Analysis Date2015-04-27 04:41:30
MD503da62258ab053908fb935c50287d949
SHA1e1c5da11f9710f52e8bb130cc3a9396354c2ca54

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: c8087ea6a249266ed1db0453229b76c2 sha1: f24c3538e03212398d0206382ac7e42c6f8b23bf size: 580096
Section.itext md5: 7d01b8ffc56f096e211f89f0f28e5b49 sha1: 43b3dfdb6c15c992bdb77e04b014a72fa7083d43 size: 6656
Section.data md5: cb210a12278fc6b67accee22c52b9ad1 sha1: 51bc7293587b0d76ffac8b0a91f132bf3a441c59 size: 15872
Section.bss md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.idata md5: 80655c280fee15e63402a8fc93041c3c sha1: 70058b942a43ead6b6712ab5c943d69bcaec2034 size: 16896
Section.tls md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rdata md5: c1788dfeb92bbf0cff5aeaeaf1270ff8 sha1: 469a55b2d8c433d2a38eb7d9398cf0c8965abf15 size: 512
Section.reloc md5: 590aac335a7094d529e15198df1c5920 sha1: 19f6ce5bce0408d9def55b6f4e98e57a871d8c56 size: 35840
Section.rsrc md5: 36fc0f2328ae84440d5c533b8e4e18f3 sha1: a06f3f6496550e49d06d98b94aa9319cb4e10198 size: 17408
Timestamp2012-06-08 11:12:27
VersionLegalCopyright: Copyright (C) 1999
InternalName: MSRSAAPP
FileVersion: 1, 0, 0, 1
CompanyName: Microsoft Corp.
Comments: Remote Service Application
ProductName: Remote Service Application
ProductVersion: 4, 0, 0, 0
FileDescription: Remote Service Application
OriginalFilename: MSRSAAP.EXE
PEhash100026082cf25b51ed9226876ff03e7f4f84e949
IMPhash8033c11f8a2fdfc317e8655120579933
AVAd-AwareGen:Trojan.Heur.PK0@rKTRLAjS
AVAlwil (avast)Delf-SQI [Trj]
AVArcabit (arcavir)Gen:Trojan.Heur.PK0@rKTRLAjS
AVAuthentiumW32/Downloader.C.gen!Eldorado
AVAvira (antivir)BDS/Backdoor.Gen
AVBitDefenderGen:Trojan.Heur.PK0@rKTRLAjS
AVBullGuardGen:Trojan.Heur.PK0@rKTRLAjS
AVCA (E-Trust Ino)Win32/Fynloski.A!generic
AVCAT (quickheal)Backdoor.Fynloski.A9
AVClamAVWIN.Trojan.DarkKomet
AVDr. WebBackDoor.Tordev.9
AVEmsisoftGen:Trojan.Heur.PK0@rKTRLAjS
AVEset (nod32)Win32/Fynloski.AM
AVFortinetW32/DarkKomet.ID!tr.bdr
AVFrisk (f-prot)W32/Downloader.C.gen!Eldorado
AVF-SecureGen:Trojan.Heur.PK0@rKTRLAjS
AVGrisoft (avg)BackDoor.Generic15.BIJI
AVIkarusBackdoor.Win32.DarkKomet
AVK7Trojan ( 004ab1b21 )
AVKasperskyBackdoor.Win32.DarkKomet.zem
AVMalwareBytesBackdoor.Agent.DCRSAGen
AVMcafeeGeneric BackDoor.xa
AVMicrosoft Security EssentialsBackdoor:Win32/Fynloski.A
AVMicroWorld (escan)Gen:Trojan.Heur.PK0@rKTRLAjS
AVRisingBackdoor.Pontoeb!4DF0
AVSophosMal/Fynloski-C
AVSymantecno_virus
AVTrend MicroBKDR_FYNLOS.SMM
AVTwisterBackdoor.1BF177D5B42E079D
AVVirusBlokAda (vba32)Backdoor.DarkKomet

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit ➝
C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\Crsc\crsc.exe\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\crsc ➝
C:\WINDOWS\system32\Crsc\crsc.exe\\x00
Creates FileC:\WINDOWS\system32\Crsc\crsc.exe
Creates FilePIPE\lsarpc
Creates Processcmd.exe /k attrib C: +s +h
Creates ProcessC:\WINDOWS\system32\Crsc\crsc.exe
Creates Processcmd.exe /k attrib C: +s +h

Process
↳ cmd.exe /k attrib C: +s +h

Creates Processattrib "C:\malware.exe" +s +h

Process
↳ cmd.exe /k attrib C: +s +h

Creates Processattrib "C:" +s +h

Process
↳ C:\WINDOWS\system32\Crsc\crsc.exe

Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates MutexDC_MUTEX-QQT124F

Process
↳ attrib "C:\malware.exe" +s +h

Process
↳ attrib "C:" +s +h

Network Details:

DNSlolipop.sevegame.com
Type: A
141.8.225.80
Flows TCP192.168.1.1:1037 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1038 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1039 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1040 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1041 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1042 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1043 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1044 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1045 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1046 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1047 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1048 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1049 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1050 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1051 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1054 ➝ 141.8.225.80:1604
Flows TCP192.168.1.1:1055 ➝ 141.8.225.80:1604

Raw Pcap

Strings
 - 
,  x 
, 
.
\
-
 
 
.
.
.
@
`@
.
.
.
..
$
@
#
;
.
.
..
23
.
==??
???????????????
0000
000000
040904b0
1, 0, 0, 1
!1Aa
#+3;CScs
4, 0, 0, 0
66006666
6666
9-+,
&Abort
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
A call to an OS function failed/Application is not licensed to use this feature
Access violation
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
*A control cannot have itself as its parent
&All
Alt+
Ancestor for '%s' not found
Application Error1Format '%s' invalid or incompatible with argument
April
Assertion failed
August	September
Bitmap image is not valid
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
BkSp
Cancel
Cannot assign a %s to a %s
Cannot create file "%s". %s
Cannot drag a form
Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Cannot open clipboard/Menu '%s' is already being used by another form
Cannot open file "%s". %s
Canvas does not allow drawing
Class %s not found
clock
combobox
Comments
CompanyName
Confirm
Control-C hit
Copyright (C) 1999
Ctrl+
DCDATA
DCOM not installed"Unable to find a Table of Contents
December
Division by zero
Docked control must have a name%Error removing control from dock tree
 - Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
 - Dock zone not found
Down
DVCLAL
ebutton
edit
EEEEEEEE
Enter
Error
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error reading %s%s%s: %s
Exception in safecall method
explorerbar
External exception %x
Failed to create key %s
Failed to get data for '%s'
Failed to set data for '%s'
February
File access denied
FileDescription
File not found
FileVersion
Floating point division by zero
Floating point overflow
Floating point underflow
Friday
FriendlyName
header
&Help
Home
Icon image is not valid
&Ignore
Information
Integer overflow Invalid floating point operation
Interface not supported
InternalName
Invalid argument
Invalid argument to date encode
Invalid argument to time encode
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid clipboard format Clipboard does not support Icons
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid filename
Invalid ImageList
Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context
Invalid image size
Invalid numeric input
Invalid pixel format
Invalid pointer operation
Invalid property path
Invalid property value
Invalid stream format$''%s'' is not a valid component name
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant type
Invalid variant type conversion
I/O error %d
January
@jjj
jjjj
jjjjj
jjjjjj
July
June
Left
LegalCopyright
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
listview
March
menu
Menu index out of range
Menu inserted twice
Metafile is not valid
Microsoft Corp.
Monday
MSRSAAP.EXE
MSRSAAPP
No argument for format '%s'"Variant method calls not supported
No help found for context$No topic-based help system installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
No help found for %s#No context-sensitive help installed
Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active$%s not in a class registration group
N&o to All
November
Null Renderer
October
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Operation not supported
OriginalFilename
Out of memory
Out of system resources
PACKAGEINFO
page
PgDn
PgUp
Privileged instruction(Exception %s in module %s at %p.
ProductName
ProductVersion
progress
Property is read-only
Property %s does not exist
Range check error
Read
Read beyond end of file	Disk full
rebar
Remote Service Application
Resource %s not found
&Retry
Right
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Sample Grabber
Saturday
Scan line index out of range!Cannot change the size of an icon
scrollbar
Shift+
'%s' is not a valid GUID value
!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time
Space
spin
%s%s
%s.Seek not implemented$Operation not allowed on sorted list
%s (%s, line %d)
Stack overflow
startpanel
status
Stream read error
Stream write error
StringFileInfo
Sub-menu is not in menu
Sunday
System Error.  Code: %d.
taskband
taskbar
Thread creation error: %s
Thread Error: %s (%d)
Thursday
toolbar
tooltip
Too many open files
trackbar
Translation
traynotify
treeview
Tuesday	Wednesday
Unable to create directory
Unexpected variant error
Unsupported clipboard format
VarFileInfo
Variant or safe array is locked
Variant overflow
Video Capture
VS_VERSION_INFO
Warning
window
Write$Error creating variant or safe array)Variant or safe array index out of bounds
&Yes
Yes to &All
<$=">!?
<&<}<	=
<#=]=|=
>-?:?[?
                                                                
-.-.-.-
;;;\;};
;";*;\;
:":(:@:
:":&:*:
?"?&?*?
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
								
0.0.0.0
0 0$0(0,0004080<0@0D0H0L0P0T0d0u0y0
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0 0(0,0004080<0@0D0H0\0|0
0"0&0*0.02060:0>0B0F0J0N0R0V0Z0^0b0f0j0n0r0v0z0~0
0#0'0+0/03070;0?0C0G0K0[0
0 0(00080@0H0P0X0`0h0p0x0
0 000<0u0
0#00050B0G0T0Y0f0k0x0}0
0%0)0/060:0T0]0f0r0|0
0!000G0V0m0|0
0+0?0]0q0
0!0-0<0V0
0"0*020:0B0J0R0Z0b0j0r0z0
0$0(04080@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0&0,0A0O0U0`0{0
000D0/1
0(0:0F0X0h0r0
0 0@0H0L0P0T0X0\0`0d0h0x0
0-0<0J0[0l0
0(0-0L0Y0d0q0
0&0/0Q0
0)0>0S0e0
0(0<0T0h0|0
0(080@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0
	0(080E0
0/0f0y0
0&0G0R0k0
0,0I0~0
0>0I0O0\0m0
0.0K0~0
"0<0L0z0
 0(0W0v0
&0-0X0_0
0!1-1;1"2,222[2q2
0$1.191
0123456789abcdef
0123456789ABCDEF
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ/*-+.=
0123456789ABCDEFGHJKLMNPQRSTUVWXYZ
0	1F1\1r1
0?1K1R1\1n1|1
0@1L1k1z1
0#1O1d1|1
020A0P0b0{0
020H0j0z0
030X0d0}0
04181@1D1
= =$=(=,=0=4=8=
< <$<(<,<0<4<8<<<@<D<\<|<
> >$>(>,>0>4>8><>@>D>H>L>P>T>b>t>
:(:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
; ;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:t:
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=t=
; ;$;(;,;0;4;8;<;@;D;H;L;P;X;j;|;
;$;(;,;0;4;8;<;@;D;H;L;Z;
= =$=(=,=0=4=8=<=@=D=P=T=X=h=y=}=
> >$>(>,>0>4>8><>@>D>R>Z>b>j>|>
=$=(=,=0=4=8=<=@=D=T=t=|=
? ?$?(?,?0?4?8?<?@?P?p?x?|?
> >$>(>,>0>4>8><>T>d>t>|>
? ?$?(?,?0?4?H?]?a?
< <$<(<,<0<4<H<h<p<t<x<|<
< <$<(<,<0<4<<<P<e<i<|<
-050=0B0[0g0l0
061K1^1
"063>3I3
>">)>0>7>>>E>L>S>Z>a>h>o>v>}>
>0>8><>@>D>H>L>P>T>X>\>`>d>
? ?$?,?0?8?<?D?H?P?T?c?o?x?
< <$<,<0<8<<<D<H<P<T<\<`<h<l<t<x<
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
: :(:0:8:@:H:P:X:`:h:p:x:
? ?(?0?8?@?H?P?X?`?h?p?x?
>(>0>8>K>d>
,090b0
:	;0;9;A;H;P;\;e;r;
<0<9<T<g<z<
>0?b?~?
<0<B<T<f<x<
;0c0j0
(0c0r0
;0<;<F<`<e<
<+=0=g=
0I0M0T0
0j1t1~1
<0<k<p=
	0L0`0|0
<&<0<;<M<\<|<
0M0i0m0q0u0y0}0
,0O0T0Y0^0c0h0
;(;0;<;P;X;\;`;d;h;l;p;t;x;
=0=s={=
=0=S=v=
0T0X0\0`0
:0;T;c;
0UntMiscFunc
0UntPasswordAndData
^0x0w1
0x%.2x%.2x%.2x%.2x%.2x%.2x
-[[[[1
-{{{{1
101<1T1`1y1
10181<1@1D1H1L1P1T1X1h1
101P1o1
1 1(10181@1H1P1X1`1h1p1x1
1-1<1}1
1!1%1)101I1l1x1|1
1!1,1=1|1
1,111>1C1P1U1b1g1t1y1
1 1$1(1j1
1"1*121:1B1J1R1Z1b1j1r1z1
1+1/131V1^1u1}1
1$1(181W1x1
1,1;1B2Q2`2o2~2
1#1)1C1L1T1b1g1q1
1.1;1F1Y1f1
1!1.1G1[1f1k1v1{1
111N1n1
1+1:1O1^1h1p1u1}1
1!141d1s1
1&141T1\1`1d1h1l1p1t1x1|1
1)161`1}1
1.161>1F1N1V1^1f1n1v1~1
1#161i1
1%181]1-2H2a2{2
1#1A1I1Q1Y1a1i1q1y1
1$1b1g1
1(1B1L1V1`1o1y1
1(1F1Y1
1<1G1N1Y1g1
1(1H1,7074787<7@7X8`8d8
1-1H1g1{1
1%1j1~1
1,1L1T1X1\1`1d1h1l1p1t1
1:1p1}1
"1@1X1x1
1"202N2
1 2/2?2d3
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
1!252I2]2q2
127.0.0.1
127.0.0.1:1604
1)272F2]2
1.2C2U2
1?2K2X2h2x2
1(2o2v2
1*2Z2u2
14181<1@1D1H1L1P1T1
161K1W1_1i1n1s1x1}1
=)>1>8>D>H>T>X>`>d>h>l>p>t>x>|>
; <1<8<><D<K<[<b<h<n<u<
1b2l2v2
1C2I2Y2f2l2|2b3i384?4
=*=1=D=\={=
1D2a3u3
<-<1<D<d<l<p<t<x<|<
1h1l1p1t1x1
1H2Q2^2
>1>=>I>S>]>i>u>
1l2p2t2x2|2
1M1[1y1
1R1`1~1
1SCDesktop
1SCMydocs
1t2x2|2
1X1&5:5Q5j5;;W;e;
:":-:2:=:
 2001, 2002 Mike Lischke
 2004, 2005 Pierre le Riche / Professional Software Development
213d3+474>4P4z4
2$2,2024282<2@2D2H2L2d2p2
2 2(20282D2H2L2P2X2\2`2d2h2l2p2t2x2|2
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
2 2$2(2,2024282<2@2D2H2L2T2d2r2v2
2"2&2*2.22262:2>2B2F2J2N2R2
2 2%2+22282=2C2H2N2U2[2f2n2w2
2"2*222:2B2J2R2Z2b2j2r2z2
2#2'2+2/23272;2?2C2G2K2O2S2W2[2_2c2g2k2o2
2 2$2(2,2D2d2l2p2t2x2|2
2 2$2(2,2F2N2V2^2f2n2v2~2
2(2-2:2?2L2Q2^2c2p2u2
2 2$2(282X2`2d2h2l2p2t2x2|2
2"2?2]2e2m2u2}2
222@2N2\2n2
2%2/292D2N2T2f2t2|2
222H2^2t2
222I2V2[2
2 2<2L2f2
2*2=2P2c2m2u2}2
2$242F2V2u2
2-262;2@2N2W2\2a2o2x2}2
2/262B2Y2`2m2
2$272C2M2T2^2e2o2|2
2$272I2f2y2
2#2d2{2
2$2D2L2P2T2X2\2`2d2h2l2
2$2D2L2P2T2X2\2`2d2h2l2p2t2x2|2
2$2D2P2d2l2p2t2x2|2
2#2E2R2d2q2{2
2^2g2u2
2(2H2e2
2>2V2x2
2(313;3K3W3l3
2#3/3>3
2+3;3R3j4
2&343U3
2)373E3e3
2"393?3n3t3
2<3H3\3d3h3l3p3t3x3|3
262c2m2}2
?2?6?:?T?d?t?|?
272?2C2]2e2i2
282I2l2
292E2_2k2
<"<*<2<:<B<J<R<Z<b<j<r<z<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
;";*;2;:;B;J;R;Z;b;j;r;z;
:":*:2:::B:J:R:Z:b:j:r:z:
?"?*?2?:?B?J?R?Z?b?j?r?z?
?(?2?<?F?P?Z?d?n?
;2;F;Q;Y;a;w;
<-<2<g<H>
2H2S2`2k2
< <$<2<H<X<\<n<r<v<
2I2M2Q2U2Y2]2a2e2i2m2q2u2y2}2
2j6s6}6
;(>2>_>j>x>
2K2c2}2
2N2V2^2f2n2v2~2
2n3r3v3z3~3
>	?2?O?o?
2UntDCSettingsReader
%.2x-%.2x-%.2x-%.2x-%.2x-%.2x
=2=;=y=
;%;3;[;
30?0F0L0^0l0
30O1g1x1
313?3M3[3i3w3
323O3o3
323R3o3
324K4Z4
#32770
 32 bit
3#313?3M3[3 4-4G4U4c4q4
3!3*303A3L3Q3n3v3~3
3"3*323:3B3J3R3Z3b3j3r3z3
3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 3$3(3,3
3 3$3(3,3034383
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 3$3(3,3034383<3@3D3H3L3Z3h3l3|3
3 3$3(3,3034383<3@3P3p3x3|3
3 3$3(3,3034383`3n3|3
3 3$3(3,3034383D3d3l3p3t3x3|3
3"3*3<3c3l3u3
3 3$3<3R3V3g3o3
333:3Z3l3
3$3,343<3D3L3T3\3d3l3t3|3
3&3.363>3F3N3V3^3f3n3v3~3
3"3-373>3H3O3Y3`3j3o3t3y3
3"3'393H3^3q3
3 3,3C3h3t3
3&3.3D3d3l3p3t3x3|3
3)3?3G3f3k3
3!3/3J3_3i3n3
333J3g3
3"3.3L3V3]3
3#3@3M3R3p3
334L4[4
3)383U3
3)393U3e3
3<3D3H3L3P3T3X3\3`3d3
3+3K3h3
3+3P3`3
3+3v3}3
3 4,4@4H4L4P4T4X4\4`4d4h4l4p4~4
3)4.4l4
3$4C4_4
3>4I4X4}4
3)4i6v6
3^4l4w4
354>4C4e4r4
=#='=+=/=3=7=;=?=
>3>7>;>T>d>t>|>
384K4U4[4
393J4d4
:!:':3:C:h:s:9;C;I;M;S;W;];a;g;k;q;u;{;
3CommDlg
>'?3?:?D?N?`?p?
=3>d>q>
3F3V3c3s3
?/?3?g?
:(;3;M;
<#<3<M<c<
3Messages
>3>o>~>
3O4[4b4l4w4
3T3c3r3
3U4^4}4
3W3v3~3
:3:;:X:s:
40G0Z0t0
424:4J4V4V5^5p5|5
424f4z4
4%414E4N4b4
4(4,40444@4D4H4L4P4T4X4\4h4l4x4|4
4%4+404;4A4F4Q4W4\4g4m4r4}4
4$4)40454v4
4"4*424:4B4J4R4Z4b4j4r4z4
4"4,424>4C4N4S4X4c4h4m4x4}4
4 4(4,4044484<4@4D4H4L4`4p4
4 4$4(4,4044484<4@4D4H41696C6P6z6
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4 4$4(4,4044484<4@4D4N4R4d4u4y4
4"4&4*4.42464:4>4B4F4J4b4~4
4"4&4*4.42464:4>4B4F4J4N4R4V4Z4^4b4f4j4n4r4v4
4$444<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4
4 444<4@4D4H4L4P4T4X4\4`4d4r4z4
4$4,444<4D4L4T4\4d4l4t4|4
4,44484<4@4D4H4L4P4T4h4
4.4[4`4z4
4$4.464@4J4R4Z4b4r4|4
4%4/484A4K4X4c4u4
4	4"4F4N4l4t4
4<4\4y4
4!454f4
4&464M4]4u4
4)4F4f4
4#4F4p4
4-4G4]4j4w4
4#4X4u4
4.5;5@5
4#5*5?5
4 5$5(5,5H5L5P5T5`5d5p5t5x5|5
4	555B5V5]5w5
4(5:5?5N5d5
4)5.565;5P5U5]5{5
4	5)5F5f5
4(5=5U5
4=5<6P6~6
4#5H5(6@6
4!6>6f6h9x9
4,6X6n6}6
474c4h4z4
476=6T6u6~6
476Z6}6
>,>4>8><>@>D>H>L>P>T>d>
<,<4<8<<<@<D<H<L<P<T<p<
:,:4:8:<:@:D:H:L:P:T:p:
;,;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;><B<F<J<N<R<V<Z<^<b<f<j<n<r<
;,;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
= =(=,=4=8=@=D=L=P=X=\=d=h=p=t=
494>4d4i4
495t5.6;6F6U6l6|6
?4?9?V?[?p?u?
:':.:4:<:B:P:V:d:j:x:
>4>D>P>T>\>`>d>h>l>p>t>x>|>
:&:4:F:T:c:
4I5P5g5
4J5X5|5
4N5j5o5
4Q4a4w4
4T5h5{5
> >$>4>T>\>`>d>h>l>p>t>x>|>
?4?T?q?
4U4Z4^4b4h4
$;4$w	f
%.4x:%.4x
<4<X<`<d<{<
5"505@5P5X5\5`5d5h5l5p5t5x5|5
5"525G5R5`5q5
5*535P5i5y5
5$5,5054585<5@5D5H5L5
5"5*525:5B5J5R5Z5v5
5"5-53585C5I5N5Y5_5d5o5u5z5
5 5/535D5d5l5p5t5x5|5
5'5^5{5
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5 5$5(5,5054585F5d5
5 5$5(5,5D5Z5^5o5w5{5
5!5&5;5[5k5
5"5'5:5?5R5W5j5o5
5#5'5+585D5H5T5X5`5d5h5l5p5t5x5|5
5&5.595>5H5R5j5r5
5(5<5f5k5}5
5,5<5L5T5X5\5`5d5h5l5p5t5x5|5
5%5-5N5V5g5
5)5@5P5g5
5'575n5
5 585<5@5D5H5L5P5T5X5l5
5"585D5X5`5d5h5l5p5t5x5|5
5+595G5U5c5q5
5$5a6}6
5$5D5g5
5<5D5H5L5P5T5X5\5`5d5|5
5%5E5M5g5o5s5
5=5I5i5
5;5W5v5
5 5Y5v5
5:5Z5w5
5$5Z5x5
5 6'6.6
5	6:6&7h7
5!6(6a6
566B7k7
566m6*787Q7^7c7p7u7
5*6;6O6
5+6E6S6
5>6I6@8
5:6I6U6
5)6N6`6l6{6
5*6P6]6l6{6
595Y5v5
<	=5=>=c=o=v=
>5>D>[>|>
5G5L5h5
<%=5=L=\=
5M5U5[5g5n5
<5<M<h<
=$>5>\>o>
5P6p6x6|6
<&=5=s=
5Themes
=%>->5>=>W>s>x>
60646x6|6
646W6o6
 64 bit
6"616>6M6
6+616I6V6^6g6u6
6 626m6
6'636L6X6g6v6
6 6$646<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6?6\6|6
6&6*6.626H6_6c6t6
6 6$6(6,60646@6K6O6]6e6~6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6l6y6}6
6 6$6(6,6064686<6@6D6H6L6P6T6X6f6n6V7Z7^7b7f7j7n7r7v7z7~7
6&6.666<6D6L6T6\6d6l6t6|6
6%6/666@6O6[6s6}6
6!6.6_6j7
6!6+696I6a6m6y6
6 6(6D6
6 6<6D6H6_6g6k6
6,6<6H6L6T6X6\6`6d6h6l6p6t6x6|6
6"6*6r6
6"6*6R6|6
6'6A6y6
6<6D6H6L6P6T6X6\6`6d6h6l6p6
6+6G6j6o6
6[6g6n6x6
6%6H6b6x6
6#6L6P6
6+6l6t6z6
6%6T6p6
6$717=7F7M7u7\8
6 7,707<7@7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
6%777r7
6 7:7d7
6#7@7d7q7y7
6	7,7O7r7
6*7H7`7l7
6 7U7n7~7
6A6U6i6
>6>A>I>X>l>z>
>!>,>6>A>K>V>`>k>u>
6B6r6~6
<6=:=>=B=F=J=N=R=V=Z=^=b=f=j=
6C7Q7`7
;);6;C;P;`;e;m;
6D7d7z7
>'>6>E>T>c>r>
6F;[;f;
6h7x7|7
?(?6?K?X?]?j?o?|?
?6?O?g?
6p6t6x6|6
:):6:@:R:X:e:r:|:
:6:S:s:
;,<6<W<b<i<t<
738A8S8m8|8
747Y7o7
748J8R8Z8b8j8r8z8
758:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9
7(717=7F7R7[7g7l7x7
7$727D7T7]7
7$747@7J7Z7f7p7z7
7)747B7d7~7
7 757B7G7T7Y7f7k7x7}7
7$7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
7$7,747<7D7L7T7\7d7l7t7|7
7"7.7<7
7 7$7(7,7074787<7@7D7H7L7P7T7h7{7
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
7 7$7(7,70747s7}7
7'7,777=7H7
7!777?7C7\7
7 7$7(7,7P7T7
7"7&7>7L7P7l7t7x7|7
7$7(787@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
7!7&7K7T7g7r7}7
7&7+7l7
7.787=7I7V7v7~7
7'7A7M7]7u7
7&7D7V7
7$7F7O7q7{7
7,7I7i7
7,7L7T7X7\7`7d7h7l7p7t7x7|7
7(7P7t7
7(7V7t7
7;7X7x7
7!848C8
7.858f8m8
7+8:8I8X8g8v8
7)8.8N8_:d:
7	8A8Z8q8
7-8b9R:
7!8D8g8
7<8N8k8
797V7v7
7A8I8_8
7h7O9T9
7J8X8y8
="=,=7=;=L=P=T=n=v=
7nduWlanTypes
7S8i8{8
7T7a7o7
7UntInputsControls
<#<'<+<8=\=
 !"#$%8
:8;^;{;
80211_OPEN
80211_SHARED_KEY
808=8X8
80L0Y0m0z0
818O8[8f8p8z8
82999O9S9W9[9_9c9
829=9R9j9
838K8Y8h8
85999=9A9H9
878<8H8M8[8g8o8u8
878>8M8
8(8084888<8@8D8H8L8P8T8X8\8`8p8
8,818>8C8P8[8
8 868:8>8B8]8a8e8i8
8(878C8M8]8
8)878C8Q8
8$8,8084888<8@8D8H8L8P8T8X8p8
8 8(80888@8H8P8X8`8h8p8x8
8$8,848<8D8L8T8\8d8l8t8
8$8+858:8H8O8X8`8m8z8
8$8)868;8H8M8Z8_8l8q8~8
8"8,868;8J8R8Z8b8t8
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
8 8$8(8,808^8h8o8
8"8&8*8.82868:8>8B8F8J8N8R8V8Z8^8b8f8j8n8r8v8z8~8
8 8$8(8,8:8B8J8X8\8p8
8 8$8,8D8`8d8l8p8t8x8|8
888@8D8H8L8P8T8X8\8`8|8
8#8,8:8M8j8y8
8,8<8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
8(8<8D8H8L8P8T8X8\8`8d8r8z8
8!8>8e8
8:8?8j8
8,8:8M8
8(898K8U8k8|8Z9
8%8B8u8
8(8C8^8
8+8c8m8
8<8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
8;8G8O8W8j8
8<8I8S8d8i8y8
8&8q8y8
8$8U8Y8`8
8+90989b9s9|91:;:
8#9+9G9O9S9j9r9
8!9.9P9V9}9
8/9A9Z9f9n9
8.9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9
8%9m9}9
8+9q9u9y9}9
<8<@<D<H<L<P<T<X<\<`<d<h<
;8;@;D;H;L;P;T;X;\;`;d;h;
?8?@?D?H?L?P?T?X?\?`?p?
8DLLMemory
:8:E:}:
8E9M9S9_9g9
<&<*<8<f<
8H9U9o9}9):6:
?8?I?f?
>&>8>J>l>|>
?$?8?M?
=8=M=t=
{8+{p+{h
8Registry
8X8w8h9v9
9>:[:$;
909U9q9
90K0P0q0
90:@:s:
9!:%:):-:1:5:9:=:A:E:I:M:Q:U:Y:]:a:e:i:m:q:u:y:}:
91:8:J:N:R:V:Z:^:
9&:2:::n:|:
939;9^9i9}9
93:R:o:
979T9t9
989[9~9
9,909]9l9
9 91959H9X9d9h9p9t9x9|9
9-939=9B9J9R9Z9c9m9z9
9'949D9T9`9d9l9p9t9x9|9
9'959C9Q9_9m9{9
9$9,9094989<9@9D9H9L9P9T9X9\9`9d9h9v9
9 9(90989@9H9P9X9`9h9p9x9
9$9,909D9L9m9y9
9"9*929:9B9J9R9Z9b9j9r9
9%9-959K9b9g9l9q9
9$9)969=9G9T9\9m9
9 9$9(9,9094989<9@9D9
9 9$9(9,9094989<9@9D9H9L9P9T9X9
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
9 9$9(9,909P9i9
9	9(999W9^9
9 9$9(9D9d9l9p9t9x9|9
9$9>9I9^9i9u9
9#9+9I9Q9l9t9x9
9-9;9J9a9
999S9q9
9 9^9w9
9:9B9b9
9<9D9H9L9P9T9X9\9`9d9z9
9+:*;9;P;d;
9$9T<t<
9?9Y9k9
; ;9;A;[;c;g;z;
9.:B:J:`:x:
;9<C<Z<
9<:\:d:h:l:p:t:x:|:
9F:J:N:R:V:Z:^:b:f:j:n:r:v:z:~:
9#:G:{:
9 :@:H:L:P:T:X:\:`:d:h:x:
9!:>:K:g:
9-:N:z:+<
9P:\:i:
9R:_:y:
9S:`:s:
="=<=A=[=
ACanvas
accept
Accept
ACCESS DENIED (x64)
[ACMIn
acmStreamClose
acmStreamConvert
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
acmStreamSize
acmStreamUnprepareHeader
Action
Action 
ActivateKeyboardLayout
ActiveControl
ActiveOfflineKeylogger
ActiveOnlineKeylogger
ActiveOnlineKeyStrokes
ACTIVEREMOTESHELL
ActiveX
ActnList
;.;A;c;z;
AddContact
AddSize
ADDSOCKS5
?A?d?i?n?s?x?}?
ADirectShow9
AdjustTokenPrivileges
AdjustWindowRectEx
advapi32.dll
;=<A<E<I<P<
|afxCodeHook
<%<)<A<I<e<m<
=!=%=<=a=i=m=
akBottom
akLeft
akRight
alBottom
alClient
alCustom
	AlignInfo
	Alignment
	AlignRect
AlignWithMargins<
alLeft
alNone
AlphaBlendT
AlphaBlendValue
alRight
_AMMediaTypeH
Anchors
=A>N>h>
AnimateWindow
ANSI_CHARSET
AntiVirusDisableNotify
An unexpected memory leak has occurred. 
Apartment
AppData
ARABIC_CHARSET
Archive
Array 
attrib "
AttribArchive
AttribHidden
AttribNormal
AttribRO
AttribSystem
AttribTemp
aUntWIFI
	AutoCheck
AutoConnect
AutoHotkeys
AutoLineReduction
AutoLineReductionl6B
	AutoMerge
	AutoPopup
AutoScroll
AutoSize
AVICAP32.DLL
?%?B?~?
;B0uGj
backinfoes
BALTIC_CHARSET
<!<B<c<
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
BDSUnthemedDesigner
=*>B>e>
BeginBufferedPaint
BeginPaint
Be Right Back
?*?/?B?G?Z?_?r?w?
BiDiMode
BiDiModex
biHelp
biMaximize
biMinimize
biSystemMenu
BitBlt
Bitmap
bListUnit
BlockContact
BlockInput
;Blu	3
Boolean
BorderIcons
BorderStyle
BorderWidth<
#BOT#CloseServer
#BOT#OpenUrl
#BOT#Ping
#BOT#RunPrompt
#BOT#SvrUninstall
Bottom
#BOT#URLDownload
#BOT#URLUpdate
#BOT#VisitUrl
BP_^[]
>B>R>i>
 Broadcast adress : 
 Broadcasts : NO
 Broadcasts : YES
B.rsrc
Brush<
bsBDiagonal
bsClear
bsCross
bsDiagCross
bsDialog
bsFDiagonal
bsHorizontal
bsNone
bsSingle
bsSizeable
bsSizeToolWin
bsSolid
bsToolWindow
bsVertical
BTERRORDownload File| Error on downloading file check if you type the correct url...|
BTERRORUpdate from URL| Error on downloading file check if you type the correct url...|
BTERRORVisit URL|An exception occured in the thread|
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: name <-> ordinal number don't match
BTMemoryGetProcAddress: no export table found
 BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: Can't attach library
BTMemoryLoadLibary: dll dos header is not valid
BTMemoryLoadLibary: Get DLLEntyPoint failed
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid
BTMemoryLoadLibary: VirtualAlloc failed
BTRESULTClose Server|close command receive, bye bye...|
BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|
BTRESULTHTTP Flood|Http Flood task finished!|
BTRESULTMass Download|Downloading File...|
BTRESULTOpen URL|
BTRESULTPing|Respond [OK] for the ping !|
BTRESULTRun command|
BTRESULTSyn Flood|Syn task finished!|
BTRESULTUDP Flood|UDP Flood task finished!|
BTRESULTUninstall|uninstall command receive, bye bye...|
BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|
BTRESULTVisit URL|finished to visit 
BufferedPaintSetAlpha
buffer error
BuildImportTable: can't load library: 
BuildImportTable: GetProcAddress failed
BuildImportTable: ReallocMemory failed
Button
BUTTON
ButtonSizet(B
=(>B>x>
ByRef 
 bytes: 
 Bytes
 Bytes (
;B<Z<r<
;$<:<c<
C0O042
caFree
caHide
CallHelp
CallNextHookEx
CallWindowProcA
#CAMEND
CAMERA
caMinimize
Cancel
CanClose
CanDock
caNone
capGetDriverDescriptionA
Caption
Caption<
Cardinal
Category
;&<C<c<
C ;C$s
Cd;Cpt
CD-ROM
>!?(?c?g?k?o?s?w?{?
CHANGEDATE
[ChangeID]
ChangeWindowName
CharLowerA
CharLowerBuffA
CharNextA
Charsett(B
CharToOemA
CharUpperBuffA
CHATNUDGE
CHATOUT
Ch;Ctt
Checked
CheckMenuItem
CHIDED
CHIDEF
CHINESEBIG5_CHARSET
;ChwpV
> >;>C>I>
?C?J?_?l?r?z?
$:Cjtc
ckAttachToInterface	OleServer
ckNewInstance
ckRemote
ckRunningInstance
ckRunningOrNew
cl3DDkShadow
cl3DLight
clActiveBorder
clActiveCaption
clAppWorkSpace
clAqua
Classes
^Classes
ClassesHmA
clBackground
clBlack
clBlue
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clCream
clDefault
CleanMsConfig
ClearC
clFuchsia
clGradientActiveCaption
clGradientInactiveCaption
clGray
clGrayText
clGreen
clHighlight
clHighlightText
clHotLight
Client
ClientHeight<
ClientToScreen
ClientWidtht(B
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
:: Clipboard Change : size = 
Clipbrd
clLime
clMaroon
clMedGray
clMenu
clMenuBar
clMenuHighlight
clMenuText
clMoneyGreen
clNavy
clNone
clOlive
CloseCD
CLOSECHAT
CloseClipboard
CloseHandle
CloseServer
CloseServiceHandle
closesocket
CloseThemeData
CloseW
clPurple
clScrollBar
CLSIDFromProgID
clSilver
clSkyBlue
;CLt_3
clTeal
clWebAliceBlue
clWebAntiqueWhite
clWebAquamarine
clWebAzure
clWebBeige
clWebBisque
clWebBlack
clWebBlanchedAlmond
clWebBlue
clWebBlueViolet
clWebBrown
clWebBurlywood
clWebCadetBlue
clWebChartreuse
clWebChocolate
clWebCoral
clWebCornFlowerBlue
clWebCornSilk
clWebCrimson
clWebCyan
clWebDarkBlue
clWebDarkCyan
clWebDarkGoldenRod
clWebDarkGray
clWebDarkgreen
clWebDarkKhaki
clWebDarkMagenta
clWebDarkOliveGreen
clWebDarkOrange
clWebDarkOrchid
clWebDarkRed
clWebDarkSalmon
clWebDarkSeaGreen
clWebDarkSlateBlue
clWebDarkSlategray
clWebDarkTurquoise
clWebDarkViolet
clWebDeepPink
clWebDeepskyBlue
clWebDimGray
clWebDodgerBlue
clWebFirebrick
clWebFloralWhite
clWebForestGreen
clWebGainsboro
clWebGhostWhite
clWebGold
clWebGoldenRod
clWebGray
clWebGreen
clWebGreenYellow
clWebHoneydew
clWebHotPink
clWebIndianRed
clWebIndigo
clWebIvory
clWebKhaki
clWebLavender
clWebLavenderBlush
clWebLawnGreen
clWebLemonChiffon
clWebLightBlue
clWebLightCoral
clWebLightCyan
clWebLightGoldenrodYellow
clWebLightGreen
clWebLightgrey
clWebLightPink
clWebLightSalmon
clWebLightSeaGreen
clWebLightSkyBlue
clWebLightSlateGray
clWebLightSteelBlue
clWebLightYellow
clWebLime
clWebLimeGreen
clWebLinen
clWebMagenta
clWebMaroon
clWebMediumAquamarine
clWebMediumBlue
clWebMediumOrchid
clWebMediumPurple
clWebMediumSeaGreen
clWebMediumSlateBlue
clWebMediumSpringGreen
clWebMediumTurquoise
clWebMediumVioletRed
clWebMidnightBlue
clWebMintcream
clWebMistyRose
clWebMoccasin
clWebNavajoWhite
clWebNavy
clWebOldLace
clWebOlive
clWebOliveDrab
clWebOrange
clWebOrangeRed
clWebOrchid
clWebPaleGoldenrod
clWebPaleGreen
clWebPaleTurquoise
clWebPaleVioletRed
clWebPapayaWhip
clWebPeachPuff
clWebPeru
clWebPink
clWebPlum
clWebPowderBlue
clWebPurple
clWebRed
clWebRosyBrown
clWebRoyalBlue
clWebSaddleBrown
clWebSalmon
clWebSandyBrown
clWebSeaGreen
clWebSeashell
clWebSienna
clWebSilver
clWebSkyBlue
clWebSlateBlue
clWebSlateGray
clWebSnow
clWebSpringGreen
clWebSteelBlue
clWebTan
clWebTeal
clWebThistle
clWebTomato
clWebTurquoise
clWebViolet
clWebWheat
clWebWhite
clWebWhiteSmoke
clWebYellow
clWebYellowGreen
clWhite
clWindow
clWindowFrame
clWindowText
?(?>?C?_?l?y?
clYellow
cmd.exe
cMessengerAPI_TLB
>&>;>C>`>m>O?
>C?O?{?
CoAddRefServerProcess
CoCreateInstance
CoCreateInstanceEx
CoInitialize
CoInitializeEx
Color<
Colord+B
COMBOPATH
comctl32.dll
CoMessengerU
command
Command
 Command successfully executed!|
CommCtrl
commdlg_FindReplace
commdlg_help
CompareStringA
COMSPEC
connect
ConnectKind
Constraints
Consts
CONTINUE_P
Contnrs
Control
CONTROLIO
ControlOfs%.8X%.8X
Control Panel\Desktop
Controls
&Controls
ControlService
CopyEnhMetaFileA
CopyFileA
CopyMode,-B
CoReleaseServerProcess
CoResumeClassObjects
CoSuspendClassObjects
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles
crAppStart
crArrow
crCross
crDefault
crDrag
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBitmap
CreateDIBSection
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateFontIndirectA
CreateHalftonePalette
CreateIcon
CreateMenu
CreateMutexA
CreatePalette
CreatePenIndirect
CreatePipe
CreatePopupMenu
CreateProcessA
CreateRemoteThread
CreateServiceA
CreateSolidBrush
CreateThread
CreateToolhelp32Snapshot
CreateWindowExA
crHandPoint
crHelp
crHourGlass
crHSplit
crIBeam
crMultiDrag
crNoDrop
crSize
crSizeAll
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crSQLWait
crUpArrow
crVSplit
CryptApi
;+;C;R;Z;f;s;
;C<S<`<q<|<
$;Ctt?
?"?C?\?u?
Currency
CurrentControlSet
CurrentVersion
Cursor
CutMultiFiles
CUxTheme
CVariants
C(_^[Y]
=$=D=\=
D57ABA5857F0AFF67584605E90BE4665C9814BEEC7ED390E0271A42F098683FF146F5F3CD58FDA8B3FFF2C0F3A06B8B57BFD53FF95B7DF4AC7EDF9F80DE87EFB56127704CE8AC598566BB4B78C91E0E9072494578B41ABCC7D3FE2BA38134312926166B989328747EC8F6E4B9FCC1FB1B6818F105F38C004FD0F50C3A3A96359455913308854DADD295D1625C3F886FF407A522661757C5B1503D4609F0FFCACD91CB779FC6FAD8E4CF9A564FA78D325DF45F469ECF8E1C6B11F8275F817CE5DED8B7E6F0292792AC0CAB846DBAAF12AACF28D7D988B616DCAFE12FBD42EE9830FEEDB5E0B3027FED23B0B052B9AFA84237821C08615FC41250BA7C22BEF05EEFBE36AD7D3B05E9733B3EDA06688788FB3BEB1CE984DAA1A9F1536FFE98154D75E36388FBA2CFE68ACC3F2FE589326435ECE7DBD9199C819AAF43B7714F2BD9ADAD5D46391D419EEF5F19CECD48A63EA3AC113153B622A0B71BA72B365A0706A172E900E1F498BC607D7A3A5858CD314E6DFDFBC196F4DD85EF50A77C3C8679AD55DF8B1900D4017AF010AFC777FF00278E2835DAFA8F9A6895A92A8B8C271CC20FF2B16FADEB6PA
`.data
data error
DATAFLUX
DataSize: 
 Days and 
DC2_USERS
DC3_FEXEC
DCDATA
_DCEntryPoint
dclogs\
DCMUTEX
DCPERSFWBP
DCSC_CHATNUDGE
DCSC_CHATRELOAD
DCSC_DESTROYCHAT
DCSC_GRABPWDS
DCSC_INITCHAT
DCSC_POSTDATA
D$(#D$8
%d.%d.%d.%d
> >$>(>,>D>d>l>p>t>x>|>
?D?d?l?p?t?x?|?
DDOSHTTPFLOOD
DDOSSYNFLOOD
DDOSUDPFLOOD
Decimal
Default
DEFAULT_CHARSET
DefaultMonitor
DEFAULT MONITOR (DISPLAY)
DefFrameProcA
 deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly 
DefMDIChildProcA
DefWindowProcA
DelContact
DelDir
dElElElElElElElEl
DeleteCriticalSection
DeleteDC
DeleteEnhMetaFile
DeleteFileA
DeleteFiles
DELETELOG
DeleteMenu
DeleteObject
DeleteReg
DeleteService
DelMSKey
Delphi%.8X
Delphi Component
Delphi Picture
Description
DesignSize
DESKTHMB
DESKTOP
DESKTOPCAPTURE
DESKTOPSTOP
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
D$HPkD$TdPV
Dialogs
DIRATTRIB
DirectDraw
DirectShow9
DirectShow9'
DirectShow9	
DirectSound
DisabledTaskManager
DisableNotifications
DisableRegistryTools
DisableStartButton
DisableTaskMgr
Dispatch
DispatchMessageA
DispatchMessageW
DISPCAMS
DISPLAY
DisplayName
DisplayVersion
dkDock
dkDrag
D$LPkD$XdPV
D$LPkD$XdPW
dmActiveForm
dmAutomatic
	dmDesktop	dmPrimary
dmMainForm
dmManual
DockClient
DockSite
DOSCAP
DosDateTimeToFileTime
Double
[DOWN]
DownloadFail
DOWNLOADFILE
DOWNLOADFOLDER
DownloadSuccess
=+=D=P=Z=g=o=
DragKind
DragMode
DragObject
DragQueryFileA
DrawEdge
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
DrawThemeBackground
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeText
drivers\etc\hosts
Drives
=D=R=k=l>
dsDragEnter
dsDragLeave
dsDragMove
dStdCtrls
><?D?S?[?v?|?
DUntScreenThumb
dUntSearchThread
dUntSynFlood
>	?#?D?U?p?u?
DVCLAL
DwmApi
DWMAPI.DLL
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled
DWNFOLDERRES
DXTypes
:.:D:Z:_:d:z:
<"=*=@=E=^=
EAbort
EAbstractError
EAccessViolation
EActnList
EAssertionFailed
EASTEUROPE_CHARSET
EBitsError
EClassNotFound
EComponentErrorprA
	EControlC
EConvertError
EDITSVR
EDivByZero
EDTDATE
EDTPATH
E`E`E`E`E`E`E`E`
E`E`E`E`E`E`E`E`E`E`E`E`E`E`E`E`E
	EExternal
EExternalException
EFCreateError
EFilerError
EFileStreamError
EFOpenErrorDoA
EHeapException
EHelpSystemException
EInOutErrorH
	EIntError
EIntfCastError
EIntOverflow
EInvalidCast
EInvalidGraphic4)B
EInvalidGraphicOperation
EInvalidOp
EInvalidOperation
EInvalidPointerx
:;<E<k<u<
EListError
EMathError
EMenuError
|$( EMFt
EmptyBin
EmptyClipboard
EmptyWorkingSet
Enabled
Enabled<
Enabled|
EnabledStartButton
EnabledT
EnabledTaskManager
EnableFirewall
EnableLUA
EnableMenuItem
EnableScrollBar
EnableThemeDialogTexture
EnableTheming
EnableWindow
EndBufferedPaint
EndPaint
EndReceive
ENDSNAP
EnterCriticalSection
EnumCalendarInfoA
EnumChildWindows
EnumClipboardFormats
EnumDeviceDrivers
EnumDisplayDevicesA
EnumDisplayMonitors
EnumProcesses
EnumProcessModules
EnumResourceNamesA
EnumServicesStatusA
EnumThreadWindows
EnumWindows
	EOleError
EOleException
EOleSysError
EOSError
EOutOfMemory
EOutOfResources
	EOverflow
EPrivilege
E$PVSj
EqualRect
ERangeError
EReadError
ERegistryException
EResNotFound
;E;R;^;f;v;
ERR|Cannot listen to port, try another one..|
ERR|Socket error..|
ESafecallException
ESocketError
EStackOverflow
EStreamError
EStringListError
EThread
?+?:?E?T?\?l?{?
EUnderflow
EVariantArrayCreateError
EVariantArrayLockedError
EVariantBadIndexError
EVariantBadVarTypeErrorX
EVariantDispatchError
EVariantError
EVariantInvalidArgError
EVariantInvalidOpError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantOverflowError
EVariantTypeCastError
EVariantUnexpectedError
;'<?<E<W<i<~<
EWriteErrorLpA
	Exception
ExcludeClipRect
ExitProcess
ExitThread
ExitWindowsEx
ExplicitHeight
ExplicitLeft
ExplicitTop
ExplicitWidth
explorer.exe
Explorern
ExtCtrls
ExtTextOutA
EZeroDividel
:$:?:f:
><?F?{?
FAKEMSG
FastMM Borland Edition 
FComObj
-ffff!
File Attrib : [ 
FILEATTRIB
FILEBOF
FILEEND
FILEEOF
FILEERR
file error
FILEM002
FILEM004
FILEM005
FILEM006
FILEM007
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FILETRANSFER
FillRect
FILM003
FinalizeSections: VirtualProtect failed
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
FindWindowExA
FirewallPolicy
>F>J>N>R>V>Z>^>
?+?\?f?l?
;-;F;+<><L<[<
FlatSB
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FMGRSC
:!:):F:N:R:e:m:q:
FormatMessageA
Forms]
Forms0
FormsL
FormsP
	FormStyle<
  FourCC: 
	fpDefault
fpFixed
FPUMaskValue
fpVariable
FrameRect
FreeLibrary
FreeResource
#FreezeIO
fsBold
f;sDt~f
fsItalic
fsMDIChild	fsMDIForm
fsNormal
fsStayOnTop
fsStrikeOut
fsUnderline
FTPFILEUPLOAD
FTPHOST
FTPPASS
FTPPORT
FtpPutFileA
FTPROOT
FTPSIZE
FTPUPLOADK
FTPUSER
=-=f=v=
@?:F?v
G0Y0n0
GateWay
:GauQFKu
GB2312_CHARSET
gdi32.dll
GdiFlush
GdipAlloc
GDIPAPI
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipDisposeImage
GdipDrawImageRectI
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
gdiplus.dll
GdiplusShutdown
GdiplusStartup
,GDIPOBJ
GdipSaveImageToStream
GdipSetInterpolationMode
"GDIPUTIL
GENCODE
GetACP
GetActiveObject
GetActivePorts
GetActiveWindow
GetAppList
GetBitmapBits
GetBrushOrgEx
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
#GetClipboardText
GetClipBox
GetClipF
GetClipT
GetCommandLineA
GetComputerNameA
GetCPInfo
GetCurrentHwProfileA
GetCurrentPositionEx
GetCurrentProcess
GetCurrentProcessId
GetCurrentThemeName
GetCurrentThread
GetCurrentThreadId
GetCursor
GetCursorPos
GetDateFormatA
GetDCEx
GetDCOrgEx
GetDesktopWindow
GetDeviceCaps
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetDIBColorTable
GetDIBits
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GETDRIVEINFO
GetDrives
GetDriveTypeA
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetEnvironmentVariableA
GetErrorInfo
GetExitCodeProcess
GetExitCodeThread
GetFileAttrib
GetFileAttributesA
GetFileSize
GetFileTime
GetFileType
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFocus
GetForegroundWindow
GetFullInfo
GetFullPathNameA
gethostbyaddr
gethostbyname
gethostname
GetHostsFile
GetIconInfo
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardState
GetKeyboardType
GetKeyNameTextA
GetKeyState
GetLastActivePopup
GetLastError
GetLastInputInfo
GetLocaleInfoA
GetLocalTime
GETLOGSHISTORY
GetLongPathNameA
GetMappedFileNameA
GetMappedFileNameW
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessageA
GetMessagePos
GetMiniWind
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameA
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleHandleA
GetModuleInformation
GetMonitorInfo
GetMonitorInfoA
GetMonitorInfoW
GETMONITORS
GETMSNINFO
GetMsnList
GetObjectA
GetOfflineLogs
GetPaletteEntries
GetParent
GetPixel
GetPrivilege
GetProcAddress
GetProcessHeap
GetProcessMemoryInfo
GetPropA
GetRgnBox
#GetScreenSize
GetScrollInfo
GetScrollPos
GetScrollRange
getservbyname
GetServList
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
GetSIN
getsockname
GetSrchDrives
GetStartupInfoA
GetStartUpList
GetStdHandle
GetStockObject
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDirectoryA
GetSystemInfo
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemPowerStatus
GetTempPathA
GetTextExtentPoint32A
GetTextMetricsA
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundRegion
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThreadContext
GetThreadLocale
GetTickCount
GetTokenInformation
GetTokenInformation error
GetTopWindow
GetTorrent
GetUserDefaultLangID
GetUserNameA
GetVersion
GetVersionExA
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowsDirectoryA
GetWindowTextA
GetWindowTextLengthA
GetWindowTheme
GetWindowThreadProcessId
GetWinMetaFileBits
?/???G?g?w?
GlassFrame.Bottom
GlassFrame.Enabled
GlassFrame.Left
GlassFrame.Right
GlassFrame.SheetOfGlass
GlassFrame.Top
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
GMD5Api
GMMSystem
Graphics
+Graphics
GraphUtil
GREEK_CHARSET
GroupIndex
<H=[=|=
=+>=>H>
Handled
HANGEUL_CHARSET
HARDWARE\DESCRIPTION\System
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Heap32First
Heap32ListFirst
Heap32ListNext
Heap32Next
HeapAlloc
HeapFree
HEBREW_CHARSET
Height
HelpContext
HelpContext\mA
HelpFilep
:	HelpIntfs
:	HelpIntfs	
HelpKeyword
HelpType
HideClock
HideDeskTop
HideFolder
HideStartButton
HideSystemTrayIcons
HideTaskBar
HideTaskBarIcons
HitTest
HitTestThemeBackground
>%>H>k>
HKNewExpandString
HKNewInt
; ;@;`;h;l;p;t;x;|;
= =@=H=L=P=T=X=\=`=d=h=|=
HorzScrollBar
HorzScrollBarp
Host: 
=h=p=c>|>
Ht Ht.
	htKeyword	htContext
http://
HTTP://
HttpQueryInfoA
;~hu	3
=H=U=a=j=p=}=
hUntSendStream
HWINDSENDTEXT
:H;X;h;t;
>">;>i>
<^<I=~=
='=;=I=]={=
IAMStreamConfig4
IAMVideoProcAmp4
IBaseFilterP
ICaptureGraphBuilder24
IChangeNotifier4
ICustomHelpViewer4
.idata
Identifier
IDesignerHook8
IDesignerNotify4
	IDispatch4
IDockManager4
IDTYPE
IExtendedHelpViewerl
IFilterGraph4
Ignore
IgnoreFontProperty
IGraphBuilder
IHelpSelector4
IHelpSystem4
Ih;J4u
IHV_END
IHV_START
IInterface
IKsPropertySet4
image/bmp
ImageHlp
ImageIndex
image/jpeg
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_Write
ImageList_WriteEx
Images
IMediaControld
IMediaEventd
IMediaEventEx$
IMediaFilter4
IMessenger2h
IMessenger3
IMessengerd
ImgList
imm32.dll
ImmGetCompositionStringA
ImmGetContext
ImmGetConversionStatus
ImmIsIME
ImmNotifyIME
ImmReleaseContext
ImmSetCompositionFontA
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetOpenStatus
incompatible version
incorrect data check
incorrect header check
	Incrementh
inet_addr
inet_ntoa
 inflate 1.2.3 Copyright 1995-2005 Mark Adler 
InflateRect
InfluenceRect
INFNAN
infoes
IniFiles
InitializeCriticalSection
InitializeFlatSB
InitializeProcessForWsWatch
;$<I<N<k<{<
InsertMenuA
InsertMenuItemA
INSTALL
InstallHKEY
InstallLocation
InstallService
insufficient memory
Integer
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InternetCloseHandle
InternetConnectA
\Internet Explorer\iexplore.exe
InternetOpenA
InternetOpenUrlA
InternetReadFile
IntersectClipRect
IntersectRect
Interval\mA
InvalidateRect
invalid bit length repeat
invalid block type
invalid code lengths set
invalid distance code
invalid distances set
invalid distance too far back
invalid literal/length code
invalid literal/lengths set
invalid stored block lengths
invalid window size
Invisible
ioctlsocket
IOleForm4
 IP : 
IPersist4
 IP Mask : 
%IPPORTSCAN
?'?/?I?Q?
ISampleGrabber4
ISampleGrabberCB4
IsAppThemed
IsBadReadPtr
IsChild
IsClipboardFormatAvailable
IsControl
IsDialogMessageA
IsDialogMessageW
IsEqualGUID
IsIconic
 is now open!|
IsRectEmpty
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
IStringsAdapter4
IsValidSid
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsWow64Process
IsZoomed
<%<<<i<t<
`.itext
iUntProcess
IUntSocks5
IVideoWindowd
I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!
=+=:=I=X=g=!>
;*;=;J;g;p;
JOHAB_CHARSET
=-===J=P=e=k=x=
=!=J=S=
<+=J=T=c=
Jt'Jt5
:J;v;E<I<M<Q<U<Y<]<a<e<i<m<q<u<y<}<
=J>V>e>p>{>
;?;J;X;
<+<:<J<Y<j<w<
=->;>K>~?
K1[1S3c3~3E4J4O4c4
KACMConvertor
KbdLayerDescriptor
#KCMDDC51#-
kD$PdP
kD$TdP
#KEEPALIVE#
kernel32
kernel32.dll
<,<K<]<e<x<
keybd_event
KeylogOn
KEYNAME
KeyPreview
KILLPID
KillProcess
KILLREMOTESHELL
KillSProcess
KillTimer
K,;K$u
K\;K|wY
; ;$;(;,;k;o;s;
:+:K:q:
Kt;K|sy
KWindows
~KxI[)
=?>`>l>
>%>,>L>a>
LanErr
LanList
Layout File
layout text
>L?c?l?
LeaveCriticalSection
[LEFT]
Limited
LineTo
ListCam
listen
L$(#L$<
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadLibraryA
LoadLibraryExA
LoadResource
LoadStringA
LocalAlloc
Local drive (default)
LocalFileTimeToFileTime
location
LockComp
LockResource
LockWorkStation
LogOffComp
LongWord
LookupAccountSidA
LookupPrivilegeDisplayNameA
LookupPrivilegeNameA
LookupPrivilegeValueA
 Loopback interface
;L;P;T;
:l;p;t;x;|;
lstrcpyA
lstrcpynA
lstrlenA
l$()t$,
L$%#T$
maActivate
maActivateAndEat
maAutomatic
maBottomToTop
MAC_CHARSET
	maDefault
Magellan MSWHEEL
MAINICON
maLeftToRight
maManual
maNoActivate
maNoActivateAndEat
maNone
maParent
MapViewOfFile
MapVirtualKeyA
MapWindowPoints
Margin
Margins
maRightToLeft
MaskBlt
maTopToBottom
	MaxHeight
Maximize
Maximized
MaxWidth
mbBarBreak
mbBreak
mbLeft
mbMiddle
mbNone
mbRight
mciSendStringA
=MD5Core
Md5GetFromFile
md5result
MDICLIENT
m/d/yy
memory allocation failed!
MenuAnimation
Menus@*D
MessageBoxA
MessengerAPI_TLB
MessengerAPI_TLB"
?M?_?h?
Microsoft
	MinHeight
Minimize
Minimized
MinWidth
MJPGte
MkeDir
mmmm d, yyyy
:mm:ss
Mode(*B
Module32First
Module32FirstW
Module32Next
Module32NextW
MODULES
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MONSIZE
MONSIZE0x0x0x0
MouseActivate
mouse_event
MousePos
MouseZ
MoveFileA
MoveFold
MoveToEx
Mozilla
msacm32.dll
MSGBOX
MSGCORE
MSGICON
MSGTITLE
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
MSH_SCROLL_LINES_MSG
MSH_WHEELSUPPORT_MSG
MSNAWAY
MSNBUSY
MSNINFO
MSNOFFINE
MSNONLINE
MSNSIGNOUT
MS Sans Serif
MS Shell Dlg 2
MSWHEEL_ROLLMSG
MulDiv
MULTIBIND
MultiByteToWideChar
MultiMon
MULTIPLUGS
mUntSendDataFluxThread
::;?;M;V;
myappname
=!>/>N?
N0Y0f0q0
nduCType
nduEapTypes
nduL2cmn
:nduNtDDNdis
nduWinDot11
=nduWinNT
nduWlanAPI
need dictionary
netapi32.dll
NetApiBufferFree
Netbios
NETDATA
NETDRV
NetShareEnum
NetShareGetInfo
net start uxsms
netstat -a -n -o
net stop uxsms
Network
 Network interface
Neutral
NewFrame
	NewHeight
\newl\
NewLeft
	NewTarget
NewTop
NewWidth
NoControlPanel
Normal
Normal/Unactive
Not Available
notepad
notepad.exe
NoToAll
=;>N>S>^>p>
ntdll.dll
Nt Nt,
NtQuerySystemInformation
NtUnmapViewOfSection
[NUM_LOCK]
NUntPluginsData
>N?V?{?
ObjectMenuItem
odComboBoxEdit
odDisabled	odChecked	odFocused	odDefault
odGrayed
odHotLight
odInactive	odNoAccel
odNoFocusRect
odReserved1
odReserved2
odSelected
OEM_CHARSET
OemToCharA
Offline
OFFLINEK
OffsetRect
< of the Normal
> of the Normal
OK|Successfully started..|
=/=O=l=
OldCreateOrder
ole32.dll
oleaut32.dll
OleConst
OleMainThreadWndClass
OleServer
	OleServer
OleStr
OleVariant
OnActivate
OnAdvancedDrawItemD!D
OnAlignInsertBeforeh
OnAlignPosition
OnAlignPositionp
OnCanResize\mA
OnChange
OnChange\mA
OnClick
OnClick` D
OnClose\mA
OnCloseQueryP
OnCloseT
OnConstrainedResize
OnContextPopup\mA
OnCreate\mA
OnDblClick\mA
OnDeactivate
	OnDestroy\mA
OnDockDrop
OnDockOver
OnDragDrop`
OnDragOverH
OnDrawItem
	OnEndDockT
OnGetSiteInfo\mA
OnHelp
OnHide
	OnKeyDown$
OnKeyPress
OnKeyUp 
Online
ONLINESTROKES
ONLINESTROKES\newl\:: 
OnMeasureItem
OnMouseActivateD
OnMouseDown\mA
OnMouseEnter\mA
OnMouseLeave
OnMouseMoveD
	OnMouseUp
OnMouseWheelDownh
OnMouseWheelh
OnMouseWheelUp\mA
OnPaint\mA
OnPopup
OnResize
OnShortCut\mA
OnShow
OnShowSV
OnStartDock
On The Phone
OnTimerSV
OnUnDock
OpenCD
OpenClipboard
OpenProcess
OpenProcessToken
OpenProcessToken error
OpenSCManagerA
OpenServiceA
OpenThemeData
OpenThreadToken
OpenWebPage
OrientationP)B
=+=:=O=^=s=
Out to lunch
out.txt
	OwnerDraw
p5t5x5|5
paCenter
Padding
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
paLeft
Parameters
ParentBiDiMode
ParentBiDiMode<
ParentBiDiMode<*D
ParentColor<
ParentFont,-B
paRight
PASSWORD
PastMultiVM
PatBlt
PAUSED
PAUSED_P
<*<P<b<
PeekMessageA
PeekMessageW
PeekNamedPipe
PERSINST
='=?=P=h=
ping 127.0.0.1 -n 4 > NUL && "
_PinInfo
Pitch<
PixelsPerInch
PlayEnhMetaFile
PlaySoundA
PLUGIN
<'=P=m=
pmAuto
pmBlack
pmCopy	pmNotCopy
pmExplicit
pmMaskNotPen
pmMaskPenNot
pmMask	pmNotMask
pmMerge
pmMergeNotPen
pmMergePenNot
pmNone
pmNotMerge
pmNotXor
pmWhite
poDefaultPosOnly
poDefaultSizeOnly
poDesigned	poDefault
poDesktopCenter
Policies
poMainFormCenter
poNone
poOwnerFormCenter
poPrintToFit
poProportional
	PopupMenu0
	PopupMode
PopupParent
PortScanAdd
poScreenCenter
Position
Position<
POST /index.php/1.0
PostMessageA
PostQuitMessage
PowerOff
PREVIEWF
Printers
PrintScale
PrintText
PROCESS
Process32First
Process32FirstW
Process32Next
Process32NextW
ProgIDFromCLSID
Progman
:-:P:s:
psAlternate
PSAPI.dll
psClear
psDash
psDashDotDot
psDot	psDashDot
psInsideFrame
psSolid
P?:S?u
psUserStyle
PtInRect
Publisher
P\YZ_^
>!?:?Q?
Q<]_^[
qComConst
:*;Q;l;
QQQQQQQQS3
QQQQQQQQSV
QQQQQQQQSVW
QQQQQQQQSVW3
QQQQQQQS
QQQQQQQSV
QQQQQQQSVW
QQQQQQSV
QQQQQQSVW
QQQQQQSVW3
QQQQQSVW
QQQQS3
QQQQSV
QQQQSVW
QTypInfo
QueryPerformanceCounter
QueryServiceStatus
QueryWorkingSet
QUICKUP
>	?$?R?{?
R0_^[]
R0]_^[
R0Z_^[
	RadioItemDmA
RaiseException
R ;C0|
R,;C4}!
.rdata
ReadFile
Read-Only
ReadProcessMemory
RealizePalette
Real Time
ReBarWindow32
Rebuild
RectVisible
Redirection
RedrawWindow
RefreshClipboard
RefreshList
REFRESHLOGS
REFRESHMODS
REFRESHPROC
RefreshSIN
REFRESHWIFI
REG_BINARY
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
REG_DWORD
RegEnumKeyExA
RegEnumValueA
REG_EXPAND_SZ
RegFlushKey
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegStr
REG_SZ
RELATEDCMD
ReleaseCapture
ReleaseDC
@.reloc
RemoteMachineName
#RemoteScreenSize
Removable
RemoveMenu
RemovePropA
RemoveServices
RenameFile
RenAppReg
ResetEvent
Resize
RESMON
RestartComp
RestartServer
RestartSocket
RestoreDC
ResultAttrib
ResumeThread
r*-H420to-
RHelpIntfs
Right<
[RIGHT]
rmdir "
RPCLanScan
R@PSWV
RSNA_PSK
"RTLConsts
RtlUnwind
RUNNING
RunPrompt
RunSelectedAsAdmin
RunSelectedHidden
RunSelectedShow
Runtime error     at 00000000
RUntRC4
RUSSIAN_CHARSET
<R=V=Z=b=h=
R\Z_^[
<'<,<s<
S`]_^[
S$_^[]
S	_^[]
S0_^[]
S0_0f0x0
;s0t=;
S8_^[]
sActiveX
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SAPI.SpVoice
SaveDC
Scaled
%s, ClassID: %s
ScreenSaver
ScreenSnap
ScreenToClient
ScrollWindow
Sd]_^[
SEARCHFILES
Security Center
select
Selected
SelectObject
SelectPalette
#SendClip
Sender
SendFilesToTrash
SendMessageA
SendMessageW
#SendTaskMgr
sendto
SendYourClipboard
:S;e;p;{;
server
SERVER
Services
SeShutdownPrivilege
SetActiveWindow
SetBkColor
SetBkMode
SetBrushOrgEx
SetCapture
Set cdaudio door closed wait
set cdAudio door open
SetClassLongA
SetClipboardData
SetCursor
SetCursorPos
SetDIBColorTable
SetEndOfFile
SetEnhMetaFileBits
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetFocus
SetForegroundWindow
SetLastError
SetLayeredWindowAttributes
SetMenu
SetMenuItemInfoA
SetParent
SetPixel
SetPropA
SetRect
SetROP2
SetScrollInfo
SetScrollPos
SetScrollRange
SetStretchBltMode
SetTextColor
SetThemeAppProperties
SetThreadContext
SetThreadLocale
SetThreadPriority
SetTimer
SetViewportOrgEx
SetWindowLongA
SetWindowLongW
SetWindowOrgEx
SetWindowPlacement
SetWindowPos
SetWindowsHookExA
SetWindowTextA
SetWindowTheme
SetWinMetaFileBits
" +s +h
SharedAccess
SheetOfGlass
shell32.dll
SHELL32.DLL
*ShellAPI
ShellExecuteA
ShellExecuteExA
Shell_traywnd
Shell_TrayWnd
SHEmptyRecycleBinA
SHFileOperationA
SHFolder.dll
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHIFTJIS_CHARSET
(ShlObj
ShortCut
%ShortCut#
ShortCutText
ShortInt
ShowClock
ShowDeskTop
ShowFolder
ShowHint<
ShowOwnedPopups
ShowScrollBar
ShowStartButton
ShowSystemTrayIcons
ShowTaskBar
ShowTaskBarIcons
Show/Unactive
ShowWindow
Sh#S0f
shutdown
Shutdown
Single
SizeofResource
)sl)sh)kX
Smallint
Smooth<
SnapBufferp
[SNAPSHOT]
socket
Sockets
SOCKS5CLOSE
SOCKS5FLUSH
SOCKS5STATUS
Software
Software\Borland\Delphi\Locales
SOFTWARE\Borland\Delphi\RTL
Software\Borland\Locales
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\
\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Software\Microsoft\Windows NT\CurrentVersion\Winlogon
SOUNDCAPTURE
SOUNDSTOP
Source
Source	TMenuItem
\space\
SpeakerVoice
%s, ProgID: "%s"
" /s /q
SrchDrives
%s (%s)
ssCtrl
ssDouble
ssFlat
ssHotTrack
ssLeft
ssMiddle
	ssRegular
ssRight
S(;S$s
ssShift
StandardProfile
STARTED
StartServiceA
StartServices
 Status : DOWN
 Status : UP
StdActns
StdVCL
StJ)Sp
STOPED
STOPED_P
STOPSEARCH
StopServices
stream end
stream error
StretchBlt
string
String
StringFromCLSID
Strings
Style<
SubMenuImages
SUBMREMOTESHELL
SuccesProc
) successfully dump in 
SVQh 7H
SvrUninstall
;;;S;X;_;d;k;v;
sx;P`u
S`_^[Y]
S$_^[Y]
SYMBOL_CHARSET
SyncObjs
SysAllocStringLen
SysConst
SYSERRCannot create the output file!
SYSERRCannot open remote process for reading..
SYSERRNot a valid range set!
SysFreeString
SYSINFO
SYSINFORemote process (
SysInit
SysListView32
SysReAllocStringLen
System
SYSTEM
SystemBiosDate
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Services\
systeminfo
SystemParametersInfoA
SysUtils
S`Z]_^[
<*t"<0r=<9w9i
t9;wlt4
TACMConvertor
TACMIn
TActionLinkSV
TAdvancedMenuDrawItemEvent
tagEXCEPINFO 
tagMULTI_QI
Tahoma
TAlign
TAlignInfo
TAlignInsertBeforeEvent
TAlignPositionEvent
TAnchorKind
TAnchors
TApplication
TApplicationd
Target
TaskbarCreated
taskmgr
taskmgr.exe
TAsyncTask
TBaseDragControlObject
TBaseDragControlObjectX
TBaseSocket
TBaseSocketlMG
TBasicAction
TBasicActionD
TBasicActionLink
	TBiDiMode
TBitmap
TBitmapCanvas
TBitmapImage
TBitmapp6B
tbLeftButton
TBorderIcon
TBorderIcons
TBorderWidth
tbRightButton
TBrush
TBrushResourceManager
TBrushStyle
TByteArray
t';C8u
TCanResizeEvent
TCanvas
TCanvasd0B
TCaption
TCaptureWebcam
TChangeLink
tcHt(Ht3
TClassFinder
TClipboard
TClipboard|
TClipboardFormats
TCloseAction
TCloseEvent
TCloseQueryEvent
TColor
TCommonDialog
TComponent
TComponentd
TComponentName<
TConnectionHandler
TConnectKind
TConstrainedResizeEvent
TConstraintSize
TContainedAction
TContextPopupEvent
TControl
TControlActionLink
TControlCanvas
TControlScrollBar
TControlScrollBarP
TCriticalSection
TCursor
TCustomAction
TCustomActionList
TCustomActionListL
TCustomControl
TCustomControlAction
TCustomControlAction@
TCustomDockForm 
TCustomDockFormp
TCustomForm
TCustomImageList
TCustomIpClient
TCustomIpClientLOG
TCustomMemoryStreamTzA
TCustomVariantType
TDataThread
	TDCWebCam
TDefaultMonitor
TDockDropEvent
TDockOverEvent
	TDockTree
	TDockZone
TDownloaderThreadU
TDragControlObject
TDragControlObjectEx
TDragDockObject
TDragDockObject8
TDragDockObjectEx
TDragDropEvent
	TDragKind
	TDragMode
TDragObject
TDragOverEvent
TDragState
t$;^dt
TDumpThread
TEndDragEvent
TerminateProcess
	TErrorRec
TEvent
TExceptRec
TextHeight
	TFileName
TFiler
TFileStream
TFont0-B
TFontCharset
	TFontName
TFontPitch
TFontStyle
TFontStyles
TForm4
TFormBorderStyle
TFormStyle
t"+G4PWV
TGdiplusBase
TGetSiteInfoEvent
TGlassFramet
TGlassFrameT
	TGPBitmap
TGPGraphicsRP
TGPImage
TGraphic
TGraphicsObject,,B
TGraphicsObjectT,B
THAI_CHARSET
THandleObject
THandleStream
THelpContext
THelpEvent
THelpManager
	THelpType
THelpViewerNode
Theme manager 
The sizes of unexpected leaked medium and large blocks are: 
The unexpected small block leaks are:
THintAction
THintActionh
	THintInfo@
THintWindow
This program must be run under Win32
Thread32First
Thread32Next
t%HtIHtm
t:HtVH
	ThumbSize
TIcon87B
TIconImage
TIdentMapEntry
TImageIndex
TImeName
 Times.
TInputsControl
	TIntConst
TInterfacedObject
TInterfacedPersistenthuA
TInterfacedPersistent,uA
	TIpSocket
T$$J;D$ v0
tjHt+Ht7
t%Jt?Jt[
TKeepAlive
	TKeyEvent
TKeyPressEvent
TlHelp32
TlsGetValue
TlsSetValue
	TMainMenu
	TMainMenuh(D
TMargins
TMargins`
TMarginSize
TMemoryStream
TMenuActionLinkH#D
TMenuAnimation
TMenuAnimations
TMenuAutoFlag
TMenuBreak
TMenuChangeEvent
TMenuDrawItemEvent
	TMenuItem
TMenuItemAutoFlag
	TMenuItemH#D
TMenuItemStack
TMenul'D
TMenuMeasureItemEvent
	TMetafile
TMetafileImage
TModuleInfo
TMonitor
TMouse
TMouseActivate
TMouseActivateEvent
TMouseButton
TMouseEvent
TMouseMoveEvent
TMouseWheelEvent
TMouseWheelUpDownEvent
tmpprint.txt
tmp.txt
$TMultiReadExclusiveWriteSynchronizer
TNotifyEvent
t;NtGNtSNt_
ToAscii
TObject
TObject	
ToGetClipT
TOleServer
Toolhelp32ReadProcessMemory
too many length or distance symbols
TOrderedList
*.torrent
TOwnerDrawState
TPadding
TPaddingx
TPatternManagerSV
TPenMode
	TPenStyle
TPersistent
TPersistent<tA
TPicture
TPicture@3B
TPlugThread
TPoint
TPopupAlignment
TPopupFormArray
TPopupList
TPopupMenu
TPopupMenuL+D
TPopupMode
TPopupWndArray
	TPosition
TPrintScale
TPropFixup
TPropIntfFixup
TPUtilWindow
>+?T?q?
TQuickTransfer
TraceResult
TraceRoute
TrackButton
Tracking
_TrackMouseEvent
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
TransparentColort(B
TransparentColorValue<
TrayClockWClass
TrayNotifyWnd
TReader
TReceiveDataFlux
TReceiveFileThread
	TRegGroup
TRegGroups
	TRegistryS
TRemoteShell
TResourceManager
TResourceStream
TSampleGrabberCB
TSampleGrabberCBImpl
TSampleGrabberCBInt
TScanRange
TScreen
TScreen`
TScreenCapture
TScreenThumb
TScrollBarInc
TScrollBarStyle
TScrollingWinControl
TSearchRec`
TSearchThreadU
TSendDataFluxThread
TSendFileThreadU
TServerEventDispatch
TServerReaderU
TSharedImage
TSHFolder
TShiftState
	TShortCut
TShortCutEvent
TShortCutList
	TSiteList
TSizeConstraints
TSocketHost
TSocketPort
TSocks5Config
TSoundCapture
TStack
TStartDockEvent
TStream
TStreamAdapter
TStringItem
TStringList
TStringListPwA
TStrings
TStringStreamX{A
TSynchroObject
;T<`<t<|<
TThemeServices
TThread(
TThreadList
TThreadLocalCounter
TTimer
TTimerx
TTrackButton
t:;t$,v
:T;t;x;|;
TUnDockEvent
TUnitHashArray
TUploadFTP
TURKISH_CHARSET
`;t$ v?
;t$,v:
TVariantArray
TVideoImage
TVideoSample
TVisitThread
tVSVWU
TWinControl
TWinControlActionLink
TWindowState
TWMKey
ty;s@u
u*;~8u
>@?U?d?
u>hHsG
UnActiveOfflineKeylogger
UnActiveOnlineKeylogger
UnActiveOnlineKeyStrokes
UnBlockContact
Unexpected Memory Leak
#UnFreezeIO
UnhandledExceptionFilter
UnhookWindowsHookEx
UninitializeFlatSB
UninstallAPP
UninstallString
unknow
Unknow
UNKNOW
Unknown
Unknown compression
unknown compression method
UnmapViewOfFile
UnrealizeObject
UnregisterClassA
UntActivePorts
UntAntiSB
+UntAsyncTask
(UntBot
UntCaptureWebcam
UntControlKey
UntCore
UntCPU
UntDisableAero
)UntDownloaderThread
UntFTP
UntFun
untFunctions
UntFWB
 UntFWB
UntInfections
"UntIPUtils
UntKeepAlive
UntKeylogger
UntMain
UntMainConnectionThread
UntMClipboard
UntMsConfig
UntMSN
UntNetShareLister
UntProcess
UntQuickTransferThread
UntRC4
UntRDPThread
UntReceiveDataFluxThread
UntReceiveFileThread
UntRegEdit
UntRemoteDesktop
)UntRemoteShell
UntRemoteUtils
UntResizePic
UntRootKit
UntRPCScan
+UntScreenCapture
UntSendFileThread
UntServerReader
UntServices
UntSinInfo
UntSoundCaptureThread
untstartup
_UntUDPFlood
(UntUploadFTPThread
UntVars
UntWebCam
UntWindowManager
UPANDEXEC
UPDATE
UpdatesDisableNotify
UpdateWindow
UPFLUX
UPLOADEXEC
UPLOADFILE
URLDOWNLOADTOFILE
URLDownloadToFileA
UrlMon
URLMON.DLL
URLUpdate
UseDockManager,
user32
USER32
user32.dll
User32.dll
USER32.DLL
Userinit
UserInit
\uTorrent\
UTypes
>U>_>v>
=">U>w>
uxtheme.dll
=/><?v?
>(?_?v?
VarAdd
VarAnd
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCmp
VarCyFromStr
VarDateFromStr
VarDiv
VarI4FromStr
Variant
VariantChangeType
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
Variants
VarIdiv
VarMod
VarMul
VarNeg
VarNot
VarR4FromStr
VarR8FromStr
VarSub
$VarUtils
VarXor
;V<c<}<
Vd;VXr
VendorIdentifier
VerLanguageNameA
VerQueryValueA
version.dll
VertScrollBar
>V?f?q?
`VFrames
VFramesh
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
Visible
Visible<
Visible\mA
VkKeyScanA
;*;@;V;l;x;
vMenus
>.?;?V?\?p?u?
;-<V<s<
VSample
VWUUhdN@
<"<)<w>
<'<?<W<
:<:W:|:
WaitForMultipleObjectsEx
WaitForSingleObject
WaitMessage
Wallpaper
WallPaper
waveInAddBuffer
waveInClose
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader
WavPlay
;W=c=j=y=
WEBCAMLIVE
WEBCAMSTOP
WEP104
WheelDelta
;%<,<W<`<h<q<
+WH+W@
WideCharToMultiByte
WideString
WideStrUtils
Width<
WidthX
WindowFromPoint
WindowMenu\mA
Windows
Windows 2000
Windows 7
Windows 95
Windows 98
Windows Me
Windows NT 4.0
Windows Server 2003
WindowState
Windows Vista
Windows XP
WinDrive
WinExec
?WinInet
wininet.dll
winmm.dll
WINNLSEnableIME
WinSock
WinSvc
wlanapi.dll
WlanCloseHandle
WlanEnumInterfaces
WlanGetAvailableNetworkList
WlanOpenHandle
WlanQueryInterface
WndProcPtr%.8X%.8X
WPA_NONE
WPA_PSK
WPA_USE_GROUP OR RSN_USE_GROUP
WriteClip
WriteFile
WriteProcessMemory
WS2_32.DLL
WSACleanup
__WSAFDIsSet
WSAGetLastError
WSAIoctl
WSAStartup
wscsvc
wsMaximized
wsMinimized
wsNormal
wsock32.dll
WWinSpool
?"?*?x?
;X0t@S
;X0uG;u
XD;PHu
XRIGHT
XUntHTTPFlood
xUSock
XWHEEL
=Y=a=s=x=
yDirect3D9
YesToAll
>Y?i?t?
<>=Y=l=v=
{<:y&q?	
YStrUtils
YUntScanPorts
-YUNVt=-
_^[YY]
Y_^[Y]
$YZ_^[
$YZ]_^[
YZ]_^[
YZXtm1
(Z]_^[
$Z]_^[
>Z>j>|>
;/<Z<j<
ZLibEx
ZTUWVSPRTj
<:<Z<w<
?=?Z?z?