Analysis Date2014-09-12 20:33:08
MD5d4ac7434afc32c3e58df2335c65ff945
SHA16cad9d5ad0c66338f9c4057f7d72c02f85034364

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 8067456c5dc713997e61924c501c8cb2 sha1: a31e9403bbcd95793846f9619bda7cfde9229e20 size: 580096
Section.itext md5: 3f63b5c2974302201afb8afa01b8ac10 sha1: 7e49535face98e2cd7183ec3e98c2a95894ebcd5 size: 6656
Section.data md5: 81fa247370ecc3476b5c17086c0f2024 sha1: 57a1468ce4eaa810ed0ffdb3622c1d142eb61123 size: 15872
Section.bss md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.idata md5: cd30ca2b6ff5111155dec94ee29ec186 sha1: e5fd41be7799ae8933dbc4c297e57fc2fc8d2368 size: 16896
Section.tls md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rdata md5: c1788dfeb92bbf0cff5aeaeaf1270ff8 sha1: 469a55b2d8c433d2a38eb7d9398cf0c8965abf15 size: 512
Section.reloc md5: e55564594dad16a2ca19fb85903b9300 sha1: 7ef009dc015904e2abf1868ff1c92a15317b0df4 size: 35840
Section.rsrc md5: 45c59bc7c736128738aeb8e99283500f sha1: 579190f23a2a0b4c9fee9f159f69467fc54647ea size: 17408
Timestamp2012-06-07 15:59:53
VersionLegalCopyright: Copyright (C) 1999
InternalName: MSRSAAPP
FileVersion: 1, 0, 0, 1
CompanyName: Microsoft Corp.
Comments: Remote Service Application
ProductName: Remote Service Application
ProductVersion: 4, 0, 0, 0
FileDescription: Remote Service Application
OriginalFilename: MSRSAAP.EXE
PEhash951144beaeafaeb722ad30e43a4feb23f37057d3
IMPhashe5b4359a3773764a372173074ae9b6bd

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit ➝
C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Administrator\My Documents\DCSCMIN\IMDCSC.exe\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT ➝
C:\Documents and Settings\Administrator\My Documents\DCSCMIN\IMDCSC.exe\\x00
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\My Documents\DCSCMIN\IMDCSC.exe
Creates ProcessC:\Documents and Settings\Administrator\My Documents\DCSCMIN\IMDCSC.exe

Process
↳ C:\Documents and Settings\Administrator\My Documents\DCSCMIN\IMDCSC.exe

Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates MutexDCMIN_MUTEX-WC5VTWD

Network Details:

Flows TCP192.168.1.1:1031 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1031 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1032 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1033 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1034 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1035 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1036 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1037 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1038 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1039 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1040 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1041 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1042 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1043 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1044 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1045 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1046 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1047 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1048 ➝ 7.90.168.44:1602
Flows TCP192.168.1.1:1049 ➝ 7.90.168.44:1602

Raw Pcap
0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308

0x00000000 (00000)   44353733 42413541 34454646 43334642   D573BA5A4EFFC3FB
0x00000010 (00016)   36323933 3038                         629308


Strings
 - 
,  x 
, 
.
\
-
 
 
.
.
.
..
$
@
#
;
.
.
.
.
@
`@
.
..
23
.
==??
???????????????
0000
000000
040904b0
1, 0, 0, 1
!1Aa
#+3;CScs
4, 0, 0, 0
66006666
6666
9-+,
&Abort
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
A call to an OS function failed/Application is not licensed to use this feature
Access violation
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
*A control cannot have itself as its parent
&All
Alt+
Ancestor for '%s' not found
Application Error1Format '%s' invalid or incompatible with argument
April
Assertion failed
August	September
Bitmap image is not valid
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
BkSp
Cancel
Cannot assign a %s to a %s
Cannot create file "%s". %s
Cannot drag a form
Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Cannot open clipboard/Menu '%s' is already being used by another form
Cannot open file "%s". %s
Canvas does not allow drawing
Class %s not found
clock
combobox
Comments
CompanyName
Confirm
Control-C hit
Copyright (C) 1999
Ctrl+
DCDATA
DCOM not installed"Unable to find a Table of Contents
December
Division by zero
Docked control must have a name%Error removing control from dock tree
 - Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
 - Dock zone not found
Down
DVCLAL
ebutton
edit
EEEEEEEE
Enter
Error
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error reading %s%s%s: %s
Exception in safecall method
explorerbar
External exception %x
Failed to create key %s
Failed to get data for '%s'
Failed to set data for '%s'
February
File access denied
FileDescription
File not found
FileVersion
Floating point division by zero
Floating point overflow
Floating point underflow
Friday
FriendlyName
header
&Help
Home
Icon image is not valid
&Ignore
Information
Integer overflow Invalid floating point operation
Interface not supported
InternalName
Invalid argument
Invalid argument to date encode
Invalid argument to time encode
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid clipboard format Clipboard does not support Icons
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid filename
Invalid ImageList
Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context
Invalid image size
Invalid numeric input
Invalid pixel format
Invalid pointer operation
Invalid property path
Invalid property value
Invalid stream format$''%s'' is not a valid component name
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant type
Invalid variant type conversion
I/O error %d
January
@jjj
jjjj
jjjjj
jjjjjj
July
June
Left
LegalCopyright
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
listview
March
menu
Menu index out of range
Menu inserted twice
Metafile is not valid
Microsoft Corp.
Monday
MSRSAAP.EXE
MSRSAAPP
No argument for format '%s'"Variant method calls not supported
No help found for context$No topic-based help system installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
No help found for %s#No context-sensitive help installed
Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active$%s not in a class registration group
N&o to All
November
Null Renderer
October
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Operation not supported
OriginalFilename
Out of memory
Out of system resources
PACKAGEINFO
page
PgDn
PgUp
Privileged instruction(Exception %s in module %s at %p.
ProductName
ProductVersion
progress
Property is read-only
Property %s does not exist
Range check error
Read
Read beyond end of file	Disk full
rebar
Remote Service Application
Resource %s not found
&Retry
Right
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Sample Grabber
Saturday
Scan line index out of range!Cannot change the size of an icon
scrollbar
Shift+
'%s' is not a valid GUID value
!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time
Space
spin
%s%s
%s.Seek not implemented$Operation not allowed on sorted list
%s (%s, line %d)
Stack overflow
startpanel
status
Stream read error
Stream write error
StringFileInfo
Sub-menu is not in menu
Sunday
System Error.  Code: %d.
taskband
taskbar
Thread creation error: %s
Thread Error: %s (%d)
Thursday
toolbar
tooltip
Too many open files
trackbar
Translation
traynotify
treeview
Tuesday	Wednesday
Unable to create directory
Unexpected variant error
Unsupported clipboard format
VarFileInfo
Variant or safe array is locked
Variant overflow
Video Capture
VS_VERSION_INFO
Warning
window
Write$Error creating variant or safe array)Variant or safe array index out of bounds
&Yes
Yes to &All
<-=:=[=
<&<}<	=
                                                                
 !"#$%
-.-.-.-
;"<?<_<|<
;(;:;~;
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
								
0.0.0.0
0 0$0(0,0004080<0@0
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0 0$0(0,0004080<0@0D0H0T0h0}0
0"0&0*0.02060:0>0B0F0J0N0R0V0Z0
0&00050O0Y0^0x0
0%0)0/060:0T0]0f0r0|0
0 0$0(080X0`0d0h0l0p0t0x0|0
0"0*020:0B0J0R0Z0b0j0r0z0
0*0.020L0\0l0t0x0|0
0$0,040<0D0L0T0\0d0l0t0|0
0&0.060>0F0N0V0
00090C0
0!0>0C0X0]0x0}0
0(0:0F0X0h0r0
0,0;0F0X0n0s0
0*0>0R0a0n0}0
0(0<0T0h0|0
	0'0;0Y0m0
001D1Q1e1r1
0$050:0E0`0
0$070I0f0y0
0&070O0g0x0
0"0A0J0}0
0.0D0f0v0
0$0H0L0P0i0q0
0(0H0P0T0X0\0`0d0h0l0p0
0.0H0T1^1c1m1t1
0(0K0n0
0>0V0x0
0"1/1?1M1
0"1*1H1M1V1\1q1
0&1\1i1
0-1>1O1`1w1
0&1?1W1
0123456789abcdef
0123456789ABCDEF
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ/*-+.=
0123456789ABCDEFGHJKLMNPQRSTUVWXYZ
0%141B1S1d1
0;152@2s3y3
0%1c1m1
0*1G1}1
0?1K1R1\1n1
0%1K1U1
.030E0
031A1_1
040<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
= =$=(=,=0=4=8=
; ;$;(;,;0;4;8;<;@;
<$<,<0<4<8<<<@<D<H<L<`<
<(<0<4<8<<<@<D<H<L<P<p<
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
=$=(=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;F;N;#<S<
> >$>(>,>0>4>8><>H>h>p>t>x>|>
? ?$?(?,?0?4?8?<?J?R?j?n?r?v?z?~?
=(=,=0=4=8=L=_=c=s=
> >$>(>,>0>4>8><>P>p>x>|>
= =$=(=,=0=4=H=h=p=t=x=|=
-050=0B0[0g0l0
071H1^1
081Q1Y1a1i1q1|1
>0>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?0?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
:0:8:<:@:D:H:L:P:T:X:t:
< <$<,<0<8<<<D<H<P<T<\<`<h<l<t<x<
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
: :(:0:8:@:H:P:X:`:h:p:x:
090E0_0k0
091X1h1u1
0A0d0p0
:0:A:l:
^0b0f0j0n0r0v0z0~0
,0b0o0
;0;B;T;f;x;
;0c0j0
=$>0>D>L>P>T>X>\>`>d>h>l>p>t>
0H0\0x0
'0H0f0
0H0U0a0j0p0}0
?!?%?)?0?I?l?x?|?
-0J0|0
_0k0r0|0
0n1r1v1z1~1
	0P0m0
?0?P?m?
?0?P?X?\?`?d?h?l?p?t?x?
&0Q0`0o0~0
>0>?>S>
0S1e1p1
0T0R2t2
0T1b1o1
= >$>(>,>0>t>x>|>
?0?<?T?`?y?
+0U0d0{0
/0U0k1
0UntMiscFunc
0UntPasswordAndData
0x%.2x%.2x%.2x%.2x%.2x%.2x
= =0=Y=i=.>K>h>
*0Z0u0
=!=%=)=-=1=
-[[[[1
-{{{{1
1 10181<1@1D1H1L1P1T1X1\1`1d1h1l1p1|1
1 101P1X1\1`1d1h1l1p1t1x1
1"1)10171>1E1L1S1Z1a1h1o1v1}1
1<1]1~1
1!1,1=1|1
1 1$1(1,1014181<1@1D1H1L1\1|1
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1|1
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1p1t1x1
1 1$1(1,101D1d1l1p1t1x1|1
1%1)1-1115191=1&2d2
1"1&1*1.12161:1>1B1F1J1N1R1V1Z1^1v1
1'1+1/13171;1?1C1G1K1O1S1W1[1_1c1g1k1o1s1w1{1
1"1*121:1B1J1R1Z1b1j1r1z1
1$1,141<1D1L1T1\1d1l1t1|1
1%1/181H1
1"1'191H1^1q1
1*1/1B1G1Z1_1r1w1
1 1,1C1h1t1
1)1=1H1t2
1+1:1Q1`1w1
1$1<1Y1j1
112i2q2
1!141d1s1
1$141T1\1`1d1h1l1p1t1x1|1
1'161K1Z1d1l1q1y1
1*171F1X1]1|1
1#191A1^1j1
1,1D1d1l1p1t1x1|1
1!1f1z1
1(1H1,7074787<7@7H8P8T8x8|8
"1@1X1x1
1.2>2I2N2Y2^2i2n2y2~2
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
1^2!4{6
127.0.0.1
127.0.0.1:1604
1/2A2H2v2
1/2B2L2Q2k2u2z2
1$2C2_2
1>2I2X2}2
1^2l2w2
14181<1@1D1H1L1P1T1
142A2j2
151x1/2H2h2
:!:%:):-:1:5:9:=:A:E:I:\:`:d:h:l:p:t:x:|:
161K1W1_1i1n1s1x1}1
181C1J1U1c1|1
; <1<8<><D<K<[<b<h<n<u<
191H1L1T1X1d1h1p1t1x1|1
>!>1>A>R>q>{>
1b2l2v2{2M3
1C2\2q2
1Q1Y1`1l1p1|1
1S2_2f2x2
1SCDesktop
1SCMydocs
 2001, 2002 Mike Lischke
 2004, 2005 Pierre le Riche / Professional Software Development
20393B3H3Y3d3i3
212=2S2x2
2#212?2M2[2i2w2
2!2>2}2
2+2:2|2
2$2(2,2024282<2@2D2\2|2
2 2$2,20282<2D2H2P2T2\2`2h2l2t2x2
2 2$2(2,202@2`2h2l2p2t2x2|2
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2r2z2
2 2$2(2,2024282F2N2
2 2$2(2,20242D2T2X2h2
2"2&2*2.22262:2>2B2F2J2N2R2V2Z2^2b2f2j2n2r2v2
2"2'2-22282=2C2J2P2U2[2`2f2m2s2~2
2"2*222:2B2J2R2Z2b2j2r2z2
2 2$2(2,2F2N2V2^2f2n2v2~2
2+222>2U2\2i2
2"2&2*292v2
222_2i2y2
222:2J2V2V3^3p3|3
2$2,242<2D2L2T2\2d2l2t2|2
2 2*242>2H2R2\2f2p2z2
2#2/262@2X2r2|2
2 2.262L2X2l2t2x2|2
2,2<2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
2&2:2N2i2q2y2
2)2;2U2a2
223>3S3
2*242<2A2l2
2'242:2B2O2U2]2j2p2x2
2&24282T2\2`2d2h2l2p2t2x2|2
2$242F2V2u2
224G4R5
2(262K2X2]2j2o2|2
2$272C2M2T2^2e2o2|2
2/272W2g2o2
2&292L2_2i2q2y2
2+292S2t2
2$2a2e2i2m2q2u2y2}2
2$2a2i2o2{2
2"2C2d2
2$2D2a2
2`2d2h2l2p2
2.2D2Z2p2
2.2E2R2W2~2
2&2j2y2
2<2q2:3H3S3p3
2/2Z2w2
2"303N3
233?3K3U3_3i3t3~3
2+393W3
2#3H3(4@4
2"3Y3g3v3
243C3P3[3s3
="=&=*=.=2=6=:=>=B=F=J=N=R=V=*?
;";&;*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;r;v;z;~;
<"<&<*<.<2<6<H<Y<]<p<
273E3W3q3}3
? ?%?2?7?D?I?V?[?h?m?z?
282G2^2
283E3N3W3y3
293V3}3
<"<*<2<:<B<J<R<Z<b<j<r<z<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
;";*;2;:;B;J;R;Z;b;j;r;z;
:":*:2:::B:J:R:Z:b:j:r:z:
?"?*?2?:?B?J?R?Z?b?j?r?z?
:"<2<=<C<L<P<
2d2l2{2
?&?*?.?2?D?U?Y?l?
:2:::F:P:Y:e:n:z:
>(>->2>@>I>N>
2K3O3S3W3[3_3c3g3k3o3s3w3{3
<2<k<z<
2O2^2k2v2
;(<2<S<^<e<p<
2UntDCSettingsReader
%.2x-%.2x-%.2x-%.2x-%.2x-%.2x
=2=;=y=
30383<3@3D3H3L3P3T3X3h3
30O1g1x1
314B5\5|5
#32770
 32 bit
3#30353B3G3T3Y3f3k3x3}3
3'303f3q3w3
3"303L3P3X3\3`3d3h3l3p3t3x3
3+323@3E3R3Y3^3k3r3w3
3"323G3R3`3q3
3$3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
3"3*323:3B3J3R3Z3b3j3r3z3
3*3.32363:3>3B3F3J3N3R3V3Z3^3b3f3j3n3r3v3z3~3
3 3(3,3034383<3@3D3H3L3P3T3X3\3`3d3t3
3 3$3(3,3034383<3@3D3H3L3P3T3b3t3x3|3
3 3$3(3,3034383<3@3D3H3L3P3T3h3}3
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 3$3(3,3034383<3@3D3L3\3j3n3
3 3$3(3,3034383<3@3T3t3|3
3"3&3*3.32363:3>3B3F3J3N3R3V3Z3^3b3f3j3n3r3v3z3~3
3)33383R3\3a3{3
3$3,343<3D3L3T3\3d3l3t3|3
3&3.363>3F3N3V3^3f3n3v3~3
3"3-373>3H3O3Y3`3j3o3t3y3
3$3,383<3@3D3L3P3T3X3\3`3d3h3l3p3t3x3|3
3%3;3C3b3g3
3!3/3J3_3i3n3
3>3[3z3
3 383<3@3D3H3L3P3T3X3l3
3(383D3H3P3T3X3\3`3d3h3l3p3t3x3|3
3)393U3e3
3/3F3c3
3'3G3d3
3$3J3^6f6q6
3.3N3k3
3+3N3q3
343<3@3D3H3L3P3T3X3\3`3d3
3#434J4b5
343F3l3}3
3	4!404M4
3.4@4_4f4
3+464>4L4]4
3%494M4~4
3%4B4b4
3 4C4f4
3)4C4Y4f4s4
3:4N4b4v4
3-4P4m4
3*4Z475k5
354>4C4e4r4
374<4V4
<#<'<+</<3<7<;<?<C<G<K<d<
>#>'>+>/>3>7>;>?>C>G>K>O>S>W>[>_>c>g>k>o>
=#='=+=/=3=7=;=?=C=G=K=O=S=W=[=h>
3B4h4y4
:%:3:B:Y:
3c4o4T6
3CommDlg
>$>/>3>D>H>L>f>n>
;3;?;F;X;h;x;
3G3L3h3
3G5W5n5
3I3W3e3
3I4V4i4~4
<&<3<:<@<L<f<q<
?+?/?3?L?\?l?t?x?|?
3M3U3,4
:#:3:M:c:
3Messages
:";3;M;Z;b;o;};
;3;:;s;
?3?V?y?
>3>X>d>}>
<!=%=)=-=4=
40484<4@4D4H4L4P4T4X4\4`4d4h4t4
404X4x4
405H5d5t5
414X4m4
424J4b4)5M5
434V4x4
4"404>4B4S4W4[4~4
4,414>4C4P4U4b4g4t4y4
4+424@4K4Q4k4t4|4
4"4*424:4B4J4R4Z4b4j4r4z4
4$4(4,4044484<4@4D4H4V4^4t4
4 4%4,414r4
4)444[4
4 4$4(4,40444@4K4O4]4e4~4
4 4$4(4,4044484<4@4D4H4L4P4`4o4s4
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4<6
4 4$4(4,4044484<4@4D4R4`4d4t4
4 4$4(4,4044484@4X4n4r4
4 4$444<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4$4,444<4D4L4T4\4d4l4t4|4
4!4)4?4R4\4a4{4
4!4-4:4X4j4
4&4.464
4 4$4H4L4P4T4`4d4h4l4p4t4x4|4
4!4/4I4n4
4)454:4
4&464M4]4u4
4$4D4L4P4T4X4\4`4d4h4l4
4#4F4s4x4
4&4R4w4
4+4T4e4
4=4X4i4
4#525A5P5_5n5}5
4#5/565A5S5d5
4#5-5S5o5
4(5_5t5
4$565;5J5`5
4=5K5^5q5
484X4u4
;4;8;<;@;D;H;
;(;,;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
= =(=,=4=8=@=D=L=P=X=\=d=h=p=t=|=
=!=4=9=
4A4U4i4
4d576P6
:$:,:4:<:\:d:h:l:p:t:x:|:
:4:<:@:D:H:L:P:T:X:\:`:d:
=4=<=@=D=H=L=P=T=X=\=l=
?4?<?@?D?H?L?P?T?X?\?t?
?$?,?4?<?D?L?T?\?d?l?t?|?
4E5b5o5
>#>4>g>r>
= =$=(=,=4=H=]=a=t=
:";4;K;
4L4V4a4
;(;4;@;L;X;d;p;|;
4Q4a4w4
>!>4>T>\>`>d>h>l>p>t>x>|>
: :4:@:T:\:`:d:h:l:p:t:x:|:
$;4$w	f
%.4x:%.4x
505D5X5l5
50646P6T6
535B5Q5`5o5
545Y5o5
5 505<5@5H5L5P5T5X5\5`5d5h5l5p5t5~5
5,54585<5@5D5H5L5P5T5X5\5j5
5,545B5L5\5h5r5
5$5,5054585<5@5D5H5L5^6
5"5*525:5B5J5R5Z5v5
5#5.535B5J5U5Z5e5l5
5)5/545?5E5J5U5[5`5k5q5v5
5 5$545T5\5`5d5h5l5p5t5x5|5
5"5.5<5
5 5$5(5,5054585<5@5D5X5h5x5
5 5$5(5,505;5G5N5X5b5l5v5
5%5-555=5E5m5
5(5-5:5?5L5Q5^5c5p5u5
5)5<5_5g5k5
5$5(585@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5"5;5C5_5g5
5.5@5H5M5S5X5m5
5-5;5I5U5Z5
5-5>5K5m5z5
5&5/5L5e5u5
5)5@5P5g5
5*5^5r5
5!575?5C5\5
5(575F5U5d5s5
5$5a6}6
5%5B5b5
5@5D5H5L5h5l5p5t5
5,5L5i5
5@5S5x5
5!646C6
565V5s5
5 6'6.6
5$6@6E6_6
5:6S6l6
5@7M7g7
596e6r6
:5;9;=;A;E;I;M;Q;U;Y;];a;e;i;m;q;u;y;
5B5J5U5
=#=5=D=\=
<!<,<5<D<[<g<s<{<
<&<5<F<S<b<o<t<
;5;?;H;
5j9s9}9
;5;K;^;
5K5Y5a5~5
5K6]6h6s6
;5<L<u<
5p5>6j6
5P6Y6c6s6
:&;5;s;
5Themes
5V5k5}5
:5;X;e;
606S6k6
627=7R7j7
636\6l6
646A6v7
 64 bit
6(6064686<6@6D6H6L6P6T6X6\6`6p6
6&606?6K6S6b6l6q6}6
6 60686<6@6D6H6L6P6T6X6\6`6d6h6v6
6+616I6V6^6g6u6
6#626M6\6
6$646@6y6
6$6,6064686<6@6D6H6L6P6T6X6p6
6!6&61676<6G6M6R6]6c6h6s6y6~6
6$6(6,6064686<6@6D6
6 6$6(6,606
6 6$6(6,6064686<6@6D6H6L6d6z6~6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6"6&6*6.62666:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
6 666:6>6B6]6a6e6i6
6'6+6<6\6d6h6l6p6t6x6|6
6#6/6H6T6c6r6
6#6>6J6R6d6
6,6:6M6
6"6*6R6|6
6)6/6X6^6{6
6)676C6Q6
667o7|7
6+696G6X6
6(696K6U6k6|6Z7
6(6A6d6
6'6C6f6k6
6,6E6_6f6u6
6%6G6V6`6u6z6
6%6H6b6x6
6>6n6z6
6 6T6d6l6t6|6
6;6X6x6
6-757;7G7W7|7
6(7,7074787<7@7X7d7h7
6&797l7
6!7F7X7d7s7
6^7k7v7
6%7m7}7
6_7m778`8
686V6(727F7M7Y7m7v7
687<7@7D7H7L7p7t7
<6<A<I<X<l<z<
<6=:=>=B=F=J=N=R=2?;?S?
<+<6<C<
;);6;C;P;`;e;m;
=&=+=6=;=F=K=Y=b=g=l=z=
?&?.?6?>?F?N?T?m?x?
>$>)>6>;>H>M>Z>_>l>q>~>
6P7p7x7|7
:):6:@:R:X:e:r:|:
6^;s;~;
=6=?=S=a=u=
>&>6>>>S>[>x>
<6<V<s<
6Y6a6g6s6{6
?7?`?}?
707U7q7
737;7^7i7}7
748J8R8Z8b8j8r8z8
757R7r7
7"747]7j7x7
7)757:7
7$7,707D7L7m7y7
7#7.737>7C7U7f7o7t7
7 7+767
7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
7 7$7(7,7074787<7@7D7H7L7P7T7X7d7q7u7
7 7$7(7,7074787<7@7T7
7 7$7(7,7074787<7L7\7`7n7
7!7*777<7F7L7T7
7'777=7Q7[7i7y7
7"7'7:7?7R7W7j7o7
7!7-787>7J7T7Z7f7k7v7{7
7#7+7I7Q7l7t7x7
7!7&7K7T7g7r7}7
7 7<7L7\7d7h7l7p7t7x7|7
7<7`7m7u7
777T7t7
7=7a7{7
7#7B7d7
7(7E7e7
7,7H7m8
77:J: ;
7 7M7j7
7-7M7j7
7 7Y7w7
7 8$888<8
7!8>8q8
788U8]8
7+8*999P9d9
7?8C8G8K8O8S8`8l8p8|8
7&8C8S8
7$8H8p8
7"8I8d8
7!8J8m8
7,8s8z8
7_9e9|9
7A8I8S8Y8d8t8
>">,>7>A>L>^>n>
7B7J7R7Z7b7j7r7z7
:':,:7:=:H:
=">7>J>O>c>
7M8W8]8a8g8k8q8u8{8
7nduWlanTypes
;7;O;T;[;`;g;r;
7Q8P9d9
7UntInputsControls
=7=_=y=
:?;8<->
80<0_0c0
80211_OPEN
80211_SHARED_KEY
80888T8d8t8|8
80:::j:t:3;7;;;?;C;G;K;O;
838;8X8s8
838B8{8
838M8_8
8,818=8G8M8U8v8~8
8$838?8I8Y8
8,84888<8@8D8H8L8P8T8X8\8j8r8
8)848D8T8\8`8d8h8l8p8t8x8|8
8'858C8Q8]8b8:9\9
8,878B8J8R8\8f8k8z8
8 8(80888@8H8P8X8`8h8p8x8
8#8(838@8R9c9w9
8+8/838Q8Y8r8
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
8 8$8(8,8084888<8h8
8 8$8(8,80848B8
8 8$8(8,8:8B8J8R8Z8b8j8r8z8
8 8$8(8>8F8N8V8^8f8n8v8~8
888=8B8G8L8Q8
8%8*8<8F8U8j8
8!8)8F8N8R8e8m8q8
8$8?8Z8
8:8F8^8j8v9
8/8G8U8d8
8#8I9f9
8%8K8p8
88=W=o=
8/8X8g8
8	90999A9H9P9\9e9r9
8(939M9
8+979>9I9[9l9
8 9(90989M9
8$9@9f9
8!9&9F9W;\;
8!9.9P9V9}9
8 9.9U9
8+9=9V9b9j9
8%9Z:J;
8B9H9d9r9
8D8V8[8u8
8DLLMemory
:8:E:_:m:{:
:&:*:8:f:
8f9q9h;
8j95:W:`:}:
<&<8<J<l<|<
8l9p9t9x9|9
8M9j9o9
8N8R8V8n8|8
8P9c9l9
{8+{p+{h
8Registry
8S9v97:u:0;?;
8X9d9x9
; ;8;X;`;d;h;l;p;t;x;|;
9#:^:~:
90949H9h9p9t9x9|9
909T9t9|9
90:::a:
90:;:F:`:e:
919=9L9
9	:2:O:o:
939P9p9
9':3:G:a:z:
94:9:X:i:
9+:4:F:i;q;
95:9:=:A:H:
969>9^9
9	:6:E:
9":.:6:j:x:
9&:7:Z:t:
9(909H9P9l9
9%949j9
9$95999L9l9t9x9|9
9*979P9s9
9 9(90989@9H9P9X9`9h9p9x9
9"9*929:9B9J9R9Z9b9j9r9
9#9+949<9G9R9d9t9
9#9(9-92979<9w9
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
9 9$9(9,9094989L9l9t9x9|9
9 9$9(9,90949p9x9
9 9$9(9,9<9\9d9h9l9p9t9x9|9
9 999A9[9c9g9z9
9&9@9E9M9{9S:_:n:
9$9<9X9\9d9h9l9p9t9x9|9
9)9G9S9^9h9r9
9,9P9i9v9
9.:B:J:`:x:
9C9H9P9z9
;9<C<Z<
>%>/>9>D>N>Y>c>n>x>
9&:D:r:
9':D:y:
9e9j:n:r:v:z:~:
>+>9>E>J>
>->9>E>O>Y>e>q>{>
?+?9?G?U?c?q?
9(:J:O:
9J:[:u:
=9>K>P>q>
9=:m:c<o<w<
9o:}:+</<3<7<;<?<C<G<K<O<S<W<[<_<c<g<k<o<s<w<{<
9%:,:W:`:h:q:
9$:^:z:~:
=&>>>a>
ACanvas
accept
Accept
ACCESS DENIED (x64)
[ACMIn
acmStreamClose
acmStreamConvert
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
acmStreamSize
acmStreamUnprepareHeader
Action
ActionH
ActivateKeyboardLayout
ActiveControl4
ActiveOfflineKeylogger
ActiveOnlineKeylogger
ActiveOnlineKeyStrokes
ACTIVEREMOTESHELL
ActiveX
ActnList
AddContact
AddSize
ADDSOCKS5
ADirectShow9
AdjustTokenPrivileges
AdjustWindowRectEx
advapi32.dll
<]<a<e<i<p<
|afxCodeHook
:a;h;z;~;
:%:):A:I:e:m:
;!;%;<;a;i;m;
akBottom
akLeft
akRight
alBottom
alClient
alCustom
	AlignInfo
	Alignment
	AlignRect
AlignWithMargins<
alLeft
alNone
AlphaBlendT
AlphaBlendValue
alRight
_AMMediaTypeH
Anchors
AnimateWindow
ANSI_CHARSET
AntiVirusDisableNotify
An unexpected memory leak has occurred. 
>A>O>Y>e>
Apartment
AppData
ARABIC_CHARSET
Archive
Array 
>*>A>s>
attrib "
AttribArchive
AttribHidden
AttribNormal
AttribRO
AttribSystem
AttribTemp
aUntWIFI
	AutoCheckd-C
AutoConnect
AutoHotkeys
AutoHotkeysd-C
AutoLineReduction
AutoLineReductiond7B
	AutoMergeDmA
	AutoPopupDmA
AutoScroll
AutoSizeDmA
AVICAP32.DLL
=#=A=w=|=#>(>_>
: :;:b:
<%<)<:<B<
;B0uGj
backinfoes
BALTIC_CHARSET
;*<B<b<m<
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
BDSUnthemedDesigner
BeginBufferedPaint
BeginPaint
Be Right Back
?$?b?g?
BiDiMode nA
BiDiModex
BiDiModeX
biHelp
biMaximize
biMinimize
biSystemMenu
=#=*=B=I=\=t=
BitBlt
Bitmap
Bitmapx+C
bListUnit
BlockContact
BlockInput
;Blu	3
Boolean
BorderIcons
BorderStyle
BorderWidthd
#BOT#CloseServer
#BOT#OpenUrl
#BOT#Ping
#BOT#RunPrompt
#BOT#SvrUninstall
Bottom
#BOT#URLDownload
#BOT#URLUpdate
#BOT#VisitUrl
BP_^[]
=!=B=?>Q>n>
 Broadcast adress : 
 Broadcasts : NO
 Broadcasts : YES
B.rsrc
Brush<
bsBDiagonal
bsClear
bsCross
bsDiagCross
bsDialog
bsFDiagonal
bsHorizontal
bsNone
bsSingle
bsSizeable
bsSizeToolWin
bsSolid
bsToolWindow
bsVertical
BTERRORDownload File| Error on downloading file check if you type the correct url...|
BTERRORUpdate from URL| Error on downloading file check if you type the correct url...|
BTERRORVisit URL|An exception occured in the thread|
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: name <-> ordinal number don't match
BTMemoryGetProcAddress: no export table found
 BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: Can't attach library
BTMemoryLoadLibary: dll dos header is not valid
BTMemoryLoadLibary: Get DLLEntyPoint failed
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid
BTMemoryLoadLibary: VirtualAlloc failed
BTRESULTClose Server|close command receive, bye bye...|
BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|
BTRESULTHTTP Flood|Http Flood task finished!|
BTRESULTMass Download|Downloading File...|
BTRESULTOpen URL|
BTRESULTPing|Respond [OK] for the ping !|
BTRESULTRun command|
BTRESULTSyn Flood|Syn task finished!|
BTRESULTUDP Flood|UDP Flood task finished!|
BTRESULTUninstall|uninstall command receive, bye bye...|
BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|
BTRESULTVisit URL|finished to visit 
BufferedPaintSetAlpha
buffer error
BuildImportTable: can't load library: 
BuildImportTable: GetProcAddress failed
BuildImportTable: ReallocMemory failed
Button
BUTTON
ButtonSizel)B
;(<B<x<
=,>B>X>x?
ByRef 
 bytes: 
 Bytes
 Bytes (
C2S2K4[4v4=5B5G5[5
caFree
caHide
CallHelp
CallNextHookEx
CallWindowProcA
#CAMEND
CAMERA
caMinimize
Cancel
CanClose
CanDock
caNone
capGetDriverDescriptionA
Caption
Caption<
Cardinal
Category
C ;C$s
Cd;Cpt
CD-ROM
;?;C;G;L;};
CHANGEDATE
[ChangeID]
ChangeWindowName
CharLowerA
CharLowerBuffA
CharNextA
Charsetl)B
CharToOemA
CharUpperBuffA
CHATNUDGE
CHATOUT
Ch;Ctt
CheckedX
CheckMenuItem
CHIDED
CHIDEF
CHINESEBIG5_CHARSET
;ChwpV
$:Cjtc
ckAttachToInterface	OleServer
:!:):C:K:f:n:
ckNewInstance
ckRemote
ckRunningInstance
ckRunningOrNew
cl3DDkShadow
cl3DLight
clActiveBorder
clActiveCaption
clAppWorkSpace
clAqua
Classes
^Classes
ClassesxnA
clBackground
clBlack
clBlue
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clCream
clDefault
CleanMsConfig
ClearC
clFuchsia
clGradientActiveCaption
clGradientInactiveCaption
clGray
clGrayText
clGreen
clHighlight
clHighlightText
clHotLight
Client
ClientHeight<
ClientToScreen
ClientWidthl)B
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
:: Clipboard Change : size = 
Clipbrd
clLime
clMaroon
clMedGray
clMenu
clMenuBar
clMenuHighlight
clMenuText
clMoneyGreen
clNavy
clNone
clOlive
CloseCD
CLOSECHAT
CloseClipboard
CloseHandle
CloseServer
CloseServiceHandle
closesocket
CloseThemeData
CloseW
clPurple
clScrollBar
CLSIDFromProgID
clSilver
clSkyBlue
;CLt_3
clTeal
clWebAliceBlue
clWebAntiqueWhite
clWebAquamarine
clWebAzure
clWebBeige
clWebBisque
clWebBlack
clWebBlanchedAlmond
clWebBlue
clWebBlueViolet
clWebBrown
clWebBurlywood
clWebCadetBlue
clWebChartreuse
clWebChocolate
clWebCoral
clWebCornFlowerBlue
clWebCornSilk
clWebCrimson
clWebCyan
clWebDarkBlue
clWebDarkCyan
clWebDarkGoldenRod
clWebDarkGray
clWebDarkgreen
clWebDarkKhaki
clWebDarkMagenta
clWebDarkOliveGreen
clWebDarkOrange
clWebDarkOrchid
clWebDarkRed
clWebDarkSalmon
clWebDarkSeaGreen
clWebDarkSlateBlue
clWebDarkSlategray
clWebDarkTurquoise
clWebDarkViolet
clWebDeepPink
clWebDeepskyBlue
clWebDimGray
clWebDodgerBlue
clWebFirebrick
clWebFloralWhite
clWebForestGreen
clWebGainsboro
clWebGhostWhite
clWebGold
clWebGoldenRod
clWebGray
clWebGreen
clWebGreenYellow
clWebHoneydew
clWebHotPink
clWebIndianRed
clWebIndigo
clWebIvory
clWebKhaki
clWebLavender
clWebLavenderBlush
clWebLawnGreen
clWebLemonChiffon
clWebLightBlue
clWebLightCoral
clWebLightCyan
clWebLightGoldenrodYellow
clWebLightGreen
clWebLightgrey
clWebLightPink
clWebLightSalmon
clWebLightSeaGreen
clWebLightSkyBlue
clWebLightSlateGray
clWebLightSteelBlue
clWebLightYellow
clWebLime
clWebLimeGreen
clWebLinen
clWebMagenta
clWebMaroon
clWebMediumAquamarine
clWebMediumBlue
clWebMediumOrchid
clWebMediumPurple
clWebMediumSeaGreen
clWebMediumSlateBlue
clWebMediumSpringGreen
clWebMediumTurquoise
clWebMediumVioletRed
clWebMidnightBlue
clWebMintcream
clWebMistyRose
clWebMoccasin
clWebNavajoWhite
clWebNavy
clWebOldLace
clWebOlive
clWebOliveDrab
clWebOrange
clWebOrangeRed
clWebOrchid
clWebPaleGoldenrod
clWebPaleGreen
clWebPaleTurquoise
clWebPaleVioletRed
clWebPapayaWhip
clWebPeachPuff
clWebPeru
clWebPink
clWebPlum
clWebPowderBlue
clWebPurple
clWebRed
clWebRosyBrown
clWebRoyalBlue
clWebSaddleBrown
clWebSalmon
clWebSandyBrown
clWebSeaGreen
clWebSeashell
clWebSienna
clWebSilver
clWebSkyBlue
clWebSlateBlue
clWebSlateGray
clWebSnow
clWebSpringGreen
clWebSteelBlue
clWebTan
clWebTeal
clWebThistle
clWebTomato
clWebTurquoise
clWebViolet
clWebWheat
clWebWhite
clWebWhiteSmoke
clWebYellow
clWebYellowGreen
clWhite
clWindow
clWindowFrame
clWindowText
clYellow
cmd.exe
cMessengerAPI_TLB
=$=C=N=\=n=|=
;c<o<|<
<C=O={=
CoAddRefServerProcess
CoCreateInstance
CoCreateInstanceEx
CoInitialize
CoInitializeEx
Color<
Color\,B
COMBOPATH
comctl32.dll
CoMessengerU
command
Command
 Command successfully executed!|
CommCtrl
commdlg_FindReplace
commdlg_help
CompareStringA
COMSPEC
connect
ConnectKind
Constraints
Consts
CONTINUE_P
Contnrs
Control
CONTROLIO
ControlOfs%.8X%.8X
Control Panel\Desktop
Controls
&Controls
Controls<
ControlService
CopyEnhMetaFileA
CopyFileA
CopyMode$.B
CoReleaseServerProcess
CoResumeClassObjects
CoSuspendClassObjects
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles
;C<Q<g<w<|<
crAppStart
crArrow
crCross
crDefault
crDrag
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBitmap
CreateDIBSection
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateFontIndirectA
CreateHalftonePalette
CreateIcon
CreateMenu
CreateMutexA
CreatePalette
CreatePenIndirect
CreatePipe
CreatePopupMenu
CreateProcessA
CreateRemoteThread
CreateServiceA
CreateSolidBrush
CreateThread
CreateToolhelp32Snapshot
CreateWindowExA
crHandPoint
crHelp
crHourGlass
crHSplit
crIBeam
crMultiDrag
crNoDrop
crSize
crSizeAll
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crSQLWait
crUpArrow
crVSplit
CryptApi
Ctl3D nA
$;Ctt?
?"?C?\?u?
Currency
CurrentControlSet
CurrentVersion
Cursor
CutMultiFiles
CUxTheme
CVariants
C(_^[Y]
D57ABA5857F0AFF67584605E90BE4665C9814BEEC7ED390E0271A42F098683FF146F5F2ED194D183328638064360C9B46BD409B1BBF39124F5EEB1E639E92ABE5F2E4B1DF4A1969E6B1CF7F89690F5F9074DAE5DDE14F48E2579B5E422541C55C13635A9E116A36DCFF61039EAC5198FF4BFAE0F4B00D62381467FFDCFC76F7465632B1AAA06DCE15E195235D8F488FC2D40371351040869554BDE748A0BF5C5EA13B130B579AA9755F6AD658A47D304EF08CD72FBF68FE29F22BE46B450C025CF815E502CEC6D24D7CDFB6997F4C963F2F98A6F91FF5419B7EC59FE8611D3907DDC90741F3427E6D83A151442C18EB87A334CA8E7PA
`.data
data error
DATAFLUX
DataSize: 
 Days and 
DC2_USERS
DC3_FEXEC
DCDATA
_DCEntryPoint
dclogs\
DCMUTEX
DCPERSFWBP
DCSC_CHATNUDGE
DCSC_CHATRELOAD
DCSC_DESTROYCHAT
DCSC_GRABPWDS
DCSC_INITCHAT
DCSC_POSTDATA
D$(#D$8
%d.%d.%d.%d
DDOSHTTPFLOOD
DDOSSYNFLOOD
DDOSUDPFLOOD
; ;*;;;D;d;q;{;
Decimal
Default
DEFAULT_CHARSET
DefaultMonitor
DEFAULT MONITOR (DISPLAY)
DefFrameProcA
 deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly 
DefMDIChildProcA
DefWindowProcA
DelContact
DelDir
dElElElElElElElEl
DeleteCriticalSection
DeleteDC
DeleteEnhMetaFile
DeleteFileA
DeleteFiles
DELETELOG
DeleteMenu
DeleteObject
DeleteReg
DeleteService
DelMSKey
Delphi%.8X
Delphi Component
Delphi Picture
Description
DesignSize
DESKTHMB
DESKTOP
DESKTOPCAPTURE
DESKTOPSTOP
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
<&<<<\<d<h<l<p<t<x<|<
=<=\=d=h=l=p=t=x=|=
; ;<;\;d;h;l;p;t;x;|;
=<>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
D$HPkD$TdPV
='=d=H>W>
Dialogs
DIRATTRIB
DirectDraw
DirectShow9
DirectShow9'
DirectShow9	
DirectSound
DisabledTaskManager
DisableNotifications
DisableRegistryTools
DisableStartButton
DisableTaskMgr
Dispatch
DispatchMessageA
DispatchMessageW
DISPCAMS
DISPLAY
DisplayName
DisplayVersion
dkDock
dkDrag
D$LPkD$XdPV
D$LPkD$XdPW
>$>D>L>P>T>X>\>`>d>h>l>|>
:.:D:L:Z:l:|:
dmActiveForm
dmAutomatic
	dmDesktop	dmPrimary
dmMainForm
dmManual
DockClient
DockSite0
=D=O=j=
DOSCAP
DosDateTimeToFileTime
Double
[DOWN]
DownloadFail
DOWNLOADFILE
DOWNLOADFOLDER
DownloadSuccess
DragKind
DragMode
DragObject
DragQueryFileA
DrawEdge
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
DrawThemeBackground
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeText
drivers\etc\hosts
Drives
dsDragEnter
dsDragLeave
dsDragMove
dStdCtrls
>->D>T>
DUntScreenThumb
dUntSearchThread
dUntSynFlood
DVCLAL
DwmApi
DWMAPI.DLL
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled
DWNFOLDERRES
DXTypes
E0x0?1K1R1d1
EAbort
EAbstractError
EAccessViolation
EActnList
EAssertionFailed
EASTEUROPE_CHARSET
EBitsError
EClassNotFound
EComponentError
	EControlC
EConvertError
EDITSVR
EDivByZero
EDTDATE
EDTPATH
E`E`E`E`E`E`E`E`
E`E`E`E`E`E`E`E`E`E`E`E`E`E`E`E`E
	EExternal
EExternalException
EFCreateError
EFilerError
EFileStreamError
EFOpenErrortpA
EHeapException
EHelpSystemException
?e?i?m?q?x?
EInOutError`
	EIntError
EIntfCastError
EIntOverflow
EInvalidCast
EInvalidGraphic,*B
EInvalidGraphicOperation
EInvalidOp
EInvalidOperation
EInvalidPointer
EListError
EMathError
EMenuError
|$( EMFt
EmptyBin
EmptyClipboard
EmptyWorkingSet
Enabled
Enabled<
Enabled|
EnabledStartButton
EnabledT
EnabledTaskManager
EnableFirewall
EnableLUA
EnableMenuItem
EnableScrollBar
EnableThemeDialogTexture
EnableTheming
EnableWindow
EndBufferedPaint
EndPaint
EndReceive
ENDSNAP
EnterCriticalSection
EnumCalendarInfoA
EnumChildWindows
EnumClipboardFormats
EnumDeviceDrivers
EnumDisplayDevicesA
EnumDisplayMonitors
EnumProcesses
EnumProcessModules
EnumResourceNamesA
EnumServicesStatusA
EnumThreadWindows
EnumWindows
	EOleError
EOleException
EOleSysError
EOSError
EOutOfMemory
EOutOfResources
	EOverflow
EPrivilege
E$PVSj
EqualRect
ERangeError 
EReadError
ERegistryException
EResNotFound
ERR|Cannot listen to port, try another one..|
ERR|Socket error..|
ESafecallException
ESocketError
=E>S>t>
EStackOverflow
EStreamError
EStringListError
EThreadD
=+=:=E=T=\=l={=
EUnderflow
EVariantArrayCreateError
EVariantArrayLockedError
EVariantBadIndexError
EVariantBadVarTypeError
EVariantDispatchError
EVariantError
EVariantInvalidArgError$
EVariantInvalidOpError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantOverflowError
EVariantTypeCastError
EVariantUnexpectedError
EWriteError|qA
	Exception
ExcludeClipRect
ExitProcess
ExitThread
ExitWindowsEx
ExplicitHeight
ExplicitLeft
ExplicitTop
ExplicitWidth
explorer.exe
Explorern
ExtCtrls
ExtTextOutA
EZeroDivide
FAKEMSG
FastMM Borland Edition 
FComObj
-ffff!
F|h$YG
File Attrib : [ 
FILEATTRIB
FILEBOF
FILEEND
FILEEOF
FILEERR
file error
FILEM002
FILEM004
FILEM005
FILEM006
FILEM007
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FILETRANSFER
FillRect
FILM003
FinalizeSections: VirtualProtect failed
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
FindWindowExA
FirewallPolicy
<F<J<N<R<V<Z<^<
<F=k=s=
?+?\?f?l?
FlatSB
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FMGRSC
FormatMessageA
Forms]
Forms0
FormsL
FormsP
	FormStyle<
  FourCC: 
	fpDefault
fpFixed
FPUMaskValue
fpVariable
FrameRect
FreeLibrary
FreeResource
#FreezeIO
fsBold
f;sDt~f
fsItalic
fsMDIChild	fsMDIForm
fsNormal
fsStayOnTop
fsStrikeOut
fsUnderline
FTPFILEUPLOAD
FTPHOST
FTPPASS
FTPPORT
FtpPutFileA
FTPROOT
FTPSIZE
FTPUPLOADK
FTPUSER
=-=f=v=
@?:F?v
?(?F?Y?
GateWay
:GauQFKu
GB2312_CHARSET
gdi32.dll
GdiFlush
GdipAlloc
GDIPAPI
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipDisposeImage
GdipDrawImageRectI
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
gdiplus.dll
GdiplusShutdown
GdiplusStartup
,GDIPOBJ
GdipSaveImageToStream
GdipSetInterpolationMode
"GDIPUTIL
GENCODE
GetACP
GetActiveObject
GetActivePorts
GetActiveWindow
GetAppList
GetBitmapBits
GetBrushOrgEx
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
#GetClipboardText
GetClipBox
GetClipF
GetClipT
GetCommandLineA
GetComputerNameA
GetCPInfo
GetCurrentHwProfileA
GetCurrentPositionEx
GetCurrentProcess
GetCurrentProcessId
GetCurrentThemeName
GetCurrentThread
GetCurrentThreadId
GetCursor
GetCursorPos
GetDateFormatA
GetDCEx
GetDCOrgEx
GetDesktopWindow
GetDeviceCaps
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetDIBColorTable
GetDIBits
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GETDRIVEINFO
GetDrives
GetDriveTypeA
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetEnvironmentVariableA
GetErrorInfo
GetExitCodeProcess
GetExitCodeThread
GetFileAttrib
GetFileAttributesA
GetFileSize
GetFileTime
GetFileType
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFocus
GetForegroundWindow
GetFullInfo
GetFullPathNameA
gethostbyaddr
gethostbyname
gethostname
GetHostsFile
GetIconInfo
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardState
GetKeyboardType
GetKeyNameTextA
GetKeyState
GetLastActivePopup
GetLastError
GetLastInputInfo
GetLocaleInfoA
GetLocalTime
GETLOGSHISTORY
GetLongPathNameA
GetMappedFileNameA
GetMappedFileNameW
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessageA
GetMessagePos
GetMiniWind
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameA
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleHandleA
GetModuleInformation
GetMonitorInfo
GetMonitorInfoA
GetMonitorInfoW
GETMONITORS
GETMSNINFO
GetMsnList
GetObjectA
GetOfflineLogs
GetPaletteEntries
GetParent
GetPixel
GetPrivilege
GetProcAddress
GetProcessHeap
GetProcessMemoryInfo
GetPropA
GetRgnBox
#GetScreenSize
GetScrollInfo
GetScrollPos
GetScrollRange
getservbyname
GetServList
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
GetSIN
getsockname
GetSrchDrives
GetStartupInfoA
GetStartUpList
GetStdHandle
GetStockObject
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDirectoryA
GetSystemInfo
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemPowerStatus
GetTempPathA
GetTextExtentPoint32A
GetTextMetricsA
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundRegion
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThreadContext
GetThreadLocale
GetTickCount
GetTokenInformation
GetTokenInformation error
GetTopWindow
GetTorrent
GetUserDefaultLangID
GetUserNameA
GetVersion
GetVersionExA
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowsDirectoryA
GetWindowTextA
GetWindowTextLengthA
GetWindowTheme
GetWindowThreadProcessId
GetWinMetaFileBits
GlassFrame.Bottom
GlassFrame.Enabled
GlassFrame.Left
GlassFrame.Right
GlassFrame.SheetOfGlass
GlassFrame.Top
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
GMD5Api
GMMSystem
<"<G<O<
;;;G;O;W;j;z;
Graphics
+Graphics
GraphUtil
GREEK_CHARSET
>&>G>R>k>
GroupIndex nA
<(<G<Y<a<t<
:H;[;|;
H0Q0^0
: :$:(:H:a:
Handled
HANGEUL_CHARSET
HARDWARE\DESCRIPTION\System
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Heap32First
Heap32ListFirst
Heap32ListNext
Heap32Next
HeapAlloc
HeapFree
HEBREW_CHARSET
Height
HelpContext
HelpContextX
HelpFilep
:	HelpIntfs
:	HelpIntfs	
HelpKeyword nA
HelpType
HideClock
HideDeskTop
HideFolder
HideStartButton
HideSystemTrayIcons
HideTaskBar
HideTaskBarIcons
Hint<nA
HitTest
HitTestThemeBackground
HKNewExpandString
HKNewInt
; ;@;H;L;P;T;X;\;`;d;h;x;
HorzScrollBar
HorzScrollBarp
Host: 
:(:H:P:T:X:\:`:d:h:l:p:t:x:
<-<H<Q<l<
;(;@;H;T;h;p;t;x;|;
Ht Ht.
	htKeyword	htContext
http://
HTTP://
HttpQueryInfoA
;~hu	3
hUntSendStream
HWINDSENDTEXT
<"<;<i<
>+?\?i?
IAMStreamConfig4
IAMVideoProcAmp4
IBaseFilter4#F
ICaptureGraphBuilder24
IChangeNotifier4
ICustomHelpViewer4
.idata
Identifier
IDesignerHookh
IDesignerNotify4
	IDispatch4
IDockManager4
IDTYPE
IExtendedHelpViewer
IFilterGraph4
Ignore
IgnoreFontProperty
IGraphBuilder
IHelpSelector4
IHelpSystem4
Ih;J4u
IHV_END
IHV_START
IInterface
IKsPropertySet4
image/bmp
ImageHlp
ImageIndex
image/jpeg
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_Write
ImageList_WriteEx
Images
IMediaControld
IMediaEventd
IMediaEventEx
IMediaFilterx
IMessenger2
IMessenger3
IMessengerd
ImgList
imm32.dll
ImmGetCompositionStringA
ImmGetContext
ImmGetConversionStatus
ImmIsIME
ImmNotifyIME
ImmReleaseContext
ImmSetCompositionFontA
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetOpenStatus
>I>M>T>
incompatible version
incorrect data check
incorrect header check
	Incrementh
inet_addr
inet_ntoa
 inflate 1.2.3 Copyright 1995-2005 Mark Adler 
InflateRect
InfluenceRect
INFNAN
infoes
IniFiles
InitializeCriticalSection
InitializeFlatSB
InitializeProcessForWsWatch
InsertMenuA
InsertMenuItemA
INSTALL
InstallHKEY
InstallLocation
InstallService
insufficient memory
Integer
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InternetCloseHandle
InternetConnectA
\Internet Explorer\iexplore.exe
InternetOpenA
InternetOpenUrlA
InternetReadFile
IntersectClipRect
IntersectRect
Interval
InvalidateRect
invalid bit length repeat
invalid block type
invalid code lengths set
invalid distance code
invalid distances set
invalid distance too far back
invalid literal/length code
invalid literal/lengths set
invalid stored block lengths
invalid window size
Invisible
ioctlsocket
IOleForm4
:$;I;p;
 IP : 
IPersist4
 IP Mask : 
%IPPORTSCAN
ISampleGrabber4
ISampleGrabberCB4
IsAppThemed
IsBadReadPtr
IsChild
IsClipboardFormatAvailable
IsControl
IsDialogMessageA
IsDialogMessageW
IsEqualGUID
IsIconic
 is now open!|
IsRectEmpty
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
IStringsAdapter4
IsValidSid
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsWow64Process
IsZoomed
?%?<?i?t?
`.itext
iUntProcess
IUntSocks5
IVideoWindowd
I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!
?J?e?t?
;*;=;J;g;p;
='=J=m=
JOHAB_CHARSET
;-;=;J;P;e;k;x;
<=?J?[?q?
=!=J=S=
Jt'Jt5
=J>V>e>p>{>
:J;W;e;
:J:Y:a:f:n:{:
;';_;k;
KACMConvertor
KbdLayerDescriptor
#KCMDDC51#-
kD$PdP
kD$TdP
#KEEPALIVE#
kernel32
kernel32.dll
keybd_event
KeylogOn
KEYNAME
KeyPreview
KILLPID
KillProcess
KILLREMOTESHELL
KillSProcess
KillTimer
?.?K?k?
K,;K$u
K\;K|wY
<k<o<w<|<
;#;@;K;T;b;u;
Kt;K|sy
KWindows
~KxI[)
:+:K:z:
?(?@?l?
?'?L?]?
LanErr
LanList
Layout File
layout text
LeaveCriticalSection
[LEFT]
<#=L=i=
Limited
LineTo
ListCam
listen
:(:L:i:v:{:
<L<j<o<
L$(#L$<
>+>L>m>
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadLibraryA
LoadLibraryExA
LoadResource
LoadStringA
LocalAlloc
Local drive (default)
LocalFileTimeToFileTime
location
LockComp
LockResource
LockWorkStation
LogOffComp
LongWord
LookupAccountSidA
LookupPrivilegeDisplayNameA
LookupPrivilegeNameA
LookupPrivilegeValueA
 Loopback interface
?-?;?L?Q?c?
;(;-;:;?;L;Q;^;c;p;u;
>%?L?q?v?
lstrcpyA
lstrcpynA
lstrlenA
l$()t$,
L$%#T$
='=@=L=V=c=k=
;L<Y< =/=
<!=/=]=m=
maActivate
maActivateAndEat
maAutomatic
maBottomToTop
MAC_CHARSET
	maDefault
Magellan MSWHEEL
MAINICON
maLeftToRight
maManual
maNoActivate
maNoActivateAndEat
maNone
maParent
MapViewOfFile
MapVirtualKeyA
MapWindowPoints
Margin
Margins
maRightToLeft
MaskBlt
maTopToBottom
	MaxHeight
Maximize
Maximized
MaxWidth
mbBarBreak
mbBreak
mbLeft
mbMiddle
mbNone
mbRight
mciSendStringA
=MD5Core
Md5GetFromFile
md5result
MDICLIENT
m/d/yy
memory allocation failed!
MenuAnimation
Menus06C
MessageBoxA
MessengerAPI_TLB
MessengerAPI_TLB"
Microsoft
	MinHeight
Minimize
Minimized
MinWidth
MJPGte
MkeDir
mmmm d, yyyy
:mm:ss
?'?M?o?
Mode +B
Module32First
Module32FirstW
Module32Next
Module32NextW
MODULES
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MONSIZE
MONSIZE0x0x0x0
MouseActivate
mouse_event
MousePos
MouseZ
MoveFileA
MoveFold
MoveToEx
Mozilla
>,>M>R>l>q>
;*;M;s;
msacm32.dll
MSGBOX
MSGCORE
MSGICON
MSGTITLE
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
MSH_SCROLL_LINES_MSG
MSH_WHEELSUPPORT_MSG
MSNAWAY
MSNBUSY
MSNINFO
MSNOFFINE
MSNONLINE
MSNSIGNOUT
MS Sans Serif
MS Shell Dlg 2
MSWHEEL_ROLLMSG
MulDiv
MULTIBIND
MultiByteToWideChar
MultiMon
MULTIPLUGS
mUntSendDataFluxThread
myappname
>&?+?=?M?Y?n?
nduCType
nduEapTypes
nduL2cmn
:nduNtDDNdis
nduWinDot11
=nduWinNT
nduWlanAPI
need dictionary
netapi32.dll
NetApiBufferFree
Netbios
NETDATA
NETDRV
NetShareEnum
NetShareGetInfo
net start uxsms
netstat -a -n -o
net stop uxsms
Network
 Network interface
Neutral
NewFrame
	NewHeight
\newl\
NewLeft
	NewTarget
NewTop
NewWidth
;!</<N=G>Y>n>
NoControlPanel
Normal
Normal/Unactive
Not Available
notepad
notepad.exe
NoToAll
<n=r=v=z=~=
=;>N>S>^>p>
ntdll.dll
Nt Nt,
NtQuerySystemInformation
NtUnmapViewOfSection
[NUM_LOCK]
NUntPluginsData
;';?;N;V;b;o;{;
ObjectMenuItem
odComboBoxEdit
odDisabled	odChecked	odFocused	odDefault
odGrayed
odHotLight
odInactive	odNoAccel
odNoFocusRect
odReserved1
odReserved2
odSelected
OEM_CHARSET
OemToCharA
Offline
OFFLINEK
OffsetRect
< of the Normal
> of the Normal
OK|Successfully started..|
OldCreateOrder
ole32.dll
oleaut32.dll
OleConst
OleMainThreadWndClass
OleServer
	OleServer
OleStr
OleVariant
OnActivate(
OnAdvancedDrawItem
OnAlignInsertBefore
OnAlignPosition
OnAlignPositionp
OnCanResize
OnChange
OnClick
OnClose
OnCloseQueryx
OnCloseT
OnConstrainedResize
OnContextPopup
OnCreate
OnDblClick
OnDeactivate
	OnDestroy
OnDockDrop4
OnDockOver
OnDragDrop
OnDragOverp
OnDrawItem|,C
	OnEndDock|
OnGetSiteInfo
OnHelp
OnHide
	OnKeyDownL
OnKeyPress
OnKeyUpH
Online
ONLINESTROKES
ONLINESTROKES\newl\:: 
OnMeasureItem
OnMouseActivatel
OnMouseDown
OnMouseEnter
OnMouseLeave
OnMouseMovel
	OnMouseUp
OnMouseWheel
OnMouseWheelDown
OnMouseWheelUp
OnPaint
OnPopup
OnResize
OnShortCut
OnShow0
OnShowSV
OnStartDock
On The Phone
OnTimerSV
OnUnDock
OpenCD
OpenClipboard
OpenProcess
OpenProcessToken
OpenProcessToken error
OpenSCManagerA
OpenServiceA
OpenThemeData
OpenThreadToken
OpenWebPage
OrientationH*B
>$>O>t>
Out to lunch
out.txt
=$=/=:=O=V=\=d=j=x=~=
	OwnerDraw
=,=?=p=
:,;P;_;
paCenter
Padding`4C
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
paLeft
Parameters
ParentBiDiMode
ParentBiDiMode<
ParentColor<
ParentFont$.B
paRight
PASSWORD
PastMultiVM
PatBlt
PAUSED
PAUSED_P
PeekMessageA
PeekMessageW
PeekNamedPipe
PERSINST
ping 127.0.0.1 -n 4 > NUL && "
_PinInfo
Pitch<
PixelsPerInch
PixelsPerInchL7C
PlayEnhMetaFile
PlaySoundA
PLUGIN
>'?P?m?
pmAuto
pmBlack
pmCopy	pmNotCopy
pmExplicit
pmMaskNotPen
pmMaskPenNot
pmMask	pmNotMask
pmMerge
pmMergeNotPen
pmMergePenNot
pmNone
pmNotMerge
pmNotXor
pmWhite
poDefaultPosOnly
poDefaultSizeOnly
poDesigned	poDefault
poDesktopCenter
Policies
poMainFormCenter
poNone
poOwnerFormCenter
poPrintToFit
poProportional
	PopupMenu0
	PopupMode
PopupParent
PortScanAdd
poScreenCenter
Position
Position<
POST /index.php/1.0
PostMessageA
PostQuitMessage
PowerOff
PREVIEWF
Printers
PrintScale
PrintText
PROCESS
Process32First
Process32FirstW
Process32Next
Process32NextW
ProgIDFromCLSID
Progman
psAlternate
PSAPI.dll
psClear
psDash
psDashDotDot
psDot	psDashDot
psInsideFrame
psSolid
P?:S?u
psUserStyle
PtInRect
Publisher
?"???P?v?
P\YZ_^
Q<]_^[
qComConst
QQQQQQQQS3
QQQQQQQQSV
QQQQQQQQSVW
QQQQQQQQSVW3
QQQQQQQS
QQQQQQQSV
QQQQQQQSVW
QQQQQQSV
QQQQQQSVW
QQQQQQSVW3
QQQQQSVW
QQQQS3
QQQQSV
QQQQSVW
QTypInfo
QueryPerformanceCounter
QueryServiceStatus
QueryWorkingSet
QUICKUP
<	=$=R={=
R0_^[]
R0]_^[
R0Z_^[
	RadioItemtnA
RaiseException
<'=R=b=
>R?b?t?
R ;C0|
R,;C4}!
.rdata
ReadFile
Read-Only
ReadProcessMemory
RealizePalette
Real Time
ReBarWindow32
Rebuild
RectVisible
Redirection
RedrawWindow
RefreshClipboard
RefreshList
REFRESHLOGS
REFRESHMODS
REFRESHPROC
RefreshSIN
REFRESHWIFI
REG_BINARY
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
REG_DWORD
RegEnumKeyExA
RegEnumValueA
REG_EXPAND_SZ
RegFlushKey
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegStr
REG_SZ
RELATEDCMD
ReleaseCapture
ReleaseDC
@.reloc
RemoteMachineName
#RemoteScreenSize
Removable
RemoveMenu
RemovePropA
RemoveServices
RenameFile
RenAppReg
ResetEvent
Resize
RESMON
RestartComp
RestartServer
RestartSocket
RestoreDC
ResultAttrib
ResumeThread
r*-H420to-
RHelpIntfs
;&;<;R;h;t;
Right<
Right 
[RIGHT]
rmdir "
;)<R<o<
RPCLanScan
R@PSWV
RSNA_PSK
"RTLConsts
RtlUnwind
RUNNING
RunPrompt
RunSelectedAsAdmin
RunSelectedHidden
RunSelectedShow
Runtime error     at 00000000
RUntRC4
RUSSIAN_CHARSET
<R=V=Z=^=d=
;R;W;e;n;
R\Z_^[
S`]_^[
S$_^[]
S	_^[]
S0_^[]
;s0t=;
S8_^[]
sActiveX
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SAPI.SpVoice
SaveDC
Scaled
%s, ClassID: %s
ScreenSaver
ScreenSnap
ScreenToClient
ScrollWindow
Sd]_^[
SEARCHFILES
Security Center
select
Selected
SelectObject
SelectPalette
#SendClip
Sender
SendFilesToTrash
SendMessageA
SendMessageW
#SendTaskMgr
sendto
SendYourClipboard
server
SERVER
Services
SeShutdownPrivilege
SetActiveWindow
SetBkColor
SetBkMode
SetBrushOrgEx
SetCapture
Set cdaudio door closed wait
set cdAudio door open
SetClassLongA
SetClipboardData
SetCursor
SetCursorPos
SetDIBColorTable
SetEndOfFile
SetEnhMetaFileBits
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetFocus
SetForegroundWindow
SetLastError
SetLayeredWindowAttributes
SetMenu
SetMenuItemInfoA
SetParent
SetPixel
SetPropA
SetRect
SetROP2
SetScrollInfo
SetScrollPos
SetScrollRange
SetStretchBltMode
SetTextColor
SetThemeAppProperties
SetThreadContext
SetThreadLocale
SetThreadPriority
SetTimer
SetViewportOrgEx
SetWindowLongA
SetWindowLongW
SetWindowOrgEx
SetWindowPlacement
SetWindowPos
SetWindowsHookExA
SetWindowTextA
SetWindowTheme
SetWinMetaFileBits
" +s +h
SharedAccess
SheetOfGlass
shell32.dll
SHELL32.DLL
*ShellAPI
ShellExecuteA
ShellExecuteExA
Shell_traywnd
Shell_TrayWnd
SHEmptyRecycleBinA
SHFileOperationA
SHFolder.dll
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHIFTJIS_CHARSET
(ShlObj
ShortCut
%ShortCut#
ShortCutText
ShortInt
ShowClock
ShowDeskTop
ShowFolder
ShowHint<
ShowOwnedPopups
ShowScrollBar
ShowStartButton
ShowSystemTrayIcons
ShowTaskBar
ShowTaskBarIcons
Show/Unactive
ShowWindow
Sh#S0f
shutdown
Shutdown
Single
SizeofResource
)sl)sh)kX
Smallint
Smooth<
SnapBufferp
[SNAPSHOT]
socket
Sockets
SOCKS5CLOSE
SOCKS5FLUSH
SOCKS5STATUS
Software
Software\Borland\Delphi\Locales
SOFTWARE\Borland\Delphi\RTL
Software\Borland\Locales
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\
\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Software\Microsoft\Windows NT\CurrentVersion\Winlogon
SOUNDCAPTURE
SOUNDSTOP
Source
Source	TMenuItem
\space\
SpeakerVoice
%s, ProgID: "%s"
" /s /q
SrchDrives
%s (%s)
ssCtrl
ssDouble
ssFlat
ssHotTrack
ssLeft
ssMiddle
	ssRegular
ssRight
S(;S$s
ssShift
StandardProfile
STARTED
StartServiceA
StartServices
 Status : DOWN
 Status : UP
StdActns
StdVCL
StJ)Sp
STOPED
STOPED_P
STOPSEARCH
StopServices
stream end
stream error
StretchBlt
string
String
StringFromCLSID
Strings
Style<
SubMenuImages
SUBMREMOTESHELL
SuccesProc
) successfully dump in 
SvrUninstall
sx;P`u
S`_^[Y]
S$_^[Y]
SYMBOL_CHARSET
SyncObjs
SysAllocStringLen
SysConst
SYSERRCannot create the output file!
SYSERRCannot open remote process for reading..
SYSERRNot a valid range set!
SysFreeString
SYSINFO
SYSINFORemote process (
SysInit
SysListView32
SysReAllocStringLen
System
SYSTEM
SystemBiosDate
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Services\
systeminfo
SystemParametersInfoA
SysUtils
S`Z]_^[
<*t"<0r=<9w9i
t9;wlt4
TACMConvertor
TACMIn
TActionLinkSV
TAdvancedMenuDrawItemEvent
tagEXCEPINFO 
tagMULTI_QI
Tahoma
TAlign
TAlignInfo
TAlignInsertBeforeEvent
TAlignPositionEvent
TAnchorKind
TAnchors
TApplication
TApplicationd
Target
TaskbarCreated
taskmgr
taskmgr.exe
TAsyncTask
TBaseDragControlObject
TBaseSocket
TBaseSocket$
TBasicAction
TBasicActionLink
TBasicActiont
	TBiDiMode
TBitmap
TBitmapCanvas
TBitmaph7B
TBitmapImage
tbLeftButton
TBorderIcon
TBorderIcons
TBorderWidth
tbRightButton
TBrush
TBrushResourceManager
TBrushStyle
TByteArray
t';C8u
TCanResizeEvent
TCanvas
TCanvas\1B
TCaption
TCaptureWebcam
TChangeLink
tcHt(Ht3
TClassFinder
TClipboard
TClipboardFormats
TClipboardL
TCloseAction
TCloseEvent
TCloseQueryEvent
TColor
TCommonDialog
TComponent
TComponentNamel
TConnectionHandler
TConnectKind
TConstrainedResizeEvent
TConstraintSize
TContainedAction
TContainedAction4
TContextPopupEvent
TControl
TControlActionLink
TControlCanvas
TControlScrollBar
TControlScrollBarP
TCriticalSection
TCursor
TCustomAction
TCustomActionList
TCustomActionListX
TCustomActionT
TCustomControl
TCustomControlAction
TCustomControlActionh
TCustomDockForm 
TCustomDockFormp
TCustomForm
TCustomImageList
TCustomIpClient
TCustomIpClientl
TCustomMemoryStream
TCustomVariantType
TDataThread
	TDCWebCam
TDefaultMonitor
TDockDropEvent
TDockOverEvent
	TDockTree
	TDockZone
TDownloaderThreadU
TDragControlObject
TDragControlObjectEx
TDragDockObject
TDragDockObject`
TDragDockObjectEx
TDragDropEvent
	TDragKind
	TDragMode
TDragObject
TDragOverEvent
TDragState
t$;^dt
TDumpThread
TEndDragEvent
TerminateProcess
	TErrorRec
TEvent
TExceptRec
TextHeight
	TFileName
TFiler
TFileStream
TFont(.B
TFontCharset
	TFontName
TFontPitch
TFontStyle
TFontStyles
TForm4
TFormBorderStyle
TFormStyle
t"+G4PWV
TGdiplusBase
TGetSiteInfoEvent
TGlassFramet
TGlassFrameT
	TGPBitmap
TGPGraphicsRP
TGPImage
TGraphic
TGraphicsObject$-B
TGraphicsObjectL-B
THAI_CHARSET
THandleObject
THandleStream
THelpContext
THelpEvent
THelpManager
	THelpType
THelpViewerNode
Theme manager 
The sizes of unexpected leaked medium and large blocks are: 
The unexpected small block leaks are:
THintAction
	THintInfo@
THintWindow
THintWindow(
This program must be run under Win32
Thread32First
Thread32Next
t%HtIHtm
t:HtVH
	ThumbSize
TIcon08B
TIconImage
TIdentMapEntry
TImageIndex
TImeName
 Times.
TInputsControl
	TIntConst
TInterfacedObject
TInterfacedPersistent
TInterfacedPersistent\vA
	TIpSocket
	TIpSocket$
T$$J;D$ v0
tjHt+Ht7
t%Jt?Jt[
TKeepAlive
	TKeyEvent
TKeyPressEvent
TlHelp32
TlsGetValue
TlsSetValue
	TMainMenu
TMargins
TMarginSize
TMemoryStream
TMenuActionLink
TMenuAnimation
TMenuAnimations
TMenuAutoFlag
TMenuBreak
TMenuChangeEvent
TMenuDrawItemEvent
	TMenuItem
TMenuItemAutoFlag
TMenuItemStack
TMenuMeasureItemEvent
	TMetafile
TMetafileImage
TModuleInfo
TMonitor
TMouse
TMouseActivate
TMouseActivateEvent
TMouseButton
TMouseEvent
TMouseMoveEvent
TMouseWheelEvent
TMouseWheelUpDownEvent
tmpprint.txt
tmp.txt
$TMultiReadExclusiveWriteSynchronizer
TNotifyEvent
t;NtGNtSNt_
ToAscii
TObject
TObject	
ToGetClipT
TOleServer
TOleServer4
Toolhelp32ReadProcessMemory
too many length or distance symbols
TOrderedList
*.torrent
TOwnerDrawState
TPadding
TPatternManagerSV
TPenMode
	TPenStyle
TPersistent
TPersistentluA
TPicture
TPicture84B
TPlugThread
TPoint
TPopupAlignment
TPopupFormArray
TPopupList
TPopupMenu
TPopupMode
TPopupWndArray
	TPosition
TPrintScale
TPropFixup
TPropIntfFixup
TPUtilWindow
TQuickTransfer
TraceResult
TraceRoute
TrackButton
Tracking
_TrackMouseEvent
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
TransparentColorl)B
TransparentColorValued
TrayClockWClass
TrayNotifyWnd
TReader
TReceiveDataFlux
TReceiveFileThread
	TRegGroup
TRegGroups
	TRegistryS
TRemoteShell
TResourceManager
TResourceStream
TSampleGrabberCB
TSampleGrabberCBImpl
TSampleGrabberCBInt
TScanRange
TScreen
TScreen`
TScreenCapture
TScreenThumb
TScrollBarInc
TScrollBarStyle
TScrollingWinControl
TSearchRec`
TSearchThreadU
TSendDataFluxThread
TSendFileThreadU
TServerEventDispatch
TServerReaderU
TSharedImage
TSHFolder
TShiftState
	TShortCut
TShortCutEvent
TShortCutList
TShortCutList8
	TSiteList
TSizeConstraints
TSizeConstraints<
TSocketHost
TSocketPort
TSocks5Config
TSoundCapture
TStack
TStartDockEvent
TStream
TStreamAdapter
TStringItem
TStringList
TStringList(yA
TStrings
TStringsHwA
TStringStream
TSynchroObject
> ><>T>t>
TThemeServices
TThreadList
TThreadLocalCounter
TThreadX
TTimer
TTrackButton
t:;t$,v
:T;t;x;|;
TUnDockEvent
TUnitHashArray
TUploadFTP
TURKISH_CHARSET
`;t$ v?
;t$,v:
TVariantArray
TVideoImage
TVideoSample
TVisitThread
tVSVWU
TWinControl
TWinControlActionLink
TWindowState
TWMKey
ty;s@u
U0_0i0|0
u*;~8u
u%htnD
UnActiveOfflineKeylogger
UnActiveOnlineKeylogger
UnActiveOnlineKeyStrokes
UnBlockContact
Unexpected Memory Leak
#UnFreezeIO
UnhandledExceptionFilter
UnhookWindowsHookEx
UninitializeFlatSB
UninstallAPP
UninstallString
unknow
Unknow
UNKNOW
Unknown
Unknown compression
unknown compression method
UnmapViewOfFile
UnrealizeObject
UnregisterClassA
UntActivePorts
UntAntiSB
+UntAsyncTask
(UntBot
UntCaptureWebcam
UntControlKey
UntCore
UntCPU
UntDisableAero
)UntDownloaderThread
UntFTP
UntFun
untFunctions
UntFWB
 UntFWB
UntInfections
"UntIPUtils
UntKeepAlive
UntKeylogger
UntMain
UntMainConnectionThread
UntMClipboard
UntMsConfig
UntMSN
UntNetShareLister
UntProcess
UntQuickTransferThread
UntRC4
UntRDPThread
UntReceiveDataFluxThread
UntReceiveFileThread
UntRegEdit
UntRemoteDesktop
)UntRemoteShell
UntRemoteUtils
UntResizePic
UntRootKit
UntRPCScan
+UntScreenCapture
UntSendFileThread
UntServerReader
UntServices
UntSinInfo
UntSoundCaptureThread
untstartup
_UntUDPFlood
(UntUploadFTPThread
UntVars
UntWebCam
UntWindowManager
UPANDEXEC
UPDATE
UpdatesDisableNotify
UpdateWindow
UPFLUX
UPLOADEXEC
UPLOADFILE
URLDOWNLOADTOFILE
URLDownloadToFileA
UrlMon
URLMON.DLL
URLUpdate
UseDockManager,
user32
USER32
user32.dll
User32.dll
USER32.DLL
Userinit
UserInit
\uTorrent\
UTypes
>U>_>v>
uxtheme.dll
<u=y=}=
>!?>?U?Z?
<(=_=v=
;/<<=v=
V2h2x2
VarAdd
VarAnd
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCmp
VarCyFromStr
VarDateFromStr
VarDiv
VarI4FromStr
Variant
VariantChangeType
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
Variants
VarIdiv
VarMod
VarMul
VarNeg
VarNot
VarR4FromStr
VarR8FromStr
VarSub
$VarUtils
VarXor
Vd;VXr
VendorIdentifier
VerLanguageNameA
VerQueryValueA
version.dll
VertScrollBar
<V=f=q=
VFrames
`VFrames
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
Visible
Visible<
VkKeyScanA
vMenus
VSample
VSample0(F
;(;V;t;
;$<)<V<[<$>)>T>Y>
:*:@:V:[:`:v:
VWUUhdN@
:":;:W:|:
WaitForMultipleObjectsEx
WaitForSingleObject
WaitMessage
Wallpaper
WallPaper
waveInAddBuffer
waveInClose
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader
WavPlay
WEBCAMLIVE
WEBCAMSTOP
WEP104
WheelDelta
+WH+W@
WideCharToMultiByte
WideString
WideStrUtils
Width<
WidthX
WindowFromPoint
WindowMenu
Windows
Windows 2000
Windows 7
Windows 95
Windows 98
Windows Me
Windows NT 4.0
Windows Server 2003
WindowState
Windows Vista
Windows XP
WinDrive
WinExec
?WinInet
wininet.dll
winmm.dll
WINNLSEnableIME
WinSock
WinSvc
wlanapi.dll
WlanCloseHandle
WlanEnumInterfaces
WlanGetAvailableNetworkList
WlanOpenHandle
WlanQueryInterface
WndProcPtr%.8X%.8X
?W?o?u?
WPA_NONE
WPA_PSK
WPA_USE_GROUP OR RSN_USE_GROUP
WriteClip
WriteFile
WriteProcessMemory
WS2_32.DLL
WSACleanup
__WSAFDIsSet
WSAGetLastError
WSAIoctl
WSAStartup
wscsvc
wsMaximized
wsMinimized
wsNormal
wsock32.dll
WWinSpool
: ;=;x;
;X0t@S
;X0uG;u
XD;PHu
XRIGHT
XUntHTTPFlood
xUSock
XWHEEL
=Y=a=s=x=
yDirect3D9
YesToAll
>Y?j?r?
{<:y&q?	
YStrUtils
YUntScanPorts
-YUNVt=-
_^[YY]
Y_^[Y]
$YZ_^[
$YZ]_^[
YZ]_^[
YZXtm1
?!?>?z?
:&;?;Z;
(Z]_^[
$Z]_^[
ZLibEx
ZTUWVSPRTj
?+???Z?u?
?=?Z?z?