Ok, i opened the twunk_64.exe with bintext.exe from Found Stone Tools and i get this lines:

0000343A 0040343A 0 Exclusive Offer from your friends at Scorpion Networks - Microsoft Internet Explorer

00001660 00401660 0 *\AC:\Documents and Settings\Scorpion.SCORPION\Desktop\VB Code\StealthXP\spectre series\diablo\Kemet.vbp


00002160 00402160 0 www.scorpionsearch.com
000021DC 004021DC 0 http://www.scorpionsearch.com/diablo_admin.html
0000A482 0040C482 0 CompanyName
0000A49C 0040C49C 0 Twain Working Group
0000A4CA 0040C4CA 0 FileDescription
0000A4EC 0040C4EC 0 Twain.dll Client's 32-Bit Thunking Server
0000A546 0040C546 0 FileVersion
0000A560 0040C560 0 1,7,1,0
0000A576 0040C576 0 InternalName
0000A590 0040C590 0 Twunk_32
0000A5AA 0040C5AA 0 OriginalFilename
0000A5CC 0040C5CC 0 Twunk_32.exe
0000A5EE 0040C5EE 0 ProductName
0000A608 0040C608 0 Twain Thunker
0000A62A 0040C62A 0 ProductVersion
0000A648 0040C648 0 1,7,1,0


and a lot of references to internet calls so it seem's that it is it


thanks to all