// Decompiled with JetBrains decompiler // Type: Pharming_V4.criatxtinfect // Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe using Microsoft.VisualBasic.CompilerServices; using System; using System.IO; namespace Pharming_V4 { [StandardModule] internal sealed class criatxtinfect { public static void criatxtinfect() { string path = Path.GetTempPath() + "\\checkinfect.txt"; try { if (File.Exists(path)) return; using (File.Create(path)) ; using (StreamWriter streamWriter = new StreamWriter(path)) streamWriter.Write("infected"); } catch (Exception ex) { ProjectData.SetProjectError(ex); ProjectData.ClearProjectError(); } } } }