Analysis Date2013-09-15 14:07:12
MD57d18b9eb5b6be47f830ddb859038b605
SHA161d219c935ecde1c94d7e50019a868dd191faf28

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Section.text md5: d8617ad73c61100ebf73473b04f8a2cf sha1: f84a3bea4df9d44fa590887a49ddd80f5e88bef2 size: 81408
Section.rsrc md5: 085ece4575b8e2900cf89e46d5bc3da0 sha1: 2d0686f0e18f3381a399705563beb7561a4cbbcb size: 1024
Section.reloc md5: 030d224a7340e8d9cc25cd80f0aa5a0b sha1: 484e8e3b5e2c7de38e376f85878b74d4ba3df43c size: 512
Timestamp2013-08-20 02:18:58
Pdb pathc:\Users\Sentra user\Dropbox\Aplicacion\Aplicacion\Aplicacion\obj\Debug\Aplicacion.pdb
VersionLegalCopyright: Copyright (C)
Assembly Version: 1.0.0.0
InternalName: Aplicacion.exe
FileVersion: 1.0.0.0
ProductName: .Net
ProductVersion: 1.0.0.0
FileDescription: Aplicacion
OriginalFilename: Aplicacion.exe
PackerMicrosoft Visual C# v7.0 / Basic .NET
PEhash099dd9f983b3a3659461db4513d7559b217a4a62
AVavgILAgent

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CLASSES_ROOT\netfile\shell\runas\ ➝
"%1" %*\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shellex\PropertySheetHandlers\ShimLayer Property Page\ ➝
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shell\runas\ ➝
"%1" %*\\x00
RegistryHKEY_CLASSES_ROOT\.\\xe0\\xb5\\xe1\\x85\\xe0\\xb5\ ➝
\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shell\open\EditFlags ➝
NULL
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shellex\DropHandler\ ➝
{86C86720-42A0-1069-A2E8-08002B30309D}\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shellex\PropertySheetHandlers\PifProps\ ➝
{86F19A00-42A0-1069-A2E9-08002B30309D}\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shell\open\command\ ➝
"%1" %*\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shellex\DropHandler\ ➝
{86C86720-42A0-1069-A2E8-08002B30309D}\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit ➝
C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\Microsoft.NET\Framework\netfxsbs10.\\xe0\\xb5\\xe1\\x85\\xe0\\xb5 start\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shell\runas\command\ ➝
"%1" %*\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shell\open\EditFlags ➝
NULL
RegistryHKEY_CLASSES_ROOT\.\\xe0\\xb5\\xe1\\x85\\xe0\\xb5\PersistentHandler\ ➝
{098f2470-bae0-11cd-b579-08002b30bfeb}\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shell\runas\command\ ➝
"%1" %*\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shellex\PropertySheetHandlers\PifProps\ ➝
{86F19A00-42A0-1069-A2E9-08002B30309D}\\x00
RegistryHKEY_CLASSES_ROOT\.net\PersistentHandler\ ➝
{098f2470-bae0-11cd-b579-08002b30bfeb}\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\ ➝
Aplicaci\\xc3\\xb3n\\x00
RegistryHKEY_CLASSES_ROOT\.net\ ➝
netfile\\x00
RegistryHKEY_CLASSES_ROOT\netfile\shell\open\command\ ➝
"%1" %*\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Security ➝
C:\WINDOWS\Microsoft.NET\Framework\Framework.net\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\shellex\PropertySheetHandlers\ShimLayer Property Page\ ➝
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}\\x00
RegistryHKEY_CLASSES_ROOT\netfile\DefaultIcon\ ➝
%SystemRoot%\System32\shell32.dll,-154\\x00
RegistryHKEY_CLASSES_ROOT\netfile\ ➝
Componente para aplicaciones Microsoft .NET\\x00
RegistryHKEY_CLASSES_ROOT\\\xe0\\xb5\\xe1\\x85\\xe0\\xb5file\DefaultIcon\ ➝
"%1"\\x00
Creates FilePIPE\ROUTER
Creates FilePIPE\wkssvc
Creates FileC:\WINDOWS\Microsoft.NET\Framework\netfxsbs10.\\xe0\\xb5\\xe1\\x85\\xe0\\xb5
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\Microsoft.NET\Framework\Framework.net
Creates Process"C:\WINDOWS\Microsoft.NET\Framework\Framework.net" bautiza
Creates MutexSantuario_12-
Creates MutexGlobal\.net clr networking
Creates MutexGlobal\CLR_RESERVED_MUTEX_NAME
Starts ServiceRASMAN

Process
↳ "C:\WINDOWS\Microsoft.NET\Framework\Framework.net" bautiza

Creates FilePIPE\lsarpc

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 832

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1084

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LogonTime ➝
NULL
Creates FileWMIDataDevice

Process
↳ Pid 1868

Process
↳ Pid 1104

Network Details:

DNSlb.wordpress.com
Type: A
66.155.11.238
DNSlb.wordpress.com
Type: A
76.74.254.120
DNSlb.wordpress.com
Type: A
72.233.2.58
DNSlb.wordpress.com
Type: A
72.233.69.6
DNSlb.wordpress.com
Type: A
76.74.254.123
DNSlb.wordpress.com
Type: A
66.155.9.238
DNSblogspot.l.googleusercontent.com
Type: A
173.194.41.106
DNSblogspot.l.googleusercontent.com
Type: A
173.194.41.107
DNSblogspot.l.googleusercontent.com
Type: A
173.194.41.108
DNSsecretosytrucos.wordpress.com
Type: A
DNSdarkvaticano.blogspot.com
Type: A
HTTP GEThttp://secretosytrucos.wordpress.com/2013/08/10/netflix/
User-Agent:
HTTP GEThttp://darkvaticano.blogspot.com/
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 66.155.11.238:80
Flows TCP192.168.1.1:1032 ➝ 173.194.41.106:80

Raw Pcap
0x00000000 (00000)   47455420 2f323031 332f3038 2f31302f   GET /2013/08/10/
0x00000010 (00016)   6e657466 6c69782f 20485454 502f312e   netflix/ HTTP/1.
0x00000020 (00032)   310d0a48 6f73743a 20736563 7265746f   1..Host: secreto
0x00000030 (00048)   73797472 75636f73 2e776f72 64707265   sytrucos.wordpre
0x00000040 (00064)   73732e63 6f6d0d0a 436f6e6e 65637469   ss.com..Connecti
0x00000050 (00080)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x00000060 (00096)   0d0a                                  ..

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a206461 726b7661 74696361   Host: darkvatica
0x00000020 (00032)   6e6f2e62 6c6f6773 706f742e 636f6d0d   no.blogspot.com.
0x00000030 (00048)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x00000040 (00064)   702d416c 6976650d 0a0d0a6e 65637469   p-Alive....necti
0x00000050 (00080)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x00000060 (00096)   0d0a                                  ..


Strings
$0aeaba5c-66eb-4909-a5c3-b31612e152ab
1.0.0.0
11.0.0.0
	"	'	,	7	S	h	
accion
adanString
AddFireWall
AddressFamily
AddSeconds
AllocHGlobal
aplicacion
Aplicacion
Aplicacion.exe
Aplicacion.Hijo
Aplicacion.Identidad.Hijo
Aplicacion.Purgatorio
Aplicacion.Santificacion
Aplicacion.Santuario
Aplicacion.Trinidad.Espiritu
Aplicacion.Trinidad.Hijo
Application
ApplicationSettingsBase
appString
archivo
ArrayList
Assembly
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyCopyrightAttribute
AssemblyCultureAttribute
AssemblyDescriptionAttribute
AssemblyFileVersionAttribute
AssemblyName
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyVersionAttribute
AsyncCallback
aunBautizado
avicap32.dll
azarDigitos
bajarArchivo
Bautiza
Bautizar
BautizarComputador
bautizarWithWinRar
bautizo
BeginChangeDir
BeginClose
BeginGetFileList
BeginGetFileSize
BeginInvoke
BeginLogin
BeginMakeDir
BeginUpload
BeginUploadDirectory
BinaryMode
binMode
Bitmap
botarDeEjecucion
botWasHere
buffer
BUFFER_SIZE
callback
CamHandle
CancelEventArgs
capCreateCaptureWindowA
capGetDriverDescriptionA
capturaImagen
CargaInformacion
cbName
cchData
.cctor
Centered
ChangeDir
ChangeDirCallback
CheckKey
chequeterePath
cierraProceso
CipherMode
ClassesRoot
cleanup
cliente
clientSocket
Clipboard
CloseCallback
comandoCam
command
Compare
CompilationRelaxationsAttribute
CompilerGeneratedAttribute
ComputeHash
ComVisibleAttribute
Concat
CONECTADO
Connect
Contains
Control
Convert
copiar
CopyFromScreen
Copyright (C)
corazon
Corazon
_CorExeMain
CorreAplicacion
costilla
CreaEvaDesdeCostilla
crearFrameWork
Create
createDataSocket
CreateDecryptor
CreateEncryptor
CreateSubKey
creoEnDios
CurrentUser
c:\Users\Sentra user\Dropbox\Aplicacion\Aplicacion\Aplicacion\obj\Debug\Aplicacion.pdb
DateTime
DayOfWeek
DebuggableAttribute
DebuggingModes
Default
defaultInstance
Delete
deleteFile
Desencriptar
desencriptaSimple
desifra
destinatario
Detener
DialogResult
Dictionary`2
directorio
Directory
DirectoryInfo
dirName
Dispose
DllImportAttribute
dosEnUno
Double
DownloadFile
)d+.-r.
DriveInfo
DriveType
dwDisplayType
dwScope
dwStyle
dwType
dwUsage
ejecuta
ejecutaAppSana
ejecutaAppSanaJoineada
ejecutable
ejecutaFrameWork
Ejecutar
ejecutor
elejidos
EmptyClipboard
EnableVisualStyles
Encoding
Encripta
Encriptar
encriptaSimple
EndInvoke
EndPoint
EndsWith
Enumerator
EnumWindows
EnumWindowsProc
EnumWindowsProcDelegate
enviarComando
enviarMensaje
Environment
Equals
escanearRed
escuchar
escucho
esFakeExe
esFrameWorkdotNet
esLaMismaVersion
esMenor
esNetUSerNet
esPuta
EsPuta
estaAppEstaConCopiaFakeExe
estado
estadoApp
EstadoApp
estaEnWindir
estaVivo
esteAppEstaBautizado
esteEquipoEstaBautizado
estoyBautizado
estoyEnUnPendrive
esUnEjecutableDeInicio
esWinRarExe
esWinrarFake
Exception
existeArchivo
existeDirectorio
existeOtroSantoEnElCielo
existeWinRarDotNet
Exists
extencion
extraeAppSanaFromFakeExe
extraeFrameWorkFromFile
fakeExe
FakeExe
FileAttributes
FileInfo
FileMode
fileName
FileStream
FileSystemInfo
Finalize
FindWindow
Framework.net
Framework.net.Properties
Framework.net.Trinidad.Hijo
Framework.net.Trinidad.Hijo.Espiritu
Framework.net.Trinidad.Padre.Purgatorio
FreeHGlobal
FromBase64String
FromImage
ftpClie
FtpClient
ftpComando
FtpException
fullEnte
fuWinIni
GeneratedCodeAttribute
Genesis
geroglifico
get_AddressList
get_AllScreens
getAlma
get_Aplicacion
getAplicacionInocente
getApostolName
get_ASCII
GetAttributes
get_BaseStream
get_BinaryMode
get_Bounds
get_Build
GetBytes
get_Canal
get_Capacity
get_Chars
get_Cielo
getClave
get_Clave
get_Client
get_CodeBase
GetCommandLineArgs
get_Connected
get_Count
get_CreationTime
get_Current
GetCurrent
get_DayOfWeek
get_Default
GetDesktopWindow
getDios
GetDirectories
get_DirectoryName
GetDirectoryName
GetDrives
get_DriveType
GetEnumerator
GetEnvironmentVariable
get_EsPuta
get_EstadoApp
GetExecutingAssembly
get_FakeExe
GetFileList
GetFileListCallback
GetFileListMaskCallback
get_FileName
GetFileName
GetFiles
GetFileSize
GetFileSizeCallback
GetFolderPath
get_FullName
GetFullPath
get_Handle
get_Height
get_Hogar
GetHostName
get_Hour
get_Id
GetImage
getInfo
get_IpLocal
get_IsReady
get_Item
get_Jpeg
get_KeySimple
get_LastAccessTime
get_LastWriteTime
get_Left
get_Length
GetLocaleInfo
get_LocalEndPoint
GetLogicalDrives
get_MainModule
get_MainWindowTitle
get_Major
getMarca
getMensaje
get_Message
get_MiDios
get_MiNameApp
get_Minor
get_Minute
get_Minutes
get_Modules
get_Name
GetName
getNombre
get_Nombre
getNombreFem
getNombreFromMSN
get_NombreSanto
get_Now
get_OSVersion
get_Pais
get_Parametros
GetParent
get_Password
get_PathFrameWorkDotNet
getPaths
getPathWinRar
get_Peso
get_Plegaria
get_Port
GetProcesses
get_ProcessName
get_PROXY
get_Puerta
get_Puerto
get_PuertoHot
get_Puntaje
get_RemotePath
get_RemotePort
get_Rezo
getRunList
get_RunRuta
getSala
get_SALVADOR
getSanto
get_SanuFloodHilo
get_Second
get_Server
get_Servidor
get_ServidorHot
get_Sistema
get_Size
get_StackTrace
get_StartInfo
get_StartTime
GetStream
GetString
GetSubKeyNames
get_Timeout
get_Top
GetTypeFromHandle
get_Unico
get_Username
get_UserName
get_UTF8
get_Valor
GetValue
GetValueNames
get_VerboseDebugging
get_Verdad
get_Visible
get_Width
get_Windir
GetWindow
GetWindowLongA
GetWindowLongPtr
GetWindowText
GetWindowThreadProcessId
Graphics
GuidAttribute
GW_CHILD
GW_HWNDFIRST
GW_HWNDLAST
GW_HWNDNEXT
GW_HWNDPREV
GWL_EXSTYLE
GW_OWNER
hablar
HashAlgorithm
hwndParent
IAsyncResult
IComparer`1
ICryptoTransform
idealApp
identificacion
IDisposable
IEnumerator
ImageFormat
imagen
imagenPath
InAttribute
IndexOf
infectaRED
infectarRed
INGRESANDO
inicia
iniciaEscaneoRED
INICIO
innerException
IntPtr
Invierte
Invoke
IPAddress
IPEndPoint
IPHostEntry
iplocal
ipLocal
IpLocal
IsDigit
IsRunning
IsWindowVisible
kernel32.dll
keyActivo
keybuffer
keysimple
KeySimple
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
LayoutKind
lazaro
LCType
leerArchivo
leerDios
List`1
listenUsb
Locale
LOCALE_SABBREVCTRYNAME
LOCALE_SYSTEM_DEFAULT
LocalMachine
loggedin
LoginCallback
lParam
lpBuffer
lpBufferSize
lpcCount
lpClassName
lpComment
lpdwProcessId
lpEnumFunc
lphEnum
lpLCData
lpLocalName
lpNetResource
lpProvider
lpRemoteName
lpszName
lpszVer
lpszWindowName
lpvParam
lpWindowName
lujuria
MakeDir
MakeDirCallback
makeFrameWork
Marshal
MarshalAsAttribute
masificaByPath
MD5CryptoServiceProvider
meHablasAMi
mensaje
_mensaje
message
MessageBox
MessageBoxButtons
MessageBoxIcon
method
$$method0x6000142-1
Microsoft.Win32
miDios
MiDios
miNameApp
MiNameApp
mision
_mMutexOwned
<Module>
MoveNext
mpr.dll
mscoree.dll
mscorlib
mueveTmp
MulticastDelegate
NativeWin32
nCmdShow
NETRESOURCE
NetworkStream
nHeight
nIndex
nMaxCount
nombre
_nombre
Nombre
nombreSanto
NombreSanto
notificarMensaje
NotImplementedException
Nuestro
nuevoApostol
NuevoUserinit
nWidth
obedecer
object
Object
observar
obtenerWebCam
OpenRead
OpenSubKey
OpenText
op_Equality
OperatingSystem
op_GreaterThan
op_Inequality
oracion
OSVersionNoRevision
otroNombre
OutAttribute
PaddingMode
pantallazo
parametros
Parametros
password
Password
PathFrameWorkDotNet
pathInicialFrameWorkDotNet
pathWinRar
Pecado
Pecador
pecados
PictureBox
PixelFormat
plegaria
Plegaria
pobrefile
pobrePathFile
Poseer
<PrivateImplementationDetails>{845EA18B-5CC2-45B4-8554-A1FF0BFA3F78}
procesos
Process
ProcessModule
ProcessModuleCollection
ProcessStartInfo
ProcessWindowStyle
ProtocolType
PtrToStructure
puerta
Puerta
puerto
Puerto
puertoHot
PuertoHot
puntaje
_puntaje
Puntaje
Random
ReadByte
readLine
ReadLine
ReadOnlyCollectionBase
readResponse
ReadWeb
Receive
recibir
Rectangle
recurse
registro
Registry
RegistryKey
RegistryValueKind
ReleaseMutex
@.reloc
remotePath
RemotePath
RemotePort
Remove
Replace
Resolve
RESOURCE_CONNECTED
RESOURCE_CONTEXT
RESOURCEDISPLAYTYPE_DIRECTORY
RESOURCEDISPLAYTYPE_DOMAIN
RESOURCEDISPLAYTYPE_FILE
RESOURCEDISPLAYTYPE_GENERIC
RESOURCEDISPLAYTYPE_GROUP
RESOURCEDISPLAYTYPE_NDSCONTAINER
RESOURCE_DISPLAYTYPE_NET
RESOURCEDISPLAYTYPE_NETWORK
RESOURCEDISPLAYTYPE_ROOT
RESOURCEDISPLAYTYPE_SERVER
RESOURCEDISPLAYTYPE_SHARE
RESOURCEDISPLAYTYPE_SHAREADMIN
RESOURCEDISPLAYTYPE_TREE
RESOURCE_GLOBALNET
RESOURCE_RECENT
RESOURCE_REMEMBERED
RESOURCE_SCOPE_NET
RESOURCETYPE_ANY
RESOURCETYPE_DISK
RESOURCE_TYPE_NET
RESOURCETYPE_PRINT
RESOURCETYPE_RESERVED
RESOURCEUSAGE_ALL
RESOURCEUSAGE_ATTACHED
RESOURCEUSAGE_CONNECTABLE
RESOURCEUSAGE_CONTAINER
RESOURCE_USAGE_NET
RESOURCEUSAGE_NOLOCALDEVICE
RESOURCEUSAGE_SIBLING
responde
responder
respuesta
result
resultCode
resume
`.rsrc
runApp
runAppAux
runAppByPeso
runAppByPuntaje
runFile
runRuta
RunRuta
runSanFrameWork
RuntimeCompatibilityAttribute
RuntimeTypeHandle
salvador
SALVADOR
sanCam
SantaClase
sanTelnet
santoEnLinea
SantoIerrece
santosSiempreVivos
santoX
sanuFloodHilo
SanuFloodHilo
SC_CLOSE
Screen
SearchOption
SeekOrigin
semilla
sendCommand
sender
SendKeys
SendMessage
SendWait
sereYo
server
Server
servidor
Servidor
servidorHot
ServidorHot
servidorStream
set_Aplicacion
set_Arguments
SetAttributes
set_BinaryMode
set_Canal
set_Cielo
set_Clave
SetCompatibleTextRenderingDefault
set_CreateNoWindow
seteaApp
set_EnableRaisingEvents
set_ErrorDialog
set_EsPuta
set_EstadoApp
set_FakeExe
set_FileName
SetForegroundWindow
set_Hogar
set_IpLocal
set_Key
setMensaje
set_MiDios
set_MiNameApp
set_Mode
setNewFrameWorkDotNet
setNombre
set_Nombre
set_NombreSanto
set_Padding
set_Pais
set_Parametros
set_Password
set_PathFrameWorkDotNet
set_Peso
set_Plegaria
set_Port
set_PROXY
set_Puerta
set_Puerto
set_PuertoHot
set_Puntaje
set_RemotePath
set_RemotePort
set_Rezo
set_RunRuta
setSala
set_SALVADOR
set_SanuFloodHilo
set_Server
set_Servidor
set_ServidorHot
set_Sistema
set_StartInfo
setTaldo
set_Timeout
SettingChangingEventArgs
SettingChangingEventHandler
Settings
SettingsBase
SettingsSavingEventHandler
set_Unico
set_Username
set_UseShellExecute
set_Valor
SetValue
set_Verb
set_VerboseDebugging
set_Verdad
set_Visible
set_WindowStyle
showDir
ShowWindow
simpleKey
sistema
Sistema
SizeOf
Socket
SocketFlags
SocketType
soploDeVida
soyUnApostol
soyUnSiervo
soyWinRAR
SpecialFolder
SPIF_SENDWININICHANGE
SPIF_UPDATEINIFILE
SPI_SETDESKWALLPAPER
StartsWith
STAThreadAttribute
Stream
StreamReader
StreamWriter
Stretched
String
StringBuilder
#Strings
StructLayoutAttribute
strVisible
Substring
Subtract
SW_HIDE
SymmetricAlgorithm
Synchronized
System
System.CodeDom.Compiler
System.Collections
System.Collections.Generic
System.ComponentModel
System.Configuration
System.Diagnostics
System.Drawing
System.Drawing.Imaging
System.IO
System.Net
System.Net.Sockets
SystemParametersInfo
System.Reflection
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Security.Cryptography
System.Security.Principal
System.Text
System.Threading
System.Timers
System.Windows.Forms
taldoChannel
TcpClient
teclas
teclea
telnet
Temporal
textoEncriptado
TextReader
TextWriter
!This program cannot be run in DOS mode.
Thread
ThreadStart
tiempoDesde
Timeout
timeoutSeconds
TimeSpan
ToBase64String
ToCharArray
ToInt32
ToLower
ToString
ToUpper
traducir
TransformFinalBlock
TripleDESCryptoServiceProvider
TryGetValue
uAction
Unayko
_Unayko_el_Unico
unidad
unidades
UnmanagedType
uParam
Upload
UploadCallback
UploadDirectory
UploadDirectoryCallback
UploadDirectoryPathRecurseMaskCallback
UploadFileNameResumeCallback
user32
user32.dll
User32.Dll
username
Username
UTF8Encoding
v2.0.50727
vaciarClipBoard
value__
ValueType
variablesMinus
verboseDebugging
VerboseDebugging
verContenidoCarpetaAComprimir
verdad
Verdad
Version
VERSION
vidaLazaro
visible
Visible
vocabulario
WaitForExit
WaitForInputIdle
WaitHandle
WaitOne
wallpaper
wasHere
wdriver
WebClient
Windir
WindowsIdentity
WM_CAP_CONNECT
WM_CAP_COPY
WM_CAP_DISCONNECT
WM_CAP_GET_FRAME
WM_CAP_SET_PREVIEW
WM_CAP_SET_PREVIEWRATE
WM_CAP_START
WM_SYSCOMMAND
WM_USER
WNetCloseEnum
WNetEnumResource
WNetOpenEnum
wParam
WrapNonExceptionThrows
WriteLine
WS_CHILD
WS_EX_APPWINDOW
WS_EX_TOOLWINDOW
WS_VISIBLE