
FbFK$c
5O`,e'
yaWb>h(
l\!</p5Z^$C
#K"6O~
VV]z|x
PmRhl"
Wp*++r
VvIiy!
O{Yn<?
ww~}6n
WBy)$(!A
t[LdhZ
azhF+O
M/_zo'
}6GmtQ
	NKr87
!^7n(0
M5f~# N
rNF:lN
/+M.*B
9Of;B	
"83ByHw
+uMr]5{k
vm,=ShIH
-QQVo$
\|.7:9
P*'Nv[
S^,KfM
; DQ0iN
UVF$)k|)
Y)`h2O9
RxJ	OIa
]RxY	/Ka
;-C}^C
W!hb,fhjD
:A{c/C
x.scpp5
RxC	oH
n/?07&7
J!N	qR
d%$K!E	)R
J!M	iRHWB
;L$rGhw<Eb
g	o<Z+
|Cc\Ax
U}p[XR
J!N	qR
zJ!G	9R
()D+!Z
)TVBe)x
-lu@Xi
9z>~<x
AqOdk3
"[[.=}
#=k?x6
(,Yx8W*
Xx~x"fpS
!sGgic
[Gk::"\
r,<E[=s
x+7gqY
h#m#qJn>OM
Xl1;<bW;:y
\t,fd.:
<1iVZ+:-5
#fk5uEZ;
PV6>}zL
|d7e5W
IAtd]U
*OAtFy
Z%vza:
\4G= vr]:
ug1G/'
FwHg]7
9}j_d%^
^Cb#Gr"
Tm^4'v$
7;0Wa=-5W
'#BOp2f:
3]q72s
lfvI63;
8*3w:2
aFocF'1
K#1;"&
"!.l""
Ouo~|)
q]sG [l
|}0wtj'
A@[]e}@
+;%~T{
A6NV7K
]zy~i)W
Y16IL$_
c7%1.~
9ZBezVc8
a^HWbX
ud\U!6
;sN>S*8
b y}^p
JM;Hcd
0xd=Vb4
>?%q#Y
- [|P)6
#\K.cz
zRoN~X
|':_VK
#f9]ay<
weCzSv
f^{s|K
(5f>n`
M$SC#w
AYP5"v
	ZJm(V
_@"Ud>
Qe='8ZF
+xNP,;
d]T/+T
-%jX#\
y:OEf?_
PYD:%Z
@3w-[1HV
MDm(lA
qpykyM
LhlfRS
1c)J'4
PX.yXS
7<C%2Z7
WRrEsC
I@Eo;g
`M;jCC
"|Z.}	
4I"!X|S
ggn8wQ
g2CS]2
N_)Y!i
gnnhxCL
[!E#]\r8]
~QBOx5:
a8j;iG
>bBZJ/
;dx_59
8qD@25
^>b%kz+
'^6YM)
W[Lp>f
KtP%I"[
_vfv5sG
cLdp-#B
cjOrB0
:`2-cXR>l
L_dn:)
)<MQtF
^g)e?!=?J
.ag<}Bx
{(fin]
@/hMO`k
K$ZZGs
	&a.%3
//X\5}
#wR2wX
P~]_0 
X#WBz_Z
o|rWZ0P
4D0R3o
Dk^{H;~
@zJtL	
qkoX?F0
?=j^OY
KGu%KS
p?qMSL
c7I"G|
-+0A#KI
^F2@Rr`
 Dd ;0
gA>D	b
0MEf@2
;vtJ'@
L4ZRaE
H>HE$2
0PYx&a
:!2u'"L
itxBk6
:202Pw
URO<Y!
nD%2SR
=$zI,$q=
$ZHxHt
sQY&s}
^c>{ok
[/y4#w
8SS{e5
r~Sx]O
^J0$&H
So|9S9
fuq~{aGUR
o?L:RZS
5UK)-B]
u [v#]
Y9~jVN
}pnchM>
vGQIxY#
>Fy)$	^
T\5i6!+T
h(-c0W
BESn"4
fxsmF6W
P!l0E%
;9E<OTD
Z usvD
Hr|"YE
w~ZIJvVNnZ^
dV@NFj#
;[`Sa \-
h@:h3@
J]5	bA&
{42]vD
ZKAf5P
)~]Gm{
,zb.>q
&z`M|X'
j,7:t&
.Z6-?s
mhvnry@
{=z<~b
G3bfd[
|;Q|U^
M8?UkR
R?^gz$[
;9guRdQ
*'iZ5G
;,&wp @W
6N^B(-"
l]'bye
K.Dl\`
Ep	8kM
!&=U\	
wI1i 8 
	-,5#|CjC
]"ouV@
ZOEkxq
hKGo[Sco[g
KAcww4
ib7yGK/
D J`,=
W%"czW$
HJo944J
	lK&H7
Tlp"CC0H
DRs"myP
0V5=#h
zq}''P
SwbK3($
3)+#Yk
%h#/+C
$[yW,=
v2.0.50727
#Strings
yA!q	+
Y	9|'%
 R!]!~!
& 'B'I'h'
-4.E.Y.r.{.
0_0l0{0
7F7^7n7
9[:a:z:
;?;T;|;
DJD\D`D
D&E<EJE
M(N?NVN
P+PIPYP
#)#9$a$|$
&I(R(e(u(
)I*^*y*Y,
/D0K051k1w1&232<2
3,5f6,7
@9AJASAaA|A
I:IAIZI
L6LWLlLuL
N3O<OWOyO
Orcus.exe
mscorlib
System.Core
System.Windows.Forms
System
Orcus.Plugins
Orcus.Shared
System.Management
System.Drawing
System.ServiceModel
System.ServiceProcess
Microsoft.Win32.TaskScheduler
starksoft.aspen
Orcus.Shared.Utilities
AForge.Video.DirectShow
AForge.Video
System.Speech
System.ServiceModel.Web
System.Xml
CSCore
System.Web.Extensions
System.Security
System.Runtime.Serialization
User32.dll
user32.dll
gdi32.dll
kernel32
kernel32.dll
iphlpapi.dll
user32
shell32.dll
advapi32.dll
msvcrt.dll
Kernel32.dll
shlwapi.dll
Orcus.Commands.TextChat.TextChatForm.resources
Orcus.MainForm.resources
Orcus.Properties.Resources.resources
costura.aforge.video.directshow.dll.zip
costura.aforge.video.dll.zip
costura.cscore.dll.zip
costura.microsoft.win32.taskscheduler.dll.zip
costura.orcus.plugins.dll.zip
costura.orcus.shared.dll.zip
costura.orcus.shared.utilities.dll.zip
costura.starksoft.aspen.dll.zip
<Module>
.cctor
MainForm
_client
components
IContainer
System.ComponentModel
label1
label2
KillButton
Button
UninstallButton
ConnectedLabel
label3
CancelEventHandler
add_Closing
EventHandler
client
Form1_Closing
CancelEventArgs
sender
MethodInvoker
Control
Invoke
Delegate
_client_Disconnected
EventArgs
IPEndPoint
System.Net
TcpClient
System.Net.Sockets
get_Client
Socket
get_RemoteEndPoint
EndPoint
get_Address
IPAddress
get_Port
String
Format
set_Text
get_DarkGreen
set_ForeColor
Connected
get_DarkRed
Disconnected
_client_Connected
KillButton_Click
FileExtensions
GetFreeTempFileName
System.IO
SetAttributes
FileAttributes
WriteAllText
ProcessStartInfo
System.Diagnostics
set_WindowStyle
ProcessWindowStyle
Process
UninstallButton_Click
IDisposable
Dispose
disposing
SuspendLayout
set_AutoSize
set_Location
set_Name
set_Size
set_TabIndex
FontStyle
GraphicsUnit
set_Font
ButtonBase
set_UseVisualStyleBackColor
add_Click
ContainerControl
set_AutoScaleDimensions
set_AutoScaleMode
AutoScaleMode
get_White
set_BackColor
set_ClientSize
get_Controls
ControlCollection
set_FormBorderStyle
FormBorderStyle
set_MaximizeBox
set_MinimizeBox
set_StartPosition
FormStartPosition
ResumeLayout
PerformLayout
InitializeComponent
<_client_Connected>b__6_0
CompilerGeneratedAttribute
System.Runtime.CompilerServices
Program
Object
Version
AdministrationApiVersion
ServerApiVersion
CurrentFrameworkVersion
System.Threading
<AppContext>k__BackingField
get_AppContext
set_AppContext
Exception
List`1
System.Collections.Generic
Enumerator
ClientController
FileInfo
ILoadable
Enumerable
System.Linq
Contains
IEnumerable`1
Thread
TimeSpan
WaitHandle
WaitOne
ToString
MessageBox
DialogResult
Application
EnableVisualStyles
SetCompatibleTextRenderingDefault
SetUnhandledExceptionMode
UnhandledExceptionMode
AppDomain
get_CurrentDomain
UnhandledExceptionEventHandler
add_UnhandledException
ThreadExceptionEventHandler
add_ThreadException
get_CurrentThread
CultureInfo
System.Globalization
set_CurrentCulture
IsNullOrEmpty
Environment
Debugger
get_IsAttached
ExpandEnvironmentVariables
Equals
StringComparison
GetEnumerator
get_Current
InfluenceStartup
IClientStartup
GetType
Concat
MoveNext
GetCurrentProcess
get_MainModule
ProcessModule
get_FileName
set_Verb
set_Arguments
FileSystemInfo
get_FullName
Install
ThreadStart
set_IsBackground
ApplicationContext
STAThreadAttribute
Unload
ExitThread
AppContext
<>9__12_0
<>9__12_1
<>9__12_2
UnhandledExceptionEventArgs
get_ExceptionObject
Restart
<Main>b__12_0
ThreadExceptionEventArgs
get_Exception
<Main>b__12_1
eventArgs
<Main>b__12_2
OrcusApplicationContext
_unloadLock
_unloaded
<KeyLoggerService>k__BackingField
<AsyncOperation>k__BackingField
AsyncOperation
IFactoryClientCommand
add_Idle
get_Factory
PluginFactory
Initialize
IDatabaseConnection
add_ApplicationExit
get_KeyLoggerService
get_AsyncOperation
set_AsyncOperation
NotifyIcon
SystemIcons
get_Shield
set_Icon
set_Visible
add_DoubleClick
ShowWindow
ClientOnConnected
Serializer
Orcus.Shared.NetSerializer
ExceptionInfo
Orcus.Shared.Commands.ExceptionHandling
GetTypeFromHandle
RuntimeTypeHandle
Serialize
Current_ExceptionsAvailable
Monitor
Shutdown
Application_ApplicationExit
AsyncOperationManager
CreateOperation
ApplicationOnIdle
KeyLoggerService
<>c__DisplayClass11_0
window
<>4__this
<>9__1
Activate
<ShowWindow>b__0
<ShowWindow>b__1
AppConfigWriter
Orcus.Utilities
FileContent
get_DirectoryName
get_Name
Combine
WriteAppConfig
executableFile
CsvWriter
_streamWriter
StreamWriter
<ReplaceCarriageReturnsAndLineFeedsFromFieldValues>k__BackingField
<CarriageReturnAndLineFeedReplacement>k__BackingField
get_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
set_ReplaceCarriageReturnsAndLineFeedsFromFieldValues
get_CarriageReturnAndLineFeedReplacement
set_CarriageReturnAndLineFeedReplacement
TextWriter
WriteCsv
CsvFile
Orcus.Shared.Csv
csvFile
filePath
Exists
Delete
Encoding
System.Text
get_Default
encoding
Stream
stream
set_Position
CsvRecord
Headers
get_Count
Records
CsvRecords
Fields
WriteToStream
writer
IList`1
get_Item
Replace
ICollection`1
WriteLine
WriteRecord
fields
ReplaceCarriageReturnsAndLineFeedsFromFieldValues
CarriageReturnAndLineFeedReplacement
ErrorReporter
_instance
_errorFile
_fileLock
<IsDataAvailable>k__BackingField
ExceptionsAvailable
get_IsDataAvailable
set_IsDataAvailable
Interlocked
CompareExchange
add_ExceptionsAvailable
Remove
remove_ExceptionsAvailable
StringBuilder
ReflectionTypeLoadException
System.Reflection
get_StackTrace
AppendLine
get_LoaderExceptions
Func`3
Aggregate
GetExceptionStackTrace
exception
ManagementObjectSearcher
FileStream
get_Message
set_Message
set_StackTrace
set_ErrorType
DateTime
get_Now
set_Timestamp
GetTotalMemory
set_ProcessMemory
set_IsServiceRunning
set_IsAdministrator
set_ProcessPath
set_Is64BitSystem
set_Is64BitProcess
get_Version
set_RuntimeVersion
set_State
set_ClientVersion
set_TotalMemory
set_AvailableMemory
ManagementObjectCollection
OfType
IEnumerable
System.Collections
ManagementObject
FirstOrDefault
ManagementBaseObject
set_OsName
get_OsName
get_OSVersion
OperatingSystem
GetDirectoryName
Directory
CreateDirectory
DirectoryInfo
FileMode
FileAccess
Convert
ToBase64String
ReportError
StreamReader
TextReader
ReadLine
FromBase64String
Deserialize
get_EndOfStream
GetData
get_Exists
ExceptionSent
Current
IsDataAvailable
<>c__DisplayClass13_0
<GetExceptionStackTrace>b__0
builder
exception1
NotepadHelper
WaitForInputIdle
get_MainWindowHandle
IntPtr
ShowMessage
message
ProcessExtensions
GetProcesses
op_Equality
GetProcessByFilename
fileName
ProxyHelper
RegistryKey
Microsoft.Win32
Registry
CurrentUser
OpenSubKey
GetValue
StartsWith
GetSystemProxy
ipAddress
ScreenHelper
Screen
Bitmap
Rectangle
Graphics
ImageAttributes
System.Drawing.Imaging
get_PrimaryScreen
get_Bounds
get_Width
get_Height
PixelFormat
FromImage
get_Size
CopyFromScreen
CopyPixelOperation
set_CompositingMode
CompositingMode
System.Drawing.Drawing2D
set_CompositingQuality
CompositingQuality
set_InterpolationMode
InterpolationMode
set_SmoothingMode
SmoothingMode
set_PixelOffsetMode
PixelOffsetMode
SetWrapMode
WrapMode
DrawImage
TakeScreenshot
_isAdministrator
Nullable`1
get_HasValue
get_Value
GetValueOrDefault
get_IsAdministrator
WindowsIdentity
System.Security.Principal
GetCurrent
WindowsPrincipal
IsInRole
WindowsBuiltInRole
UnauthorizedAccessException
IsUserAdministrator
IsAdministrator
ActiveWindowChangedEventArgs
Orcus.Utilities.KeyLogger
<Title>k__BackingField
get_Title
ActiveWindowHook
_hookDelegate
_hookHandleTitleChange
_hookHandleWinChange
_lastWindowTitle
ActiveWindowChanged
EventHandler`1
WINEVENT_OUTOFCONTEXT
EVENT_SYSTEM_FOREGROUND
EVENT_OBJECT_NAMECHANGE
Marshal
System.Runtime.InteropServices
GetLastWin32Error
Win32Exception
SuppressFinalize
op_Inequality
Finalize
add_ActiveWindowChanged
remove_ActiveWindowChanged
RaiseOne
WinEventProc
hWinEventHook
eventType
idObject
idChild
dwEventThread
dwmsEventTime
GetActiveWindowTitle
KeyboardHook
WM_KEYDOWN
WM_SYSKEYDOWN
WM_KEYUP
WM_SYSKEYUP
_keyboardDelegate
_keyboardHookHandle
_keyProcessing
StringDown
StringUp
KeyDown
KeyEventHandler
_keyProcessing_StringDown
_keyProcessing_StringUp
add_StringDown
remove_StringDown
add_StringUp
remove_StringUp
add_KeyDown
remove_KeyDown
add_KeyUp
remove_KeyUp
KeyEventArgs
ToInt32
PtrToStructure
KeyboardHookProc
wParam
lParam
get_ModuleName
_databaseConnection
MaxLogSize
_activeWindowHook
_keyboardHook
_keyLog
KeyLog
Orcus.Shared.Commands.Keylogger
_logFile
databaseConnection
Create
add_Saved
get_Length
TryPushKeyLog
_keyLog_Saved
WindowChanged
_activeWindowHook_ActiveWindowChanged
SpecialKeyType
KeyLogEntry
SpecialKey
StandardKey
WriteSpecialKey
_keyboardHook_StringUp
WriteString
_keyboardHook_StringDown
Refresh
CheckSize
NormalText
get_LogEntries
DataMode
get_KeyLog
PushFile
PushKeyLog
forcePush
KeysToSpecialKey
KeyProcessing
_deadKeys
ArrayList
_deadKeyOver
_lastWasDeadKey
Substring
OnKeyActionFurtherProcessing2
vkcode
nScanCode
isDown
kbstate
IEnumerator
UInt32
Boolean
ProcessKeyAction
MyGetKeyboardState
IsPrintableKey
vkCode
IsDeadKey
get_ModifierKeys
IsCtrlPressed
SendLogEventArgs
<IsHandled>k__BackingField
<LogData>k__BackingField
logData
get_IsHandled
set_IsHandled
get_LogData
IsHandled
LogData
StringDownEventArgs
<IsChar>k__BackingField
<Value>k__BackingField
<VCode>k__BackingField
isChar
get_IsChar
get_VCode
IsChar
ChangeComputerStateCommand
Orcus.StaticCommands
StaticCommand
Action`1
StaticCommandResult
Orcus.Shared.DynamicCommands
Execute
IServerConnection
parameter
resultSender
serverConnection
ComputerAction
value__
LogOff
ChangeWallpaperCommand
get_UTF8
GetString
DownloadAndExecuteCommand
SHA256Managed
System.Security.Cryptography
BitConverter
ToArray
GetTempPath
MakeUnique
FileShare
HashAlgorithm
ComputeHash
SequenceEqual
IServicePipe
StartProcess
DownloadAndExecuteFromUrlCommand
UseHashToken
DontUseHash
WebClient
System.Text.RegularExpressions
OpenRead
get_ResponseHeaders
WebHeaderCollection
NameValueCollection
System.Collections.Specialized
IndexOf
GetExtension
get_Success
get_Groups
GroupCollection
Capture
RequestKeyLogCommand
HttpFloodCommand
HttpFloodPackage
Orcus.Shared.StaticCommands.DDoS
IcmpFloodCommand
IcmpFloodPackage
KillCommand
MakeAdminCommand
set_StartInfo
OpenWebsiteCommand
PasswordRecoveryCommand
PasswordData
Orcus.Shared.Commands.Password
SendServerPackage
ServerPackageType
Orcus.Shared.Connection
StopDDoSCommand
SynFloodCommand
SynFloodPackage
UdpFloodCommand
UdpFloodPackage
UninstallCommand
RemovePrivateFiles
RemoveAllDependencies
UpdateCommand
Uninstall
UpdateFromUrlCommand
DownloadFile
get_Scheme
UriBuilder
UriSchemeHttp
set_Scheme
set_Port
get_Uri
DDoSManager
Orcus.StaticCommands.DDoS
Operations
OperationsLock
get_Host
get_Threads
get_Duration
StartHttpFlood
httpData
get_IcmpSockets
get_PackageSize
StartIcmpFlood
icmpData
get_SynSockets
StartSynFlood
synData
get_UdpSockets
StartUdpFlood
udpData
RemoveAt
StopAll
HttpFlood
_duration
_floodingJob
_floodingThread
_requestClass
<IsWorking>k__BackingField
<Host>k__BackingField
<Threads>k__BackingField
threads
duration
get_IsWorking
set_IsWorking
IsWorking
Threads
HttpRequest
_stopwatch
Stopwatch
_isRunning
StartNew
WebRequest
HttpWebRequest
get_Headers
set_KeepAlive
GetResponse
WebResponse
HttpWebResponse
GetResponseStream
get_Elapsed
get_TotalMinutes
IcmpFlood
_synClass
<IcmpSockets>k__BackingField
<Port>k__BackingField
<PacketSize>k__BackingField
icmpSockets
packetSize
get_PacketSize
GetHostEntry
IPHostEntry
get_AddressList
IcmpSockets
PacketSize
SendIcmp
_icmpSockets
_ipEndPoint
_pSize
_isWorking
ipEndPoint
synSockets
AddressFamily
SocketType
ProtocolType
set_Blocking
SendTo
get_Connected
Disconnect
IDDoSOperation
SynFlood
<SynSockets>k__BackingField
SynSockets
SendSyn
_synSockets
OnConnect
IAsyncResult
AsyncCallback
get_AddressFamily
BeginConnect
UdpFlood
<PSize>k__BackingField
<UdpSockets>k__BackingField
udpSockets
get_PSize
UdpSockets
SendUdp
_udpSockets
ServiceConnection
Orcus.Service
_serviceConnection
<IsConnected>k__BackingField
<Pipe>k__BackingField
ChannelFactory`1
NetNamedPipeBinding
set_MaxBufferSize
set_MaxBufferPoolSize
set_MaxReceivedMessageSize
EndpointAddress
Binding
System.ServiceModel.Channels
CreateChannel
IsAlive
get_IsConnected
set_IsConnected
get_Pipe
IsConnected
ServiceInstaller
ServiceController
GetServices
Func`2
WriteAllBytes
WaitForExit
InstallIfNotExist
GetPath
GetFreeFilename
<>9__0_0
get_ServiceName
<InstallIfNotExist>b__0_0
Autostarter
Orcus.Protection
AddToAutostart
filename
TaskService
TaskDefinition
SetValue
RegistryValueKind
GetValueNames
DeleteValue
get_RootFolder
TaskFolder
get_Tasks
TaskCollection
get_Major
get_Definition
get_Principal
TaskPrincipal
get_RunLevel
TaskRunLevel
NewTask
get_Triggers
TriggerCollection
LogonTrigger
Trigger
get_Actions
ActionCollection
ExecAction
set_RunLevel
DeleteTask
RegisterTaskDefinition
inverse
Action
FindTask
get_Path
IsAddedToAutostart
IEnumerator`1
get_AllTasks
SecurityException
RemoveFromAutostart
<>c__DisplayClass1_0
<AddToAutostart>b__0
get_ActionType
TaskActionType
<AddToAutostart>b__1
<>9__2_0
<>9__3_0
<IsAddedToAutostart>b__2_0
<RemoveFromAutostart>b__3_0
Installer
get_Directory
get_InvariantCulture
IFormatProvider
SetCreationTime
currentFile
hideFile
changeCreationTime
newCreationTime
setRunAsAdminFlag
TcpAnalyzerDetector
ProcessNames
IsATcpAnaylzerRunning
GetProcessesByName
CheckProcessIsRunning
sProcessName
VirtualMachineDetector
_graphicDevice
get_GraphicDevice
IsRunningInVm
IsOnParallelsDesktop
IsOnVmWare
IsOnVirtualBox
IsOnVirtualPc
GetGraphicDevice
GraphicDevice
Resources
Orcus.Properties
resourceMan
ResourceManager
System.Resources
resourceCulture
get_Assembly
Assembly
get_ResourceManager
get_Culture
set_Culture
GetObject
get_Orcus_Service
EditorBrowsableAttribute
EditorBrowsableState
Culture
Orcus_Service
DebuggerNonUserCodeAttribute
GeneratedCodeAttribute
System.CodeDom.Compiler
Settings
ApplicationSettingsBase
System.Configuration
defaultInstance
SettingsBase
Synchronized
Default
ClientStartup
<IsAdministrator>k__BackingField
<ClientPath>k__BackingField
<IsInstalled>k__BackingField
isInstalled
get_ClientPath
get_IsInstalled
ClientPath
IsInstalled
CommandLoadedEventArgs
<NewCommandType>k__BackingField
newCommandType
get_NewCommandType
NewCommandType
PluginLoader
_current
<AvailablePlugins>k__BackingField
Dictionary`2
ResourceInfo
Orcus.Shared.Plugins
<ClientPlugins>k__BackingField
<FactoryCommandPlugins>k__BackingField
<Loadables>k__BackingField
<Commands>k__BackingField
CommandLoaded
get_AvailablePlugins
get_ClientPlugins
get_FactoryCommandPlugins
get_Loadables
get_Commands
add_CommandLoaded
remove_CommandLoaded
MemoryStream
ResourceType
GetEntryAssembly
get_ResourceName
GetManifestResourceStream
GetTypes
get_ResourceType
Activator
CreateInstance
set_Item
get_PluginName
LoadPlugins
pluginSettings
ReadAllBytes
LoadPlugin
GZipStream
System.IO.Compression
CompressionMode
Decompress
AvailablePlugins
ClientPlugins
FactoryCommandPlugins
Loadables
Commands
<>9__22_0
<>9__22_1
<>9__22_2
<>9__23_0
Command
IsSubclassOf
<LoadPlugins>b__22_0
<LoadPlugins>b__22_1
GetInterface
<LoadPlugins>b__22_2
<LoadPlugin>b__23_0
Orcus.Native
ALG_CLASS_HASH
ALG_SID_SHA1
ALG_ID
CALG_MD5
CALG_SHA1
DEVMODE
ValueType
dmDeviceName
dmSpecVersion
dmDriverVersion
dmSize
dmDriverExtra
dmFields
dmPosition
dmDisplayOrientation
DisplayFixedOutput
dmColor
dmDuplex
dmYResolution
dmTTOption
dmCollate
dmFormName
dmLogPixels
dmBitsPerPel
dmPelsWidth
dmPelsHeight
dmDisplayFlags
dmDisplayFrequency
dmICMMethod
dmICMIntent
dmMediaType
dmDitherType
dmReserved1
dmReserved2
dmPanningWidth
dmPanningHeight
GetWindow_Cmd
GW_HWNDFIRST
GW_HWNDLAST
GW_HWNDNEXT
GW_HWNDPREV
GW_OWNER
GW_CHILD
GW_ENABLEDPOPUP
HashParameters
HP_ALGID
HP_HASHVAL
HP_HASHSIZE
HookType
WH_JOURNALRECORD
WH_JOURNALPLAYBACK
WH_KEYBOARD
WH_GETMESSAGE
WH_CALLWNDPROC
WH_CBT
WH_SYSMSGFILTER
WH_MOUSE
WH_HARDWARE
WH_DEBUG
WH_SHELL
WH_FOREGROUNDIDLE
WH_CALLWNDPROCRET
WH_KEYBOARD_LL
WH_MOUSE_LL
ICONINFO
xHotspot
yHotspot
hbmMask
hbmColor
IEAutoComplteSecretHeader
dwSize
dwSecretInfoSize
dwSecretSize
IESecretHeader
IESecretInfoHeader
dwIdHeader
dwTotalSecrets
unknown
unknownZero
KeyboardHookStruct
VirtualKeyCode
ScanCode
ExtraInfo
LASTINPUTINFO
cbSize
dwTime
MEMORYSTATUSEX
dwLength
dwMemoryLoad
ullTotalPhys
ullAvailPhys
ullTotalPageFile
ullAvailPageFile
ullTotalVirtual
ullAvailVirtual
ullAvailExtendedVirtual
SizeOf
MIB_TCPROW_OWNER_PID
localAddr
localPort1
localPort2
localPort3
localPort4
remoteAddr
remotePort1
remotePort2
remotePort3
remotePort4
owningPid
ToUInt16
get_LocalPort
get_RemotePort
LocalPort
RemotePort
MIB_TCPTABLE_OWNER_PID
dwNumEntries
MIB_UDPROW_OWNER_PID
MIB_UDPTABLE_OWNER_PID
NativeMethods
GetLastInputInfo
EnumDisplaySettings
deviceName
modeNum
devMode
ChangeDisplaySettings
FindWindow
className
windowText
command
FindWindowEx
parentHandle
childAfter
windowTitle
GetDesktopWindow
SendMessage
SendMessageW
SystemParametersInfo
uAction
uParam
lpvParam
fuWinIni
GetWindow
nCmdShow
parentHwnd
childAfterHwnd
LoadKeyboardLayout
pwszKLID
GetWindowThreadProcessId
lpdwProcessId
GetForegroundWindow
GetKeyboardLayout
idThread
GetWindowText
EnumThreadWindows
threadId
pfnEnum
ProcessId
GetShellWindow
EnumWindows
lpEnumFunc
GetClassName
lpClassName
nMaxCount
GetDlgItem
nIDDlgItem
BitBlt
nXDest
nYDest
nWidth
nHeight
hdcSrc
CreateDC
lpszDriver
lpszDevice
lpszOutput
lpInitData
DeleteDC
SetCursorPos
mouse_event
dwFlags
cButtons
dwExtraInfo
keybd_event
SwapMouseButton
BlockInput
fBlockIt
GetTickCount64
GetTickCount
GetExtendedTcpTable
pTcpTable
dwOutBufLen
ipVersion
tblClass
reserved
GetExtendedUdpTable
GetKeyState
ToAscii
uVirtKey
uScanCode
lpbKeyState
lpwTransKey
fuState
lpKeyState
lpChar
uFlags
GetKeyboardState
pbKeyState
SetWindowsHookEx
hookType
dwThreadId
CallNextHookEx
UnhookWindowsHookEx
GetModuleHandle
lpModuleName
MapVirtualKey
uMapType
SetWinEventHook
eventMin
eventMax
hmodWinEventProc
lpfnWinEventProc
idProcess
UnhookWinEvent
GlobalMemoryStatusEx
lpBuffer
LoadLibrary
libraryName
GetProcAddress
procedureName
GetSystemInfo
lpSystemInfo
SHGetSpecialFolderPath
hwndOwner
lpszPath
nFolder
fCreate
CryptAcquireContext
phProv
pszContainer
pszProvider
dwProvType
CryptCreateHash
phHash
CryptHashData
pbData
dwDataLen
CryptDestroyHash
CryptGetHashParam
dwParam
pdwDataLen
CryptReleaseContext
RegOpenKeyEx
subKey
ulOptions
samDesired
hkResult
FreeLibrary
hModule
GetCursorInfo
CopyIcon
GetIconInfo
piconinfo
SelectObject
hObject
CreateCompatibleDC
DeleteObject
hObjSource
SetWindowText
GetSystemDefaultLCID
CreateDesktop
lpszDesktop
pDevmode
dwDesiredAccess
CloseDesktop
hDesktop
OpenDesktop
fInherit
GetProcessWindowStation
EnumDesktops
hwinsta
EnumDesktopWindows
lpString
CreateProcess
lpApplicationName
lpCommandLine
lpProcessAttributes
lpThreadAttributes
bInheritHandles
dwCreationFlags
lpEnvironment
lpCurrentDirectory
lpStartupInfo
lpProcessInformation
SetThreadDesktop
GetWindowRect
lpRect
PrintWindow
nFlags
PostMessage
HandleRef
SetWindowPos
hWndInsertAfter
EnumChildWindows
DestroyIcon
memcmp
WinEventDelegate
MulticastDelegate
object
method
BeginInvoke
callback
EndInvoke
result
EnumThreadProc
EnumWindowsProc
HookProc
EnumDesktopProc
EnumDesktopWindowsProc
desktopHandle
WindowEnumProc
lparam
POINTAPI
POINTL
PROCESS_INFORMATION
hProcess
hThread
dwProcessId
Bottom
bottom
get_Left
get_Top
get_Right
get_Bottom
set_Height
set_Width
get_Location
op_Implicit
GetHashCode
get_CurrentCulture
Height
Location
SecretEntry
dwOffset
SecretId
SecretId1
SecretId2
SecretId3
SecretId4
SecretId5
SecretId6
SecretId7
SetWindowPosFlags
AsynchronousWindowPosition
DeferErase
DrawFrame
FrameChanged
HideWindow
DoNotActivate
DoNotCopyBits
IgnoreMove
DoNotChangeOwnerZOrder
DoNotRedraw
DoNotReposition
DoNotSendChangingEvent
IgnoreResize
IgnoreZOrder
FlagsAttribute
STARTUPINFO
lpReserved
lpDesktop
lpTitle
dwXSize
dwYSize
dwXCountChars
dwYCountChars
dwFillAttribute
wShowWindow
cbReserved2
lpReserved2
hStdInput
hStdOutput
hStdError
SYSTEM_INFO
dwOemId
dwPageSize
lpMinimumApplicationAddress
lpMaximumApplicationAddress
dwActiveProcessorMask
dwNumberOfProcessors
dwProcessorType
dwAllocationGranularity
wProcessorLevel
wProcessorRevision
TCP_TABLE_CLASS
TCP_TABLE_BASIC_LISTENER
TCP_TABLE_BASIC_CONNECTIONS
TCP_TABLE_BASIC_ALL
TCP_TABLE_OWNER_PID_LISTENER
TCP_TABLE_OWNER_PID_CONNECTIONS
TCP_TABLE_OWNER_PID_ALL
TCP_TABLE_OWNER_MODULE_LISTENER
TCP_TABLE_OWNER_MODULE_CONNECTIONS
TCP_TABLE_OWNER_MODULE_ALL
TernaryRasterOperations
SRCCOPY
SRCPAINT
SRCAND
SRCINVERT
SRCERASE
NOTSRCCOPY
NOTSRCERASE
MERGECOPY
MERGEPAINT
PATCOPY
PATPAINT
PATINVERT
DSTINVERT
BLACKNESS
WHITENESS
CAPTUREBLT
CURSORINFO
hCursor
ptScreenPos
UDP_TABLE_CLASS
UDP_TABLE_BASIC
UDP_TABLE_OWNER_PID
UDP_TABLE_OWNER_MODULE
WindowHelper
desktopWindow
<>c__DisplayClass0_0
shelldllDefViewParent
shelldllDefView
sysListView32
<GetDesktopWindow>b__0
DesktopWindow
ProgMan
SHELLDLL_DefViewParent
SHELLDLL_DefView
SysListView32
CREATE
DESTROY
ACTIVATE
SETFOCUS
KILLFOCUS
ENABLE
SETREDRAW
SETTEXT
GETTEXT
GETTEXTLENGTH
QUERYENDSESSION
QUERYOPEN
ENDSESSION
ERASEBKGND
SYSCOLORCHANGE
SHOWWINDOW
WININICHANGE
SETTINGCHANGE
DEVMODECHANGE
ACTIVATEAPP
FONTCHANGE
TIMECHANGE
CANCELMODE
SETCURSOR
MOUSEACTIVATE
CHILDACTIVATE
QUEUESYNC
GETMINMAXINFO
PAINTICON
ICONERASEBKGND
NEXTDLGCTL
SPOOLERSTATUS
DRAWITEM
MEASUREITEM
DELETEITEM
VKEYTOITEM
CHARTOITEM
SETFONT
GETFONT
SETHOTKEY
GETHOTKEY
QUERYDRAGICON
COMPAREITEM
GETOBJECT
COMPACTING
COMMNOTIFY
ObsoleteAttribute
WINDOWPOSCHANGING
WINDOWPOSCHANGED
COPYDATA
CANCELJOURNAL
NOTIFY
INPUTLANGCHANGEREQUEST
INPUTLANGCHANGE
USERCHANGED
NOTIFYFORMAT
CONTEXTMENU
STYLECHANGING
STYLECHANGED
DISPLAYCHANGE
GETICON
SETICON
NCCREATE
NCDESTROY
NCCALCSIZE
NCHITTEST
NCPAINT
NCACTIVATE
GETDLGCODE
SYNCPAINT
NCMOUSEMOVE
NCLBUTTONDOWN
NCLBUTTONUP
NCLBUTTONDBLCLK
NCRBUTTONDOWN
NCRBUTTONUP
NCRBUTTONDBLCLK
NCMBUTTONDOWN
NCMBUTTONUP
NCMBUTTONDBLCLK
NCXBUTTONDOWN
NCXBUTTONUP
NCXBUTTONDBLCLK
INPUT_DEVICE_CHANGE
KEYFIRST
KEYDOWN
DEADCHAR
SYSKEYDOWN
SYSKEYUP
SYSCHAR
SYSDEADCHAR
UNICHAR
KEYLAST
IME_STARTCOMPOSITION
IME_ENDCOMPOSITION
IME_COMPOSITION
IME_KEYLAST
INITDIALOG
COMMAND
SYSCOMMAND
HSCROLL
VSCROLL
INITMENU
INITMENUPOPUP
MENUSELECT
MENUCHAR
ENTERIDLE
MENURBUTTONUP
MENUDRAG
MENUGETOBJECT
UNINITMENUPOPUP
MENUCOMMAND
CHANGEUISTATE
UPDATEUISTATE
QUERYUISTATE
CTLCOLORMSGBOX
CTLCOLOREDIT
CTLCOLORLISTBOX
CTLCOLORBTN
CTLCOLORDLG
CTLCOLORSCROLLBAR
CTLCOLORSTATIC
MOUSEFIRST
MOUSEMOVE
LBUTTONDOWN
LBUTTONUP
LBUTTONDBLCLK
RBUTTONDOWN
RBUTTONUP
RBUTTONDBLCLK
MBUTTONDOWN
MBUTTONUP
MBUTTONDBLCLK
MOUSEWHEEL
XBUTTONDOWN
XBUTTONUP
XBUTTONDBLCLK
MOUSEHWHEEL
MOUSELAST
PARENTNOTIFY
ENTERMENULOOP
EXITMENULOOP
NEXTMENU
SIZING
CAPTURECHANGED
MOVING
POWERBROADCAST
DEVICECHANGE
MDICREATE
MDIDESTROY
MDIACTIVATE
MDIRESTORE
MDINEXT
MDIMAXIMIZE
MDITILE
MDICASCADE
MDIICONARRANGE
MDIGETACTIVE
MDISETMENU
ENTERSIZEMOVE
EXITSIZEMOVE
DROPFILES
MDIREFRESHMENU
IME_SETCONTEXT
IME_NOTIFY
IME_CONTROL
IME_COMPOSITIONFULL
IME_SELECT
IME_CHAR
IME_REQUEST
IME_KEYDOWN
IME_KEYUP
MOUSEHOVER
MOUSELEAVE
NCMOUSEHOVER
NCMOUSELEAVE
WTSSESSION_CHANGE
TABLET_FIRST
TABLET_LAST
RENDERFORMAT
RENDERALLFORMATS
DESTROYCLIPBOARD
DRAWCLIPBOARD
PAINTCLIPBOARD
VSCROLLCLIPBOARD
SIZECLIPBOARD
ASKCBFORMATNAME
CHANGECBCHAIN
HSCROLLCLIPBOARD
QUERYNEWPALETTE
PALETTEISCHANGING
PALETTECHANGED
HOTKEY
PRINTCLIENT
APPCOMMAND
THEMECHANGED
CLIPBOARDUPDATE
DWMCOMPOSITIONCHANGED
DWMNCRENDERINGCHANGED
DWMCOLORIZATIONCOLORCHANGED
DWMWINDOWMAXIMIZEDCHANGE
GETTITLEBARINFOEX
HANDHELDFIRST
HANDHELDLAST
AFXFIRST
AFXLAST
PENWINFIRST
PENWINLAST
CPL_LAUNCH
CPL_LAUNCHED
SYSTIMER
HSHELL_ACCESSIBILITYSTATE
HSHELL_ACTIVATESHELLWINDOW
HSHELL_APPCOMMAND
HSHELL_GETMINRECT
HSHELL_LANGUAGE
HSHELL_REDRAW
HSHELL_TASKMAN
HSHELL_WINDOWCREATED
HSHELL_WINDOWDESTROYED
HSHELL_WINDOWACTIVATED
HSHELL_WINDOWREPLACED
EnvironmentExtensions
Orcus.Extensions
_is64BitOperatingSystem
_is64BitProcess
_systemPageSize
get_Is64BitOperatingSystem
get_Is64BitProcess
get_SystemPageSize
get_SystemDirectory
GetFolderPath
SpecialFolder
GetParent
get_WindowsFolder
GetDelegateForFunctionPointer
GetIsWow64ProcessDelegate
get_Handle
Is32BitProcessOn64BitProcessor
Is64BitOperatingSystem
Is64BitProcess
SystemPageSize
SystemDirectory
WindowsFolder
IsWow64ProcessDelegate
handle
isWow64Process
ImageExtensions
get_HorizontalResolution
get_VerticalResolution
SetResolution
ResizeImage
height
ExtensionAttribute
BitmapData
LockBits
ImageLockMode
get_Scan0
get_Stride
UnlockBits
CompareMemCmp
RegistryExtensions
ClassesRoot
LocalMachine
CurrentConfig
RegistryHive
Orcus.Shared.Commands.Registry
ArgumentOutOfRangeException
OpenRegistry
registryHive
StreamExtensions
CopyTo
output
StringExtensions
IsNullOrWhiteSpace
AdministrationConnection
Orcus.Connection
_commandSelector
_connectionInfo
<Id>k__BackingField
connection
get_Id
SendingType
Orcus.Shared.Communication
ToUInt32
PackageReceived
SendPackage
ResponseType
package
responseType
Client
MaxWaitTime
_random
Random
_isDisposed
<IsSearching>k__BackingField
<Connection>k__BackingField
<DatabaseConnection>k__BackingField
get_IsSearching
set_IsSearching
get_Connection
set_Connection
get_DatabaseConnection
add_Connected
remove_Connected
add_Disconnected
remove_Disconnected
StopConnect
IpAddressInfo
Orcus.Shared.Core
SslStream
System.Net.Security
BinaryReader
BinaryWriter
CanTryConnect
TryConnect
Connect
Connection_Disconnected
PrimitiveProtocol
ReadByte
ReadInt32
ReadBytes
binaryWriter
binaryReader
IProxyClient
Starksoft.Aspen.Proxy
Socks4ProxyClient
Socks4aProxyClient
Socks5ProxyClient
ArgumentException
set_ProxyHost
set_ProxyPort
get_Ip
CreateConnection
get_AsyncWaitHandle
EndConnect
GetStream
NetworkStream
RemoteCertificateValidationCallback
get_MachineName
AuthenticateAsClient
AuthenticationException
System.Security.Authentication
tcpClient
ipAddressInfo
UserCertificateValidationCallback
X509Certificate
System.Security.Cryptography.X509Certificates
X509Chain
SslPolicyErrors
certificate
sslPolicyErrors
KeyDatabase
GetKey
Authenticate
IsSearching
Connection
DatabaseConnection
TryConnectDelegate
<>9__29_0
get_OverwriteTryConnect
<Connect>b__29_0
InformationCollector
BasicComputerInformation
PlatformID
get_UserName
set_UserName
KeyValuePair`2
PluginInfo
Select
ToList
set_Plugins
GetFiles
LoadablePlugin
set_LoadablePlugins
JavaScriptSerializer
System.Web.Script.Serialization
ClientConfig
set_Mutex
set_InstallationFolder
set_IpAddresses
set_NewCreationDate
set_ClientTag
set_TaskSchedulerTaskName
set_RegistryAutostartKeyName
set_ProxyOption
set_HideFile
set_AntiVMs
set_AntiDebugger
set_AntiTcpAnalyzer
set_Install
set_ChangeCreationDate
set_ForceInstallerAdministratorRights
set_SetAdminFlag
set_InstallService
set_IsKeyloggerEnabled
set_AdministrationRightsRequired
set_TryOtherAutostartMethodsIfChosenOneFails
set_RegistryHiddenAutostart
set_TaskSchedulerRequestHighestPrivileges
set_ReconnectDelay
set_AutostartMethod
set_FrameworkVersion
set_ClientConfig
set_ApiVersion
set_ClientPath
get_InstalledUICulture
get_TwoLetterISOLanguageName
set_Language
get_LCID
get_Language
RegionInfo
get_TwoLetterISORegionName
get_Platform
set_OSName
get_OSName
set_OSType
OSType
get_VersionString
SendInformation
GetOsFriendlyName
GetSubKeyNames
Double
GetFrameworkVersion
MD5CryptoServiceProvider
Append
DriveInfo
GetDrives
GetBytes
GetHardwareId
<>9__0_1
<>9__0_2
<>9__0_3
get_Key
get_Guid
set_Guid
get_PluginVersion
set_Version
set_IsLoaded
<SendInformation>b__0_0
<SendInformation>b__0_1
<SendInformation>b__0_2
<SendInformation>b__0_3
PluginReceiver
_length
_md5Hash
_receiveLock
_stream
<Guid>k__BackingField
<AdministrationId>k__BackingField
<Version>k__BackingField
administrationId
length
md5Hash
version
get_AdministrationId
ReceiveData
WritePlugin
AdministrationId
FileTransferEventArgs
ResultSender
_sendLock
_session
SendResult
session
add_SendResult
remove_SendResult
ResponseResult
staticCommandResult
ResponseResultEventArgs
<Session>k__BackingField
<CommandResult>k__BackingField
commandResult
get_Session
get_CommandResult
Session
CommandResult
ServerConnection
_pluginReceivers
_readByteDelegate
Func`1
_sslStream
<AdministrationConnections>k__BackingField
<SendLock>k__BackingField
FileTransferAccepted
FileTransferCompleted
<BinaryReader>k__BackingField
<BinaryWriter>k__BackingField
<TcpClient>k__BackingField
sslStream
reader
get_AdministrationConnections
get_SendLock
add_FileTransferAccepted
remove_FileTransferAccepted
add_FileTransferCompleted
remove_FileTransferCompleted
get_BinaryReader
get_BinaryWriter
get_TcpClient
ServerPackage
set_Data
set_ServerPackageType
RedirectPackage
set_Administration
set_RedirectPackage
ObjectDisposedException
serverPackageType
redirectPackage
FromAdministrationPackage
PluginVersion
JpgCompression
Orcus.Shared.Utilities.Compression
Orcus.Shared.Compression
get_ASCII
ToByteArray
get_TickCount
Compress
EndRead
asyncResult
ResultSender_SendResult
PushExceptions
exceptions
InitializeFileTransfer
SendBytes
FromClientPackage
AdministrationConnections
SendLock
<>c__DisplayClass37_0
pluginReceiverGuid
closingSessionId
<EndRead>b__0
<EndRead>b__1
<EndRead>b__2
Consts
Orcus.Config
<KeyLogFile>k__BackingField
<ExceptionFile>k__BackingField
<PluginsDirectory>k__BackingField
<ApplicationPath>k__BackingField
<FileTransferTempDirectory>k__BackingField
get_ExecutablePath
get_KeyLogFile
get_ExceptionFile
get_PluginsDirectory
get_ApplicationPath
get_FileTransferTempDirectory
KeyLogFile
ExceptionFile
PluginsDirectory
ApplicationPath
FileTransferTempDirectory
ENCRYPTIONKEY
INSTALLATIONFOLDER
NEWCREATIONDATE
PLUGINS
CLIENTTAG
TASKSCHNAME
REGISTRYAUTOSTARTKEYNAME
PROXYOPTION
HIDEFILE
ANTIVM
ANTIDEBUGGER
ANTITCPANALYZER
INSTALL
CHANGECREATIONDATE
FORCEINSTALLERADMINISTRATORPRIVILEGES
SETADMINFLAG
INSTALLSERVICE
KEYLOGGERENABLED
ADMINISTRATIONRIGHTSREQUIRED
TRYOTHERAUTOSTARTONFAIL
REGISTRYHIDDENAUTOSTART
TASKSCHREQUESTHIGHESTPRIVILEGES
RECONNECTDELAY
AUTOSTARTMETHOD
Orcus.Shared.Encryption
Decrypt
WebcamCommand
Orcus.Commands.Webcam
_framesLock
_lastFrame
_screenWaitEvent
AutoResetEvent
_unsafeStreamCodec
UnsafeStreamCodec
_videoCaptureDevice
VideoCaptureDevice
_webcamSettings
WebcamSettings
Orcus.Shared.Commands.Webcam
WebcamCommunication
WebcamInfo
get_Source
get_MonikerString
get_VideoCapabilities
VideoCapabilities
get_Resolution
set_VideoResolution
ResponseByte
IConnectionInfo
NewFrameEventHandler
add_NewFrame
remove_NewFrame
get_ImageQuality
get_Device
get_PixelFormat
CodeImage
AddRange
ResponseBytes
FilterCategory
VideoInputDevice
FilterInfoCollection
FilterInfo
ProcessCommand
connectionInfo
NewFrameEventArgs
get_Frame
EventWaitHandle
_videoCaptureDevice_NewFrame
<>9__7_1
WebcamResolution
<>9__7_0
set_MonikerString
set_AvailableResolutions
<ProcessCommand>b__7_0
FrameSize
set_Heigth
<ProcessCommand>b__7_1
UserInteractionCommand
Orcus.Commands.UserInteraction
UserInteractionCommunication
Orcus.Shared.Commands.UserInteraction
TextToSpeechPackage
UserInteractionWelcomePackage
SpeechSynthesizer
System.Speech.Synthesis
get_Speed
set_Rate
get_Volume
set_Volume
get_VoiceName
SelectVoice
SetOutputToDefaultAudioDevice
CommandResponse
PackageCompression
get_Text
GetInstalledVoices
ReadOnlyCollection`1
System.Collections.ObjectModel
InstalledVoice
SpeechVoice
set_Voices
get_Application
ShowBalloonTip
ToolTipIcon
get_VoiceInfo
VoiceInfo
get_Age
VoiceAge
set_VoiceAge
SpeechAge
get_Gender
VoiceGender
set_VoiceGender
SpeechGender
<ProcessCommand>b__0_0
UninstallProgramsCommand
Orcus.Commands.UninstallPrograms
_uninstallPaths
_counter
GetEntries
UninstallableProgram
Orcus.Shared.Commands.UninstallPrograms
UninstallProgramEntryLocation
registryKey
location
UninstallProgramsCommunication
ContainsKey
get_Extension
ExtractAssociatedIcon
ToBitmap
ImageFormat
get_Png
GetIconFromPath
<GetEntries>d__2
<>1__state
<>2__current
<>l__initialThreadId
<>3__registryKey
<>3__location
<subKey>5__1
<>7__wrap1
<>7__wrap2
get_ManagedThreadId
DebuggerHiddenAttribute
System.IDisposable.Dispose
set_Id
set_EntryLocation
set_IconData
<>m__Finally1
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.get_Current
NotSupportedException
System.Collections.IEnumerator.Reset
System.Collections.IEnumerator.get_Current
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.GetEnumerator
System.Collections.IEnumerable.GetEnumerator
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.UninstallPrograms.UninstallableProgram>.Current
System.Collections.IEnumerator.Current
<>c__DisplayClass3_0
uninstallableProgram
<ProcessCommand>b__0
TextChatForm
Orcus.Commands.TextChat
_chatSettings
ChatSettings
Orcus.Shared.Commands.TextChat
_meColor
_otherColor
_isClosing
<IsClosed>k__BackingField
MainRichTextBox
RichTextBox
MessageTextBox
TextBox
SendButton
FromArgb
chatSettings
get_IsClosed
set_IsClosed
add_SendMessage
remove_SendMessage
OnShown
ForceClose
MessageReceived
timestamp
get_KeyCode
set_SuppressKeyPress
MessageTextBox_KeyDown
OnClosing
get_PreventClose
set_Cancel
OnClosed
SendButton_Click
ToShortTimeString
SendText
set_Enabled
MessageTextBox_TextChanged
set_ActiveControl
get_Topmost
MainForm_Load
ComponentResourceManager
set_Anchor
AnchorStyles
TextBoxBase
set_ReadOnly
set_AcceptsReturn
add_TextChanged
add_Load
IsClosed
<>c__DisplayClass14_0
get_YourName
<MessageReceived>b__0
SendTextMessageEventArgs
<Message>k__BackingField
Message
TextChatCommand
_currentChatForm
TextChatCommunication
ToInt64
get_HideEveythingElse
add_Closed
ShowDialog
<ProcessCommand>b__2_2
<>c__DisplayClass2_0
get_Ticks
<ProcessCommand>b__1
Computer
Orcus.Commands.TextChat.Utilities
WM_COMMAND
MIN_ALL
op_Explicit
MinimizeAllScreens
RichTextBoxExtensions
get_TextLength
set_SelectionStart
set_SelectionLength
set_SelectionColor
AppendText
get_ForeColor
ScrollToCaret
ScrollToEnd
TaskmanagerCommand
Orcus.Commands.TaskManager
<SendProcesses>k__BackingField
get_SendProcesses
set_SendProcesses
TaskManagerCommunication
Orcus.Shared.Commands.TaskManager
ProcessInfo
ProcessListChangelog
GetProcessById
set_ClosedProcesses
set_NewProcesses
set_PriorityClass
ProcessPriorityClass
GetIconFromProcess
get_ProcessName
get_PrivateMemorySize64
set_PrivateBytes
get_WorkingSet64
set_WorkingSet
get_FileVersionInfo
FileVersionInfo
get_FileDescription
set_Description
get_CompanyName
set_CompanyName
set_IconBytes
get_StartTime
set_StartTime
get_PriorityClass
set_CanChangePriorityClass
ProcessToProcessInfo
<ProcessCommand>b__4_2
process
SendProcesses
<>c__DisplayClass4_0
<ProcessCommand>b__3
<>c__DisplayClass4_1
allProcesses
<ProcessCommand>b__4
<>c__DisplayClass4_2
<ProcessCommand>b__5
<>9__4_0
<>9__4_1
<>9__4_6
<>9__4_7
<ProcessCommand>b__4_0
<ProcessCommand>b__4_1
<ProcessCommand>b__4_6
<ProcessCommand>b__4_7
DataReceivedEventArgs
Orcus.Commands.ReverseProxy
<Data>k__BackingField
get_Data
ReverseProxyClient
BUFFER_SIZE
_buffer
_disconnectIsSend
<ConnectionId>k__BackingField
<Handle>k__BackingField
<Target>k__BackingField
<ConnectionInfo>k__BackingField
DataReceived
target
connectionId
get_ConnectionId
get_Target
get_ConnectionInfo
set_ConnectionInfo
add_DataReceived
remove_DataReceived
BeginReceive
SocketFlags
get_LocalEndPoint
Handle_Connect
EndReceive
AsyncReceive
SendToTargetServer
ConnectionId
Handle
Target
ConnectionInfo
ReverseProxyCommand
_clientsLock
_proxyClients
ReverseProxyCommunication
Orcus.Shared.Commands.ReverseProxy
_reverseProxyClient_DataReceived
_reverseProxyClient_Disconnected
GetAddressBytes
_reverseProxyClient_Connected
ReverseProxyConnectedEventArgs
<LocalEndpoint>k__BackingField
localEndpoint
get_LocalEndpoint
LocalEndpoint
AdvancedBitmapImage
Orcus.Commands.RemoteDesktop
<Image>k__BackingField
<IsTaken>k__BackingField
get_Image
set_Image
get_IsTaken
set_IsTaken
IsTaken
RemoteActions
MOUSEEVENTF_LEFTDOWN
MOUSEEVENTF_LEFTUP
MOUSEEVENTF_RIGHTDOWN
MOUSEEVENTF_RIGHTUP
MOUSEEVENTF_WHEEL
KEYEVENTF_KEYDOWN
KEYEVENTF_KEYUP
DoMouseLeftClick
isMouseDown
DoMouseRightClick
DoMouseMove
DoMouseScroll
scrollDown
DoKeyPress
keyDown
RemoteDesktopCommand
_lastIconImage
_cursorLock
_screenFactory
_screenFactoryLock
_unsafeStreamCodecLock
RemoteDesktopCommunication
Orcus.Shared.Commands.RemoteDesktop
Cursor
get_Position
WriteByte
get_AllScreens
RemoteDesktopAction
DoAction
action
MouseAction
ScreenFactory
<CurrentImage>k__BackingField
<Monitor>k__BackingField
<ImageLock>k__BackingField
<AutoResetEvent>k__BackingField
_actionLock
get_CurrentImage
set_CurrentImage
get_Monitor
set_Monitor
get_ImageLock
get_AutoResetEvent
set_AutoResetEvent
CurrentImage
ImageLock
CURSOR_SHOWING
GetHdc
ReleaseHdc
CaptureScreen
screenNumber
FromHbitmap
FromHwnd
GetHbitmap
MakeTransparent
FromHandle
CaptureCursor
GetBounds
RegistryCommand
Orcus.Commands.RegistryExplorer
RegistryCommunication
RegistrySubKey
RegistryValue
RegistryCreateValuePackage
RegistryValueBinary
RegistryValueMultiString
RegistryKeyPermissionCheck
set_IsEmpty
GetRegistrySubKeys
RegistrySubKeysPackage
set_Path
set_RegistrySubKeys
set_RegistryHive
DeleteSubKeyTree
DeleteSubKey
RegistrySubKeyAction
GetValueKind
RegistryValueString
set_Key
set_Value
RegistryValueExpandString
RegistryValueDWord
RegistryValueQWord
RegistryValueUnknown
GetRegistryValues
get_RegistryValueTypes
RegistryValuesPackage
set_Values
CreateSubKey
get_RegistryHive
get_RegistryValue
get_ValueObject
get_ValueKind
CreateValue
ConvertFromOrcusValueKind
registryValue
SendPermissionDenied
SendError
ICookieRecovery
Orcus.Commands.Passwords
GetCookies
RecoveredCookie
IPasswordRecovery
GetPasswords
RecoveredPassword
PasswordsCommand
set_Cookies
set_Passwords
get_Passwords
RecoverPasswords
get_Cookies
RecoverCookies
recoverCookies
ChromiumBase
Orcus.Commands.Passwords.Utilities
set_Field1
set_Password
set_Application
set_PasswordType
PasswordType
Passwords
datapath
browser
AddMilliseconds
set_Host
set_ExpiresUtc
set_Secure
set_HttpOnly
set_ApplicationName
Cookies
dataPath
ProtectedData
Unprotect
DataProtectionScope
encryptedData
JsonUtil
DataContractJsonSerializer
System.Runtime.Serialization.Json
XmlObjectSerializer
WriteObject
ReadObject
KeyDecoder
get_Minor
GetWindowsProductKey
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
DecodeProductKey
digitalProductId
get_Chars
Insert
DecodeProductKeyWin8AndUp
MozillaDecryptor
_appPath
_configDir
_mozglueDllPtr
_msvcpDllPtr
_msvcrDllPtr
_nss3DllPtr
configDir
appPath
FileNotFoundException
GetNss3Path
GetMozgluePath
GetMsvcrPath
GetMsvpPath
PK11_GetInternalKeySlot
PK11_Authenticate
loadCerts
NSSBase64_DecodeBuffer
arenaOpt
outItemOpt
PK11SDR_Decrypt
cypherText
TSECItem
SECItemType
SECItemData
SECItemLen
NSS_InitPtr
configdir
UnmanagedFunctionPointerAttribute
CallingConvention
PK11SDR_DecryptPtr
__result
PK11_GetInternalKeySlotPtr
PK11_AuthenticatePtr
NSSBase64_DecodeBufferPtr
HiveKeys
AccessMasks
ConstructorInfo
SafeHandleZeroOrMinusOneIsInvalid
Microsoft.Win32.SafeHandles
GetConstructor
BindingFlags
Binder
ParameterModifier
UIntPtr
GetMethod
MethodInfo
MethodBase
GetField
FieldInfo
PlatformNotSupportedException
OpenBaseKey
registryType
RegistryAccessMask
QueryValue
EnumerateSubKeys
Notify
CreateLink
WoW6432
Wow6464
AllAccess
RegistryView
Registry86
Registry64
RegistryKeyExtensions
IsNameOrValueNull
keyName
GetValueSafe
defaultValue
OpenReadonlySubKeySafe
OpenWritableSubKeySafe
GetFormattedKeyValues
<>9__0
<GetFormattedKeyValues>b__0
keyVal
<GetFormattedKeyValues>b__4_1
<GetFormattedKeyValues>d__4
<>3__key
<>8__1
System.Collections.Generic.IEnumerator<System.String>.get_Current
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
System.Collections.Generic.IEnumerator<System.String>.Current
RegistryKeyHelper
EndsWith
AddRegistryKeyValue
addQuotes
OpenReadonlySubKey
DeleteRegistryKeyValue
SQLiteHandler
_dbBytes
_encoding
_pageSize
_sqlDataTypeSize
_fieldNames
_masterTableEntries
_tableEntries
Compare
Decimal
baseName
ConvertToInteger
startIndex
endIndex
GetRowCount
GetTableNames
rowNum
ToLower
CompareTo
Subtract
ToUInt64
get_Unicode
get_BigEndianUnicode
Multiply
ReadMasterTable
offset
TrimStart
ReadTable
tableName
UInt64
ReadTableFromOffset
CopyArray
arySrc
aryDes
record_header_field
sqlite_master_entry
row_id
item_type
item_name
astable_name
root_num
sql_statement
table_entry
content
TimeHelper
ToLocalTime
op_Subtraction
get_TotalSeconds
ToUnixTime
DateTimeKind
AddSeconds
FromUnixTime
unixTime
Yandex
Orcus.Commands.Passwords.Applications.Yandex
ApplicationName
WinSCP
Orcus.Commands.Passwords.Applications.WinSCP
dec_next_char
WinSCPDecrypt
<GetPasswords>d__0
<key>5__1
<accountKey>5__2
UnescapeDataString
<>m__Finally2
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.get_Current
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.Password.RecoveredPassword>.GetEnumerator
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.Password.RecoveredPassword>.Current
<WinSCPDecrypt>b__2_0
Windows
Orcus.Commands.Passwords.Applications.Windows
BerkeleyDb
Orcus.Commands.Passwords.Applications.Thunderbird
<Keys>k__BackingField
get_BaseStream
get_Keys
Reverse
Extract
source
littleEndian
ByteHelper
NumberStyles
ConvertHexStringToByteArray
hexString
PasswordCheck
<EntrySalt>k__BackingField
<Oid>k__BackingField
<Passwordcheck>k__BackingField
dataToParse
get_EntrySalt
set_EntrySalt
get_Oid
set_Oid
get_Passwordcheck
set_Passwordcheck
EntrySalt
Passwordcheck
Thunderbird
GetDirectories
<>9__1_0
<>9__1_1
<>9__1_2
<>9__1_3
<>9__1_4
<>9__1_5
<>9__1_6
SearchOption
<GetPasswords>b__1_0
<GetPasswords>b__1_1
<GetPasswords>b__1_2
<GetPasswords>b__1_3
<GetPasswords>b__1_4
<GetPasswords>b__1_5
<GetPasswords>b__1_6
AesHelper
Orcus.Commands.Passwords.Applications.Thunderbird.Cryptography
SecretKey
AesEncryptor
AesDecryptor
Rfc2898DeriveBytes
Rijndael
CryptoStream
SymmetricAlgorithm
get_BlockSize
DeriveBytes
set_IV
get_KeySize
CreateDecryptor
ICryptoTransform
CryptoStreamMode
CryptographicException
AesDecryptorMain
CreateEncryptor
get_Salt
AesEncryptorMain
Asn1Der
Sequence
Integer
BitString
OctetString
ObjectIdentifier
Asn1DerObject
<Type>k__BackingField
<Lenght>k__BackingField
<Objects>k__BackingField
get_Type
set_Type
get_Lenght
set_Lenght
get_Objects
set_Objects
AppendFormat
Lenght
Objects
MozillaPBE
<GlobalSalt>k__BackingField
<MasterPassword>k__BackingField
<Key>k__BackingField
<IV>k__BackingField
globalSalt
masterPassword
entrySalt
get_GlobalSalt
get_MasterPassword
get_IV
HMACSHA1
SHA1CryptoServiceProvider
Compute
GlobalSalt
MasterPassword
RsaHelper
RSACryptoServiceProvider
Encrypt
RsaEncryptor
RsaDecryptor
RsaKeyManager
_containerName
GetCommandLineArgs
containerName
CspParameters
KeyContainerName
AsymmetricAlgorithm
set_KeySize
set_PersistKeyInCsp
GenKey_SaveInContainer
GetKeyFromContainer
DeleteKeyFromContainer
TripleDesHelper
TripleDESCryptoServiceProvider
set_Mode
CipherMode
set_Padding
PaddingMode
ReadToEnd
DescbcDecryptor
DescbcDecryptorByte
Pidgin
Orcus.Commands.Passwords.Applications.Pidgin
<password>5__1
<reader>5__2
XmlTextReader
XmlDocument
XmlNodeList
XmlReader
get_DocumentElement
XmlElement
XmlNode
get_ChildNodes
get_ItemOf
get_InnerText
Orcus.Commands.Passwords.Applications.Opera
JDownloader
Orcus.Commands.Passwords.Applications.JDownloader
Matches
MatchCollection
RegexOptions
set_Field2
AesCryptoServiceProvider
<Decrypt>b__1_0
CryptoApi
Orcus.Commands.Passwords.Applications.InternetExplorer
KeyStr
PROV_RSA_FULL
CRYPT_VERIFYCONTEXT
ToCharArray
Buffer
BlockCopy
DecryptIePassword
dataList
GCHandle
GCHandleType
AddrOfPinnedObject
ByteArrayToStructure
set_Length
GetUrlHashString
wstrUrl
DoesUrlMatchWithHash
urlHash
ExplorerUrlHistory
_urlHistoryList
_urlHistory
IndexOutOfRangeException
ReleaseComObject
AddHistoryEntry
pocsUrl
pocsTitle
DeleteHistoryEntry
QueryUrl
ClearHistory
DefaultMemberAttribute
STATURLEnumerator
_enumerator
_index
_staturl
enumerator
SetFilter
poszFilter
GetUrlHistory
InternetExplorer
<GetPasswords>d__1
<dataList>5__1
<entry>5__2
<urlHistory>5__3
<>m__Finally3
ADDURL_FLAG
Orcus.Commands.Passwords.Applications.InternetExplorer.Native
ADDURL_ADDTOHISTORYANDCACHE
ADDURL_ADDTOCACHE
IEnumSTATURL
pceltFetched
ppenum
InterfaceTypeAttribute
ComInterfaceType
GuidAttribute
IUrlHistoryStg
AddUrl
DeleteUrl
lpSTATURL
BindToObject
ppvOut
get_EnumUrls
EnumUrls
IUrlHistoryStg2
AddUrlAndNotify
fWriteHistory
poctNotify
punkISFolder
SHFILEINFO
dwAttributes
szDisplayName
szTypeName
SortFileTimeAscendingHelper
IComparer
System.Collections.IComparer.Compare
CompareFileTime
FILETIME
System.Runtime.InteropServices.ComTypes
lpFileTime1
lpFileTime2
SortFileTimeAscending
STATURL
pwcsUrl
pwcsTitle
ftLastVisited
ftLastUpdated
ftExpires
get_URL
get_UrlString
get_LastVisited
get_LastUpdated
get_Expires
UrlString
LastVisited
LastUpdated
Expires
STATURLFLAGS
STATURLFLAG_ISCACHED
STATURLFLAG_ISTOPLEVEL
STATURL_QUERYFLAGS
STATURL_QUERYFLAG_ISCACHED
STATURL_QUERYFLAG_NOURL
STATURL_QUERYFLAG_NOTITLE
STATURL_QUERYFLAG_TOPLEVEL
UrlHistoryClass
Win32api
SHGFI_ATTR_SPECIFIED
SHGFI_ATTRIBUTES
SHGFI_PIDL
SHGFI_DISPLAYNAME
SHGFI_USEFILEATTRIBUTES
FILE_ATTRIBUTRE_NORMAL
SHGFI_EXETYPE
SHGFI_SYSICONINDEX
ILC_COLORDDB
ILC_MASK
ILD_TRANSPARENT
SHGFI_ICON
SHGFI_LARGEICON
SHGFI_SHELLICONSIZE
SHGFI_SMALLICON
SHGFI_TYPENAME
SHGFI_ICONLOCATION
UrlCanonicalize
pszUrl
pszCanonicalized
pcchCanonicalized
get_Capacity
set_Capacity
CannonializeURL
FileTimeToSystemTime
FileTime
SystemTime
FileTimeToDateTime
filetime
SystemTimeToFileTime
lpSystemTime
lpFileTime
get_Year
get_Month
get_Day
get_Hour
get_Minute
get_Second
get_Millisecond
DateTimeToFileTime
datetime
SHGetFileInfo
pszPath
dwFileAttributes
cbSizeFileInfo
shlwapi_URL
URL_DONT_SIMPLIFY
URL_ESCAPE_PERCENT
URL_ESCAPE_SPACES_ONLY
URL_ESCAPE_UNSAFE
URL_PLUGGABLE_PROTOCOL
URL_UNESCAPE
SYSTEMTIME
DayOfWeek
Milliseconds
Minute
Second
Firefox
Orcus.Commands.Passwords.Applications.Firefox
_firefoxCookieFile
_firefoxPath
NullReferenceException
GetEnvironmentVariable
GetProfilePath
GetFile
profilePath
searchTerm
GetFirefoxInstallPath
FirefoxLogins
nextId
logins
disabledHosts
LoginData
encryptedPassword
encryptedUsername
encType
formSubmitURL
hostname
httprealm
passwordField
timeCreated
timeLastUsed
timePasswordChanged
timesUsed
usernameField
FileZilla
Orcus.Commands.Passwords.Applications.FileZilla
<entry>5__1
ReadAllText
StringSplitOptions
CoreFtp
Orcus.Commands.Passwords.Applications.CoreFTP
RijndaelManaged
ToByte
TransformFinalBlock
DecryptCoreFtpPassword
<line>5__1
Chrome
Orcus.Commands.Passwords.Applications.Chrome
MessageBoxCommand
Orcus.Commands.MessageBox
MessageBoxInformation
Orcus.Shared.Commands.MessageBox
get_MessageBoxButtons
MessageBoxButtons
get_Icon
SystemIcon
MessageBoxIcon
CommandSucceed
SystemIconToMessageBoxIcon
LivePerformance
Orcus.Commands.LivePerformance
_cpuPerformanceCounter
PerformanceCounter
_receiveCounters
_sendCounters
PerformanceCounterCategory
GetInstanceNames
Component
LiveData
Orcus.Shared.Commands.LivePerformance
set_Handles
set_Threads
set_Processes
get_Handles
get_HandleCount
ProcessThreadCollection
ReadOnlyCollectionBase
set_ClockSpeed
NextValue
set_InUse
set_UpTimeSeconds
set_UsedMemory
EthernetAdapterData
set_EthernetAdapterData
get_EthernetAdapterData
set_BytesReceive
set_BytesSend
GetCpuSpeedInGHz
LivePerformanceCommand
_livePerformance
LivePerformanceCommunication
StaticPerformanceData
StaticPerformance
GetStaticPerformanceData
OrderBy
IOrderedEnumerable`1
set_MemorySpeed
set_UsedMemorySlots
UInt16
set_TotalMemorySlots
SetMemoryInformation
ManagementClass
GetInstances
get_Properties
PropertyDataCollection
PropertyData
set_MaxClockSpeed
set_ProcessorName
set_Cores
set_LogicalProcessors
set_L1Cache
set_L2Cache
set_L3Cache
SetProcessorInformation
NetworkInterface
System.Net.NetworkInformation
IPInterfaceProperties
EthernetAdapter
NetworkInterfaceType
UnicastIPAddressInformation
set_EthernetAdapters
GetAllNetworkInterfaces
get_NetworkInterfaceType
GetIPProperties
set_AdapterName
get_Description
set_ConnectionType
get_DnsSuffix
set_DnsName
get_UnicastAddresses
UnicastIPAddressInformationCollection
IPAddressInformation
get_Ipv4Address
set_Ipv4Address
get_Ipv6Address
set_Ipv6Address
get_EthernetAdapters
SetEthernetInformation
<>9__2_1
<SetMemoryInformation>b__1_0
managementObject
<SetMemoryInformation>b__1_1
<SetMemoryInformation>b__1_2
<SetProcessorInformation>b__2_0
<SetProcessorInformation>b__2_1
LiveKeyloggerCommand
Orcus.Commands.LiveKeylogger
LiveKeyloggerCommunication
Orcus.Shared.Commands.LiveKeylogger
SendOrPostCallback
<Dispose>b__3_0
<>9__2
<>9__3
<ProcessCommand>b__2
CancellationTokenSource
Orcus.Commands.Internet
_cancelActions
<IsCancellationRequested>k__BackingField
get_IsCancellationRequested
set_IsCancellationRequested
Cancel
Register
IsCancellationRequested
InternetCommand
InternetCommunication
Orcus.Shared.Commands.Internet
MassDownloadManager
_cancellationTokenSource
<IsEnabled>k__BackingField
get_Instance
get_IsEnabled
set_IsEnabled
MassDownloadServer
server
parallelDownloads
CancelAsync
StartDownload
GetDownloadUrl
Instance
IsEnabled
HvncActions
Orcus.Commands.HVNC
_hvncDesktop
WM_LBUTTONDOWN
WM_LBUTTONUP
WM_RBUTTONDOWN
WM_RBUTTONUP
VMW_EXECUTE_MENU
VMW_HILITE_MENU
_lastWindow
<VncMessage>k__BackingField
MK_LBUTTON
HWND_TOP
HWND_TOPMOST
_windowPrintTypes
GWL_STYLE
WindowFromPoint
SetForegroundWindow
RegisterWindowMessage
hvncDesktop
get_VncMessage
set_VncMessage
StyleHaveSizeBorders
DoMouseClick
HvncAction
Orcus.Shared.Commands.HVNC
hvncAction
GetWindowClassFlags
GetWindowInfo
GetAncestor
MouseEvent
windowinfo
hitTest
ncMessage
clientCursorPos
screenCursorPos
MAKELPARAM
SendMessageTimeout
windowHandle
timeout
GetWindowLong
nIndex
SetWindowLong
dwNewLong
lastestWindowFromPoint
VncMessage
WindowPrintTypes
WCF_PAINTMETHOD_NOP
WCF_PAINTMETHOD_PAINT
WCF_PAINTMETHOD_PRINT
WCF_PAINTMETHOD_PRINTWINDOW
WCF_PAINTMETHOD_SKIP_HOOK
WCF_MOUSE_CLIENT_TO_SCREEN
WCF_MOUSE_AUTOCAPTURE
SysCommands
SC_SIZE
SC_MOVE
SC_MINIMIZE
SC_MAXIMIZE
SC_NEXTWINDOW
SC_PREVWINDOW
SC_CLOSE
SC_VSCROLL
SC_HSCROLL
SC_MOUSEMENU
SC_KEYMENU
SC_ARRANGE
SC_RESTORE
SC_TASKLIST
SC_SCREENSAVE
SC_HOTKEY
SC_DEFAULT
SC_MONITORPOWER
SC_CONTEXTHELP
SC_SEPARATOR
SCF_ISSECURE
SC_ICON
SC_ZOOM
WINDOWINFO
rcWindow
rcClient
dwStyle
dwExStyle
dwWindowStatus
cxWindowBorders
cyWindowBorders
atomWindowType
wCreatorVersion
filler
GetAncestorFlags
GetRoot
GetRootOwner
MouseActivate
MA_ACTIVATE
MA_ACTIVATEANDEAT
MA_NOACTIVATE
MA_NOACTIVATEANDEAT
SendMessageTimeoutFlags
SMTO_NORMAL
SMTO_BLOCK
SMTO_ABORTIFHUNG
SMTO_NOTIMEOUTIFNOTHUNG
SMTO_ERRORONEXIT
HitTestValues
HTERROR
HTTRANSPARENT
HTNOWHERE
HTCLIENT
HTCAPTION
HTSYSMENU
HTGROWBOX
HTMENU
HTHSCROLL
HTVSCROLL
HTMINBUTTON
HTMAXBUTTON
HTLEFT
HTRIGHT
HTTOPLEFT
HTTOPRIGHT
HTBOTTOM
HTBOTTOMLEFT
HTBOTTOMRIGHT
HTBORDER
HTOBJECT
HTCLOSE
HTHELP
HTSIZEFIRST
HTSIZELAST
WindowStyles
WS_BORDER
WS_CAPTION
WS_CHILD
WS_CLIPCHILDREN
WS_CLIPSIBLINGS
WS_DISABLED
WS_DLGFRAME
WS_GROUP
WS_HSCROLL
WS_MAXIMIZE
WS_MAXIMIZEBOX
WS_MINIMIZE
WS_MINIMIZEBOX
WS_OVERLAPPED
WS_OVERLAPPEDWINDOW
WS_POPUP
WS_POPUPWINDOW
WS_SIZEFRAME
WS_SYSMENU
WS_TABSTOP
WS_VISIBLE
WS_VSCROLL
HvncCommand
_currentHvncDesktop
_renderWindows
_desktopLock
DisposeSession
HvncCommunication
CreateDesktopInformation
WindowUpdate
WindowInformation
get_CustomName
get_StartExplorer
SystemInformation
get_VirtualScreen
set_AllWindows
AllocHGlobal
set_Handle
PtrToStringAnsi
set_Title
get_NewWindows
get_UpdatedWindows
FreeHGlobal
set_RenderedWindow
get_RenderedWindow
set_RenderedWindowHandle
<>c__DisplayClass5_0
<>c__DisplayClass5_1
windowToRenderHandle
<>9__5_0
<ProcessCommand>b__5_0
HvncDesktop
SW_HIDE
SW_NORMAL
STARTF_USESTDHANDLES
STARTF_USESHOWWINDOW
UOI_NAME
STARTF_USEPOSITION
NORMAL_PRIORITY_CLASS
DESKTOP_CREATEWINDOW
DESKTOP_ENUMERATE
DESKTOP_WRITEOBJECTS
DESKTOP_SWITCHDESKTOP
DESKTOP_CREATEMENU
DESKTOP_HOOKCONTROL
DESKTOP_READOBJECTS
DESKTOP_JOURNALRECORD
DESKTOP_JOURNALPLAYBACK
AccessRights
_stringCollection
StringCollection
_windows
_desktop
<DesktopName>k__BackingField
<HvncActions>k__BackingField
get_DesktopName
set_DesktopName
get_IsOpen
get_DesktopHandle
get_HvncActions
desktopName
GetWindows
DrawDesktop
DrawWindow
GetWindowAtPosition
wparam
caseInsensitive
GetDesktops
SetCurrent
desktop
DesktopWindowsProc
wndHandle
DesktopProc
CheckDisposed
DesktopName
IsOpen
DesktopHandle
<>9__40_0
<GetWindows>b__40_0
<>c__DisplayClass43_0
<DrawWindow>b__0
<>c__DisplayClass47_0
<Exists>b__0
HvncHelper
WindowHandles
GetExactHandle
baseHandle
WindowElement
<Rectangle>k__BackingField
rectangle
get_Rectangle
RenderWindow
<WindowInformation>k__BackingField
windowInformation
get_WindowInformation
ApplyWindowInformation
hObjectSource
CreateCompatibleBitmap
ReleaseDC
GetWindowDC
NewGuid
get_Jpeg
FromFile
Render
Window
HostsFileCommand
Orcus.Commands.HostsFile
HostsFileCommunication
Orcus.Shared.Commands.HostsFile
WriteFile
BlockUserInput
Orcus.Commands.FunActions
FromSeconds
seconds
MIN_ALL_UNDO
SPI_SETDESKWALLPAPER
SPIF_UPDATEINIFILE
SPIF_SENDWININICHANGE
RestoreAllScreens
get_Bmp
SetDesktopWallpaper
newWallpaper
ToggleDesktopIcons
get_DeviceName
RotateScreen
degrees
SwapMouseButtons
RestoreMouseButtons
Centered
Stretched
DesktopWallpaper
FromStream
DesktopWallpaperStyle
Orcus.Shared.Commands.FunActions
FunActionsCommand
FunActionsCommunication
CommandFailed
ImageUtilities
TakeFullScreenshot
RotateFlip
RotateFlipType
get_WorkingArea
RotateScreenshotScreenByScreen
KeyboardLayout
SetKeyboardLayout
layoutToLoad
SwitchTo
layoutId
HWND_BROADCAST
WM_SYSCOMMAND
TurnOff
System.Timers
set_Interval
ElapsedEventHandler
add_Elapsed
currentCursorPosition
currentTime
get_TotalMilliseconds
<Hold>b__0
ElapsedEventArgs
Rotate
ENUM_CURRENT_SETTINGS
CDS_UPDATEREGISTRY
CDS_TEST
DM_DISPLAYORIENTATION
DM_PELSWIDTH
DM_PELSHEIGHT
ToInt16
pRotateDegrees
SwapExtents
pelHeight
pelWidth
RotateResult
DISP_CHANGE_SUCCESSFUL
DISP_CHANGE_BADMODE
DISP_CHANGE_FAILED
DISP_CHANGE_RESTART
RotateDegrees
Degrees0
Degrees90
Degrees180
Degrees270
Taskbar
SW_SHOW
VistaStartMenuCaption
vistaStartMenuWnd
set_IsVisible
SetVisibility
ProcessThread
GetVistaStartMenuWnd
taskBarWnd
MyEnumThreadWindowsProc
IsVisible
WindowsModules
SetDesktopVisibility
visible
SetClockVisibility
SetTaskManager
enable
FileDownloader
Orcus.Commands.FileExplorer
_fileStream
_tempDownloadFile
_uploadInfo
UploadInfo
Orcus.Shared.Commands.FileExplorer
_receivedBytes
uploadInfo
add_ResponseBytes
remove_ResponseBytes
get_Checksum
CalculateMd5HashFromFileToString
MoveTo
Response
FileExplorerCommunication
FileExplorerCommand
_currentFileDownloader
FileExplorerShortcut
ShortcutType
DriveType
PathContent
GetPathRoot
get_IsReady
get_RootDirectory
get_DriveType
FileExplorerEntry
set_Entries
get_Entries
get_Parent
get_ToolBase
IToolBase
ExecuteFileAnonymously
Packages
CreatePackage
CalculateMd5HashFromFile
get_ServerConnection
get_SendBufferSize
Ceiling
get_File
get_Package
ResponseError
<>9__3_1
EntryType
<ProcessCommand>b__3_0
<ProcessCommand>b__3_1
ResponseBytesEventArgs
<Bytes>k__BackingField
get_Bytes
EventLogCommand
Orcus.Commands.EventLog
EventLog
EventLogEntry
Orcus.Shared.Commands.EventLog
EventLogCommunication
EventLogEntryCollection
LinqExtensions
TakeLast
GetSecurityEventLog
OrderByDescending
get_EntryType
EventLogEntryType
set_EntryType
get_EventID
set_EventId
set_Source
get_TimeGenerated
get_Timestamp
<ProcessCommand>b__0_1
ConsoleCommand
Orcus.Commands.Console
_cmdProcess
_currentConnectionInfo
_standardInput
get_HasExited
CancelErrorRead
CancelOutputRead
ConsoleCommunication
Orcus.Shared.Commands.Console
GetCultureInfo
get_TextInfo
TextInfo
get_OEMCodePage
GetEncoding
get_StartInfo
set_CreateNoWindow
set_FileName
set_RedirectStandardOutput
set_RedirectStandardInput
set_RedirectStandardError
set_UseShellExecute
set_StandardErrorEncoding
set_StandardOutputEncoding
DataReceivedEventHandler
add_OutputDataReceived
add_ErrorDataReceived
get_StandardInput
set_AutoFlush
BeginOutputReadLine
BeginErrorReadLine
CmdProcess_OutputDataReceived
ComputerInformation
Orcus.Commands.ComputerInformation
Orcus.Shared.Commands.ComputerInformation
get_VistaOrHigher
set_SystemInformation
OperatingSystemInformation
set_HardwareInformation
HardwareInformation
set_NetworkInformation
NetworkInformation
set_BiosInformation
BiosInformation
set_SoftwareInformation
SoftwareInformation
set_LogicalDrives
LogicalDrive
get_ElapsedMilliseconds
set_ProcessTime
GetInformation
GetLogicalDrives
BootMode
set_NtVersion
set_Platform
set_SystemDirectory
set_ClrVersion
get_UserDomainName
set_UserDomainName
set_SystemPageSize
get_BootMode
set_BootMode
set_FriendlyName
get_FriendlyName
set_InternalName
get_InternalName
set_Architecture
set_AdminPasswordStatus
set_Workgroup
set_Manufacturer
set_Model
set_Owner
set_TotalPhysicalMemory
set_ProductKey
GetOperatingSystemInformation
set_ProductId
MinValue
set_ReleaseDate
set_SupportedLanguages
GetBiosInformation
ProcessorInfo
set_Screens
get_ProcessorCount
set_ManufactureId
set_ProcessorInfo
set_L2CacheSize
set_L3CacheSize
set_DeviceId
set_ProcessorId
set_ProcessorType
set_ExternalClockSpeed
set_Revision
VideoCardInfo
set_MaxRefreshRate
set_VideoArchitecture
set_VideoMemoryType
set_VideoModeDescription
set_VideoProcessor
set_VideoCardInfo
GetHardwareInformation
GetHostName
IpAddress
set_Proxy
IWebProxy
DownloadString
set_PublicIp
set_MacAddress
get_OperationalStatus
OperationalStatus
get_AddressPreferredLifetime
GetPhysicalAddress
PhysicalAddress
WebException
GetNetworkInformation
set_AntiVirusPrograms
set_Firewalls
set_InstalledPrograms
GetSoftwareInformation
ArchitectureToString
AdminPasswordStatusToString
status
ProcessorTypeToString
VideoArchitectureToString
VideoMemoryTypeToString
GetLanIp
VistaOrHigher
GetValue`1
<>9__5_7
<>9__6_0
<>9__6_1
<>9__6_2
<>9__9_0
<>9__10_0
<>9__10_1
set_IsReady
set_DriveType
get_AvailableFreeSpace
set_AvailableFreeSpace
get_DriveFormat
set_DriveFormat
set_RootDirectory
get_TotalSize
set_TotalSize
get_VolumeLabel
set_VolumeLabel
<GetLogicalDrives>b__3_0
<GetBiosInformation>b__5_7
get_Primary
set_IsPrimary
set_Resolution
get_BitsPerPixel
set_BitsPerPixel
set_DeviceName
<GetHardwareInformation>b__6_0
ToDecimal
op_Division
<GetHardwareInformation>b__6_1
<GetHardwareInformation>b__6_2
set_AddressFamily
<GetNetworkInformation>b__9_0
<GetSoftwareInformation>b__10_0
mObject
<GetSoftwareInformation>b__10_1
regKey
<GetOperatingSystemInformation>b__0
computerSystemManagmentObject
<GetOperatingSystemInformation>b__1
<GetOperatingSystemInformation>b__2
<GetOperatingSystemInformation>b__3
<GetOperatingSystemInformation>b__4
<GetOperatingSystemInformation>b__5
<GetOperatingSystemInformation>b__6
<GetOperatingSystemInformation>b__7
biosManagmentObject
<GetBiosInformation>b__0
<GetBiosInformation>b__1
<GetBiosInformation>b__2
<GetBiosInformation>b__3
ManagementDateTimeConverter
ToDateTime
<GetBiosInformation>b__4
<GetBiosInformation>b__5
TrimEnd
<GetBiosInformation>b__6
<>c__DisplayClass6_0
processorManagementObject
<GetHardwareInformation>b__3
<GetHardwareInformation>b__4
<GetHardwareInformation>b__5
<GetHardwareInformation>b__6
<GetHardwareInformation>b__7
<GetHardwareInformation>b__8
<GetHardwareInformation>b__9
<GetHardwareInformation>b__10
<GetHardwareInformation>b__11
<GetHardwareInformation>b__12
<GetHardwareInformation>b__13
CodeCommand
Orcus.Commands.Code
CodeCommunication
Orcus.Shared.Commands.Code
CompilerParameters
CompilerResults
CompilerError
VBCodeProvider
Microsoft.VisualBasic
IDictionary`2
CSharpCodeProvider
Microsoft.CSharp
set_GenerateInMemory
set_GenerateExecutable
get_ReferencedAssemblies
CodeDomProvider
CompileAssemblyFromSource
get_Errors
CompilerErrorCollection
get_HasErrors
get_Line
get_ErrorText
get_CompiledAssembly
get_IsWarning
ClientActionCommand
Orcus.Commands.ClientAction
ClientActionCommunication
Orcus.Shared.Commands.ClientAction
AudioCommand
Orcus.Commands.Audio
AudioCommunication
Orcus.Shared.Commands.Audio
SoundOutDevice
MMDeviceEnumerator
CSCore.CoreAudioAPI
MMDevice
PlayAudioInformation
WasapiOut
CSCore.SoundOut
get_IsSupportedOnCurrentPlatform
EnumAudioEndpoints
MMDeviceCollection
DataFlow
DeviceState
set_Device
DirectSoundDeviceEnumerator
CSCore.DirectSound
EnumerateDevices
DirectSoundDevice
get_SoundOutId
DirectSoundOut
get_AudioData
DmoMp3Decoder
CSCore.Codecs.MP3
ISoundOut
IWaveSource
PlaybackStoppedEventArgs
add_Stopped
GetDefaultAudioEndpoint
playInformation
soundOut
waveSource
memoryStream
get_DeviceID
<>c__DisplayClass0_1
<>c__DisplayClass0_2
defaultDevice
set_IsDefault
enumAudioEndpoint
<>9__0_5
<ProcessCommand>b__0_5
AudioVolumeControlCommand
Orcus.Commands.AudioVolumeControl
_deviceList
_listsLock
AudioEndpointVolume
AudioVolumeControlCommunication
Orcus.Shared.Commands.AudioVolumeControl
AudioDevice
AudioEndpointVolumeChannel
ComObject
CSCore.Win32
ToSingle
FromDevice
set_MasterVolumeLevelScalar
get_Channels
set_VolumeScalar
GetAudioDevices
AudioEndpointType
mmDeviceCollection
defaultDeviceId
audioEndpointType
GetAudioDevice
deviceId
channelIndex
get_ChannelIndex
AudioChannel
set_ChannelIndex
get_VolumeScalar
<GetAudioDevices>b__4_0
<GetAudioDevices>d__4
<>3__mmDeviceCollection
<>3__defaultDeviceId
<>3__audioEndpointType
<>7__wrap3
<>7__wrap4
get_MasterVolumeLevelScalar
set_CurrentVolume
set_AudioEndpointType
set_AudioChannels
<>m__Finally4
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.get_Current
System.Collections.Generic.IEnumerable<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.GetEnumerator
System.Collections.Generic.IEnumerator<Orcus.Shared.Commands.AudioVolumeControl.AudioDevice>.Current
<GetAudioDevice>b__0
ActiveConnectionsCommand
Orcus.Commands.ActiveConnections
ActiveConnection
Orcus.Shared.Commands.ActiveConnections
Connections
MIB_TCP_STATE_ESTAB
MIB_TCP_STATE_TIME_WAIT
MIB_TCP_STATE_LISTEN
MIB_TCP_STATE_CLOSE_WAIT
GetUdpConnections
GetTcpConnections
IntToIp
ConvertToState
ConnectionState
GetProcessTitle
set_ProtocolName
ProtocolName
set_LocalAddress
set_LocalPort
set_RemoteAddress
set_RemotePort
<GetUdpConnections>b__4_0
<GetTcpConnections>b__5_0
CommandSelector
Orcus.CommandManagement
<CommandCollection>k__BackingField
FactoryCommand
get_FactoryCommandType
get_CommandCollection
ForEach
Current_CommandLoaded
ExecuteCommand
CommandCollection
<Dispose>b__4_0
get_Identifier
<ExecuteCommand>b__0
<ExecuteCommand>b__1
<ServerConnection>k__BackingField
<ToolBase>k__BackingField
<FrameworkVersion>k__BackingField
FrameworkVersion
Orcus.Plugins.IConnectionInfo.get_ServerConnection
get_FrameworkVersion
CommandWarning
packageCompression
ToolBase
Orcus.Plugins.IConnectionInfo.ServerConnection
_executionLockObject
_filePushRequests
_serverConnection
set_ServerConnection
entryName
dataMode
PushData
GetFileName
InternalPushFile
isCsvData
CheckRunning
PushRequests
GetFreePushFileName
<CheckRunning>b__13_0
<>c__DisplayClass14_1
autoResetEvent
CS$<>8__locals1
<PushRequests>b__0
<PushRequests>b__1
<PushRequests>b__2
FilePushRequest
<EntryName>k__BackingField
<DataMode>k__BackingField
<FileName>k__BackingField
<IsCsvData>k__BackingField
get_EntryName
set_EntryName
get_DataMode
set_DataMode
get_IsCsvData
set_IsCsvData
EntryName
FileName
IsCsvData
StaticCommandExecuter
<StaticCommands>k__BackingField
get_StaticCommands
StaticCommands
<ServicePipe>k__BackingField
get_ServicePipe
ServicePipe
<PrivateImplementationDetails>
4D53392A6A24D5E801ADA14E79B43F9BEBB79150
65976E8BC1E21014EFB963E7F0E54D344F1B81A5
EE6001A9EFFBC3E336D7A05124DA53EF8D648CE1
__StaticArrayInitTypeSize=10
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=48
AssemblyLoader
Costura
nullCache
assemblyNames
symbolNames
CS$<>9__CachedAnonymousMethodDelegate1
ResolveEventHandler
CultureToString
culture
AssemblyName
GetAssemblies
GetName
get_CultureInfo
ReadExistingAssembly
destination
DeflateStream
GetExecutingAssembly
LoadStream
fullname
TryGetValue
resourceNames
ReadStream
ToLowerInvariant
ReadFromEmbeddedResources
requestedAssemblyName
get_Flags
AssemblyNameFlags
ResolveAssembly
assemblyName
ResolveEventArgs
<Attach>b__0
add_AssemblyResolve
Attach
ProcessedByFody
AssemblyConfigurationAttribute
AssemblyFileVersionAttribute
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
DebuggableAttribute
DebuggingModes
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
14.0.0.0
$3C374A42-BAE4-11CF-BF7D-00AA006946EE
$3C374A41-BAE4-11CF-BF7D-00AA006946EE
$AFA0DC11-C313-11D0-831A-00C04FD5AE38
$3C374A40-BAE4-11CF-BF7D-00AA006946EE
1.0.0.0
WrapNonExceptionThrows
$3601a898-0fe1-4710-ac30-2e6c417f46bd
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8"?><assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING